- APRA CPS 230 Operational Risk ManagementAPRA's CPS 230 addresses operational risk and continuity across critical operations and service arrangements. Regulated institutions must connect governance, disruption tolerances, continuity planning and provider controls, with notification of material incidents and disruptions.
- Bank of England Recognised Payment Systems Code of PracticeThe Bank of England's recognised-systems Code sets governance, operational-resilience and outsourcing requirements for operators and specified service providers. It links the reliability of payment infrastructure with the controls and external arrangements supporting operation.
- DNB Oversight Regulation for the proper functioning of payment transactionsDNB's Dutch payment-transaction oversight regulation addresses operational availability and resilience, including iDEAL. It connects payment services with risk controls and evidence for supervision, focusing on their ability to remain available and function through disruption.
- EBA ICT and Security Risk Management GuidelinesThe EBA's ICT and Security Risk Management Guidelines provide guidance whose amended scope focuses on payment-service user relationship management. Read alongside DORA's ICT-risk framework, they help distinguish remaining payment-specific guidance from the digital-resilience regime.
- EBA Outsourcing Arrangements GuidelinesThe EBA's Outsourcing Guidelines address how firms govern external service arrangements. Criticality assessment, due diligence and contractual rights connect monitoring with concentration-risk and exit planning, supported by outsourcing registers and regulatory notifications.
- EU Digital Operational Resilience ActThe EU Digital Operational Resilience Act, DORA, brings ICT-risk governance, incident reporting, resilience testing and third-party risk into a financial-sector framework. It links continuity and recovery controls with major-incident classification, reporting and dependency registers.
- FFIEC Business Continuity ManagementFFIEC Business Continuity Management guidance supports US examinations of resilience, recovery and third-party dependencies. Enterprise governance, impact analysis, recovery strategies and testing work with improvement, evidenced by tests, incidents, remediation and board oversight.
- HKMA Supervisory Policy Manual OR-2 — Operational ResilienceHKMA's OR-2 operational-resilience guidance asks institutions to identify critical operations and set impact tolerances. Resource and dependency mapping feed severe-scenario testing, incident response and remediation, with assessments and test evidence for HKMA supervisory review.
- MAS Technology Risk Management GuidelinesMAS Technology Risk Management Guidelines address governance, cybersecurity and resilience in Singapore's finance sector. Board oversight, architecture, testing and third-party controls support incident monitoring, with significant events reported under the applicable MAS notices.
- New Zealand Financial Market Infrastructures Act 2021New Zealand's Financial Market Infrastructures Act 2021 establishes Reserve Bank regulation and oversight of designated infrastructures. It covers the systems handling financial obligations, linking designation and operation with the supervisory framework for market infrastructure.