## _cr15254 — IMF staff assessment (FSAP mission), Norway

## Source details

**Canonical URL:** [_cr15254 — IMF staff assessment (FSAP mission), Norway](https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr15254.pdf)

## Other formats

- [Markdown version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr15254.pdf.md)
- [Structured JSON version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr15254.pdf.json)

---

### Overview of the FMI landscape
- Five FMIs located in Norway.
- Composition of FMIs:
  - Four interbank payment systems, including the Norges Bank Settlement System (NBO), the Norwegian Interbank Clearing System (NICS), and two private settlement systems.
  - One central securities depository that also serves as a securities settlement system (Verdipapirsentralen, VPS/VPO).
  - No trade repositories.
  - Two systemically important foreign central counterparties (CCPs) have branches in Norway.
- Interdependencies and links:
  - NBO linked to the CLS system (supports 17 eligible currencies, including the Norwegian krone).
  - VPS has indirect links to Clearstream (Luxembourg) and Euroclear (Belgium).
  - Licensed foreign CCPs providing cross-border services in Norway include LCH.Clearnet (U.K.), European Commodity Clearing (ECC, Germany), Nasdaq OMX Clearing AB (Sweden), and SIX x-clear (Switzerland). SIX x-clear Norwegian branch has links with LCH.Clearnet.

### Key operational and structural details
- Norges Bank Settlement System (NBO)
  - Settles interbank positions on a gross and net basis across accounts held at Norges Bank.
  - Settles clearing positions from NICS, VPS, and SIX x-clear Norwegian Branch.
  - Receives payments to/from the CLS system.
  - Daily operational hours: from 5.30 a.m. to 4.30 p.m. (4.00 p.m. closing time in the summer).
  - 21 direct participants in settlement of net positions from the NICS.
  - 109 smaller banks participate indirectly through a private settlement bank.
  - Norges Bank holds the accounts of 131 banks.
- Norwegian Interbank Clearing System (NICS)
  - Multilateral clearing for small-value payments (card, credit, debit transfers).
  - Net positions settled in NBO at four intervals: 5:30 a.m., 11:00 a.m., 1:30 p.m., and 3:30 p.m.
  - Large-value transactions relayed on a gross basis for settlement in the NBO.
- Private settlement systems
  - DNB and Sparebank 1 SMN operate private settlement systems and are direct participants in the NBO as first-tier banks and act as second-tier banks for indirect participants.
  - There were 97 and 11 small bank participants in the DNB and Sparebank 1 SMN settlement systems at end-2014, respectively.
- Verdipapirsentralen (VPS / VPO)
  - Records owners/holders of rights to registered financial instruments and handles transfers; functions as a securities settlement system (VPO).
  - As of end-2014, there were 70 members: 37 direct and 33 indirect participants.
  - Payments between direct participants for trades in equities, equity capital instruments, listed funds, notes and bonds are settled in the VPO.
  - Securities are netted and settled at the CSD; settlement of securities takes place after netting and settlement of cash on a delivery versus payment (DVP) basis at Norges Bank.
  - Two settlement cycles (within 6.20 a.m. and 12.30 p.m.).

### Assessment of oversight and supervisory framework
- Assessment based on the CPMI‑IOSCO Principles for Financial Market Infrastructures (PFMIs).
- Authorities and legal basis:
  - Norges Bank and the Financial Supervisory Authority of Norway (FSA) responsible for oversight and supervision of FMIs.
  - Legal powers derive from the Norges Bank Act, Payment Systems Act, Financial Supervision Act, Securities Register Act, Securities Trading Act, and relevant ICT and payment institution regulations.
  - Licensing regimes well established.
  - Ministry of Finance published a consultation paper to consider a prescript to clarify insolvency provisions in the Payment Systems Act.
- Cooperation and resources:
  - Cooperative arrangements established to share responsibilities in supervision and oversight between Norges Bank and the FSA.
  - Resources to discharge supervisory and oversight duties appear sufficient for both Norges Bank and the FSA.
  - FSA technical and operational know-how shared with Norges Bank under cooperative arrangements.
  - Norges Bank cooperates with other foreign central banks in oversight of CLS under an agreed protocol, and is establishing cooperative oversight arrangements with overseas authorities for foreign-based CCPs licensed to operate in Norway.
- Disclosure and standards:
  - All Norwegian FMIs completed assessments against the CPMI‑IOSCO PFMIs and are improving observance where needed.
  - Evaluation and rating results published in Norges Bank’s Financial Infrastructure Report.
  - Criteria to identify FMIs subject to supervision and oversight have been established.
  - VPS and Oslo Clearing have publicly disclosed their responses to the CPMI‑IOSCO Disclosure Framework for FMIs in accordance with Principle 23.

### Emerging operational risks and vulnerabilities
- Operational stability: Norwegian payment systems have a good record of operational stability; stability and structural issues largely addressed since FSAP 2005.
- Identified operational risks:
  - Failure of shared infrastructure (evidenced by a major bank terminating an outsourcing contract with a CSP in favor of an overseas service provider).
  - Business continuity plans lack clear recovery time objectives and end-of-day settlement goals.
  - Primary and secondary sites for payment systems do not appear to have completely distinct risk profiles.
  - Operational risks from routine software maintenance; addressed through insourcing IT application skills and setting up an alternative third site.
  - Cyber risks emerged as a potential source of systemic risk.
  - High dependence on a single telecommunications provider could be a single point of failure.

### Systemic importance and concentration (NBO and other FMIs)
- NBO’s average daily turnover amounted to around 200 billion NOK in 2014.
- Around 90 percent of total transaction values were concentrated in the top five participants.
- The average daily turnover as a percentage of gross domestic product was around 6 percent in 2014.
- Other FMIs with significant daily turnover include the NICS, VPO, and CLS.
- Table 2 (as presented in source) — Average Daily Turnover in Selected FMIs in 2014:
  - NBO: Gross (in billion NOK) 19812254
  - NICS: 361
  - VPO:
  - CLS:
  - In percent of GDP 6.33.91.7 11.5
- CLS links and metrics:
  - CLS participates in the NBO and holds an account in Norges Bank, used to transact all incoming and outgoing payments in NOK from correspondent banks in Norway.
  - The NOK and 16 other eligible currencies are settled by CLS Bank International located in the U.S.
  - One Norwegian bank participates directly as a settlement member in CLS.
  - There are 33 Norwegian indirect participants (third parties).
  - Four banks act as liquidity providers.
  - CLS average daily turnover, measured by settlement and pay-ins of NOK, amounted to 361 billion NOK and 7.8 billion NOK, respectively, in 2014.

### Foreign CCPs licensed to provide cross‑border services in Norway
- Four foreign CCPs licensed, including two that are systemically important.
- Swiss CCP SIX x-clear Ltd
  - Authorized by the Norwegian Ministry of Finance to act as a CCP in Norway.
  - On May 1st, 2015, Oslo Clearing was legally integrated into the Swiss CCP SIX x-clear.
  - SIX x-clear Norwegian Branch clears equities, equity derivatives, and securities lending transactions in NOK; participates in VPO with its own settlement account both in VPS and at Norges Bank.
- UK CCP LCH.Clearnet Ltd
  - Operates on Oslo Børs, providing clearing services in NOK and interoperability with the SIX x-clear Norwegian Branch.
  - LCH.Clearnet Ltd is an international CCP with over 170 members and has no branch in Norway.
  - Considered a systemically important foreign CCP in Norway.
  - LCH.Clearnet Swap Clear service includes Norwegian members such as DNB.
- German CCP European Commodity Clearing (ECC) Ltd
  - Operates on Norexeco; ECC has not commenced clearing in Norway as Norexeco is not yet in operation.
  - ECC is licensed as a CCP in Germany in accordance with EMIR and has no branch in Norway.
- Swedish CCP Nasdaq OMX Clearing AB
  - Operates through its Norwegian branch Nasdaq OMX Oslo NUF.
  - CCP for secondary listed Norwegian equity derivatives on the Stockholm stock exchange and other commodity derivatives; main currencies are euro and USD.
- Norwegian banks are also clearing members in foreign CCPs including Eurex Clearing, EuroCCP, and ICE Clear Europe.

