Annexe 5 — Modèle AOC

Annex 5 — AOC (Attestation of Compliance) Template#

A5.0. Purpose#

The Attestation of Compliance (AOC) is a public declaration of conformance with the CCSA standard. It is signed by the Assessed Entity, the Lead Auditor (from the CCSAC), and is registered in the Council Listed Validated Crypto Solutions (LVCS) Registry.

Unlike the ROC, the AOC is published publicly and is used to confirm compliance to customers, regulators, insurers, and banking partners.

A5.1. AOC Structure#

==============================================
CCSA Attestation of Compliance (AOC)
==============================================

PART 1  — Identification
PART 2  — Assessed Solution Description
PART 3  — Type of Assessment
PART 4  — Audit Information
PART 5  — Compliance Statement
PART 6  — Public Compliance Summary
PART 7  — Public Findings Summary
PART 8  — Baseline Carry-Over Applied
PART 9  — Compensating Controls Summary
PART 10 — Customized Approach Summary
PART 11 — Validity & Status
PART 12 — Action Plan for Non-Compliant Status (if applicable)
PART 13 — Acknowledgements & Signatures
PART 14 — Council Registration
==============================================

A5.2. AOC Template (full text)#

+===========================================================+
|                                                            |
|       CCSA ATTESTATION OF COMPLIANCE                       |
|       CCSA Standard v0.2 (draft toward v1.0)               |
|                                                            |
+===========================================================+


PART 1 — Identification
-----------------------

Assessed Entity:        ____________________________________
Legal Address:          ____________________________________
Tax / Registration ID:  ____________________________________
Primary Contact:        ____________________________________

CCSA Listing ID:        ____________________________________
                        (assigned by Council upon listing)


PART 2 — Assessed Solution Description
--------------------------------------

Product/Service Name:   ____________________________________
Product Version:        ____________________________________
Brief Description:      ____________________________________
                        ____________________________________

Segment Classification:
  [ ] C.1 — Custodial Wallets / Custodians
  [ ] C.2 — Non-Custodial Wallets (vendor scope)
  [ ] C.3 — Cryptocurrency Exchanges (CEX/DEX)
  [ ] C.4 — Issuers (Stablecoins / RWA / Fiat-tokens)

Supported Blockchains:  ____________________________________
                        ____________________________________

Supported Languages:    ____________________________________

Documentation URL:      ____________________________________
Website:                ____________________________________


PART 3 — Type of Assessment
---------------------------

Assessment Type:
  [ ] Initial certification
  [ ] Annual re-certification
  [ ] Material change re-assessment
  [ ] Incident-driven re-assessment

Approach Used:
  [ ] Defined Approach only
  [ ] Mix of Defined Approach + Customized Approach
  [ ] Defined Approach + Compensating Controls
  [ ] All three (Defined + Customized + Compensating)

Methodology Notes:      ____________________________________
                        ____________________________________


PART 4 — Audit Information
--------------------------

CCSAC (Audit Company):     _________________________________
CCSAC Accreditation #:     _________________________________
CCSAC Country:             _________________________________

Lead Auditor:              _________________________________
Lead Auditor CCSA-QSA #:   _________________________________

Audit Period:              From _________ to _________
ROC Reference:             _________________________________
                          (internal, not public)

Total Audit Effort:        ___ person-days


PART 5 — Compliance Statement
-----------------------------

Based on the assessment conducted in accordance with CCSA Standard
(version above) and documented in the associated Report on Compliance,
the undersigned Lead Auditor attests that:

[Assessed Entity Name]
[Assessed Solution Name]

has demonstrated compliance with the requirements of CCSA Standard
at the following level:

  [ ] LEVEL 1 (Foundation)
        ≥ 90% In Place ratio; ≤ 10% CC ratio; 0 Not in Place
        All Critical Requirements In Place via Defined Approach
  [ ] LEVEL 2 (Standard)
        ≥ 95% In Place ratio; ≤ 5% CC ratio; 0 Not in Place
        All Critical Requirements In Place via Defined Approach
  [ ] LEVEL 3 (Advanced)
        100% In Place OR ≤ 2.5% CC with Council approval; 0 Not in Place
        All Critical Requirements In Place via Defined Approach

Outcome:
  [ ] PASS
  [ ] CONDITIONAL PASS (see Action Plan PART 12)
  [ ] FAIL

This Attestation does NOT constitute:
- A guarantee of absence of vulnerabilities outside the audit scope
- A guarantee of future compliance or security
- An audit of financial statements or reserve adequacy
- An audit of smart contract logic (separate engagement type)

CCSA Standard reduces, but does not eliminate, security risk.


