Instructions No. (5) of 2022 Concerning Business Continuity Management

PALESTINE MONETARY AUTHORITY

Instructions No. (5) of 2022
Concerning Business Continuity Management

Based on the provisions of Decision-Law No. (9) of 2010 concerning Banks, particularly Articles (43) and (72) thereof, and in accordance with the powers delegated to us, and to achieve the public interest, we have issued the following Instructions:

Article (1)
Definitions

The following words and phrases shall have the meanings specified below wherever they appear in these Instructions, unless the context indicates otherwise:

Business Continuity Management: A comprehensive and ongoing business management process that includes policies, procedures, and plans used to maintain the continuity and resilience of operations and to restore them in a timely manner upon exposure to any emergency or threat, with the aim of reducing the level of risks and operational, financial, legal, and reputational damages resulting from business disruption.
Business Continuity Plan: A detailed, documented guideline plan that outlines the necessary procedures to guide the bank to ensure response, recovery, and restoration of systems and processes after an interruption.
Business Impact Analysis (BIA): The measurement and analysis of the consequences resulting from the interruption of activities and processes, with the aim of developing necessary recovery strategies by identifying priorities, resources, and requirements needed in the restoration process.
Recovery Time Objective (RTO): The acceptable time period to restore critical activities, processes, and services after an incident occurs.
Recovery Point Objective (RPO): The maximum permissible amount of data loss for the purpose of resuming critical operations upon service restoration.
Maximum Acceptable Outage (MAO): The maximum time period for the stoppage of operations, services, or products that the bank can withstand.
Incident: The condition that may lead to a malfunction, emergency, crisis, or loss.
Critical Operations: Operations whose stoppage cannot be tolerated for a period determined based on the Business Impact Analysis.

PALESTINE MONETARY AUTHORITY

Disaster Recovery Plan (DRP): An action plan to restore systems, data, applications, and others upon the occurrence of an incident in order to return to normal operations.
Crisis Management Plan (CMP): An action plan that determines how to handle a risk or threat when it occurs, and the procedures required from the bank and service providers to deal with those risks.
Critical Systems: Systems whose stoppage or malfunction leads to the disruption of critical operations.

Article (2)
Objective and Scope of Application

The provisions of these Instructions aim to specify the procedures the bank must take to confront threats and business interruption risks, ensure recovery from their impacts with minimal losses, and build resilience into its critical operational processes during exposure to an incident.
The provisions of these Instructions apply to all banks licensed by the Palestine Monetary Authority to conduct banking business in Palestine.

Article (3)
Governance of Business Continuity Management

The bank's Board of Directors shall do the following:
أ. Approve the business continuity strategy and policy, and any amendments thereto, which shall include long-term strategic objectives, action plans, and timelines to achieve these objectives. ب. Allocate the necessary resources to implement the business continuity plan, including qualified financial and human resources. ت. Form a steering committee for business continuity management authorized by the Board of Directors, comprising members of senior management and the business continuity management officer. ث. Approve a specific charter for the business continuity committee, including the committee's objectives, roles and responsibilities, number of participants in meetings, and meeting frequency. ج. Ensure the existence, development, and continuous updating of an operational risk management policy and verify its implementation. ح. Receive reports on the progress of the business continuity plan, including the results of plan testing. خ. Ensure that policies and plans are reviewed by an independent body, such as internal or external auditors, annually or upon making any fundamental change.
The bank's business continuity management committee shall do the following:
أ. Prepare policies and develop necessary plans for the continuity of critical operations and systems, oversee their implementation, and review them at least once annually or upon making any fundamental change, which shall include objectives, scope, roles, and responsibilities.

PALESTINE MONETARY AUTHORITY

ب. Determine the standards and guidelines used in the business continuity program.  
ت. Identify the necessary resources to implement the business continuity plan from all relevant departments.  
ث. Provide a business continuity management function within the risk department, ensuring that the incumbent possesses the qualifications, experience, competence, and skills appropriate to manage and implement business continuity programs and plans. ج. Form and assign all business continuity management functions, and clearly define the roles and responsibilities of each member. ح. Oversee the design and implementation of awareness programs regarding business continuity for all administrative levels in the bank, ensuring that all relevant parties are aware of their roles and responsibilities during an incident. خ. Oversee the design of periodic tests and regularly review test results and measure the effectiveness of plan implementation.

Article (4)
Business Impact Analysis