Art.12 Backup policies and procedures, restoration and recovery

Financial entities document backup policies (scope of data and minimum backup frequency set by criticality or confidentiality) and restoration and recovery procedures, set up backup systems whose activation does not weaken security, and test backup and restoration periodically. When restoring with their own systems they restore onto ICT systems kept separate, both physically and logically, from the source system. Recovery time and recovery point objectives are set per function, and integrity checks and reconciliations follow any recovery. Entities other than microenterprises keep redundant ICT capacity; microenterprises decide on redundancy from their risk profile (Art. 12(4)). Further duties apply only to specific entity types: central counterparties must be able to recover every transaction in progress when the disruption hit, data reporting service providers keep backup and restoration facilities, and central securities depositories keep a geographically distant secondary processing site (Art. 12(3) and (5)). Entities listed in Article 16(1) are outside this Article and follow the simplified framework of Article 16 instead.

Source: DORA (Regulation (EU) 2022/2554), Art.12. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.