Reputational Risk

Trust is OLTA’s most valuable asset. This page explains how we identify, monitor, and mitigate reputational risk then anchors those safeguards in a set of clearly stated corporate values.

Definition & Materiality

Reputational risk is the potential for negative perception by investors, regulators, partners, or the public to damage OLTA’s ability to operate, raise capital, or retain users.

Material impacts may include:

• Capital outflows and reduced AUM

• Increased borrowing or insurance costs

• Heightened regulatory scrutiny

• Diminished partner and listing opportunities

---

Primary Risk Drivers

Driver	Illustrative Scenario	Typical Impact
Security Incident	Protocol exploit: contract, oracle, or API	Partial fund loss, emergency pauses
Governance Failure	Disputed vote, opaque decision	Stakeholder distrust
Regulatory Breach	Sanctions list violation, KYC lapse	Fines, license revocation
Operational Misconduct	Insider trading, conflicts of interest	Enforcement action
Communication Misstep	Inaccurate marketing claim	Loss of credibility

---

Monitoring & Early-Warning System

Metric / Tool	Frequency	Threshold for Action
24-h Media & Social Sentiment Index	Continuous	Sentiment < -2σ
Onchain Anomaly Dashboard (large unexplained transfers, TVL drop)	Continuous	> 5 % TVL shift/hr
Security Alerts (Immunefi, internal bug bounty)	Real-time	Critical/high severity
Reg-Tech Compliance Checks (sanctions, KYC)	Batch daily	Any match
Incident Hotline	24/7	Any credible report

Alerts above threshold trigger the escalation protocol outlined below.

---

Preventive Controls & Governance Alignment

1. Code Quality – Mandatory external audits, formal verification on critical contracts.

2. Segregation of Duties – Multi-sig treasury, role-based access for upgrades.

3. Disclosure Discipline – Quarterly NAV attestation, real-time index composition feeds.

4. Policy Framework – AML/KYC, conflict-of-interest, and disclosure policies reviewed annually by the Risk Committee.

5. Stakeholder Engagement – Community calls, transparent forum, and mandatory RFC period before material changes.

---

Escalation & Crisis Communication

1. Detection: Monitoring system raises alert.

2. Triage: Risk Lead classifies severity within 60 minutes.

3. Response Team Activation: Core Contributors + Communications + Legal.

4. Initial Statement (≤ 4 h): Facts known, actions taken, next update time.

5. Post-Mortem (≤ 7 d): Root-cause analysis, remediation plan, governance proposal if needed.

See Crisis Management → Communication Playbook for detailed scripts and roles.

---

Corporate Values in Practice

Value	What It Means	Embedded Controls
Integrity First	Always act in the long-term interest of users.	Audit trail on-chain, independent financial reviews.
Investor-Centric	Prioritise capital preservation and clarity.	Real-time NAV, low-cost structure, factsheets.
Resilience by Design	Build systems that withstand stress.	Stress-testing, circuit-breakers, multi-chain redundancy roadmap.
Open Collaboration	Encourage external scrutiny and contribution.	MIT-licensed code, public bug bounty, open forums.
Regulatory Readiness	Stay ahead of evolving rules.	Continuous AML/KYC screening, legal advisory panel, compliant L2 (Base) as primary deployment.

Base is the Layer-2 network built by Coinbase; it inherits Coinbase’s compliance controls (embedded AML/KYC screening, SOC 2-audited infrastructure) and provides native fiat on/off-ramps. The result is an environment that is easier to audit and more reassuring for institutional investors.

---

Review & Update Cycle

• Quarterly: Risk metrics review by Risk Committee; update early-warning thresholds if required.

• Annually: Comprehensive reputational-risk assessment and values reaffirmation, subject to DAO ratification.

• Ad Hoc: Immediate review after any critical incident.