Prudent Policy: Circular on Sound Management Practices Regarding Business Continuity of Financial Institutions

Congresstraat 12-14 | 1000 Brussels
+32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be Prudent Policy

Brussels, 10 March 2005
Circular on sound management practices regarding business continuity of financial institutions PPB 2005/2

1. Justification and definitions
   Credit institutions, insurance undertakings, investment firms1 and management companies of collective investment schemes must have an organization appropriate to their activity.2 This authorization requirement includes, among other things, that the undertakings concerned use all reasonable means to ensure their service provision and activities without interruptions. They must, in particular – taking into account the nature, size and complexity of their business – set up their organization, systems and procedures such that, in the event of a serious and unplanned interruption of their business, they can continue to comply with their obligations arising from the supervisory status and protect the interests and rights of their clients. An adapted business continuity policy is a necessary instrument in this regard to achieve these objectives. It is evident that the theme of business continuity is also on the agenda of international consultation forums and regulators, which may lead to harmonized rules in the future. This does not prevent Belgian financial institutions from already working on their business continuity policy and taking measures to complete or improve their organization in this regard. This circular lists a number of criteria – translated as sound management practices – by which the CBFA will assess the business continuity policy of the financial institutions under its supervision.

1
Hereinafter, "investment firms" means the investment firms referred to in Article 47 of the Act of 6 April 1995, as well as investment advisory companies (Article 119 of the Act of 6 April 1995) and derivatives specialists (Article 45, 10°, of the Act of 6 April 1995 and the Royal Decree of 28 January 2004). 2 See Article 20 of the Act of 22 March 1993 (credit institutions), Article 14bis of the Act of 9 July 1975 (insurance undertakings), Articles 62 and 124 of the Act of 6 April 1995 (investment firms, investment advisory companies) and Article 9 of the Royal Decree of 28 January 2004 (derivatives specialists). For the management companies of collective investment schemes, see Article 153, §1, of the Act of 20 July 2004 concerning certain forms of collective management of investment portfolios.

Congresstraat 12-14 | 1000 Brussels
+32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 2
  In this circular, the following terms are understood as:
  business continuity: the objective of ensuring that service provision and activities proceed without interruption under all circumstances; business continuity policy: the establishment of a strategy regarding business continuity and an implementation policy aimed at taking all reasonable measures to ensure business continuity; business continuity planning: the planning and preparation process that – in execution of the business continuity policy – results in a business continuity plan; business continuity plan, abbreviated "BCP":
  a collection of procedures and documentation that are developed and brought together into a coherent whole and made available in the event of an unplanned interruption.

2. Scope of application
   2.1. Ratione personae
   The sound management practices apply to credit institutions, insurance undertakings, investment firms and management companies of collective investment schemes governed by Belgian law. They also apply to the Belgian branches of credit institutions, insurance undertakings, investment firms and management companies of collective investment schemes, which are subject to the law of a state that is not a member of the European Union. For undertakings that are part of a group, the group dimension can play an important role in the concrete implementation of their business continuity policy. The undertaking must in such a case demonstrate that the group-wide organization does not detract from the soundness of its business continuity policy. The sound management practices are relevant for both large and small institutions, although the consequences of interruptions for each business can vary greatly. Therefore, each institution must translate its specific characteristics into an appropriate and proportionate business continuity policy, including with regard to objectives, planning and the resources used to ensure this. The CBFA expects institutions that are considered by the Committee for Financial Stability ("CFS") as critical to the proper functioning of the Belgian financial system (payment systems, clearing and settlement) to also implement the specific CFS recommendations.

Congresstraat 12-14 | 1000 Brussels
+32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 3
  2.2. Ratione materiae
  The sound management practices address serious unplanned interruptions of the business resulting from, among other things, computer failures, computer viruses and cybercrime, accidents, large-scale social unrest, bomb alerts, fraud, sabotage, terrorism, natural disasters, as well as the failure of utilities (telecommunications, electricity, gas, water,...). Acts of war and simultaneous terrorist attacks targeting the undertaking at multiple remote locations, as well as the rapid, large-scale spread of infectious deadly diseases, fall outside the scope of application. Also excluded are interruptions of service provision and activity that the undertaking itself has planned and communicated to clients, users or other interested parties (for example due to relocation, maintenance work on its infrastructure). Without prejudice to the specific characteristics of each undertaking, business continuity planning takes into account scenarios such as:
  • the total or partial destruction and/or unavailability of business buildings;
  • the unavailability of
  o critical business functions and systems; o persons holding effective control of the undertaking; o critical know-how and personnel playing a key role;
  • the loss or damage of data;
  • damage to or failure of critical infrastructure (IT, transport,...) or
  utilities;
  • the loss of important counterparties and service providers.
  The following elements are included, where applicable, in the planning:
  • central and decentralized business units, as well as foreign branches that are of
  critical importance to the operation of the Belgian branch, or vice versa;
  • support functions;
  • central and decentralized ICT systems, databases and software;
  • telecommunication and data communication channels, with special attention to connections with
  financial markets, multilateral trading facilities, central counterparties, clearing and settlement institutions, important counterparties and distribution networks;
  • services outsourced to third-party service providers.

