Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
Offered only in the countries listed. Regions: EEA. Checked 2026-10-09. Not scored.
Recorded as where a Wise account that holds money can be opened. Wise's "Where can I use Wise?" says you can hold money if you live in a country where you can open a Wise account, and its "Where do I need to live to hold money with Wise?" table lists 80 countries and territories (all 30 EEA states plus the 50 codes above). Restrictions in that table: US excluding Nevada; Bahrain, Israel and Malaysia personal accounts only; Hong Kong business accounts only; Brazil BRL only for residents; India only while travelling overseas; Thailand, Wise has temporarily stopped issuing currencies and account details. Send and receive reach further: Wise says you can register and send money from most countries, and it names places it does not serve at all (Afghanistan, Belarus, Burundi, Central African Republic, Chad, Congo, DR Congo, Cuba, Eritrea, Iran, Iraq, North Korea, Libya, Myanmar, Somalia, South Sudan, Russia, Sudan, Syria, Yemen, Venezuela, and the Crimea, Donetsk, Luhansk, Kherson and Zaporizhzhia regions of Ukraine), where you cannot log in, register, use the card, or send or receive. Card eligibility is a narrower separate list, not used here.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better · 1 no evidence
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Neutral settlement, disclosed filtering reaching Weak: Edge filtering is disclosed in docs only, or the neutrality of the settlement layer cannot be shown from code.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Wise can suspend, restrict or close an individual customer's account, including their ability to send or withdraw money. Notice may come after the fact, or not at all where that would be unlawful or compromise security, and closure can be without notice. The power is held by Wise unilaterally and is not limited by any multisig or timelock.
Evidence (2)2 documented
Documented
UK personal terms clause 8.4: Wise may suspend or restrict an individual account on reasonable concerns about account security, suspected unauthorised or fraudulent use, or suspected breach of the agreement or Acceptable Use Policy.
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
Clause 8.5-8.6: notice of suspension 'as soon as we can, either before ... or soon after', unless unlawful or a security risk; among the listed actions, closure without notice and limiting the ability to send money or withdraw.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Transfers settle only on Wise's own ledger, reached through Wise's authenticated API or its app and website. No direct settlement path outside Wise exists.
Evidence (1)1 documented
Documented
Wise API getting-started guide: all API calls need OAuth tokens from Wise-issued client credentials (or a personal API token for business accounts); production base URL is https://api.wise.com.
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every integration depends on Wise's hosted API, with credentials and access provisioned by Wise. None of the intermediary code is public and there is no fallback operator, so the dependency is closed and single-vendor.
Evidence (1)1 documented
Documented
Credentials are issued by Wise during partner onboarding with Wise's sales and implementation teams; access model is set by Wise.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Wise screens at its own ledger, which is also the settlement layer. Sanctions restrictions are disclosed in the Acceptable Use Policy without a named list source. Wise states that it does not fully disclose how its automated fraud controls, which can reject transactions, work. Judgment call: that admission of partly undisclosed filtering is taken as anchor 0 rather than 1.
Evidence (2)2 documented
Documented
UK personal privacy notice section 3: fraud-prevention processing is not fully disclosed; section 6.2: automated processes may reject a proposed transaction or close an account.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Only client-side samples, a signing library and API collections are public. The platform that runs transfers is closed. Judgment call: 1 (SDK-level code only) rather than 0, consistent with M-Pesa's client libraries.
Evidence (1)1 verified
Verified
github.com/transferwise (verified org, 223 repos): the API-facing public code is samples (wise-platform-samples: oauth-connect, oauth-connect-popup, strong-customer-authentication), signing examples and a signing library, a Postman collection and a 2021 reference Android bank app. No backend, ledger, API server or deploy scripts.
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The API reference and an open-format statement export are documented on the hosted docs site. The only API schema in a repo is a Postman collection last updated in July 2024, which does not track the current API versions. Judgment call: 1 (documented only), because the versioned schema is not in a repo; a reviewer could argue 2 if the Postman collection is accepted as current.
Evidence (2)1 verified · 1 documented
Verified
MIT-licensed Postman collection of the public API in a repo; last commit 2024-07-24, while the live API reference is versioned 2026q3 on docs.wise.com.
Does every repository needed to run the product carry an OSI-approved license? F1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The components needed to run Wise are proprietary and closed, so nothing that runs the rail can be forked. Among the public repos, four carry MIT or Apache-2.0 licences and wise-platform-samples has none.
Evidence (2)1 verified · 1 documented
Verified
wise-platform-samples has no LICENSE file at this commit (root: .gitignore, CODEOWNERS, README.md, common, oauth-connect, oauth-connect-popup, strong-customer-authentication) and no licence statement in the README.
