Market Conduct and Trading Compliance Manual

This policy represents Bitkaya’s approved Market Conduct & Trading Compliance Manual (version 1.1, FINAL, April 2026) as the governing framework for fair, transparent, compliant and client-focused virtual-asset trading and market-facing activity. The body below reproduces every section and paragraph of the approved manual.

Change Log

Version	Date	Summary of Changes	Approvers	Impacted Policies/Procedures	Notes
1.0	October 2025	Initial Manual	Board	All
1.1	April 2026	Cross-manual harmonization following AML/CTF/CPF Manual v2.1.	Board	2.4, 4.2, 4.4, 5.2, 6, 7, 8.1, 9.2, 11.1

1 Purpose and Scope

This manual sets out the principles, standards, and procedures governing the market conduct of Bitkaya, a Virtual Asset Service Provider (VASP). It applies to all employees, officers, directors, contractors, and third parties acting on behalf of the company. Its purpose is to ensure compliance with applicable laws, regulations, licensing conditions, and industry codes of conduct across all jurisdictions where Bitkaya operates.

This policy extends to:

All activities related to virtual asset issuance, exchange, custody, and transfer.
Dealings with clients, counterparties, regulators, and service providers.
Digital communications, advertising, and promotions in online and offline channels.

2 Core Principles

The foundation of Bitkaya’s market conduct framework rests on a set of core principles that guide every decision, transaction, and interaction undertaken by the company and its representatives. These principles ensure that Bitkaya operates with integrity, protects client interests, and fosters trust in the broader digital asset ecosystem.

As a Virtual Asset Service Provider (VASP), Bitkaya acknowledges the unique risks and responsibilities associated with digital assets and is committed to conducting business in a manner that is ethical, transparent, compliant, and client-focused. The principles outlined below provide the benchmark for professional behavior and establish the expectations that all employees, officers, contractors, and third parties acting on behalf of the company must uphold.

2.2 Integrity and Fairness

Bitkaya is committed to conducting business with the highest standards of honesty, fairness, and good faith.

Employees must avoid manipulative trading practices, such as front-running, spoofing, or creating false market signals.
All representations made to clients and stakeholders must be truthful, balanced, and not misleading, whether in product disclosures, marketing materials, or personal interactions.
Fair treatment applies equally to all clients, regardless of their size, trading activity, or relationship with the firm.

2.3 Transparency

Transparency is a cornerstone of trust in financial services, especially in the digital asset sector where information asymmetries can harm clients.

Bitkaya will provide clear, accurate, and timely disclosures on pricing, fees, risks, and the nature of products and services.
Clients and regulators will be informed of material changes that could impact their interests, such as system outages, regulatory updates, or policy changes.
Reports to regulators and counterparties will be complete, consistent, and verifiable to support market confidence and compliance oversight.

2.4 Compliance

Compliance with applicable regulations is non-negotiable.

Bitkaya adheres to Anti-Money Laundering (AML), Counter-Terrorist Financing (CFT), securities, consumer protection, sanctions, and data privacy laws across all jurisdictions of operation.
All staff must undergo mandatory compliance training, including AML/CFT red-flag awareness, data handling, and reporting obligations.
Internal monitoring systems will be used to detect suspicious transactions, identify potential regulatory breaches, and escalate them for appropriate action.

2.5 Accountability

Accountability ensures that actions taken within Bitkaya are aligned with its ethical and legal responsibilities.

Employees and management must take ownership of decisions, communications, and outcomes, including errors or oversights.
Senior management and the Board have ultimate responsibility for ensuring that internal controls, policies, and risk frameworks are effective.
Accountability extends to third-party service providers, who must be subject to appropriate due diligence, monitoring, and contractual oversight.

2.6 Client-Centricity

Client trust is central to Bitkaya’s long-term success.

Clients’ interests must take priority over the firm’s short-term commercial interests.
Services must be suitable and appropriate, ensuring clients understand the risks associated with digital assets and products offered.
Bitkaya will safeguard client funds and digital assets through segregated accounts, secure custody solutions, and insurance (where available).
Client feedback and complaints will be treated as opportunities to improve services and strengthen relationships.

