Broker-dealers and RIAs are increasingly being challenged as they strive to respond to the coronavirus pandemic while maintaining regulatory compliance. Fortunately for them, guidance from past epidemics may offer ample lessons.
By its very nature, the COVID-19 outbreak triggers SEC and FINRA requirements to carry out and adhere to appropriately designed procedures — specifically, business continuity plans (BCPs) — for dealing with unexpected emergencies, or “significant business disruptions.”
To help guide its members, FINRA has issued many recommendations
While the SEC has not provided comparable guidance specifically to RIAs on its
Under
FINRA has historically emphasized the need for BCPs to include pandemic preparedness, notably during the H1N1 epidemic in 2009. If BDs, or RIAs as well, find that their BCPs did not sufficiently address the demands necessitated by the COVID-19 pandemic, then the regulators point out that they should be evaluating their BCP procedures in response to current events.
Equally, or more importantly, firms are managing the impact and risks posed by factors such as remote work, telework and space-sharing arrangements, while ensuring continuity of communications with customers, counterparties and regulators. The 2013 risk alert spelled out the same obligations for RIAs.
In reviewing their current BCP against the COVID-19 outbreak, BDs and RIAs may ask themselves:
- What are my procedures for monitoring current events to ensure timely activation of BCP procedures?
- How adaptable are my technological and recordkeeping systems to telework or remote work arrangements?
- How well can supervisors perform their required daily tasks when not in the same physical space as their reports?
- Has my firm identified personnel necessary to maintain baseline operations, both remote and at the physical office; which vendors are responsible for critical processes?
- How do these answers vary based on personnel, department, or location?
Given the reliance on information technology and security to support remote work arrangements, wealth management firms may also consider reviewing their BCPs in tandem with their cybersecurity incident response plans.
FINRA’s guidance strongly emphasizes how pandemic-related responses could increase the risk of cyber events. Beyond the clear risks of increased use of remote-office and telework arrangements, elevated levels of anxiety and confusion about the pandemic among firm personnel could boost phishing attacks or other intrusions — some of which could leverage attack vectors such as home wireless networks, personal devices, or cloud storage.
Other attacks may focus on the sense of urgency, emotion and pressure associated with meeting critical business needs during a time of crisis. More training and tailored reminders to employees of the specific risks of remote access can provide positive reinforcement to prior cybersecurity preparedness activities.
Firms could also review their BCPs to make sure that backup personnel for critical roles or relationships have been identified should current personnel become incapacitated or unavailable.
The COVID-19 pandemic and related market turbulence show no signs of abating in the near-term. BDs and RIAs may consider examining their BCPs closely to determine each of their steps in reacting to the significant operational challenges of the pandemic. While the end of this crisis may not be in sight, regulators may look closely at how firms are adapting, and most importantly how well they are protecting their customers.
