Broker-dealers and RIAs are increasingly being challenged as they strive to respond to the coronavirus pandemic while maintaining regulatory compliance. Fortunately for them, guidance from past epidemics may offer ample lessons.
By its very nature, the COVID-19 outbreak triggers SEC and FINRA requirements to carry out and adhere to appropriately designed procedures — specifically, business continuity plans (BCPs) — for dealing with unexpected emergencies, or “significant business disruptions.”
To help guide its members, FINRA has issued many recommendations on its website about how to manage the various risks and impacts of the coronavirus pandemic.
While the SEC has not provided comparable guidance specifically to RIAs on its coronavirus page, the regulator’s August 2013 OCIE risk alert — which was issued following Hurricane Sandy and described its review of RIAs’ BCPs — may be instructive. The SEC interpreted Rule 206(4)-7 of the Advisers Act as including BCPs, based on the advisor’s fiduciary obligations to its clients.
Goldman Sachs warns that U.S. businesses will not see earnings growth in 2020, as a result of the coronavirus. We check in with dealmakers on the potential impact on mid-market M&A. Arsenal buys healthcare search and communications firm. Audax, HarbourVest and Genstar named top three most active PE firms in U.S. deals.
Chris Mier, CFA of Loop Capital, says fiscal policy needs to achieve more at present and believes we are at a comfortable point in the credit cycle. Despite that conviction, he says the coronavirus will serve to slow growth. John Hallacy hosts.
As the COVID-19 virus spreads globally, many U.S. financial institutions are said to be taking steps to protect employees and minimize disruption. But only a handful are sharing specifics, to avoid contributing to any public panic.
Under FINRA Rule 4370, BDs must create, maintain and regularly review a BCP that identifies procedures for operating during an emergency or significant business disruption. Importantly, a broker-dealer’s BCP can, and should, be tailored to the size and needs of the firm, which would include the environment where it operates.
FINRA has historically emphasized the need for BCPs to include pandemic preparedness, notably during the H1N1 epidemic in 2009. If BDs, or RIAs as well, find that their BCPs did not sufficiently address the demands necessitated by the COVID-19 pandemic, then the regulators point out that they should be evaluating their BCP procedures in response to current events.
Equally, or more importantly, firms are managing the impact and risks posed by factors such as remote work, telework and space-sharing arrangements, while ensuring continuity of communications with customers, counterparties and regulators. The 2013 risk alert spelled out the same obligations for RIAs.
In reviewing their current BCP against the COVID-19 outbreak, BDs and RIAs may ask themselves:
- What are my procedures for monitoring current events to ensure timely activation of BCP procedures?
- How adaptable are my technological and recordkeeping systems to telework or remote work arrangements?
- How well can supervisors perform their required daily tasks when not in the same physical space as their reports?
- Has my firm identified personnel necessary to maintain baseline operations, both remote and at the physical office; which vendors are responsible for critical processes?
- How do these answers vary based on personnel, department, or location?
Given the reliance on information technology and security to support remote work arrangements, wealth management firms may also consider reviewing their BCPs in tandem with their cybersecurity incident response plans.
Organizations and firms are donating N95 masks, providing resources at no cost and taking steps to protect employees and practices nationwide from the spreading pandemic.
FINRA’s guidance strongly emphasizes how pandemic-related responses could increase the risk of cyber events. Beyond the clear risks of increased use of remote-office and telework arrangements, elevated levels of anxiety and confusion about the pandemic among firm personnel could boost phishing attacks or other intrusions — some of which could leverage attack vectors such as home wireless networks, personal devices, or cloud storage.
Other attacks may focus on the sense of urgency, emotion and pressure associated with meeting critical business needs during a time of crisis. More training and tailored reminders to employees of the specific risks of remote access can provide positive reinforcement to prior cybersecurity preparedness activities.
Firms could also review their BCPs to make sure that backup personnel for critical roles or relationships have been identified should current personnel become incapacitated or unavailable.
The COVID-19 pandemic and related market turbulence show no signs of abating in the near-term. BDs and RIAs may consider examining their BCPs closely to determine each of their steps in reacting to the significant operational challenges of the pandemic. While the end of this crisis may not be in sight, regulators may look closely at how firms are adapting, and most importantly how well they are protecting their customers.
