MTD-POL-02 · Record Retention Policy (v1.4)

Identity, integrity & provenance

Document id

mtd-pol-02

sha256 (the integrity anchor citations pin to)

d6dda34f4d415fcad5589bae71497e993037358e2c1d249fc444dc40ee010803

Covers the extracted text, 1485 characters of it.

Added by

Demo User

Added at

2026-10-04 18:51 UTC

Source

register_document

Retain until

2032-10-04

Document control — provenance carried to the assessment stages as evidence metadata

Reference

MTD-POL-02

Version

1.4

Owner

Head of Compliance

Approved by

the Board

Approved

15 May 2025

Classification

Internal

Next review due

May 2027 (biennial)

Allocated to assessments

Where this document's content was filed at triage — 3 sections. A section can be allocated to more than one assessment. Change it with Triage and allocate, in the actions at the top of this page.

3.1 Retention period for transaction records

3.1 Records of transaction data, including payment messages and accompanying information, are retained for seven years from the date of the transaction.

EU 2023/1113 — Mittenda Limited

Mittenda Limited owns and operates the retention of its own transaction records, including payment messages and accompanying information, as a PSP/CASP under EU 2023/1113. It is the only assessment unit and the entity that must act on this retention period.

3.2 Deletion on expiry of retention period

3.2 On the expiry of the applicable retention period, records containing personal data are deleted in accordance with the Data Protection Policy, unless a legal hold applies.

EU 2023/1113 — Mittenda Limited

Mittenda Limited performs the deletion of its own transaction records containing personal data at the end of retention. The deletion of transfer information after retention is part of the regime this assessment covers, and Mittenda is the unit that owns the activity.

3.3 Form of retained records: reconstruction and admissibility

3.3 Records are retained in a form that permits the reconstruction of individual transactions and is admissible in legal proceedings.

EU 2023/1113 — Mittenda Limited

Mittenda Limited owns the form in which its transaction records are kept so that individual transactions can be reconstructed. That supports its record-keeping duties as a PSP/CASP under EU 2023/1113, and it is the unit that must act on it.

Not allocated

Text no triage section covers — 5 passages. Often this is the title, document-control metadata or sign-off; if any of it belongs to an assessment, file it with Triage and allocate, in the actions at the top of this page.

# Mittenda Limited · Record Retention Policy (v

) · specimen excerpt > **Synthetic specimen.** Mittenda Limited is a fictional firm. This document is invented, > derived from scenarios seen in practice, and contains deliberate deficiencies for > demonstration. It is not a template and must not be adopted. **Document control:**

. | Version | Date | Change | |---|---|---| |

| May 2025 | Crypto-asset transfer records added to the schedule | | 1.3 | November 2023 | Reconstruction requirement made explicit | *[Earlier versions omitted]* **Contents** 1. Purpose 2. Retention schedule 3. **Transaction records** 4. Customer due diligence records 5. Deletion and legal holds Appendix A: Record classes and periods *Sections in bold are excerpted below.* *[Sections 1 and 2 omitted]* ## 3. Transaction records

*[Sections 4 onward and Appendix A omitted]*

Document text

1485 chars

Mittenda Limited · Record Retention Policy (v1.4) · specimen excerpt

Synthetic specimen. Mittenda Limited is a fictional firm. This document is invented, derived from scenarios seen in practice, and contains deliberate deficiencies for demonstration. It is not a template and must not be adopted.

Document control: MTD-POL-02 · owner: Head of Compliance · approved: the Board, 15 May 2025 · classification: Internal · next review due: May 2027 (biennial).

Version	Date	Change
1.4	May 2025	Crypto-asset transfer records added to the schedule
1.3	November 2023	Reconstruction requirement made explicit

[Earlier versions omitted]

Contents

Purpose
Retention schedule
Transaction records
Customer due diligence records
Deletion and legal holds

Appendix A: Record classes and periods

Sections in bold are excerpted below.

[Sections 1 and 2 omitted]

3. Transaction records

3.1 Records of transaction data, including payment messages and accompanying information, are retained for seven years from the date of the transaction.

3.2 On the expiry of the applicable retention period, records containing personal data are deleted in accordance with the Data Protection Policy, unless a legal hold applies.

3.3 Records are retained in a form that permits the reconstruction of individual transactions and is admissible in legal proceedings.

[Sections 4 onward and Appendix A omitted]

What it evidences

Risks (2):Travel-rule accompanying-information records not retained for five years Personal data not deleted upon expiry of the five-year retention period

Controls (14):Travel-rule records retention policy and staff training Personal-data expiry deletion policy and training Storage-limitation policy and training for travel-rule records Verification audit trail retention Post-dispatch sampling review of outbound beneficiary-name field Post-dispatch sampling review of request-response pairs Per-transfer admissibility audit trail retention Outbound originator-name post-dispatch sampling review Post-dispatch sampling review of outbound beneficiary-information Post-dispatch sampling review of verification Missing-information detection audit-trail retention Post-dispatch originator-information sampling review

12 of 14 shown

Obligations (13):Five-year retention of transfer information records Deletion of personal data on expiry of the retention period Intermediary PSP retains originator and beneficiary information with the transfer Obtain and hold information for transfers to a self-hosted address Full and prompt responses to AML/CFT authority enquiries Personal data processed only for AML/CFT purposes Transmit and retain accompanying originator and beneficiary information Obtain and hold information for transfers from a self-hosted address No retention of party information beyond what is necessary Transitional retention for proceedings pending on 25 June 2015 GDPR-compliant transmission of personal data at all times Documentation of all transfers with missing information

12 of 13 shown

Cited by (32):

