Article 20 Operational risk

1.   A SIPS operator shall establish a robust framework with appropriate systems, policies, procedures and controls to identify, monitor and manage operational risk.

2.   A SIPS operator shall review, audit, and test systems, operational policies, procedures and controls periodically and after significant changes.

3.   A SIPS operator shall establish service level and operational reliability objectives and policies designed to achieve those objectives. It shall review the objectives and policies at least annually.

4.   A SIPS operator shall ensure that a SIPS has, at all times, scalable capacity to handle increases in payment volumes that occur due to stress events, and that it can achieve its service level objectives.

5.   A SIPS operator shall establish comprehensive physical and information and communication technology (ICT) security policies, processes and system policies, as well as resilient information systems, that adequately identify, assess and manage all potential vulnerabilities, threats, incidents and risks in an ICT environment. It shall review the policies at least annually.

6.   A SIPS operator shall establish a business continuity plan that addresses events posing a significant risk of disrupting the SIPS’ operations. The plan shall include the use of a secondary site and be designed to ensure that critical information technology systems can resume operations within two hours of those events. The plan shall be designed in such a way that the SIPS is always able to settle all payments due by the end of the business day on which the disruption occurs. The SIPS operator shall test the plan and review it at least annually.

7.   A SIPS operator shall identify critical participants based, in particular, on payment volumes and values and their potential impact on other participants and the SIPS as a whole, in the event of a significant operational problem experienced by such participants.

8.   A SIPS operator shall identify, monitor, and manage the risks that critical participants, other FMIs, and services and utility providers might pose to the SIPS’ operations.

9.   For the purposes of this Article, references to ‘risk’ include the risks specified in Articles 21 and 22.