What Happens If a Team Member Loses Access? A Company Recovery Plan

A lost phone, inaccessible email account or unexpected employee departure should not stop payroll, vendor payments or treasury operations. For companies holding USDC or USDT, the recovery plan must cover more than resetting a password. It must also preserve the company’s ability to authorize transactions from a self-custodial treasury vault.

Stablerail uses self-custodial MPC vaults with quorum signing. MPC, or multi-party computation, distributes signing authority so that no single person needs to hold a complete private key. A quorum policy then determines how many authorized signers must approve a transaction.

This structure reduces dependence on one employee, but only if the company configures backup signers, documents account recovery steps and tests them before an incident.

Start by identifying what was lost

“Lost access” can describe several different incidents. The correct response depends on whether the company has lost a login, a signing device or confidence that credentials remain secure.

Do not treat a suspected compromise as a routine password reset. If a device or credential could be in someone else’s control, assume it is unsafe until reviewed.

Design a quorum that survives one person being unavailable

A quorum is the minimum number of authorized signers required to approve a transaction. A one-person setup is simple, but it creates a single point of failure. If that person loses access, the company cannot sign until access is restored.

These are examples rather than universal recommendations. The right threshold depends on transaction frequency, payment deadlines, team size and risk tolerance.

For a 2-of-3 structure, the three signers might be the CFO, controller and a designated executive backup. The backup must be a real, enrolled signer who can complete the process—not simply an administrator listed in a policy document.

A resilient design should also avoid correlated failure. If every signer uses the same identity provider, office network and device management system, one outage could block the entire quorum. Where practical, keep at least one backup signer operationally independent while applying the same security standards.

Separate account recovery from key recovery

Account recovery restores a person’s access to the platform after a login, multifactor authentication or identity problem. Key recovery restores or replaces the company’s ability to cryptographically sign transactions.

They are not interchangeable. Resetting a platform password should not automatically grant the ability to move treasury funds. Likewise, replacing a signer in an MPC quorum may require authorization from the remaining company signers and completion of the applicable verification process.

Your written plan should state:

• Who may request an account reset or signer replacement.
• How the requester’s identity and authority are verified.
• Which remaining signers or company officers must approve the change.
• How compromised sessions and devices are revoked.
• How a replacement signer is enrolled and tested.
• Where the request, approval and completion evidence is retained.

Keep current company and authorized-person records available. Depending on the incident, verification may require corporate details, identification for the authorized person and evidence that they are permitted to act for the company. Contact Stablerail support through an approved channel for platform-specific recovery requirements; do not rely on contact details supplied in an unsolicited message.

Create a step-by-step incident runbook

1. Contain the incident

Record when access was lost and whether the device or credentials might be compromised. Disable affected user access, revoke active sessions and remove the user from payment or approval workflows where appropriate. If the person had a corporate card, review whether that card should also be suspended.

2. Confirm the remaining quorum

Check that enough active signers remain to authorize transactions. Do this before urgent payroll, tax or supplier deadlines. If the quorum is intact, normal operations can continue while the affected signer is replaced.

3. Review recent activity

Use the audit log to inspect logins, beneficiary changes, allowlist changes and transaction approvals associated with the user. Escalate unfamiliar wallet addresses or payments for investigation. A wallet screening tool such as Stablerail Checker can support address review, but it does not replace internal investigation.

4. Restore or replace access

Follow the documented account recovery or key recovery path. Never ask employees to share passwords, authentication codes or private recovery material over email or chat. Enroll the replacement device or signer using the approved process, then verify permissions and approval limits.

5. Close the incident

Export or retain the relevant audit trail, approvals and support correspondence. Document the cause, time to restore service, affected payments and any control changes. This evidence helps finance, security and auditors understand exactly what happened.

Make offboarding part of recovery planning

Planned departures are easier than lost-device incidents, but they create similar risks. Do not wait until after an employee’s final day to discover that removing them would break the signing quorum.

Before offboarding a signer:

• Appoint and enroll the replacement signer.
• Confirm the new signer can access the vault and participate in approvals.
• Review approval limits, allowlists and scheduled payments owned by the departing employee.
• Transfer ownership of invoices, payment links, payroll files and beneficiary records.
• Revoke the employee’s login, active sessions, cards and signing authority at the agreed time.
• Confirm that the post-departure quorum still supports normal and emergency payments.

For involuntary departures, coordinate the timing among finance, HR, IT and security so access is removed consistently.

Test business continuity before an emergency

A recovery document is not enough. Test the process at least quarterly and after major changes to signers, identity systems or treasury policies. Companies with frequent payments or a small signing group may choose a more frequent schedule.

A controlled test should confirm that:

• A primary signer can be marked unavailable without stopping the remaining quorum.
• Backup signers can log in from approved devices and complete an approval.
• Current contact and identity-verification records are available.
• The team can find the latest runbook and escalation contacts.
• A low-value test transaction can be approved under the backup arrangement, where company policy permits.
• The audit log captures the recovery exercise and resulting changes.

Set a recovery time objective: the maximum acceptable time before critical treasury operations resume. For example, a company with daily contractor payouts might target recovery before the next payment cut-off. This is an internal operating target, not a platform guarantee.

A practical minimum recovery standard

At minimum, a company treasury should have more authorized signers than its required quorum, one named backup for each critical role, documented account and key recovery procedures, same-day offboarding steps, and a tested escalation path.

The core principle is simple: losing one person’s access should create a manageable incident, not loss of control over company funds. Quorum signing provides the technical foundation, while backup signers, current documentation and regular testing turn it into a working business continuity plan.