Central Bank of Jordan Instructions on Business Continuity Plans for Banks

1 Number: 10/2248 Date: 30/2/1427 Hijri Date: 30/3/2006 Instructions Business Continuity Plan Number (27/2006) Issued by the Central Bank of Jordan pursuant to the provisions of Article (99/B) of the Banking Law In line with the concern of the Central Bank of Jordan to ensure the business continuity of banks in potential situations of emergency, disruptions and work interruptions, I hereby decide the following: Article (1): Definitions: A. Business Continuity Plan: The plan that ensures the resumption of the institution’s operation, especially critical work, after a reasonable period of interruption of business. B. Disaster Recovery Plan: Part of the Business Continuity Plan that is activated in cases of major emergency or disaster that result in high risks. C. Business Impact Analysis: The mechanism through which the impact (results) of interruption of business is determined. Article (2): All banks must develop business continuity plans while compliant with the principles stated in Article number (3) herein. Article (3): High - level principles of the business continuity plans: I list hereunder the High - level principles that banks must comply with in order to ensure the effectiveness of their business continuity plans: First Principle: Board of Directors and Senior Management Responsibilities: The responsibilities of the Board of Directors and senior management include the following issues: A. Allocating sufficient resources, including qualified human resources that are capable of preparing and developing the business continuity plans. B. Setting policies related to management and control of potential risks. C. Reviewing the test results of the business continuity plans. D. Endorsing the business continuity plans and their amendments, at least annually. E. Ensuring that the business continuity plans are updated regularly if needed and that relevant human resources are qualified and trained in a manner that would enable them to undertake the tasks assigned to them within those plans.

2 Second Principle: The Life Cycle of the Business Continuity Plans: The business continuity plans must include the following stages at least: A. Business Impact Analysis: The analysis of the impact or loss on business and activities is the first step towards developing the business continuity plans, and includes the following:

1. The potential impact (loss) resulting from various expected and unexpected incidents on operations and activities.
2. All operations and activities should be taken into consideration when analyzing the impact and not limiting it to matters related directly to technology and information systems.
3. Estimating and calculating the tolerable work interruption period of time that is acceptable and the losses incurred due to the interruption. B. Risk Assessment: Risk assessment is the second step towards developing the business continuity plans, and includes the following:
4. Prioritizing operations and activities subject to disruption and interruption according to their criticality while taking into consideration the potential and frequency of disruptions and interruptions.
5. Undertaking a gap analysis through comparing the time needed to resume operations according to what is stated in the business continuity plans and the business objectives.
6. Determining the various potential threats and analyzing their impact in terms of how the risks could negatively affect revenues, activities, clients and the bank’s staff. C. Business Continuity Plan Development: The plan must:
7. Be in writing and distributed to all concerned parties in order to ensure their knowledge of the procedures that need to be undertaken in various cases of interruption of business.
8. Specify the cases where the plan needs to be activated quickly.
9. Specify emergency actions and procedures that need to be adopted in order to activate the plan when the interruption of business occurs.
10. Be appropriately flexible in order to handle unanticipated threat scenarios or changes on various business operations.
11. Focus on the methods of business resumption, recovery, and business continuity.
12. Be effective in terms of reducing the impact of the interruption of business and decreasing losses to the minimum level possible.

3 D. Continuous Testing, Reviewing and Updating of Business Continuity Plan: The effectiveness of the business continuity plan must be verified by undertaking the following steps:

1. Testing the plan at least once a year.
2. Subjecting the plan to an independent review conducted by the internal auditor.
3. Continuously updating the plan to accommodate changes both internally and externally. Third Principle: Other Policies: The following policies must be taken into consideration: A. Systems and infrastructure life cycle. B. Change control policies. C. Data management and retention procedures. D. Training plans. E. Insurance policies. F. Policies related to contacting state institutions, such as the civil defense, the police and the public security forces. The Governor Dr. Umayya Toukan