17.3	An FMI should have clearly defined operational reliability objectives and should have policies in place that are designed to achieve those objectives.
APEX Clear has in place the following policies and controls to ensure operational reliability: (i) IT incident management and response plan that categorises incidents by severity and specifies the recovery time objectives for APEX Clear’s critical systems. (ii) IT System Change Management Policy is established to ensure that all changes are analysed, recorded, tested and approved to minimize the potential impacts to existing systems. (iii) IT problem management, root cause analysis and tracking mechanisms are in place to mitigate the risks of recurring incidents and ultimately reduce the likelihood and impact of any disruptions or service downtime. (iv) APEX Clear establishes the operating model with tiered roles for IT operations. The first-line support staff focus on system monitoring, issue identification, prompt handling and escalation. The second-line technical specialists focus on problem diagnosis, root cause analysis and ultimate solutions. (v) APEX Clear has two geographically separated data centres provided by two different vendors, which are certified as Tier 3 and Tier 4 respectively with stringent access controls and real-time environment monitoring. The power supply, network service and other core facilities are redundantly deployed to prevent single points of failure. (vi) Our core systems (e.g. Clearing System) are industry proven solutions with high- availability design. Rigorous tests including UAT, stress test, destructive test and industry-wide test were conducted before system go-live. Core systems are redundantly deployed at two data centres in hot-hot mode, with real-time data synchronization via high-speed dedicated lines. When primary data centre is disrupted, Disaster Recovery (“DR”) data centre can take over almost immediately from IT infrastructure perspective. (vii) Storage Area Network and tape drives are established. Regular backup is performed for core systems and data. Offsite storage is in place. Disaster Recovery Plan is developed and tested together with market participants on an annual basis.
17.4	An FMI should ensure that it has scalable capacity adequate to handle increasing stress volumes and to achieve its service-level objectives.
APEX Clear has established an IT System Capacity Management Policy to ensure adequate scalable capacity to handle increasing stress volumes and to achieve our service level objectives. APEX Clear performs capacity assessment for every new system or significant changes to existing system, in addition to the regular annual review of IT system capacity planning. Prior to the IT system acquisition, a thorough projected five-year volume assessment is performed based on the nature of its intended operations, industry status quo and trends, experience in China as well as international markets. The estimated maximum capacity and threshold for IT systems was then set to ensure that adequate resources are in place to cater for peak volume. The key considerations for capacity management are: (i) Stress testing: Stringent stress testing shall be performed before deployment of IT devices and applications, so as to ensure that the IT resource is able to fulfil the capacity requirements.