PART 6 — Public Compliance Summary
----------------------------------

Overall Assessment Status:
  Total applicable Mandatory requirements:      ___
  In Place (including In Place with Customized): ___ (___% )
  Compensating Control:                         ___ (___% )
  Not in Place:                                 ___ (___% )
  Not Applicable:                               ___

Domain Status Breakdown:

  B.1  Cryptographic Material Inventory and Classification:  ___% In Place
  B.2  Generation of Cryptographic Material:                  ___% In Place
  B.3  Storage of Cryptographic Material:                     ___% In Place
  B.4  Usage of Cryptographic Material:                       ___% In Place
  B.5  Lifecycle Management:                                  ___% In Place
  B.6  Wallet Architecture for CCM:                           ___% In Place
  B.7  Compromise Detection and Monitoring:                   ___% In Place
  B.8  Personnel and Access Control:                          ___% In Place

Critical Requirements (per Section D.2.5):
  [ ] All Critical Requirements In Place via Defined Approach
  [ ] [If not all] List of non-compliant Critical Requirements: ____________


PART 7 — Public Findings Summary
--------------------------------

Strengths (3–5 highlights):
1. _____________________________________________________
2. _____________________________________________________
3. _____________________________________________________

Areas for Future Improvement (3–5 high-level items):
1. _____________________________________________________
2. _____________________________________________________
3. _____________________________________________________

(Detailed findings are in the Report on Compliance, which is
confidential per ROC Section 14 Confidentiality requirements.)


PART 8 — Baseline Carry-Over Applied
------------------------------------

The following baseline certifications were applied for carry-over
(per Section A):

  [ ] PCI DSS v4.0.1: Level ___, expiry _________________
  [ ] GOST R 57580:   level ___, assessment date __________
  [ ] CCSS v8.0:      Level ___, expiry _________________
  [ ] SOC 2:          Type ___, period _________________
  [ ] ISO/IEC 27001:  Date _________________
  [ ] MiCA:           Status _________________
  [ ] Other:          _________________________________________

Percentage of Mandatory requirements addressed via Full carry-over: ___%
Percentage of Mandatory requirements addressed via Partial carry-over: ___%


PART 9 — Compensating Controls Summary
--------------------------------------

Number of Compensating Controls applied:                ___
Percentage of Mandatory requirements via CC:            ___%
                                            (max for Level: ___%)

High-level CC description (without confidential specifics):
1. _____________________________________________________
2. _____________________________________________________
3. _____________________________________________________

(Full Compensating Controls details are in the ROC.)


PART 10 — Customized Approach Summary
-------------------------------------

Number of requirements addressed via Customized Approach:  ___

High-level description Customized Approach implementations:
1. [Requirement ref] — [brief description objective achievement]
2. _____________________________________________________
3. _____________________________________________________

(Full Customized Approach documentation in ROC Section 9.)


PART 11 — Validity & Status
---------------------------

This Attestation is valid:
  From:  _________________
  Until: _________________

Re-assessment required by:  _________________

Current Status (filled by Council):
  [ ] Active
  [ ] Pending renewal (expires within ___ days)
  [ ] Suspended (reason: ___________________________)
  [ ] Incident-flagged (date: ___________________)
  [ ] Terminated (reason: ___________________________)


PART 12 — Action Plan for Non-Compliant Status
----------------------------------------------

[Completed ONLY for a CONDITIONAL PASS or FAIL outcome]

Non-Compliant Items:

| Requirement | Status | Remediation Action | Target Date | Owner |
|-------------|--------|-------------------|-------------|-------|
| B.X.Y       | Not in Place | _____________ | YYYY-MM-DD | _____ |
| ...         | ...    | ...               | ...         | ...   |

Re-validation Plan:
[Description of when and how re-validation will be conducted to
confirm closure of non-compliant items]


PART 13 — Acknowledgements & Signatures
---------------------------------------

LEAD AUDITOR ATTESTATION

By signing, I attest:

(a) I conducted this assessment in accordance with CCSA Standard
    and the CCSA Code of Professional Responsibility;

(b) The findings represented in this AOC and associated ROC are based
    on evidence collected during the audit period;

(c) I had no prior consulting engagement with the Assessed Entity in
    the last 12 months in areas covered by this audit;

(d) This Attestation accurately reflects the results of the assessment;

(e) I understand the limitations of this assessment (see ROC Section 12 Limitations of Assessment).

