Document ID: chunk:federal_register_of_legislation:F2023L01242:body:0:p7
Version: federal_register_of_legislation:F2023L01242
Segment Type: other
Provision Reference: 
Character Range: 17809–21100

entity must:
(a)          define, identify and maintain a register of its critical operations;
(b)          take reasonable steps to minimise the likelihood and impact of disruptions to its critical operations;
(c)          maintain a credible BCP that sets out how it would maintain its critical operations within tolerance levels through disruptions, including disaster recovery planning for critical information assets;[12]
(d)          activate its BCP if needed in the event of a disruption; and
(e)          return to normal operations promptly after a disruption is over.

Critical operations and tolerance levels
35.         Critical operations are processes undertaken by an APRA-regulated entity or its service provider which, if disrupted beyond tolerance levels, would have a material adverse impact on its depositors, policyholders, beneficiaries or other customers, or its role in the financial system.
36.         An APRA-regulated entity must, at a minimum, classify the following business operations as critical operations, unless it can justify otherwise:
(a)          for an ADI: payments, deposit-taking and management, custody, settlements and clearing;
(b)          for an insurer (general, life, private health): claims processing;
(c)          for an RSE licensee: investment management and fund administration; and
(d)          for all APRA-regulated entities: customer enquiries and the systems and infrastructure needed to support critical operations.
37.         APRA may require an APRA-regulated entity, or a class of APRA-regulated entities, to classify a business operation as a critical operation.
38.         For each critical operation, an APRA-regulated entity must establish tolerance levels for:
(a)          the maximum period of time the entity would tolerate a disruption to the operation;
(b)          the maximum extent of data loss the entity would accept as a result of a disruption; and
(c)          minimum service levels the entity would maintain while operating under alternative arrangements during a disruption.
39.         APRA may require an APRA-regulated entity to review and change its tolerance levels for a critical operation. APRA may set tolerance levels for an APRA-regulated entity, or a class of APRA-regulated entities, where it identifies a heightened risk or material weakness.

Business continuity plan
40.         An APRA-regulated entity's BCP must include:
(a)          the register of critical operations and associated tolerance levels;
(b)          triggers to identify a disruption and prompt activation of the plan, and arrangements to direct resources in the event of activation;
(c)          actions it would take to maintain its critical operations within tolerance levels through disruptions;
(d)          an assessment of the execution risks, required resources, preparatory measures, including key internal and external dependencies needed to support the effective implementation of the BCP actions; and
(e)          a communications strategy to support execution of the plan.
41.         An APRA-regulated entity must maintain the capabilities required to execute the BCP, including access to people, resources and technology.[13] An APRA-regulated entity must monitor compliance with its tolerance levels and