What it asks for. Financial entities must use and maintain up-to-date ICT systems, protocols and tools that are appropriate to the magnitude of their operations, reliable, have sufficient capacity to process the data needed for their activities and services, and are technologically resilient.
In practice. Capacity must cover peak order and message volumes, including during stressed market conditions or the introduction of new technology. Doing this well means capacity planning and performance monitoring for critical systems, lifecycle management that identifies end-of-life technology and plans its replacement, stress and load testing, and architectural resilience such as redundancy for systems supporting critical or important functions. Evidence includes capacity reports, test results, technology roadmaps and an asset inventory with support status.
Common gaps. Organisations commonly run unsupported legacy systems for critical functions without a documented risk acceptance, and rarely test capacity under realistic stressed conditions.