A future asset-servicing platform can lose an interface, a provider connection or a key operational dependency while investor obligations continue. The owner must decide which services require continuity, what can be recovered and how unfinished instructions will be explained. A credible plan protects the record as well as availability, so restored access does not reveal an inconsistent account.
Identify the services that must continue
The plan should distinguish viewing information, receiving instructions, processing events and confirming settlement. Different functions can have different dependencies and consequences when unavailable. CPSS-IOSCO's operational-risk principles provide a framework for continuity and recovery in their scope. Applying those ideas to a service requires its own professional assessment. A hypothetical dashboard outage need not mean that a registry or payment provider has stopped. Owners should map the actual dependencies so support staff can give accurate information about which functions are affected, what obligations remain and whether an alternative route is available under the governing arrangements and documented operating procedures.
Preserve the state of unfinished work
Backups and recovery procedures need to retain enough information to determine what happened before the interruption. The operation should know which instructions were received, authorised, submitted externally or completed. BIS's tokenisation analysis supports considering the links between distributed records and conventional providers. A hypothetical system restart must not replay a completed payment or lose an accepted request. Technical and operational teams should test reconstruction together. The useful evidence is a reconciled state after recovery, with unresolved cases still visible, rather than a server returning online while staff remain unable to identify which investor transactions actually progressed during the incident.
Communicate within the known facts
Incident messages should state the affected service, current limitations and the route for updates. They should distinguish a confirmed outcome from an investigation. A hypothetical planned completion time should not be presented as guaranteed settlement when an external provider's records remain unavailable. Owners need an authorised communication process with enough access to technical and operational information. Investors should have a practical contact route for time-sensitive matters. The plan should also specify how alternative instructions are recorded and later reconciled, preventing a temporary manual channel from creating a second, disconnected account of obligations that the restored system does not recognise or handle consistently.
Test the handback to normal operation
Recovery is incomplete until the service has reconciled relevant records, reviewed exceptions and confirmed that ongoing work uses the correct state. Owners should record what the exercise or incident revealed and assign corrective actions. Investors gain clearer treatment when delays and transactions remain traceable after access returns. A platform's resilience cannot be inferred from the resilience of its underlying ledger alone. It depends on the full operating arrangement, including staff, records and external providers. The commercial objective is a service capable of preserving its obligations through disruption and explaining their eventual outcome without using restored technical availability as a substitute for completed investor servicing.
