Custody recoverability self-assessment
“We hold a backup” and “we can recover” are different claims, and most firms only ever test the first one. The gap between them is usually invisible until an auditor asks a follow-up question, or until the day the vendor is not answering the phone.
Twelve questions below. They are scored, they take about five minutes, and the result names the questions a reviewer would ask you next. Nothing you answer is stored or sent anywhere.
Where the questions come from
They are the short form of a 34-item checklist, cut down to the twelve that separate firms that have done this from firms that intend to. Five of them do most of the work: who physically holds the recovery kit, when anyone last opened it, how many accounts the backup actually covers, whether a reconstruction has ever run without the vendor in the room, and what the plan is for the staked and locked positions nobody can sweep on demand.
The vendor tooling is not the gap. Most MPC custody platforms ship an offline recovery tool, several of them open source, and some can verify a backup without ever exposing a private key. The tools work. What is missing is the part that happens on a schedule and leaves evidence: a number for coverage, a date for the last test, and a record an auditor accepts without a month of preparation first.
On the regulatory references
Each gap in the result carries the expectation it is measured against, and those references are kept deliberately narrow.
FINMA Circular 2023/1 does most of the work for a Swiss institution. It asks for backup and restore processes “die regelmässig getestet und validiert werden”, for critical data to be identified systematically and completely, for a recovery plan that allows for the loss of key people, and for the ability to deliver critical functions to be tested or exercised against outages that run for months. The last of its transition periods ended on 1 January 2026. Nothing in it says “signing keys”, which is the whole problem: read it as a database restore and you pass, read it as a custodian and the critical function is signing and the critical data includes the backup archive.
DORA Art. 28(8) asks EU financial entities for exit plans that are documented and “sufficiently tested”. It reaches a Swiss group through its EU entities rather than directly, so it is the banner for some readers here and irrelevant to others.
FINMA’s supervisory notice of 12 January 2026 is cited once. It is an eight-page notice on the custody of crypto assets. It lists private keys that are not kept securely enough among the operational risks, and dependence on a third party’s technical infrastructure among the risks of using an outside custodian, and it observes that supervised institutions have not always taken these risks into account. Its requirements are about who may hold client assets (a prudentially supervised custodian whose clients are protected in a bankruptcy). It sets no deadlines and says nothing on how a key is backed up or tested. Several advisory summaries published since attach phased timelines to it that are the advisers’ own recommendation, and repeating those as regulation is a good way to lose an argument with a general counsel.
A score out of twenty-four is a rough indication and does not stand in for an audit. The level is also held down by two gates: no result reaches Level 2 unless a reconstruction has been run, and none reaches Level 3 unless the firm ran it itself within the last twelve months and has a record made at the time. The useful part is the map of which domain is weakest, and the way to check a Level 2 or 3 result is to have someone who did not answer the questions answer them again.