Article 16 Business continuity plan (Article 48(1) of Directive 2014/65/EU)

Trading venues shall, in the context of their governance and decision making framework in accordance with Article 3, establish a business continuity plan to implement effective business continuity arrangements provided for in Article 15. The business continuity plan shall set out the procedures and arrangements for managing disruptive incidents.

The business continuity plan shall provide for the following minimum content:

1. (a)

   a range of possible adverse scenarios relating to the operation of the algorithmic trading systems, including the unavailability of systems, staff, work space, external suppliers or data centres or loss or alteration of critical data and documents;

2. (b)

   the procedures to be followed in case of a disruptive event;

3. (c)

   the maximum time to resume the trading activity and the amount of data that may be lost in the IT system;

4. (d)

   procedures for relocating the trading system to a back-up site and operating the trading system from that site.

5. (e)

   back-up of critical business data including up-to-date information of the necessary contacts to ensure communication inside the trading venue, between the trading venue and its members and between the trading venue and clearing and settlement infrastructures;

6. (f)

   staff training on the operation of the business continuity arrangements;

7. (g)

   assignment of tasks and establishment of a specific security operations team ready to react immediately after a disruptive incident;

8. (h)

   an ongoing programme for testing, evaluation and review of the arrangements including procedures for modification of the arrangements in light of the results of that programme.

Clock synchronisation after a disruptive incident shall be included in the business continuity plan.

Trading venues shall ensure that an impact assessment identifying the risks and consequences of disruption is carried out and periodically reviewed. For this purpose, any decision by the trading venue not to take into account an identified risk of unavailability of the trading system in the business continuity plan shall be adequately documented and explicitly approved by the management body of the trading venue.

Trading venues shall ensure that their senior management:

1. (a)

   establishes clear objectives and strategies in terms of business continuity;

2. (b)

   allocates adequate human, technological and financial resources to pursue the objectives and strategies under point (a);

3. (c)

   approves the business continuity plan and any amendments thereof necessary as a consequence of organisational, technological and legal changes;

4. (d)

   is informed, at least on a yearly basis, of the outcome of the impact assessment or any review thereof and of any findings concerning the adequacy of the business continuity plan;

5. (e)

   establishes a business continuity function within the organisation.

The business continuity plan shall set out procedures to address any disruptions of outsourced critical operational functions, including where those critical operational functions become unavailable.