Module · 98 · Licensing & 3rd-Party (IC View)
Licensing & Third-Party Architecture
IC-grade visibility into vendor stack, regulatory licences, market-data entitlements and source-code escrow. Issuance, rotation and contract execution are performed by the backend via signed RPC into the legal/ops vault — never from this surface.
Tier-0 vendors
6
single points · failover required
Tier-1 vendors
9
business-critical
Code escrow
3
MSCI · Fireblocks · AWS IaC
Vault unseal
5/9
Shamir, HSM-backed
OSS licence risk
0
no copyleft in distribution
Execution boundary
┌────────────────────────┐
IC console │ licensing-architecture (this page) — READ-ONLY VIEW
└──────────────┬─────────┘
│ signed JWT (read scope: licence.read)
▼
┌──────────────────────────────────────────────────────┐
│ Edge serverFn · scopes verified · audit-logged │
└──────────────┬───────────────────────────────────────┘
│ mTLS · HSM-attested
▼
┌──────────────────────────────┐ ┌────────────────────┐
│ HashiCorp Vault Enterprise │──│ CloudHSM (FIPS 3) │
│ · contracts, keys, escrow │ │ · root-of-trust │
└────────────┬─────────────────┘ └────────────────────┘
│ webhook
▼
┌──────────────────────────────┐
│ 3rd-party APIs (Bloomberg, │
│ MSCI, SWIFT, Fireblocks…) │
└──────────────────────────────┘01
A · Vendor register
| Vendor | Category | Licence form | SLA | Escrow | Tier | Notes |
|---|---|---|---|---|---|---|
| Bloomberg Terminal + B-PIPE | Market data | Per-user terminal + enterprise B-PIPE | 99.95% | n/a | Tier-0 | Primary market data + FXGO execution |
| Refinitiv (LSEG) Eikon + Elektron | Market data | Enterprise · redistributed | 99.95% | n/a | Tier-1 | Backup data + WM/Refinitiv 4pm fix |
| MSCI ESG + Barra GEM3 | Risk model | Annual subscription + factor data | 99.5% | code+data | Tier-1 | Ex-ante risk, ESG screens |
| FactSet | Reference data | Per-user + API | 99.5% | n/a | Tier-2 | Symbology cross-walk |
| ICE Data Services | Pricing — fixed income | Daily price file enterprise | 99.9% | data only | Tier-1 | Evaluated bond prices |
| SWIFT (gpi + SWIFTRef) | Payments rail | BIC + gpi membership | 99.999% | n/a | Tier-0 | MT103/202, ISO 20022 pacs |
| CLS Group | FX PvP | Settlement member (via prime) | 99.99% | n/a | Tier-0 | Eligible CCY only |
| DTCC CTM + ALERT | Post-trade match | Subscriber | 99.9% | n/a | Tier-1 | Equity / FI affirmation |
| MarkitWire (OSTTRA) | OTC confirmation | Enterprise | 99.9% | n/a | Tier-1 | IRS/CDS/FX-NDF |
| Fireblocks | Custody · MPC | Enterprise + tenant | 99.99% | key shards | Tier-0 | Digital-asset MPC, policy engine |
| Chainalysis KYT | Travel rule / AML | Annual | 99.5% | n/a | Tier-1 | On-chain risk scoring |
| Jumio + Onfido | KYC / IDV | Per-verification | 99.5% | n/a | Tier-1 | Dual-vendor failover |
| Algorand Foundation · State Proofs | On-chain settlement | Open protocol + relay agreement | 99.9% | n/a | Tier-1 | PQ-resistant rail |
| AWS (ap-southeast-1 / -3) | Compute / DB | Enterprise Support + EDP | 99.99% | AMI + IaC | Tier-0 | Multi-AZ primary |
| Cloudflare (Workers + R2) | Edge / CDN | Enterprise | 100% | n/a | Tier-1 | WAF + DDoS |
| HashiCorp Vault Enterprise | Secrets / PKI | HCP + HSM (CloudHSM) | 99.9% | seal shards | Tier-0 | 5-of-9 Shamir unseal |
| Confluent Cloud (Kafka) | Event spine | Dedicated cluster | 99.99% | topic schema | Tier-1 | Trade events + audit |
02
B · Licence families
Regulated activity
- • SG CMS (MAS, S$1.0Bn+ AUM)
- • HK Type 9 SFC
- • MY CMSL (SC)
- • ID Manager Investasi (OJK)
- • VCC Sub-fund + Labuan FSA
Data redistribution
- • Bloomberg B-PIPE enterprise (no redistribution to retail)
- • MSCI Index linked-product licence
- • ICE evaluated price redistribution
Settlement membership
- • SWIFT BIC (live)
- • DTCC ID (subscriber)
- • CLS settlement member (via prime)
- • Bursa Depository nominee
OSS compliance
- • AGPLv3 — none in distributed surface
- • Apache-2.0 / MIT — NOTICE bundled
- • SPDX SBOM generated on every release
03
C · Continuity & exit obligations
- • Source-code escrow with NCC Escrow Europe (3 vendors). Release triggers: insolvency, M&A change-of-control without consent, 30d SLA breach.
- • Market-data run-off rights — 12 months continuity for in-flight portfolios under master agreements.
- • Data residency: SG (primary), HK (secondary), MY (Labuan DR). No cross-border PII without standard contractual clauses.
- • Cyber insurance: USD 50M aggregate (Beazley, Munich Re). Carve-out for ransomware ≤ USD 10M.
- • DORA Art.28 register maintained — ICT third-party concentration risk reviewed quarterly by IC.