2.7 Innovation with Responsibility

Bitkaya embraces innovation in digital assets, while ensuring that technological and financial advancements are responsibly managed.

New products, services, or technologies must undergo a risk assessment process before launch, including compliance, cybersecurity, and client suitability reviews.
Risks such as volatility, operational complexity, and technology vulnerabilities must be identified, disclosed, and mitigated.
The firm will contribute to industry standards, regulatory discussions, and responsible innovation practices, ensuring that digital asset markets develop in a safe and sustainable manner.

3 Prohibited Practices

To preserve the integrity of the digital asset markets and protect clients, Bitkaya enforces strict prohibitions on behaviors that could compromise fairness, transparency, or compliance with applicable regulations. Certain practices are inherently harmful to market integrity, investor confidence, and the reputation of the firm, and therefore will not be tolerated under any circumstances.

This section sets out the activities that are expressly forbidden for all employees, officers, contractors, and third parties acting on behalf of Bitkaya. By clearly identifying these prohibited practices, the company ensures that its operations remain aligned with regulatory standards, industry best practices, and ethical obligations expected of a licensed Virtual Asset Service Provider (VASP).

3.1 Market Manipulation

Bitkaya strictly prohibits any behavior intended to create false or misleading appearances of market activity.

Examples include: wash trading, spoofing, layering, pump-and-dump schemes, or disseminating rumors to distort asset prices.
Such practices undermine market integrity, erode client trust, and may constitute criminal offenses under financial market regulations.
Employees must report any suspected manipulative activity to the Compliance team for investigation.

3.2 Insider Trading

The use of material, non-public information (MNPI) for trading or advisory purposes is forbidden.

Employees must not buy, sell, or recommend virtual assets where they possess MNPI, such as details of pending listings, partnerships, or regulatory approvals.
Confidential client or company data must never be exploited for personal benefit or to benefit third parties.
Employees handling sensitive information must adhere to information barrier (“Chinese Wall”) protocols to prevent inadvertent leaks.

3.3 Misrepresentation

All forms of misrepresentation are prohibited, whether deliberate or negligent.

Employees must not provide false, misleading, or exaggerated statements about Bitkaya’s services, the risks of digital assets, or potential returns.
Marketing and promotional materials must be reviewed for accuracy, fairness, and regulatory compliance before publication.
Misrepresentation may also occur through omission, such as failing to disclose significant risks, fees, or limitations.

3.4 Conflicts of Interest

Employees and management must act impartially and avoid situations where personal or financial interests compromise professional judgment.

Any actual or potential conflict must be disclosed promptly to Compliance.
Examples include: engaging in undisclosed outside business activities, prioritizing personal trading over client trades, or accepting benefits from third parties that could influence decision-making.
Where conflicts cannot be avoided, Bitkaya will implement appropriate management, disclosure, and mitigation measures.

3.5 Unlicensed Activity

Operating without required authorizations threatens the integrity of the firm and exposes both Bitkaya and its staff to severe legal consequences.

Employees must not conduct or promote any regulated services in jurisdictions where Bitkaya lacks the appropriate licenses, registrations, or regulatory exemptions.
This includes services such as exchange operations, custodial wallet services, advisory functions, or token issuance, where local law requires authorization.
Employees must immediately escalate any uncertainty about licensing requirements to the Legal and Compliance departments.

4 Trading Conduct

Trading activity must be conducted not only in accordance with market conduct principles, but also in a manner consistent with Bitkaya’s AML/CTF/CPF, sanctions, safeguarding, and client protection obligations. This includes appropriate review of elevated-risk trading patterns, suspicious off-ramping and on-ramping behaviour, unusual transaction activity, sanctions or wallet exposure concerns, and any other circumstances requiring escalation before execution, settlement, or release of assets.

4.1 Best Execution

Bitkaya is committed to securing the most favorable outcomes for clients when executing their orders.

