Independent Singapore VCC guidance
Direct answer
A wallet recovery drill should prove that the VCC can restore authorised control after a signer, device, location or custody-provider failure without exposing live keys or moving investor assets unexpectedly. Define the failure scenario, use an approved test wallet or provider simulation, require the same approvals as a real recovery, reconstruct access, execute a harmless proof transaction and reconcile it to custody and fund records. Directors should receive the exceptions, residual dependencies and retest actions, not any secret recovery material.
At a glance
- Never place seeds, private keys or recovery shares in the drill plan or board pack.
- Test people, approvals, provider dependencies and record reconciliation together.
- Use a controlled environment that cannot cause an unintended live transfer.
- Prove both recovery of control and removal of obsolete authority.
- Repeat after signer, custody, wallet architecture or material policy changes.
Who this is for
- Digital-asset VCCs using third-party custody, multi-signature wallets, threshold arrangements or controlled self-custody workflows.
Important exclusions
- Instructions for storing or reconstructing real private keys, bypassing custody controls or selecting a specific cryptographic design.
Define the failure that the drill will simulate
| Scenario | Control question | Safe proof |
|---|---|---|
| Signer unavailable | Can the approved alternate authority act without the absent person? | Authorise a test-wallet transaction through the alternate route |
| Device lost | Can credentials or signing capability be restored without weakening identity checks? | Re-enrol an approved test device and revoke the old record |
| Provider outage | Can the fund obtain records, contact escalation owners and execute the documented fallback? | Run the provider's recovery simulation and reconcile exported records |
| Office inaccessible | Can authorised staff operate from an alternate controlled location? | Complete approval and signing steps through the alternate site |
| Key-person departure | Can obsolete authority be removed and quorum restored promptly? | Update a test-wallet signer set and verify access logs |
Choose one primary failure and identify any secondary assumptions. A signer outage combined with a provider outage is a different test from a simple device replacement. State which live systems are out of scope and why. The scenario should be credible for the custody model, but the exercise environment should prevent an accidental transfer of portfolio assets. Project Guardian materials highlight custody, settlement, security and operational resilience as core digital-asset considerations; the drill converts those concerns into observable evidence.
Sources: Monetary Authority of Singapore · Monetary Authority of SingaporeRelated guidance: mapping critical VCC services before an outage
Separate the drill plan from secret recovery material
- The plan identifies roles and approval steps, never actual seeds, keys or recovery shares.
- Participants receive only the information needed for their assigned stage.
- Real recovery material remains inside the approved custody or key-management control.
- Screenshots and recordings exclude secrets, authentication codes and sensitive wallet details.
- Test addresses are independently verified before any proof transaction is authorised.
- The exercise has an immediate stop route if a live environment is reached unexpectedly.
- Evidence retention is approved before logs or provider reports are collected.
Use two records. The control plan describes the scenario, roles, approvals, expected evidence and stop conditions. The restricted execution record is created inside the approved custody process and contains only the minimum sensitive references needed by authorised participants. Board and audit evidence should show that the control operated without reproducing secrets. If a participant can complete the recovery using information found in the ordinary runbook, treat that as a serious design weakness.
Sources: Monetary Authority of Singapore · Monetary Authority of SingaporeRun the recovery through the real governance path
- Declare the incidentOpen a timed exercise record, identify the simulated failure, freeze unplanned changes and notify only the approved response group.
- Verify authorityConfirm the VCC, sub-fund, wallet purpose, authorised decision makers, participant identities and the approval route for the recovery action.
- Restore controlled accessUse the approved provider or key-management procedure while an independent observer records milestones, exceptions and control evidence.
- Execute a safe proofPerform a pre-approved harmless action in the test environment, using address verification and the normal transaction approval sequence.
- Revoke obsolete accessRemove the simulated failed signer, device or credential, then confirm that it can no longer initiate or approve activity.
- Close and reconcileMatch custody logs, wallet evidence, transaction details and fund records, then record defects and the decision on retesting.
Do not allow the word drill to become permission for shortcuts. A realistic test uses normal identity verification, dual control, address checks, whitelisting, transaction review and post-event reconciliation. If the procedure cannot be completed within the fund's tolerance, record the cause rather than pausing the clock. Distinguish delay caused by deliberate security controls from delay caused by missing ownership, inaccessible records or an unavailable external party.
