Purpose
Maintain the governance, context, responsibilities and resources required for an effective and proportionate BCM program that ensures resilience against disruptions, protection of stakeholders, and compliance with the Centrale Bank van Curaçao en Sint Maarten (CBCS) provisions and ISO 22301 standards.
Preconditions
- Current organization, service, regulatory and stakeholder information is available.
- BCM roles have named incumbents or accountable functions.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Review external context | Political/regulatory (local laws, CBCS provisions, FATF standards); economic/technological (crypto volatility, fintech); social/cultural factors; natural/environmental risks (storms, flooding, earthquakes); competitive pressures in global VASP services | Context review record |
| 2 | Review internal context | Products/services (trading platform, wallets, compliance systems); resources (IT, personnel, capital); org structure and governance; dependencies on vendors, banking partners, cloud services | Context review record |
| 3 | Identify interested parties | Regulators (CBCS, FATF-aligned); clients and investors; employees/contractors; suppliers, IT providers, partners; insurers, auditors, emergency services | Stakeholder register |
| 4 | Confirm BCM scope | Document scope and justified exclusions; applies to all departments, employees, contractors, consultants, critical suppliers, vendors, outsourcing partners, and external stakeholders | Scope document |
| 5 | Assign Board responsibilities | Approves BCM policy, reviews plans annually, ensures resource allocation, oversees audits, corrective actions, compliance reports | Responsibility assignment |
| 6 | Assign Department Head responsibilities | Identify critical functions, dependencies, recovery needs; maintain departmental continuity sub-plans; ensure staff training and BCM awareness | Responsibility assignment |
| 7 | Assign Employee responsibilities | Participate in training and drills; execute BCM responsibilities as assigned | Responsibility assignment |
| 8 | Confirm audit arrangements | Internal and external audits conducted annually; findings reviewed by Board; corrective actions tracked | Audit schedule and findings |
| 9 | Confirm resource availability | Competent personnel, budget, systems, premises, supplier resources; financial (budget), human (staffing, training), physical (facilities, alternate sites) | Resource assessment |
| 10 | Obtain Board approval | At least annually and after material change; BCM Policy reviewed annually and after major disruption | Board approval minutes |
| 11 | Record and escalate constraints | Record decisions, actions, unresolved resource constraints; escalate to management and Board | Escalation records |
| 12 | Apply proportionality | Single BCM Officer reports to Board instead of dedicated BCM department; governance right-sized for small, growing VASP | Governance decision record |
Exceptions and Escalation
Any unassigned critical role, material resource constraint or unapproved scope exclusion shall be escalated promptly to management and the Board.
Records
- BCM context and scope review
- Responsibility assignment or contact list
- Resource assessment
- Board approval and oversight minutes
- Escalation and remediation records
Relationships
- Policy: POL-BCM-001 Business Continuity Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-BCM-001 Ensure BCM Governance Responsibilities and Resources Are Maintained
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: annual and after material organizational or regulatory change
History
- 2026-07-26: Created from sections 4, 5, 12 and 16 of the approved Business Continuity Manual.