OM-5.2 OM-5.2 General Requirements
OM-5.2.1
To ensure an ability to operate on an ongoing basis and limit losses in the event of severe business disruption all
Islamic bank licensees must maintain a business continuity plan (BCP) appropriate to the scale and complexity of their operations. A BCP must address the following key areas:(a) Data back up and recovery (hard copy and electronic);(b) Continuation of all critical systems, activities, and counterparty impact;(c) Financial and operational assessments;(d) Alternate communication arrangements between the licensee and its customers and its employees;(e) Alternate physical location of employees;(f) Communications with and reporting to the CBB and any other relevant regulators; and(g) Ensuring customers' prompt access to their funds in the event of a disruption.Amended: October 2012
October 07OM-5.2.2
Effective BCPs must be comprehensive, limited not just to disruption of business premises and information technology facilities, but covering all other critical areas, which affect the continuity of critical business operations or services (e.g. liquidity, human resources and others).
October 07OM-5.2.3
Licensees must notify the CBB promptly if their BCP is activated. They must also provide regular progress reports — as agreed with the CBB — until the BCP is deactivated.
October 07OM-5.2.4
The CBB recognises that BCPs involve costs, and that it may not be cost effective to have a fully developed and implemented BCP for all conceivable worst-case scenarios. However, the CBB expects licensees to plan for how they may cope with the complete destruction of buildings and surrounding infrastructure in which their key offices, installations, counterparties or service providers are located. The loss of key personnel, and a situation where back-up facilities might need to be used for an extended period of time are important factors in effective BCPs.
October 07OM-5.2.5
Licensees may find it useful to consider two-tier plans: one to deal with near-term problems; this should be fully developed and able to be put into immediate effect. The other, which might be in paper form; should deal with a longer-term scenario (e.g. how to accommodate processes that might not be critical immediately but would become so over time).
October 07
