The company states it has conducted due diligence: "each Visa supplier is subject to a thorough due diligence process. Our review is tailored to the type of supplier and the activities the supplier will be performing for Visa, and may include background screening, sanctions screening, or review of anti-bribery controls, for example."

I would say that a statement of conducting due diligence is not the same as assessing risks in their supply chain. I think a more specific statement on how risk is measured would better meet the requirements of the Act.

No details are provided as to how they assess risks and based on what conclusions are drawn.