As hurricane season approaches, the securities and commodities industries' principal regulators are effectively encouraging firms to do the equivalent of putting up storm shutters, stocking up on batteries and bottled water, and installing generators.
The Securities and Exchange Commission (SEC), the Financial Industry Regulatory Authority (FINRA), and the Commodities Futures Trading Commission's (CFTC) issued a staff advisory on business continuity and disaster recovery planning. This advisory follows a joint review of the effects of Hurricane Sandy, which closed U.S. equity and options markets on October 29 and 30, 2012, and encourages firms to review and enhance their business continuity plans ("BCP") to improve responses to, and reduce recovery time after, significant large-scale events.
PREPARING FOR WIDESPREAD SERVICE DISRUPTIONS
The guidance encourages firms to create BCPs that consider the possibility of widespread lack of telecommunications, transportation, electricity, office space, fuel, and water. Firms should take into consideration the proximity of vendors to the disaster area and consider using redundant, multiple service providers and secondary and/or back-up services. Besides reviewing their own BCPs, firms should also consider whether vendors providing critical services such as clearance and settlement, banking and finance, trading support, fuel, telecommunications, electricity and other utilities also have adequate BCPs.
Employees might be unable to work remotely in a disaster, since they rely on telephone and internet service for remote access. Therefore, BCPs should provide for alternatives to remote work, especially for key control functions like compliance, risk management, back office operations, and financial and regulatory reporting. Firms' telecommunications infrastructure should also be enhanced as to allow staff to remain fully functional while working from home for both brief and extended periods of time.
SELECTING APPROPRIATE ALTERNATIVE LOCATIONS
Given potential widespread regional disruption in case of disaster, the agencies encourage firms to choose alternate locations that are not in close proximity to the firms' permanent sites, since the storm that hits Manhattan may also hit Jersey City, and both sites might rely on the same critical utility services.
KEEPING TRACK OF EMPLOYEES
The regulators said that it is preferable for firms to implement a centralized process for accounting for all employees instead of relying on each business unit to contact employees individually. In addition, firms should update emergency contact lists frequently, and adopt a variety of methods to communicate with employees.
KEEPING IN CONTACT WITH CUSTOMERS AND COUNTERPARTIES
The guidance suggests that firms consider plans for providing contact information to customers and trading counterparties, and that firm websites be updated with information about operational status and general contact information during an event. Introducing firms are specifically advised to provide on their websites contact information for clearing firms, to enable customers to execute liquidating orders or wire transfers if the introducing firms stop operating, and establish relationships with multiple broker-dealers to facilitate alternate market entry points.
KEEPING UP WITH REGULATORY REQUIREMENTS
Firms should consider time-sensitive regulatory requirements, such as month-end financial processes which should be properly prioritized, as a disaster may occur at any time. Firms should also regularly update their BCPs to account for new regulatory requirements.
TESTING AND UPDATING BCPS
The advisory recommends at least annual, if not more frequent, BCP tests, including full-staff BCP tests to evaluate whether all day-to-day functions, including trade processing, can be performed, regardless of staff location. Firms should incorporate the results of these tests into periodic updates of their BCPs, and should provide at least annual and more frequent training on BCPs to familiarize employees with the plan and their critical preestablished roles.
THE TIME TO REVIEW AND REVISE BCPS IS NOW
The three regulators view market reliability and resilience as important to investors and the efficient operation of capital markets, and expect that, with the hurricane season underway, firms review their BCPs against the best practices set forth in the advisory.
Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
© Morrison & Foerster LLP. All rights reserved
