Vestronis
/Compliance

Governance, integrity and compliance

Governments, development finance institutions and lenders expect their counterparties to operate to recognised integrity standards. This page sets out the policies, controls and due-diligence procedures Vestronis applies. Each policy is published once the board has approved it.

Policy framework

Our core policies

01
Code of Conduct
Standards of behaviour for staff, directors and representatives.
02
Anti-Bribery & Corruption
Zero tolerance for bribery, facilitation payments and improper advantage, including gifts and hospitality controls.
03
Sanctions & Export Controls
Screening of counterparties and beneficial owners against applicable sanctions lists.
04
AML / Know Your Counterparty
Identity, ownership and source-of-funds checks proportionate to risk.
05
Conflicts of Interest
Declaration, recording and management of actual and perceived conflicts.
06
Procurement Integrity
Respect for public-procurement rules and fair treatment of bidders.
07
Data Protection
Personal data processed lawfully, fairly and securely.
08
Environmental & Social Policy
Commitments applied through project screening and action plans.
09
Speak-Up / Whistleblowing
Confidential and anonymous reporting, with protection from retaliation.
Control model

Three lines of accountability

Our control framework follows the Three Lines Model of the Institute of Internal Auditors. Responsibilities are separated so that the people who manage risk are not the people who give assurance on it.

1st
Project & business teams
Own and manage risk in daily work: screening, documentation and decision records.
2nd
Compliance, risk & ESG
Set policy, monitor, challenge and report independently of project teams.
3rd
Independent assurance
Internal audit or an external reviewer reports directly to the Audit & Risk Committee.
Integrity due diligence

Knowing our counterparties

Before a counterparty is engaged, and again at each project gate, we carry out integrity due diligence proportionate to risk. This follows the approach expected by multilateral development banks.

  • Identity and beneficial-ownership verification down to natural persons
  • Screening against UN, EU, UK and US (OFAC) sanctions lists
  • Checks against the cross-debarment lists of the World Bank, EBRD, EIB, ADB, AfDB and IDB
  • Politically exposed person and adverse-media screening
  • Source-of-funds review for equity participants
  • Documented red-flag escalation to the compliance function, with the right to decline
Anti-corruption controls

Preventing improper advantage

GH
Gifts & hospitality
Thresholds, prior approval and a central register. Nothing is offered to public officials during procurement.
TPI
Third-party intermediaries
Agents and consultants are screened, contracted with audit rights and paid only against documented services.
FP
Facilitation payments
Prohibited without exception.
POL
Political contributions
Vestronis makes no political contributions.
DON
Donations & sponsorship
Reviewed for conflicts, including any link to the Kelmendi Foundation, and recorded.
Controls

How policies are applied

Integrity and sanctions screening runs before each project gate. Conflicts are declared at every decision. Policy training is required for staff and representatives, and compliance reports go to the board. Vestronis does not claim certification against any management-system standard unless an accredited certificate is published here.

Data & information security

Protecting personal and confidential data

Personal data is processed in line with Kosovo's Law No. 06/L-082 on Protection of Personal Data, in force since 13 February 2019, which closely transposes the EU GDPR. Where the GDPR applies directly, we comply with it. Our information-security controls are designed with reference to ISO/IEC 27001. This is not a claim of certification.

ACC
Access control
Role-based access, multi-factor authentication and project-level information barriers.
ENC
Encryption
Data encrypted in transit; service providers bound by data processing agreements.
LOG
Logging
Access to confidential documents and data rooms is logged and reviewed.
RET
Retention
Records are kept according to a defined retention schedule.
Speak up

Raising a concern

Anyone, inside or outside Vestronis, can report suspected misconduct through our confidential channel, anonymously if they wish. Reports go only to designated governance oversight personnel, and retaliation against anyone reporting in good faith is prohibited.

→
Whistleblowing channel
Confidential, by email or post, with an option to report anonymously.

Partner with Vestronis

Whether you represent a public authority, an investor or lender, or a technical partner, tell us about the opportunity and we will route it to the right team.