3. Establishment of a business continuity policy by the institution
   Every institution has an adapted strategy and policy regarding its business continuity. Taking into account the nature, size and complexity of its business, it must set up its organization such that, in the event of a serious and unplanned interruption of the business, it can maintain or restore as soon as possible its critical business functions and resume its normal service provision and activity within a reasonable timeframe. The senior management of the institution (usually the board of directors) approves this strategy and the guidelines of the business continuity policy and ensures that the persons responsible for executive management take the necessary steps to further develop and apply it.

Congresstraat 12-14 | 1000 Brussels
+32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 4
  Periodically and at least once a year, the executive management reports to the senior management on business continuity in general and on the operation and effectiveness of the business continuity planning and the BCP in particular. If necessary, one member of the executive management is responsible for coordination and reporting. The strategy and guidelines of the policy relate, among other things, to:
  • raising awareness at all levels of the undertaking regarding the importance of
  business continuity and the BCP;
  • identification of core services and critical business units, functions and
  systems;
  • determination of the maximum duration the institution accepts to restore its critical
  business units, functions and systems after an unplanned interruption;
  • establishment of the acceptable reduction in service provision to third parties and the time horizon for the
  resumption of normal service provision and business activity after an unplanned interruption;
  • determination of responsibilities and reporting lines regarding business continuity;
  • application of preventive and risk-reducing measures;
  • allocation of budget and resources.
  The internal audit function includes the operation and application of the business continuity policy and the BCP of the undertaking in its audit planning and activities and evaluates them. For this purpose, appropriate audit programs and techniques are used.

4. Implementation of the business continuity policy
   4.1. Analysis of discontinuity risks and vulnerability of the undertaking
   Based on the principles discussed above, the institution analyzes the discontinuity risks and the various scenarios applicable to the undertaking. Where possible, a business impact analysis quantifies the consequences of the realization of the identified risks and scenarios with regard to clients, counterparties, markets, personnel, internal services, the financial situation or the reputation of the institution.
   4.2. Development of continuity and recovery measures
   The institution develops – in accordance with the established strategy and guidelines as referred to in point 3 – detailed business continuity measures to achieve the desired objectives. The BCP is the concrete result of this and thus includes the measures, procedures and information, etc., necessary to mitigate and manage the consequences of a serious and unplanned interruption.

Congresstraat 12-14 | 1000 Brussels
+32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 5
  The BCP, which usually consists of several sub-plans, must be sufficiently detailed and user-friendly in light of the nature, size and complexity of the business, be communicated to the relevant employees and be maintained at multiple locations, including at places not described as critical. The BCP contains the following components:
  (a) crisis management: decision-making structures (e.g., crisis management committee) and procedures that come into effect in the event of serious unplanned interruptions, with identification of all persons playing a role in them and of their respective responsibilities, reporting and priorities. (b) communication: procedures and respective responsibilities for communication with personnel, supervisors (CBFA, NBB,...), media, markets, important counterparties and with clients. (c) recovery of critical documentation: preservation or recovery of all critical documents and contracts by means of copying, scanning, storage at other locations (with possible remote access, if applicable),... This naturally also applies to the BCP and to agreements and service level agreements with service providers that must intervene in the event of an interruption, as well as to the necessary procedure manuals, ICT licenses and manuals. (d) human resources and equipment: without prejudice to the implementation of applicable measures to appropriately protect personnel in the event of a disaster, establishing how critical personnel can be brought to the agreed locations and function (offices, equipment and supplies,...). The use of interim staff or external specialists may also fall under this. (e) recovery of critical business functions: procedures for the various business functions and processes that must be maintained or restored in the event of interruption according to the requirements established in this regard (see point 3). This planning can, due to its simplicity, clarity and structure (checklists, step-by-step procedures), also be understood and executed by persons who do not necessarily possess all the expertise in this regard. Account is also taken of possible interweaving of business activities, critical nodes (so-called single points of failure) and dependence on other internal or external parties. It may also be advisable to provide manual procedures in case the undertaking's ICT support is unavailable. If the nature, size and complexity of the activity require it, the institution must have the possibility to relocate to one or more remote backup sites (for the characteristics of a backup site and the distance relative to the business center, see – mutatis mutandis – point (f) and Annex 1);

