Continuity Plan for Crypto Companies: What Regulators Require
Business Continuity Plan for Crypto Companies:
What Regulators Require
Every major crypto regulator — FSC, FSA, VARA, MAS, FCA — requires a BCP as a condition of licensing. Most VASPs either have no BCP or have one that would not survive a regulatory review. Here is what a compliant BCP actually looks like.
Why Regulators Require a BCP — and What They Actually Check
A Business Continuity Plan is not a box-ticking exercise. For regulated VASPs, it is a mandatory document that regulators review at licensing, at renewal, and increasingly during thematic supervisory visits. Understanding what inspectors actually look for — as opposed to what most VASPs submit — is the difference between a document that passes and one that triggers remediation requirements.
Regulators require a BCP because they are responsible for the stability of the financial system and the protection of clients whose assets are held by regulated VASPs. When a VASP experiences an operational failure — cyberattack, key person loss, banking failure, custody breach — the regulator needs confidence that the business can either continue operating at a minimum service level or wind down in an orderly manner without client harm.
The BCP is the regulator’s evidence that the VASP has thought through its failure scenarios before they happen, allocated responsibility for managing them, and tested whether its response actually works. A BCP that was never tested, that names people who have left the company, or that describes systems that no longer exist is worse than no BCP — it signals that the licensee treats compliance as paperwork rather than practice.
Every major crypto licensing regulator explicitly requires a BCP as part of the licence application and ongoing compliance obligations. The specific framing varies but the substance is consistent: MAS (Singapore) requires business continuity management under its Technology Risk Management Guidelines; VARA (Dubai) requires operational resilience documentation as part of the rulebook; FSC (Mauritius) requires a BCP as part of the VASP licence application; FCA (UK) applies operational resilience rules to crypto asset firms; EU MiCA CASP requires a business continuity policy under Article 67.
- MAS (Singapore): Technology Risk Management Guidelines — BCP mandatory
- VARA (Dubai): Operational resilience requirements in VARA Rulebook
- FSC (Mauritius): BCP required at VASP licence application stage
- FCA (UK): Operational resilience rules apply to registered crypto asset firms
- MiCA CASP (EU): Business continuity policy required under Article 67
Based on regulatory guidance and supervisory practice across VARA, MAS, and FCA, inspectors reviewing a VASP BCP focus on five questions. First: does the BCP cover the scenarios that are actually relevant to this business? A generic template that does not address custody key management or exchange system failures is immediately identifiable as inadequate. Second: are the recovery time and recovery point objectives defined and realistic? Vague language (“restore within a reasonable time”) is insufficient. Third: are named roles current and do those people know their responsibilities? Fourth: has the BCP been tested in the last 12 months and is there evidence of the test? Fifth: has the BCP been updated following any material change to the business, systems, or personnel?
The Five Scenarios Every Crypto BCP Must Cover
Generic BCPs cover generic risks — power outages, office fires, staff illness. A VASP BCP must additionally cover the scenarios specific to crypto operations. These five are the ones regulators focus on and the ones most likely to actually affect your business.
Crypto businesses are among the most targeted by cybercriminals globally. Your BCP must address: what happens when your exchange or custody system is compromised; who has authority to halt trading or withdrawals; how you communicate with clients during an incident; what your relationship with your cybersecurity incident response team looks like; and what your regulatory notification obligations are (most jurisdictions require notification within 24–72 hours of a material cyber incident). The BCP should reference your cybersecurity incident response plan — but must also address the business continuity dimension: what services can continue, which must halt, and how you restore normal operations.
VASPs — particularly at early and growth stage — are frequently dependent on one or two individuals who hold critical knowledge: the technical architecture, the compliance programme, the banking relationships, or the custody key management procedures. The BCP must address what happens if these individuals are suddenly unavailable — through illness, resignation, or death. This requires: documented succession for each critical role; knowledge transfer documentation for critical processes; multi-signature or dual-control arrangements for custody and operational accounts; and cross-training so that at least two individuals can perform each critical function. Regulators specifically look for this — a VASP where one person holds all the keys (literally and figuratively) is an operational risk.