### Major changes and ongoing reforms
- Follow-up since FSAP 2005:
  - Mitigants for two-tiered settlement arrangements; Norges Bank receives reports on breaches to limits provided by private settlement banks to their tier two banks.
  - Daily clearing in the NICS increased from two to four sessions.
  - Netting of payments in different formats merged.
  - Payments larger than 25 million NOK are automatically excluded from netting in the NICS and are settled on a gross basis at the NBO for direct participants.
  - Switchover to direct participation in the NBO due to failure of a private settlement bank tested; results suggested sufficient liquidity for a one day disruption.
  - Consultation paper (in Norwegian) published by the finance ministry on February 18th, 2015, due for comments on May 19th, 2015, includes a prescript to clarify insolvency provisions in the Payment Systems Act. If effective, Norges Bank and VPS will be able to change rules so transactions from a failed participant in the securities settlement system can be settled even in case of insolvency.
- Norges Bank settlement system changes
  - New settlement system in 2009 (second generation RTGS) based on off‑the‑shelf software and outsourcing of IT operations.
  - Outsourcing began in 2002 for NBO-related IT operations; all Norges Bank IT-related operations outsourced as of late-2009.
  - First generation RTGS system developed in-house in 1999.
- European regulation and platform developments
  - Norwegian Parliament will be voting on EMIR and the Central Securities Depositories Regulation (CSDR); EMIR and CSDR not currently integrated into the EEA Agreement.
  - Political solution agreed on incorporation of EU Regulations establishing the European Supervisory Authorities into the EEA Agreement; technical details being negotiated.
  - If approved, ESA will be given new competences to adopt legally binding decisions towards national surveillance authorities and financial institutions.
- TARGET2‑Securities (T2S) and VPS
  - VPS positive about joining T2S.
  - T2S expected to start operations by June 2015; CSDs migrate in four waves until February 2017.
  - VPS plans to introduce a new system for securities registration and settlement by 2017.
  - VPS will discuss potential participation in T2S in 2015, involving market participants and Norges Bank.
  - Prerequisite for VPS’ participation in T2S is for Norges Bank to place the Norwegian krone at disposal in T2S.

### Effectiveness of oversight and supervision framework (findings)
- Division of responsibilities:
  - FMIs licensed under the Payments Systems Act (Section 2) supervised by Norges Bank.
  - FMIs licensed under the Financial Supervision Act (Section 1) supervised by the FSA.
  - Two publicly disclosed cooperative arrangements determine information exchange and joint consultations, including during a crisis.
- Criteria for identifying FMIs: ten FMIs subject to supervision and oversight; six identification criteria published (number of transactions and values; type of participants; markets impacted; market shares; interconnectedness; available alternatives).
- Legal powers and scope:
  - Norges Bank Act (Section 27 and Circular 30.11.2005 nr. 1351) empowers Norges Bank to obtain information about an FMI.
  - Payment Systems Act (Sections 2–9) gives Norges Bank legal powers to require changes in licensed payment systems (NICS and DNB) but not cover other FMIs (VPS, Sparebank 1 SMN, Oslo Clearing) supervised by the FSA.
  - FSA can order an FMI to act according to PFMIs if justifiable under Norwegian law.
- Reporting and monitoring:
  - NBO and licensed payment systems subject to reporting requirements; critical disruptions must be notified immediately.
  - Quarterly and annual reporting requirements on operational disruptions, participation, turnover, exposure, or planned changes.
  - Norges Bank has semiannual meetings with all FMIs under its oversight and collects quantitative data on direct and indirect participants.
  - Norges Bank has online access to information in VPS to monitor securities settlement activity (VPS Settlement Benchmark; VPS Oppgjørsinfo).
- Resources and staffing:
  - Norges Bank’s Financial Infrastructure Unit staffed with eight persons, mainly economists; relies on FSA staff for IT and operational know‑how.
  - FSA organizes FMI supervision through:
    - VEPIN Section: 15 employees; 5 work full time on infrastructure supervision (including 2 lawyers and 3 economists).
    - ITBET Section: seven experienced employees; responsible for supervising IT systems and preparing the Risk and Vulnerability Analysis Report.

### Separation of NBO oversight and operations; self-assessments and disclosure
- Separation of responsibilities:
  - NBO operations: Interbank Settlement Unit in the Markets and Banking Services Department.
  - NBO oversight: Financial Infrastructure Unit in the Financial Stability Department.
  - Conflicts of interest are escalated to the Governor and Deputy Governor.
  - Interbank Settlement Unit completed a self-assessment for comparison by the Financial Infrastructure Unit.
- Self-assessments and publication:
  - All FMIs in Norway completed self-assessments following Norges Bank’s request.
  - Norges Bank’s assessments largely consistent with FMI evaluations and published in the Financial Infrastructure Report of 2014.
  - VPS and Oslo Clearing have published information according to Principle 23; all FMIs were assessed as fully observing Principle 23 despite only two public disclosures.
- Inconsistencies and validation need:
  - VPS’ disaster recovery and business continuity rules require systems to be operational within four hours (instead of two hours); nevertheless VPS assessed as fully observing Principle 17.
  - Recommendation to compare evaluation results across FMIs to validate consistency.

### Oversight of operational risk and critical service providers (CSPs)
- Suggested actions:
  - Deepen cooperation between Norges Bank and the FSA in assessing operational risk in the NBO, leveraging FSA’s operational and technical expertise.
  - Adopt CPMI‑IOSCO Assessment Methodology for the Oversight Expectations Applicable to Critical Service Providers.
  - Establish specific oversight expectations for extensively outsourced, systemically important payment systems covering:
    - risk identification and management;
    - information security;
    - reliability and resilience;
    - technology planning;
    - communication with users.
  - Assessments of CSPs should include assigned ratings, publicly disclosed, and used as basis for contract renewal.
- Current cooperative arrangements:
  - Two domestic cooperation agreements between Norges Bank and the FSA; invitations to observe inspections and joint annual conference on payment systems, IT, and risks.
  - Financial Infrastructure Crisis Preparedness Committee (BFI): established October 2000; current mandate appears narrowly focused on IT incidents; holds three regular meetings annually and arranges at least one contingency exercise a year.
  - Authorities should include crisis management in cooperation arrangements, broaden BFI’s role to cover all FMI-related risks, and specify roles, responsibilities, and potential tools to manage a crisis.
  - Recommended crisis scenarios to cover: default of a clearing member in a CCP; participant failure in securities settlement; simultaneous cyber attack on primary and secondary sites of a payment system.
- International cooperation:
  - Norges Bank cooperates with foreign central banks to oversee CLS.
  - FSA participates in four EMIR supervisory colleges, signed ESMA MOU, observer in ESMA Board of Supervisors Meetings, and participates in international committees.
  - Cooperative oversight arrangements for foreign-based CCPs planned: MOU with Swiss authorities for SIX x-clear Ltd; discussions with Bank of England for LCH.Clearnet Ltd. Licenses issued by the Ministry of Finance to foreign CCPs include a condition regarding MOU for the FSA; foreign authorities would act as lead overseer.

