Financial Market Utilities, 60314-60326 [2022-21222]

Agencies

• FEDERAL RESERVE SYSTEM

[Federal Register Volume 87, Number 192 (Wednesday, October 5, 2022)]
[Proposed Rules]
[Pages 60314-60326]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-21222]


========================================================================
Proposed Rules
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains notices to the public of 
the proposed issuance of rules and regulations. The purpose of these 
notices is to give interested persons an opportunity to participate in 
the rule making prior to the adoption of the final rules.

========================================================================


Federal Register / Vol. 87, No. 192 / Wednesday, October 5, 2022 / 
Proposed Rules

[[Page 60314]]



FEDERAL RESERVE SYSTEM

12 CFR Part 234

[Regulation HH; Docket No. R-1782]
RIN No. 7100-AG40


Financial Market Utilities

AGENCY: Board of Governors of the Federal Reserve System.

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: The Board of Governors of the Federal Reserve System (Board) 
is proposing to amend the requirements relating to operational risk 
management in the Board's Regulation HH, which applies to certain 
financial market utilities that have been designated as systemically 
important (designated FMUs) by the Financial Stability Oversight 
Council (FSOC) under Title VIII of the Dodd-Frank Wall Street Reform 
and Consumer Protection Act (the Dodd-Frank Act or Act). The proposal 
would update, refine, and add specificity to the operational risk 
management requirements in Regulation HH to reflect changes in the 
operational risk, technology, and regulatory landscapes in which 
designated FMUs operate since the Board last amended this regulation in 
2014. The proposal would also adopt specific incident-notification 
requirements.

DATES: Comments must be received by December 5, 2022.

ADDRESSES: You may submit comments, identified by Docket No. R-1782 and 
RIN 7100-AG40, by any of the following methods:
     Agency Website: https://www.federalreserve.gov. Follow the 
instructions for submitting comments at https://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm.
     Email: [email protected]. Include docket 
and RIN numbers in the subject line of the message.
     FAX: 202-452-3819 or 202-452-3102.
     Mail: Ann E. Misback, Secretary, Board of Governors of the 
Federal Reserve System, 20th Street and Constitution Avenue NW, 
Washington, DC 20551.
    Instructions: All public comments are available from the Board's 
website at https://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm as submitted. Accordingly, comments will not be edited 
to remove any identifying or contact information. Public comments may 
also be viewed electronically or in paper in Room M-4365A, 2001 C 
Street NW, Washington, DC 20551, between 9:00 a.m. and 5:00 p.m. during 
Federal business weekdays. For security reasons, the Board requires 
that visitors make an appointment to inspect comments. You may do so by 
calling (202) 452-3684. Upon arrival, visitors will be required to 
present valid government-issued photo identification and to submit to 
security screening in order to inspect and photocopy comments. For 
users of TTY-TRS, please call 711 from any telephone, anywhere in the 
United States.

FOR FURTHER INFORMATION CONTACT: Emily Caron, Assistant Director (202-
452-5261) or Kathy Wang, Lead Financial Institution and Policy Analyst 
(202-872-4991), Division of Reserve Bank Operations and Payment 
Systems; or Cody Gaffney, Attorney (202-452-2674), Legal Division. For 
users of TTY-TRS, please call 711 from any telephone, anywhere in the 
United States.

SUPPLEMENTARY INFORMATION:

I. Background

A. Financial Market Utilities

    A financial market utility (FMU) is a person that manages or 
operates a multilateral system for the purpose of transferring, 
clearing, or settling payments, securities, or other financial 
transactions among financial institutions or between financial 
institutions and the person.\1\ FMUs provide essential infrastructure 
to clear and settle payments and other financial transactions. 
Financial institutions, including banking organizations, participate in 
FMUs pursuant to a common set of rules and procedures, technical 
infrastructure, and risk-management framework.
---------------------------------------------------------------------------

    \1\ 12 U.S.C. 5462(6).
---------------------------------------------------------------------------

    If a systemically important FMU fails to perform as expected or 
fails to effectively measure, monitor, and manage its risks, it could 
pose significant risk to its participants and the financial system more 
broadly. For example, the inability of an FMU to complete settlement on 
time could create credit or liquidity problems for its participants or 
other FMUs. An FMU, therefore, should have an appropriate and robust 
risk-management framework, including appropriate policies and 
procedures to measure, monitor, and manage the range of risks that 
arise in or are borne by the FMU.

B. Title VIII of the Dodd-Frank Act

    In recognition of the criticality of FMUs to the stability of the 
financial system, Title VIII of the Dodd-Frank Act (the Dodd-Frank Act 
or Act) established a framework for enhanced supervision of certain 
FMUs. Section 804 of the Dodd-Frank Act states that the FSOC shall 
designate those FMUs that it determines are, or are likely to become, 
systemically important. Such a designation by the FSOC makes an FMU 
subject to the supervisory framework set out in Title VIII of the Act.
    Section 805(a)(1)(A) of the Act requires the Board to prescribe 
risk-management standards governing the operations related to payment, 
clearing, and settlement activities of designated FMUs.\2\ As set out 
in section 805(b) of the Act, the applicable risk-management standards 
must (1) promote robust risk management, (2) promote safety and 
soundness, (3) reduce systemic risks, and (4) support the stability of 
the broader financial system.\3\
---------------------------------------------------------------------------

    \2\ 12 U.S.C. 5464(a)(1). The Act directs the Board to ``tak[e] 
into consideration relevant international standards and existing 
prudential requirements'' when it promulgates these risk-management 
standards. Id. In addition, section 805(a)(2) of the Act grants the 
U.S. Commodity Futures Trading Commission (CFTC) and the U.S. 
Securities and Exchange Commission (SEC) the authority to prescribe 
such risk-management standards for a designated FMU that is, 
respectively, a derivatives clearing organization (DCO) registered 
under section 5b of the Commodity Exchange Act, or a clearing agency 
registered under section 17A of the Securities Exchange Act of 1934. 
12 U.S.C. 5464(a)(2).
    \3\ Further, under section 805(c), the risk-management standards 
may address areas such as (1) risk-management policies and 
procedures, (2) margin and collateral requirements, (3) participant 
or counterparty default policies, (4) the ability to complete timely 
clearing and settlement of financial transactions, (5) capital and 
financial resource requirements for designated FMUs, and (6) other 
areas that are necessary to achieve the objectives and principles 
described above. 12 U.S.C. 5464(c).
---------------------------------------------------------------------------

    A designated FMU is subject to examination by the federal agency 
that

[[Page 60315]]

has primary jurisdiction over the FMU under federal banking, 
securities, or commodity futures laws (the ``Supervisory Agency'').\4\ 
At present, the FSOC has designated eight FMUs as systemically 
important, and the Board is the Supervisory Agency for two of these 
designated FMUs--The Clearing House Payments Company, L.L.C. (on the 
basis of its role as operator of the Clearing House Interbank Payments 
System (CHIPS)) and CLS Bank International.\5\ The risk-management 
standards in the Board's Regulation HH apply to Board-supervised 
designated FMUs.\6\
---------------------------------------------------------------------------

    \4\ The Act's definition of ``Supervisory Agency'' is codified 
at 12 U.S.C. 5462(8). Section 807 of the Act authorizes the 
Supervisory Agencies to examine and take enforcement actions against 
the Supervisory Agencies' respective designated FMUs. The Act also 
describes certain authorities that the Board has with respect to 
designated FMUs for which it is not the Supervisory Agency, such as 
participation in examinations and recommendations on enforcement 
actions. 12 U.S.C. 5466.
    \5\ The SEC is the Supervisory Agency for The Depository Trust 
Company (DTC); Fixed Income Clearing Corporation (FICC); National 
Securities Clearing Corporation (NSCC); and The Options Clearing 
Corporation (OCC). The CFTC is the Supervisory Agency for the 
Chicago Mercantile Exchange, Inc. (CME); and ICE Clear Credit LLC 
(ICC). See U.S. Department of the Treasury, Financial Market Utility 
Designations, https://home.treasury.gov/policy-issues/financial-markets-financial-institutions-and-fiscal-service/fsoc/designations.
    \6\ The risk-management standards in Regulation HH would also 
apply to any designated FMU for which another Federal banking agency 
is the Supervisory Agency. At this time, there are no such 
designated FMUs.
---------------------------------------------------------------------------

C. Regulation HH Risk-Management Standards for Designated FMUs

    Section 234.3 of Regulation HH includes a set of 23 risk-management 
standards addressing governance, transparency, and the various risks 
that can arise in connection with a designated FMU's payment, clearing, 
and settlement activities, including legal, financial, and operational 
risks. These standards are based on and generally consistent with the 
Principles for Financial Market Infrastructures (PFMI).\7\ The 
Regulation HH standards generally employ a flexible, principles-based 
approach. In several cases, however, the Board adopted specific minimum 
requirements that a designated FMU must meet in order to achieve the 
overall objective of a particular standard.
---------------------------------------------------------------------------

    \7\ The PFMI, published by the Committee on Payment and 
Settlement Systems (now the Committee on Payments and Market 
Infrastructures) and the Technical Committee of the International 
Organization of Securities Commissions in April 2012, is widely 
recognized as the most relevant set of international risk-management 
standards for payment, clearing, and settlement systems.
---------------------------------------------------------------------------

1. Operational Risk Management
    Section 234.3(a)(17) of Regulation HH requires that a designated 
FMU manage its operational risks by establishing a robust operational 
risk-management framework that is approved by its board of 
directors.\8\ In this regard, the designated FMU must (1) identify and 
mitigate its plausible sources of operational risk; (2) identify, 
monitor, and manage the operational risks it may pose to other FMUs and 
trade repositories; (3) ensure a high degree of security and 
operational reliability; (4) have adequate, scalable capacity to handle 
increasing stress volumes; (5) address potential and evolving 
vulnerabilities and threats; and (6) provide for rapid recovery and 
timely resumption of critical operations and fulfillment of 
obligations, including in the event of a wide-scale or major 
disruption. Section 234.3(a)(17) also contains several specific minimum 
requirements for business continuity planning, including a requirement 
for the designated FMU to have a business continuity plan that (1) 
incorporates the use of a secondary site at a location with a distinct 
risk profile from the primary site; (2) is designed to enable critical 
systems to recover and resume operations no later than two hours 
following disruptive events; (3) is designed to enable it to complete 
settlement by the end of the day of the disruption, even in case of 
extreme circumstances; and (4) is tested at least annually.
---------------------------------------------------------------------------

