BTC Ledger User Guide

BTC Ledger is passwordless. There is no public registration — every account is provisioned by governance from Staff Manager.

• Enter your work email and we send a six-digit verification code. The code is single-use and expires shortly after it is issued.
• You can also receive the code by SMS on the phone number held on your staff record.
• Once your work Gmail address has been verified, Continue with Google is offered on later visits and signs you straight in.
• If we see a new device or network, the session is held until you confirm with the six-digit code from your authenticator app (or one backup code).
• Sessions lock automatically after a short period of inactivity and must be unlocked before you can continue.

Your first sign-in opens an onboarding gate. Until it is completed you cannot reach the ledger modules.

• Complete your profile: full name, the nickname used in greetings, and your phone number.
• Enrol an authenticator app by scanning the QR code (or entering the manual key), then confirm one generated code.
• Store the backup codes shown after enrolment — each one can be used once if you lose the authenticator.
• Automated reminders are emailed on days 1, 3, 5 and 6 if onboarding is still incomplete.
• Accounts that never complete onboarding are flagged inactive and removed, and Admin and Management are notified.

The dashboard is the executive landing page: portfolio and cash KPIs at the top, followed by governance status and the live audit timeline.

• KPI cards summarise portfolio value, cash position, investor equity and outstanding approvals.
• Governance overview lists pending invitations and onboarding still in progress (Admin and Management only).
• The audit timeline shows recent state changes colour-coded by action type.
• One-click PDF export produces an A4 landscape snapshot of the overview for board packs.

Every movement of money is recorded as a category-driven, double-sided entry with an auto-generated reference (BTC-DE-XXXXXX). Inflow and outflow columns feed a running balance that can never be edited retrospectively.

• The manual category picker is deliberately limited to Loan Repayment, OpEx / Expense, Other Inflow and Other Outflow.
• Loan disbursements (BTC-LN-XXXXXX) and investor deposits or dividends (BTC-INV-XXXXXX) are cross-posted automatically from their own modules — never key them by hand.
• Choosing Loan Repayment turns the client field into an active-loan lookup so you can only post against an open facility.
• Reconcile an entry with a coded reason — timing differences, human & system errors (data entry mistakes), shrinkage/waste & unauthorised activity, bank charges or a successful transaction — plus the legacy codes. The reason is written to the audit trail.
• Attach supporting evidence (bank statement, receipt, screenshot) when reconciling — uploads are optional, capped at 2MB and stored in the private reconciliation vault.
• Voiding an entry is a critical action: it needs counterpart governance sign-off.

Borrowers are registered once and carry a permanent BTC-CL-XXXXXX identifier used across every facility and ledger line.

• Capture full name, phone, email and NIN at registration.
• KYC tier (Unverified, Tier 1, Tier 2 or Flagged) controls what the client can be offered.
• Flagged clients surface in Compliance for review before any further disbursement.

Book facilities with tri-party sourcing: the borrowing client, the field agent earning commission, and the investor funding the principal.

• Choose flat rate, straight line or reducing balance to preview the amortisation schedule.
• The Loan Calculator models any structure before you commit, including total interest and per-instalment amounts.
• Agent commission is calculated from the agent's default percentage and tracked until paid.
• Collateral type and details are stored against the facility for recovery workflows.
• Disbursement automatically posts the matching outflow to the daily ledger.

Track equity roll-forward per investor: opening equity, additions and withdrawals, with profit-share percentages driving the dividend engine.

• Closing equity is calculated by the system (opening + additions − withdrawals) and can never be typed in.
• Run the dividend engine to distribute a profit pool pro-rata across active investors.
• Each distribution posts a matching outflow to the daily ledger automatically.
• Investors sourced by a staff member feed that agent's sourcing commission.

• Every staff member carries a permanent BTC-SID-XXXXXX identifier used across audit logs.
• Edit email, phone, role and both commission rates from the staff record; changes route through the approval flow.
• Two commission channels are tracked separately: loan origination and investor sourcing.
• The Performance view ranks agents by originated volume, sourced equity, repayment quality and commission earned.
• Only an Admin may invite Admin or Management accounts; Management can invite Staff.
• Tab access and action rights are granted individually and require dual sign-off to change.
• Switching a staff member to Inactive instantly ends all of their active sessions and blocks future sign-in, while their historical records remain intact.
• Accounts are never created with a password typed by an admin: once a staff record is approved, use Send invite and the recipient signs in with their own emailed code.

• Sign in at /auth with the allowlisted governance email — the address registered as the bootstrap administrator.
• Open /setup while signed in and enter the one-time setup code held securely in the backend.
• The first Admin account, staff record and permissions are created automatically, and /setup closes permanently.
• From then on all further accounts — staff, management and admin — are added by invitation from Staff Manager.

• Cross sign-off is mandatory: a request raised by an Admin is decided by Management, and a request raised by Management is decided by an Admin.
• You can never approve your own request, and Staff can neither raise nor decide approvals.
• Open any request to see the full detail view — the exact before and after state, the requester, and the reason given.
• Every decision requires a written note, and every state change is written to an append-only audit history that cannot be edited or deleted.
• The security audit timeline separately records every permission and policy change made by governance.

Entries migrated from the paper ledger can be recorded against their original date without breaking the audit trail.

• Set the effective date to the date the transaction actually occurred — future dates are rejected.
• A paper ledger reference or audit reason is mandatory on every historical entry.
• The system records both the original effective date and the moment it was keyed, plus the migration batch.
• Loan schedules and interest are anchored to the effective date, not the entry date.

The ledger screens every entry against Nigerian AML thresholds under the Money Laundering Act 2022 and SCUML / NFIU reporting rules.

• Physical cash of ₦5,000,000.00 or more for an individual raises a currency transaction threshold flag.
• Physical cash of ₦10,000,000.00 or more for a corporate raises the same flag.
• Flags are generated automatically at the point of entry and listed in the Compliance module for review.
• Incomplete KYC (missing NIN, or a Flagged tier) blocks further disbursement to that client.

Sarah answers member enquiries, captures entries from messages and escalates anything she cannot verify. Only allowlisted numbers are served; unauthorised numbers and parsing failures are logged and surfaced as live alerts inside the app.