VASPs must maintain records of all transactions carried out on their platform for a period of at least five years. These records must include information on the customers, the type and value of the virtual assets, and the date and time of the transaction.