| (1) | A central counterparty must establish, implement, maintain and enforce a business continuity policy and a disaster recovery plan, approved by the controlling body— |
| (a) | to identify all critical business functions and related systems, and include the central counterparty’s strategy, policy and objectives to ensure the continuity of these functions and systems; |
| (b) | that takes into account interdependencies within the central counterparty, including exchanges and trading venues cleared by the central counterparty, and securities settlement and payment systems used by the central counterparty; |
| (c) | that takes into account critical functions or services which have been outsourced to third-party providers; |
| (d) | that contains clearly defined and documented arrangements for use in the event of a business continuity or systemic event which are designed to ensure a minimum service level of critical functions; |
| (e) | that must identify and include recovery point objectives and recovery time objectives for critical functions and determine the most suitable recovery strategy for each of these functions, which arrangements must be designed to ensure that in extreme scenarios critical functions are completed on time and that agreed service levels are met; |
| (f) | that identifies the maximum acceptable down time of critical functions and systems, and stipulate that— |
| (i) | the maximum recovery time for the central counterparty’s critical functions to be included in the business continuity policy may not be longer than two hours; and |
| (ii) | end of day procedures and payments must be completed on the required time and day in all circumstances; |
| (g) | to achieve prompt recovery of its operations following any disruptions; |
| (h) | to allow for the timely recovery of information, including data, in the event of a disruption; and |
| (i) | to cover the exercise of authority in the event of any systemic event. |
| (2) | A licensed central counterparty must— |
| (a) | conduct a business impact analysis which identifies the business functions which are critical to ensure the continuity of the functions of the central counterparty; |
| (b) | use scenario based risk analysis which is designed to identify how various scenarios affect the risks to its critical business functions; |
| (c) | in assessing risks take into account dependencies on external providers, including utilities services and take action to manage these dependencies through appropriate contractual organisational arrangements; and |
| (d) | on an annual basis and following an incident or significant organisation changes, review its business impact analysis and scenario analysis. |
| (3) | A licensed central counterparty’s disaster recovery plan must include arrangements— |
| (a) | to ensure continuity of its critical functions based on disaster scenarios, which arrangements must address the availability of adequate human resources, the maximum downtime of critical functions, and failover and recovery to a secondary site; |
| (b) | to maintain a secondary processing site capable of ensuring continuity of all critical functions of the central counterparty, which secondary site must have a geographical risk profile which is distinct from that of the primary site; |
| (c) | to consider the need for additional processing sites if the diversity of the risk profiles of the primary and secondary sites do not provide sufficient confidence that the central counterparty’s business continuity objectives will be met in all scenarios; and |
| (d) | for the maintenance and provision of immediate access to the secondary business site to allow staff to ensure continuity of the functions and services if the primary location of business is not available. |
| (4) | A licensed central counterparty must— |
| (a) | test and monitor its business continuity policy and disaster recovery plan at regular intervals and after significant modifications or changes to the systems or related functions to ensure the business continuity policy achieves the stated objectives including the two hour maximum recovery time objective; |
| (b) | plan and document the tests which must— |
| (i) | involve scenarios of large scale disasters and switch overs between primary and secondary sites; and |
| (ii) | include involvement of clearing members, service providers and relevant institutions with which interdependencies have been identified in the business continuity policy. |
| (5) | A licensed central counterparty must— |
(a) regularly review and update its business continuity policy to include all critical functions and the most suitable recovery strategy for them;
| (b) | regularly review and update its disaster recovery plan to include all critical functions and the most suitable recovery strategy for them; |
| (c) | annually subject its business continuity and disaster recovery plan to an independent review and testing; |
| (d) | when updating its business continuity policy and disaster recovery plan take into consideration the outcome of the tests and recommendations of independent reviews and other reviews of supervisory authorities; and |
| (e) | review its business continuity policy and disaster recovery plan after every significant disruption, to identify the causes and any required improvements to the central counterparty’s operations, business continuity policy and disaster recovery plan. |
| (6) | A licensed central counterparty must— |
| (a) | have a crisis management function to act in case of a systemic event, which must— |
| (i) | be monitored and regularly reviewed by its controlling body; and |
| (ii) | contain well-structured and clear procedures to manage internal and external crisis communications during a systemic event; |
| (b) | have a crisis management procedure which must be clear and documented in writing; |
| (c) | following a systemic event, undertake a review of its handling of the crisis, which review must, where relevant, incorporate contributions from clearing members and other external stakeholders; and |
| (d) | have a communication plan which documents the way in which the senior management, the controlling body, relevant external stakeholders and the Authority will be adequately informed during a crisis. |