Execution Factors: In determining best execution, the firm considers price, speed, likelihood of execution and settlement, order size, and prevailing market conditions.
Use of Venues: Orders may be routed through different trading venues, exchanges, or liquidity providers, but only where this aligns with the client’s best interests.
Disclosure: Clients will be informed of execution policies and any material limitations, ensuring transparency in how their trades are handled.
Monitoring: Execution quality will be reviewed regularly, and adjustments will be made to maintain high standards of client protection.

4.2 Order Handling

Client orders must be managed with integrity, efficiency, confidentiality, and appropriate control discipline.
All orders must be handled in a fair and timely manner, but Bitkaya is not required to proceed with execution, settlement, transfer, or release where legal, compliance, sanctions, fraud, safeguarding, or operational concerns remain unresolved.
Where an order, payment flow, wallet destination, transaction pattern, or client instruction presents unusual, inconsistent, restricted, or higher-risk characteristics, the matter must be reviewed and, where necessary, escalated before further action is taken.
Order handling records must be sufficient to demonstrate the timing of the order, the actions taken, the persons involved, any restrictions or delays applied, and the reason for any escalation, hold, or refusal.

4.3 Front Running

Bitkaya enforces a zero-tolerance policy against front running.

Employees, officers, or affiliates must not use advance knowledge of client orders to execute trades in their own accounts or on behalf of others before the client order is executed.
Front running is considered a serious breach of trust and may result in termination, regulatory reporting, and potential criminal liability.
Surveillance systems are in place to detect patterns of activity that may suggest front running or related misconduct.

4.4 Personal Trading

Bitkaya recognizes the potential conflicts of interest that arise from employee trading in virtual assets.

Pre-Approval: All employees must obtain prior approval from the Compliance team before initiating trades in digital assets.
Restricted Assets: Employees may be restricted from trading in assets that are under consideration for listing, partnership, or other strategic activity by Bitkaya.
Monitoring: Personal trades are subject to periodic review to ensure compliance with disclosure and conflict of interest requirements.
Prohibition on Misuse of Information: Employees are strictly prohibited from using confidential client data, company strategy, or other material non-public information (MNPI) for personal trading.
Employees must not use knowledge of sanctions alerts, internal compliance escalations, onboarding restrictions, unusual activity reviews, pending approvals, or other non-public control information for personal benefit or to benefit another person. Any such use is strictly prohibited and may constitute serious misconduct.

5 Communication and Promotion

Effective communication is essential to building trust, safeguarding clients, and maintaining regulatory compliance in the digital asset sector. As a Virtual Asset Service Provider (VASP), Bitkaya recognizes that every advertisement, disclosure, and client interaction reflects not only the company’s values but also its commitment to fairness, transparency, and integrity.

This section establishes the standards governing how Bitkaya engages with clients, the public, and regulators through advertising, disclosures, and social media. By adhering to these principles, Bitkaya ensures that all communications are accurate, responsible, and compliant with applicable laws, thereby protecting both the firm’s reputation and the interests of its clients.

5.1 Advertising Standards

Bitkaya ensures that all marketing, digital content, and promotional activities reflect the highest standards of fairness and integrity.

Accuracy and Balance: All advertising must be factual, balanced, and capable of substantiation. Claims of performance or benefits must be supported by verifiable data.
No Misleading Statements: Marketing must avoid exaggerations, omissions, or promises of guaranteed returns, as these are misleading and non-compliant with financial promotion regulations.
Regulatory Compliance: All communications must comply with applicable securities, consumer protection, and financial promotion regulations in the jurisdictions where they are published.
Review Process: Promotional materials must undergo Compliance review and approval before release to ensure accuracy and compliance.

5.2 Client Communication

Communications relating to trades, execution, delays, restrictions, or service availability must be fair, accurate, and consistent with Bitkaya’s legal and regulatory obligations.

Where a transaction, withdrawal, settlement, or onboarding step is delayed or cannot proceed because of legal, sanctions, safeguarding, or compliance concerns, communication must be handled carefully and in accordance with applicable confidentiality and anti-tipping-off restrictions.

