linnugripiblog

Introduction

The ongoing spread of avian flu has raised concerns among governmental and public health officials of a near term pandemic flu. A pandemic flu would involve the person-to-person transmission of a “virulent human flu that causes a global outbreak, or pandemic, of serious illness.”1 Although there is no pandemic flu at this time, were one to occur, it may cause a significant and extended business interruption differing materially from the emergencies recently confronted by member organizations of the New York Stock Exchange LLC (the “Exchange”). For example, a pandemic flu is expected to occur in multiple “waves,” each potentially spanning weeks or longer, and thus might have a substantially greater duration than the blackout of August 14 and 15, 2003, or the terrorist attacks of September 11, 2001. In addition, a pandemic flu is expected to involve outbreaks in numerous domestic and international locations. Therefore, unlike the regional emergencies created by Hurricanes Katrina and Rita, a pandemic flu might impact a member organization’s main office, branch offices, back-up locations, suppliers, and customers, regardless of their geographic diversity.

Due to the concern over a potential pandemic flu, NYSE Regulation, Inc. is issuing this Information Memo to provide guidance to member organizations as to how to assess whether their Business Continuity and Contingency Plans (“BCPs”) would be suitable for a prolonged, widespread public health emergency.2 This memorandum reflects the current state of publicly available information concerning a potential pandemic and commonly accepted strategies for pandemic preparedness. Ultimately, the key to any BCP is flexibility: member organizations should tailor their planning efforts to their particular business models and customer needs, and should become and remain informed about developing pandemic flu projections.

Exchange Rule 446, “Business Continuity and Contingency Plan”

BCPs are mandated by Exchange Rule 446. Briefly, by way of background, Exchange Rule 446(a) requires member organizations to “develop and maintain a written business continuity and contingency plan establishing procedures relating to an emergency or significant business disruption” that is reasonably designed to enable the member organization to meet its existing obligations to customers and addresses the member organization’s existing relationships with broker-dealers and counterparties.3

Exchange Rule 446(c) sets forth ten minimum elements that a BCP must address. They are the following:

1) books and records back-up and recovery (hard copy and electronic); 2) identification of all mission critical systems and back-up for such systems; 3) financial and operational risk assessments; 4) alternate communications between customers and the firm; 5) alternate communications between the firm and its employees; 6) alternate physical location of employees; 7) critical business constituent, bank and counter-party impact; 8) regulatory reporting; 9) communications with regulators; and 10) how the . . . member organization will assure customers prompt access to their funds and securities in the event the . . . member organization determines it is unable to continue its business.

A “mission critical system,” as defined in Exchange Rule 446(e), is any necessary system “to ensure prompt and accurate processing of securities transactions, including order taking, entry, execution, comparison, allocation, clearance and settlement of securities transactions, the maintenance of customer accounts, access to customer accounts and the delivery of funds and securities.” The Exchange has previously stated that in preparing BCPs, member organizations should emphasize having multiple levels of back-ups, a geographic diversity of back-up facilities and outsourced services, up-to-date technology for back-up facilities, a variety of telecommunications options, robust testing of BCPs and back-up facilities, and time recovery standards and business prospects for various situations.4

The Exchange also has stated that a member organization’s BCP must recognize the interdependence of securities industry participants. Specifically, a member organization’s BCP must include “procedures that assess the impact that a significant business disruption would have” on: businesses with which the member organization has an ongoing relationship concerning the support of its operating activities; lending banks; and counterparties such as institutional customers or other broker-dealers.5 Such procedures ought to address “whether alternative actions or arrangements with respect to their contractual relationships with critical business constituents, banks, and counter-parties would be appropriate upon the occurrence of a material business disruption to either party.”6 Furthermore, the Exchange has provided that BCP testing should be coordinated with other institutions, “taking into consideration the broad interdependence among industry participants . . . member organizations should coordinate with key external entities that could cause a BCP to fail such as telecommunications and service providers, subsidiaries and suppliers, and outsourced functions.”7

