A CCP shall conduct a business impact analysis which is designed to identify the business functions which are critical to ensure the services of the CCP. The criticality of these functions to other institutions and functions in the financial infrastructure shall be part of the analysis.

A CCP shall use scenario based risk analysis which is designed to identify how various scenarios affect the risks to its critical business functions.

In assessing risks, a CCP shall take into account dependencies on external providers, including utilities services. A CCP shall take action to manage such dependencies through appropriate contractual and organisational arrangements.

Business impact analysis and scenario analysis shall be kept up to date, shall be reviewed at least on an annual basis and following an incident or significant organisational changes. The analyses shall take into account all relevant developments, including market and technology developments.