FINRA rule 4370
(the “emergency preparedness rule) requires broker-dealers to create and maintain written business continuity plans relating to an emergency or significant business disruption. BCP procedures have to be reasonably designed so the firm can meet its existing obligations to customers.
Firms must disclose the elements of their BCP to new clients and post the BCP on its website if it has one. The document also must be provided to customers and to FINRA staff if requested.
FINRA states that a broker-dealer’s BCP must be appropriate to the scale and scope of its business. The SRO notes there is room for flexibility but at a minimum, a BCP must include the following elements:
- Data backup and recovery;
- All mission critical systems;
- Financial and operational assessments;
- Alternate communications between customers and the firm, and between the firm and employees;
- Alternate physical location of employees;
- Critical business constituent, bank and counterparty impact;
- Regulatory reporting;
- Communications with regulators; and
- How the firm will assure customers’ prompt access to their funds and securities in the event that the firm determines that it is unable to continue its business.
Broker-dealers are required to conduct an annual review of their BCP on an annual basis. You also must update your BCP in the event of any material change to your firm’s operations, structure, business or location.