### Operational risk findings and metrics
- Service availability:
  - NBO availability was close to 100 percent in 2014.
  - NBO Online availability was 99.99 percent.
  - The SIL system was 100 percent.
- NICS operational disruptions:
  - Continuously decreased since start-up in 1998, but three major disruptions in 2013–2014:
    - March 18, 2013: severe network problems led to communication failure for nearly 3 hours between participating banks and the NICS.
    - February 4 and 6, 2014: connection problems between the NICS and SWIFT disrupted receipt and processing of SWIFT transactions; disruptions lasted over an hour for one incident and was slightly above two hours for the other.
- Shared infrastructure failures:
  - Two serious incidents in 2013 involved network outages at two major IT service providers lasting between 2 and 4 hours; continuity solutions did not function properly.
  - One major bank ended part of its contractual agreement with an IT service provider and switched to an overseas service supplier.
  - These shared IT suppliers also serve as CSPs for many FMIs, creating tight interdependencies.
  - NBO has a dedicated infrastructure with its CSP, mitigating shared-infrastructure risks.
- Back-up systems and recovery objectives:
  - NBO designed with full redundancy and no single point of failure; requirement for resumption of operations within 2 hours and settlement by the end of the day can be achieved via automatic switch to redundant components.
  - Recovery time objectives and end-of-day settlement goals need to be clearly established in business continuity plans.
- Primary/secondary site risk profiles:
  - Locations of NBO and NICS primary and secondary sites do not appear to have completely distinct risk profiles.
  - Routine software maintenance errors can be time-consuming (several days) to locate and correct.
  - NBO strategy for 2014–16 includes strengthening internal IT expertise and an enhanced contingency solution: alternative shared recovery site using SWIFT’s MIRS planned for second half of 2015, activatable within a maximum of 2.5 hours and designed to back-up an RTGS system for up to a month.
  - NICS alternative clearing solution assessments do not appear to include a similar alternative third site.
- Cyber risks:
  - Complex and high frequency attacks could disrupt functionality, availability, and data integrity.
  - Recent payment card breaches and card fraud reported by the FSA provide lessons for FMIs.

### Recommendations on operational risk (selected)
- Report service availability for the NICS and private settlement banks (NB).
- Establish clear recovery time objectives:
  - For the NBO and NICS, include recovery time objectives in business continuity plans: critical IT systems need to resume operations within two hours following disruptive events and ensure end of day settlement following disruptions, even in extreme circumstances.
  - Applicable to other FMIs, particularly VPS which appears to have a recovery time objective of 4 hours.
- Maintain alternative settlement arrangements:
  - Planned third site for the NBO; maintain, document, and test alternative settlement methods (including manual paper based procedures) if this does not increase operational risk.
  - For the NICS, assess feasibility of a third site as part of alternative clearing solution assessments.
- Insource IT application skills for the NBO to ensure sufficient in‑house skills within Norges Bank.
- Monitor critical service providers:
  - Establish robust arrangements for selection and substitution of CSPs, timely access to all necessary information, and proper controls and monitoring tools.
  - Use authorities’ assessment results of CSPs against international standards as basis for contract renewal.
  - CSPs should develop recovery plans in line with international guidance.
- Analyze risks in secondary sites and relocate if necessary to achieve distinct risk profiles.
- Examine the use of NBO Online as part of contingency arrangements.

### Governance, risk management gaps, and CSP financial resilience
- NBO risk management framework:
  - Designed in line with the Regulation on Internal Control and Risk Management at Norges Bank and internal rules; Executive Board adopted revised Principles for Risk Management in 2013.
  - Risks managed at four levels and regularly reported to senior management.
  - Comprehensive risk analysis covers hardware, communications, software failures, external attacks, disloyal personnel, and supplier-related technical failures and lack of expertise.
  - Operational risk reporting and control structure includes daily risk analysis by operational units; executive directors report through the Risk Management Unit to the Governor quarterly and to the Executive Board twice a year; Internal Audit ensures effective internal controls.
- Gaps for the NICS:
  - Lack of a comprehensive risk management framework for the NICS; NICS Operations Office lacks a framework independent from its CSP, and has limited dedicated full‑time employees.
  - NICS Operations Office in process of establishing a comprehensive risk management framework.
  - Mission concurs with Norges Bank’s assessment recommending improvements in observance of Principles 2, 3, and 17.
- CSP considerations:
  - Norwegian payments system largely dependent on CSPs (mainly IT and messaging providers).
  - Authorities started to identify CSPs for the NBO and NICS.
  - Assessments of CSP financial strength and risk management practices against CPMI‑IOSCO PFMI’s Annex F planned for 2015.
  - Competition and supplier changes could affect FMIs; Norges Bank capable of ensuring continuity and therefore not required to prepare a financial recovery and wind‑down plan, but its CSP should establish appropriate recovery and wind‑down plans.
  - For the NICS, NICS Operations Office does not have a recovery and wind‑down plan due to federation status of Finance Norway; a financial recovery and wind‑down plan for its CSP is included in the NICS risk management framework.
- Telecommunications dependency:
  - High dependence on a single telecommunications provider noted; alternative routing in contingency arrangements should be addressed.
  - Existing redundancy and recoverability measures exist; development of alternative routing methods recommended.
  - Example contingency channel: NBO Online (web‑based banking application) could be considered as contingency route for submission of payment orders.

### Main recommendations and timeframes (selected from Table 1)
- Supervision and oversight of FMIs
  - Conduct a joint assessment of the NBO’s operational risk (NB, FSA) — Near-Term
  - Establish oversight expectations for critical service providers of systemically important payment systems (NB, FSA) — Immediate
  - Assess NBO and NICS critical service providers against oversight expectations, subject to assigned ratings and public disclosure (NB, FSA) — Near-Term
  - Enhance domestic cooperation agreements to handle crisis events and broaden the role of the Financial Infrastructure Crisis Preparedness Committee (NB, FSA) — Immediate
  - Enter into foreign cooperation arrangements to oversee and supervise CCPs licensed to operate in Norway, expandable to crisis cooperation (MOF, NB, FSA) — Near-Term
  - Adopt the prescript for the Payment Systems Act to address insolvency provisions for failed participants in the securities settlement system (MOF, NB) — Near-Term
  - Enhance transparency of the FSA’s FMI policy through its Risks and Vulnerability Analysis Report and website (FSA) — Immediate
  - Adopt the CPMI‑IOSCO Quantitative Disclosure Standards for Central Counterparties (NB, FSA) — Immediate
- Operational risk management in payment systems
  - Report service availability for the NICS and private settlement banks (NB) — Near-Term
  - Establish clear recovery time objectives for FMIs (NB) — Immediate
  - Maintain alternative settlement arrangements to handle contingencies, including manual procedures (NB) — Near-Term
  - Insource IT application skills for the NBO (NB) — Near-Term
  - Analyze risks in secondary sites (NB, FSA) — Near-Term
  - Establish a comprehensive risk management framework for the NICS (NB) — Near-Term
  - Promote greater transparency with public disclosure of responses to the CPMI‑IOSCO Disclosure Framework for FMIs (NB) — Near-Term
  - Examine the use of NBO Online as part of contingency arrangements (NB, FSA) — Near-Term

Note on timing: “Immediate” is within one year; “near-term” is 1–3 years; “medium-term” is 3–5 years. Actors: Ministry of Finance (MOF), Norges Bank (NB), and Financial Supervisory Authority (FSA).