For exchange operators, the BCP must define the conditions under which trading is halted, who has authority to halt it, and how clients are notified. It must also address the period of the halt: how are client orders handled, what happens to margin positions, and how is market integrity maintained during the halt and restoration period. The BCP should define a degraded service mode — what minimum services can be maintained (withdrawals only, read-only access) when full trading cannot be restored — and the conditions for returning to full operation. Market manipulation or extreme volatility scenarios that may require trading suspension should also be addressed.
The fragility of crypto business banking is a known risk — crypto-friendly banking relationships are fewer and less stable than traditional financial services relationships. Your BCP must address what happens when your primary banking partner terminates the relationship, freezes accounts, or experiences its own operational failure. This requires: at minimum two banking relationships with different counterparties; documented procedures for switching fiat payment processing between banking partners; client communication procedures for deposit and withdrawal delays; and a minimum operational cash reserve held outside the primary banking relationship. The BCP should specify how long the business can operate using reserve funds if the primary bank relationship fails.
For custodial VASPs and exchange operators holding client assets, a custody key compromise is the highest-severity operational scenario. The BCP must address: the immediate response to a suspected key compromise (halt all withdrawals, initiate key rotation); the forensic investigation process; client notification obligations and timing; regulatory notification requirements; and the process for restoring custody operations after key rotation. The BCP should also address partial compromise scenarios — where a subset of keys or a specific wallet is compromised — and the decision framework for determining whether to continue operations or initiate an orderly wind-down. Insurance arrangements for custody losses should be referenced. See our guidance on AML/KYC compliance for the regulatory notification framework that applies alongside BCP activation.
BCP Structure: What the Document Must Contain
A compliant VASP BCP is a structured document with defined sections — not a narrative essay. Regulators reviewing BCPs at licensing and renewal expect to find specific content in a logical structure. Here is the required architecture and what each section must address.
Testing and Maintenance: The Part Most VASPs Skip
A BCP that has never been tested is a hypothesis, not a plan. Regulators know this, which is why testing evidence is increasingly a focus of supervisory visits. The testing requirement is not onerous — but it must be structured, documented, and regular.
A tabletop exercise is a facilitated discussion where the BCP team walks through a scenario — “our primary exchange server has been compromised at 2am on a Friday” — and tests their decision-making against the documented procedures. No actual systems are tested; the exercise tests human response, decision authority, communication, and procedure accuracy. A tabletop exercise takes 2–3 hours, requires no technical disruption to operations, and produces a test report that demonstrates regulatory compliance. It is the minimum acceptable testing standard — not the gold standard.
The test report must document: the scenario tested, the date, the participants, the key decisions made, gaps or issues identified, and remediation actions assigned. This report is the evidence regulators request when they ask “when did you last test your BCP?”
For VASPs with defined RTO commitments for critical systems, tabletop testing alone is insufficient — you need to actually test that your systems can recover within the committed timeframe. Technical failover testing involves activating backup systems, verifying data integrity, and measuring actual recovery time against the RTO. This should be done at least annually for primary exchange and custody systems, and documented with the same rigour as the tabletop exercise. If the actual recovery time exceeds the documented RTO, the BCP must be updated to reflect the realistic timeframe — not the aspirational one.
The annual review and testing cycle is the minimum. The BCP must also be updated following any material change to the business that affects the continuity scenarios or response procedures. Mandatory update triggers include: key personnel changes (especially BCP roles), changes to primary banking relationships, migration to new custody or exchange infrastructure, expansion into new jurisdictions, and actual BCP activation events. After any real incident that triggered BCP activation, a post-incident review must update the BCP to reflect lessons learned. A BCP that was last updated 18 months ago and names three people who have left the company is non-compliant regardless of when it was formally reviewed.
BCP Readiness Checklist — Before Your Next Regulatory Review
Use this checklist before submitting a licence application, before a renewal, or before a supervisory visit. Every item marked as missing is a finding waiting to happen.
WCR Legal advises on BCP drafting and review for regulated VASPs — from initial document preparation for licence applications through annual review, testing facilitation, and regulatory submission across VARA, FSC, MAS, FCA, and MiCA jurisdictions.
Post Comment