Share via:
- Updated on: November 5, 2026
Crypto compliance business continuity is the ability to keep screening, monitoring, and record-keeping running when the provider behind them is unavailable. Deposits and withdrawals keep arriving whether or not your know-your-transaction (KYT) provider responds. Alerts are still owed, and so is the audit trail that shows a supervisor what your firm checked and when. There is also a cost component – delays to that process caused by unforseen system outages have repercussions beyond regulatory obligations. In a competitive environment, poor experience with deposits and withdrawals can be the difference between a retail client staying or going. Worse, it can mean losses in exchange.
For a head of compliance or a money laundering reporting officer (MLRO), continuity comes down to knowing who screens transfers if the main provider cannot, and being able to show a supervisor that this was planned in advance. In the EU, the Digital Operational Resilience Act (DORA) treats outside technology providers as a dependency that firms must plan around. In the UK, the Financial Conduct Authority (FCA) sets its own operational resilience rules for the firms in its scope.
Key takeaways
Screening, alert, and record-keeping duties continue while a provider is unavailable, so the fallback has to exist before it is needed.
DORA applies to crypto-asset service providers (CASPs) authorized under the Markets in Crypto-Assets Regulation (MiCA) and requires exit strategies for information and communication technology (ICT) services that support critical or important functions.
Five checks make a backup real: a second provider ready to switch to, a fast switchover, portable risk rules, a known data location and governing law, and current security certifications.
A backup that runs alongside the main provider on a small share of traffic keeps the extra work small and the switchover tested.
What happens to your obligations when screening stops?
A screening outage does not pause the rules that screening exists to meet. Whether the provider is unavailable for an hour, a day, or longer, three things keep moving.Transaction flows. Deposits arrive and customers ask for withdrawals. Each one needs a decision: hold it, release it, or check it some other way. A firm without a written fallback ends up making that call case by case, under pressure, with no record of why.
Alerts. A quiet alert queue during an outage means nothing was checked. Risk keeps arriving: a deposit from a sanctioned address, or funds that moved cross-chain to reach you, still has to be caught. When service returns, everything that moved in the gap needs screening again.
The audit trail. Supervisors and auditors look at what the firm did, including what it did while its tools were down. A gap in transaction monitoring records has to be explained later: when it started, what the firm did instead, and when normal screening resumed.
All of this follows from relying on one outside provider for a regulated function, whatever the cause of an outage. It is also why regulators now ask how firms plan for it.
What do DORA and the FCA expect from your provider arrangements?
DORA, Regulation (EU) 2022/2554, has applied since January 17, 2025. CASPs authorized under MiCA, Regulation (EU) 2023/1114, are among the financial entities it covers (Article 2(1)(f)). A screening and monitoring provider delivered as a service is likely to count as one of the ICT third-party service providers that DORA asks firms to manage.Two DORA requirements bear directly on a backup plan:
For ICT services supporting critical or important functions, financial entities must put in place exit strategies (Article 28(8)). Whether screening counts as a critical or important function is the firm’s own assessment, and that assessment should be written down.
Contracts with ICT third-party service providers must state where services are provided and where data is processed and stored (Article 30(2)(b)).
In the UK, the FCA’s operational resilience rules ask the firms in their scope to identify their important business services, set a tolerance for how much disruption each can bear, and show they can stay within it. Whether those rules apply to a crypto business depends on how the firm is authorized, so its compliance or legal team should confirm its own position.
What should a five-point resilience checklist cover?
A backup provider helps only if it can take over in practice. The checklist below turns that into five questions to send to your current provider and to any candidate for the second slot.Item | Why it matters | Question to ask your provider |
|---|---|---|
A second provider ready to switch to | Screening duties continue while the main provider is unavailable | Which provider takes over, and is access already set up and tested? |
Application programming interface (API) switchover within a day | A backup that takes weeks to connect cannot cover an outage | How long does it take to repoint transaction feeds and alert handling to the second provider, and who has done it before? |
Risk rules documented so they can move | Thresholds and rule logic stay locked in one tool if nobody writes them down | Can our rules, risk categories, and alert grades be exported in a form the second provider can use? |
Where data is held and under which laws | Supervisors ask where data is processed and stored, and DORA contracts must say so | Where are our data and logs stored, and which laws apply to them? |
Security certifications | Independent audits show the provider’s controls were checked by someone else | Which certifications are current, what do they cover, and when were they last audited? |
Ask each question in writing and keep the answers with your third-party risk documentation. When the answers change, after a contract renewal or a product change, update the file so the exit strategy describes the setup you actually run.
How do you run a backup provider without doubling the work?
A backup that has never screened live traffic is hard to rely on when it matters. Running it alongside the main provider, live but light, keeps it tested without doubling the team’s workload:Send a small share of transfers, or a fixed sample, to both providers and compare the results each month.
Review the second provider’s alerts in a weekly batch.
Keep risk rules, thresholds, and alert grades in one document owned by compliance, and apply it to both providers.
Put a switchover rehearsal on the calendar, with named owners, and record the result.
Coverage is the first thing to check, because a backup has to see the chains your customers actually use. Crystal Expert, Crystal’s platform for crypto monitoring and investigations, covers 330+ blockchains and 130,000+ entities verified in the field. In Crystal Expert, an analyst can monitor wallets and transfers against the firm’s own risk rules, investigate an alert and trace funds across cthe evidence gathered, with each finding open to inspection. The useful test for any second provider is whether its results are actionable intelligence an analyst can check and file. Crystal surfaces; humans decide.
Certifications come next. For the last row of the checklist, Crystal holds ISO 27001 and SOC 2 Type II certifications, is compliant with the General Data Protection Regulation (GDPR), and keeps its data governance EU-based. Ask the same questions of any provider you shortlist, and see how to evaluate a screening provider for the wider criteria.
FAQ
What does business continuity mean for crypto compliance?
It means a firm can keep screening transfers, handling alerts, and keeping its audit trail when a provider or internal system is unavailable, because it planned and tested a fallback in advance.Should a crypto firm run two screening providers at the same time?
A firm that depends on one provider for screening is better placed with a second one running alongside it on a small share of traffic. That keeps the integration working, shows whether the two agree, and makes a switchover a rehearsed step. Building the integration in the middle of an outage is slower and harder.What should a firm do with alerts and the audit trail if a screening provider is unavailable?
Follow the fallback documented in advance and log each decision. When service returns, screen everything that moved during the gap.What is an exit strategy under DORA?
DORA, the EU’s Digital Operational Resilience Act, requires financial entities, including crypto-asset service providers authorized under MiCA, to have exit strategies for ICT services that support critical or important functions (Article 28(8)). For screening, that means a written, rehearsed plan to move to another provider without a break.What belongs in a switchover test?
A switchover test repoints a sample of live transaction feeds and alert handling to the second provider, checks that the firm’s risk rules produce the expected alerts, and confirms that records land in the audit trail. Record who ran it, how long it took, and what did not work, then fix it before the next rehearsal.Get a second provider in place before you need one
A tested backup turns a provider outage into a planned procedure. The team knows which transfers to hold, which provider takes over, and what goes in the audit trail, and the exit strategy a supervisor reads describes a setup the firm has actually run.Need a backup today? Get Crystal Continuity Access.
