Letter from Fabio Panetta to Irene Tinagli, MEP, on the independent review of TARGET incidents in 2020 and the Eurosystem’s response

Fabio Panetta

Member of the Executive Board

Ms Irene Tinagli

Chair of the Committee on Economic and Monetary Affairs (ECON) European Parliament

60, rue Wirtz B-1047 Brussels

Independent review of TARGET incidents in 2020 and the Eurosystem's response

Madam Chair, dear Irene,

ECB-PUBLIC

28 July 2021

L/FP/21/46

I am pleased to inform you that the European Central Bank (ECB) today published the report presenting the results of the independent review1 of incidents that affected TARGET2 and TARGET2-Securities in 2020, in line with our commitment to publish the findings and with the European Parliament's request in its resolution on the ECB Annual Report2.

1 The independent review is available at:

https://www.ecb.europa.eu/press/pr/date/2021/html/Report_external_review_TARGET_Services_incidents_2020.en. pdf

2 See European Parliament resolution of 10 February 2021 on the European Central Bank - annual report 2020, available at: https://www.europarl.europa.eu/doceo/document/TA-9-2021-0039_EN.html.

Address	Postal address
European Central Bank	European Central Bank	Tel.: [phone]
Sonnemannstrasse 20	60640 Frankfurt am Main	E-mail: [e-mail]
60314 Frankfurt am Main	Germany	www.ecb.europa.eu
Germany

ECB-PUBLIC

We also published the Eurosystem's response3, which accepts the recommendations made by Deloitte in its report as well as the general conclusions, and commits to implementing the recommendations in full.

As you may recall, the ECB announced the launch of an independent review in November 20204 after an incident that affected TARGET2 on 23 October 2020, causing an outage of almost ten hours. In total, there were five major incidents related to information technology in 2020 (none of which were cyber-related)5, affecting payment transactions and securities processing of the TARGET Services that are under the responsibility of the Eurosystem and operated by four service-providing national central banks (Deutsche Bundesbank, Banco de España, Banque de France and Banca d'Italia).

The independent review describes the incidents in detail, outlines their consequences for TARGET Services participants and identifies their root causes. It lists weaknesses in several areas, including business continuity management, failover and recovery testing, and communication protocols in crisis situations. Based on these findings, the review issues 18 detailed recommendations.

Measures addressing several of the recommendations have already been agreed upon or implemented. For example, in 2020, following an earlier recommendation by the TARGET2 oversight function, the Eurosystem decided to establish a more comprehensive second line of defence for all the TARGET Services, which has already been partially implemented and which will be fully operational by the end of 2021. The Eurosystem has also improved its external communication with market participants following dedicated industry workshops that were held in the first quarter of 2021.

3 The Eurosystem's response is available at:

https://www.ecb.europa.eu/pub/pdf/other/Eurosystem_response_MIB_report_TARGET_Services_incidents_2020~7b b669032b.en.pdf

1. See "ECB announces independent review of payments system outage", 16 November 2020, available at:https://www.ecb.europa.eu/press/pr/date/2020/html/ecb.pr201116~7b08f0a3c5.en.html.
2. As mentioned in previous correspondence to members of the Committee (see the letter from the ECB President to MEP
   Martin Schirdewan on 22 December 2020, available at: https://www.ecb.europa.eu/pub/pdf/other/ecb.mepletter201229_Schirdewan~95bcf23720.en.pdf?747933c86b8153452 6078cc6413e3fd6, and the letter from the ECB President to MEP Markus Ferber on 21 January 2021, available at: https://www.ecb.europa.eu/pub/pdf/other/ecb.mepletter210122_Ferber~a55c2d402a.en.pdf?ea8715b0cda8a994c92a3 ec16474c529), four incidents affected TARGET2 services in 2020 (on 16 March, 11 August, 23 October and 16 November 2020). Another incident affected TARGET2-Securities (on 25 May 2020).

Page 2 of 3

ECB-PUBLIC

The Eurosystem is committed to decisively implementing the other recommendations as soon as possible, as explained in its response. The ECB will keep the European Parliament and the wider public informed about the deployment of the measures, and we stand ready to discuss the matter further with the members of the ECON Committee.

Yours sincerely,

[signed]

Fabio Panetta

Page 3 of 3