Retail Payment Activities Regulations — 5
ovider, that (i) contains clearly defined policies, processes and procedures for implementing the plan and for escalating the response to an incident, taking into account the incident response procedures of any third-party service provider from which the payment service provider receives services and the need to coordinate its response with that of the third-party service provider, (ii) identifies the measures to be taken to mitigate the impact of an incident, including manual processes or other alternate solutions that the payment service provider could resort to if primary systems relating to the provision of retail payment activities were unavailable, and indicates how quickly those measures could be implemented, (iii) requires the payment service provider, on becoming aware of an incident, to immediately investigate it to determine (A) the incident’s root causes, (B) its possible or verified impact on retail payment activities, (C) its possible or verified impact on end users, (D) its possible or verified impact on other payment service providers or on clearing houses of clearing and settlement systems that are designated under subsection 4(1) of the Payment Clearing and Settlement Act , as those expressions are defined in section 2 of that Act, and (E) its possible or verified impact on systems, data or information involved in the performance of retail payment activities, (iv) requires the payment service provider, while an investigation is underway, to take immediate measures to prevent or mitigate any further damage, including to the integrity, confidentiality or availability of systems, data or information, (v) requires the payment service provider to take measures as soon as feasible to address the identified root causes of the incident, (vi) sets out policies and procedures for reporting incidents to and coordinating incident response with relevant internal stakeholders — including any senior officer referred to in subparagraph (d)(ii) and relevant agents and mandataries — and relevant external stakeholders, that address, among other things, (A) the timing of the reporting and coordination, and (B) the information that is to be reported and shared for the purpose of coordination, (vii) addresses how the payment service provider will promptly identify the status of all transactions at the time of any service reduction, deterioration or breakdown, recover lost or corrupted data and correct any data integrity issues, and (viii) requires the payment service provider to keep, in respect of each incident, a record of (A) the information referred to in clauses (iii)(A) to (E), as determined by the investigation, (B) the measures taken in accordance with subparagraphs (ii), (iv) and (v), (C) the manner in which it reported the incident and coordinated the incident response, and (D) the status of all transactions identified, the manner in which the status of those transactions was identified and the manner in which the payment service provider recovered any lost or corrupted data and corrected any data integrity issues; and (j) set out a plan for responding to anomalous events or lapses referred to in paragraph (h). Proportionality (2) All aspects of the risk management and incident response framework — including all objectives, targets, systems, policies, procedures, processes and controls — must be proportionate to the impact that a reduction, deterioration or breakdown of the payment service provider’s retail payment activities could have on end users and other payment service providers, having regard to factors including the payment service provider’s ubiquity and connectedness, as established using the information referred to in subparagraph 19 (4)(a)(i) or paragraph 19 (4)(b), as the case may be. Third-party service providers (3) If a payment service provider receives services related to a payment function from one or more third-party service providers, the risk management and incident response framework must (a) addres