Compliance Policy

This policy applies to the company, its officers, and anyone acting for it, including agents and subcontractors. It covers advisory and valuation work, and the purchase and sale of goods. A counterparty that will not accept these terms is not taken on.

The director is responsible for this policy and for compliance with the Bribery Act 2010. The company does not offer, pay, request or accept bribes or facilitation payments, whether directly or through third parties. No success fees are paid to officials or to anyone connected with a procurement decision. Agents and introducers are appointed in writing, with their fees disclosed to clients where the contract requires it.

Before an engagement is accepted, the director assesses the bribery risk and the reputational risk to the customer. The assessment covers the country, any agent or introducer, and any public official. Work does not start where that risk cannot be mitigated.

The director reads this policy before acting for the company, and reads it again whenever it is changed. Anyone else appointed to act for the company does the same before they act. The director reviews the policy at least once a year, and whenever the work of the company changes, and checks that it has been followed on each engagement.

The company does not offer or accept a gift, hospitality, or anything of value, for an official or for anyone connected with a procurement decision. Any other gift or hospitality is recorded by the director. Cash is never offered or accepted.

A conflict includes acting for more than one party on the same requirement, or taking a fee from a producer as well as from the buyer. The director tells the customer, and any other party affected, before work starts. If the conflict cannot be managed with their agreement, the engagement is refused.

The company does not facilitate tax evasion by a customer, a supplier, an agent, or anyone else acting for it, and it does not ask anyone else to do so. An agent is appointed in writing, and the fee is disclosed where the contract requires it.

Every counterparty, beneficial owner, end user, vessel and destination is screened before work starts and again before goods move. Screening covers the UK sanctions list maintained by OFSI and the FCDO. Where US persons, US-origin goods or US dollars are involved, the OFAC lists are screened as well, and where EU persons or goods are involved, the EU consolidated list.

The director is responsible for export control. The company has been registered with the UK Export Control Joint Unit since August 2026. Goods are classified before an offer is made. Controlled goods move only under a valid export licence from the country they leave. Goods leaving the UK are classified against the UK Strategic Export Control Lists and move only under the appropriate licence issued by the Export Control Joint Unit. The company obtains end-user undertakings where the licence requires them, and it keeps licence records for the retention period the licence sets. Brokering of controlled goods between third countries is done only under the trade control rules. Goods imported into or exported from the United Kingdom are declared to HM Revenue and Customs, and a controlled export is not declared until the licence is in place.

Where the goods are of United States origin, they are classified against the United States Munitions List or the Commerce Control List before an offer, and they move only under the United States authorisation that applies. A Foreign Military Sales case is used only where that case authorises the supply. Controlled goods are not shipped until that licence or authorisation is in place. Where a licence restricts the end user or a further transfer, the buyer is told before the goods move. If goods already supplied are later reclassified as controlled, the buyer is told. The goods are not kept at the company's premises. Technical data for a controlled supply is held under the information-security section. Only the director has access to it, and it is not placed on this website. A suspected breach of export control or sanctions is stopped, reviewed by the director, and reported to the relevant authority where the rules require a report.

Licence numbers and end-user details are given to an identified counterparty on request. They are not published on this website.

Before work starts, the company asks each counterparty for:

• the registered legal name, company number and registered address;
• beneficial owners holding 25 per cent or more, and the directors;
• the end user and end use of the goods, with an end-user statement where a licence requires one;
• evidence of the counterparty's own licences, registrations or permits for the goods;
• the bank that will pay or receive, and the route the goods will take.

Payment for goods is made to the company under the contract. The company is not authorised by the Financial Conduct Authority, does not hold client money, and does not give regulated financial advice.

The company does not accept forced, compulsory or child labour in its own operations or in its supply chains. Suppliers are asked to confirm the same in writing.

The director is responsible for health and safety and reviews this section at least once a year. The company has no factory, warehouse or store, and no employees other than the director. Energetic materials and ammunition are not kept at the registered office and are not handled by the company. Manufacture, storage and carriage sit with the producer, the carrier and the licensed consignee.

The company's own work is office work and travel to meetings. The place of work has drinking water, sanitary facilities and the ability to take a break. Before acting for the company, the director reads this section. Anyone else appointed to act for the company reads it first, and is told to report an injury the same day, not to handle the goods, and to follow the occupier's safety rules on any visit. An injury or a dangerous condition is reported to the director the same day and is recorded. A person who breaches this section stops the activity at once. Anyone appointed to act for the company is stood down from that work until the director decides otherwise.

The director records, for each calendar year, fatalities, major injuries, injuries causing more than seven days of incapacity, injuries to non-workers, and dangerous occurrences. The record is reviewed with this section. There have been none.

A visit to a producer, a range or a storage site is the only work away from the office. It takes place only with the occupier's permission, and only after the occupier has confirmed that a safety briefing will be given. The director does not lift, carry or move energetic materials or ammunition. Manual handling of those goods stays with the occupier. The director does not enter an area zoned for an explosive atmosphere unless the occupier authorises the entry and the occupier's controls are in place. Hearing protection, and any other personal protective equipment, is worn when the occupier requires it. If those controls are not in place, the visit does not proceed. The company holds no safety-critical equipment and runs no goods vehicles or workplace transport.

The company does not use hazardous substances in its own workplace, so no workplace exposure arises and no health surveillance is required for noise, vibration, respiratory disease or skin disease. Asbestos, lead and ionising radiation are not part of the work, so those medicals are not required. This is reviewed if the work changes. On a supply, the producer provides the safety data sheet. Where a supply would place a substance on the GB market, the registration and safety-data-sheet duties that apply to that supply are confirmed before an offer is made. End-of-life disposal is carried out by a licensed party in the country concerned. The goods are not kept at the company's premises, so the Dangerous Substances and Explosive Atmospheres Regulations are not engaged there. On a visit, the occupier's regime applies.

