Article 6 Complexity and risk considerations

This article acts as a calibration mechanism for the business continuity policy requirements set out in earlier articles.

It requires crypto-asset service providers to tailor their business continuity policy to their own risk profile, taking into account factors that could increase complexity or risk.

Crucially, it also mandates an annual self-assessment to ensure this calibration remains current and reflective of the provider's actual operations.

Important points:

• Factor in elements of increased complexity or risk — including the types of services offered, reliance on permissionless distributed ledgers, and the potential impact of disruptions — when building your business continuity policy.
• Conduct an annual self-assessment of the scale, nature, and range of your services, using the criteria in the Annex as a baseline alongside any other criteria you consider relevant.
• The self-assessment feeds directly into how the business continuity policy is shaped, making it an ongoing obligation rather than a one-time exercise.