Business Continuity and Disaster Recovery (BC/DR) Policy

Effective Date: 18 november 2024

Issued by: Neobank Capital

Approved by: Chief Risk Officer (CRO) & Chief Information Security Officer (CISO)

1. Purpose

The purpose of this BC/DR Policy is to ensure that Neobank Capital can continue critical operations, protect customer data, and restore services quickly in the event of a disruption, including:

1. Cybersecurity incidents or data breaches
2. System outages or cloud service failures
3. Natural disasters, pandemics, or geopolitical events
4. Operational or infrastructure disruptions

This policy ensures the company maintains resilience, regulatory compliance, and customer trust.

2. Scope

This policy applies to:

1. All employees, contractors, vendors, and third-party service providers.
2. All Neobank Capital applications, systems, cloud environments, APIs, and decentralized platforms.
3. Critical business functions including transaction processing, account management, customer support, and regulatory reporting.

3. Business Continuity Principles

1. Risk Assessment: Identify potential threats and assess their impact on operations.
2. Critical Function Prioritization: Determine essential services and define Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
3. Resilience by Design: Implement redundancies, failover systems, and distributed infrastructure to minimize disruption.
4. Communication: Maintain clear internal and external communication channels during disruptions.
5. Regulatory Compliance: Ensure compliance with GDPR, UK GDPR, CCPA, and financial regulations during recovery efforts.

4. Disaster Recovery Principles

1. Data Backups: Regularly backup all critical systems, applications, and databases.
2. Secure Storage: Maintain backups in geographically diverse, encrypted, and access-controlled locations.
3. Recovery Testing: Conduct periodic DR tests to ensure systems can be restored quickly and accurately.
4. Failover Procedures: Predefine failover strategies for critical systems, including decentralized financial services infrastructure.
5. Post-Disaster Evaluation: Analyze recovery performance and implement improvements.

5. Roles and Responsibilities

6. Business Continuity Planning (BCP)

1. Identification of Critical Functions: Define core services such as account access, fund transfers, crypto-wallet management, and regulatory reporting.
2. Alternate Work Sites: Ensure remote or alternate office capabilities for staff during site disruptions.
3. Resource Inventory: Maintain a list of critical resources, systems, personnel, and suppliers.
4. Communication Plan: Define internal and external notification channels for employees, customers, regulators, and vendors.

7. Disaster Recovery Planning (DRP)

1. IT Recovery Strategies: Include restoration of databases, cloud services, blockchain nodes, APIs, and applications.
2. Recovery Time Objectives (RTOs): Maximum acceptable downtime for critical systems.
3. Recovery Point Objectives (RPOs): Maximum acceptable data loss in case of disruption.
4. Testing: Conduct quarterly DR drills and annual full-scale simulations.
5. Documentation: Maintain detailed DR manuals, including step-by-step recovery procedures.

8. Incident Response Integration

1. BC/DR plans are integrated with the Incident Response Policy to ensure coordinated action during cyberattacks or data breaches.
2. Critical incidents trigger activation of BC/DR procedures and escalation to the Incident Response Team (IRT).

9. Vendor and Third-Party Continuity

1. Evaluate third-party vendors’ BC/DR capabilities before engagement.
2. Include service-level agreements (SLAs) and recovery requirements in contracts.
3. Regularly audit vendors to ensure their readiness aligns with Neobank Capital standards.

10. Training and Awareness

1. Annual BC/DR training for all employees and contractors.
2. Periodic tabletop exercises simulating different disaster scenarios.
3. DR simulation results are reviewed, and improvements are implemented.

11. Monitoring, Testing, and Review

1. Conduct continuous monitoring of critical systems to identify vulnerabilities.
2. Test BC/DR plans quarterly for IT systems and annually for full organizational readiness.
3. Review and update the policy and plans annually or after any disruption or regulatory change.

12. Documentation and Record-Keeping

1. Maintain records of:
2. BC/DR plans and updates
3. Test results and simulations
4. Incident activations and recovery reports
5. Retain documents for at least 5 years or as required by law.

13. Communication Protocol

1. Internal: Notify employees and stakeholders immediately during disruptions.
2. External: Inform customers and regulators in compliance with privacy and financial regulations.
3. Public Statements: Coordinated by the Communications Officer and Legal Team.

14. Policy Enforcement

1. Violations of BC/DR procedures may result in:
2. Employee or contractor disciplinary action
3. Suspension of access to systems
4. Legal action for willful negligence

15. Contact Information

Business Continuity & Disaster Recovery Coordinator (CRO)

📧 bcdr@neobank.capital

Chief Information Security Officer (CISO)

📧 security@neobank.capital

Data Protection Officer (DPO)

📧 privacy@neobank.capital