    \8\ In this notice, Sec.  234.4(a)(17) will be informally 
referred to as the ``operational risk management standard.''
---------------------------------------------------------------------------

    Although the term ``operational risk'' is not defined in current 
Regulation HH, when the Board proposed amendments to Sec.  234.3(a)(17) 
in 2014, it described operational risk as the risk that deficiencies in 
information systems, internal processes, and personnel or disruptions 
from external events will result in the deterioration or breakdown of 
services provided by an FMU.\9\ Consistent with an all-hazards view of 
managing operational risk, the Board believes operational risk could 
arise internally and externally. Internal sources of operational risk 
include the designated FMU's people, processes, and technology.\10\ 
External sources of operational risk are those that fall outside the 
direct control of a designated FMU. For example, external sources of 
operational risk can include the designated FMU's participants and 
other entities, such as other FMUs, settlement banks, liquidity 
providers, and service providers, which may transmit threats through 
their various connections to the designated FMU. External sources of 
operational risk also include physical events, such as pandemics, 
natural disasters, and other destruction of property, as well as 
information security threats, such as cyberattacks and technology 
supply chain vulnerabilities. These internal and external sources of 
operational risk can manifest in different scenarios (including wide-
scale or major disruptions) and can result in the reduction, 
deterioration, or breakdown of services that a designated FMU provides. 
A designated FMU must plan for these types of scenarios and test its 
systems, polices, procedures, and controls against them.
---------------------------------------------------------------------------

    \9\ 79 FR 3665, 3683 (Jan. 22, 2014). The Board also 
incorporated this definition of ``operational risk'' into part I of 
the Federal Reserve Policy on Payment System Risk (PSR policy) in 
2014, see 79 FR 2838, 2845 (Jan. 16, 2014), and into its ORSOM 
rating system in 2016, see 81 FR 58932, 58936 (Aug. 26, 2016). The 
PSR policy is available at https://www.federalreserve.gov/paymentsystems/files/psr_policy.pdf.
    \10\ Deficiencies in assessing and managing these sources of 
operational risk could cause errors or delays in processing, systems 
outages, insufficient capacity, fraud, data loss, and data leakage.
---------------------------------------------------------------------------

    Importantly, the Board believes that effective operational risk-
management, in combination with sound governance arrangements and 
effective management of general business risk (including the risk of 
losses from operational events), promotes operational resilience, which 
refers to the ability of an FMU to: (1) maintain essential operational 
capabilities under adverse conditions or stress, even if in a degraded 
or debilitated state; and (2) recover to effective operational 
capability in a time frame consistent with the provision of critical 
economic services.\11\
---------------------------------------------------------------------------

    \11\ See Sec.  234.3(a)(2) and (a)(15).
---------------------------------------------------------------------------

2. Evolution in the Operational Risk, Technology, and Regulatory 
Landscape
    When the Board proposed the current Regulation HH risk-management 
standards in 2014, it recognized that there was ongoing work and 
discussion domestically and internationally on developing operational 
risk-management standards and planning for business continuity with 
respect to cybersecurity and responses to cyberattacks.\12\ For 
example, in 2016, the Committee on Payments and Market Infrastructures 
(CPMI) and Technical Committee of the International Organization of 
Securities Commissions (IOSCO) published Guidance on cyber resilience 
for financial market infrastructures (Cyber Guidance), which 
supplements the PFMI and provides guidance on cyber resilience, 
including

[[Page 60316]]

in the context of governance, the comprehensive management of risks, 
and operational risk management.\13\ The Cyber Guidance has informed 
the Federal Reserve's supervision of designated FMUs.\14\
---------------------------------------------------------------------------

    \12\ 79 FR 3665, 3683 (Jan. 22, 2014).
    \13\ CPMI-IOSCO, Guidance on Cyber Resilience for Financial 
Market Infrastructures (June 2016), https://www.bis.org/cpmi/publ/d146.htm.
    \14\ For example, when the Board finalized its ORSOM rating 
system for designated FMUs in 2016, it noted that the then-
forthcoming Cyber Guidance would guide the Board's assessment of a 
designated FMU with respect to operational risk and cybersecurity 
policies and procedures. 81 FR 58932, 58934 (Aug. 26, 2016).
---------------------------------------------------------------------------

    More recently, new challenges to operational risk management have 
emerged, including a global pandemic and severe weather events. In 
addition, certain types of cyberattacks that were once thought to be 
extreme or ``tail-risk'' events, like attacks on the supply chain and 
ransomware attacks, have become more prevalent. Technology solutions 
for the management of operational risk have also advanced since 2014, 
including the development of new technologies that have the potential 
to improve the resilience of designated FMUs. Finally, the legal and 
regulatory landscape in which designated FMUs operate has evolved to 
reflect these changes in the broader operational risk environment. For 
example, in November 2021, the Board, the Office of the Comptroller of 
the Currency (OCC), and the Federal Deposit Insurance Corporation 
(FDIC) adopted requirements on computer-security incident notifications 
for banking organizations and bank service providers (interagency 
notification rule).\15\
---------------------------------------------------------------------------

    \15\ 86 FR 66424 (Nov. 23, 2021). Congress also recently enacted 
the Cyber Incident Reporting for Critical Infrastructure Act of 
2022, which requires covered entities to report significant cyber 
incidents to the Cybersecurity and Infrastructure Agency (``CISA''). 
See H.R. 2471, 117th Cong. (2022).
---------------------------------------------------------------------------

    The evolution in the operational risk, technology, and regulatory 
landscape motivated the Board to conduct a full review of Sec.  
234.3(a)(17) to determine whether updates are necessary. Following this 
review, the Board believes that the outcomes required by the current 
operational risk management standard are generally still relevant and 
comprehensive. However, the Board has identified several areas where it 
believes updates to the rule are necessary.

II. Explanation of Proposed Rule

    The Board is proposing to amend its operational risk management 
standard to reflect changes in the operational risk and threat 
landscape, as well as to incorporate developments in designated FMUs' 
operations and technology usage since the Board last amended Regulation 
HH in 2014. The proposal focuses on four areas: (1) review and testing, 
(2) incident management and notification, (3) business continuity 
management and planning, and (4) third-party risk management. The Board 
is also proposing several technical or clarifying amendments throughout 
Sec. Sec.  234.2 and 234.3(a).\16\
---------------------------------------------------------------------------

    \16\ In addition to the technical changes described below in 
section II.E, the Board is also proposing a technical change to the 
title of Sec.  234.3. Currently, the section is erroneously titled 
``Standards for payment systems,'' which is the legacy title from 
the initial Regulation HH risk-management standards published in 
2012. The Board is proposing to replace ``payment systems'' with 
``designated financial market utilities.''
---------------------------------------------------------------------------

    The Board believes that the proposal continues to employ a 
flexible, principles-based approach in Regulation HH. Further, the 
Board believes the proposed amendments are largely consistent with 
existing measures that designated FMUs take to comply with Regulation 
HH and would create minimal added burden for the designated FMUs that 
are subject to Regulation HH. Accordingly, the Board is proposing that 
the proposed changes would become effective and require compliance 60 
days from the date a final rule is published in the Federal Register.
    The Board requests comment on all aspects of the proposed 
amendments, including the proposed effective and compliance date. In 
addition, the Board requests comment on the specific questions below. 
Where possible, commenters should provide both quantitative data and 
detailed analysis in their comments, particularly with respect to 
suggested alternatives to the proposed amendments. Commenters should 
also explain the rationale for their suggestions.

A. Review and Testing

    Currently, Sec.  234.3(a)(17)(i) requires designated FMUs to 
identify the plausible sources of operational risk, both internal and 
external, and mitigate their impact through the use of appropriate 
systems, policies, procedures, and controls that are reviewed, audited, 
and tested periodically and after major changes. This general review 
and testing requirement applies broadly to the systems, policies, 
procedures, and controls that the designated FMU develops to mitigate 
sources of operational risk. For example, designated FMUs need to 
design and conduct appropriate tests on any policies or systems that 
they develop to ensure a high degree of security and operational 
reliability (as required by Sec.  234.3(a)(17)(iii)). Similarly, a 
designated FMU needs to review and test any arrangements it sets up to 
achieve its planned business continuity recovery and resumption 
objectives (as required by Sec.  234.3(a)(17)(vii)). This general 
review and testing requirement encompasses all reviews and tests the 
designated FMU performs with respect to such systems, policies, 
procedures, and controls, including those performed by the designated 
FMU's business lines, risk-management function, and audit function. It 
does not, however, prescribe specific types of tests that the 
designated FMU must conduct.
    The Board is proposing amendments to the general review and testing 
requirement that would provide more specificity regarding its 
expectations. Proposed Sec.  234.3(a)(17)(i) would emphasize that, just 
as the current general review and testing requirement applies broadly 
to the designated FMU's systems, policies, procedures, and controls, 
the proposal's requirements would also apply broadly to the systems, 
policies, procedures, and controls developed to mitigate the impact of 
the designated FMU's sources of operational risk.
1. Testing
    Proposed Sec.  234.3(a)(17)(i)(A)(1) would require a designated FMU 
to conduct tests of its systems, policies, procedures, and controls in 
accordance with a documented testing framework. The documented testing 
framework would need to address, at a minimum, the scope and frequency 
of such testing, who participates in such testing, and how the results 
of such testing will be reported. The testing framework would also need 
to account for any interdependencies between and among the systems, 
policies, procedures, and controls that are being tested.\17\ A 
designated FMU could describe its testing framework in either a single 
document or in multiple documents, as appropriate, and could leverage 
relevant industry standards as it develops its testing framework.\18\
---------------------------------------------------------------------------

