226. Competent authorities should assess whether the institution’s business continuity, response …

Competent authorities should assess whether the institution’s business continuity, response and recovery plans:

• a. establish roles and responsibilities, including clear guidance on potential succession, and set out the internal decision-making process along with definition of activation triggers;
• b. are reviewed to ensure contingency strategies remain consistent with current operations, risks and threats, resilience levels, and recovery objectives and priorities;
• c. prioritise business continuity actions using risk-based approach;
• d. are tested regularly to ensure that recovery objectives and timeframes can be met; and
• e. are inclusive of the testing of services provided by third-party service providers, where applicable;

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/