The growth of virtual asset businesses has made cybersecurity an increasingly important component of regulatory compliance, operational resilience and risk management.
For Virtual Asset Service Providers (VASPs) operating in or from Seychelles, cybersecurity is now addressed within a dedicated regulatory framework. The Seychelles Financial Services Authority (FSA) has established the Virtual Asset Service Providers Act 2024 together with specific regulations covering cybersecurity requirements. The FSA’s VASP legal framework also includes dedicated Guidance Notes for Cybersecurity Audit.
For VASPs, this means cybersecurity should not be viewed solely as an information technology responsibility. It forms part of the broader control environment through which a business protects its systems, information, virtual assets, customers and operations.
At FiveComply, we support regulated and licensing-stage businesses with independent cybersecurity audit and regulatory assurance services designed to help VASPs assess the effectiveness of their cybersecurity arrangements and identify areas requiring further attention.
1. Cybersecurity as a Regulatory Responsibility
The Seychelles VASP framework places specific emphasis on cybersecurity.
The FSA’s licensing guidance states that applicants must satisfy the Authority that they meet the applicable cybersecurity measures under the VASP Act and relevant regulations. Applicants are also expected to provide a Cyber Security Policy addressing the practices and procedures designed to protect the business from cybersecurity risks and the measures to be taken where such risks materialise.
The FSA guidance further indicates that a VASP’s cybersecurity arrangements should address matters including third-party suppliers, agents and intermediaries, data protection and business continuity following a cybersecurity breach. It also states that the Authority is to be notified of an attempted cybersecurity risk or event within 24 hours, with procedures for such notification expected to be incorporated into the relevant policy framework.
These requirements demonstrate why cybersecurity cannot be treated simply as a technical matter. Governance, policies, controls, incident management and operational resilience all form part of the wider cybersecurity framework.
2. What Is a Cybersecurity Audit?
A cybersecurity audit provides an independent assessment of an organisation’s cybersecurity framework, controls and related processes.
Importantly, an audit should not be limited to determining whether policies exist.
A meaningful cybersecurity audit considers whether the relevant controls are appropriately designed, implemented and capable of addressing the risks faced by the business.
For a VASP, this may involve examining how cybersecurity responsibilities are allocated, how access to systems and sensitive information is controlled, how security incidents are managed, and how the organisation maintains operations when systems or technology are disrupted.
The FSA’s inclusion of specific Guidance Notes for Cybersecurity Audit within its VASP framework reinforces the relevance of independent cybersecurity assurance for the sector.
3. Key Areas for a Seychelles VASP Cybersecurity Audit
The precise scope of an audit should be determined by the nature, size, complexity and risk profile of the VASP. Depending on the business model and technology environment, an assessment may consider areas such as:
Cybersecurity Governance
The audit may examine the governance structures surrounding cybersecurity, including the allocation of responsibilities, management oversight, reporting arrangements and accountability for cybersecurity risks.
A VASP should be able to demonstrate who is responsible for cybersecurity and how significant risks are escalated and addressed.
Policies and Procedures
The existence of a Cyber Security Policy is an important component of the regulatory framework, but policies should also reflect the actual activities, systems and risk profile of the business.
An audit can assess whether policies and procedures are appropriately documented, current and implemented in practice.
Access and Privilege Management
Unauthorised or excessive access can create significant cybersecurity and operational risks.
The review may therefore consider user access controls, privileged access, authentication arrangements, access reviews and procedures for managing employee or contractor access.
Information and Data Security
VASPs may handle sensitive customer, transactional and operational information.
A cybersecurity audit can assess the controls used to protect information against unauthorised access, alteration, disclosure, loss or destruction, taking into account the systems and technologies used by the business.
Incident Management and Response
Cybersecurity incidents require timely identification, escalation, response and remediation.
For Seychelles VASPs, this area also has a direct regulatory dimension given the FSA’s requirement concerning notification of attempted cybersecurity risks or events within 24 hours.
An audit can therefore examine whether the organisation has appropriate incident response procedures, responsibilities and escalation mechanisms in place.
Business Continuity and Resilience
Cybersecurity risks can quickly become operational risks.
A significant technology incident may affect customer access, transaction processing, communications or other critical activities. The FSA’s licensing guidance specifically refers to business continuity arrangements in the event of a cybersecurity breach.
Cybersecurity assurance should therefore consider whether continuity and recovery arrangements are appropriately designed and periodically tested.
Third-Party and Outsourcing Risks
Many VASPs rely on external technology providers, cloud infrastructure, service providers, agents or other third parties.
The FSA’s guidance specifically refers to third-party suppliers, agents and intermediaries within the Cyber Security Policy framework.
An effective audit should therefore consider whether third-party cybersecurity risks are identified, assessed and appropriately managed.