    \17\ The proposal emphasizes the need for a designated FMU to 
take a comprehensive and risk-based approach to its operational risk 
management testing program, rather than focusing only on testing 
individual (or groups of) systems, policies, procedures, or controls 
(or components therein).
    \18\ For example, a designated FMU could leverage standards 
developed by the National Institute of Standards and Technology 
(NIST) and the Federal Financial Institutions Examination Council 
(FFIEC).
---------------------------------------------------------------------------

    Proposed Sec.  234.3(a)(17)(i)(A)(2) would require that the tests 
that a designated FMU conducts assess whether its systems, policies, 
procedures, or controls function as intended. Such tests could include 
capacity stress tests,

[[Page 60317]]

crisis management tabletop exercises, after-action reviews of 
incidents, business continuity tests both internally and with 
participants, vulnerability assessments, cyber scenario-based testing, 
penetration tests, and red team tests. Importantly, as described 
further below, a designated FMU would need to remediate any 
deficiencies identified during testing.
2. Review Scope
    Proposed Sec.  234.3(a)(17)(i)(B) would require a designated FMU to 
conduct a review of the design, implementation, and testing of relevant 
systems, policies, procedures, and controls after the designated FMU 
experiences any material operational incidents (which are discussed in 
section II.B.2 below). A designated FMU would also need to conduct such 
a review after significant changes to the environment in which it 
operates.\19\
---------------------------------------------------------------------------

    \19\ The Board is also proposing a technical amendment to the 
requirement for the designated FMU to review its recovery and 
orderly wind-down plan under Sec.  234.3(a)(3)(iii)(G) from 
``following'' to ``after'' changes to the designated FMU's systems 
and environment. This conforms with the review requirement under 
proposed Sec.  234.3(a)(17)(i)(B). The Board is also proposing a 
technical amendment to the requirement for the designated FMU to 
update its public disclosure under Sec.  234.3(a)(23)(v) from 
``following'' to ``to reflect'' changes to its systems and 
environment.
---------------------------------------------------------------------------

    The operational risk environment, including sources of risk and the 
nature or types of threats, can change unexpectedly and quickly. The 
proposal would ensure that designated FMUs review and make timely 
changes to their systems, policies, procedures, and controls following 
such changes. For example, the COVID-19 global pandemic highlighted new 
risks and challenges in the operational risk environment that warrant a 
review of relevant systems, policies, procedures, and controls.
3. Remediation of Identified Deficiencies
    Finally, proposed Sec.  234.3(a)(17)(i)(C) would require a 
designated FMU to remediate as soon as possible, following established 
governance processes, any deficiencies identified during tests and 
reviews. A designated FMU would need to assess whether such identified 
deficiencies require urgent remediation or are less urgent. In order to 
ensure that remediation measures are effective, it would be imperative 
for a designated FMU to perform subsequent validation to assess whether 
the remediation measures have addressed deficiencies without 
introducing new vulnerabilities.
    A designated FMU should consult widely used and relevant industry 
standards to inform its understanding of how it should remediate any 
deficiencies. These industry standards, such as those published by the 
National Institute of Standards and Technology (NIST), the Federal 
Financial Institutions Examination Council (FFIEC), the Financial 
Services Sector Coordinating Council (FSSCC), and the International 
Organization for Standardization (ISO), are updated regularly and 
typically offer current and specific information on operational risk 
management practices.
4. Questions
    With respect to proposed Sec.  234.3(a)(17)(i)(A)-(C), the Board 
requests comment on the following specific questions:
    1. Are the elements listed in Sec.  234.3(a)(17)(i)(A)(1) the right 
elements to include by rule in the testing framework? What other 
elements should be addressed in a rule for a testing framework?
    2. Are there challenges associated with implementation of these 
proposed requirements that the Board has not considered?

B. Incident Management and Notification

    The Board is proposing to establish incident management and 
notification requirements in proposed Sec.  234.3(a)(17)(vi).
1. Documented Incident Management Framework
    Proposed Sec.  234.3(a)(17)(vi) would require a designated FMU to 
establish a documented framework for incident management that provides 
for the prompt detection, analysis, and escalation of an incident; 
appropriate procedures for addressing an incident; and incorporation of 
lessons learned following an incident.\20\
---------------------------------------------------------------------------

    \20\ These broad categories in incident management are generally 
consistent with those identified in the NIST computer-security 
incident handling guide. See NIST, Computer Security Incident 
Handling Guide (Special Publication 800-61, rev. 2), https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf.
---------------------------------------------------------------------------

    In line with the all-hazards approach to operational risk 
management in this standard, the Board believes it is important for a 
designated FMU to be prepared to detect, address, and learn from any 
type of operational incident, regardless of the scenario or source of 
risk and the level of severity. Different types of incidents may 
require different levels of escalation internally or externally. 
Different types of incidents may also require different strategies for 
containment or eradication. For example, given the increasing 
prevalence of cyberattacks in the financial sector, a designated FMU 
should plan for an incident where a participant (or another type of 
connected entity), rather than the designated FMU itself, is 
experiencing a cyberattack. In this scenario, a designated FMU should 
be operationally prepared to take, and should have a legal basis to 
take, appropriate steps to mitigate the risk of contagion to itself or 
other participants, including but not limited to disconnecting the 
participant from the FMU if necessary. A designated FMU should also 
have processes and procedures to determine whether and when it would be 
appropriate to allow such a participant to reconnect to the FMU.
    The proposal would require that a designated FMU's incident 
management framework include a plan for notification and communication 
of material operational incidents. This plan would, among other things, 
need to identify the entities that would be notified of operational 
incidents, including non-participants that could be affected by 
material operational incidents at the designated FMU and appropriate 
industry information-sharing fora. Proposed Sec.  234.3(a)(17)(vi)(A) 
and (B), which are discussed further in sections II.B.2 and II.B.3, 
would set forth more detailed requirements for notification and 
communication of material incidents to ensure that the Board, the 
designated FMU's participants, and other relevant entities receive 
timely notifications.
2. Incident Notification to the Board
    Proposed Sec.  234.3(a)(17)(vi)(A) would require a designated FMU 
to notify the Board of operational incidents.
    In November 2021, the Board, FDIC, and OCC jointly adopted the 
interagency notification rule for banking organizations and bank 
service providers.\21\ The interagency notification rule scoped out 
designated FMUs, but the preamble to the interagency rule explained 
that the Board believes it is important for designated FMUs to inform 
Federal Reserve supervisors of operational disruptions on a timely 
basis.\22\ The preamble to the interagency rule also noted that the 
Board would consider proposing amendments to Regulation

[[Page 60318]]

HH in the future to formalize its incident-notification expectations 
and promote consistency between requirements applicable to designated 
FMUs that are supervised by the Board, the U.S. Securities and Exchange 
Commission (SEC), and the U.S. Commodity Futures Trading Commission 
(CFTC).\23\
---------------------------------------------------------------------------

    \21\ 86 FR 66424 (Nov. 23, 2021).
    \22\ Id. at 66428 (noting that ``the Board has generally 
observed such practice by designated FMUs'').
    \23\ Id. SEC-supervised designated FMUs are subject to the SEC's 
Regulation SCI, which generally requires covered entities to notify 
the SEC ``immediately'' and their members or participants 
``promptly'' of an SCI event. See 17 CFR 242.1000 (defining ``SCI 
Event'') and 242.1002 (imposing notification requirements related to 
SCI Events). Similarly, a CFTC-supervised designated FMU must notify 
the CFTC ``promptly'' of an ``exceptional event''. See 17 CFR 
39.18(g). An ``exceptional event'' includes ``[a]ny hardware or 
software malfunction, security incident, or targeted threat that 
materially impairs, or creates a significant likelihood of material 
impairment, of automated system operation, reliability, security, or 
capacity; or [a]ny activation of the designated FMU's business 
continuity and disaster recovery plan.'' Id.
---------------------------------------------------------------------------

    Under proposed Sec.  234.3(a)(17)(vi)(A), a designated FMU would be 
required to immediately notify the Board when it activates its business 
continuity plan or has a reasonable basis to conclude that (1) there is 
an actual or likely disruption, or material degradation, to any of its 
critical operations or services,\24\ or to its ability to fulfill its 
obligations on time; or (2) there is unauthorized entry, or the 
potential for unauthorized entry, into the designated FMU's computer, 
network, electronic, technical, automated, or similar systems that 
affects or has the potential to affect its critical operations or 
services. Given the large volume and value of payment, clearing, and 
settlement activity processed by these entities and their 
interconnectedness with financial institutions and markets, material 
operational issues occurring at these designated FMUs could have 
financial stability implications. It is therefore critical for the 
Board to be notified immediately of these types of issues.
---------------------------------------------------------------------------

    \24\ Critical operations and critical services are discussed 
below in section II.E.2.
---------------------------------------------------------------------------

