Add escalation thresholds
Examples include: confirmed account compromise triggers the security-response procedure; leverage approaching a verified liquidation threshold triggers the position-risk procedure; inability to access a venue blocks new exposure and activates the operational contingency plan.
Preserve the timeline
During a fictional crisis, update the card every 15 minutes with new information but do not overwrite earlier facts. This lets the learner see how the interpretation changed and prevents hindsight from making the response look cleaner than it was.
Completion check
Run a compound scenario and explain why each action belongs to market, security or access risk. If an action depends on an unverified rumor, mark it as pending rather than upgrading the rumor into a fact.
*Cryptocurrency and virtual asset transactions are highly volatile and irreversible, may result in significant losses, and do not guarantee returns; customers should trade only after understanding the risks involved.
