The Board of Governors of the US Federal Reserve System has finalised new rules that update risk management and business continuity requirements for certain systemically important financial market utilities (FMUs) that are supervised by the Board.
FMUs provide essential infrastructure to clear and settle payments and other financial transactions to allow financial markets and the broader economy to function effectively.
The new rules update existing rules which were established in 2014 and have been revised due to subsequent developments in the regulatory, technological, and threat landscapes.
Updates include areas such as:
Review and testing of operational risk management measures: the updates provide more clarity on this area, including when reviews should take place and what should trigger reviews, as well as confirming a duty to remediate deficiencies identified during testing.
Incident notifications: a new incident notification requirement is implemented where a designated FMU will need to notify affected participants immediately ‘in the event of actual disruptions or material degradation to its critical operations or services or to its ability to fulfill its obligations on time’.
Business continuity: updates have been made to terminology related to required backup sites. References to a ‘secondary site’ and ‘primary site’ are being replaced with a general reference to two sites providing for sufficient redundancy supporting critical operations and services that are located at a sufficient geographical distance from each other to have a distinct risk profile. Additionally, a technical amendment clarifies that the current two-hour recovery time objective applies to critical operations and services.
Third party risk management: recognising the importance of supply chain risk, new third party risk management requirements have been introduced.
The new rules also add a definition of operational risk as a ‘defined term’. Operational risk is defined as ‘the risk that deficiencies in information systems or internal processes, human errors, management failures, or disruptions from external events will result in the reduction, deterioration, or breakdown of services provided by the designated financial market utility’.
FMUs subject to the rule must be in compliance with certain updates by 90 days and all updates by 180 days after publication in the Federal Register.
