FMI Standard 17B: Critical service providers

Introduction

Application 

i. This standard applies to every operator of a designated FMI was specified in its designation notice under section 29(2)(f) of the Financial Market Infrastructures Act 2021 (the Act) as falling within one or more of the following classes of designated FMIs:

(a) a pure payment system; or

(b) a central securities depository; or

(c) a securities settlement system; or 

(d) central counterparty.

Legal powers

ii. Under section 8 of the Act the regulator is defined as the RBNZ and the FMA acting jointly (or the RBNZ acting on its own in relation to pure payment systems).

iii. Section 12 of the Act provides the regulator's functions. These include regulating designated FMIs, dealing with designated FMIs that are distressed, and other functions under the Act.

iv. Subject to certain statutory prerequisites, section 31 of the Act allows the regulator to make standards for designated FMIs.

v. Section 34 sets out the matters that standards may deal with or otherwise relate to. Section 34(1)(b) provides that the regulator may make standards that deal with, or otherwise relate to, the relationship between operators and persons who provide services to those operators for the purposes of designated FMIs. 

Interpretation

vi. The words and phrases used in this standard have the same meaning as in the Act. 

vii. Critical service provider means a person or entity that provides critical services to the operator of an FMI.

viii. Critical services means services that are necessary for an FMI to provide essential services without material disruption.

ix. Essential services means:

(a) for services provided by designated FMIs which are assessed as systemically important by the regulator under section 24 of the Act, all services contributing to the assessment that an FMI is systemically important; and 

(b) for services provided by designated FMIs that are not assessed as systemically important under section 24 of the Act, any services covered by the protections in subpart 5 of Part 3 of the Act. 

Commencement

x. This standard comes into force on 1 March 2024.

Requirements

1) An operator must take all reasonable steps to ensure the continued provision of critical services by managing the relationship with its critical service providers.

2) Further to the requirements in clause (1), an operator must take reasonable steps to ensure that a FMI’s critical service provider:a) identifies and manages relevant operational and financial risks to the provider’s ability to provide critical services to the FMI. This includes ensuring that:

i) the provider implements and maintains appropriate policies and procedures for the continued provision of critical services; and

ii) the provider has effective risk management processes; and

iii) the provider’s critical services are available, reliable, and resilient; and

iv) the provider has robust business continuity management plans and disaster recovery plans to support the timely resumption of its critical services in the event of an outage, so that the provider fulfils the terms of its agreement with the operator or FMI, as appropriate; and

b) devotes sufficient resources to ensuring the confidentiality and integrity of information relating to the operator and the FMI; and

c) has in place robust methods to plan for the entire lifecycle of the use of its technologies and the selection of technological standards; and

d) provides the operator with sufficient information to enable the operator to clearly understand the provider’s roles and responsibilities in managing risks related to the FMI’s use of the provider. 

3) An operator must identify the FMI’s critical service providers and disclose the FMI’s dependency on those providers to the regulator and, where appropriate, its participants.

See Guidance for Standard 17B: ‘Critical Service Providers’, in Guidance for the FMI Standards (PDF, 925KB) for more detail.