Prudential Policy

Brussels, 10 March 2005

Circular regarding prudent business practices concerning the business continuity of financial institutions PPB 2005/2

1. Justification and Definitions

Credit institutions, insurance undertakings, investment firms¹ and management companies of collective investment schemes must have an organization appropriate to their activity.²

This authorization requirement includes, among other things, that the companies concerned use all reasonable means to ensure their services and activities continue without interruption. They must, in particular – taking into account the nature, scale, and complexity of their business – set up their organization, systems, and procedures such that, in the event of a serious and unplanned interruption of their business, they can continue to comply with their obligations arising from their supervisory status and protect the interests and rights of their clients.

An adapted business continuity policy is a necessary instrument in this regard to achieve these objectives.

It is foreseeable that the theme of business continuity is also appearing on the agenda of international consultation forums and regulators, which could lead to harmonized rules in the future. This does not prevent Belgian financial institutions from already working on their business continuity policy and taking measures to complete or improve their organization in this regard.

This circular lists a number of criteria – translated as prudent business practices – by means of which the CBFA will assess the business continuity policy of the financial institutions under its supervision.

¹ Hereinafter, "investment firms" means the investment firms referred to in Article 47 of the Law of 6 April 1995, as well as investment advisory companies (Article 119 of the Law of 6 April 1995) and derivatives specialists (Article 45, 10°, of the Law of 6 April 1995 and the Royal Decree of 28 January 2004). ² See Article 20 of the Law of 22 March 1993 (credit institutions), Article 14bis of the Law of 9 July 1975 (insurance undertakings), Articles 62 and 124 of the Law of 6 April 1995 (investment firms, investment advisory companies) and Article 9 of the Royal Decree of 28 January 2004 (derivatives specialists). For the management companies of collective investment schemes, see Article 153, §1, of the Law of 20 July 2004 concerning certain forms of collective management of investment portfolios.

In this circular, the following terms are understood as:

Business continuity: the objective of ensuring that services and activities proceed uninterrupted under all circumstances;

Business continuity policy: the establishment of a strategy regarding business continuity and an implementation policy aimed at taking all reasonable measures to ensure business continuity;

Business continuity planning: the planning and preparation process that – in implementation of the business continuity policy – results in a business continuity plan;

Business continuity plan, abbreviated "BCP": a collection of procedures and documentation that are developed and brought together into a coherent whole and made available in the event of an unplanned interruption.

2. Scope of Application

2.1. Ratione personae

The prudent business practices apply to credit institutions, insurance undertakings, investment firms, and management companies of collective investment schemes under Belgian law. They also apply to the Belgian branches of credit institutions, insurance undertakings, investment firms, and management companies of collective investment schemes, which fall under the law of a state that is not a member of the European Union.

For companies that are part of a group, the group dimension can play an important role in the concrete implementation of their business continuity policy. The company must demonstrate in such cases that the group-wide organization does not detract from the soundness of its business continuity policy.

The prudent business practices are relevant for both large and small institutions, although the consequences of interruptions can vary greatly for each business. Therefore, each institution must translate its specific characteristics into an appropriate and proportionate business continuity policy, including regarding objectives, planning, and the resources deployed to ensure this.

The CBFA expects institutions that are considered by the Committee for Financial Stability ("CFS") as critical for the proper functioning of the Belgian financial system (payment systems, clearing, and settlement) to also implement the specific CFS recommendations.

2.2. Ratione materiae

The prudent business practices address serious unplanned interruptions of the business resulting from, among other things, computer failures, computer viruses, and cybercrime, accidents, extensive social unrest, bomb alerts, fraud, sabotage, terrorism, natural disasters, as well as the failure of utilities (telecommunications, electricity, natural gas, water,...).

Acts of war and simultaneous terrorist attacks targeting the company at multiple remote locations, as well as the rapid, large-scale spread of infectious deadly diseases, fall outside the scope of application. Also excluded are interruptions of services and activities that the company itself has planned and communicated to clients, users, or other interested parties (for example, due to relocation, maintenance work on its infrastructure).

Without prejudice to the specific characteristics of each company, business continuity planning takes into account scenarios such as:

• the total or partial destruction and/or unavailability of business premises;
• the unavailability of:
  • critical business functions and systems;
  • persons who have effective control of the company;
  • critical know-how and personnel playing a key role;
• the loss or damage of data;
• damage to or failure of important infrastructure (IT, transport,...) or utilities;
• the loss of important counterparties and service providers.

The following elements are, where applicable, included in the planning:

• central and decentralized business units, as well as foreign establishments that are critically important for the operation of the Belgian establishment, or vice versa;
• support functions;
• central and decentralized ICT systems, databases, and software;
• telecommunication and data communication channels, with special attention to connections with financial markets, multilateral trading facilities, central counterparties, clearing and settlement institutions, important counterparties, and distribution networks;
• services outsourced to third-party service providers.

