Article 21 Security requirements and business continuityF1

TIPS DCA holders shall implement adequate security controls to protect their systems from unauthorised access and use. TIPS DCA holders shall be exclusively responsible for the adequate protection of the confidentiality, integrity and availability of their systems.

TIPS DCA holders shall inform the ECB of any security-related incidents in their technical infrastructure and, where appropriate, security-related incidents that occur in the technical infrastructure of the third party providers. The ECB may request further information about the incident and, if necessary, request that the TIPS DCA holders take appropriate measures to prevent a recurrence of such an event.

In the event that a TIPS DCA holder has a problem that prevents it from settling instant payment orders and positive recall answers in TARGET2-ECB, it shall be its responsibility to resolve the problem.

In the event that a TIPS DCA holder unexpectedly submits an abnormally high number of messages, which threaten the stability of the TIPS Platform, and does not, upon request of the ECB, refrain from such behaviour without delay, the ECB may block from the TIPS Platform all further messages submitted by such TIPS DCA holder.

The ECB may impose additional security requirements, in particular with regard to cybersecurity or the prevention of fraud, on all TIPS DCA holders.

TIPS DCA holders using instructing parties in line with Article 7(2) or (3), or allowing access to their TIPS DCA as set out in Article 8(1), shall be deemed to have addressed the risk stemming from such use or access in accordance with the additional security requirements imposed upon them.