What an examiner wants to see for a large transfer

An examiner asks for the authorisation record on a large withdrawal. The response is a database export showing an approval status and a user identifier, and the examination proceeds from there in a direction nobody enjoys.

Part of Digital asset custody

The examination question

Examinations sample transactions and trace controls. For a large transfer the trace is roughly: who initiated it, who approved it, what were they looking at, and how do you know.

The fourth row is where the conversation typically becomes uncomfortable, because the honest answer includes platform administrators, integration accounts and anyone with production database access.

Why self-generated records are weak

The record is produced by the supervised entity, stored in its systems, and attested by its staff. Every element of it is within the entity's control.

This is not an accusation of misconduct. It is a structural observation about what the record can establish, and it applies equally to entities with excellent controls. The examiner's concern is what the record proves, not what the entity did.

What changes with a verifiable receipt

# What the examiner receives

  transfer-2026-04412.receipt
  issuer-jwks.json          (as published, with rotation history)
  verify                    (the verification tool)

# What they can establish without trusting the entity's systems:

  ✓ the statement was signed by a credential enrolled to a
    named individual
  ✓ user verification was performed at signing
  ✓ the statement contains the destination, asset and amount
    that executed
  ✓ the issuer countersigned at the stated time
  ✓ nothing has been altered since

The examiner is no longer assessing the entity's log integrity. They are checking a signature, which is a mechanical operation with a definite result.

The escalation dimension

Supervisory expectations commonly include escalation procedures: unusual activity is reviewed by someone with authority, and that review is documented.

Escalation records have the same weakness as approval records and one additional one: they are often written after the fact, as a narrative, rather than captured at the moment of decision.

• What triggered the escalation, in structured terms
• What the reviewer was shown, including the alert context
• What they decided, and on what basis
• Whether the transaction proceeded, and who released it

Each of these is capturable at the moment it happens. Reconstructing them from memory and email threads during an examination is what makes examinations long.

What to prepare before an examination

1. Identify the transaction tiers that examiners are likely to sample — typically the largest, the unusual, and any that triggered escalation.
2. For each, establish what record currently exists and who could have written it.
3. Add signed receipts at the approval and escalation points for those tiers.
4. Publish the issuer key at a stable location and document its rotation history.
5. Prepare the verification tool and instructions as part of the examination package.

The fifth point is worth doing deliberately. An examiner handed a verification tool and asked to run it themselves is being offered something unusual, and the offer itself communicates confidence.

Scope, honestly

This addresses the authorisation and escalation records for significant transactions. It does not address transaction monitoring quality, sanctions screening, customer due diligence, or the many other areas an examination covers.

It is one part of a supervisory relationship, and the part where the gap between what entities have and what examiners want is currently widest.

This describes supervisory expectations at a general level and is not legal or compliance advice. Requirements are specific to licence type and jurisdiction; take them to counsel.

The trace an examiner runs

The last row is where the honest answer includes platform administrators, integration accounts and anyone with production database access. That is not an accusation about conduct; it is a structural observation about what the record can establish, and it applies equally to entities with excellent controls.

Objections and honest limits

“Our logs are immutable.” Immutability protects against later alteration. It does not establish that the entry described something a human actually did, because the entry reflects what the application asserted at the time.

“Escalation is documented in the case notes.” Escalation records share the weakness of approval records plus one more: they are usually written after the fact as narrative rather than captured at the moment of decision.

Preparing before the examination

1. Identify the tiers examiners will sample. Largest transfers, unusual ones, anything that triggered escalation.
2. Establish what record exists today. And who could have written it.
3. Add signed receipts at approval and escalation. For those tiers only.
4. Publish the issuer key at a stable location. With a documented rotation history, retained for the full period.
5. Hand the examiner the verification tool. Being asked to run it themselves is unusual, and the offer communicates confidence.

Terms used here

Non-repudiation

The property that the party who authorised an action cannot credibly deny it, because the evidence does not depend on records they control.

Escalation record

Documentation that unusual activity was reviewed by someone with authority. Frequently reconstructed after the fact rather than captured at the decision.

Supervisory examination

A regulator's periodic test of controls, typically by sampling transactions and tracing the evidence behind each.

Frequently asked questions

Why are application approval records weak for an examiner? They are produced, stored and attested by the supervised entity. That is a structural point about what the record proves, not an accusation about conduct.

What does a verifiable receipt let an examiner do? Check a signature mechanically, without assessing the entity's log integrity or database access controls.

Why do escalation records need particular attention? They share the weakness of approval records and are often written after the fact as narrative rather than captured at the moment of decision.

Does this cover the whole examination? No. It addresses authorisation and escalation records for significant transactions — one part of a supervisory relationship, and currently the widest gap.

What does a verifiable receipt change? The examiner checks a signature mechanically instead of assessing your log integrity and database access controls.

Sources and further reading

• NYDFS 23 NYCRR Part 500 — Cybersecurity Requirements
• Published examination manuals and supervisory expectations for money transmission.
• RFC 8037 — CFRG elliptic curve signatures for JOSE
• NYDFS — virtual currency business activity