(10)Issuers should implement in their internal policies a maximum retention period for the personal data of the individual holders shared by the crypto-asset service providers. Considering the objective of ensuring compliance with the reporting obligations pursuant to Article 22(1) of Regulation (EU) 2023/1114, that maximum retention period should not exceed 5 years from the date of obtaining the personal data.