Business continuity management bank

MaRisk AT 7.3 asks for an emergency concept for all activities and processes that are critical or important functions. The concept contains business continuity and recovery plans based on plausible scenarios, names responsibilities, targets and measures, and sets the criteria for triggering a plan. The bank updates it every year and after relevant events, and the management board gets a written report on the state of emergency management at least once a quarter.

The concept rests on business impact analyses over a list of all functions. When a critical or important function is outsourced, the bank and the service provider need emergency concepts that fit together. The bank tests the concept regularly, every year for critical or important functions, records the tests and reports the results in writing to those responsible. The text in force since 30 June 2026 is on the Bundesbank website (PDF, in German).

For ICT, the Digital Operational Resilience Act sets the rules. Article 11 asks for an ICT business continuity policy and a business impact analysis of exposures to severe business disruptions. Banks test the plans at least annually for ICT systems supporting all functions. They also test after substantive changes to ICT systems supporting critical or important functions. Except at microenterprises, the tests include cyberattack scenarios and switchovers between the primary ICT infrastructure and the redundant capacity.

Banks also need a crisis management function with procedures for internal and external crisis communication, and on request they give the supervisor an estimate of the aggregated annual costs and losses from major ICT-related incidents. Article 12 covers backups: a documented backup policy, restoration on systems physically and logically segregated from the source system, and recovery time and recovery point objectives for each function. DORA in the EU sets wider operational resilience requirements alongside these continuity duties.

Business continuity management plans for the failure of specific processes, systems or sites and for their recovery. Operational resilience is the wider goal: the bank keeps delivering its critical services within a tolerance for disruption, whatever the cause. The Basel Committee's principles for operational resilience of 31 March 2021 count business continuity planning and testing as one of their parts.

A business impact analysis looks at what happens when an activity or process fails, over graded periods of time. MaRisk asks it to consider the type and size of the tangible and intangible damage and the point in time of the failure. The result decides which functions come back first and how long an outage may last, and it feeds the recovery time objectives under DORA.

MaRisk AT 7.3 requires annual tests for critical or important functions. DORA Article 11 requires at least annual testing of the plans for ICT systems supporting all functions, with additional tests after substantive changes to ICT systems supporting critical or important functions. MaRisk adds that frequency and scope follow the threat level and that service providers take part. Advanced testing of live systems falls under threat-led penetration testing.