Title VI – Business continuity management

Without prejudice to the applicable requirements under DORA, issuers of ARTs should establish, as part of the implementation of their business continuity policy and plans established in accordance with Article 34 (9) of Regulation (EU) 2023/1114, a sound business continuity management and response and recovery plans to ensure their ability to operate on an ongoing basis, to manage incidents that could disrupt the delivery of critical operations in line with the issuer of ARTs ’ risk appetite and tolerance for disruption, and to limit losses and disruption to service provision in the event of severe business disruption. Issuers of ARTs may establish a specific independent business continuity function taking into account the proportionality criteria listed in Title I.

An issuer of ARTs relies on several critical resources (e.g. IT systems, including cloud services, communication systems, core staff and buildings). The purpose of business continuity management is to reduce the operational, financial, legal, reputational and other material consequences arising from a disaster or extended interruption to these resources and consequent disruption to the issuer of ARTs ’ ordinary business procedures. Other risk management measures might be intended to reduce the probability of such incidents or to transfer their financial impact to third-parties (e.g. through insurance).

In order to establish a sound business continuity management plan, an issuer of ARTs should carefully analyse risk factors for, and its exposure to, severe business disruptions and assess (quantitatively and qualitatively) their potential impact, using internal and/or external data and scenario analysis. This analysis should test the issuer of ARTs ’ ability to deliver critical operations through disruption and should cover all business lines and internal units, including the RMF or risk management procedures, and should take into account their interdependency. The results of the analysis should contribute to defining the issuer of ARTs recovery priorities and objectives.

On the basis of the abovementioned analysis, an issuer of ARTs should put in place:

• a. contingency and business continuity plans to ensure that the issuer of ARTs reacts appropriately to emergencies and is able to deliver critical operations and maintain essential data if there is disruption to its ordinary business procedures;
• b. recovery plans for critical resources and critical or important functions²¹ to recover from disruption and enable the issuer of ARTs to return to ordinary business procedures in an appropriate timeframe. Any residual risk from potential business disruptions should be consistent with the issuer of ARTs ’ risk appetite;
• c. for other activities, or where the continuity of critical essential functions is impossible to ensure, issuers of ARTs should have in place procedures for the timely recovery of data and functions and the timely resumption of their activities.

Contingency, business continuity and recovery plans should be documented and carefully implemented. The documentation should be available within the business lines, internal units and RMF for staff in charge of risk management procedures and should be stored on systems that are physically separated and readily accessible in case of contingency. Appropriate training should be provided. Plans should be regularly tested and updated. Any challenges or failures occurring in the tests should be documented and analysed, with the plans reviewed accordingly.