BCPs should be flexible documents that adjust to emerging threats to business continuity. According to Exchange Rule 446(b), “member organizations must conduct, at a minimum, a yearly review of their business continuity and contingency plan to determine whether any modifications are necessary in light of changes to . . . operations, structure, business or location.” The Exchange has advised that “[r]isk assessment is an essential component of business continuity planning. When preparing, updating, and maintaining a BCP, . . . member organizations must dedicate resources to periodically assess risk factors so that plans remain viable and effective in light of evolving circumstances.”8

At present, member organizations should assess the unique risks posed by a pandemic flu to determine whether their BCPs would be viable in the event that the avian flu were to give rise to a pandemic. In conducting that assessment, member organizations should consider utilizing the Federal government’s Business Pandemic Influenza Planning Checklist, available at http://www.pandemicflu.gov/plan/pdf/businesschecklist.pdf. In addition, member organizations should consider the following guidance.

Guidance Concerning Potential Business Disruptions of a Pandemic Flu

Historically, pandemics have occurred three to four times per century. Thus, regardless of whether the current avian flu causes a pandemic, there remains a substantial risk of a pandemic, involving some disease, in the not too distant future.

In light of the threat of a pandemic, or any biologically based threat, member organizations should review their BCPs and make any necessary modifications. The threat of a pandemic poses unique challenges and therefore requires special planning. Because of the potential business disruption that a pandemic would cause, the securities industry should plan specifically for such an event keeping in mind the following five specific risks:

(1) Pandemics can have multiple strains that arrive in separate waves. The cycles might span many months. Firms therefore should evaluate the viability of their BCPs in the event that they would have to be operative for periods of weeks or months.

(2) The United States government has indicated that it may resort to quarantines in the event of a domestic outbreak, and foreign governments’ reactions may be similar or more drastic. Firms should evaluate the viability of their BCPs in light of potential restrictions on travel, as well as on gatherings of large numbers of people in one location.
(3) Pandemics can have a multinational or global scale.

(4) Pandemics can impact large percentages of the population and of a company’s work force (as many as 30% to 40%). In addition, fear may deter healthy people from attending work.

(5) A pandemic could result in the loss of multiple personnel within the same business unit (including business continuity managers). As a result, firms should consider whether their succession plan is adequately extensive.

Some questions that firms should consider in light of the risks a pandemic poses to their operations include:

- Many health officials believe that a best practice would be to have a multi-tiered response determined by various pandemic-related trigger points. So, for example, if human to human transmission occurred abroad, that would trigger the firm to implement certain contingencies, whereas if an occurrence of the outbreak occurred in the U.S., that would trigger implementations of additional contingencies. Has the firm established escalating contingencies for various trigger points?

- Do the firm and/or firm service providers have the technological infrastructure and capacity in place to support widespread telecommuting and/or operations from back-up sites?

- BCPs may call for the activation of one or more back-up sites in response to certain events. The conventional use of a back-up site is as a response to a geographically localized event. Firms should consider whether a back-up site would be a viable option in the event of a pandemic. If the firm uses a vendor to provide back-up space, has the firm evaluated whether the vendor is capable of providing space in the event that multiple customers require usage simultaneously?

- Has the firm considered the impact of requiring employees to work at a remote location over a long timeframe?

- Has the firm conducted tests, including telecommuting and teleconferencing capabilities, to evaluate its ability to execute both the technological and the logistical aspects of its BCP?
- Does the firm have supervisory, surveillance, and record-keeping systems in place to permit employees to work from home for prolonged periods? Has the firm tested the functionality of such systems? Does the firm have procedures for supervising employees who work from home for prolonged periods?

- Business continuity planning for the financial industry has historically focused particular attention on firms’ clearing and settlement functions as well as on trading operations, both of which are viewed as critical. Does the firm have contingencies in place that ensure functioning of these critical operations in the event of conditions including, but not limited to, limitations on travel and on public gatherings?