3. Establishment of a Business Continuity Policy by the Institution

Every institution has an adapted strategy and policy regarding its business continuity. Taking into account the nature, scale, and complexity of its business, it must set up its organization such that, in the event of a serious and unplanned interruption of the business, it can maintain or restore its critical business functions as soon as possible and resume its normal services and activities within a reasonable timeframe.

The senior management of the institution (usually the board of directors) approves this strategy and the guidelines of the business continuity policy and ensures that the persons responsible for executive management take the necessary steps to further develop and apply it.

Periodically and at least once a year, the executive management reports to the senior management on business continuity in general and on the operation and effectiveness of business continuity planning and the BCP in particular. If necessary, one member of the executive management is responsible for coordination and reporting.

The strategy and guidelines of the policy relate, among other things, to:

• raising awareness at all levels of the company regarding the importance of business continuity and the BCP;
• identifying core services and critical business units, functions, and systems;
• determining the maximum duration the institution accepts to make its critical business units, functions, and systems available again after an unplanned interruption;
• establishing the acceptable reduction in services to third parties and the time horizon for resuming normal services and business activities after an unplanned interruption;
• determining responsibilities and reporting lines regarding business continuity;
• applying preventive and risk-reducing measures;
• allocating budget and resources.

The internal audit function includes the operation and application of the company's business continuity policy and BCP in its audit planning and activities and evaluates them. To this end, appropriate audit programs and techniques are deployed.

4. Implementation of the Business Continuity Policy

4.1. Analysis of Discontinuity Risks and Vulnerability of the Company

Based on the principles discussed above, the institution analyzes the discontinuity risks and the various scenarios applicable to the company. Whenever possible, the consequences of the realization of identified risks and scenarios regarding clients, counterparties, markets, personnel, internal services, the financial situation, or the reputation of the institution are quantified in a business impact analysis.

4.2. Development of Continuity and Recovery Measures

The institution develops – in function of the established strategy and guidelines as referred to in point 3 – detailed business continuity measures to achieve the desired objectives.

The BCP is the concrete result of this and thus includes the measures, procedures, and information, etc., necessary to mitigate and manage the consequences of a serious and unplanned interruption.

The BCP, which usually consists of several sub-plans, must be sufficiently detailed and user-friendly in light of the nature, scale, and complexity of the business, be communicated to the relevant employees, and be maintained at various locations, including places not described as critical.

The BCP contains the following components:

(a) Crisis management: decision-making structures (e.g., crisis management committee) and procedures that come into effect in the event of serious unplanned interruptions, indicating all persons involved in them and their respective responsibilities, reporting, and priorities.

(b) Communication: procedures and respective responsibilities for communication with personnel, supervisors (CBFA, NBB,...), media, markets, important counterparties, and clients.

(c) Recovery of critical documentation: preservation or recovery of all critical documents and contracts by means of copying, scanning, storage at other locations (with possible remote access, if applicable),... This naturally also applies to the BCP and to agreements and service level agreements with service providers that must intervene in the event of an interruption, as well as for necessary procedure manuals, ICT licenses, and manuals.

(d) Human resources and equipment: without prejudice to the implementation of applicable measures to appropriately protect personnel in the event of a disaster, establishing how critical personnel can be brought to agreed locations and function there (offices, equipment, and supplies,...). This may also include the use of interim staff or external specialists.

(e) Recovery of critical business functions: procedures for the various business functions and processes that must be maintained or restored in the event of an interruption in accordance with the requirements established in this regard (see point 3). This planning can, due to its simplicity, clarity, and structure (checklists, step-by-step procedures), also be understood and executed by persons who do not necessarily possess all expertise in this regard. Account is also taken of possible interweaving of business activities, critical nodes (so-called single points of failure), and dependence on other internal or external parties. It may also be advisable to provide for manual procedures in case the company's ICT support is unavailable.

If the nature, scale, and complexity of the activity require it, the institution must have the possibility to relocate to one or more remote backup centers (for the characteristics of a backup center and the distance relative to the business center, see – mutatis mutandis – point (f) and Annex 1);

(f) Information and Telecommunication Technology ("ICT"): procedures indicating when, where, how, and in what order critical ICT systems and files are restored or recreated in the event of loss, damage, or destruction. Given that the presence of critical employees during an unplanned interruption cannot be guaranteed, these procedures are designed such that they can also be executed by other, possibly less experienced, persons.

