Compliance Infrastructure
Compliance is not a feature we added. It is the foundation.
OpenAssets was designed to produce institutional-grade records that hold up to regulatory scrutiny from the first commit.
Regulatory Context
What the regulations actually require from your data layer
Requires broker-dealers and investment advisers to preserve electronic records in a non-rewriteable, non-erasable format. Records must be indexed and accessible for immediate production to examiners. Retention periods vary by record type: 6 years for most, 3 years for many operational records.
OpenAssets addresses: Ownership records are written to an append-only log. Structured export available on demand. Retention configuration matches record-type requirements.
Requires financial institutions to develop, implement, and maintain a comprehensive information security program to protect customer financial data. The 2023 updated Safeguards Rule added specific technical controls: encryption, MFA, access controls, and incident response requirements.
OpenAssets addresses: AES-256 encryption at rest and in transit, role-based access with full activity log, configurable data residency, documented incident response procedures.
Requires futures commission merchants and introducing brokers to maintain books and records in their original form, indexed, and readily accessible. Records must be producible to CFTC examiners within one day. Retention minimum 5 years, with the first 2 years in an easily accessible location.
OpenAssets addresses: Complete ownership history available via structured export within minutes. Indexed record store with timestamps and provenance for each entry.
Technical Controls
What institutional compliance requires from your data layer
Every ownership event is committed to an append-only log. No record can be modified or deleted after commitment. Log entries contain timestamp, user, action type, and affected record IDs.
Every user action is scoped by role and logged. Administrative provisioning, data access, exception resolution, and export generation all appear in the activity log with user attribution.
AES-256 encryption at rest, TLS 1.3 in transit. Encryption keys are customer-scoped and rotated on a defined schedule. Key management is isolated from application access.
Each normalized record retains a reference to its source feed, source record identifier, transformation log, and the time each transformation was applied. Lineage is queryable and exportable.
Exceptions are flagged with structured context: what conflicted, from which sources, at what time. Escalation paths are configurable by asset class, threshold, and user role. Every resolution is logged.
Export packages are pre-formatted for SEC 17a-4 production requests, GLBA data subject access, and CFTC examiner requests. Format templates are maintained and updated as regulatory guidance changes.
Retention periods are configurable by record type and regulatory requirement. Records subject to litigation hold can be flagged independently of standard retention cycles. Deletion requires administrative confirmation and generates a log entry.
Sample Audit Trail
Every reconciliation event is logged and attributable
Here is what the audit trail looks like. Every action on every record produces an entry. This sample represents five sequential events on related positions.
| Timestamp (UTC) | Asset ID | Event Type | Status |
|---|---|---|---|
| 2026-07-03 08:14:52 | OAX-00142 | Ownership Transfer | Reconciled |
| 2026-07-03 08:15:11 | OAX-00143 | Position Reconciled | Reconciled |
| 2026-07-03 09:02:37 | OAX-00144 | Exception Flagged | Exception Flagged |
| 2026-07-03 11:43:09 | OAX-00144 | Exception Resolved | Resolved |
| 2026-07-03 14:28:55 | OAX-00145 | Custody Confirmation | Reconciled |
Reporting Outputs
Reports your auditors and regulators can actually use
Structured record export
Machine-readable export in JSON or CSV format. Every record includes its lineage chain, source provenance, transformation log, and retention classification.
Timestamped ownership trail
Complete ownership history for any position, queryable by asset, date range, counterparty, or event type. Every entry carries a verifiable UTC timestamp.
17a-4 WORM compliance path
For SEC-regulated entities, OpenAssets supports a WORM (Write Once Read Many) output path for critical ownership records. Records committed to the WORM path cannot be altered or deleted.
Talk to our compliance team
We can walk through how OpenAssets handles the specific record-keeping and reporting requirements that apply to your firm.