Regulatory Compliance

Compliance isn't a feature. It's the foundation. Every module maps to a specific CMA, CBK, or ODPC requirement.

Regulatory Framework

Capital Markets Authority (CMA)

VaTViT is designed for CMA Regulatory Sandbox entry. Our system boundary design ensures we operate as a Financial Operating System — not a broker, and not a fund manager.

Sandbox application in preparation
System boundary compliance
Capital requirements met
Annual audits scheduled

Central Bank of Kenya (CBK)

Full compliance with CBK anti-money laundering guidelines and forex regulations.

AML transaction monitoring
Sanctions screening (CBK watchlists)
7-year document retention
Quarterly CBK reporting

Data Protection Act (ODPC)

All personal data of Kenyan users stored in-country with full GDPR-equivalent protection.

Nairobi-region data residency
Data Processing Agreements
Right-to-erasure support
Privacy by design

Key Compliance Modules

KYC / AML

Smile ID integration for identity verification. Real-time AML transaction monitoring. Fully automated — no manual queues.

Audit Trail

Every action logged immutably. User activity, system changes, ledger transactions. 7-year retention policy.

Data Security

End-to-end encryption, role-based access control, multi-factor authentication, and continuous vulnerability scanning.

Legal Agreements

Broker Compliance

Broker credential management, segregated account verification, and real-time position reconciliation.

Customer Support

Dedicated compliance support team. Response time: <24 hours for regulatory queries.

Security & Encryption

Enterprise-Grade Security

TLS 1.3 for all data in transit
AES-256 encryption for data at rest
mTLS for service-to-service communication
JWT signed tokens with RS256
OAuth 2.0 with PKCE flow
Hardware security module (HSM) for key storage
Regular penetration testing
ISO 27001 certification in progress

Regulatory Status

We are actively working with regulators to ensure VaTViT meets all requirements.