*Source: EXECUTIVE SUMMARY and selected sections, IMF staff assessment (FSAP mission), Norway (content unit _cr15254).*

### EXECUTIVE SUMMARY ___________________________________________________________________________ 4

### EXECUTIVE SUMMARY

### Overview of the FMI landscape
- Norway has a modern and stable financial market infrastructure (FMI). Five FMIs are located in Norway.
- Composition of FMIs:
  - Four interbank payment systems, including the Norges Bank Settlement System (NBO), the Norwegian Interbank Clearing System (NICS), and two private settlement systems.
  - One central securities depository that also serves as a securities settlement system (Verdipapirsentralen, VPS/VPO).
  - There are currently no trade repositories.
  - Two systemically important foreign central counterparties (CCPs) have branches in Norway.
- Interdependencies and links:
  - The FMI landscape has tight interdependencies and includes links with foreign FMIs.
  - The NBO is linked to the CLS system (supports 17 eligible currencies, including the Norwegian krone).
  - VPS has indirect links to Clearstream (Luxembourg) and Euroclear (Belgium).
  - Licensed foreign CCPs providing cross-border services in Norway include LCH.Clearnet (U.K.), European Commodity Clearing (ECC, Germany), Nasdaq OMX Clearing AB (Sweden), and SIX x-clear (Switzerland). SIX x-clear Norwegian branch has links with LCH.Clearnet.

### Key operational and structural details
- Norges Bank Settlement System (NBO)
  - Settles interbank positions on a gross and net basis across accounts held at Norges Bank.
  - Settles clearing positions from NICS, VPS, and SIX x-clear Norwegian Branch.
  - Receives payments to/from the CLS system.
  - Daily operational hours: from 5.30 a.m. to 4.30 p.m. (4.00 p.m. closing time in the summer).
  - 21 direct participants in settlement of net positions from the NICS.
  - 109 smaller banks participate indirectly through a private settlement bank.
  - Norges Bank holds the accounts of 131 banks.
- Norwegian Interbank Clearing System (NICS)
  - Jointly owned system for receiving and clearing payment transactions.
  - Multilateral clearing for small-value payments (card, credit, debit transfers).
  - Net positions settled in NBO at four intervals: 5:30 a.m., 11:00 a.m., 1:30 p.m., and 3:30 p.m.
  - Large-value transactions relayed on a gross basis for settlement in the NBO.
- Private settlement systems
  - DNB and Sparebank 1 SMN operate private settlement systems and are direct participants in the NBO as first-tier banks and act as second-tier banks for indirect participants.
  - There were 97 and 11 small bank participants in the DNB and Sparebank 1 SMN settlement systems at end-2014, respectively.
- Verdipapirsentralen (VPS / VPO)
  - Records owners/holders of rights to registered financial instruments and handles transfers.
  - Functions as a securities settlement system (VPO).
  - As of end-2014, there were 70 members: 37 direct and 33 indirect participants.
  - Payments between direct participants for trades in equities, equity capital instruments, listed funds, notes and bonds are settled in the VPO.
  - Securities are netted and settled at the CSD; settlement of securities takes place after netting and settlement of cash on a delivery versus payment (DVP) basis at Norges Bank.
  - Two settlement cycles (within 6.20 a.m. and 12.30 p.m.).

### Assessment of oversight and supervisory framework
- The assessment is based on the CPMI-IOSCO Principles for Financial Market Infrastructures (PFMIs).
- Authorities and legal basis:
  - Norges Bank and the Financial Supervisory Authority of Norway (FSA) are responsible for oversight and supervision of FMIs.
  - Legal powers derive from the Norges Bank Act, Payment Systems Act, Financial Supervision Act, Securities Register Act, Securities Trading Act, and relevant regulations relating to the use of information and communications technology, and payment institutions.
  - Licensing regimes are well established.
  - The Ministry of Finance has published a consultation paper to consider a prescript to clarify insolvency provisions in the Payment Systems Act.
- Cooperation and resources:
  - Cooperative arrangements established to share responsibilities in supervision and oversight between Norges Bank and the FSA.
  - Resources to discharge supervisory and oversight duties appear to be sufficient for both Norges Bank and the FSA.
  - FSA technical and operational know-how are shared with Norges Bank under cooperative arrangements.
  - Norges Bank cooperates with other foreign central banks in oversight of CLS under an agreed protocol, and is establishing cooperative oversight arrangements with overseas authorities for foreign-based CCPs licensed to operate in Norway.
- Disclosure and standards:
  - All Norwegian FMIs completed assessments against the CPMI-IOSCO PFMIs and are improving observance where needed.
  - Evaluation and rating results published in Norges Bank’s Financial Infrastructure Report.
  - Criteria to identify FMIs subject to supervision and oversight have been established.
  - VPS and Oslo Clearing have publicly disclosed their responses to the CPMI-IOSCO Disclosure Framework for FMIs in accordance with Principle 23.

### Emerging operational risks and vulnerabilities
- Operational stability: Norwegian payment systems have a good record of operational stability, and stability and structural issues have been largely addressed since the FSAP of 2005.
- Identified operational risks and examples:
  - Failure of shared infrastructure has created risks for FMIs; demonstrated by a major Norwegian bank terminating an outsourcing contract with a CSP in favor of an overseas service provider.
  - Clear recovery time objectives and end-of-day settlement goals appear to be missing from existing business continuity plans.
  - Primary and secondary sites for payment systems do not appear to have completely distinct risk profiles, making them vulnerable to wide scale or major disruptions.
  - Operational risks may arise from routine software maintenance; addressed through insourcing IT application skills and setting up an alternative third site.
  - Cyber risks have emerged as a potential source of systemic risk.
  - High dependence on a single telecommunications provider could be a single point of failure.

### Recommendations (summary)
- Strengthen cooperation to address risks from outsourced critical infrastructures and interdependencies:
  - Conduct a joint assessment by Norges Bank and the FSA of the operational risk in the Norges Bank Settlement System (NBO).
  - Establish oversight expectations for the critical service providers (CSPs) of systemically important payment systems.
  - Enhance domestic cooperation agreements to handle crisis events, and broaden the role of the Financial Infrastructure Crisis Preparedness Committee to cover all FMI-related risks.
  - Enter into foreign cooperation arrangements to oversee CCPs licensed to operate in Norway, including cooperation in times of crisis.
- Strengthen operational resiliency of payment systems:
  - Report the service availability of all payment systems, including the NICS and private settlement banks.
  - Establish clear recovery time objectives to ensure critical IT systems can resume operations within two hours following disruptive events and achieve end of day settlement.
  - Maintain alternative settlement arrangements, including manual paper-based procedures, to allow processing of time-critical transactions in extreme circumstances.
  - Analyze risks in the secondary sites for payment systems.

