When regulators don't specify verification methods, your compliance statement is crucial in managing enforcement risk. This template provides a structured way to document how you're meeting regulatory obligations when the rules don't prescribe the mechanism.
Purpose of the Template
You're filing a due diligence statement. The regulation requires attestation but doesn't mandate a specific verification method. Your vendor claims their platform ensures compliance, but when regulators ask how you reached your conclusion, "our provider calculated it" won't suffice.
This template documents the methodology behind your compliance statement so you can defend it as your own work. Use it when:
- Filing origin attestations, ESG disclosures, or sanctions compliance statements
- Relying on third-party verification platforms where no government-mandated system exists
- Responding to regulatory inquiries about how you determined compliance
- Conducting internal audits of vendor-supported compliance processes
The EU's March 2025 rough diamond import requirements highlight the gap this template addresses. Importers must present a Kimberley Process certificate listing every country of origin, but the regulation doesn't require the scanning, matching, or blockchain logging that vendors offer. The law asks for documented attestation and leaves the rigor to you.
Prerequisites
Before completing this template, ensure you have:
- The regulatory text: Understand what the rule requires versus what your vendor claims
- Vendor methodology documentation: Request technical specifications, not marketing materials
- Access to underlying data: Trace vendor outputs back to source records
- Internal subject matter expertise: Someone on your team who understands the compliance domain
- Audit trail capability: Ability to independently reproduce the vendor's calculation or verification
If your vendor can't provide methodology documentation or won't explain how their system reaches conclusions, that's a selection problem, not a template problem.
The Template
VENDOR COMPLIANCE STATEMENT
Prepared by: [Name, Title]
Date: [Date]
[Regulatory Obligation](/glossary/regulatory-obligation): [Cite specific regulation, section, effective date]
1. Regulatory Obligation
What the regulation requires us to attest:
[Specific language from the regulation]
What the regulation does NOT specify:
[Verification method, data sources, acceptable evidence types]
2. VERIFICATION METHODOLOGY
We determined compliance using the following approach:
[Describe the process in your own words, not the vendor's marketing copy]
Data sources consulted:
- [List each source: internal records, third-party databases, vendor platform data]
- [For each source, note: who controls it, update frequency, audit status]
Verification steps performed:
- [Step 1: What you checked and how]
- [Step 2: What you validated and against what standard]
- [Step 3: What exceptions you identified and how you resolved them]
3. VENDOR ROLE AND LIMITATIONS
Vendor name and service used: [Specific product/service]
What the vendor provided:
[Data, matching algorithm, blockchain logging, certificate validation, etc.]
What the vendor did NOT provide:
[Final determination, legal interpretation, attestation authority]
Vendor methodology review:
- Methodology documentation reviewed: [Date, version]
- Independent validation performed: [Describe test or spot-check]
- Limitations identified: [Any gaps, assumptions, or caveats in vendor approach]
4. INTERNAL CONTROLS
Control owner: [Name, title]
Segregation of duties:
- Data entry: [Role]
- Verification: [Different role]
- Attestation authority: [Senior role]
Review cadence: [Frequency of methodology review and spot-checks]
Exception handling process:
[How you handle cases where vendor output is unclear or contradictory]
5. SUPPORTING DOCUMENTATION
Records retained for this attestation:
- [List each document type and retention location]
- [Include vendor outputs, internal analysis, exception logs]
Audit trail available: [Yes/No]
If yes, describe: [How you can reproduce the determination]
6. ATTESTATION BASIS
Based on the methodology described above, we attest that:
[Specific compliance statement required by regulation]
This determination reflects our analysis of available evidence as of [Date].
Limitations and assumptions:
[Any material uncertainties, data gaps, or methodological constraints]
Prepared by: _____________________ Date: _________
[Name, Title]
Reviewed by: _____________________ Date: _________
[Senior officer with attestation authority]
Customizing the Template
For origin attestations: In section 2, detail how you traced the supply chain. If using physical mapping or blockchain matching, explain what gets matched to what and what constitutes a valid match. Don't just write "vendor confirmed origin", describe the specific verification steps.
For ESG reporting: In section 3, document which sustainability metrics the vendor calculated versus which ones your team verified independently. If relying on vendor-collected supplier data, explain your validation process for that data.
For sanctions screening: In section 2, specify which watch lists you checked, how you handled name variations, and what threshold you used for potential matches. If your vendor uses proprietary algorithms, document what you understand about those algorithms and what testing you performed.
For consent management: In section 4, describe how you validated that consent records match actual user interactions, not just that the vendor's platform logged something.
Adjust the template's length based on complexity. A straightforward certificate validation might need two pages. A multi-vendor, cross-border supply chain attestation might need ten.
Validation Steps
Before you file the statement:
Test the spot-check: Pick three representative cases. Can you manually reproduce the vendor's conclusion using the methodology you documented? If not, your documentation isn't complete enough.
Run the regulator question drill: Ask someone outside your compliance team to read section 2 and explain back to you how you determined compliance. If they can't, rewrite it.
Check for vendor language: Search your document for the vendor's brand name, product names, and marketing terms. Replace them with functional descriptions. "Tracr blockchain matching" becomes "rough diamond physical characteristic matching logged to distributed ledger."
Document the gaps: If your vendor won't explain their methodology or you can't validate their outputs, document that limitation in section 3. It's better to acknowledge the gap than to pretend it doesn't exist.
Version control: Every time the vendor updates their methodology or you change your process, create a new version of this statement. Your attestation is only as good as your ability to explain what changed and when.
This template won't make a weak vendor methodology defensible, but it will force you to confront whether you actually understand what you're attesting to. If you can't complete section 2 without copying the vendor's marketing materials, you've identified the real compliance gap, and it's not the one the regulator left.
