Regulators Issue Joint Staff Review of Firms' Business Continuity and Disaster Recovery Planning

WASHINGTON — The Financial Industry Regulatory Authority (FINRA) today joined the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC)'s Division of Swap Dealer and Intermediary Oversight in issuing a staff advisory on business continuity and disaster recovery planning.

The advisory follows a joint

 by regulators in the aftermath of Hurricane Sandy, which caused widespread damage to Northeastern states and closed U.S. equity and options markets for two days in October 2012. The SEC's Office of Compliance Inspections and Examinations (OCIE), the CFTC's Division of Swap Dealer and Intermediary Oversight, and FINRA issued the advisory to encourage firms to review their business continuity plans so as to improve responses to and reduce recovery time after significant large-scale events.

"Market reliability and resilience are vital to investors and to the fair and efficient operation of capital markets," said OCIE Director Andrew Bowden. "In partnership with our fellow regulators at FINRA and the CFTC, we are sharing these lessons learned from Superstorm Sandy to help industry participants better prepare for future events that threaten to disrupt market operations."

FINRA Executive Vice President Grace Vogel said, "With hurricane season underway, and with the problems from last year fresh in mind, we trust that our member firms will review their business continuity planning procedures against these best practices."

Gary Barnett, Director of the CFTC's Division of Swap Dealer and Intermediary Oversight added, "With this joint effort, we were able to leverage the experience of the entire industry to spread knowledge of best practices and identify areas that need improvement to help our firms be better prepared and better able to respond to disasters."

Drawing on examination observations, the advisory suggests effective practices in the following areas.

• Preparation for widespread disruption
• Planning for alternative locations
• Telecommunications services and technology
• Communication plans
• Regulatory and compliance considerations
• Reviewing and testing

Firms can strengthen their business continuity and disaster recovery plans by implementing these practices as appropriate.