### Main recommendations and timeframes (from Table 1)
- Supervision and oversight of FMIs
  - Conduct a joint assessment of the NBO’s operational risk (NB, FSA) — Near-Term
  - Establish oversight expectations for critical service providers of systemically important payment systems (NB, FSA) — Immediate
  - Assess NBO and NICS critical service providers against oversight expectations, which are subject to assigned ratings and public disclosure (NB, FSA) — Near-Term
  - Enhance domestic cooperation agreements to handle crisis events, and broaden the role of the Financial Infrastructure Crisis Preparedness Committee to cover all FMI-related risks (NB, FSA) — Immediate
  - Enter into foreign cooperation arrangements to oversee and supervise CCPs that have been licensed to operate in Norway, which could be expanded to cover cooperation in times of crisis (MOF, NB, FSA) — Near-Term
  - Adopt the prescript for the Payment Systems Act to address insolvency provisions for failed participants in the securities settlement system (MOF, NB) — Near-Term
  - Enhance the transparency of the FSA’s FMI policy through its Risks and Vulnerability Analysis Report and website (FSA) — Immediate
  - Adopt the CPMI-IOSCO Quantitative Disclosure Standards for Central Counterparties (NB, FSA) — Immediate
- Operational risk management in payment systems
  - Report service availability for the NICS and private settlement banks (NB) — Near-Term
  - Establish clear recovery time objectives for FMIs (NB) — Immediate
  - Maintain alternative settlement arrangements to handle contingencies, including manual procedures to handle time-critical transactions in extreme circumstances (NB) — Near-Term
  - Insource IT application skills for the NBO (NB) — Near-Term
  - Analyze risks in secondary sites (NB, FSA) — Near-Term
  - Establish a comprehensive risk management framework for the NICS (NB) — Near-Term
  - Promote greater transparency with the public disclosure of responses to the CPMI-IOSCO Disclosure Framework for FMIs (NB) — Near-Term
  - Examine the use of NBO Online as part of contingency arrangements (NB, FSA) — Near-Term

Note on timing: “Immediate” is within one year; “near-term” is 1–3 years; “medium-term” is 3–5 years. Actors: Ministry of Finance (MOF), Norges Bank (NB), and Financial Supervisory Authority (FSA).

*Source: EXECUTIVE SUMMARY, IMF staff assessment (FSAP mission), Norway.*

### 6.      The NBO remains systemically important and highly concentrated. The NBO’s average

### 6.      The NBO remains systemically important and highly concentrated. The NBO’s average

### Systemic importance and concentration
- The NBO’s average daily turnover amounted to around 200 billion NOK in 2014.
- Around 90 percent of total transaction values were concentrated in the top five participants.
- The average daily turnover as a percentage of gross domestic product was around 6 percent in 2014.
- Other FMIs that have significant daily turnover include the NICS, VPO, and CLS.
- Table 2. Norway: Average Daily Turnover in Selected FMIs in 2014 (as presented in source)
  - NBO: Gross (in billion NOK) 19812254
  - NICS: 361
  - VPO: 
  - CLS:
  - In percent of GDP 6.33.91.7 11.5
- Source: Norges Bank.

### Links with CLS and cross‑border settlement
- CLS participates in the NBO and holds an account in Norges Bank, used to transact all incoming and outgoing payments in NOK from correspondent banks in Norway.
- The NOK and 16 other eligible currencies are settled by CLS Bank International located in the U.S.
- One Norwegian bank participates directly as a settlement member in CLS.
- There are 33 Norwegian indirect participants (third parties).
- Four banks act as liquidity providers, which are committed to provide liquidity if necessary to cover outgoing payments.
- CLS helps to mitigate foreign exchange settlement risks through its payment versus payment arrangements.
- CLS average daily turnover, measured by settlement and pay-ins of NOK, amounted to 361 billion NOK and 7.8 billion NOK, respectively, in 2014.

### Foreign CCPs licensed to provide cross‑border services in Norway
- Four foreign CCPs are licensed to provide cross-border services in Norway, including two that are systemically important.
- Swiss CCP SIX x-clear Ltd
  - Authorized by the Norwegian Ministry of Finance to act as a CCP in Norway.
  - On May 1st, 2015, Oslo Clearing was legally integrated into the Swiss CCP SIX x-clear.
  - Clearing services previously provided by Oslo Clearing are now provided by the SIX x-clear Norwegian Branch, which clears equities, equity derivatives, and securities lending transactions in NOK.
  - The SIX x-clear Norwegian Branch participates in VPO with its own settlement account both in VPS and at Norges Bank.
- UK CCP LCH.Clearnet Ltd
  - Operates on Oslo Børs, providing clearing services in NOK for equities traded on Oslo Børs and interoperability with the SIX x-clear Norwegian Branch for equities and derivatives on equities traded on the London Stock Exchange (LSE).
  - Oslo Børs and the LSE have a common order book for equity derivatives.
  - LCH.Clearnet Ltd is an international CCP with over 170 members and has no branch in Norway.
  - LCH.Clearnet Ltd is considered a systemically important foreign CCP in Norway as the amounts cleared are large and important for financial stability.
  - LCH.Clearnet Swap Clear service for interest derivatives includes Norwegian members such as DNB.
- German CCP European Commodity Clearing (ECC) Ltd
  - Operates on the pulp and paper exchange Norexeco and clears commodity derivative trades in euro and USD.
  - As Norexeco is not yet in operation, the ECC has not commenced clearing in Norway.
  - ECC is licensed as a CCP in Germany in accordance with EMIR and has no branch in Norway.
  - According to supplementary requirements in German national legislation, German CCPs also need a banking license. The German banking license is not relevant for the ECC’s Norwegian CCP license.
- Swedish CCP Nasdaq OMX Clearing AB
  - Operates through its Norwegian branch Nasdaq OMX Oslo NUF.
  - This CCP is for secondary listed Norwegian equity derivatives on the Stockholm stock exchange.
  - The Nasdaq OMX Oslo branch is currently a CCP for energy, freight, iron ore, seafood and quota derivatives and electricity certificates.
  - The branch provides clearing in several currencies of commodities derivatives. The main currencies are euro and USD.
- Note: Norwegian banks are also clearing members in foreign CCPs including Eurex Clearing, EuroCCP, and ICE Clear Europe.

### Major changes and ongoing reforms
- Stability and structural issues addressed since FSAP 2005 included:
  - Follow-up measures to mitigate potential spillover risks from two-tiered settlement arrangements; Norges Bank receives reports on breaches to limits provided by private settlement banks to their tier two banks.
  - Daily clearing in the NICS increased from two to four sessions.
  - Netting of payments in different formats has been merged.
  - For direct participants, payments larger than 25 million NOK are automatically excluded from netting in the NICS and are settled on a gross basis at the NBO.
  - The switchover to direct participation in the NBO due to the failure of a private settlement bank was tested with results suggesting the availability of sufficient liquidity for a one day disruption.
  - Further analysis was made on the contagion effects if a bank has insufficient funds to `meet its net settlement obligations.
  - A consultation paper (in Norwegian) was published by the finance ministry on February 18th, 2015, and is due for comments on May 19th, 2015; this includes a prescript to clarify insolvency provisions in the Payment Systems Act.
  - If the prescript becomes effective, Norges Bank and VPS will be able to change their rules so that transactions from a failed participant in the securities settlement system can be settled even in the case of insolvency.
- Norges Bank settlement system changes
  - Norges Bank changed to a new settlement system in 2009.
  - The second generation RTGS system was based on the purchase of off-the-shelf software from an external vendor and the outsourcing of IT operations.
  - Outsourcing has helped reduce costs and mitigated risks from depending on IT expertise from a few central bank staff.
  - First generation RTGS system was developed in-house by Norges Bank’s internal IT department in 1999.
  - The changeover followed the decision to outsource NBO-related IT operations, including the SWIFT interface and collateral management system, to a third party service provider since 2002.
  - All Norges Bank IT-related operations have also been outsourced to the same firm as of late-2009.
- European regulation and platform developments
  - The Norwegian Parliament will be voting on the EMIR and the Central Securities Depositories Regulation (CSDR).
  - EMIR and CSDR have not currently been integrated into the EEA Agreement due to possible inconsistencies with the Norwegian Constitution.
  - Parties have agreed on a political solution on incorporation of the EU Regulations establishing the European Supervisory Authorities into the EEA Agreement; technical details are being negotiated.
  - If approved, both regulations will be included in the EEA Agreement, giving the EFTA Surveillance Authority (ESA) the role of an intermediate authority between Norwegian institutions and ESMA, EBA and EIOPA.
  - ESA will be given new competences to adopt legally binding decisions towards national surveillance authorities and financial institutions.
- TARGET2‑Securities (T2S) and VPS
  - The Norwegian CSD (VPS) is positive about joining the common technology platform T2S.
  - T2S is expected to start operations by June 2015, after which CSDs are expected to migrate to the new system in four waves until February 2017.
  - If VPS joins T2S, it would do so after these waves.
  - The VPS plans to introduce a new system for securities registration and settlement by 2017.
  - VPS will discuss its potential participation in T2S in 2015, involving market participants and Norges Bank.
  - A prerequisite for VPS’ participation in T2S is for Norges Bank to place the Norwegian krone at disposal in T2S.