    Importantly, in addition to actual disruptions, material 
degradation, or unauthorized entries, the proposal would also require 
immediate notification to the Board if the designated FMU has a 
reasonable basis to conclude that a disruption or material degradation 
is ``likely'' to occur or if there is ``potential'' for unauthorized 
entry into the designated FMU's computer, network, electronic, 
technical, automated, or similar systems that affects or has the 
potential to affect its critical operations or services. For example, a 
hurricane in the region where the designated FMU is located would not 
alone trigger notification; however, if the designated FMU concludes 
that such an event likely would disrupt or materially degrade its 
critical operations or services, then notification would be required. 
Similarly, in the case of potential unauthorized entries, not all 
identified vulnerabilities in its systems would require an immediate 
notification. However, if a designated FMU discovers or becomes aware 
of an unexploited vulnerability and determines that, if exploited, such 
vulnerability could result in a disruption or material degradation of 
its critical operations or service, the designated FMU would need to 
notify the Board immediately of such discovery.
    The Board notes that ``immediately'' is meant to convey the urgency 
in notifying the Board of these material operational incidents; it does 
not mean ``instantaneous'' notification. The Board would expect to be 
notified of an operational incident once the designated FMU activates 
its business continuity plan or has a reasonable basis to conclude that 
an incident meets any of the criteria in proposed Sec.  
234.3(a)(17)(vi)(A)(1)-(2), even if the designated FMU does not yet 
have detailed information on the root cause or measures for containment 
or remediation. In these cases, the Board would expect to receive any 
available information that the designated FMU has at the time of 
notification.
    The Board recognizes that the requirement for ``immediate'' 
notification to the Board would establish a heightened requirement for 
designated FMUs relative to banking organizations.\25\ The proposed 
requirement is consistent with the systemic importance of designated 
FMUs and with existing SEC and CFTC incident notification requirements 
for the designated FMUs for which either the SEC or the CFTC is the 
Supervisory Agency.
---------------------------------------------------------------------------

    \25\ Under the interagency notification rule, a banking 
organization must notify its primary Federal regulator of certain 
computer-security incidents ``as soon as possible and no later than 
36 hours.'' See 86 FR 66424, 66431-32 (discussing timing of 
notification to agencies).
---------------------------------------------------------------------------

3. Incident Notification to Participants and Other Relevant Entities
    Proposed Sec.  234.3(a)(17)(vi)(B) would require a designated FMU 
to establish criteria and processes, including the appropriate methods 
of communication, to provide for timely communication and responsible 
disclosure of material operational incidents to its participants or 
other relevant entities that have been identified in its notification 
and communication plan.
    As proposed, this incident notification requirement would arise in 
two circumstances. First, a designated FMU would need to notify 
affected participants immediately in the event of actual disruptions or 
material degradation to its critical operations or services or to its 
ability to fulfill its obligations on time.\26\ This immediate 
notification would ensure that affected participants (e.g., 
participants encountering delays or errors) are aware that the issue 
originates from the designated FMU and not their own systems, in order 
to minimize confusion in the markets that the designated FMU serves and 
to allow participants to assess the impact to their operations. The 
term ``immediately'' is meant to convey the urgency in notifying the 
designated FMU's participants of disruptions or material degradation to 
its services; it does not mean ``instantaneous'' notification.
---------------------------------------------------------------------------

    \26\ The requirement for ``immediate'' notification to affected 
participants would establish a heightened requirement for designated 
FMUs relative to those imposed on bank service providers in the 
interagency rule (which requires notification ``as soon as 
possible''), consistent the systemic importance of designated FMUs.
---------------------------------------------------------------------------

    Second, a designated FMU would need to notify all participants and 
other relevant entities \27\ in a timely and responsible manner of all 
other material operational incidents that require immediate 
notification to the Board. When designing this part of its 
communication plan, the Board would expect a designated FMU to consider 
the timing, content, recipients, and method of notification for a range 
of potential material operational incidents. In determining the scope 
of disclosure for a particular incident, the Board would expect a 
designated FMU to consider factors such as the risk-mitigation benefits 
arising from early warning to the financial system, the safety and 
soundness of the designated FMU, and any financial stability 
implications of disclosure. The Board recognizes that there might be 
risks to providing early disclosures to a broad audience regarding 
certain types of material operational issues. For example, if a 
designated FMU identifies a cyber vulnerability, the designated FMU 
might weigh the risk of disclosure as sufficiently great to delay 
notification or tailor the information provided to avoid exposing the 
designated FMU to a cyberattack.
---------------------------------------------------------------------------

    \27\ As described in section II.B.1, above, a designated FMU 
would need to identify non-participant relevant entities in its plan 
for notification and communication of material operational 
incidents.

---------------------------------------------------------------------------

[[Page 60319]]

4. Examples of Material Operational Incidents
    The following is a non-exhaustive list of operational incidents 
that the Board would consider to be material for purposes of the 
proposal. The Board would expect examples 1 and 2 to trigger immediate 
notifications to the Board and to the designated FMU's participants 
(and notification in a timely manner to other relevant entities, as 
applicable). The Board would expect examples 3-5 to trigger immediate 
notification to the Board, but believes the designated FMU should 
determine when they may trigger appropriately timely notifications and 
disclosure to participants and non-participant entities based on the 
criteria in its notification and communication plan.
    (1) Large-scale distributed denial of service attacks that prevent 
the designated FMU from receiving its participants' payment 
instructions.
    (2) A severe weather event or other natural disaster that causes 
significant damage to a designated FMU's production site and 
necessitates failover to another site during the business day.
    (3) Malware on a designated FMU's network that poses an imminent 
threat to its critical operations or services (such as its core 
payment, clearing, or settlement processes, or collateral management 
processes), or that may require the designated FMU to disengage any 
compromised products or information systems that support the designated 
FMU's critical operations and services from internet-based network 
connections.
    (4) A ransom malware attack that encrypts a critical system or 
backup data.
    (5) A zero-day vulnerability on software that the designated FMU 
uses and has determined, if exploited, could lead to a disruption to or 
material degradation of its critical operations or services.
5. Questions
    With respect to proposed Sec.  234.3(a)(17)(vi), the Board requests 
comment on the following specific questions:
    3. Do the requirements under proposed Sec.  234.3(a)(17)(vi)(A) 
strike the proper balance between providing the Board with early 
warning and allowing designated FMUs sufficient time to notify the 
Board?
    4. How should the criteria for determining whether operational 
incidents are material enough to warrant notification to the Board 
under proposed Sec.  234.3(a)(17)(vi)(A) be modified, if at all?
    5. Should the Board provide additional examples of material 
operational incidents?
    6. How should designated FMUs provide notifications to the Board? 
For example, should the Board establish a centralized point of contact 
to receive notifications, or should designated FMUs notify their 
supervisory teams?
    7. Is the proposed requirement on planning for timely notification 
and ``responsible disclosure'' of material operational incidents clear? 
Should a term other than ``responsible'' disclosure be used, given the 
intention of this proposed requirement, as explained in section II.B.3 
above?
    8. Are there challenges associated with implementing these proposed 
requirements that the Board has not considered?

C. Business Continuity Management and Planning

    Current Sec.  234.3(a)(17)(vi) (which, under the proposal, would be 
renumbered as Sec.  234.3(a)(17)(vii)) requires that a designated FMU 
have business continuity management that provides for rapid recovery 
and timely resumption of its critical operations and fulfillment of its 
obligations, including in the event of a wide-scale or major 
disruption. Current Sec.  234.3(a)(17)(vii) (which, under the proposal, 
would be renumbered as Sec.  234.3(a)(17)(viii)) elaborates on certain 
requirements for a designated FMU's business continuity plan. 
Specifically, a business continuity plan must incorporate the use of a 
secondary site with a distinct risk profile from the primary site; be 
designed to enable critical systems to recover and resume operations no 
later than two hours following disruptive events; be designed to 
complete settlement by the end of the day of the disruption, even in 
extreme circumstances; and be tested at least annually.
    The proposed amendments to current Sec.  234.3(a)(17)(vii) would 
provide further detail in Regulation HH related to business continuity 
management and planning in order to promote robust risk management, 
reduce systemic risks, increase safety and soundness, and support the 
stability of the broader financial system.
1. Two Sites Providing for Sufficient Redundancy
    The proposal would amend current Sec.  234.3(a)(17)(vii)(A) to 
update terminology related to required backup sites. Currently, Sec.  
234.3(a)(17)(vii)(A) requires a designated FMU to have a secondary site 
that is located at a sufficient geographical distance from the primary 
site to have a distinct risk profile. The Board proposes to replace the 
references to ``secondary site'' and ``primary site'' with a general 
reference to ``two sites providing for sufficient redundancy supporting 
critical operations and services'' that are located at a sufficient 
geographical distance from ``each other'' to have a distinct risk 
profile (collectively, ``two sites with distinct risk profiles'').
    This proposed amendment would accommodate data center arrangements 
with multiple production sites, rather than reflecting only the 
traditional arrangement where one site is considered ``primary'' and 
another site is treated distinctly as a backup site. The proposal would 
still require, however, a minimum of two locations that are 
sufficiently geographically distant from each other to have a distinct 
risk profile. Consistent with the Board's explanation when it adopted 
the current text of Regulation HH in 2014, the Board would consider 
sites to have ``distinct risk profiles'' if, for example, they are not 
located in areas that would be susceptible to the same severe weather 
event (e.g., the same hurricane zone) or on the same earthquake fault 
line. These sites would likely also have distinct power and telecom 
providers and be operated by geographically dispersed staff.
2. Recovery and Resumption
    Current Sec.  234.3(a)(17)(vi) establishes a broad requirement for 
business continuity management. Current Sec.  234.3(a)(17)(vii)(B)-(C) 
sets specific recovery and resumption objectives, requiring that a 
designated FMU's business continuity plan be designed to enable, 
respectively, recovery and resumption no later than two hours following 
disruptive events and completion of settlement by the end of the day of 
the disruption, even in case of extreme circumstances.
    Under the proposal, these requirements would remain substantively 
unchanged.\28\ Since the Board established these requirements in 
Regulation HH, the two-hour recovery time objective has been a 
particular area of focus during bilateral discussions with Board-
supervised designated FMUs, as well as in broader domestic and 
international fora, specifically in the context of extreme cyber 
events. At the center of those discussions is the balance between 
timely recovery and resumption of critical operations and

[[Page 60320]]

appropriate assurance that critical operations are restored to a 
trusted state. The Board continues to believe it is imperative to 
financial stability that a designated FMU be able to recover and resume 
its critical operations and services quickly after disruptive events, 
physical and cyber, and to complete settlement by the end of the day of 
the disruption. In related discussions with Board-supervised firms, and 
supported by provisions in the CPMI-IOSCO Cyber Guidance, Board staff 
has emphasized that recovery time objectives are necessary and critical 
targets around which plans, systems, and processes should be designed, 
enabling the firm to meet the objective.\29\ However, these recovery 
time objectives should not be interpreted as a requirement for a 
designated FMU to resume operations in a compromised or otherwise 
untrusted state.
---------------------------------------------------------------------------

