KuCoin earns ISO 22301 certification for operational resilience

KuCoin has secured ISO 22301:2019 certification for its business continuity management system, adding an international continuity standard to the exchange’s existing security and operational controls. Summary KuCoin has secured ISO 22301:2019 certification for its business continuity management system. The standard covers preparations for operational disruptions and recovery of critical services. KuCoin now lists ISO 22301 alongside ISO 27001 and SOC 2 Type II in its Trust Framework. The certification comes as regulators place more focus on operational resilience for crypto and financial firms. According to KuCoin’s Aug. 11 announcement, the certification covers its framework for preparing for operational disruptions, maintaining critical services and restoring affected systems when incidents occur. KuCoin ISO 22301 certification covers service continuity ISO 22301 sets requirements for a Business Continuity Management System, or BCMS, under which companies identify possible operational disruptions, establish response procedures and prepare recovery plans for critical services. For KuCoin, the certification adds business continuity management to a compliance framework that already includes ISO/IEC 27001:2022 for information security and SOC 2 Type II for operational controls. The exchange said ISO 22301 is designed to cover disruptions that can come from cyber incidents, infrastructure failures, problems involving outside service providers and other unexpected events. Its focus extends beyond preventing an incident by requiring procedures for keeping important operations running and restoring services when interruptions occur. Such requirements have particular relevance for cryptocurrency exchanges because trading takes place around the clock rather than within fixed market hours. Platforms must maintain access to trading, asset transfers, payments and other services across different regions and time zones. KuCoin identified cloud outages, blockchain node failures, payment infrastructure problems and reliance on third-party providers among the operational risks that exchanges may need to manage alongside cybersecurity threats. The certification follows previous additions to the exchange’s security controls. As crypto.news reported in December, KuCoin already held SOC 2 Type II, ISO 27001:2022, ISO 27701 and Cryptocurrency Security Standard certifications at the time it received its European regulatory authorization. The exchange also used third-party proof-of-reserves audits. KuCoin now lists ISO/IEC 27001:2022 for information security management, SOC 2 Type II for operational reliability and ISO 22301:2019 for business continuity as three parts of its Trust Framework. Operational resilience requirements have entered crypto regulation Business continuity controls have also become part of regulatory requirements for financial and crypto companies in several markets. In the European Union, the Markets in Crypto-Assets Regulation establishes rules for crypto-asset service providers, while the Digital Operational Resilience Act sets requirements covering information and communications technology risks for regulated financial entities. DORA includes requirements around ICT risk management, incident handling, resilience testing and third-party technology risks.