RISK-002 Tokenization Custody Partner Not Yet Licensed

Context

ADR-001-tokenization-platform settled on Polygon plus a licensed third-party custody partner for tokenized media-rights and ticketing assets. Diligence on the custody partner surfaced a gap after the decision was made: their license covers the primary launch market but not the secondary region the roadmap has slotted for the following quarter. This was not caught during vendor selection because the original diligence checklist only asked “are they licensed,” not “licensed where.”

Impact

• Cannot legally custody tokenized assets for secondary-region clients until resolved — this blocks the Q4 expansion milestone in the roadmap, not just a nice-to-have.
• If discovered by a regulator or partner before we disclose it, it’s a compliance finding rather than a managed risk — worse for the relationship and for any future licensing application in that region.

Mitigation

• Legal has opened a scoped application for the secondary-region license; custody partner is co-filing since it’s their license, not ours.
• Roadmap for the secondary region is provisionally slipped one quarter pending license approval — communicated internally, not yet to affected clients.
• Diligence checklist for any future custody or licensing partner now explicitly requires a jurisdiction-by-jurisdiction breakdown, not a single yes/no licensing question.

Owner

Blockchain division lead, with Legal as co-owner on the filing.