Retain Transaction Records and Regulatory Data

Purpose

Translate the VASP Ordinance into a testable BCMS requirement for transaction reconstruction, annual accounts, regulatory data and external expert cooperation.

Normative

Bitkaya shall retain VASP transaction records and regulatory data in a manner that supports transaction reconstruction, financial reporting, CBCS reporting and external expert review.

Descriptive

Recordkeeping should allow reconstruction of transactions for at least ten years and support annual account submission, publication where applicable, periodic data submissions, foreign-activity reporting, external expert reviews, management letters, expert notifications and cooperation with CBCS instructions.

Source reference: VASP Ordinance, Articles 41 and 51 through 55; commencement instrument Publicatieblad A 2025 No. 91, Article 1.

Assurance Assertions

• VASP transaction records are retained for at least ten years.
• Regulatory reporting data and annual account evidence are maintained.
• External expert review and CBCS reporting obligations are tracked.

Relationships

• Source: SRC-VASP-001 Landsverordening toezicht virtuele activa dienstverleners
• Policies: POL-AML-001 AML CTF CPF Compliance Manual, POL-ECM-001 Enterprise Compliance Manual
• Processes: PRC-FCI-001 Financial Crime and Integrity, PRC-OTC-001 High-Level Overview of Principal OTC Service Delivery
• Procedures: PROC-AML-004 Perform Transaction Monitoring and Alert Review, PROC-AML-005 Perform FIU Reporting and Case Escalation, PROC-AML-006 Apply Travel Rule and Counterparty VASP Due Diligence, PROC-AML-007 Maintain AML Records and Data Retention
• Controls: CTRL-ABC-005 Ensure ABC Books Records and Payments Are Controlled, CTRL-ABC-007 Ensure ABC Monitoring Training Reporting and Improvement Are Maintained, CTRL-MCT-003 Ensure Best Execution and Order Handling Are Controlled, CTRL-MCT-005 Ensure Client Assets and Custody Are Safeguarded, CTRL-SAFU-004 Ensure Client Assets Are Reconciled and Reported Accurately, CTRL-MCT-007 Ensure Market Conduct Surveillance Reporting and Improvement Operate, CTRL-EMP-006 Ensure Employees Cooperate With Reviews and Audits, CTRL-RMF-003 Ensure Controls Indicators and Remediation Are Monitored, CTRL-RMF-008 Ensure Risk Data Reporting Assurance and Policy Are Governed, CTRL-RMF-009 Ensure Fraud Concerns Are Stopped Escalated and Recorded, CTRL-ICA-003 Ensure Risk Based Internal Audits Are Independent and Complete, CTRL-ICA-004 Ensure Second Line Control Testing Is Effective, CTRL-ICA-005 Ensure External and Regulatory Audits Are Supported, CTRL-ICA-007 Ensure Assurance Competence Evidence and Proportionality, CTRL-REG-001 Ensure Regulatory Obligations and Calendar Are Current, CTRL-REG-002 Ensure Regulatory Submissions Are Complete Accurate and Timely, CTRL-REG-006 Ensure Regulatory Communications and Records Are Traceable, CTRL-ESG-002 Ensure Environmental Metrics and Resource Actions Are Monitored, CTRL-ESG-007 Ensure ESG Reporting Proportionality and Improvement Are Current, CTRL-PRIV-003 Ensure Sensitive Data Retention and Disposal Are Controlled, CTRL-PRIV-006 Ensure AML Sanctions and Regulatory Data Remain Confidential, CTRL-ODOO-002 Ensure Monthly Odoo External Backup Is Completed, CTRL-ODOO-003 Ensure Odoo Backup Storage Access Retention and Disposal Are Controlled, CTRL-ODOO-004 Ensure Odoo Backups Are Verified Logged and Evidenced, CTRL-FIN-001 Ensure Finance Tax Governance Calendar and Proportionality Are Current, CTRL-FIN-002 Ensure Books Records and Financial Close Are Complete and Accurate, CTRL-FIN-003 Ensure Annual Financial Statements Are Approved Reviewed Submitted and Published, CTRL-FIN-004 Ensure CIT and TOT Are Calculated Filed and Paid on Time, CTRL-FIN-005 Ensure Payroll Social Security and Withholding Obligations Are Met, CTRL-FIN-006 Ensure Finance Movements Reconciliations and Exceptions Are Controlled, CTRL-FIN-007 Ensure Authority Requests Reporting Assurance and Remediation Are Managed, CTRL-TRAIN-006 Ensure Training Records Reporting and Improvement Are Maintained
• Systems: SYS-KYT-001 Crystal Intelligence Blockchain Analytics, SYS-FIN-001 Odoo Accounting ERP, SYS-IT-001 Odoo Automated Compliance Monitoring
• Issues: ISS-KYT-001 Approve and Validate Crystal Intelligence Calibration, ISS-SAFU-001 Confirm Safeguarding Architecture Legal Protections and Operating Evidence, ISS-FIN-001 Confirm Finance and Tax Sources Thresholds Systems and Operating Evidence, ISS-IT-001 Confirm Odoo Compliance Automation Security Testing and Operating Evidence, ISS-TRAIN-001 Confirm Training Governance Completion Assessment and Operating Evidence, ISS-OTC-001 Review and Complete Principal OTC Service Flow Controls
• Publications: PUB-KYT-002 Crystal Intelligence Calibration and Change Record, PUB-FIN-001 Bitkaya Accounting Treatment in Odoo SOP, PUB-IT-001 Automated Compliance Monitoring Controls in Odoo SOP, PUB-TRAIN-002 Compliance Department Training, PUB-TRAIN-003 Front Office AML and Sanctions Training, PUB-TRAIN-004 Finance Department Compliance Training, PUB-TRAIN-005 IT Compliance Training, PUB-KYT-001 Odoo Pre-Trade and Post-Trade KYT Controls SOP, PUB-OTC-001 Bitkaya Principal OTC Service Flows Memo

Assurance

• Source verified: yes
• Implementation linked: partial; mapped to current BCMS implementation objects while detailed VASP coverage remains planned
• Wording unambiguous: review

History

• 2026-07-25: Created from SRC-VASP-001, including embedded commencement details.
• 2026-07-26: Added policy, process and procedure mappings; detailed VASP implementation remains planned.