DORA Article 61: Obligations, Deadlines & Penalties

A CSD shall identify sources of operational risk, both internal and external, and minimise their impact through the deployment of appropriate ICT tools, processes and policies set up and managed in accordance with Regulation (EU) 2022/2554. Regulation (EU) 2022/2554, Article 61, Article 61

A CSD shall minimise the impact of operational risks through any other relevant appropriate tools, controls and procedures for other types of operational risk, including for all the securities settlement systems it operates. Regulation (EU) 2022/2554, Article 61, Article 61

For services that it provides as well as for each securities settlement system that it operates, a CSD shall establish, implement and maintain an adequate business continuity policy and disaster recovery plan, including ICT business continuity policy and ICT response and recovery plans established in accordance with Regulation (EU) 2022/2554. Regulation (EU) 2022/2554, Article 61, Article 61

The business continuity policy and disaster recovery plan shall ensure the preservation of services, the timely recovery of operations and the fulfilment of the CSD’s obligations in the case of events that pose a significant risk to disrupting operations. Regulation (EU) 2022/2554, Article 61, Article 61

The plan referred to in paragraph 3 shall provide for the recovery of all transactions and participants’ positions at the time of disruption to allow the participants of a CSD to continue to operate with certainty and to complete settlement on the scheduled date. Regulation (EU) 2022/2554, Article 61, Article 61

The plan shall ensure that critical IT systems can resume operations from the time of disruption as provided for in Article 12(5) and (7) of Regulation (EU) 2022/2554. Regulation (EU) 2022/2554, Article 61, Article 61

A CSD shall identify, monitor and manage the risks that key participants in the securities settlement systems it operates, as well as service and utility providers, and other CSDs or other market infrastructures might pose to its operations. Regulation (EU) 2022/2554, Article 61, Article 61

A CSD shall, upon request, provide competent and relevant authorities with information on any such risk identified. Regulation (EU) 2022/2554, Article 61, Article 61

A CSD shall inform the competent authority and relevant authorities without delay of any operational incidents, other than in relation to ICT risk, resulting from such risks. Regulation (EU) 2022/2554, Article 61, Article 61

ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the operational risks referred to in paragraphs 1 and 6, other than ICT risk, and the methods to test, to address or to minimise those risks. Regulation (EU) 2022/2554, Article 61, Article 61