complianceOctober 19, 2026 · 8 min read
What regulators ask a crypto exchange for: the technical file, explained
The technical sections of a VASP or CASP application, what evidence each one needs, and which parts your software vendor should hand you ready-made.
BitPolaris Engineering
Two halves of an application
The legal half is yours and your counsel’s: entity, capital, governance, fit-and-proper persons, business plan. The technical half is about the system: how client assets are kept apart, how identities are verified, how incidents are handled, where data lives. Most delays come from the technical half being written from scratch.
The technical sections
| Section | What they want to see | Evidence |
|---|---|---|
| System description | Architecture, environments, third parties, hosting | Diagrams, provider list, data-flow map |
| Custody & segregation | Client assets separate from company assets; key management | Wallet tiers, policy, reconciliation method, PoR exports |
| ICT risk (DORA) | Controls, incident classes, backups, third-party register | Control mapping, restore drill records |
| AML / KYC | Tiers, screening, record keeping | Provider contracts, decision logs |
| Travel rule | Originator / beneficiary data on transfers | Data fields, export format, thresholds |
| Market integrity | Market-making disclosure, self-trade prevention | Volume split reports |
| Security testing | Independent testing and remediation | Pen-test summary, disclosure policy |
What to demand from a vendor
- A written technical file mapped to your regime, not a marketing deck.
- Proof that reserves are reconciled against the chain, not only against the vendor’s own database.
- An audit log covering every money action and settings change, exportable.
- Self-hosting if your regime requires control of keys; ask where the keys are, precisely.
- Dual KYC providers or at least a documented fallback.
BitPolaris delivers the technical file with every deployment; your counsel runs the application.