Staff must not explain, confirm, or imply internal compliance conclusions in a way that would breach legal restrictions or compromise an ongoing review.

Given the influence and reach of social media, strict controls are necessary to protect Bitkaya’s reputation and regulatory standing.

Authorized Spokespersons: Only designated and authorized employees may make official statements on behalf of Bitkaya via social platforms.
Personal Use: Employees must not use personal accounts to make statements that could be construed as representing Bitkaya’s official views, services, or positions.
Prohibited Content: Sharing confidential information, speculative claims, or unverified statements about Bitkaya or the digital asset market is strictly prohibited.
Monitoring: Bitkaya reserves the right to monitor public communications for potential reputational or regulatory risks and will take action where necessary.

6 Client Asset Protection

Bitkaya’s client asset protection obligations operate together with its compliance and sanctions obligations. Client assets must be safeguarded, but may also need to be restricted, held, or prevented from moving where applicable law, sanctions controls, unusual activity review, fraud concerns, or other legal restrictions require this. Such matters must be managed through documented escalation and decision-making procedures.

6.1 Segregation of Assets

Bitkaya ensures that all client assets are strictly segregated from company operational funds to protect clients from loss or misuse.

Dedicated Accounts: Client fiat funds must be held in segregated bank accounts, and virtual assets must be maintained in distinct wallets separate from company holdings.
Regulatory Compliance: Segregation practices will comply with jurisdiction-specific custody and safeguarding requirements, including reporting to regulators where mandated.
Auditability: Accurate records must be maintained to demonstrate full reconciliation of client balances at all times. Independent audits may be conducted to verify compliance.
No Commingling: Under no circumstances shall client assets be used to finance company operations, lending, or proprietary trading.

6.2 Custody Standards

Bitkaya employs institutional-grade custody solutions to mitigate risks associated with theft, fraud, or operational errors.

Wallet Management: The firm will use a combination of multi-signature wallets, hardware security modules (HSMs), and cold storage solutions to safeguard client assets.
Access Controls: Only authorized personnel may access custody systems, subject to multi-factor authentication, role-based permissions, and approval workflows.
Operational Resilience: Custody processes will include redundancies, secure backups, and contingency procedures to ensure asset recovery in the event of technical failures or breaches.
Vendor Oversight: Where third-party custodians are used, they will be subject to rigorous due diligence, contractual safeguards, and ongoing monitoring.

6.3 Insurance Coverage

Recognizing the unique risks of the digital asset ecosystem, Bitkaya will seek to mitigate residual risks through insurance coverage where feasible.

Scope of Coverage: Policies may include protection against cyberattacks, fraud, employee misconduct, and operational failures.
Limitations: Clients will be informed of the extent and limitations of any insurance coverage to ensure clarity about protections.
Continuous Review: The firm will regularly assess the adequacy of insurance arrangements in line with evolving risks, market conditions, and regulatory guidance.

6.4 Safeguarding Measures

Robust safeguarding measures are critical to protecting both client assets and sensitive data.

Cybersecurity Protocols: Bitkaya will maintain firewalls, intrusion detection systems, penetration testing, and security monitoring to protect against cyber threats.
Data Protection: Client information and transaction records will be encrypted in transit and at rest, with strict access controls applied.
Incident Response: A formal incident response plan will be maintained, including escalation procedures, forensic investigation, and mandatory reporting of material breaches to regulators and affected clients.
Business Continuity: Disaster recovery protocols, offsite backups, and redundancy systems will ensure resilience in the event of natural disasters, system failures, or targeted attacks.

7 Complaint Handling

Client complaints concerning execution, delays, restrictions, onboarding outcomes, transaction handling, safeguarding, or communications must be handled fairly, promptly, and in accordance with the complaints framework.

Where a complaint touches on sanctions, unusual activity review, internal compliance escalation, or legal restrictions, the complaint process must remain coordinated with the relevant control function. Complaint handling must not override legal, compliance, or confidentiality obligations.

Responses to such complaints must be accurate and clear, but must not disclose information in a manner that breaches anti-tipping-off or other legal restrictions.