### Effectiveness of the oversight and supervision framework

A. Regulation, Supervision, and Oversight of FMIs
- Norges Bank and the FSA are the authorities responsible for the oversight and supervision of FMIs in Norway.
- FMIs licensed under the Payments Systems Act (Section 2) are supervised by Norges Bank.
- Norwegian FMIs licensed under the Financial Supervision Act (Section 1) are supervised by the FSA.
- Both authorities jointly supervise and oversee Norwegian FMIs under two publicly disclosed cooperative arrangements, which establish the nature of tasks, cooperation, and division of responsibilities. The cooperative arrangements do not cater for joint supervision but determine information exchange and joint consultations, including during a crisis.
- The criteria for identifying FMIs is clearly defined and publicly disclosed with ten FMIs subject to supervision and oversight.
- Six criteria for FMI identification (published in Norges Bank’s Financial Infrastructure Report and website):
  - (i) number of completed transactions and values;
  - (ii) type of participants;
  - (iii) markets impacted by the system;
  - (iv) market shares;
  - (v) interconnectedness with other FMIs and financial institutions;
  - (vi) available alternatives to using the FMI at short notice.
- For the FSA, the criteria is established by law so all institutions that operate FMIs are subject to licensing and supervisory requirements. The FSA is also a member of IOSCO so supervision is based on the PFMIs.
- For Norges Bank, differences in scope between supervision and oversight:
  - Supervision: ensuring compliance against laws, regulation, and other requirements from the authorities.
  - Oversight: assessments against the CPMI-IOSCO PFMIs, evaluation of related issues on financial stability, and issuance of public statements.

B. Regulatory, Supervisory, and Oversight Powers and Resources
- Legal framework and powers
  - Strong legal basis from Norges Bank Act, Payment Systems Act, Financial Supervision Act, Securities Register Act, Securities Trading Act, and relevant ICT and payment institution regulations.
  - Licensing regimes and authorities in charge are well established.
  - Although supervisory authority for an FMI has legal powers, an overseer generally relies on moral suasion.
  - Norges Bank Act (Section 27 and Circular 30.11.2005 nr. 1351) empowers the central bank to obtain information about an FMI, including statistical information on customers.
  - Payment Systems Act (Sections 2–9) gives Norges Bank legal powers to require changes in licensed payment systems (NICS and DNB), but such powers do not cover other Norwegian FMIs (VPS, Sparebank 1 SMN, and Oslo Clearing), which are supervised by the FSA.
  - Oslo Clearing's and VPS' associated securities settlement systems are also approved by the FSA.
  - Where PFMIs overlap with laws and regulations, Norges Bank induces change by publishing assessment results, requesting FMIs to develop plans to improve observance, and monitoring progress in supervisory and oversight meetings.
  - The FSA can order an FMI to act according to the PFMIs if justifiable according to Norwegian legislation.
- Reporting and monitoring
  - The NBO and licensed payment systems are subject to reporting requirements; critical disruptions need to be notified immediately.
  - Such payment systems are required to submit quarterly and annual reports to Norges Bank on operational disruptions, participation, turnover, exposure, or planned changes.
  - Norges Bank has semiannual meetings with all FMIs under its oversight and collects quantitative data on direct and indirect participants to analyze risk exposures.
  - Norges Bank has online access to information in the VPS to monitor securities settlement activity, including the “VPS Settlement Benchmark” (settlement degree and aggregated positions) and “VPS Oppgjørsinfo” (individual positions for settlement members).
  - The FSA and the police also have access to VPS Oppgjørsinfo.
- Resources and staffing
  - Norges Bank’s Financial Infrastructure Unit, responsible for FMI oversight, is staffed with eight persons, mainly economists.
  - There is access to resources from the research and legal units for specialized analysis such as quantitative analysis of financial risk in CCPs.
  - The Financial Infrastructure Unit does not have staff with expertise on IT and operational issues of FMIs and leverages FSA staff for such know-how under cooperative arrangements.
  - The FSA organizes FMI supervision through two sections:
    - Investment Firm and Infrastructure (VEPIN) Section: responsible for approving SSSs, supervision of CCPs, the Norwegian CSD and SSS, and trading venues. VEPIN has 15 employees where 5 work full time on infrastructure supervision, including 2 lawyers and 3 economists. Other VEPIN staff are involved part-time in FMI supervision.
    - Information Technology and Payment Services Supervision (ITBET) Section: responsible for supervising IT systems of FMIs and institutions under its general supervision, and payment services. ITBET has seven experienced employees and prepares the Risk and Vulnerability Analysis Report and monitors payment services and the threat landscape.

C. Disclosure of Policies with Respect to FMIs
- Norges Bank’s FMI policies are explicit and publicly disclosed in the Financial Infrastructure Report and website, describing differences in scope for supervision and oversight and oversight activities against the PFMIs.
- The FSA's FMI policies are described in Norwegian on its website and Annual Report, but could be made more transparent in English and disclosed through the Risks and Vulnerability Analysis (RAV) Report to provide information to interested parties, including foreign investors and foreign FMIs.

*Source: _cr15254 - 6.      The NBO remains systemically important and highly concentrated. The NBO’s average*

### 19.      Norges Bank’s NBO oversight and operational responsibilities are separated to prevent

### 19.      Norges Bank’s NBO oversight and operational responsibilities are separated to prevent

### Separation of responsibilities and oversight framework
- NBO operations: responsibility of the Interbank Settlement Unit located in the Markets and Banking Services Department.  
- NBO oversight: responsibility of the Financial Infrastructure Unit in the Financial Stability Department.  
- If conflicts of interest arise: directors of both departments raise issues to the Governor and Deputy Governor.  
- Interbank Settlement Unit (as NBO operator) was requested to complete a self-assessment for comparison by the Financial Infrastructure Unit.

### Self-assessments, publication, and disclosure
- All FMIs located in Norway have completed self-assessments following Norges Bank’s request to systemically important FMIs, including the NBO, NICS, DNB Bank, Sparebank 1 SMN, VPS, and Oslo Clearing.  
- Norges Bank’s own assessments were largely consistent with FMI evaluation results and were published in the Financial Infrastructure Report of 2014.  
- Norges Bank’s assessments of VPS and Oslo Clearing were done in cooperation with the FSA.  
- So far only VPS and Oslo Clearing have published information according to Principle 23 on Disclosure of rules, key procedures, and market data of the CPMI-IOSCO PFMI.  
- All FMIs were assessed as fully observing Principle 23, despite only two FMIs publicly disclosing responses to the CPMI-IOSCO Disclosure Framework.

