8 Business continuity plans

Financial entities (⁵¹ ) should have in place, maintain, and periodically test appropriate business continuity plans with the aim to ensure the continuity of the financial entity’s critical or important functions provided by TPSPs. The TPSP should also be involved in those tests as appropriate. Financial entities within a group- or institutional protection scheme (IPS)- related structure may rely on centrally established and periodically tested business continuity plans regarding their functions provided by TPSPs, in accordance with Section 2.

⁵¹ Financial entities within the scope of CRD should also refer to the requirements under Article 85(2) of Directive 2013/36/EU and Title VI of the EBA Guidelines on internal governance while investment firms should refer to Title VI of the EBA Guidelines on internal governance under Directive (EU) 2019/2034, and issuers of ARTs to Title VI of the EBA Guidelines on the minimum content of the governance arrangements for issuers of asset-referenced tokens under Regulation (EU) 2023/1114.

Business continuity plans should take into account the possible event of a failure or disruption at a TPSP impacting the provision of critical or important functions. Taking into account the application of proportionality, as part of the overall business continuity policy, financial entities should conduct a business impact analysis (BIA) of their exposures to severe business disruptions. Under the BIA, financial entities should assess the potential impact of severe business disruptions by means of quantitative and qualitative criteria, using internal and external data and scenario analysis, as appropriate. The BIA should consider the criticality of identified and mapped business functions, support processes, third-party dependencies, and substitutability of the TPSP.