7.1 Procedures

Bitkaya is committed to maintaining a transparent and accessible complaints framework to ensure that all client concerns are addressed in a structured, consistent, and timely manner.

Accessibility: Clients must be informed of clear channels through which they can submit complaints, including email, online portals, and dedicated customer service contacts.
Acknowledgment: Complaints should be acknowledged promptly (e.g., within two business days), with confirmation of receipt and an outline of the next steps.
Response Timelines: Standard response timelines must be established (e.g., resolution within 30 days, unless extended due to complexity), and clients must be kept updated on progress.

7.2 Fair Treatment

Complaints must be managed with fairness, impartiality, and respect for client rights.

Impartial Review: Each complaint will be handled objectively, without bias toward the company or the client.
Consistency: Similar complaints must be treated consistently to ensure fairness across all cases.
Consumer Protection Standards: Resolution processes must align with local and international consumer protection laws, ensuring that clients receive equitable treatment and outcomes.

7.3 Escalation

Clients must be informed of their right to escalate complaints if they are dissatisfied with the outcome.

Internal Escalation: Bitkaya will provide internal escalation procedures, allowing unresolved complaints to be reviewed by senior management or the Compliance team.
External Channels: Where internal resolution is insufficient, clients will be advised of alternative dispute resolution (ADR) mechanisms, ombudsman services, or relevant regulatory complaint platforms.
Regulatory Obligations: Certain complaints may trigger mandatory reporting to regulators, particularly if they involve misconduct, systemic issues, or breaches of regulatory requirements.

7.4 Record-Keeping

A comprehensive and auditable record of all complaints must be maintained.

Documentation: Each complaint must be recorded with details of the issue, investigation steps, communications, and resolution outcome.
Retention Period: Records must be retained for at least five years, or longer if required by local regulation.
Analysis: Complaint data will be regularly reviewed to identify trends, systemic risks, and opportunities for process improvements.
Regulatory Review: Records must be made available to regulators upon request, demonstrating compliance with complaint-handling obligations.

8 Monitoring and Enforcement

To uphold the highest standards of integrity, Bitkaya actively monitors its operations and enforces compliance with market conduct policies.

Monitoring and enforcement mechanisms are essential to detect misconduct early, ensure accountability, and demonstrate adherence to regulatory obligations. By combining surveillance systems, independent audits, and proportionate disciplinary measures, Bitkaya fosters a culture of transparency and responsibility.

This section sets out the firm’s approach to oversight, ensuring that violations are promptly identified, fairly addressed, and, where necessary, reported to the appropriate regulatory authorities.

8.1 Surveillance

Bitkaya maintains surveillance and monitoring processes proportionate to the risks arising from its trading and market-facing activity.

Surveillance may include review of:

unusual pricing or execution patterns;
front running or market abuse indicators;
suspicious or inconsistent client behaviour;
unusual wallet destinations or settlement routes;
elevated-risk off-ramping or on-ramping behaviour;
activity inconsistent with the client’s profile; and
repeated, structured, or otherwise unusual transactions that may require escalation under Bitkaya’s AML/CTF/CPF framework.

Where review identifies a material concern, the matter must be documented and escalated appropriately.

8.2 Internal Audit

Independent audits ensure that Bitkaya’s policies and procedures are functioning effectively.

Periodic Reviews: Internal audits will be conducted at defined intervals to evaluate compliance with market conduct, AML/CFT, custody, and data protection policies.
Independence: Internal audit functions will remain independent of day-to-day business operations to ensure impartial assessments.
Risk-Based Approach: Audit scope and frequency will reflect the firm’s risk profile, business growth, and regulatory requirements.
Reporting: Findings will be reported to senior management and the Board, with corrective actions tracked to completion.

8.3 Disciplinary Actions

Violations of market conduct policies will be addressed through proportionate and consistent disciplinary measures.

