3.115Institutions should establish an approved and documented governance framework for effective decision-making and proper management and control of risks arising from the use of DLT. The governance framework should include the following, as may be relevant depending on the type of DLT:
a.Cover the following elements integral to the functioning of a DLT Application:
b.Ownership model of the DLT platform and the Nodes running on it;
c.The model used to operate and manage the distributed ledger (e.g. a consortium, a single Institution);
d.Rules to govern the ledger(s) including participant and validator rules and restrictions;
e.Approval processes and procedures to grant access to create, read, update or deactivate Data stored on the distributed ledger(s);
f.Managing public and private keys;
g.Consensus protocol; and
h.Off-chain procedures (if any) including parameters for the validity of an off-chain activity and any standards or requirements for off-chains systems are defined and complied with.
i.Define the roles and responsibilities of the key groups involved with respect to the design, development, and operation of the distributed ledger(s). Key groups may include:
i.Core group who will design, govern and operate the distributed ledger(s);
ii.Qualified users of the distributed ledger(s), such as other Institutions and miners;
iii.Participants involved in the distributed ledger(s), such as owners of cryptocurrency etc.; and
iv.Third Parties including Outsourcing Service Providers such as custodians or software developers involved in delivering the service.
3.116Reviews of the DLT Application should be conducted with oversight from Senior Management, prior to launch and thereafter on an on-going basis to ensure its reliability and security.
3.117Institutions should establish clear and unambiguous governing rules for participants of the distributed ledger(s) for onboarding, on-going operations and dispute resolution.
3.118When Outsourcing to an Outsourcing Service Provider, Institutions should ensure that access to information is adequately controlled, monitored, reviewed, and audited by the Institution’s internal control functions, and regulators, or persons employed by them, including supervisory reviews by the respective Supervisory Authority.
3.119Institutions should ensure that their DLT Applications maintain appropriate evidence and records to enable the Institution’s internal control functions, external auditors, regulators, and other authorities to conduct their audits and reviews. Accordingly, Institutions should:
a.Record and store the additional evidence and information to provide auditors with a complete representation of processes, internal controls, financial statements, etc., and for proper accounting treatment of the transaction;
b.Ensure that a log of records of the DLT Application is fully available and accessible to the relevant parties to audit and review;
c.In the event that the DLT is in the form of a blockchain, ensure that off-chain activities, rules and protocols associated with and any link to on-chain activities are recorded and stored; and
d.Ensure that the DLT code and subsequent updates are recorded and stored.