- Do any components of the firm’s BCP involve activities or the suspension or modification of business practices that will require regulatory approval? If so, firms should start a dialogue with regulators.
- Has the firm considered the Human Resources implications of a pandemic? Such considerations include, but are not limited to, the operational and financial impact of a significant percentage of the staff being absent or taking short-term disability leave.

- The Federal government has recommended that firms establish partnerships with other members of their sector to provide mutual support and maintenance of essential services during a pandemic. Has the firm identified critical business partners, and has each party determined what it expects of the other during the various conditions that may arise in the event of a pandemic, to ensure that clearing, trading, and other critical functions remain operational? If a firm were to determine, for example, that a critical supplier does not have an adequate BCP or the capability for ensuring supply in the event of a certain trigger, the firm should investigate whether it would require alternative business partners or whether it would be able to consolidate its transactions with fewer business partners.

- How will the firm respond to a shutdown of national mass transit? Has the firm evaluated how to prevent employees from becoming stranded, or how to respond if they are stranded, in the event of a mass transit shutdown while employees are traveling on business?

- Educational programs are an important tool that can help businesses remain functional in the event of a pandemic. Has the firm initiated a program to educate its employees about the potential pandemic and firm contingency plans?

When considering responses to various pandemic scenarios, firms may want to read “High Level Principles for Business Continuity,” which was prepared by the Joint Forum of the BASEL Committee on Banking Supervision, The International Organization of Securities Commissions, and the International Association of Securities Supervisors. Annexes II and III are Case Studies on the impact of the 2003 SARS outbreak on the Hong Kong and Canadian securities markets, respectively. Additional information is available on various government and health organization websites.

Potential Regulatory Relief

NYSE Regulation, Inc. has provided short-term relief from certain regulatory requirements during prior business interruptions. NYSE Regulation, Inc. anticipates that, in the event of a pandemic or other public health emergency, a flexible approach to regulatory requirements will be appropriate. Some of the areas of potential regulatory relief currently under consideration by NYSE Regulation, Inc. include the following:

- extensions of time for standard filing requirements;

- flexibility with respect to office space arrangements;

- delays in real-time supervision where technology monitoring is feasible;

- additional time for reconciliations;

- extensions of time relating to licensing requirements; and

- flexibility with respect to compliance with certain provisions of clearing agreements.

Further guidance as to regulatory relief will be issued as circumstances warrant.

Questions concerning pandemic planning may be addressed to Anne DeSimone at (212) 656-2373 or Thomas Leahy at (212) 656-2340 in the Risk Assessment Unit. Questions concerning Exchange Rule 446 may be addressed to Stephen Kasprzak at (212) 656-5226 in Member Firm Regulation.

_______________________________________
Allison A. Bishop

Vice President

Risk Assessment

_______________________________________
1
2 Member organizations are not required to continue doing business in the event of a business disruption. However, a member organization’s BCP must address how it “will assure customers prompt access to their funds and securities” in the event that it discontinues business operations. Exch. R. 446(c)(10). Nothing in this Information Memo is intended to suggest that in the event of a pandemic, a member organization must stay in business. A member organization should consider, nonetheless, whether its existing plan for permitting customers prompt access to their funds and securities in the event of a business shutdown will be viable under expected pandemic conditions.
3 The Exchange previously provided general guidance as to the requirements of Exchange Rule 446 in Information Memo No. 0424 (May 3, 2004), and Information Memo No. 0580 (Oct. 13, 2005).
4 Information Memo No. 0580 at 12 (Oct. 13, 2005).
5 Information Memo No. 0424 at 3 (May 3, 2004).
6 Information Memo No. 0424 at 3 (May 3, 2004).
7 Information Memo No. 0580 at 3 (Oct. 13, 2005).
8 Information Memo No. 0580 at 2 (Oct. 13, 2005).