Purpose
Capture FATF expectations for retaining VA/VASP compliance records and making them available for review.
Normative
Bitkaya shall retain VA/VASP compliance records in a secure, retrievable and auditable form, including customer due diligence, transfer information, monitoring results, alerts, reporting decisions, risk assessments, counterparty VASP reviews and evidence of control performance.
Descriptive
Retention periods and record formats are determined by applicable law and Bitkaya policy. This requirement ensures FATF-aligned evidence exists for audit, management review and regulatory review.
Source reference: SRC-FATF-001 FATF Virtual Assets and VASP Standards.
Assurance Assertions
- Required VA/VASP compliance records are defined.
- Records are retrievable for audit or regulatory review.
- Access to confidential compliance records is controlled.
Relationships
- Source: SRC-FATF-001 FATF Virtual Assets and VASP Standards
- Parent policy: POL-ECM-001 Enterprise Compliance Manual
- Process: PRC-OTC-001 High-Level Overview of Principal OTC Service Delivery
- Regulatory-change procedure: PROC-ECM-002 Assess Regulatory Change and Framework Impact
- Regulatory-change control: CTRL-ECM-002 Ensure Regulatory Change Impact Assessment Is Completed
- Framework library: SYS-ECM-001 Compliance Framework Library
- Related VASP requirements: REQ-VASP-001 through REQ-VASP-015, where applicable
- Detailed AML/CFT/CPF manual objects: pending
Assurance
- Source verified: yes
- Implementation linked: parent-framework only
- Wording unambiguous: review
- Detailed operating procedure linked: pending future detailed manuals where applicable
History
- 2026-07-25: Created from consolidated FATF VA/VASP source object.