If the nature, scale, and complexity of the business require it, the plan provides for the equipment of one or more secure remote backup centers for critical ICT systems with the following characteristics:

i. a backup center is located at a significant geographical distance from the company's ICT business center; the distance is justified based on an objective risk analysis with attention to the criteria included in Annex 1;
ii. sufficient space for hardware and personnel;
iii. availability of equipment, files, software, and information necessary to achieve ICT recovery within the established requirements;
iv. availability of necessary ICT peripheral equipment such as cooling systems, power supply, monitoring systems,...;
v. availability of adapted telecommunications and utilities that are duplicated from those used by the company's ICT business center;
vi. physical and ICT security measures must be sufficiently maintained during the interruption and in the recovery phase.

4.3. Testing, Evaluation, and Adjustment

(a) Testing
The effectiveness of the BCP and its components, particularly the remote backup centers, is assessed using appropriate tests whose content, depth, and frequency are proportional to their importance, variability, and complexity.

Important and complex plans, whose actions and reflexes require much practice, are tested at least once a year. Higher frequencies may apply to components of plans that are critically important.

These tests also aim to sharpen personnel readiness and raise awareness of the importance of business continuity within the institution, enabling personnel to learn and perform the tasks assigned to them during a serious unplanned interruption.

The tests have sufficient relevance regarding the tested hypotheses and scenarios, including regarding conditions and activity volumes.

The tests and results are documented, analyzed, and lead to adjustments of the business continuity policy and BCP where necessary.

(b) Changes
Significant changes that the institution makes to its organization, services, activity programs, and ICT are grounds for examining the appropriateness of existing business continuity provisions and the BCP and, if necessary, adjusting them in accordance with the rules described above.
The relevant critical business units and functions are responsible for regularly reviewing their continuity provisions and detailed procedures to adjust them to changes occurring in their operation (personnel, communication means, systems,...).

5. Involvement of External Service Providers

The institution that relies on external service providers for parts of business continuity takes all reasonable steps to ensure that the agreed services are available when needed, for example by ensuring an appropriate geographical distance of the backup centers from the business centers (see Annex 1), or by including capacity guarantees in the outsourcing agreement. Indeed, a strong sectoral concentration of reliance on the same service provider can jeopardize the quality and availability of its services in the event of disasters.

For this and other concerns in the event of outsourcing, see also the CBFA circular on prudent business practices in outsourcing.³

³ For credit institutions and investment firms, see circular PPB 2004/5 of 22 June 2004.

6. Evaluation of Existing Business Continuity Policy, Planning, and Target Dates.

The CBFA expects institutions to evaluate their business continuity policy by the end of 2005 in light of the prudent business practices mentioned in this circular and determine which measures, if any, are taken, and within what timeframe, to adjust their organization in this regard.

The technical implementation and realization of certain aspects of the business continuity plan may require significant organizational interventions or implementation timelines (e.g., equipping backup centers). The institutions concerned will draw up a program to achieve their objectives within a reasonable timeframe – to be assessed in light of the nature, scale, and complexity of their business. If this program involves timelines that exceed the end of 2007, this must be discussed with the CBFA. Otherwise, such a spread of implementation does not prevent the CBFA from assessing the business continuity policy as a whole based on the management practices contained herein.

Annex 1

Criteria for Determining the Minimum Distance Between ICT Centers and Backup Centers

Given the wide variety of risk profiles, each financial institution must evaluate its own risks and, on this basis, determine the appropriate minimum distance between its ICT center and its backup center for critical ICT systems. At a minimum, the following points must be taken into account:

• the possible destruction of entire data centers and business centers, including the loss of key personnel;
• geological and meteorological hazards (floods, earthquakes, etc.); locating all data centers in the same zone exposed to flooding would, for example, be unacceptable;
• environmental risks (proximity to industrial activities with a high risk profile, airports, embassies, government institutions, and military installations, etc.); for example, a greater distance must be maintained between data centers if one is located near a nuclear power plant or a potential target for terrorist attacks, such as the premises of international institutions; also for data centers located in large agglomerations and zones with dangerous industrial activity, a greater safety distance must be built in view of that risk;
• the possible unavailability of data centers and business buildings due to social unrest, evacuations, security perimeters, destruction, or over-saturation of access roads; care must be taken to avoid that the backup center is only accessible via an access road that is threatened to be blocked when an incident occurs in the primary ICT center;
• damage from a terrorist attack on critical infrastructure or against a critical financial institution or its surroundings;
• damage to the immediate surroundings and to utilities; in this regard, it is essential that ICT and backup centers utilize utilities without "single points of failure" and that they are geographically sufficiently separated so as not to be affected by the same local incident; in rural areas where the network of utilities is less branched and redundant, the minimum safety distance between data centers should be greater than in agglomerations or industrial zones with a widely branched and redundant network.