Graduated Sanctions: Depending on the severity of the misconduct, disciplinary actions may include verbal/written warnings, mandatory training, reassignment, suspension, or termination.
Regulatory Reporting: Serious violations may be reported to regulators, law enforcement, or other authorities as required by law.
Accountability: Managers and supervisors will also be held accountable if they fail to detect or respond to misconduct within their oversight responsibilities.
Whistleblower Protection: Employees who report suspected misconduct in good faith will be protected from retaliation, encouraging a culture of transparency and accountability.

9 Regulatory Compliance

As a licensed Virtual Asset Service Provider (VASP), Bitkaya recognizes that regulatory compliance is not only a legal obligation but also a cornerstone of maintaining market credibility, client trust, and operational sustainability.

The digital asset industry operates under evolving and often complex regulatory frameworks across multiple jurisdictions, requiring strict adherence to licensing conditions, reporting obligations, and supervisory expectations.

This section outlines Bitkaya’s approach to compliance, emphasizing proactive engagement with regulators, robust AML/CFT practices, and adherence to international standards such as FATF recommendations. By embedding compliance into all aspects of its operations, Bitkaya ensures it operates responsibly, transparently, and in alignment with both local and global regulatory requirements.

9.1 Licensing

Bitkaya is committed to maintaining all necessary licenses, registrations, and authorizations in every jurisdiction in which it operates.

Regulatory Mapping: The Compliance team will maintain a jurisdictional licensing matrix to identify and track applicable requirements across regions.
Renewals and Filings: All licenses must be renewed in a timely manner, and required filings submitted accurately and within statutory deadlines.
Scope of Services: The firm will ensure that services offered in each jurisdiction align strictly with the permissions granted by regulators.
Prohibition of Unlicensed Activity: Employees and contractors are prohibited from conducting regulated activities in jurisdictions where Bitkaya lacks authorization.

9.2 AML/CFT Reporting

Bitkaya maintains an internal process for escalation and review of unusual or suspicious matters arising from trading activity, settlement activity, client behaviour, wallet exposure, or related conduct.
Internal classifications may be used for case handling, prioritization, and recordkeeping. External FIU reporting, where required by law, is made through the UTR process.
Where a matter also involves sanctions, client asset restrictions, fraud concerns, or cybersecurity issues, those dimensions must be assessed separately and managed in coordination with the relevant control functions.

9.3 Regulatory Engagement

Open, transparent, and proactive engagement with regulators is central to maintaining trust and compliance.

Cooperation: Bitkaya will cooperate fully with supervisory authorities, providing timely access to records, systems, and personnel upon request.
Inquiries and Inspections: Regulatory inquiries, inspections, or audits must be escalated immediately to the Compliance and Legal teams, who will coordinate responses.
Consultations: Where appropriate, Bitkaya will participate in industry and regulatory consultations, contributing to the development of balanced digital asset regulation.
Regulator Relationship Management: A Regulatory Affairs function will oversee ongoing relationships with supervisory bodies, ensuring consistency in communication.

9.4 Cross-Border Compliance

Bitkaya recognizes the global nature of digital assets and the extraterritorial application of certain regulatory regimes.

Extraterritorial Reach: Activities will be assessed for compliance with laws that may apply outside the firm’s home jurisdiction, including securities regulations, sanctions, and anti-corruption laws.
FATF Standards: Bitkaya will align its AML/CFT framework with the Financial Action Task Force (FATF) recommendations, ensuring global consistency.
Multi-Jurisdictional Alignment: Policies and procedures will be designed to meet the strictest applicable standards to mitigate conflicts between regulatory regimes.
Cross-Border Transactions: Enhanced due diligence will be applied to international clients and transactions to ensure compliance with local and global rules.

10 Alignment with GDF Code of Conduct

Bitkaya aligns its practices with the Global Digital Finance (GDF) Code of Conduct, reinforcing adherence to international standards of ethical behavior, transparency, accountability, and consumer protection in the digital asset industry.

This alignment ensures:

A globally recognized benchmark for conduct.
Consistency across jurisdictions and regulatory regimes.
Contribution to industry-wide trust and integrity.