Sources: Monetary Authority of Singapore · Monetary Authority of SingaporeReconcile the proof transaction to the fund books
| Evidence | What to compare | Owner |
|---|---|---|
| Wallet or custody log | Address, asset, amount, status, approvals and time | Custody control owner |
| Blockchain or provider record | Transaction identifier and final status in the test environment | Independent operations reviewer |
| Fund accounting record | Sub-fund, asset, quantity, value and any fee treatment | Administrator or fund accounting owner |
| Authority record | Approved signers before and after the simulated failure | Corporate and access-control owner |
| Incident timeline | Expected and actual milestones, delays and exceptions | Exercise coordinator |
A successful signature is not the end of the test. The fund records should identify the correct VCC or sub-fund, asset, wallet and transaction purpose. Any network fee, test asset or provider charge needs an approved accounting treatment. Reconcile status at the provider and, where relevant, the network record. If the administrator cannot independently identify the transaction from the handover evidence, the recovery process has restored access but not operational control.
Sources: Monetary Authority of Singapore · Monetary Authority of SingaporeRelated guidance: reconciling VCC custody positions to fund books · reconciling staking rewards before digital-asset NAV
Give directors a safe, decision-ready result
- Scenario and systems tested, with live systems explicitly excluded or contained.
- Expected and actual recovery milestones, without sensitive recovery material.
- Proof that alternate authority worked and obsolete access was removed.
- Transaction and fund-book reconciliation outcome for the correct sub-fund.
- Provider, person, location, system and data dependencies discovered.
- Material defects, immediate containment, owner and retest condition.
- Residual risk and the next event that will trigger another exercise.
The board pack should demonstrate control without becoming a new security exposure. Exclude private keys, seeds, recovery shares, authentication codes, detailed secret locations and unredacted screenshots. Directors need to know whether the VCC can regain authorised control, preserve segregation, reconcile records and remove obsolete access. They should also understand any dependence on the manager, custodian, wallet provider or administrator and approve the remediation or risk acceptance through the normal governance process.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Accounting and Corporate Regulatory AuthorityRelated guidance: VCC compliance checklist
Frequently asked questions
Should a wallet recovery drill use live VCC assets?
Avoid exposing live investor assets unless a carefully controlled live proof is specifically approved and necessary. A test wallet, provider simulation or segregated low-risk environment can usually demonstrate the workflow with much less operational risk.
Should directors receive the recovery seed or key locations?
No. Directors need assurance about authority, resilience, reconciliation and residual risks, not the secret material itself. Sensitive recovery information should remain within the approved custody or key-management control.
What if the custodian cannot support a simulated recovery?
Use the provider's available continuity exercise, evidence and escalation route, then record what remains untested. The VCC should not describe recovery as proven when a critical provider step was only discussed.
How does the administrator participate in the drill?
The administrator or fund-accounting owner should independently identify the proof transaction, confirm sub-fund attribution, account for any fee or test asset and reconcile wallet or custody evidence to the fund books.
When should the exercise be repeated?
Repeat after a material change in signer set, custody provider, wallet architecture, identity service, key location, administrator interface or recovery policy, and after any incident that reveals a control gap.
Official sources and further reading
- Project Guardian (Monetary Authority of Singapore)
- Achieving Operational Resilience for Financial Institutions in Singapore (Monetary Authority of Singapore)
- Third-Party Risk Management (Monetary Authority of Singapore)
- Risk Management Practices for Fund Management Companies (Monetary Authority of Singapore)
- Valuation Practices for Fund Management Companies (Monetary Authority of Singapore)
- Overview of managing a variable capital company (Accounting and Corporate Regulatory Authority)
Discuss your fund, family office or trust structure
Contact Raffles Corporate Services about Singapore VCC setup, fund structures, family offices and corporate administration.
- Email: hello@rafflescorporateservices.com
- WhatsApp: +65 8501 7133
- WhatsApp: +65 9018 0072
Where legal assistance is required, we can coordinate an introduction to an associate independent law firm, with your consent. The law firm advises you under a separate engagement. Raffles Corporate Services is not a law firm. Tax, investment management and trustee services, where needed, require appropriately qualified or authorised providers.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.