4. From Cybersecurity Policies to Effective Controls
One of the most important distinctions for a VASP is the difference between having cybersecurity documentation and demonstrating effective cybersecurity controls.
A policy may establish the intended framework, but management should also be able to demonstrate how that framework operates in practice.
For example:
- Are access rights reviewed regularly?
- Are cybersecurity incidents recorded and escalated appropriately?
- Are critical systems and information appropriately protected?
- Are business continuity arrangements tested?
- Are third-party technology risks monitored?
- Are identified weaknesses tracked through remediation?
- Are cybersecurity responsibilities clearly understood?
- Are changes to systems and infrastructure appropriately assessed from a security perspective?
These questions move the focus from documentation to effectiveness.
An independent cybersecurity audit can provide management and the Board with a structured assessment of whether the organisation’s control environment operates as intended and where further improvements may be required.
5. Cybersecurity and Operational Resilience
For a VASP, cybersecurity cannot be separated from operational resilience.
Virtual asset businesses can depend on interconnected technology platforms, wallets, applications, cloud services, external providers and other critical infrastructure. A disruption affecting one component can have consequences across the wider operating environment.
This makes resilience an important consideration when evaluating cybersecurity arrangements.
A cybersecurity audit can help identify whether the organisation has considered not only how to prevent security incidents, but also how to detect, respond to, contain and recover from them.
The objective is not simply to minimise the likelihood of an incident. It is also to strengthen the organisation’s ability to continue operating and recover effectively when disruption occurs.
6. Why Independent Cybersecurity Assurance Matters
Internal cybersecurity teams and technology providers have an important role in implementing and maintaining security controls. Independent assurance serves a different purpose.
An independent audit can provide an objective perspective on the design and effectiveness of the control environment and help identify weaknesses that may not be apparent through day-to-day operational activities.
For management and Boards, this can provide additional assurance over areas such as:
- Cybersecurity governance
- Control effectiveness
- Regulatory alignment
- Incident preparedness
- Business continuity
- Third-party risk
- Remediation of identified weaknesses
It can also provide a structured basis for management to prioritise corrective actions and monitor improvements over time.
7. What Existing Seychelles VASPs Should Consider
Cybersecurity assurance should not be viewed only as an exercise undertaken during the licensing process.
Existing VASPs should consider whether their cybersecurity arrangements remain appropriate as their business, technology and risk profile evolve.
Changes to technology platforms, service providers, organisational structures, products, customer volumes or operating models may introduce new cybersecurity risks.
A periodic independent review can therefore help VASPs determine whether their existing framework continues to be appropriate.
Key questions may include:
- When was the cybersecurity framework last independently assessed?
- Have significant technology or operational changes occurred since the previous review?
- Are previously identified cybersecurity weaknesses fully remediated?
- Are third-party and outsourcing risks adequately addressed?
- Are incident response and business continuity arrangements tested?
- Can management demonstrate effective oversight of cybersecurity risks?
- Are cybersecurity policies consistent with the VASP’s current operating model?
These considerations can help businesses identify areas requiring attention before weaknesses develop into more significant operational or regulatory concerns.
8. How FiveComply Supports Seychelles VASPs
At FiveComply, we provide independent Cybersecurity Audit services designed around the regulatory and operational profile of each VASP.
Our approach can assist businesses with:
- Cybersecurity framework assessments
- Independent cybersecurity audits
- Regulatory gap assessments
- Review of cybersecurity policies and procedures
- Assessment of governance and control arrangements
- Third-party and outsourcing risk reviews
- Incident management and business continuity assessments
- Identification and prioritisation of control weaknesses
- Remediation follow-up and ongoing assurance
Our objective is to provide more than a documentation review. We focus on understanding how cybersecurity controls operate within the business and providing clear, practical findings that management can use to strengthen the overall control environment.
Conclusion
For Seychelles VASPs, cybersecurity is increasingly connected to regulatory compliance, operational resilience and effective risk management.
The existence of a Cyber Security Policy is an important starting point, but effective cybersecurity requires appropriate governance, implemented controls, ongoing monitoring, incident preparedness and the ability to respond to changing risks.
The Seychelles regulatory framework now specifically addresses cybersecurity for VASPs and includes dedicated Guidance Notes for Cybersecurity Audit.
For both new applicants and existing VASPs, an independent cybersecurity audit can provide valuable insight into whether the organisation’s current arrangements remain regulatory, cybersecurity, financial or investment advice. Regulatory requirements may change, and businesses should refer to the applicable legislation, regulations appropriate, effective and aligned with its regulatory obligations.
At FiveComply, we support Seychelles VASPs with independent cybersecurity audit and regulatory assurance services tailored to their business model, technology environment and risk profile.
Disclaimer
This article is provided for general informational purposes only and does not constitute legal, regulatory, or tax advice.