11 Risk Management and Conflicts of Interest

In the fast-evolving digital asset industry, effective risk management and the proper handling of conflicts of interest are critical to ensuring Bitkaya’s resilience, regulatory compliance, and client trust. As a Virtual Asset Service Provider (VASP), Bitkaya faces a wide range of risks, including operational, financial, technological, compliance, and reputational, that must be proactively identified, monitored, and mitigated. A structured enterprise-wide risk management framework enables the company to anticipate threats, protect client assets, and maintain stability even under extreme market conditions.

Equally important is the management of conflicts of interest, which, if left unaddressed, can undermine fairness, transparency, and client confidence. Bitkaya requires all employees, officers, and business partners to act with integrity, disclose potential conflicts, and place client interests above personal or organizational gain. Together, these two pillars, robust risk management and conflict of interest controls, form a foundation for sustainable operations and uphold the highest standards of market conduct.

11.1 Risk Management

Market conduct and trading risks must be managed together with Bitkaya’s financial crime, sanctions, safeguarding, operational, and client protection risks.

This includes ensuring that:

high-risk clients and transactions are subject to stronger review and escalation thresholds;
suspicious activity identified through trading or settlement behaviour is escalated appropriately;
legal or sanctions restrictions are respected before execution or release;
control decisions are documented; and
management information captures emerging risks, recurring issues, and remediation actions.

11.2 Conflicts of Interest

Disclosure Obligations: Employees and management must promptly disclose any personal or financial interests that may conflict with Bitkaya’s business activities.
Personal Trading Restrictions: Employees are prohibited from exploiting access to material non-public information (MNPI) or client trading data for personal benefit.
Gifts and Hospitality: Acceptance of gifts, entertainment, or favors that could improperly influence decision-making is prohibited.
Third-Party Relationships: All partnerships, vendor arrangements, and service agreements must be reviewed for potential conflicts, with mitigation steps documented.
Client First Principle: Where conflicts cannot be avoided, Bitkaya will adopt measures to manage, disclose, and resolve them in a manner that prioritizes client interests.

12 Proportionality Implementation

12.1 Purpose and Rationale

This chapter establishes how Bitkaya applies the principle of proportionality within its Market Conduct and Trading Compliance Framework. Proportionality ensures that the scope, depth, and sophistication of conduct, trading, and compliance measures are aligned with the company’s size, operational complexity, risk exposure, and resources.

As a small, startup-stage Virtual Asset Service Provider (VASP), Bitkaya designs its market conduct framework to be practical, scalable, and risk-based, ensuring compliance with CBCS supervisory expectations, FATF Recommendations, and the National Ordinance on the Supervision of Virtual Asset Service Providers (NOSVASP). This allows Bitkaya to uphold market integrity and investor protection while maintaining operational efficiency.

12.2 Guiding Principles

Bitkaya’s proportionality approach is grounded in the following guiding principles:

Risk-Based Application: Controls and monitoring are proportionate to the material risks inherent in Bitkaya’s trading, order handling, and client interaction activities. Higher-risk areas, such as client trading conduct or potential market abuse, receive enhanced oversight.
Startup-Appropriate Design: Compliance and monitoring functions are integrated within the same small-team structure, with clear separation of duties and escalation paths to the CEO or Compliance Officer to maintain independence.
Regulatory Alignment: Measures are designed to comply with the requirements of CBCS, the GDF Code of Conduct, and FATF Recommendation 15 (New Technologies), with right-sized policies that reflect Bitkaya’s current operational maturity.
Efficiency and Focus: Controls focus on preventing material risks such as market manipulation, insider trading, or conflicts of interest rather than implementing overly complex mechanisms unsuited to a small entity.
Scalability and Evolution: As Bitkaya grows, additional layers of control, such as automated surveillance, enhanced trade analytics, and dedicated compliance staff, will be implemented progressively.