### Inconsistencies and need for validation
- Apparent minor inconsistencies in application of international standards could benefit from further validation:  
  - Only two FMIs publicly disclosed responses to the CPMI-IOSCO Disclosure Framework, yet all FMIs were assessed as fully observing Principle 23.  
  - VPS’ disaster recovery and business continuity rules require systems to be operational within four hours (instead of two hours); VPS was nevertheless assessed as fully observing Principle 17 on Operational risk.  
- Recommendation: compare evaluation results across FMIs to validate consistency.

### Oversight of operational risk and critical service providers (CSPs)
- Norges Bank should deepen cooperation with the FSA in assessing operational risk in the NBO.  
- Leverage FSA’s operational and technical expertise in payment systems for assessment of potential operational risks in the NBO, which has been subject to outsourcing and was assessed as broadly observed.  
- Cooperation could be done within the context of the cooperation agreement to complement the Financial Infrastructure Unit’s skill set without changing formal oversight responsibilities.  
- Norges Bank plans to adopt the CPMI-IOSCO Assessment Methodology for the Oversight Expectations Applicable to Critical Service Providers, and should consider establishing specific oversight expectations for systemically important payment systems that have undergone extensive outsourcing. These expectations should cover five areas:  
  - risk identification and management,  
  - information security,  
  - reliability and resilience,  
  - technology planning, and  
  - communication with users.  
- Assessments should include assigned ratings that are publicly disclosed and used as a basis for contract renewal.

### Cooperation with other authorities and crisis preparedness
- Two domestic cooperation agreements between Norges Bank and the FSA: one addressing tasks pursuant to the Payment Systems Act, and one covering SSSs and clearing houses.  
- Each authority invites the other as observers to relevant supervisory and oversight meetings; meetings address CCPs and SSS/VPS (once or twice a year) and IT-issues in payment systems (four times a year).  
- Norges Bank invited by the FSA to observe oversight inspections and on-site IT-inspections of FMIs or their CSPs.  
- FSA and Norges Bank jointly organize a yearly conference on payment systems, IT, and risks and vulnerability.  
- The Financial Infrastructure Crisis Preparedness Committee (BFI): established October 2000; led by Norges Bank until 2010; later led by FSA’s ITBET Section. The BFI consists of participants from Norges Bank, the FSA, Finance Norway, FMIs, Nets, EVRY, and major banks. It coordinates information sharing in a crisis, identifies source, potential consequences, and measures taken; holds three regular meetings annually and arranges at least one contingency exercise a year.  
- BFI’s role is not mentioned in cooperation agreements and its current mandate appears narrowly focused on IT-related incidents.  
- Authorities should include crisis management in cooperation arrangements, enhance BFI’s role, and indicate roles, responsibilities, and potential tools to manage a crisis. Recommended risk scenarios to cover include default of a clearing member in a CCP, participant failure in the securities settlement, and simultaneous cyber attack on primary and secondary sites of a payment system. Expanding BFI activities does not imply reduction in responsibilities of individual FMI system owners.

### International cooperation and oversight arrangements for foreign CCPs
- Norges Bank cooperates with foreign central banks to oversee CLS and has met with Swedish and Danish central banks on new international standards.  
- FSA participates in four EMIR supervisory colleges, signed the ESMA MOU, is an observer in ESMA Board of Supervisors Meetings, and participates in international committees including ESMA Standing Committees on Post Trading and Secondary Markets and the CPMI-IOSCO commodities working group.  
- Cooperative oversight arrangements for foreign-based CCPs operating in Norway are planned: MOU with Swiss authorities for oversight of SIX x-clear Ltd; discussions with Bank of England for oversight of LCH.Clearnet Ltd. Licenses issued by the Norwegian Ministry of Finance to LCH.Clearnet Ltd, Nasdaq OMX Clearing AB, and the ECC include a condition regarding MOU for the FSA, but not Norges Bank; in all three cases foreign authorities would act as lead overseer.

### Mission recommendations (paragraph 28)
- Conduct a joint assessment of the NBO’s operational risk;  
- Establish oversight expectations for CSPs of systemically important payment systems. This should cover five areas, including risk identification and management, information security, reliability and resilience, technology planning, and communication with users. These expectations could be published in Norges Bank’s Financial Infrastructure Report;  
- Identify, assess, and monitor CSPs. Assessments could be given assigned ratings, disclosed to the public, and used as a basis for renewing contracts with CSPs;  
- Enhance Norges Bank–FSA cooperation agreements to handle crisis events, and broaden the role of the Financial Infrastructure Crisis Preparedness Committee to cover all FMI-related risks;  
- Enhance the transparency of the FSA’s FMI policy through its Risks and Vulnerability Analysis Report and website;  
- Enter into foreign cooperation arrangements to oversee CCPs that have been licensed to operate in Norway, which could be expanded to cover cooperation in times of crisis; and  
- Adopt the prescript for the Payment Systems Act to address insolvency provisions for failed participants in the securities settlement system.

### Selected issues in the payment system — A. Operational Risk (findings and metrics)
- Service availability: NBO availability was close to 100 percent in 2014. NBO Online availability was 99.99 percent. The SIL system was 100 percent.  
- NICS operational disruptions: have continuously decreased since start-up in 1998, but experienced three major operational disruptions during 2013 and 2014:  
  - March 18, 2013: severe network problems led to communication failure for nearly 3 hours between participating banks and the NICS.  
  - February 4 and 6, 2014: connection problems between the NICS and SWIFT disrupted receipt and processing of SWIFT transactions; disruptions lasted over an hour for one incident and was slightly above two hours for the other.  
- DNB settlement system: recorded four operational disruptions in 2013, which did not appear severe or have direct impact on participant banks.  
- Shared infrastructure failures: two serious operational incidents in 2013 involved network outages at two major IT service providers lasting between 2 and 4 hours; continuity solutions did not function properly as planned. One major bank ended part of its contractual agreement with an IT service provider and changed an overseas service supplier. These shared IT suppliers also serve as CSPs for many FMIs, creating tight interdependencies. NBO has a dedicated infrastructure with its CSP, mitigating shared-infrastructure risks.  
- Back-up systems and recovery objectives: NBO designed with full redundancy and no single point of failure; requirement for resumption of operations within 2 hours and settlement by the end of the day can be achieved via automatic switch to redundant components. However, recovery time objectives and end-of-day settlement goals need to be clearly established in business continuity plans.  
- Primary and secondary site risk profiles: locations of NBO and NICS primary and secondary sites do not appear to have completely distinct risk profiles, increasing vulnerability to wide scale or major disruptions. Routine software maintenance errors can be time-consuming (several days) to locate and correct, potentially serving as single points of failure. NBO strategy for 2014–16 stated strengthening internal IT expertise; enhanced contingency solution based on different software planned for second half of 2015 using SWIFT’s MIRS as a shared alternative recovery site, activatable within a maximum of 2.5 hours and designed to back-up an RTGS system for up to a month. NICS alternative clearing solution assessments do not appear to include a similar alternative third site.  
- Cyber risks: complex and high frequency attacks against numerous targets could disrupt functionality, availability, and data integrity; recent payment card breaches and card fraud reported by the FSA provide lessons for FMIs. Management could follow international standards and best practices (Principles 2, 3, and 17 of the CPMI-IOSCO PFMIs), settlement finality, recovery time objective of 2 hours, and end-of-day settlement.

