Broker-Dealer Business Continuity Plans and the COVID-19 Crisis: Is Your BCP Adequate?
Broker-dealers should be reviewing their BCPs to confirm that they address the challenges they may face as a result of personnel working remotely in a pandemic situation.
With communities countrywide urging people to self-quarantine if they may have been exposed to the novel coronavirus (COVID-19) and employers being urged to allow employees to work from home, many brokerage firms are implementing their business continuity plans ("BCPs"). FINRA Rule 4370 requires member firms to create and maintain a written BCP that sets forth the firm's procedures relating to an emergency or significant business disruption. Such procedures must: (i) be reasonably designed to enable the firm to meet its existing obligations to customers and (ii) address the firm's existing relationships with other broker-dealers and counterparties. At a minimum, among other things, the BCP must address communications between the firm and its employees, alternate physical location of employees, regulatory reporting, and communications with regulators.
As with other significant disruptive events, the coronavirus outbreak may cause FINRA to reprioritize its BCP examinations in its review of broker-dealer readiness under stress. Consequently, broker-dealers should be reviewing their BCPs to confirm that they address the challenges they may face as a result of personnel working remotely in a pandemic situation, including technological readiness and remote supervision for extended out-of-office stints.
Firms may, for example, consider assigning personnel to back up other employees to ensure that particular tasks (including regulatory filings) are accomplished in a timely manner in the event employees become unavailable. Likewise, firms may want to institute training on various requirements for personnel working from home, including the need to ensure that all communications relating to the broker-dealer's business are captured by firm recordkeeping systems and that the privacy and security of firm systems and firm customer information are maintained.
To the extent a firm discovers that any of its BCP procedures do not work as intended or that its BCP did not include a procedure addressing a particular aspect of its business, the firm should keep a record of those issues and make appropriate changes to its BCP as soon as feasible. This could include upgrading technology or even changing vendors, if necessary, after the crisis has passed. In that way, if subsequent exams show the firm's BCP and its implementation during the crisis was inadequate, the firm will be able to demonstrate that it has learned from its hands-on experience and has proactively addressed any issues.