  Name:      _________________________________________
  Title:     Lead Auditor, [CCSAC Name]
  CCSA-QSA: # _______________________________________
  Date:      _________________________________________
  Signature: _________________________________________


CCSAC QUALITY MANAGER ATTESTATION

By signing, I confirm:

(a) This AOC and associated ROC have passed internal quality review
    per [CCSAC Name]'s Quality Management Procedures;

(b) The Lead Auditor holds a valid CCSA-QSA registration;

(c) The audit team had adequate qualifications for the assessment scope;

(d) Evidence retention complies with ROC Section 14 Confidentiality requirements.

  Name:      _________________________________________
  Title:     Quality Manager, [CCSAC Name]
  Date:      _________________________________________
  Signature: _________________________________________


ASSESSED ENTITY EXECUTIVE ATTESTATION

By signing, I, as a duly authorized representative of the
Assessed Entity, attest that:

(a) Information provided to the Lead Auditor was complete and
    accurate to the best of our knowledge;

(b) We agree to:
    1. Maintain security controls described in the ROC
    2. Promptly notify Council of any material change
       affecting compliance status (within 72 hours)
    3. Cooperate with any Council-initiated Quality Assurance
       review (random sampling per Section D.4.3)
    4. Apply for re-certification by the date specified in PART 11
    5. Notify Council immediately upon any security incident
       affecting CCM (per Section B.7.4 regulatory notification)

(c) We acknowledge that this Attestation does not constitute legal,
    financial, or insurance advice; it is solely a statement of
    security compliance status as of the audit date.

  Name:      _________________________________________
  Title:     _________________________________________
  Date:      _________________________________________
  Signature: _________________________________________


PART 14 — Council Registration
------------------------------

This Attestation has been registered in the CCSA Listed Validated
Crypto Solutions (LVCS) Registry under:

  Listing ID:        _____________________________
  Listing Date:      _____________________________
  Council Officer:   _____________________________
  Registry URL:      https://lvcs.ccsa-council.com/[Listing-ID]

  QR Code for verification: [QR placeholder]


==============================================
END OF ATTESTATION OF COMPLIANCE
==============================================

A5.3. AOC Public Disclosure#

A5.3.1. What is published in the LVCS Registry#

After registration:

• The full text of the AOC (Parts 1–14) — a public PDF
• Structured data for API access:
  • Entity name, segment, level, dates, auditors, In Place ratio per domain
• A CCSA Badge for use by the Assessed Entity (with mandatory linking to the live registry entry)

A5.3.2. What is NOT published#

• The ROC (full report) — confidential
• Working papers
• Compensating Controls details (only the high-level summary in Part 9)
• Customized Approach implementation details (only the high-level summary in Part 10)
• Confidential business information
• Personally Identifiable Information of employees or customers
• Specific cold storage addresses (where applicable for C.1, C.3)

A5.4. AOC Updates#

A5.4.1. Minor updates#

For minor changes (for example, updating contact persons or the Website URL), the AOC is updated through the Council Portal without a full re-issue.

A5.4.2. Material Changes#

For material changes (new products, new segments, substantial changes to infrastructure, new blockchain integrations), a material change re-assessment and issuance of a new AOC are required.

A5.4.3. Status Changes#

The Council has the right to update the status (Active / Pending Renewal / Suspended / Incident-flagged / Terminated) upon materializing events. The status change is published in the LVCS Registry within 24 hours of the decision.

A5.5. AOC Verification#

Third parties may verify an AOC through:

1. LVCS Registry on the Council website — search by Listing ID or organization name
2. API — programmatic verification (REST endpoint, JSON response)
3. QR code on the AOC PDF — direct link to the registry entry

A5.6. AOC Falsification Detection#

When falsification or misrepresentation of an AOC is detected:

• The Council removes the listing
• A public press release with a description of the findings (without sensitive assessment details)
• Civil action is possible under applicable jurisdiction
• Inclusion in a blacklist (shared with other standards bodies through a formal Memorandum of Understanding)

A5.7. Multi-language Publication#

The AOC is issued in:

• Russian (primary for RF-based CCSACs)
• English (international)
• Other languages on request (Kazakh, Uzbek — planned for Q4 2027+)

All language versions have equal authority. The Council maintains reconciliation between translations for consistency.

Related#

• 16 — Annex 4 — SAQ Variants — previous
• 15 — Annex 3 — ROC Reporting Template — confidential counterpart of the AOC
• 12 — Section D — Certification Levels — methodology for determining the level

Sources#

See Section 0.4 Normative References of the Front Matter.

Conceptual reference: PCI DSS AOC v4.0.1 (PCI SSC) — the structure of an attestation of compliance.