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Analytics and advertising tracking in the website and app are disclosed in the privacy notice. Which SDKs ship, and whether they are on by default, was not checked: the app is closed and no trace was run.
Evidence (1)1 documented
Documented
Privacy notice section 4.3 lists analytics providers and advertisers (cookies, pixels) among recipients; section 2.2 lists page interaction data (scrolling, clicks) collected from the website and app.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
KYC collection is legally required and disclosed with its legal basis. Wise also collects device, behavioural and location data, and shares contact data for advertising, all beyond the legal requirement. Everything is disclosed in the privacy notice. Judgment call: anchor 1 (disclosed in a policy) and anchor 0 (collection beyond the stated legal requirement) both fit; took 0.
Evidence (2)2 documented
Documented
Privacy notice section 2: identity documents and biometric face scans for KYC; device data incl. IMEI, MAC address, VPN use and installed remote-access apps; precise geolocation if location sharing is allowed; page interaction data; phone book if access is given.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Third parties that see payment data are disclosed by category in the privacy notice, but none is named (a list is available on request to privacy@wise.com). They cannot be swapped by the user.
Evidence (1)1 documented
Documented
Privacy notice section 4: data shared with Wise group companies, partner banks and financial institutions, verification providers, fraud prevention agencies, analytics and advertising providers, regulators.
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Derived. S1 = 1 (provider custody), C2 = 0 (no direct settlement), C3 = 0 (closed single-vendor API), O3 unknown (nothing to self-host). Both funds and the ability to settle depend on Wise. Regulatory safeguarding in insolvency is noted under context and is not a technical exit.
Evidence (1)1 documented
Documented
All transfer and balance operations go through Wise-hosted endpoints (see C2, C3); no exit path outside Wise is documented.
Are secrets kept out of client bundles and are webhooks signed and verified? S5
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Webhooks are signed, and Wise's reference code at a pinned commit verifies the signature. Credentials are documented as scoped and rotatable. Whether secrets ever reach client bundles was not checked, because the apps and API are closed and no trace was run, so 3 is not available. Judgment call: 2. The verification is verified in code; the gaps are that secret handling is not inspectable, the reference code dates from 2021 and uses only the sandbox key, and the docs leave payload verification optional ("where applicable").
Evidence (3)1 verified · 2 documented
Verified
Reference Node handler verifies the X-Signature-SHA256 header as an RSA-SHA256 (PKCS#1 v1.5) signature over the raw body against Wise's sandbox public key; Java and Ruby versions are in the same directory.
Webhook docs: RSA/SHA256 signatures in X-Signature-SHA256, production and sandbox public keys published, and a link to the reference repo; integrators are told not to process requests whose signature fails.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 0
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
No published audit report was found.
Compiled from: wise.com/security (says Wise holds SOC 1 Type 2, SOC 2 Type 2, PCI-DSS and ISO/IEC 27001; SOC reports are given to business customers under NDA; these are not code audits), Wise's 2019 TUV online-security certification blog post (a certification, not a code audit), the Wise Bugcrowd programme (no public disclosure allowed; a bug bounty, not an audit), github.com/transferwise (no audits folders in the listed repos), and web searches for Wise or TransferWise penetration test and code audit reports. No published code audit or penetration test report was found. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 19 evidenced, 1 attested, 9 absent, 0 not applicable, 16 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
provider
payer
from 0.24%, varies by currency
UK personal pricing page (sending and converting money); set by Wise and shown in its calculator per route.
fx
payer
mid-market rate, no markup
Wise states it uses the live mid-market rate plus the upfront fee.
cashout
payee
ATM free up to 250 GBP per month, then 2.69% of the excess
UK card fees page; ATM operators may add their own fees.
card
payer
7 GBP card order
UK pricing page.
network
payee
receiving Swift 6.11 USD, 2.16 GBP or 2.39 EUR per payment; domestic receipts free
UK pricing page.
UK personal prices; other regions and Wise Business differ. Transfer limits were not recorded.
Documented
Wise UK personal pricing page, fees at a glance (sending, converting, card, receiving).
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
bank transfer
Partner banks and local payment schemes
Transfer fee from 0.24% (varies by currency)
everywhere offered
atm
Wise card (Visa / Mastercard)
UK card, free up to 250 GBP per month, then 2.69%
ALL means every country in the availability list. Card eligibility is narrower than account availability, and send corridors vary by currency. No cash agents.
