Mercury Sanctions Status, Partner Bank Risk & Vendor Assessment

Recommended Actions

Steps to address findings for Mercury

1. 1

   IMMEDIATE (within 5 business days): Resolve the sanctions name match by requesting Mercury's legal entity name, jurisdiction of incorporation, company registration number, and beneficial ownership disclosure. Cross-reference against sanctions screening service entity NK-c2xd9dQMLRZtF5JHcaNnxC. Document the outcome in your vendor risk register. Do not execute contracts or grant data access until this is resolved.

   NIST Supply Chain Risk (SP 800-161)
2. 2

   HIGH PRIORITY (within 30 days): Request Mercury's current SOC 2 Type II report and bridge letter. Start by visiting mercury.com/security — contact their security team directly if no self-service access is available. Confirm the report covers the services your organization uses, is dated within the last 12 months, and retain it alongside this investigation report as SOC 2 CC9.2 audit evidence.

   SOC 2 Overview (AICPA)
3. 3

   HIGH PRIORITY (within 30 days): Manually review mercury.com/help/subprocessors in a browser to confirm whether an active subprocessor list is published. If incomplete, request the current subprocessor list from Mercury's data protection officer. Verify that key infrastructure and AI sub-processors (including OpenAI) are disclosed and check each against your organization's acceptable use and data residency requirements.

   GDPR Subprocessor Rules
4. 4

   MEDIUM PRIORITY (within 60 days): Request Mercury's current Data Processing Addendum (DPA) and confirm it explicitly covers AI sub-processing, including data retention terms with third-party AI providers such as OpenAI. Ask whether zero-data-retention API agreements are in place with AI providers for data submitted via the platform.

   DPA Template (GDPR Art. 28)
5. 5

   MEDIUM PRIORITY (within 60 days): Include a targeted security questionnaire covering: (a) HTTP security header configuration for app.mercury.com, (b) network segmentation and firewall policy for non-standard open ports, and (c) ISO 27001 certification status or equivalent information security management system documentation.

   ISO 27001 Standard
6. 6

   ONGOING: Retain this investigation report with a reviewer signature and date as evidence of third-party risk assessment under SOC 2 Trust Services Criterion CC9.2. Schedule a re-assessment within 12 months or upon any material change to Mercury's services, ownership, or compliance status.

   SOC 2 Overview (AICPA)NIST Risk Assessment (SP 800-30)NIST Supply Chain Risk (SP 800-161)

• Historical media search data was unavailable during this investigation. Supplementary adverse media coverage beyond the 12-month primary scan window could not be assessed. Manual searches via Google News or LexisNexis for Mercury's regulatory and litigation history are recommended.
• External cyber risk scoring was not available for this investigation. An independent quantitative cyber risk score (benchmarked against the SaaS industry average) could not be included. Manual verification via the vendor's security page or a direct security questionnaire is recommended.
• The subprocessor page at mercury.com/help/subprocessors was found but returned no parseable entries. The completeness and currency of Mercury's subprocessor disclosure could not be assessed programmatically. Manual review of the live page and direct vendor inquiry are required.
• The sanctions match for 'Mercury LLC' returned a score of 0 due to an API data gap, meaning no quantitative disambiguation score was available to assess entity similarity beyond name matching. Manual entity verification is mandatory.
• The HTTP security scanner scan was performed on the marketing site (mercury.com). Security header configuration for the application endpoint (app.mercury.com) was not independently assessed and may differ materially.