    \28\ In addition to renumbering these sections as Sec.  
234.3(a)(17)(vii) and Sec.  234.3(a)(17)(viii)(B)-(C), respectively, 
the Board is proposing a technical revision to Sec.  
234.3(a)(17)(vi), as described below in section II.E.2.
    \29\ For example, paragraph 6.2.2 of the Cyber Guidance notes 
that the objectives for resuming operations set goals for, 
ultimately, the sound functioning of the financial system, which 
should be planned for and tested against. It further notes the 
criticality of the recovery and resumption objectives under 
Principle 17, Key Consideration 6 of the PFMI, while also 
acknowledging that financial market infrastructures should exercise 
judgment in effecting resumption so that risks to itself or its 
ecosystem do not thereby escalate. For additional details, see CPMI-
IOSCO, Guidance on Cyber Resilience for Financial Market 
Infrastructures (June 2016) at section 6, https://www.bis.org/cpmi/publ/d146.htm (``Response and Recovery'').
---------------------------------------------------------------------------

    Threats to designated FMUs' operations continue to evolve, and the 
Board expects that a designated FMU's business continuity planning will 
be a dynamic process in which the designated FMU works to update the 
scenarios for which it plans on an ongoing basis to meet its recovery 
and resumption objectives. For many types of disruptive scenarios, 
technology and methods already exist to enable a designated FMU to 
recover and resume operations within two hours of the disruption. For 
example, if an earthquake damages a designated FMU's hardware and 
disrupts operations at one data center, the designated FMU can fail 
over to another location that is outside the earthquake radius.
    The Board recognizes, however, that certain threats to designated 
FMUs' operations, as well as the technology to mitigate those threats, 
are continually evolving. In areas where threats and technology are 
still evolving, such as is the case for extreme cyberattacks (e.g., 
where significant data loss or corruption occurs across its data 
centers), the Board recognizes that solutions are evolving with the 
threat environment and require a holistic approach that integrates 
protective, detective, and containment measures with response, 
recovery, and resumption solutions. The Board continues to expect that 
a designated FMU's business continuity planning will be a dynamic 
process in which the designated FMU works on an ongoing basis to update 
its plan to recover and resume operations to achieve its objectives in 
light of these evolving threats. Federal Reserve supervisors will also 
continue to work with designated FMUs through the supervisory process 
as designated FMUs identify reasonable approaches to prepare for and 
recover from such attacks. As development of adequate solutions for 
extreme cyberattacks continues, designated FMUs should also plan for 
contingency scenarios in which planned recovery and resumption 
objectives cannot be achieved. Planning for such scenarios would also 
be in accordance with national policies aimed at improving the 
cybersecurity posture of U.S. critical infrastructures.\30\
---------------------------------------------------------------------------

    \30\ See, e.g., Presidential Policy Directive/PPD-21, Critical 
Infrastructure Security and Resilience (Feb. 12, 2013), https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil.
---------------------------------------------------------------------------

3. Reconnection After a Disruption to the Designated FMU's Critical 
Operations or Services
    Proposed Sec.  234.3(a)(17)(viii)(D) would require that the 
business continuity plan set out criteria and processes that address 
the reconnection of a designated FMU to its participants and other 
entities following a disruption to the designated FMU's critical 
operations or services. In this context, the Board would consider a 
disruption to a designated FMU's critical operations or services 
broadly as a form of ``disconnection'' to external parties such as the 
designated FMU's participants. This would include situations where a 
designated FMU deliberately takes itself offline such that participants 
cannot access its services (e.g., if it experiences a major cyberattack 
that it needs to contain); it would also include situations where a 
designated FMU loses connection to its participants due to another type 
of external event (e.g., if its production site loses power due to a 
severe weather event in its region).
    The Board believes that the current requirements to plan for 
recovery and resumption include an implicit expectation that a 
designated FMU plan to reconnect to its participants and other relevant 
entities following a disruption. However, the Board is proposing to 
make this expectation explicit in order to emphasize the importance of 
ex ante criteria and processes addressing when and how a designated FMU 
will reconnect to its participants and other relevant entities. Given 
the current threat landscape and the ability for malware to spread, the 
Board believes it is crucial for a designated FMU to be prepared to 
balance the need for the designated FMU to quickly recover and resume 
its critical operations against the risk of contagion to its ecosystem 
should it resume operations in an unsafe state (e.g., before an 
extremely harmful computer virus is fully contained or eradicated). For 
cyber incidents, it is particularly important for a designated FMU to 
be prepared to assure its participants, other connected entities, and 
regulator(s) that its remediation efforts are complete and that it has 
achieved a safe and trusted state.\31\ A designated FMU should consider 
establishing a phased approach to reconnecting to the designated FMU's 
participants and other relevant entities, transaction testing with 
selected participants before full reconnection, and heightened 
monitoring for an appropriate period of time after reconnection.
---------------------------------------------------------------------------

    \31\ A designated FMU might consider leveraging third-party 
experts to verify its remediation efforts.
---------------------------------------------------------------------------

4. Business Continuity Testing
    The proposal would amend current Sec.  234.3(a)(17)(vii)(D), which 
requires the business continuity plan to be ``tested at least 
annually,'' by separating it into two requirements (proposed Sec.  
234.3(a)(17)(viii)(E) and (F)).
    Proposed Sec.  234.3(a)(17)(viii)(E) would maintain the requirement 
for at least annual testing and clarify that this requirement covers 
the designated FMU's business continuity arrangements, including the 
people, processes, and technologies of the two sites with distinct risk 
profiles.\32\ The required testing would need to demonstrate that the 
designated FMU is able to run live production at the two sites with 
distinct risk profiles; that its solutions for data recovery and data 
reconciliation enable it to meet its objectives to recover and resume 
operations two hours following a disruption and enable settlement by 
the end of the day of the disruption even in case of extreme 
circumstances including if there is data loss or corruption; and that 
it has geographically dispersed staff who can effectively run the 
operations and manage the business of the designated FMU.
---------------------------------------------------------------------------

    \32\ These tests would be subject to the general testing 
requirements described in section II.A.1 above.
---------------------------------------------------------------------------

    The Board believes that a designated FMU must be able to 
demonstrate these particular capabilities in order verify that its 
business continuity

[[Page 60321]]

arrangements will function as intended in achieving the recovery and 
resumption objectives in its business continuity plan. For example, 
given the importance of developing effective solutions for data 
recovery and reconciliation to address extreme cyber scenarios, the 
Board believes that designated FMUs should expressly be required to 
demonstrate that such solutions function as intended. Designated FMUs 
should also continue to plan for and test other scenarios, including 
wide-scale disruptions and major disruptions, from which they may need 
to recover.\33\
---------------------------------------------------------------------------

    \33\ Scenarios-based testing allows a designated FMU to address 
an appropriately broad scope of scenarios, including simulation of 
extreme but plausible events, and should be designed to challenge 
the assumptions of response, resumption, and recovery practices, 
including governance arrangements and communication plans.
---------------------------------------------------------------------------

    Proposed Sec.  234.3(a)(17)(viii)(F) would require a designated FMU 
to review its business continuity plans, pursuant to the general review 
requirements described in section II.A.2 above, at least annually. The 
objectives of this review are twofold: (1) to incorporate lessons 
learned from actual and averted disruptions, and (2) to update the 
scenarios considered and assumptions built into the plan in order to 
ensure responsiveness to the evolving risk environment and incorporate 
new and evolving sources of operational risk (e.g., extreme cyber 
events).
5. Questions
    With respect to proposed Sec.  234.3(a)(17)(viii), the Board 
requests comment on the following specific questions:
    9. What are reasonable estimates of the costs and other challenges 
associated with proposed Sec.  234.3(a)(17)(viii)?
    10. Is the proposed formulation of ``two sites providing for 
sufficient redundancy supporting critical operations'' a clear and 
appropriate replacement for references to ``primary'' and ``secondary'' 
sites in the current rule?
    11. Is the proposed requirement on addressing ``reconnection'' of 
the designated FMU after a disruption clear? Should a different term be 
used, given the intention of this proposed requirement, as explained in 
section II.C.3 above?

D. Third-Party Risk Management

    The Board expects a designated FMU to conduct its activities--
whether conducted directly by the designated FMU or through a service 
provider--in a safe and sound manner. The Board is proposing to add 
Sec.  234.3(a)(17)(ix) regarding the management of risks associated 
with third-party relationships. Proposed Sec.  234.3(a)(17)(ix) would 
require a designated FMU to have systems, policies, procedures, and 
controls in order to effectively identify, monitor, and manage risks 
associated with third-party relationships. Additionally, for any 
service that is performed for the designated FMU by a third party, 
these systems, policies, procedures, and controls would need to ensure 
that risks are identified, monitored, and managed to the same extent as 
if the designated FMU were performing the service itself. Importantly, 
the risks associated with third-party relationships would include both 
the risks stemming from the third party itself, as well as risks 
stemming from the supply chain.
    Additionally, the Board is proposing to add ``third party'' as a 
defined term in Regulation HH. Specifically, proposed Sec.  234.2(n) 
would define ``third party'' as ``any entity with which a designated 
FMU maintains a business arrangement, by contract or otherwise.'' \34\ 
For the purposes of proposed Sec.  234.3(a)(17)(ix), the Board would 
consider third-party relationships to include vendor relationships for 
products such as for software and arrangements for any services that 
third parties perform for a designated FMU.\35\ Services can include a 
wide variety of arrangements, from HVAC services that support the 
physical infrastructure of the designated FMU to technology platforms 
or financial risk management modeling that are essential to executing 
the designated FMU's payment, clearing, or settlement activities. The 
Board believes that where a designated FMU outsources the provision of 
services to a third party, the designated FMU retains the 
responsibility for meeting the risk-management standards in Regulation 
HH.
---------------------------------------------------------------------------