Congresstraat 12-14 | 1000 Brussels
+32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 6
  (f) information and telecommunications technology ("ICT"): procedures indicating when, where, how and in what order critical ICT systems and files are restored or recreated in the event of loss, damage or destruction. Given the presence of critical personnel during an unplanned interruption cannot be guaranteed, these procedures are designed such that they can also be executed by other, if necessary, less experienced persons. If the nature, size and complexity of the business require it, the plan provides for the equipment of one or more secure remote backup sites for critical ICT systems with the following characteristics:
  i. a backup site is located at a significant geographical distance from the
  ICT business center of the undertaking; the distance is justified based on an objective risk analysis with attention to the criteria included in
  Annex 1;
  ii. sufficient space for hardware and personnel;
  iii. availability of equipment, files, software and information necessary
  to achieve ICT recovery within the established requirements;
  iv. availability of necessary ICT peripheral equipment such as cooling systems,
  power supply, monitoring systems,...;
  v. availability of adapted telecommunications and utilities that are redundant to those used by the ICT business center of the undertaking;
  vi. physical and ICT security measures must be adequately maintained during the interruption and in the
  recovery phase.
  4.3. Testing, evaluation and adjustment
  (a) testing
  The effectiveness of the BCP and its components, in particular the remote backup sites, is assessed using appropriate tests whose content, depth and frequency are proportional to their importance, variability and complexity. Important and complex plans whose actions and reflexes require much practice are tested at least once a year. Higher frequencies may apply to components of plans that are of critical importance. These tests also aim to sharpen the readiness of personnel and the awareness of the importance of business continuity within the institution and enable the personnel to learn and perform the tasks assigned to them during a serious unplanned interruption. The tests have sufficient relevance with regard to the tested hypotheses and scenarios, including with regard to conditions and activity volumes. The tests and results are documented, analyzed and lead, where necessary, to adjustment of the business continuity policy and the BCP.

Congresstraat 12-14 | 1000 Brussels
+32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 7
  (b) changes
  Significant changes that the institution makes to its organization, service provision, activity program and ICT are grounds for examining the appropriateness of existing business continuity provisions and the BCP and, if necessary, to adjust it, applying the rules described above. The relevant critical business units and functions are responsible for regularly reviewing their continuity provisions and detailed procedures to adjust them to changes that occur in their operation (personnel, communication means, systems,...).

5. Involvement of external service providers
   The institution that relies on external service providers for parts of business continuity takes all reasonable steps to ensure that the agreed service provision is available when needed, for example by ensuring an appropriate geographical distance of the backup sites from the business centers (see Annex 1), or by including capacity guarantees in the outsourcing agreement. Indeed, a strong sectoral concentration of reliance on the same service provider can jeopardize the quality and availability of its service provision in the event of disasters. For this and other concerns in the event of outsourcing, see also the CBFA circular on sound management practices in outsourcing.3

6. Evaluation of existing business continuity policy, –planning and target dates.
   The CBFA expects institutions to evaluate their business continuity policy by the end of 2005 in light of the sound management practices mentioned in this circular and determine which measures, if any, are taken, and within what timeframe, to adjust their organization in this regard. The technical implementation and realization of certain aspects of the business continuity plan may require significant organizational interventions or implementation timelines (e.g., equipping backup sites). The institutions concerned draw up a program for these aspects to achieve their objectives within a reasonable timeframe – to be assessed in light of the nature, size and complexity of their business. If this program uses timelines that exceed the end of 2007, this must be discussed with the CBFA. Otherwise, such a spread of implementation does not prevent the CBFA from assessing the business continuity policy as a whole based on the management practices in question. Û

3
For credit institutions and investment firms, see circular PPB 2004/5 of 22 June 2004.

Congresstraat 12-14 | 1000 Brussels
+32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 8
  Annex 1
  Criteria for determining the minimum distance between ICT centers and backup centers Given the wide variety of risk profiles, each financial institution must evaluate its own risks and determine the appropriate minimum distance between its ICT center and its backup center for critical ICT systems based on this. At least the following points must be taken into account:
  • the possible destruction of entire data centers and business centers, including the
  loss of key personnel;
  • geological and meteorological hazards (floods, earthquakes, etc.); locating all
  data centers in the same zone exposed to floods would, for example, unacceptable;
  • environmental risks (proximity to industrial activities with high risk profiles, airports,
  embassies, government institutions and military installations, etc.); for example, a greater distance must exist between data centers if one is located near a nuclear power plant or a possible target for terrorist attacks, such as the branches of international institutions; also for data centers located in large agglomerations and in zones with dangerous industrial activity, a greater safety distance must be built in, given that risk;
  • the possible unavailability of data centers and business buildings due to social unrest,
  evacuations, security perimeters, destruction or over-saturation of access roads; it must be avoided that the backup site is only accessible via an access road that threatens to be blocked when an incident occurs in the primary ICT center;
  • damage from a terrorist attack on critical infrastructure or against a critical
  financial institution or its surroundings;
  • damage to the immediate surroundings and to utilities; in this regard, it is of
  essential importance that the ICT and backup centers use utilities without "single points of failure" and that they are geographically sufficiently separated so as not to be affected by the same local incident; in rural areas where the network of utilities is less branched and redundant, the minimum safety distance between the data centers should be greater than in agglomerations or industrial zones with a widely branched and redundant network. Û