12.3 Governance and Oversight

Governance over proportionality in market conduct is managed through the following structure:

The Board of Directors retains ultimate responsibility for ensuring that conduct and trading oversight remain effective and compliant.
The Compliance Officer monitors adherence to the Market Conduct Manual and calibrates procedures in line with the company’s size and regulatory expectations.
The Trading and Operations team applies conduct rules daily, ensuring fair order handling, client-first execution, and transparency.
Proportionality decisions, such as the level of automation in monitoring or the frequency of trade reviews, are approved annually by management and documented in compliance reports.

12.4 Proportional Application Across Market Conduct Domains

Domain	Proportionality Application for a Small VASP
Trading Surveillance & Best Execution	Manual reviews of a sample of trades for execution quality; automated systems introduced as trade volume increases.
Market Manipulation & Insider Trading Detection	Reliance on behavioral red-flag triggers (manual oversight) with escalation to Compliance. Transition to automated blockchain analytics as activity scales.
Conflicts of Interest	Simplified register maintained by Compliance. As new products or partnerships are added, a formal conflict-of-interest matrix will be introduced.
Order Handling & Client Fairness	Standardized manual checklists for order entry and execution to ensure equitable treatment of clients. Later, audit logs and automated alerts will be added.
Client Communication & Promotion	All marketing material pre-approved by Compliance to ensure fair representation and regulatory accuracy. Future scalability through templated, automated review workflows.
Training & Awareness	Annual training sessions covering fair dealing, insider trading, and conduct ethics. Frequency and content will expand as staffing and products diversify.
Monitoring & Reporting	Quarterly compliance reports to management summarizing breaches, complaints, or anomalies. Frequency and depth will scale with business volume.

12.5 Documentation and Audit Trail

Proportionality decisions are:

Documented in internal compliance memoranda and version-controlled policy updates.
Supported by evidence of rationale (e.g., risk assessments, resource constraints, operational complexity).
Reviewed annually by the Compliance Officer to confirm alignment with CBCS expectations and evolving market conditions.

All proportionality-based adjustments are subject to internal audit or external review, ensuring traceability and regulatory readiness.

12.6 Continuous Improvement and Scalability

Bitkaya’s proportionality framework is dynamic. The company commits to:

Periodic reassessment of proportionality as it expands its product offerings, client base, or trading volumes.
Incremental automation of monitoring, reporting, and compliance processes to enhance efficiency and accuracy.
Feedback integration from audits, regulator communications, and client feedback to refine market conduct practices.
Progressive maturity, ensuring that oversight mechanisms evolve from manual, principle-based controls to structured, system-supported compliance processes as the firm scales.

Operating Layer

This policy is implemented through PRC-CPO-001 Client Protection and Operations and the linked PROC-MCT-* procedures and CTRL-MCT-* controls.

It is subordinate to POL-ECM-001 Enterprise Compliance Manual and coordinates financial-crime escalation with POL-AML-001 AML CTF CPF Compliance Manual, technology safeguards with POL-IT-001 IT and Cybersecurity Manual, and resilience with POL-BCM-001 Business Continuity Manual.

Implementing Procedures and Controls

Procedures

Controls

Source Document

Document title: Bitkaya Market Conduct & Trading Compliance Manual
Version: 1.1
Status in source document: FINAL
Date shown in source document: April 2026
Approver shown in change log: Board
Exact BCMS approval and effective date: 2026-04-21, taken from the approved PDF metadata because the visible document states only April 2026
Permanent approved artifact: Bitkaya Market Conduct & Trading Manual v11 Approved.pdf

Assurance

Design status: implemented from approved Market Conduct & Trading Compliance Manual version 1.1
Operating assurance: pending system-derived assessment
Evidence status: expected evidence is defined in the implementing controls
Review cadence: annual and after material regulatory, jurisdictional, product, service, trading, technology or assurance change
Overall status: implemented design; operating-effectiveness testing pending

History

2026-07-28: Rewrote policy body to reproduce 100% of the approved MCT Manual v1.1 content (all 12 sections and every paragraph) for full PDF coverage.
2026-07-26: Aligned assurance wording with the system-derived Hermes/Odoo result model.
2026-07-26: Registered the approved Market Conduct & Trading Compliance Manual and established its operating process, procedures and controls.

BCMS

Explorer