    \34\ Participants of designated FMUs would not be considered 
third parties. This definition is consistent with the definition of 
``third-party relationship'' in the proposed interagency guidance on 
third-party relationships. See 86 FR 38182, 38186-87 (July 17, 
2021). The Board views the requirements of proposed Sec.  
234.3(a)(17)(ix) as broadly consistent with the proposed interagency 
guidance. In examining designated FMUs under Regulation HH, Board 
examiners will continue to reference guidance on third-party risk 
management.
    \35\ Relatedly, the Board believes this proposal is consistent 
with section 807(b) of the Dodd-Frank Act, which provides each 
Supervisory Agency of a designated FMU with authority examine the 
provision of any service integral to the operation of the designated 
FMU for compliance with applicable law, rules, orders, and standards 
to the same extent as if the designated FMU were performing the 
service on its own premises. 12 U.S.C. 5466(b).
---------------------------------------------------------------------------

    The Board is proposing these requirements because of the importance 
of ensuring that a designated FMU's activities do not become less safe 
when they are outsourced to third parties, and because of the 
importance of managing particular sources of operational risk 
associated with third-party relationships, including ``supply chain 
risk.'' \36\ Supply chain risk encompasses the potential for harm or 
compromise to a designated FMU that arises as a result of security 
risks from its third parties' subcontractors or suppliers, as well as 
the subcontractors' or suppliers' supply chains, and their products or 
services (including software that may be used by the third party or the 
designated FMU).\37\
---------------------------------------------------------------------------

    \36\ The Board identified supply chain risk as a threat on which 
the Board is focused in its report on cybersecurity and financial 
system resilience. See Board of Governors of the Federal Reserve 
System, Report to Congress: Cybersecurity and Financial System 
Resilience Report (September 2021), https://www.federalreserve.gov/publications/files/cybersecurity-report-202109.pdf.
    \37\ This definition is consistent with NIST's definition of 
``supply chain risk'' in the NIST computer-security incident 
handling guide. See NIST, Computer Security Incident Handling Guide 
(Special Publication 800-61, rev. 2), https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf.
---------------------------------------------------------------------------

    Further, proposed Sec.  234.3(a)(17)(ix) would require a designated 
FMU to regularly conduct risk assessments of its third-party 
relationships and establish, as appropriate, information-sharing 
arrangements with third parties. Proposed Sec.  234.3(a)(17)(ix) would 
also require a designated FMU to include third parties in business 
continuity management and testing, as appropriate. The Board believes 
these specific measures are critical to a designated FMU's ability to 
effectively manage risks related to third-party relationships.
    In general, the Board would expect a designated FMU to take a 
rigorous approach to identifying, monitoring, and managing risks 
associated with third-party relationships. To identify and assess the 
risks from third parties effectively, it would be prudent for the 
designated FMU to understand ex ante any risks associated with the 
third party, including details on the services or products the third 
party will provide and the security controls that the third party has 
in place. Before entering into a third-party relationship, the 
designated FMU should have a plan in place to address how it will 
effectively identify, monitor, and manage the relationship and its 
associated risks, in order to ensure that the designated FMU can 
continue to meet the risk-management requirements in Regulation HH. A 
designated FMU should conduct

[[Page 60322]]

appropriate due diligence on third parties and should include, as 
appropriate, provisions in service contracts that establish 
information-sharing agreements based on the risk level of the third 
party. Information-sharing arrangements should include, where 
necessary, expectations related to when the designated FMU would be 
notified of material operational incidents at the third party.
    To assess risk levels of third parties and monitor any changes in 
these risk levels that may affect a designated FMU and its ecosystem, 
the designated FMU should ensure that it regularly conducts risk 
assessments of its third-party relationships and that its information-
sharing agreements include, where appropriate, information on the third 
party's information security controls and operational resilience 
objectives and capabilities. To manage risks posed by third parties, a 
designated FMU should adopt risk management practices that are 
commensurate with the level of risk posed by its third-party 
relationships, as identified through the risk assessments it conducts. 
For example, to manage supply chain risks, a designated FMU might 
require, in its contracts with certain third parties that are critical 
to its operations and services, mandatory approval from the designated 
FMU before the service provider may outsource any material elements of 
its service to another party.
    In addition, a designated FMU should include third parties in its 
business continuity management and testing, as appropriate. A 
designated FMU should run scenario exercises with third parties to 
ensure that the designated FMU can effectively manage any instances in 
which a third party experiences an incident causing disruption or 
material degradation to the designated FMU's critical operations or 
services. For example, a designated FMU should be prepared to react--
such as by switching to a contingency plan--to a cyberattack on one of 
its third parties that causes disruptions in that entity's ability to 
enable the designated FMU to fulfill its obligations on time.
1. Questions
    With respect to proposed Sec.  234.3(a)(17)(ix), the Board requests 
comment on the following specific questions:
    12. Are there other risk-management measures that are essential to 
effective management of third-party relationship risks that the Board 
should consider setting as an explicit minimum requirement?
    13. Is the proposed requirement on managing risks associated with 
``third-party'' relationships clear? Should a different term be used, 
given the intention of this proposed requirement, as explained in 
section II.D above?
    14. Are there challenges associated with implementation of this 
proposed requirement that the Board has not considered?
    15. Should the proposed requirements related to third-party risk 
management be codified in Sec.  234.3(a)(17) as proposed, or should the 
Board consider an alternative placement for these requirements in 
Regulation HH?

E. Technical Revisions

1. Definition of Operational Risk
    Proposed Sec.  234.2(h) would add ``operational risk'' as a defined 
term in Regulation HH. Under the proposal, this term is defined as 
``the risk that deficiencies in information systems or internal 
processes, human errors, management failures, or disruptions from 
external events will result in the reduction, deterioration, or 
breakdown of services provided by the designated financial market 
utility.''
    The proposed definition of ``operational risk'' is consistent with 
the definition for operational risk in the PFMI and the Board's 
definition in part I of the Federal Reserve Policy on Payment System 
Risk (PSR policy), which sets out the Board's views, and related 
standards, regarding the management of risks in financial market 
infrastructures, including those operated by the Reserve Banks.\38\ The 
Board also provided this definition of operational risk when it 
proposed the current operational risk-management standard in Regulation 
HH in 2014; however, the Board did not believe a defined term in the 
rule text was necessary at that time. For clarifying purposes, the 
Board is proposing to adopt ``operational risk'' as a defined term.
---------------------------------------------------------------------------

    \38\ The Board revised concurrently the risk-management 
standards in Regulation HH and part I of the PSR policy based on the 
PFMI in 2014.
---------------------------------------------------------------------------

2. Definition of Critical Operations and Critical Services
    Proposed Sec.  234.2(d) would add ``critical operations'' and 
``critical services'' as defined terms in Regulation HH, in order to 
streamline references to these terms. Under the proposal, these terms 
are defined as ``any operations or services that the designated 
financial market utility identifies under 12 CFR 234.3(a)(3)(iii)(A).'' 
Under Sec.  234.3(a)(3)(iii)(A), a designated FMU must identify its 
critical operations and services related to payment, clearing, and 
settlement for purposes of developing its integrated plans for recovery 
and orderly wind-down.
    The Board's proposed amendments to Sec.  234.3(a)(17) related to 
review and testing, incident management and planning, and business 
continuity management planning, refer to a designated FMU's critical 
operations and/or services in multiple places. Amending Regulation HH 
to include definitions of ``critical operations'' and ``critical 
services'' would clarify that the critical operations or services that 
the designated FMU should consider under paragraph (a)(17) are the same 
set of critical operations and services that the designated FMU has 
identified under paragraph (a)(3). These technical revisions are not 
expected to result in changes to designated FMUs' business continuity 
management and planning.
3. Cross-Reference to ``Other Entities'' Identified in Sec.  
234.3(a)(3) on Comprehensive Management of Risk
    Current Sec.  234.3(a)(17)(ii) requires a designated FMU to 
identify, manage, and monitor the risks that its operations might pose 
to other ``financial market utilities and trade repositories, if any.'' 
The Board proposes to streamline and replace this reference with other 
``relevant entities such as those referenced in paragraph (a)(3)(ii).'' 
The Board believes this requirement is consistent with the current 
requirement under subparagraph (a)(3)(ii) for the designated FMU to 
identify, measure, monitor, and manage the material risks that it poses 
to other entities, such as other FMUs, settlement banks, liquidity 
providers, and service providers, as a result of interdependencies. As 
a conforming revision, the Board is proposing to include ``trade 
repositories'' in the list of entities listed under paragraph 
(a)(3)(ii).\39\
---------------------------------------------------------------------------

    \39\ Because of the differences in the definition for financial 
market infrastructure in the PFMI, which includes trade 
repositories, and the definition of FMU in the Dodd-Frank Act, which 
does not, the Board inadvertently excluded the reference to ``trade 
repositories'' in Sec.  234.3(a)(3)(ii).
---------------------------------------------------------------------------

4. Operational Capabilities To Ensure High Degree of Security and 
Operational Reliability
    Current Sec.  234.3(a)(17)(iii) requires a designated FMU to have 
``policies and systems'' that are designed to achieve clearly defined 
objectives to ensure a high degree of security and operational 
reliability. The Board expects a designated FMU to establish clearly 
defined objectives to ensure a high degree of security and operational 
reliability; to have systems designed to achieve these objectives; and 
to have policies, such as benchmarks, in place

[[Page 60323]]

for the designated FMU to evaluate its systems' performance against 
these objectives.
    A designated FMU is implicitly required to have the operational 
capability to achieve these objectives. The Board is proposing to make 
this requirement explicit by clarifying that a designated FMU must have 
``operational capabilities''--in addition to policies and systems--that 
are designed to achieve clearly defined objectives to ensure a high 
degree of security and operational reliability. This additional 
emphasis on having operational capabilities in addition to policies and 
systems is in line with proposed Sec.  234.3(a)(17)(i)(A)(2), which 
emphasizes the need for a designated FMU to assess whether its relevant 
systems, policies, procedures, and controls function as intended.
5. Identify, Monitor, and Manage Potential and Evolving Vulnerabilities 
and Threats
    Current Sec.  234.3(a)(17)(v) requires a designated FMU to have 
comprehensive physical, information, and cyber security policies, 
procedures, and controls ``that address'' potential and evolving 
vulnerabilities and threats. The Board is proposing to replace the 
quoted text with ``that enable the designated financial market utility 
to identify, monitor, and manage'' potential and evolving 
vulnerabilities and threats. The Board believes this is a technical 
change that would clarify what it means to ``address'' potential and 
evolving vulnerabilities and threats.
6. Questions
    With respect to the proposed set of technical amendments, the Board 
requests comment on the following specific question:
    16. Would any of these proposed amendments effect a substantive 
change? If so, how?

