{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2018-02-06","gaps":[],"covered":["2017/571 — RTS — Authorisation of data reporting services providers [no longer in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/7","url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/7","title":"Article 7 — Business continuity and back-up facilities","family":"l2_unit_view","work_id":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","view_of":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","status":"repealed","force_status":"no_longer_in_force","date_state":"no_longer_in_force","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Consolidated version of 6 February 2018","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0571-20180206","valid_from":"0001-01-01","valid_until":"2025-11-23","content_id":"71d8784a41a2455c","versions":["0001-01-01"],"version_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/7/versions/2018-02-06","revision_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/7/versions/2018-02-06/rev/71d8784a41a2455c","versions_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/7/versions","relations_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/7/relations","act_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the#art-7","source_line":"Commission Delegated Regulation (EU) 2017/571 · superseded — not in force · OJ L 87, 31.3.2017 · dated 2 Jun 2016 [no longer in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2016-06-02","entry_into_force":"2017-04-20","locators":{"document_date":"CELLAR 32017R0571 work_date_document","entry_into_force":"CELLAR 32017R0571 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","name":"Commission Delegated Regulation (EU) 2017/571","number":"2017/571","celex":"32017R0571","title_official":"COMMISSION DELEGATED REGULATION (EU) 2017/571 of 2 June 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to regulatory technical standards on the authorisation, organisational requirements and the publication of transactions for data reporting services providers (Text with EEA relevance)","document_date":"2016-06-02"},"position":{"kind":"article","key":"7","index":7,"articles":22,"annexes":0},"prev":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/6","key":"6","title":"Article 6 — Organisational requirements regarding outsourcing"},"next":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/8","key":"8","title":"Article 8 — Testing and capacity"},"act_anchor":"#art-7"}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0571-20180206","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the.md","unit_text_sha256":"6b3876a0c131138aea20b5a679d9f45ab2af9825192254d310b3ab86ac6793db","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/art-7","kind":"article","key":"7","heading":"Article 7 — Business continuity and back-up facilities","text":"## Article 7 — Business continuity and back-up facilities\n\n1. A data reporting services provider shall use systems and facilities that are appropriate and robust enough to ensure continuity and regularity in the performance of the services provided referred to in Directive 2014/65/EU.\n\n2. A data reporting services provider shall conduct periodic reviews, at least annually, evaluating its technical infrastructures and associated policies and procedures, including business continuity arrangements. A data reporting services provider shall remedy any deficiencies identified during the review.\n\n3. A data reporting services provider shall have effective business continuity arrangements in place to address disruptive incidents, including:\n\n **(a)** the processes which are critical to ensuring the services of the data reporting services provider, including escalation procedures, relevant outsourced activities or dependencies on external providers;\n\n **(b)** specific continuity arrangements, covering an adequate range of possible scenarios, in the short and medium term, including system failures, natural disasters, communication disruptions, loss of key staff and inability to use the premises regularly used;\n\n **(c)** duplication of hardware components, allowing for failover to a back-up infrastructure, including network connectivity and communication channels;\n\n **(d)** back-up of business-critical data and up-to-date information of the necessary contacts, ensuring communication within the data reporting services provider and with clients;\n\n **(e)** the procedures for moving to and operating data reporting services from a back-up site;\n\n **(f)** the target maximum recovery time for critical functions, which shall be as short as possible and in any case no longer than six hours in the case of approved publication arrangements (APAs) and consolidated tape providers (CTPs) and until the close of business of the next working day in the case of approved reporting mechanisms (ARMs);\n\n **(g)** staff training on the operation of the business continuity arrangements, individuals' roles including specific security operations personnel ready to react immediately to a disruption of services;\n\n4. A data reporting services provider shall set up a programme for periodically testing, reviewing and, where needed, modifying the business continuity arrangements.\n\n5. A data reporting services provider shall publish on its website and promptly inform the competent authority of its home Member State and its clients of any service interruptions or connection disruptions as well as the time estimated to resume a regular service.\n\n6. In the case of ARMs, the notifications referred to in paragraph 5 shall also be made to any competent authority to whom the ARM submits transaction reports.\n\n","marks":[],"text_hash":"6b3876a0c131138aea20b5a679d9f45ab2af9825192254d310b3ab86ac6793db","revision":1}}