Joining GRN

What we check

We publish our criteria so you know what to expect. Each level includes everything in the level before it, and you only answer the questions your level needs. Last reviewed October 2026.

Go to:

Level 1

Listings and platforms

You need no refugee data.

Renewed every 24 months.

Who you are

  • Your legal name, trading names, country and registration number, matched against the official register or shown on a certificate.
  • Accurate details of your services, the countries and languages you work in, your website and a main contact.
  • The name of the head of your organisation.

Integrity

  • We screen your organisation and its head against the UN Security Council list and national sanctions lists.
  • We look for serious adverse news about your organisation.

Commitments

  • You affirm each GRN Principle and the GRN Code of Conduct.
  • You never charge refugees for access to GRN or for a referral through it.
  • You keep your details accurate and tell us promptly when they change.
  • If you work directly with children, you have a child safeguarding policy.

Platforms also

  • Refugee access stays free, with no paid upgrades pushed at refugees, and you tell us before your pricing changes.
  • Your privacy policy covers what refugees give you directly, and you never sell that data or use it for targeted advertising.
  • GRN hands refugees over with a short-lived access token that carries no profile data. Your entry link uses HTTPS on your own domain and your platform validates the token.
  • If users can contact each other, post content or be under 18, you also need a safeguarding policy, and we screen your senior officers.

Level 2

Service providers

You need some refugee data to deliver a service, always with each refugee’s consent.

Renewed every 24 months, or every 12 if you recruit or receive personal data.

Everything in listings and platforms, plus:

Who you are

  • The names and roles of your directors, trustees or senior officers.
  • Your main funding or revenue sources, and your latest annual report or accounts if your income is above a set amount or you recruit.
  • Owners of more than 25% of your organisation, if you recruit or receive personal data.
  • Two references, one of them from a UN agency, international NGO, government body, major funder, major client or industry body.

Integrity

  • We screen your officers against sanctions lists and check development bank debarment lists, such as the World Bank’s.
  • We look for adverse news and litigation about your organisation and its officers.

Safeguarding

  • A policy on protection from sexual exploitation and abuse, a staff code of conduct and a way for people to report concerns.
  • An existing UN capacity assessment, or our self-assessment against the eight core standards.

Data protection

  • A named person responsible for data protection.
  • You tell us within 72 hours of any breach involving refugee data.
  • If you receive personal data: your privacy policy and the lawful basis you rely on.
  • If you copy refugee data into your own systems: a short security self-assessment. An ISO 27001 or SOC 2 report helps if you have one.
  • If you receive any refugee data: how you use AI or automated decisions on it.

Employers and recruiters also

  • Recruiters who place people with other employers: IOM IRIS certification or a recruiter licence.
  • You follow the Employer Pays Principle and the ILO General Principles for Fair Recruitment, so workers never pay recruitment fees or costs.
  • A sample contract and job offer in a language the worker understands.
  • A declaration that you comply with labour law in each destination country.

Level 3

Institutional partners

You receive wider refugee profiles, including sensitive information, or share data with other organisations.

Renewed every 12 months.

Everything in service providers, plus:

In addition

  • Your legal mandate or government contract.
  • A separate Data Sharing Agreement and a data protection impact assessment.
  • An independent security audit, ISO 27001 certificate or SOC 2 report.
  • Approval by the GRN governance board, after the panel and an independent data protection adviser.
  • References are not needed at this level.

How we decide

Who decides
An accreditation panel. A second reviewer looks first at any service provider that recruits or receives personal data. Institutional partners also go to an independent data protection adviser and then the governance board.
Reasons
Every decision records its reasons. You see the outcome, any conditions and a plain-language reason, and you can ask for one review.
After you join
We re-screen sanctions lists regularly and review a partner after a complaint, an incident, a change of ownership or a change to a platform’s pricing or link.
Breaches
Charging refugees for access to GRN or a referral, or endangering them, can lead to immediate removal from the network.

Ready to apply?

Start your applicationGRN Principles