The company has no production site and holds no environmental permit. Its own activity is an office and travel. It does not publish a carbon target and it does not buy offsets.

On a supply, the environmental duties of manufacture, storage and transport sit with the producer and the carrier in the country where that work is done. The company deals only with a producer that holds the permits that activity requires.

The director is responsible for quality. The company does not hold an ISO 9001 certificate, a NATO AQAP approval, or Nadcap approval.

A supply is quoted against a written requirement: the material or nature, the quantity, the specification or recognised standard, and the delivery window. The producer provides the test and acceptance documents named in the contract. The company does not substitute a different grade or nature for the one ordered.

A valuation is scoped in writing before work starts. The report states the information it relies on and the limits of the work.

The director is responsible for product safety. A change from the agreed specification, grade or nature is not made unless the buyer agrees to it in writing. If the goods or the documents do not match the order, or the producer reports a defect, the buyer is told and the goods are not supplied. Anyone acting for the company reports a product-safety concern to the director the same day.

The director is responsible for this section. The company does not supply counterfeit materiel. Goods are sourced from a producer that holds the permits for the work and that supplies the grade or nature ordered, with the test and acceptance documents named in the contract. If the identity, grade or documents do not match the order, the buyer is told and the goods are not supplied. The company does not buy returned goods for supply unless the buyer agrees to that purchase in writing.

The director keeps this list and reviews it with the policy. Each risk is controlled as follows.

• A controlled supply moves without a licence. Goods are classified before an offer, and they move only under a valid export licence.
• A counterparty is sanctioned. Ownership, the end user and the destination are screened before work starts and again before goods move.
• A bribe or a conflict arises. The anti-bribery and conflicts sections apply before the engagement is accepted.
• A producer lacks the permits for the work. The company deals only with a producer that holds them.
• Forced labour is used. The company does not accept it, and suppliers are asked to confirm the same in writing.
• The wrong grade is supplied. The company does not substitute the grade or nature that was ordered.
• The director is unavailable. No other person may accept a new supply or a new valuation until the director returns.
• Customer information is lost or disclosed without authority. It is held only in the company Google account and in Microsoft OneDrive, it is not copied to removable media, and only the director has access. A suspected loss is reported to the customer.

A producer is not used unless it accepts the following. It does not use forced, compulsory or child labour. It holds the permits for its work. It provides the ownership, licence and end-user information the company asks for, and it cooperates with sanctions screening. It does not offer or accept a bribe. It supplies the grade or nature that was ordered, with the safety data sheet and the test and acceptance documents named in the contract. It does not supply returned goods unless the buyer has agreed to that supply in writing. A producer that will not accept these terms is not taken on.

The director is responsible for this section. The company is directed by one person. The work that has to be completed is an accepted supply, an accepted valuation, and the keeping of the contracts, licences and due diligence records. Contracts, licences, due diligence and screening records are kept so that they survive the loss of a single computer, and they are retained for at least six years.

The public website is hosted separately from the director's own computer. Enquiries come to the published email address and telephone number. If the director is unavailable, including through illness or a pandemic, those enquiries are dealt with on return. No other person is authorised to accept a new supply or a new valuation in the director's absence. Companies House, tax and bank matters continue under the existing mandates. Loss of access to the registered office, or loss of electricity, gas or water there, does not stop the work, because enquiries are received by email and telephone and the records are held in the company Google account and in Microsoft OneDrive.

If the company Google account or Microsoft OneDrive cannot be reached, or customer information is lost or disclosed, the information-security section applies. If a producer cannot supply the ordered grade, including where transport or travel is restricted, the buyer is told and the goods are not supplied. A different grade, or a producer that has not accepted the supplier terms, is not substituted. If an accepted supply cannot proceed, the buyer is told.

The company's duty to the people affected by its work is this policy: no bribery, sanctions screening, export licensing, and no forced, compulsory or child labour in its own work or in its supply chain. The company does not run a charitable programme and it does not publish a community budget.

Environment. The company does not manufacture and does not claim a measured cut in emissions. The environment section above is the whole of that approach.

Social. The company does not accept forced, compulsory or child labour in its own work or in its supply chain. Suppliers are asked to confirm the same in writing.

Governance. The company is a private limited company, number 17389085. The director is accountable for this policy, including anti-bribery, sanctions and export control. The company is not authorised by the Financial Conduct Authority and does not hold client money.

The director is responsible for information security and reviews this section at least once a year, including where customer and company information is held.

Customer and company information is held in the company Google account and in Microsoft OneDrive, and is accessed by the director from the United Kingdom on the director's own computer. It is not copied to removable media. Only the director has access. Passwords are not shared and are not sent by email. Anyone appointed to act for the company reads this section before acting. A computer that has held customer or company information is signed out of those accounts and reset before it is disposed of or passed to anyone else. A person appointed to act for the company who does not follow this section is stood down. Access is given only by the director, and only to a person appointed for that work. When a person stops acting for the company, or the work no longer requires that access, that person's access to the company Google account and to Microsoft OneDrive is removed the same day.

The company does not accept classified material through this website, its email address or its form. Material marked OFFICIAL-SENSITIVE or above is received only through a channel agreed with the originating organisation, and only by the person who needs it for that work.

A suspected loss or unauthorised disclosure of customer information is reported to the director the same day, and the customer is told the same day. Due diligence, screening results, licences and transaction records are kept for at least six years from the end of the relevant work, or longer where a licence or a contract requires it. Before those records are destroyed, the customer may ask for the records of that customer's own engagement.

Report a suspected breach of this policy to contact@onyxadvisory.co.uk with the subject line "Compliance".