http://www.legislation.gov.uk/eur/2017/571/article/7Commission Delegated Regulation (EU) 2017/571 of 2 June 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to regulatory technical standards on the authorisation, organisational requirements and the publication of transactions for data reporting services providers (Text with EEA relevance)Commission Delegated Regulation (EU) 2017/571Commission Delegated Regulation (EU) 2017/571 of 2 June 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to regulatory technical standards on the authorisation, organisational requirements and the publication of transactions for data reporting services providers (Text with EEA relevance)King's Printer of Acts of Parliamenthttps://webarchive.nationalarchives.gov.uk/eu-exit/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0571-20180206texttext/xmlen2024-07-09Expert Participation2023-07-11Commission Delegated Regulation (EU) 2017/571 of 2 June 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to regulatory technical standards on the authorisation, organisational requirements and the publication of transactions for data reporting services providers (Text with EEA relevance)RegulationFinancial Services and Markets Act 2023Sch. 1 Pt. 3s. 1(4)s. 86(3)CHAPTER IIORGANISATIONAL REQUIREMENTS(Article 64(3), (4) and (5), Article 65(4), (5) and (6), and Article 66(2), (3) and (4) of Directive 2014/65/EU)
Article 7Business continuity and back-up facilities1.

A data reporting services provider shall use systems and facilities that are appropriate and robust enough to ensure continuity and regularity in the performance of the services provided referred to in Directive 2014/65/EU.

2.

A data reporting services provider shall conduct periodic reviews, at least annually, evaluating its technical infrastructures and associated policies and procedures, including business continuity arrangements. A data reporting services provider shall remedy any deficiencies identified during the review.

3.

A data reporting services provider shall have effective business continuity arrangements in place to address disruptive incidents, including:

(a)

the processes which are critical to ensuring the services of the data reporting services provider, including escalation procedures, relevant outsourced activities or dependencies on external providers;

(b)

specific continuity arrangements, covering an adequate range of possible scenarios, in the short and medium term, including system failures, natural disasters, communication disruptions, loss of key staff and inability to use the premises regularly used;

(c)

duplication of hardware components, allowing for failover to a back-up infrastructure, including network connectivity and communication channels;

(d)

back-up of business-critical data and up-to-date information of the necessary contacts, ensuring communication within the data reporting services provider and with clients;

(e)

the procedures for moving to and operating data reporting services from a back-up site;

(f)

the target maximum recovery time for critical functions, which shall be as short as possible and in any case no longer than six hours in the case of approved publication arrangements (APAs) and consolidated tape providers (CTPs) and until the close of business of the next working day in the case of approved reporting mechanisms (ARMs);

(g)

staff training on the operation of the business continuity arrangements, individuals' roles including specific security operations personnel ready to react immediately to a disruption of services;

4.

A data reporting services provider shall set up a programme for periodically testing, reviewing and, where needed, modifying the business continuity arrangements.

5.

A data reporting services provider shall publish on its website and promptly inform the competent authority of its home Member State and its clients of any service interruptions or connection disruptions as well as the time estimated to resume a regular service.

6.

In the case of ARMs, the notifications referred to in paragraph 5 shall also be made to any competent authority to whom the ARM submits transaction reports.