Submission of results of information and communication technology operational resilience testing or comparable exercises

8 July 2026
Ref.: 2607037

Circular no.: 24/2026
To: Central securities depositories

Subject: Submission of results of information and communication technology operational resilience testing or comparable exercises

The Financial Supervisory Authority of the Central Bank of Iceland monitors that the activities of supervised entities are in accordance with laws, regulations, rules or resolutions applicable to the activities and that the activities are otherwise in accordance with sound and healthy business practices, cf. paragraph 1 of Article 8 of Act no. 87/1998 on official supervision of financial activities. According to paragraph 1 of Article 9 of the same Act, the Financial Supervisory Authority shall examine the operations of supervised entities as often as deemed necessary, and they are obliged to provide the Financial Supervisory Authority with information in the manner and as often as it deems necessary.

According to paragraph 9 of Article 11 of Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), cf. Act no. 78/2025 on digital operational resilience for the financial market, central securities depositories shall provide the competent authority with a copy of the results of information and communication technology operational resilience testing or comparable exercises. By this letter, information is requested on the implementation and results of information and communication technology operational resilience testing or comparable exercises at central securities depositories.

The Financial Supervisory Authority requests the aforementioned information and data to assess the digital operational resilience of central securities depositories and their ability to respond to serious operational disruptions and maintain continuous operations.

The information shall cover those tests or exercises that have been carried out on the basis of operational resilience policy, operational resilience and response plans, recovery plans or other comparable measures related to information and communication technology.

The data shall, among other things, account for:

• The scope and objectives of the tests or exercises.

• The date of implementation.

• The participants and responsible parties.

• The systems, services or activities tested.

• The main scenarios used as a basis.

• The results of the tests or exercises.

• Identified weaknesses, shortcomings or gaps.

• Planned or implemented improvements and their status.

A new submission case will be created in the Central Bank's data submission system under the name "Results of information and communication technology operational resilience testing (DORA)".

Central securities depositories shall submit results when they are available or at least once a year:

• Results of information and communication technology operational resilience testing carried out in accordance with DORA.

• Results of other comparable exercises related to operational resilience, recovery or response capability of information and communication technology, as applicable.

• Relevant attachments supporting the results, including summaries, test reports, root cause analyses and improvement plans, as applicable.

If questions arise regarding the inquiry, an inquiry can be sent to olafur.hlynsson@sedlabanki.is.

Yours faithfully,
CENTRAL BANK OF ICELAND

Gísli Óttarsson
Ólafur Hlynsson executive director specialist prudential supervision prudential supervision