III. Administrative Law Matters

A. Regulatory Flexibility Act Analysis

    The Regulatory Flexibility Act, 5 U.S.C. 601 et seq. (RFA), 
requires an agency to consider the impact of its proposed rules on 
small entities. In connection with a proposed rule, the RFA generally 
requires an agency to prepare an Initial Regulatory Flexibility 
Analysis (IRFA) describing the impact of the rule on small entities, 
unless the head of the agency certifies that the proposed rule will not 
have a significant economic impact on a substantial number of small 
entities and publishes such certification along with a statement 
providing the factual basis for such certification in the Federal 
Register. An IRFA must contain (1) a description of the reasons why 
action by the agency is being considered; (2) a succinct statement of 
the objectives of, and legal basis for, the proposed rule; (3) a 
description of, and, where feasible, an estimate of the number of small 
entities to which the proposed rule will apply; (4) a description of 
the projected reporting, recordkeeping, and other compliance 
requirements of the proposed rule, including an estimate of the classes 
of small entities that will be subject to the requirement and the type 
of professional skills necessary for preparation of the report or 
record; (5) an identification, to the extent practicable, of all 
relevant Federal rules that may duplicate, overlap with, or conflict 
with the proposed rule; and (6) a description of any significant 
alternatives to the proposed rule that accomplish its stated 
objectives.
    The Board is providing an IRFA with respect to the proposed rule. 
For the reasons described below, the Board believes that the proposal 
will not have a significant economic impact on a substantial number of 
small entities. The Board invites public comment on all aspects of its 
IRFA.
1. Reasons Action Is Being Considered
    The Board is proposing to amend Regulation HH to update current 
standards related to operational risk management in light of 
developments in the operational risk, technology, and regulatory 
landscape in which designated FMUs operate. Further discussion of the 
rationale for the proposal is provided in section I.C, above.
2. Objectives of the Proposed Rule
    As described in section I.B, above, section 805(a)(1)(A) of the 
Dodd-Frank Act requires the Board to prescribe risk-management 
standards, taking into consideration relevant international standards 
and existing prudential requirements, applicable to certain designated 
FMUs. Pursuant to this authority, the Board issued Regulation HH in 
2012 and significantly revised Regulation HH in 2014. The Board is now 
proposing revisions to the current Regulation HH standards related to 
operational risk management. The Board's objective is to promote 
effective operational risk management practices at and the operational 
resilience of designated FMUs subject to Regulation HH, and as a 
result, advance safety and soundness and promote the stability of the 
U.S. financial system.
3. Description and Estimate of the Number of Small Entities
    Regulation HH applies to designated FMUs other than derivatives 
clearing organizations registered with the CFTC and clearing agencies 
registered with the SEC. At present, the FSOC has designated eight FMUs 
as systemically important; two of these designated FMUs are subject to 
the Board's Regulation HH.
    The Small Business Administration (SBA) has adopted size standards 
for determining whether a particular entity is considered a ``small 
entity'' for purposes of the RFA. The Board believes that the most 
appropriate SBA size standard to apply in determining whether a 
designated FMU is a small entity is the SBA size standard for financial 
transactions processing, reserve, and clearinghouse activities; under 
this standard, a designated FMU is considered a small entity if its 
annual receipts are less than $41.5 million.\40\ When applying this SBA 
size standard, the Board includes the assets of all domestic and 
foreign affiliates in determining whether to classify a designated FMU 
as a small entity.\41\
---------------------------------------------------------------------------

    \40\ 13 CFR 121.201 (subsector 522320). Alternatively, the SBA 
size standards for (1) securities and commodities exchanges, (2) 
trust, fiduciary, and custody activities, or (3) international trade 
financing activities could also apply to certain designated FMUs; 
these size standards are currently the same as the size standard for 
financial transactions processing, reserve, and clearinghouse 
activities (i.e., annual receipts of less than $41.5 million). Id. 
(subsectors 523210, 523991, and 522293).
    \41\ 13 CFR 121.103.
---------------------------------------------------------------------------

    After applying this SBA size standard, the Board believes that 
neither of the designated FMUs that are subject to Regulation HH are 
considered small entities.
4. Estimating Compliance Requirements
    The proposal updates current standards in Regulation HH related to 
operational risk management in light of developments in the operational 
risk, technology, and regulatory landscape in which designated FMUs 
operate. The proposed revisions are discussed in detail in section II, 
above. In general, the proposed revisions would add specificity to the 
current operational risk management standards by codifying existing 
practices of designated FMUs into the regulation. Because the proposed 
revisions do not represent a significant change from existing practices 
of designated FMUs, the Board would not expect the proposed revisions 
to have a significant economic impact on those small entities.

[[Page 60324]]

5. Duplicative, Overlapping, and Conflicting Rules
    The Board is not aware of any federal rules that may duplicate, 
overlap with, or conflict with the proposed rule.
6. Significant Alternatives Considered
    The Board did not consider any significant alternatives to the 
proposed rule. The Board believes that updating the current Regulation 
HH standards related to operational risk management in light of 
developments in the operational risk, technology, and regulatory 
landscape in which designated FMUs operate is the best way to achieve 
the Board's objectives of promoting effective operational risk 
management practices at and the operational resilience of designated 
FMUs subject to Regulation HH, and as a result, advancing safety and 
soundness and promoting the stability of the U.S. financial system.

B. Competitive Impact Analysis

    As a matter of policy, the Board conducts a competitive impact 
analysis in connection with any operational or legal changes that could 
have a substantial effect on payment system participants, even if 
competitive effects are not apparent on the face of the proposal. 
Pursuant to this policy, the Board assesses whether proposed changes 
``would have a direct and material adverse effect on the ability of 
other service providers to compete effectively with the Federal Reserve 
in providing similar services'' and whether any such adverse effect 
``was due to legal differences or due to a dominant market position 
deriving from such legal differences.'' If, as a result of this 
analysis, the Board identifies an adverse effect on competition, the 
Board then assesses whether the associated benefits--such as 
improvements to payment system efficiency or integrity--can be achieved 
while minimizing the adverse effect on competition.\42\
---------------------------------------------------------------------------

    \42\ See Policies: The Federal Reserve in the Payments System 
(issued 1984; revised 1990 and January 2001), https://www.federalreserve.gov/paymentsystems/pfs_frpaysys.htm.
---------------------------------------------------------------------------

    Designated FMUs are subject to the supervisory framework 
established under Title VIII of the Dodd-Frank Act. This proposed rule 
revises current Regulation HH operational risk-management standards for 
certain designated FMUs. At least one designated FMU that is currently 
subject to Regulation HH competes with a similar service provided by 
the Reserve Banks.
    Under the Federal Reserve Act, the Board has general supervisory 
authority over the Reserve Banks, including the Reserve Banks' 
provision of payment and settlement services. This general supervisory 
authority is more extensive in scope than the Board's authority over 
certain designated FMUs under Title VIII. In practice, Board oversight 
of the Reserve Banks goes beyond the typical supervisory framework for 
private-sector entities, including the framework provided by Title 
VIII. The Board is committed to applying risk-management standards to 
the Reserve Banks' Fedwire Funds Service and Fedwire Securities Service 
(collectively, Fedwire Services) that are at least as stringent as the 
Regulation HH standards that are applied to designated FMUs that 
provide similar services. This would continue to be the case if the 
proposed revisions to the operational risk management standards in 
Regulation HH are adopted. Specifically, the Fedwire Services are 
subject to in the risk-management standards in part I of the PSR 
policy, which (like those in Regulation HH) are based on the PFMI. The 
Board is be guided by its interpretation of the corresponding 
provisions of Regulation HH in its application of the risk management 
expectations in the PSR policy.\43\ Therefore, the Board does not 
believe the proposed rule will have any direct and material adverse 
effect on the ability of other service providers to compete with the 
Reserve Banks.
---------------------------------------------------------------------------

    \43\ See section I.B.1 of the PSR policy.
---------------------------------------------------------------------------

C. Paperwork Reduction Act Analysis

    In accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 
3506; 5 CFR part 1320, Appendix A.1), the Board reviewed the proposed 
rule under the authority delegated to the Board by the Office of 
Management and Budget. For purposes of calculating burden under the 
Paperwork Reduction Act, a ``collection of information'' involves 10 or 
more respondents. Any collection of information addressed to all or a 
substantial majority of an industry is presumed to involve 10 or more 
respondents (5 CFR 1320.3(c), 1320.3(c)(4)(ii)). The Board estimates 
there are fewer than 10 respondents and these respondents do not 
represent all or a substantial majority of the participants in payment, 
clearing, and settlement systems. Therefore, no collections of 
information under the Paperwork Reduction Act are contained in the 
proposed rule.

List of Subjects in 12 CFR Part 234

    Banks, banking, Credit, Electronic funds transfers, Financial 
market utilities, Securities.

