Circular on Developing, Maintaining, and Testing Business Continuity Plans for Market Operators

‘‘Ensuring Investor Protection.’’
SECURITIES AND EXCHANGE COMMISSION, GHANA
The Securities and Exchange Commission (hereinafter referred to as “SEC”) is the statutory body mandated by the Securities Industry Act, 2016 (Act 929) as amended by the Securities Industry (Amendment) 2021 (Act 1062), to promote the orderly growth and development of an efficient, fair, and transparent securities market in which investors and the integrity of the market are protected. Pursuant to its mandate and functions in Sections 2 and 3 of Act 929, the SEC shall be assessing the robustness of the Business Continuity Management (BCM) practices of Capital Market Operators to ascertain the operational resilience of Ghana’s Securities Industry in the event of business disruptions. The SEC shall also assess the ability of Capital Market Operators to continue to maintain critical business operations or services after a major operational disruption. All Capital Market Operators are therefore required to develop and maintain Business Continuity Plans (BCP) that are consistent with five (5) Joint Forum High-level principles for business continuity, published by the Basel Committee of Banking Supervision, International Organization of Securities Commissions (IOSCO) and International Association of Insurance Supervisors dated, August 2006 (the five principles are attached). Capital Market Operators are hereby required to employ the five (5) principles as a guide to develop, maintain, test, and review their business continuity plans. Copies of the Business Continuity Plans must be submitted to the SEC by close of business on 31st December 2022. Henceforth, Business Continuity Plans (BCP) shall be subjected to both on-site and off-site inspections. For more information, please call 0302768970, 0800100065 (toll-free) or send an email to info@sec.gov.gh. This Circular is issued pursuant to Sections 3 and 208(c) of the Securities Industry Act, 2016 (Act 929). ISSUED BY ORDER OF THE SECURITIES AND EXCHANGE COMMISSION (SEC) DATED: DATED: 8TH SEPTEMBER 2022 CIRCULAR TO ALL MARKET OPERATORS REGARDING DEVELOPING, MAINTAINING AND TESTING OF BUSINESS CONTINUITY PLANS (BCP) (CIRCULAR NUMBER: SEC/CIR/004/09/22)

Securities and Exchange Commission (SEC) | Circular Number: SEC/CIR/004/09/22 FIVE (5) JOINT FORUM HIGH-LEVEL PRINCIPLES FOR BUSINESS CONTINUITY PUBLISHED BY THE BASEL COMMITTEE OF BANKING SUPERVISION, INTERNATIONAL ORGANIZATION OF SECURITIES COMMISSIONS (IOSCO) AND INTERNATIONAL ASSOCIATION OF INSURANCE SUPERVISORS _________________________________________________________________________________________ Principle 1: Board and Senior Management Responsibility (BDSM) Capital Market Operators should have effective and comprehensive approaches to business continuity management. The board of directors and senior management are collectively responsible for the business continuity. Business continuity management should be integral part of the overall risk management programme. Policies and processes should be implemented on an enterprise-wide basis or, at a minimum, embedded in an organisation’s critical operations. Principle 2: Major operational disruptions (MOPD) Capital Market Operators (CMOs) should incorporate the risk of a major operational disruption into their approaches to business continuity management. CMOs’ business continuity management should also address how they will respond to a major operational disruption that affects the operation of the financial industry. The extent to which a CMO prepares to recover from a major operational disruption should be based on its unique characteristics and risk profile. CMOs should identify through a business impact analysis, business functions and operations that are to be recovered on a priority basis and establish appropriate recovery objectives for those operations. The BCP should be able to identify alternate business sites and a review provision on the adequacy of the recovery arrangements from the alternate business sites. Principle 3: Recovery objectives (RECO) Capital Market Operators (CMOs) should develop recovery objectives that reflect the risk they represent to the operation of the financial system. As appropriate, such recovery objectives may be established in consultation with the regulator. CMOs should establish recovery objectives that are proportionate to the risk they pose to the operation of the capital market. Principle 4: Communications (COMM) Capital Market Operators (CMOs) should include in their business continuity plans procedures for communicating within their organizations and with relevant external parties in the event of a major operational disruption. The business continuity plans of the CMOs should incorporate comprehensive emergency communication protocols and procedures.

Securities and Exchange Commission (SEC) | Circular Number: SEC/CIR/004/09/22 Principle 5: Testing (TEST) Capital Market Operators (CMOs) should test their business continuity plans, evaluate their effectiveness, and update their business continuity management, as appropriate. Testing the ability to recover critical operations as intended is an essential component of effective business continuity management. Such testing, which can take many forms, should be conducted periodically, with the nature, scope and frequency determined by the criticality of the applications and business functions.