Cited by	Suggestion	Version	When
Mittenda Limited	Coverage Not evidenced — On-demand retrieval index for originator KYC information sg-0386	current — v1`sha256 d6dda34f4d415fcad5589bae71497e993037358e2c1d249fc444dc40ee010803`	2026-10-04 20:13
Mittenda Limited	Coverage Not evidenced — Post-dispatch exemption classification audit sg-0370	current — v1`sha256 d6dda34f4d415fcad5589bae71497e993037358e2c1d249fc444dc40ee010803`	2026-10-04 20:13
Mittenda Limited	Coverage Not evidenced — Post-dispatch originator-information sampling review sg-0366	current — v1`sha256 d6dda34f4d415fcad5589bae71497e993037358e2c1d249fc444dc40ee010803`	2026-10-04 20:13
Mittenda Limited	Coverage Not evidenced — Missing-information detection audit-trail retention sg-0365	current — v1`sha256 d6dda34f4d415fcad5589bae71497e993037358e2c1d249fc444dc40ee010803`	2026-10-04 20:13
Mittenda Limited	Coverage Not evidenced — Post-dispatch sampling review of verification sg-0361	current — v1`sha256 d6dda34f4d415fcad5589bae71497e993037358e2c1d249fc444dc40ee010803`	2026-10-04 20:13
Mittenda Limited	Coverage Not evidenced — Post-dispatch sampling review of outbound beneficiary-information sg-0350	current — v1`sha256 d6dda34f4d415fcad5589bae71497e993037358e2c1d249fc444dc40ee010803`	2026-10-04 20:13
Mittenda Limited	Coverage Not evidenced — Per-transfer admissibility audit trail retention sg-0330	current — v1`sha256 d6dda34f4d415fcad5589bae71497e993037358e2c1d249fc444dc40ee010803`	2026-10-04 20:13
Mittenda Limited	Coverage Not evidenced — Outbound originator-name post-dispatch sampling review sg-0331	current — v1`sha256 d6dda34f4d415fcad5589bae71497e993037358e2c1d249fc444dc40ee010803`	2026-10-04 20:13
Mittenda Limited	Coverage Not evidenced — Post-dispatch sampling review of request-response pairs sg-0321	current — v1`sha256 d6dda34f4d415fcad5589bae71497e993037358e2c1d249fc444dc40ee010803`	2026-10-04 20:13
Mittenda Limited	Coverage Not evidenced — Post-dispatch sampling review of outbound beneficiary-name field sg-0318	current — v1`sha256 d6dda34f4d415fcad5589bae71497e993037358e2c1d249fc444dc40ee010803`	2026-10-04 20:13

10 of 32 shown

Assistant findings

32 grounded in this document

What the assistant surfaced from this document — accept or reject them on the findings and coverage page.

Finding	Value	Confidence	Status
Five-year retention of transfer information records sg-0011	Partial	Medium	Accepted
the Board sg-0013	the Board (group)	High	Accepted
Head of Compliance sg-0015	Head of Compliance (person)	High	Accepted
Deletion of personal data on expiry of the retention period sg-0019	Partial	Medium	Accepted
Travel-rule records retention policy and staff training sg-0035	Partial	Medium	Accepted
Personal-data expiry deletion policy and training sg-0043	Partial	Medium	Accepted
Storage-limitation policy and training for travel-rule records sg-0049	Not evidenced	Medium	Accepted
Travel-rule accompanying-information records not retained for five years sg-0053	marks risk live	Medium	Accepted
Personal data not deleted upon expiry of the five-year retention period sg-0054	marks risk live	Medium	Accepted
Personal data not deleted upon expiry of the five-year retention period sg-0064	Either align the transaction-record period in MTD-POL-02 §3.1 to five years, or record the national-law provision and AML/CFT purpose that permit the further two years. Give the legal-hold exception in §3.2 a stated basis and an upper limit.	Medium	Accepted

10 of 32 shown

Audit timeline

Every event on this document (48)

When (UTC)	Actor	What	Change
2026-10-06 13:38:03	Demo User	Document viewed	"MTD-POL-02 · Record Retention Policy (v1.4)" opened on the register detail.
2026-10-06 13:38:02	Demo User	Document content_accessed	Content read by a Restricted clearance (document Internal).
2026-10-06 10:10:55	Demo User	Document viewed	"MTD-POL-02 · Record Retention Policy (v1.4)" opened on the register detail.
2026-10-06 10:10:54	Demo User	Document content_accessed	Content read by a Restricted clearance (document Internal).
2026-10-06 10:05:26	Demo User	Document viewed	"MTD-POL-02 · Record Retention Policy (v1.4)" opened on the register detail.
2026-10-06 10:05:26	Demo User	Document content_accessed	Content read by a Restricted clearance (document Internal).
2026-10-06 08:53:35	Demo User	Document viewed	"MTD-POL-02 · Record Retention Policy (v1.4)" opened on the register detail.
2026-10-06 08:53:34	Demo User	Document content_accessed	Content read by a Restricted clearance (document Internal).
2026-10-05 10:21:56	Demo User	Document viewed	"MTD-POL-02 · Record Retention Policy (v1.4)" opened on the register detail.
2026-10-05 10:21:56	Demo User	Document content_accessed	Content read by a Restricted clearance (document Internal).
2026-10-04 20:13:07	Demo User	Document cited	Cited by an accepted suggestion.
2026-10-04 20:13:07	Demo User	Document cited	Cited by an accepted suggestion.
2026-10-04 20:13:07	Demo User	Document cited	Cited by an accepted suggestion.
2026-10-04 20:13:07	Demo User	Document cited	Cited by an accepted suggestion.
2026-10-04 20:13:07	Demo User	Document cited	Cited by an accepted suggestion.
15 of 48 shown