Documented
Sending money to bank accounts is the main cash-out route.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Evidenced
2024-07-01: Data breach at Evolve Bank & Trust, Wise's US partner bank for USD account details in 2020-2023, exposed data Wise had shared (names, addresses, dates of birth, SSN/EIN or ID numbers). Wise says its own systems were not affected; resolved July 2024. The date is the month given, not a day. funds lost: nosource
2026-01-15: Issue across iOS, Android and web preventing customers from adding, moving or sending money; also affected Wise Platform partners (status page, major). funds lost: unknownsource
2026-09-16: Global outage across Wise services (status page, "Widespread unavailability"). funds lost: unknownsource
Absence of a found incident is not evidence that none occurred.
Selected from the status page's major or critical service incidents and Wise's own notices; the status API returns only the 50 most recent incidents (back to 2025-05-27), so older outages are not listed. No funds loss was stated in any source.
Documented
Wise Help Centre notice, last updated 20 December 2024.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
Closed ledger with no public chain to read. Wise publishes reported volumes in its company reports; reported figures are not recorded here.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Evidenced
Wise Payments Ltd, ISO/IEC 27001:2022, Coalfire Certification certificate 2020-080301 (registered 2020-08-03, latest 2026-06-30, expires 2029-08-03). Scope: the ISMS supporting Wise Account, Wise Business and Wise Platform, including Engineering, Product, Security and other teams. The copy linked from wise.com/security (gateway/v1/iso-certificate) is the previous certificate, which expired on 2026-08-03; the certifier directory carries the renewal. source 1 · source 2
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Evidenced
Same certificate (Wise Payments Ltd, 2020-080301): key activities at the listed offices include cloud engineering services and site reliability engineering. The underlying cloud infrastructure provider is not named, and its certification was not checked. source 1
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Attested
Wise states it holds SOC 1 Type 2 and SOC 2 Type 2 attestations; business customers can download the reports after signing an NDA. source 1
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown
No independent source-code review report was found on wise.com/security, the privacy notice or docs.wise.com.
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
Wise runs a Bugcrowd bug bounty (security.txt Policy field), but no penetration-test report or attestation letter was found.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown
No stated scanning cadence was found.
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Absent
none of 5 repo(s): transferwise/digital-signatures-examples ✗ no security policy file; transferwise/digital-signatures ✗ no security policy file; transferwise/public-api-postman-collection ✗ no security policy file; transferwise/banks-reference-android ✗ no security policy file; transferwise/wise-platform-samples ✗ no security policy file source 1 · source 2 · source 3 · source 4 · source 5
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Evidenced
Patching "in a timely manner" (UK personal privacy notice 9.1); no per-severity patch timelines are published. source 1
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Absent
none of 5 repo(s): transferwise/digital-signatures-examples ✗ no scanning config or workflow step found; transferwise/digital-signatures ✗ no scanning config or workflow step found; transferwise/public-api-postman-collection ✗ no scanning config or workflow step found; transferwise/banks-reference-android ✗ no scanning config or workflow step found; transferwise/wise-platform-samples ✗ no scanning config or workflow step found source 1 · source 2 · source 3 · source 4 · source 5
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
No general customer incident-notification time was found. Wise's Hong Kong acquiring terms (wise.com/hk/legal/wise-card-processing-agreement) set a one-business-day mutual notice for shared personal data, which covers that product only. In the 2024 Evolve Bank incident Wise emailed affected customers (see maturity.incidents).
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Evidenced
Public status page at status.wise.com with incident histories. No post-mortem was found among the 50 most recent incidents (2025-05-27 to 2026-09-28) returned by its API. source 1 · source 2
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Two-step authentication is applied from account creation to payments; biometric login in the app. source 1
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
Access reviews may be covered by the SOC 2 Type 2 report, which is available only under NDA (see B1.3); not read.
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Evidenced
Users can configure an auto log-out; no default idle period is stated. source 1
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Evidenced
OAuth 2.0 for all Wise Platform partner accounts; mTLS, JOSE and SCA/2FA are optional additions. source 1
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Evidenced
Client credentials scoped per integration, rotatable and revocable in Developer Hub; optional mTLS endpoint (api-mtls.transferwise.com); webhooks signed (see CROPS S5). CROPS S5 · CROPS S5
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Evidenced
Client-credentials access tokens expire after 12 hours, above the partner's 120-minute cap; the documented example refresh token is valid for about 20 years. source 1
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown
Statement export in open formats is documented (CROPS O4); no volume limits or export logging were found. CROPS O4
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
Encryption at rest for information not in active use and encrypted transport (privacy notice 9.1). Observed: wise.com refuses TLS 1.1 and accepts TLS 1.2. No data classification scheme was found. source 1 · source 2
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Kept only as long as necessary, but typically 5 to 10 years after account closure under financial-regulation retention duties (see CROPS P2 for what is collected). source 1
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
The controller is the Wise group company providing the service; third-party partners act as independent controllers unless stated otherwise. DPIA availability not found. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
No published data processing agreement was found for personal, business or Platform customers. The privacy notice offers details of transfer arrangements on request to privacy@wise.com.