    For the reasons set forth in the preamble, the Board proposes to 
amend part 234 of chapter II of title 12 of the Code of Federal 
Regulations, as follows:

PART 234--DESIGNATED FINANCIAL MARKET UTILITIES (REGULATION HH)

0
1. The authority citation for part 234 continues to read as follows:

    Authority: 12 U.S.C. 5461 et seq.

0
2. Revise Sec.  234.2 as follows:


Sec.  234.2   Definitions.

    (a) Backtest means the ex post comparison of realized outcomes with 
margin model forecasts to analyze and monitor model performance and 
overall margin coverage.
    (b) Central counterparty means an entity that interposes itself 
between counterparties to contracts traded in one or more financial 
markets, becoming the buyer to every seller and the seller to every 
buyer.
    (c) Central securities depository means an entity that provides 
securities accounts and central safekeeping services.
    (d) Critical operations and critical services refer to any 
operations or services that the designated financial market utility 
identifies under 12 CFR 234.3(a)(3)(iii)(A).
    (e) Designated financial market utility means a financial market 
utility that is currently designated by the Financial Stability 
Oversight Council under section 804 of the Dodd-Frank Act (12 U.S.C. 
5463).
    (f) Financial market utility has the same meaning as the term is 
defined in section 803(6) of the Dodd-Frank Act (12 U.S.C. 5462(6)).
    (g) Link means, for purposes of Sec.  234.3(a)(20), a set of 
contractual and operational arrangements between two or more central 
counterparties, central securities depositories, or securities 
settlement systems, or between one or more of these financial market 
utilities and one or more trade repositories, that connect them 
directly or indirectly, such as for the purposes of participating in 
settlement, cross margining, or expanding their services to additional 
instruments and participants.
    (h) Operational risk means the risk that deficiencies in 
information systems or internal processes, human errors, management 
failures, or disruptions from external events will result in the 
reduction, deterioration, or breakdown of services provided by the 
designated financial market utility.
    (i) Orderly wind-down means the actions of a designated financial 
market utility to effect the permanent cessation, sale, or transfer of 
one or more of its

[[Page 60325]]

critical operations or services in a manner that would not increase the 
risk of significant liquidity or credit problems spreading among 
financial institutions or markets and thereby threaten the stability of 
the U.S. financial system.
    (j) Recovery means, for purposes of Sec.  234.3(a)(3) and (15), the 
actions of a designated financial market utility, consistent with its 
rules, procedures, and other ex ante contractual arrangements, to 
address any uncovered loss, liquidity shortfall, or capital inadequacy, 
whether arising from participant default or other causes (such as 
business, operational, or other structural weaknesses), including 
actions to replenish any depleted prefunded financial resources and 
liquidity arrangements, as necessary to maintain the designated 
financial market utility's viability as a going concern and to continue 
its provision of critical services.
    (k) Securities settlement system means an entity that enables 
securities to be transferred and settled by book entry and allows 
transfers of securities free of or against payment.
    (l) Stress test means the estimation of credit or liquidity 
exposures that would result from the realization of potential stress 
scenarios, such as extreme price changes, multiple defaults, and 
changes in other valuation inputs and assumptions.
    (m) Supervisory Agency has the same meaning as the term is defined 
in section 803(8) of the Dodd-Frank Act (12 U.S.C. 5462(8)).
    (n) Third party means any entity with which a designated financial 
market utility maintains a business arrangement, by contract or 
otherwise.
    (o) Trade repository means an entity that maintains a centralized 
electronic record of transaction data, such as a swap data repository 
or a security-based swap data repository.
0
3. Amend Sec.  234.3 by:
0
(a) Revising the section heading;
0
(b) Adding the words ``trade repositories,'' after the words ``such as 
other financial market utilities,'' in paragraph (a)(3)(ii);
0
(c) Removing the word ``following'' and adding in its place ``after'', 
in paragraph
0
(a)(3)(iii)(G);
0
(d) Revising paragraph (a)(17); and
0
(e) Removing the word ``following'' and adding in its place ``to 
reflect'', in paragraph (a)(23)(v).
    The revisions read as follows:


Sec.  234.3   Standards for designated financial market utilities.

    (a) * * *
    (17) Operational risk. The designated financial market utility 
manages its operational risks by establishing a robust operational 
risk-management framework that is approved by the board of directors. 
In this regard, the designated financial market utility--
    (i) Identifies the plausible sources of operational risk, both 
internal and external, and mitigates their impact through the use of 
appropriate systems, policies, procedures, and controls--including 
those specific systems, policies, procedures, or controls required 
pursuant to this paragraph (a)(17)--that are reviewed, audited, and 
tested periodically and after major changes such that--
    (A) The designated financial market utility conducts tests--
    (1) In accordance with a documented testing framework that 
addresses scope, frequency, participation, interdependencies, and 
reporting; and
    (2) That assess whether the designated financial market utility's 
systems, policies, procedures, or controls function as intended;
    (B) The designated financial market utility reviews the design, 
implementation, and testing of systems, policies, procedures, and 
controls, after material operational incidents, including the material 
operational incidents described in paragraph (a)(17)(vi)(A) of this 
section, or after significant changes to the environment in which the 
designated financial market utility operates; and
    (C) The designated financial market utility remediates as soon as 
possible, following established governance processes, any deficiencies 
in systems, policies, procedures, or controls identified in the process 
of review or testing;
    (ii) Identifies, monitors, and manages the risks its operations 
might pose to other relevant entities such as those referenced in 
paragraph (a)(3)(ii) of this section;
    (iii) Has policies, systems, and operational capabilities that are 
designed to achieve clearly defined objectives to ensure a high degree 
of security and operational reliability;
    (iv) Has systems that have adequate, scalable capacity to handle 
increasing stress volumes and achieve the designated financial market 
utility's service-level objectives;
    (v) Has comprehensive physical, information, and cyber security 
policies, procedures, and controls that enable the designated financial 
market utility to identify, monitor, and manage potential and evolving 
vulnerabilities and threats;
    (vi) Has a documented framework for incident management that 
provides for the prompt detection, analysis, and escalation of an 
incident, appropriate procedures for addressing an incident, and 
incorporation of lessons learned following an incident. This framework 
includes a plan for notification and communication of material 
operational incidents to identified relevant entities that ensures the 
designated financial market utility--
    (A) Immediately notifies the Board when the designated financial 
market utility activates its business continuity plan or has a 
reasonable basis to conclude that--
    (1) There is an actual or likely disruption, or material 
degradation, to any critical operations or services, or to its ability 
to fulfill its obligations on time; or
    (2) There is unauthorized entry, or the potential for unauthorized 
entry, into the designated financial market utility's computer, 
network, electronic, technical, automated, or similar systems that 
affects or has the potential to affect its critical operations or 
services;
    (B) Establishes criteria and processes providing for timely 
communication and responsible disclosure of material operational 
incidents to the designated financial market utility's participants and 
other relevant entities, such that--
    (1) Affected participants are notified immediately of actual 
disruptions or material degradation to any critical operations or 
services, or to the designated financial market utility's ability to 
fulfill its obligations on time; and
    (2) All participants and other relevant entities, as identified in 
the designated financial market utility's plan for notification and 
communication, are notified in a timely manner of all other material 
operational incidents that require notification under paragraph 
(a)(17)(vi)(A) of this section;
    (vii) Has business continuity management that provides for rapid 
recovery and timely resumption of critical operations and services and 
fulfillment of its obligations, including in the event of a wide-scale 
disruption or a major disruption;
    (viii) Has a business continuity plan that--
    (A) Incorporates the use of two sites providing for sufficient 
redundancy supporting critical operations that are located at a 
sufficient geographical distance from each other to have a distinct 
risk profile;
    (B) Is designed to enable critical systems, including information 
technology systems, to recover and resume critical operations and 
services no later than two hours following disruptive events;

[[Page 60326]]

    (C) Is designed to enable it to complete settlement by the end of 
the day of the disruption, even in case of extreme circumstances;
    (D) Sets out criteria and processes that address the reconnection 
of the designated financial market utility to participants and other 
entities following a disruption to the designated financial market 
utility's critical operations or services;
    (E) Provides for testing, pursuant to the requirements under 
paragraphs (a)(17)(i)(A) and (a)(17)(i)(C) of this section, at least 
annually, of the designated financial market utility's business 
continuity arrangements, including the people, processes, and 
technologies of the sites required under paragraph (a)(17)(viii)(A), 
such that it can demonstrate that--
    (1) The designated financial market utility can run live production 
at the sites required under paragraph (a)(17)(viii)(A);
    (2) The designated financial market utility's solutions for data 
recovery and data reconciliation enable it to meet its recovery and 
resumption objectives even in case of extreme circumstances, including 
in the event of data loss or data corruption; and
    (3) The designated financial market utility has geographically 
dispersed staff who can effectively run the operations and manage the 
business of the designated financial market utility; and
    (F) Is reviewed, pursuant to the requirements under paragraphs 
(a)(17)(i)(B) and (a)(17)(i)(C) of this section, at least annually, in 
order to--
    (1) Incorporate lessons learned from actual and averted 
disruptions; and
    (2) Update scenarios and assumptions in order to ensure 
responsiveness to the evolving risk environment and incorporate new and 
evolving sources of operational risk; and
    (ix) Has systems, policies, procedures, and controls that 
effectively identify, monitor, and manage risks associated with third-
party relationships, and that ensure that, for any service that is 
performed for the designated financial market utility by a third party, 
risks are identified, monitored, and managed to the same extent as if 
the designated financial market utility were performing the service 
itself. In this regard, the designated financial market utility--
    (A) Regularly conducts risk assessments of third parties and 
establishes information-sharing arrangements, as appropriate, with 
third parties; and
    (B) Includes third parties in business continuity management and 
testing, as appropriate.
* * * * *

    By order of the Board of Governors of the Federal Reserve 
System.
Margaret McCloskey Shanks,
Deputy Secretary of the Board.
[FR Doc. 2022-21222 Filed 10-4-22; 8:45 am]
BILLING CODE P