Document ID: chunk:federal_register_of_legislation:F2024C01108:reg:5:p9
Version: federal_register_of_legislation:F2024C01108
Segment Type: reg
Provision Reference: reg 5 (pt 9/35)
Character Range: 324073–327235

of arrangements
(3) An Operator must undertake a review of its Critical Business Services Arrangements:

(a)        following each material change to its Critical Business Services; and

(b)       at least once every 12 months,

and apply recommended changes to the Critical Business Services Arrangements arising from the review to ensure they comply with subrules (1) and (2).

Documentation of arrangements

(4) An Operator must document:

(a)        its Critical Business Services Arrangements; and

(b)       the scope and results of each review performed in accordance with subrule (3); and

(c)        any changes applied to the Critical Business Services Arrangements as a result of the review or otherwise,

and must maintain that documentation for a period of at least seven years from the later of the date it is created or the date it is last amended.

8A.3.2 Change management for Critical Business Services

(1) An Operator must have adequate arrangements to ensure that its Critical Business Services Arrangements continue to comply with subrule 8A.3.1(1) following the implementation of a new Critical Business Service or of a change to an existing Critical Business Service.

(2) Without limiting subrule (1), the arrangements referred to in that subrule must include arrangements for:

(a)        testing new Critical Business Services or material changes to existing Critical Business Services before implementation; and

(b)       communicating with persons that may be materially impacted by the implementation for the purposes of ensuring those persons are adequately informed about the nature, timing and impact of the implementation a reasonable time before it occurs; and

(c)        ensuring, to the extent reasonably practicable, that persons that may be materially impacted by the implementation are adequately prepared for the implementation before it occurs.

Note: Persons that may be materially impacted by the implementation may include ASIC, Participants, other Operators and the operators of licensed clearing and settlement facilities.

     (3) Without limiting paragraph (2)(b), an Operator must give written notice of the proposed implementation to ASIC a reasonable time before the implementation.

8A.3.3 Outsourcing of Critical Business Services

(1) An Operator that enters into an Outsourcing Arrangement must:
 1.         before entering into the Outsourcing Arrangement, conduct due diligence enquiries for the purposes of ensuring the Service Provider has the ability and capacity to provide the services covered by the Outsourcing Arrangement effectively; and
 2.        ensure that the Outsourcing Arrangement is contained in a documented legally binding agreement between the Operator and the Service Provider that:
        1.          sets out the nature, scope and quality of the services to be provided under the Outsourcing Arrangement; and
        2.        requires the Service Provider to give written notice to the Operator before the Service Provider:
               1.        enters into any arrangement with another person (Sub-Contractor) under which the Sub-Contractor will provide services material