Business Continuity: What Happens If the Account Holder Leaves

Every business that holds a crypto account has a quiet single point of failure, and it is rarely a server or a password. It is a person: the founder, the finance lead, or the operations manager who opened the account, verified it, and has held the login ever since. On an ordinary Tuesday that person hands in their notice, and suddenly a routine payment, a balance check, or a settings change turns into a scramble. The account still exists, the funds still exist, but the business cannot prove it is the business, because the only person who could sign in has left the building.

This is the business continuity problem in its most practical form. It is not about disaster recovery plans gathering dust in a drawer. It is about what happens when the human link between a business and its accounts breaks, whether through resignation, illness, extended travel, or a falling out. The businesses that survive that moment are not the ones with the most elaborate plans. They are the ones that separated the account from the person long before anyone left, so that no departure, however sudden, can strand the account.

Accounts drift into single-holder status gradually, and that is what makes the risk easy to miss. One person opens the account because it is fastest. The verification uses their personal email and phone number because those are to hand. Two-factor codes go to their personal device. Recovery options point at an inbox only they can open. Each choice is sensible in isolation, and together they build an account that belongs, in practice, to an individual rather than to a business.

The failure modes that follow are predictable. A password reset goes to a former employee's inbox. A login code arrives on a phone that has been handed back or wiped. A platform asks for a verification step that only the original holder can complete, and the business has no documented way to show it is entitled to take over. Even when nothing is lost, the delay alone can be costly: payments stall, suppliers wait, and the team spends days reconstructing access that should have taken minutes. The companion reading on the /blog index, including the handover playbook, shows how much of this pain comes from undocumented access rather than from any technical failure.

Continuity starts with a simple rule: the account belongs to the business, and every credential, recovery method, and contact detail should reflect that. Where a platform allows it, use a business-controlled email address for the account, one that survives any single employee, rather than a personal inbox. Keep the phone number used for recovery on a business-controlled line or device where possible. Document who the account holder of record is, who the backup administrator is, and how each of them can be reached, in a place the business controls and can update when roles change.

Separation also means writing things down in the right place. An account register, even a simple one, should list each account, its purpose, the named administrator and deputy, the recovery methods attached to it, and the date access was last reviewed. That register is itself sensitive, so it belongs in the same kind of protected storage the business uses for bank mandates and contracts, not in a shared spreadsheet that anyone can open. The point is not bureaucracy for its own sake. It is that a new administrator should be able to find, in one protected place, everything needed to keep the account running.

Start with an inventory. List every business crypto account, who opened it, whose email and phone number are attached to it, and who else could get in today if the opener disappeared tomorrow. Any account with only one answer to that last question goes on the fix list. For each of those, name a deputy administrator, move the contact details to business-controlled channels where the platform permits, and record the change in the account register.

Next, test recovery before you need it. A recovery method that has never been tried is a guess, not a plan. Work through the platform's account recovery steps in a controlled way, confirm that the business-controlled email and phone number actually receive the codes, and confirm that the deputy can complete the process. Then set a review cadence: a quarterly check that the register is current, the deputies still work at the business, and the recovery details still point at channels the business controls. The /buy-crypto-accounts pages on this site describe the account types businesses commonly hold, which helps when deciding which accounts need a deputy first.

When someone with account access leaves, speed and completeness matter more than ceremony. Within the first two days, remove or rotate their access, change shared credentials they knew, update the contact details and recovery methods that pointed at them personally, and confirm that the deputy administrator can sign in cleanly. Record each step, including the date and the person who performed it, so the business has a clear trail of who held access and when it ended.

The same routine should cover the less obvious traces of access: saved sessions on a returned laptop, a phone app still signed in, an API key or connected app the leaver set up, and any shared note or document that contains account details. Bookkeeping matters here too, because an account whose access changed hands mid-month needs records that match: note the handover date in the business's own records so that later statements and transaction histories can be reconciled without guessing who authorised what. A clean offboarding is not about suspicion. It is about closing a door properly so nobody has to wonder later whether it was left open.

Resignations give notice, but the harder cases give none. A key holder falls ill, is unreachable while travelling, or becomes unavailable during a dispute, and the business still needs to operate. Continuity planning covers those cases with the same tools: a named deputy who is already authorised, recovery methods the business controls, and sealed instructions, held securely, that explain how a trusted successor can establish authority if the primary holder cannot act.

For a small business, sealed instructions might be a letter held by its accountant or solicitor, or a document in a safe, describing the accounts, the deputies, and the evidence of ownership the business holds. For a larger one, it might be a board minute naming the account administrators. The form matters less than the fact that the instructions exist, are current, and can be found by the right person at the wrong moment. Review them whenever the business changes structure, changes banks, or changes the people who hold the keys.

Continuity planning is sometimes mistaken for cutting corners, so the boundary is worth stating plainly. It does not mean sharing passwords informally across a team, keeping a former employee's access alive just in case, or trying to work around a platform's verification checks. Those shortcuts create the very risk the plan is meant to remove, and they leave the business unable to show clean, legitimate control of its own accounts.

Real continuity works through the platform's own processes: business-controlled contact details, properly named administrators and deputies, documented ownership, and recovery steps that have been tested in advance. Done that way, the departure of any one person becomes an administrative task, not a crisis. The account keeps running, the records stay clean, and the business, not any single individual, remains the holder of its own accounts.