Article 15 Operational risk

A SIPS operator shall establish a robust framework with appropriate systems, policies, procedures and controls to identify, monitor and manage operational risk.

A SIPS operator shall review, audit, and test systems, operational policies, procedures and controls periodically and after significant changes.

A SIPS operator shall establish service level and operational reliability objectives and policies designed to achieve those objectives. It shall review the objectives and policies at least annually.

A SIPS operator shall ensure that a SIPS, at all times, has scalable capacity to handle increases in payment volumes that occur due to stress events, and that it can achieve its service level objectives.

A SIPS operator shall establish comprehensive physical and information security policies that adequately identify, assess and manage all potential vulnerabilities and threats. It shall review the policies at least annually.

A SIPS operator shall establish an effective cyber resilience framework with appropriate governance measures in place to manage cyber risk. The SIPS operator shall identify its critical operations and supporting assets, and have appropriate measures in place to protect them from, detect, respond to and recover from cyber attacks. These measures shall be regularly tested. The SIPS operator shall ensure it has a sound level of situational awareness of cyber threats. The SIPS operator shall ensure that there is a process of continuous learning and evolving to enable it to adapt its cyber resilience framework to the dynamic nature of cyber risks, in a timely manner, whenever needed.

A SIPS operator shall establish a business continuity plan that addresses events posing a significant risk of disrupting the SIPS' operations. The plan shall include the use of a secondary site and be designed to ensure that critical information technology systems can resume operations within two hours of those events. The plan shall be designed in such a way that the SIPS is always able to settle all payments due by the end of the business day on which the disruption occurs. The SIPS operator shall test the plan and review it at least annually.

A SIPS operator shall identify critical participants based, in particular, on payment volumes and values and their potential impact on other participants and the SIPS as a whole, in the event of a significant operational problem experienced by such participants.

A SIPS operator shall identify, monitor, and manage the risks that critical participants, other FMIs, and service and utility providers might pose to the SIPS' operations.