Business continuity management in banks

MaRisk AT 7.3 asks for an emergency concept for all activities and processes that are critical or important functions. The concept contains business continuity and recovery plans based on plausible scenarios, names responsibilities, targets and measures, and sets the criteria for triggering a plan. The bank updates it every year and after relevant events, and the management board gets a written report on the state of emergency management at least once a quarter.

The concept rests on business impact analyses over a list of all functions. When a critical or important function is outsourced, the bank and the service provider need emergency concepts that fit together. The bank tests the concept regularly, every year for critical or important functions, records the tests and reports the results in writing to those responsible. The text in force since June 30, 2026 is on the BaFin website (in German).

For ICT, the Digital Operational Resilience Act sets the rules. Article 11 asks for an ICT business continuity policy and a business impact analysis of exposures to severe business disruptions. Plans are tested at least once a year and after substantive changes to the ICT systems that support critical or important functions. Except at microenterprises, the tests include cyberattack scenarios and switchovers between the primary ICT infrastructure and the redundant capacity.

Banks also need a crisis management function with procedures for internal and external crisis communication, and on request they give the supervisor an estimate of the aggregated annual costs and losses from major ICT-related incidents. Article 12 covers backups: a documented backup policy, restoration on systems physically and logically segregated from the source system, and recovery time and recovery point objectives for each function. The regulation as a whole is covered on DORA in the EU.

Business continuity management plans for the failure of specific processes, systems or sites and for their recovery. Operational resilience is the wider goal: the bank keeps delivering its critical services within a tolerance for disruption, whatever the cause. The Basel Committee's principles for operational resilience of March 31, 2021 count business continuity planning and testing as one of their parts.

A business impact analysis looks at what happens when an activity or process fails, over graded periods of time. MaRisk asks it to consider the type and size of the tangible and intangible damage and the point in time of the failure. The result decides which functions come back first and how long an outage may last, and it feeds the recovery time objectives under DORA.

At least once a year for critical or important functions, under MaRisk AT 7.3 and DORA Article 11 alike, and again after substantive changes to the ICT systems behind them. MaRisk adds that frequency and scope follow the threat level and that service providers take part. Advanced testing of live systems falls under threat-led penetration testing.