Opinion of the European Central Bank of 1 November 2005 at the request of Magyar Nemzeti Bank on a draft regulation on the material, technical, security and business continuity requirements for clearing transactions (CON/2005/42)

OPINION OF THE EUROPEAN CENTRAL BANK of 1 November 2005 at the request of Magyar Nemzeti Bank on a draft regulation on the material, technical, security and business continuity requirements for clearing transactions (CON/2005/42)

1. On 20 September 2005 the European Central Bank (ECB) received a request from Magyar Nemzeti Bank for an opinion on a draft regulation on the material, technical, security and business continuity requirements of clearing transactions (hereinafter the ‘draft regulation’).

2. The ECB’s competence to deliver an opinion is based on the second, third, fifth and sixth indents of Article 2(1) of Council Decision 98/415/EC of 29 June 1998 on the consultation of the European Central Bank by national authorities regarding draft legislative provisions , as the draft regulation contains provisions concerning means of payment, Magyar Nemzeti Bank, payment and settlement systems and rules that materially influence the stability of financial institutions and markets. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

3. The draft regulation sets out in detail the different material, technical, security and business continuity requirements that clearing houses for credit institutions have to comply with as a precondition to performing their clearing activities, and also Magyar Nemzeti Bank for operating the payment and settlement system. The ECB welcomes the draft regulation, which is instrumental in order to address Core Principle VII (Security and operational reliability) of the Core Principles for Systemically Important Payment Systems of the Committee on Payment and Settlement Systems of the Bank for International Settlements. Core Principle VII requires a system with a high degree of security and operational reliability and contingency arrangements for the timely completion of daily processing. In January 2001, the ECB’s Governing Council adopted the Core Principles for Systemically Important Payment Systems as the Eurosystem’s oversight standards for such payment systems . Subsequently, in June 2003 the Governing Council adopted an oversight framework for retail payment systems operating in euro . The oversight framework is intended to ensure that retail payment systems do not become vectors of systemic risk or economic malfunctioning in the euro area. The Eurosystem has recently consulted the interested public on an issues paper concerning ‘Payment systems business continuity’ . The following suggestions are inspired by this issues paper, and are conveyed without prejudice to the Eurosystem’s future policies on business continuity arrangements for payment systems.

4. The ECB considers that Section 3(3) of the draft regulation should provide that clearing houses for credit institutions and Magyar Nemzeti Bank must introduce contingency and disaster procedures for critical functions in the event of a total failure of the telecommunication networks. It is also suggested that the business continuity arrangements set out in Section 9 of the draft regulation should require a second processing site. Such second processing site should not depend on the same critical infrastructure components used by the primary site (telecommunications, water supply and electric power).

5. The ECB also recommends that Section 11 of the draft regulation should also clarify that clearing systems need a well-defined business continuity strategy endorsed by senior management. Business continuity plans should envisage a variety of plausible scenarios, including major disasters affecting a wide area. Critical functions should be identified and processes within these functions should be categorised according to their criticality. Furthermore, it should also be specified that the operational staff of both the clearing house and the participants (credit institutions) should be thoroughly trained in the use of the business continuity procedures and the recovery and resumption arrangements. In this context, clearing houses could be required to implement the following measures: • business continuity processes and test results should be subject to an auditors’ security review, and • a periodic update and review of the business continuity arrangements ensuring their effectiveness, and • business continuity arrangements could also consider including crisis management information dissemination.

6. This opinion will be published on the ECB’s website. Done at Frankfurt am Main, 1 November 2005. [signed] The President of the ECB Jean-Claude TRICHET