Third-party risk management that finds your weakest link

AI agents continuously probe the stablecoins, vendors, protocols and infrastructure you depend on, and the providers behind them. See where you break first.

Risk areas

Third-party risk assessment, one agent per risk area

Each agent checks signals relevant to its risk area and the provider type.

Legal and regulatory

Licenses expire, regulators take action and terms change without notice. The agent checks for each in the markets your provider serves you from.

  • Licenses and public register entries, market by market
  • Enforcement actions and regulator notices
  • Changes to terms of service and policies
  • Contract terms checked against your requirements for that provider type

Range-wide monitoring behind every review

$30B+

Protected for Range customers

100+

Stablecoins Range monitors

200+

Networks Range covers

Beyond the questionnaire

See what a vendor questionnaire never asks

A due-diligence questionnaire captures what a provider reports. Agents read token permissions and holdings directly onchain.

Token permission map

See who can mint, upgrade or freeze each token on each network, along with signer thresholds and frozen addresses.

No false all-clear

When a source fails to load, the provider is marked stale with the time of its last successful check.

Holder concentration

See stablecoin holders by category and get an alert when a few wallets accumulate an outsized share.

Dependencies

Fourth-party risk: know the blast radius of every dependency

Map the providers behind each business function. Range tailors assessments to the risks of each crypto, payments and banking provider, so a stablecoin issuer is assessed differently from a cloud host.

  • Provider inventory

    Record each provider's function, tier and contract. Use your ICT provider records to support your register of information.

  • Fourth parties

    See which providers your vendors rely on and where shared dependencies concentrate your exposure.

  • Tiers you own

    Your team tiers providers by whether they support a critical or important function, drawing on DORA's definition. Range uses that tier to set review depth and reassessment frequency.

Trusted across digital-asset operations

How it works

Continuous third-party risk monitoring

  1. 01

    Set your standard

    Start with your third-party policy and existing provider list, from a spreadsheet, your GRC tool or the Range API. Choose which providers to assess, set the criteria for each tier and define alert thresholds.

  2. 02

    Agents run the first review

    Each provider gets a sourced assessment and a drafted questionnaire for your review. Your team approves the assessment.

  3. 03

    Monitor between reviews

    Agents keep checking sources and recording findings on the provider record. Findings reach your systems through the Range API and webhooks.

  4. 04

    Act on change

    Range triggers your chosen action: alert the owner, open a review task, cap new exposure to the provider or switch to the backup provider in your exit plan. Both the finding and action stay on the provider record.

Risk to assurance

Feed third-party findings into compliance assurance

Document provider oversight with sourced assessments, monitoring findings and recorded decisions.

  • Audit-ready records

    Every review, finding and action is saved with supporting evidence, ready for auditors and regulators.

  • Controls tested

    Use Range compliance testing to test the controls that rely on each provider, once or continuously.

A dedicated Range environment for third-party oversight

Run Range as managed SaaS or in a dedicated single-tenant deployment that is isolated, privately connected and encrypted with keys you control. Our engineers run it with your team.

Talk to an expert
    • A separate cloud account, network and database
    • Nothing shared with any other customer
    • Pinned to the region you choose
    • Encrypted with keys held in your own cloud account
    • Revoke a key and the data is unreadable, to us too
    • Staff access only with your approval, always logged
    • Private links from your network, never the public internet
    • Connected to banks and custodians over private links
    • Logs streamed to your own security tools
    • Forward-deployed engineers on your team
    • We deploy, monitor and upgrade it
    • The same platform as our shared cloud
    • An audit trail for every decision
    • Evidence ready for examiners
    • Fits your existing security reviews

Third-party risk questions

What risk teams ask

Yes. Range conducts due diligence on new vendors, assets and protocols, drafts a questionnaire and produces a sourced assessment for your team to approve.

Range drafts and tracks questionnaires and keeps findings and decisions on the provider record. Your GRC tool can pull them through the Range API or webhooks.

More questions on third-party risk, see the full FAQ.

Related reading 1 of 3

Related reading

Indirect exposure under MiCA: What treasury teams need to know about stablecoins

Read the story
Indirect exposure under MiCA: What treasury teams need to know about stablecoins

Review Range the way you review your providers

Range is also one of your providers. Our annual penetration test report and vendor risk pack are available under NDA.

Enterprise uptime SLA

Range publishes an uptime SLA for enterprise customers.

Data protection

Range maintains GDPR-aligned processing, access, retention and privacy controls.

SOC 2 Type II audit

Range is undergoing an independent external SOC 2 Type II audit.

Workspace isolation

Provider records, assessments and decisions are separated between customers.

Bring your provider list

We'll map your dependencies, run a sourced assessment and show you the response your policy triggers.