Testing of the ICT business continuity plans


  1. When testing the ICT business continuity plans in accordance with Article 11(6), of Regulation (EU) 2022/2554, financial entitiesas defined in Article 2, points (a) to (t) shall take into account the financial entity’s business impact analysis (BIAbusiness impact analysis) and the ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment assessment referred to in Article 3(1), point (b), of this Regulation.

  2. Financial entitiesas defined in Article 2, points (a) to (t) shall assess through the testing of their ICT business continuity plans referred to in paragraph 1 whether they are able to ensure the continuity of the financial entity’s critical or important functionsa function the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law. That testing shall:

    1. be performed on the basis of test scenarios that simulate potential disruptions, including an adequate set of severe but plausible scenarios;

    2. contain the testing of ICT servicesdigital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services provided by ICT third-party service providersan undertaking providing ICT services, where applicable;

    3. for financial entitiesas defined in Article 2, points (a) to (t), other than microenterprisesa financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million, as referred to in Article 11(6), second subparagraph, of Regulation (EU) 2022/2554, contain scenarios of switchover from primary ICT infrastructure to the redundant capacity, backups and redundant facilities;

    4. be designed to challenge the assumptions on which the business continuity plans are based, including governance arrangements and crisis communication plans;

    5. contain procedures to verify the ability of the financial entities’ staff, of ICT third-party service providersan undertaking providing ICT services, of ICT systems, and ICT servicesdigital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services to respond adequately to the scenarios duly taken into account in accordance with Article 26(2)

    For the purposes of point (a), financial entitiesas defined in Article 2, points (a) to (t) shall always include in the testing the scenarios considered for the development of the business continuity plans.

    For the purposes of point (b), financial entitiesas defined in Article 2, points (a) to (t) shall duly consider scenarios linked to insolvency or failures of the ICT third-party service providersan undertaking providing ICT services or linked to political risks in the ICT third-party service providers’ jurisdictions, where relevant.

    For the purposes of point (c), the testing shall verify whether at least critical or important functionsa function the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law can be operated appropriately for a sufficient period of time, and whether the normal functioning may be restored.

  3. In addition to the requirements referred to in paragraph 2, central counterpartiesa central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012 shall involve in the testing of their ICT business continuity plans referred to in paragraph 1:

    1. clearing members;

    2. external providers;

    3. relevant institutions in the financial infrastructure with which central counterpartiesa central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012 have identified interdependencies in their business continuity policies.

  4. In addition to the requirements referred to in paragraph 2, central securities depositoriesa central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014 shall involve in the testing of their ICT business continuity plans referred to in paragraph 1, as appropriate:

    1. users of the central securities depositoriesa central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014;

    2. critical utilities and critical service providers;

    3. other central securities depositoriesa central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014;

    4. other market infrastructures;

    5. any other institutions with which central securities depositoriesa central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014 have identified interdependencies in their business continuity policy.

  5. Financial entitiesas defined in Article 2, points (a) to (t) shall document the results of the testing referred to in paragraph 1 Any identified deficiencies resulting from that testing shall be analysed, addressed, and reported to the management bodya management body as defined in Article 4(1), point (36), of Directive 2014/65/EU, Article 3(1), point (7), of Directive 2013/36/EU, Article 2(1), point (s), of Directive 2009/65/EC of the European Parliament and of the Council, Article 2(1), point (45), of Regulation (EU) No 909/2014, Article 3(1), point (20), of Regulation (EU) 2016/1011, and in the relevant provision of the Regulation on markets in crypto-assets, or the equivalent persons who effectively run the entity or have key functions in accordance with relevant Union or national law.