Chapter III, Section I, Article 17 · Commission Delegated Regulation (EU) 2026/255

Contents

Article 17Business continuity and back-up facilities#

1.IIPs and RRMs shall ensure that they have sufficient staff, infrastructure, capital and financial resources to guarantee the continuity and regularity in the performance of their respective services, as well as the adequate protection of the IIP or RRM against operational, legal and business risks.

2.Upon registering new IIP clients, IIPs shall provide the clients with instructions on the use of back-up facilities and shall subsequently issue periodic reminders to them throughout the duration of the IIP services provided.

3.IIPs and RRMs shall have in place robust operational risk controls and procedures to secure the availability of adequate resources and back-up facilities. Such controls and procedures shall be documented within an operational risk policy or an operational risk framework which ensures that disruptions to the provided services are minimised. Such policy or framework shall include the following:

(a)a version control system to track and archive any changes made to the IIPs’ and RRMs’ software;

(b)a quality assurance policy ensuring that all changes to the hardware and software architecture of the IIPs and RRMs are tracked;

(c)automated monitoring and alert systems to track the availability of all system components and services, providing immediate notifications to the IIP clients and RRM clients regarding any service disruptions;

(d)redundancy of hardware components and network infrastructure, allowing failover to backup systems, including:

(i)for IIPs, procedures to ensure that any planned maintenance of the IIP services is performed with minimal or no disruptions of the service, making use of duplication and redundancy of hardware and software components;

(ii)for RRMs, procedures for minimal disruption during planned maintenance, with maintenance windows scheduled during periods of low activity;

(e)the conduct of periodic reviews, at least annually, evaluating the IIPs’ and RRMs’ technical infrastructures and associated policies and procedures, including business continuity arrangements and, for IIPs, information security arrangements;

(f)comprehensive data back-up measures ensuring no data losses, including retention of data reported to the Agency in the last five years after the termination of the corresponding event for IIPs and five years for RRMs;

(g)effective business continuity arrangements addressing unplanned events, including the following:

(i)arrangements for the continuity of the processes which are critical to ensuring the effectiveness of data reporting services, including escalation procedures, relevant outsourced activities or dependencies on external providers, which as regards an IIPs back-up infrastructure, may include contractual arrangement with another IIP authorised by the Agency where IIP clients will be redirected for the disclosure of their information in case of an incident, at no additional cost for the IIP client;

(ii)specific continuity arrangements, covering an adequate range of possible scenarios, in the short and medium term, including system failures, natural disasters, communication disruptions, loss of key staff and inability to use the premises regularly used;

(iii)the establishment of failover and fallback procedures that specify the redirection of IIP clients for the disclosure of their information to back-up IIP facilities;

(iv)the establishment of a target maximum recovery time for critical functions;

(v)the provision of obligatory staff trainings on the operation of business continuity;

(vi)the identification of key personnel responsible for business continuity, including the identification of personnel responsible for immediate reaction to a disruption of services.

4.Applicants may demonstrate compliance with any of the requirements referred to in paragraph 3 through submission to the Agency of a valid ISO/IEC 27000 standard series certificate on information security management systems or equivalent certifications. The Agency may ask the applicants for further clarifications regarding the certification provided, any missing information to demonstrate compliance with the requirements referred to in paragraph 3 and for an update of such certification after its expiration date.

5.IIPs and RRMs shall ensure that any deficiencies identified during the review referred to in paragraph 3, point (e), are remedied.

6.IIPs shall make available to the public all information related to the alternative means of disclosure that their IIP clients can use in case of a downtime of the platform. When planned maintenance may result in disruptions, it shall be planned for time windows where minimal activity is foreseen.

7.IIP services related to the disclosure and publication of information and submission of inside information reports shall be available at least 99,5 % of the time. The same applies where IIP services or parts thereof are outsourced to external providers.

8.In the circumstance where IIP clients have been notified by the IIP of planned maintenance or unplanned downtime or other disruption in accordance with Article 18, or the IIP clients themselves notice that, exceptionally, neither the IIP nor its back-up facilities are in operation, the IIP clients may decide whether to disclose on their website the information they would have disclosed on the IIP, or to rely on another IIP for prompt disclosure, until the IIP or its back-up facilities are restored.

9.IIPs shall publish on their platform the information disclosed by their IIP clients in accordance with paragraph 8 as soon as it is technically possible after the restoration of the services.