Disaster Recovery Site

An exchange's main trading platform can fail. A technical glitch or an unexpected outage can stop it working.

When that happens, the exchange does not just wait for the system to come back. It has a backup site built for exactly this situation.

This backup is the Disaster Recovery Site. The exchange's Standard Operating Procedure requires it to activate this site as part of restoring normal trading as fast as possible.

The Disaster Recovery Site appears in two places in the workbook, each showing a different piece of the same picture:

1. As the exchange's own backup, activated during an outage (Chapter 8, SOP for handling stock exchange outage). When continuous trading on a stock exchange is disrupted, the affected exchange must:
   • inform SEBI immediately by email;
   • inform market participants and other Market Infrastructure Institutions (MIIs) within 15 minutes of the outage, by broadcast message and on its website;
   • allow trading to continue in unaffected segments, and on other, unaffected exchanges;
   • restore normalcy at the earliest, including activating its Disaster Recovery Site;
   • inform market participants at least 15 minutes before the resumption of trading.
2. As one of two layers that can both fail, which is exactly when IRRA is needed (Chapter 6). The Investor Risk Reduction Access (IRRA) platform is described as being "intended to provide an alternative when both the primary trading platform and the disaster recovery sites are experiencing challenges." IRRA is not a substitute for the Disaster Recovery Site in ordinary circumstances — it is the fallback for the rare case where even the DR site cannot restore service, and it works at the trading member level (letting investors square off positions), not at the exchange level (which is what the DR site restores).

The two mechanisms therefore sit at different levels: the Disaster Recovery Site is the exchange's own infrastructure-level backup; IRRA is an investor-facing safety net that only becomes necessary if both the trading member's systems and the exchange's own primary-plus-DR arrangements are simultaneously in trouble.

A stock exchange's primary trading platform suffers a major technical outage at 10:05 am, halting continuous trading in the equity derivatives segment.

Suppose, in a worse scenario, the Disaster Recovery Site also runs into difficulty during the switchover, and a particular trading member's clients cannot reach their positions through either the primary platform or via the exchange's recovery. This is precisely the situation the workbook says IRRA exists for: "an alternative when both the primary trading platform and the disaster recovery sites are experiencing challenges." Affected investors use IRRA to square off open positions and cancel pending orders — the last line of defence once both the exchange's primary and backup infrastructure have failed together.

Chapter 8 (Legal and Regulatory Environment), section 8.7 (SOP for handling stock exchange outage), lists activating the Disaster Recovery Site among the affected exchange's obligations during an outage; Chapter 6, section 6.8 (Introduction of IRRA), separately explains that IRRA exists as a fallback for when the primary platform and the disaster recovery sites are both experiencing challenges. Expect a question on the SOP's sequence of obligations (informing SEBI, the 15-minute participant notification, activating the DR site, the pre-resumption notice), and a question on what IRRA is a backup for.

• The Disaster Recovery Site is exchange-level infrastructure; IRRA is investor-facing and trading-member-level. Do not treat them as the same mechanism — IRRA is specifically for when the DR site (among other things) is also struggling.
• 15 minutes appears twice with different meanings: market participants and MIIs must be informed within 15 minutes of the outage, and informed again at least 15 minutes before trading resumes. These are two separate 15-minute obligations, not one.
• Activating the DR site is one step within "restoring normalcy at the earliest" — it is not described as an automatic, instantaneous switch; the exchange must actively activate it as part of its SOP obligations.
• Trading can continue on unaffected segments and other exchanges during the outage — an outage at one exchange or in one segment does not halt the whole market.
• Do not confuse the exchange's Disaster Recovery Site with a trading member's own backup systems — the SOP passage is about the exchange's obligations during its own outage, a distinct scenario from a trading member's individual technical glitch (which is what triggers IRRA in the first place).