Objective
Ensure annual ethics certifications are complete and the handbook remains approved, proportionate and responsive to change.
Control Activity
Compliance obtains annual certifications, investigates exceptions and completes an annual and event-driven handbook review covering conduct trends, framework effectiveness, proportionality and required amendments. Verification requirements include:
- Everyone must certify compliance with the Code of Ethics annually; breaches can result in disciplinary action, termination, and regulatory reporting.
- Proportionality assessment must verify right-sized controls suitable for a small company but scalable for growth (e.g., a single Compliance Officer overseeing multiple control areas, supported by automated systems and external advisors).
- Scalable frameworks must be reviewed periodically to ensure they evolve with business expansion, technological changes, or new regulatory requirements.
- Practical resource allocation must maintain clearly defined responsibilities and accountability at all levels.
- Technology leverage must use automated tools and cloud-based systems to ensure consistency, reduce manual errors, and maintain efficient oversight without excessive cost.
- Review must confirm compliance with Curaçao’s Landsverordening toezicht virtuele activa dienstverleners and readiness for future supervisory expectations under the CBCS.
- Employees must follow procedures relevant to their job function, report risks or inefficiencies to their manager or Compliance Officer, and adapt to changes as the company grows and policies evolve.
Evidence
- Expected evidence: In-scope population and annual certifications
- Expected evidence: Exception follow-up and escalation
- Expected evidence: Conduct, training and control trend analysis
- Expected evidence: Proportionality and effectiveness assessment
- Expected evidence: Review, approval, publication and communication record
- Evidence location: source evidence in SYS-ECM-001 Compliance Framework Library, SYS-ECM-002 Compliance Reporting and Evidence Repository; target Hermes assessment record in Odoo under ISS-HERMES-001.
- Retention: according to the applicable approved policy and Bitkaya record-retention requirements.
- Testing method: reconcile certifications to the in-scope population and inspect the annual review for evidence, decisions, approvals and completed change actions
- Testing frequency: annual and after material change
Relationships
- Requirements: REQ-VASP-003 Maintain Governance and Fit and Proper Oversight, REQ-VASP-005 Maintain Integrity Based Business Operations
- Policy: POL-EMP-001 Employee Handbook
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Procedure: PROC-EMP-007 Review Employee Ethics Proportionality and Handbook Changes
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: implemented
History
- 2026-07-26: Normalized evidence metadata and separated design status from runtime effectiveness.
- 2026-07-26: Created from the approved Employee Handbook version 1.0.