How’s Your BCP?
Last week, staff at the SEC, CFTC, and FINRA drew some lessons from Hurricane Sandy and warned broker-dealers and other firms to take steps to prepare themselves for natural disasters that could disrupt their operations. As government regulators do, they sprinkled in some abbreviations, so if you have a significant market presence, you should get your get your business continuity plan, or “BCP,” in order.
Some of the recommendations will be common to any large organizations involving knowledge work and a substantial technology component. That is, such firms should consider having or making, among other things:
multiple, redundant services;
reliable remote access so staff can work from home if needed;
alternative locations for backup data centers and offices to avoid succumbing to regional disasters;
generator capacity; and
pre-arrangements for emergency office space or hotels.
Other recommendations are specific to trading firms:
Consider a plan for providing customers and trading counterparties with contact information so business can continue;
Take measures to keep websites up-to-date, including by posting contact information for clearing firms to enable customers to execute liquidating orders or wire transfers;
Establish relationships with multiple broker-dealers to facilitate market entry points.
Regulatory and Compliance Considerations
The joint staff advisory also noted regulatory considerations that should be taken into account. For example, firms should prioritize month-end financial processes to avoid delays in producing data for regulatory computations and financial reporting. Firms should also regularly update their continuity plans to include new regulatory and SRO requirements, and then test those plans at least annually. Finally, firms should consider incorporating stress tests into their continuity plans. They could perform such a test on their liquidity position and review the level of excess customer reserves. Based on this analysis, firms may be better prepared to adjust liquidity or excess reserves before a disruptive event happens.
Preparation like that would obviously be impossible before, say, an earthquake. But a hurricane is a different story, because there is usually some time to get ready before landfall. One can imagine a firm’s egregious disregard of its liquidity position affecting the safety of customers’ assets in such an event. This staff advisory may be laying the groundwork for possible enforcement action if firms ignore those concerns. So how’s your BCP?