### Operational risk recommendations (paragraph 35)
- Report service availability. For the NICS, report service availability in addition to error reporting; extend reporting to private settlement banks subject to supervision and oversight as FMIs.  
- Establish clear recovery time objectives. For the NBO and NICS, recovery time objectives should be included in business continuity plans: critical IT systems need to resume operations within two hours following disruptive events and ensure end of day settlement following disruptions, even in extreme circumstances. This should be applicable for other FMIs, particularly VPS, which appears to have a recovery time objective of 4 hours.  
- Maintain alternative settlement arrangements. Planned third site for the NBO would mitigate operational risks; maintain, document, and test alternative settlement methods (including manual paper based procedures) if this does not increase operational risk. For the NICS, assessment of alternative clearing solutions could include a feasibility study for a third site.  
- Insource IT application skills for the NBO to ensure sufficient in-house skills within Norges Bank.  
- Monitor critical service providers. Establish robust arrangements for selection and substitution of CSPs, timely access to all necessary information, and proper controls and monitoring tools. Use authorities’ assessment results of CSPs against international standards as basis for contract renewal. CSPs should develop recovery plans in line with international guidance to ensure financial soundness and use risk mitigation measures as needed.  
- Analyze risks in secondary sites. For the NBO and NICS, comparative risk analysis of secondary-site proximity to primary sites; move secondary sites if necessary to locations with distinct risk profiles.

*Source: IMF staff report content unit _cr15254 - 19.      Norges Bank’s NBO oversight and operational responsibilities are separated to prevent*

### 36.      There is a well established risk management framework for the NBO. This framework

### _cr15254 - 36.      There is a well established risk management framework for the NBO. This framework

### Risk management framework for the NBO
- The NBO framework was designed in line with the Regulation on Internal Control and Risk Management at Norges Bank and internal rules issued by the Executive Board and the Governor.
- The Executive Board adopted the revised Principles for Risk Management in compliance with the Ministry of Finance’s Regulation on Risk Management and Internal Control at Norges Bank in 2013.
- Risks are managed at four levels and are regularly reported to senior management.
- Comprehensive risk analysis encompasses:
  - failures in hardware, communications solutions or software;
  - external attacks;
  - disloyal personnel;
  - technical failures and lack of expertise associated with suppliers.
- Operational structure for risk reporting and control includes (from source):
  - operational units, including the Interbank Settlement and IT Units under the Markets and Banking Services Department, conduct daily risk analysis and mitigation measures, with directors reporting to the executive director;
  - executive directors establish risk indicators, and report progress through the Risk Management Unit to the Governor on a quarterly basis and to the Executive Board twice a year;
  - the Risk Management Unit is responsible for Norges Bank’s overall risk assessment and informs the Governor; the Compliance Unit reduces legal/regulatory/internal rules compliance risk;
  - Internal Audit, on behalf of the Executive Board, ensures effective internal controls.

### Gaps in risk management for the NICS
- There is a lack of a comprehensive risk management framework for the NICS; this shortcoming has been raised by the authorities and is being addressed.
- The NICS Operations Office’s CSP has a robust risk management and information security framework, but the NICS Operations Office (which holds the license and has ultimate responsibility) was found to lack the former.
- The NICS Operations Office is currently in the process of establishing a comprehensive risk management framework.
- The mission concurs with Norges Bank’s assessment recommending improvements in observance of:
  - Principle 2 on Governance;
  - Principle 3 on Comprehensive risk management framework;
  - Principle 17 on operational risk.
- Contributing factor: lack of dedicated and full-time employees in the NICS Operations Office, which relies on resources assigned on an ad hoc basis by Finance Norway.

### Mission recommendations (Governance and risk management for NBO/NICS)
- Strengthen the governance of the NICS:
  - increase transparency, including a description of the relationship between Finance Norway’s Payments and Infrastructure Committee, NICS Operations Office, and the CSP;
  - specify and publicly disclose the precise definition for independence, excluding parties with significant business relationships with the FMI, cross-directorships, or controlling shareholdings;
  - establish a risk committee with clear reporting lines.
- Establish a comprehensive risk management framework for the NICS:
  - framework should be independent from the CSP’s risk management framework;
  - establish the role and responsibilities of the NICS Operations Office under Finance Norway (a federation and not a regular company);
  - include a general business risk assessment from the failure of its CSP, and require the CSP to prepare a financial recovery and wind-down plan.
- Promote greater transparency for the NBO and NICS:
  - both FMIs should complete and disclose publicly responses to the CPMI-IOSCO Disclosure Framework for FMIs;
  - responses should be reviewed at least every two years to ensure continued accuracy and usefulness.

### Critical Service Providers (CSPs) — role and risks
- The Norwegian payments system is largely dependent on CSPs, assessed against new international standards.
- CSPs are mainly IT and messaging providers whose continuous and adequate activities are essential to the operations of an FMI, or multiple FMIs.
- International experience suggests considering the SWIFT network, technology firms that operate infrastructures, regional utilities contracted for telecommunications or other infrastructural services, and market-wide data providers as CSPs.
- Authorities have started to identify CSPs for the NBO and NICS.
- Assessments of CSP financial strength and risk management practices against the CPMI-IOSCO PFMI’s Annex F are planned for 2015.

### Financial strength, recovery, and wind-down planning for CSPs
- Competition in the outsourcing sector could lead to supplier or ownership changes, which can impact the operation of FMIs and reveal financial losses or declining profit margins, shift business strategies, or lead to job and skill losses.
- NBO and NICS are vulnerable to such changes but have established sound change management practices.
- Norges Bank (NBO owner/operator) is capable of ensuring continuity of operations in extreme financial circumstances and is therefore not subject to the requirement of preparing a financial recovery and wind down plan.
- Norges Bank’s CSP that operates NBO IT-related components should establish appropriate recovery and wind down plans.
- For the NICS:
  - the NICS Operations Office does not have a recovery and wind down plan due to the federation status of Finance Norway;
  - a financial recovery and wind down plan for its CSP is included in the risk management framework for the NICS Operations Office;
  - the framework includes measures to monitor and manage the general business risk for its CSP.
- Mitigants used: service level agreements, monitoring of service suppliers, setting of availability targets.

### Telecommunications dependency and contingency arrangements
- There appears to be a high dependence on a single telecommunications provider; alternative routing in contingency arrangements should be addressed to mitigate single point of failure risk.
- Existing arrangements include key methods for ensuring telecommunications continuity such as redundancy and recoverability, but development of alternative routing methods would further strengthen operational resiliency and ensure no dependence on a single supplier.
- Contingency procedures and bilateral arrangements should be established for critical functions in the event of total telecommunications network failure.
- Example of contingency channel: while SWIFT serves as the main channel for the largest banks in Norway to submit payment orders to the NBO, an alternative route exists through NBO Online (a web-based banking application allowing participating banks to register payment orders, manage queued orders, monitor account balances, access information on securities pledged to Norges Bank, and make enquiries).
- The feasibility of using NBO Online for contingency purposes could be considered by Norges Bank.

### Mission recommendations (CSPs and telecom contingency)
- Establish oversight expectations for CSPs of systemically important payment systems.
- Identify, assess, and monitor CSPs:
  - assessments could be given assigned ratings, disclosed to the public, and used as a basis for renewing contracts with CSPs.
- Examine the use of NBO Online as part of contingency arrangements.

*Source: _cr15254 - 36.      There is a well established risk management framework for the NBO. This framework*

---


_Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr15254.pdf_