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown
The privacy notice says the security team proactively monitors for abnormal and malicious activity; no SIEM or endpoint-detection statement was found.
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Absent
none of 5 repo(s): transferwise/digital-signatures-examples ✗ no deployment configuration; transferwise/digital-signatures ✗ no deployment configuration; transferwise/public-api-postman-collection ✗ no deployment configuration; transferwise/banks-reference-android ✗ no deployment configuration; transferwise/wise-platform-samples ✗ no deployment configuration source 1 · source 2 · source 3 · source 4 · source 5
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Absent
none of 5 repo(s): transferwise/digital-signatures-examples ✗ no .github/workflows; transferwise/digital-signatures ✗ 1 workflow file(s); transferwise/public-api-postman-collection ✗ no .github/workflows; transferwise/banks-reference-android ✗ no .github/workflows; transferwise/wise-platform-samples ✗ no .github/workflows source 1 · source 2 · source 3 · source 4 · source 5
B9.3 Tests run in CI Do the CI workflows run the test suite?
Absent
none of 5 repo(s): transferwise/digital-signatures-examples ✗ test command in a workflow; transferwise/digital-signatures ✗ test command in a workflow; transferwise/public-api-postman-collection ✗ test command in a workflow; transferwise/banks-reference-android ✗ test command in a workflow; transferwise/wise-platform-samples ✗ test command in a workflow source 1 · source 2 · source 3 · source 4 · source 5
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Evidenced
some of 5 repo(s): transferwise/digital-signatures-examples ✓ 9 of 9 recent commits signed; transferwise/digital-signatures ✗ 2 of 5 recent commits signed; transferwise/public-api-postman-collection ✓ 10 of 10 recent commits signed; transferwise/banks-reference-android ✓ 6 of 10 recent commits signed; transferwise/wise-platform-samples ✓ 10 of 10 recent commits signed source 1 · source 2 · source 3 · source 4 · source 5
B9.7 Changelog Is a changelog maintained with the code?
Absent
none of 5 repo(s): transferwise/digital-signatures-examples ✗ no changelog or release notes; transferwise/digital-signatures ✗ no changelog or release notes; transferwise/public-api-postman-collection ✗ no changelog or release notes; transferwise/banks-reference-android ✗ no changelog or release notes; transferwise/wise-platform-samples ✗ no changelog or release notes source 1 · source 2 · source 3 · source 4 · source 5
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
Integration architecture only (docs.wise.com developer guides covering environments, auth and webhooks); logical and infrastructure architecture are not published. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Wise Payments Limited (England and Wales, company 07209813) for UK personal customers; other regions contract with other Wise entities (not recorded). source 1
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Customer fees (a fee on each transfer or conversion, card and ATM fees); Wise plc is a listed company. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Customer may close at any time; funds left at closure can be claimed through support for 6 years, subject to checks. Wise may terminate with 90 days' notice, or immediately for misuse or regulatory reasons (UK personal terms 9.2-9.7). source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
Yes: automated processes, including machine-learning models, take part in fraud and financial-crime prevention and may reject a transaction or close an account. source 1
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Unknown
The privacy notice offers the right to request further information about an automated decision; no published AI governance (monitoring, validation, bias evaluation) was found.
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Wise app and website
frontend
No
proprietary
Wise
Yes
Wise Platform API (api.wise.com)
api
No
proprietary
Wise
Yes
Wise account ledger and transfer backend
ledger
No
proprietary
Wise
Yes
Wise KYC and verification (incl. third-party verification providers)
kyc
No
proprietary
Wise and unnamed verification providers
Yes
Partner banks and local payment schemes (pay-in and pay-out)
Incumbent. Wise is a closed, custodial e-money and payments ledger. Customer balances are held by Wise and moved through Wise's own systems and partner banks. github.com/transferwise is the GitHub-verified org for wise.com (223 public repos). Listed repos are the ones that touch the transfer API: webhook and SCA signing examples, a signing library, a Postman collection, a reference Android bank integration and the Wise Platform samples. None of them runs the transfer rail. The remaining repos are internal tooling and data-science libraries (pipelinewise, wise-pizza and similar) and are excluded. Documents cited are the UK personal terms of use and the UK personal privacy notice (Wise Payments Limited), plus docs.wise.com, which serves Markdown copies of its client-rendered pages (the .md URLs are cited). Terms clause 26.1 asserts Wise's exclusive property over "sample source code, and code libraries", which conflicts with the MIT and Apache licences in those repos; the repo licences are recorded as found. Search log: docs/research/wise.md.
