Broker-dealers and RIAs are increasingly being challenged as they strive to respond to the coronavirus pandemic while maintaining regulatory compliance. Fortunately for them, guidance from past epidemics may offer ample lessons.
By its very nature, the COVID-19 outbreak triggers SEC and FINRA requirements to carry out and adhere to appropriately designed procedures — specifically, business continuity plans (BCPs) — for dealing with unexpected emergencies, or “significant business disruptions.”
To help guide its members, FINRA has issued many recommendations on its website about how to manage the various risks and impacts of the coronavirus pandemic.
While the SEC has not provided comparable guidance specifically to RIAs on its coronavirus page, the regulator’s August 2013 OCIE risk alert — which was issued following Hurricane Sandy and described its review of RIAs’ BCPs — may be instructive. The SEC interpreted Rule 206(4)-7 of the Advisers Act as including BCPs, based on the advisor’s fiduciary obligations to its clients.
The document discusses some considerations involving the use of specialists when auditing financial statements during the pandemic.
Many consumers are taking to the highways and the water for safe getaways during the pandemic — powering one of the few bright spots in lending. However, bankers warn that boomlets usually come with distinctive credit risks.
Conversations have already started about how the increased government expenditures to support citizens during the pandemic will be funded. But resisting the urge to increase taxes may be the best way to support economic growth.
Under FINRA Rule 4370, BDs must create, maintain and regularly review a BCP that identifies procedures for operating during an emergency or significant business disruption. Importantly, a broker-dealer’s BCP can, and should, be tailored to the size and needs of the firm, which would include the environment where it operates.
FINRA has historically emphasized the need for BCPs to include pandemic preparedness, notably during the H1N1 epidemic in 2009. If BDs, or RIAs as well, find that their BCPs did not sufficiently address the demands necessitated by the COVID-19 pandemic, then the regulators point out that they should be evaluating their BCP procedures in response to current events.
Equally, or more importantly, firms are managing the impact and risks posed by factors such as remote work, telework and space-sharing arrangements, while ensuring continuity of communications with customers, counterparties and regulators. The 2013 risk alert spelled out the same obligations for RIAs.
In reviewing their current BCP against the COVID-19 outbreak, BDs and RIAs may ask themselves:
- What are my procedures for monitoring current events to ensure timely activation of BCP procedures?
- How adaptable are my technological and recordkeeping systems to telework or remote work arrangements?
- How well can supervisors perform their required daily tasks when not in the same physical space as their reports?
- Has my firm identified personnel necessary to maintain baseline operations, both remote and at the physical office; which vendors are responsible for critical processes?
- How do these answers vary based on personnel, department, or location?
Given the reliance on information technology and security to support remote work arrangements, wealth management firms may also consider reviewing their BCPs in tandem with their cybersecurity incident response plans.
Organizations and firms are donating N95 masks, providing resources at no cost and taking steps to protect employees and practices nationwide from the spreading pandemic.
FINRA’s guidance strongly emphasizes how pandemic-related responses could increase the risk of cyber events. Beyond the clear risks of increased use of remote-office and telework arrangements, elevated levels of anxiety and confusion about the pandemic among firm personnel could boost phishing attacks or other intrusions — some of which could leverage attack vectors such as home wireless networks, personal devices, or cloud storage.
Other attacks may focus on the sense of urgency, emotion and pressure associated with meeting critical business needs during a time of crisis. More training and tailored reminders to employees of the specific risks of remote access can provide positive reinforcement to prior cybersecurity preparedness activities.
Firms could also review their BCPs to make sure that backup personnel for critical roles or relationships have been identified should current personnel become incapacitated or unavailable.
The COVID-19 pandemic and related market turbulence show no signs of abating in the near-term. BDs and RIAs may consider examining their BCPs closely to determine each of their steps in reacting to the significant operational challenges of the pandemic. While the end of this crisis may not be in sight, regulators may look closely at how firms are adapting, and most importantly how well they are protecting their customers.
