{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2018-02-06","gaps":[],"covered":["2017/571 — RTS — Authorisation of data reporting services providers [no longer in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/8","url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/8","title":"Article 8 — Testing and capacity","family":"l2_unit_view","work_id":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","view_of":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","status":"repealed","force_status":"no_longer_in_force","date_state":"no_longer_in_force","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Consolidated version of 6 February 2018","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0571-20180206","valid_from":"0001-01-01","valid_until":"2025-11-23","content_id":"496a60a6ab98b317","versions":["0001-01-01"],"version_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/8/versions/2018-02-06","revision_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/8/versions/2018-02-06/rev/496a60a6ab98b317","versions_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/8/versions","relations_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/8/relations","act_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the#art-8","source_line":"Commission Delegated Regulation (EU) 2017/571 · superseded — not in force · OJ L 87, 31.3.2017 · dated 2 Jun 2016 [no longer in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2016-06-02","entry_into_force":"2017-04-20","locators":{"document_date":"CELLAR 32017R0571 work_date_document","entry_into_force":"CELLAR 32017R0571 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","name":"Commission Delegated Regulation (EU) 2017/571","number":"2017/571","celex":"32017R0571","title_official":"COMMISSION DELEGATED REGULATION (EU) 2017/571 of 2 June 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to regulatory technical standards on the authorisation, organisational requirements and the publication of transactions for data reporting services providers (Text with EEA relevance)","document_date":"2016-06-02"},"position":{"kind":"article","key":"8","index":8,"articles":22,"annexes":0},"prev":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/7","key":"7","title":"Article 7 — Business continuity and back-up facilities"},"next":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/9","key":"9","title":"Article 9 — Security"},"act_anchor":"#art-8"}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0571-20180206","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the.md","unit_text_sha256":"7451ca95c460633160402adbbcaf97ebcbc01f7537b609c527ebd4f6d2da89d1","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/art-8","kind":"article","key":"8","heading":"Article 8 — Testing and capacity","text":"## <a id=\"art-8\"></a>Article 8 — Testing and capacity\n\n1. <a id=\"art-8-p-1\"></a>A data reporting services provider shall implement clearly delineated development and testing methodologies, ensuring that:\n\n    <a id=\"art-8-p-1-a\"></a>**(a)** the operation of the IT systems satisfies the data reporting services provider's regulatory obligations;\n\n    <a id=\"art-8-p-1-b\"></a>**(b)** compliance and risk management controls embedded in IT systems work as intended;\n\n    <a id=\"art-8-p-1-c\"></a>**(c)** the IT systems can continue to work effectively at all times.\n\n2. <a id=\"art-8-p-2\"></a>A data reporting services provider shall also use the methodologies referred to in paragraph 1 prior to and following the deployment of any updates of the IT systems.\n\n3. <a id=\"art-8-p-3\"></a>A data reporting services provider shall promptly notify the competent authority of its home Member State of any planned significant changes to the IT system prior to their implementation.\n\n4. <a id=\"art-8-p-4\"></a>In the case of ARMs, the notifications referred to in paragraph 3 shall also be made to any competent authority to whom the ARM submits transaction reports.\n\n5. <a id=\"art-8-p-5\"></a>A data reporting services provider shall set up an on-going programme for periodically reviewing and, where needed, modifying the development and testing methodologies.\n\n6. <a id=\"art-8-p-6\"></a>A data reporting services provider shall run stress tests periodically at least on an annual basis. A data reporting services provider shall include in the adverse scenarios of the stress test unexpected behaviour of critical constituent elements of its systems and communication lines. The stress testing shall identify how hardware, software and communications respond to potential threats, specifying systems unable to cope with the adverse scenarios. A data reporting services provider shall take measures to address identified shortcomings in those systems.\n\n7. <a id=\"art-8-p-7\"></a>A data reporting services provider shall:\n\n    <a id=\"art-8-p-7-a\"></a>**(a)** have sufficient capacity to perform its functions without outages or failures, including missing or incorrect data;\n\n    <a id=\"art-8-p-7-b\"></a>**(b)** have sufficient scalability to accommodate without undue delay any increase in the amount of information to be processed and in the number of access requests from its clients.\n\n","marks":[],"text_hash":"7451ca95c460633160402adbbcaf97ebcbc01f7537b609c527ebd4f6d2da89d1","revision":1}}