Regulatory Map

The rules that touch paid-media finance, and how we sit inside them

Customers’ compliance teams ask the same question in different shapes: where do you fit in our regulatory perimeter? This map is the answer. Reviewed quarterly with external counsel.

Regimes tracked

EU / US / UK / HK / Global

Applies directly

In scope for ADmetric AI

Customer-facing

Pass-through obligations

Counsel review

Quarterly

Last: 2026-06-12

Jurisdiction	Regulation	Scope	Status	Our position	Next change
EU	EU AI Act	Risk-tier classification for AI in finance	Applies directly	Self-classified Limited-Risk; documentation matches Annex IV of Title III	Aug 2026 — GPAI obligations active
EU	DORA	Digital operational resilience for financial entities	Customer-facing	We are a critical ICT third-party provider for regulated buyers; register maintained per Art. 28	Q3 2026 — TLPT exercise with two banking customers
EU	PSD3 / PSR	Payment services regime	Future	We do not hold funds; not in scope. Active monitoring for any change to settlement design	2026 — Council general approach
EU	GDPR	Personal data processing	Applies directly	Controller for marketing data; processor for customer workspace data. DPA + SCCs default	Ongoing — EDPB pseudonymisation guidance
Global	AML / CFT (FATF Rec.)	Anti-money-laundering & counter-terrorist financing	Customer-facing	Invitation-only onboarding with KYB on every workspace; sanctions screening on counterparties	Travel-rule alignment for any future fund-handling design
US	SOX 404	Internal control over financial reporting	Customer-facing	SOC 1 Type II in scope for SOX-relevant customers; control mapping published	Q4 2026 — additional ITGC for AI-driven journals
US	SEC Reg S-P (amended)	Customer information safeguards & incident notice	Monitored	Not directly regulated; aligned to 30-day notice expectation in our SLA	Compliance date Dec 2026 for our larger customers
UK	FCA Operational Resilience	Important business services & impact tolerances	Customer-facing	Mapped as a material outsourced service for two FCA-regulated customers	Annual self-assessment due Mar 2027
HK	Companies Ordinance + IRO	Statutory accounts, audit, tax records	Applies directly	Audited by BDO Hong Kong; 10-year retention enforced	FY26 audit — kickoff Jan 2027
Global	ISO 27001 / SOC 2	Information security management	Applies directly	Both current; controls cross-walked to NIST CSF 2.0	ISO surveillance audit Sep 2026

What this register is, and isn’t

It is our standing position, kept current with counsel. It is not legal advice for your situation. Customers in regulated industries receive a tailored memo and the underlying control evidence on request.