Recordkeeping is a data structure, not a document hunt · September 2026
Every venue believes it keeps good records until the first document request arrives. Then "we have everything" becomes three weeks of engineers grepping S3, a compliance officer reconstructing a disposition from Slack, and a cover letter explaining why two exports of the same trade history disagree. The problem is never that the data doesn't exist. It's that the records were never built as records — they were exhaust.
The CFTC's recordkeeping rule is quietly a systems-design document: records must be kept in a form that preserves them from alteration, retrievable by the Commission's timeline, with the audit trail intact. Translate that from legalese into engineering and you get three properties: append-only storage (nothing dispositive is editable after the fact), cryptographic integrity (you can prove a record is the record), and retrieval as a first-class operation (scoped to a request, not a data dump).
Hash every artifact at write. Then hash the manifest of every package so each entry commits to the one before — H(n) = sha256(H(n−1) ‖ shaₙ). Now the exchange and the examiner can independently verify that nothing in a production was added, removed, or reordered after assembly. When scope changes mid-exam (it always does), a re-scoped package supersedes with a new manifest version and the prior one stays on the timeline. The argument about "which version did you send us" simply cannot occur.
The deeper shift: stop shipping records and start hosting the review. A regulator seat that is read-only, scoped to the cases in the request letter, and time-boxed turns a three-week production into an afternoon — and the seat's own page views become part of the record — the posture of a program that expects to be examined, visible in its own data structures.
This inverts the usual dynamic. A venue that fears its records negotiates scope; a venue that trusts them grants access. One of these postures shortens exams.
Pick a disposition from last quarter and ask for the complete story: the alert, the detection facts and thresholds in force that day, who proposed the disposition, who approved it (and that they were different people), every document generated, and the hash chain proving none of it moved. If assembling that takes longer than a coffee, the gap isn't discipline — it's architecture. Records that require heroics on request day were never records.
DataTap ships this posture as the default — WORM store, chain-hashed audit packages, scoped examiner seats — see a generated exhibit · the security posture · for DCM applicants.