Article 21
Operational risk
1.
An application for registration as a trade repository shall contain:
(a)
a detailed description of the resources available and procedures designed to identify and mitigate operational risk and any other material risk to which the applicant is exposed, including a copy of any relevant policies, methodologies, internal procedures and manuals;
(b)
a description of the liquid net assets funded by equity to cover potential general business losses in order to continue providing services as a going concern, and an assessment of the sufficiency of its financial resources with the aim of covering the operation costs of a wind-down or reorganisation of the critical operations and services over at least a six-months period;
(c)
the applicant's business continuity plan and the policy for updating it, including the following:
(i)
all business processes, resources, escalation procedures and related systems which are critical to ensuring the services of the trade repository applicant, including any relevant outsourced service and the trade repository strategy, policy and objectives towards the continuity of these processes;
(ii)
the arrangements in place with other financial market infrastructure providers including other trade repositories;
(iii)
the arrangements to ensure a minimum service level of the critical functions and the expected timing of the completion of the full recovery of those processes;
(iv)
the maximum acceptable recovery time for business processes and systems, having in mind the deadline for reporting to trade repositories as provided for in Article 9(1) of Regulation (EU) No 648/2012 and the volume of data that the trade repository needs to process within that daily period;
(v)
the procedures to deal with incident logging and reviews;
(vi)
testing programme and the results of any tests;
(vii)
the number of alternative technical and operational sites available, their location, the resources when compared with the main site and the business continuity procedures in place in the event that alternate sites need to be used;
(viii)
information on access to a secondary business site to allow staff to ensure continuity of the service if a main office location is not available;
(ix)
plans, procedures and arrangements for handling emergencies and ensuring personnel safety;
(x)
plans, procedures and arrangements for the management of crises, including the coordination of the overall business continuity action and its timely and effective activation within a given recovery time objective;
(xi)
plans, procedures and arrangements to recover the applicant's system, application and infrastructure components within the prescribed recovery time objective;
(d)
a description of the arrangements for ensuring the applicant's trade repository activities in case of disruption and the involvement of trade repository users and other third parties in them.
2.
An application for registration as a trade repository shall contain the procedures to ensure the orderly substitution of the original trade repository where requested by a reporting counterparty, an entity responsible for reporting, or by a third party reporting on behalf of non-reporting counterparties, or where such substitution is the result of a withdrawal of registration, and shall include the procedures for the transfer of data and the redirection of reporting flows to another trade repository.