Business Continuity Planning and Lessons From the COVID-19 Pandemic
In February 2019, FINRA published Regulatory Notice 19-06, launching a retrospective review of Rule 4370 (Business Continuity Plans and Emergency Contact Information) to assess its effectiveness and efficiency (the BCP Rule Review). The COVID-19 pandemic, beginning in early 2020, caused unprecedented regulatory and operational impacts on member firms and other market participants, as well as regulators. During the early stages of the pandemic and while the BCP Rule Review was still underway, FINRA published Regulatory Notice 20-08 (March 2020) encouraging each member firm to review its business continuity plan (BCP) to consider pandemic preparedness and to review its emergency contacts to ensure that FINRA has a reliable means of contacting the firm.
During the pandemic, business continuity plans were implemented as member firms adapted swiftly to prioritize the health and safety of firm personnel and investors, while maintaining the public’s access to capital markets. FINRA also provided regulatory relief and guidance, as appropriate, to member firms, firm personnel and investors as they navigated through pandemic-related impacts.
Further, to understand broader pandemic-related regulatory and operational impacts on member firms and other stakeholders, in December 2020, through Regulatory Notice 20-42, FINRA launched a retrospective review on lessons learned from member firms and their customers’ experiences during the pandemic (the Pandemic Review). In Regulatory Notice 20-42, FINRA sought feedback from firms about their experiences in a range of areas, including how member firms’ operations and business models may have changed during the public health crisis and may potentially evolve if the crisis persisted. FINRA further requested comment on whether it should consider changes to its rules, operations or administrative processes to address lessons learned during the pandemic or to respond to the anticipated long-term impacts of the pandemic on member firms and investors. As part of the Pandemic Review, FINRA sought to further validate its assessment of Rule 4370 in connection with the discrete BCP Rule Review.
Based on the BCP Rule Review and the Pandemic Review, both of which involved extensive feedback from a wide range of internal and external stakeholders, FINRA has determined to maintain Rule 4370 without change. This Notice summarizes the retrospective rule review process, the predominant themes that emerged from stakeholder feedback and resulting actions in both reviews, and provides guidance to member firms.
Questions regarding this Notice should be directed to:
- Jeanette Wingler, Associate General Counsel, Office of General Counsel (OGC), at (202) 728-8013;
- Sarah Kwak, Associate General Counsel, OGC, at (202) 728-8471; or
- Patricia Ledesma, Senior Economist, Office of the Chief Economist, at (202) 728-8461.
Background & Discussion
Retrospective Review Process
FINRA periodically reviews its rules to determine whether they are meeting their intended objectives by reasonably efficient means, particularly in light of industry, market, technology, and other environmental changes. The retrospective review process typically has two phases: the assessment phase and the action phase. The assessment phase begins with the launch of a Regulatory Notice soliciting comment from all member firms and other interested external stakeholders. As part of the assessment phase, FINRA obtains input from several of its advisory committees, comprising firms of different sizes and business models and investor protection advocates, as well as its operating departments. If appropriate, FINRA may solicit feedback through a confidential survey distributed to all member firms to validate the feedback received through the comment process and to provide an additional opportunity for all members to provide input on the effectiveness and efficiency of the rule or rule set.
The action phase implements any recommendations arising from the assessment, which could include, among others, changes to the rule or its administration. Not every assessment includes a recommended rule change. The assessment may conclude that a rule remains relevant and appropriately tailored to meet its objectives. However, to the extent action involves modification of rules, FINRA will separately engage in its usual rulemaking process to propose amendments to the rules based on the findings. This process will include input from FINRA’s advisory committees and an opportunity for comment on specific proposed revisions in a Regulatory Notice or rule filing with the Securities and Exchange Commission (SEC), or both.
To conduct the BCP Rule Review, Regulatory Notice 19-06 posed several questions pertaining to member firms’ experiences with the rule; the economic impacts, including costs and benefits, associated with creating, maintaining or updating a BCP; and the substance and activation of member firms’ BCPs (e.g., whether a BCP addresses specific types of significant business disruptions such as cyber events, terrorist attacks, pandemics or natural disasters). FINRA received two comment letters.1 FINRA subsequently solicited additional feedback through a confidential pre-pandemic survey distributed to all member firms to validate the feedback received during the comment process and to provide an additional opportunity for all members to provide their views on Rule 4370. The survey collected 288 responses, which represented approximately eight percent of FINRA member firms. In the summer of 2020, FINRA sought to supplement the input received by speaking directly with some internal and external stakeholders following the widespread activation of BCPs by member firms due to the pandemic.
To conduct the Pandemic Review, Regulatory Notice 20-42 solicited feedback on lessons learned from member firms and their customers’ experiences during the pandemic covering a range of topics, including the effectiveness of business continuity planning, among others. FINRA further requested comment on whether to consider changes to FINRA rules, operations or administrative processes in response to pandemic experiences or to address anticipated long-term impacts of the pandemic on member firms and investors. In response, FINRA received 32 comment letters spanning a broad range of issues.2 For the BCP Rule Review and Pandemic Review, FINRA also obtained input from several advisory committees, and in meetings with staff from several trade associations. In addition, FINRA obtained the perspective of its relevant operating departments.
BCP Rule Review
Rule 4370 requires a member firm to create, maintain, review at least annually and update upon any material change, a written BCP identifying procedures relating to an emergency or significant business disruption. BCPs should be reasonably designed to enable a member firm to meet its existing obligations to customers and address existing relationships with other broker-dealers and counterparties. Each member firm has flexibility to tailor its BCP to the size and needs of its business, provided that the BCP addresses the enumerated minimum elements set forth in Rule 4370 to the extent applicable and necessary to the firm’s business.3
Rule 4370 also requires each firm to provide (and promptly update upon any material change) to FINRA via electronic process or other means as FINRA may specify, prescribed emergency contact information, including the designation of two emergency contact persons, both of whom must be associated persons.4 Member firms may register and update their emergency contact persons through the FINRA Contact System (FCS).5
Findings and Observations
The BCP Rule Review, as well as the related feedback received during the Pandemic Review,6 confirmed the continuing value and effectiveness of Rule 4370 and its flexible, non-prescriptive approach, and so FINRA proposes to maintain the rule without change.
The majority of stakeholders indicated that Rule 4370 works well and expressed the view that the rule’s flexible, non-prescriptive, and risk-based approach has been effective in ensuring firms of all sizes are prepared for potential business disruptions. Commenters to Regulatory Notice 19-06 indicated that the rule has been effective at ensuring member firm preparedness for a wide range of potential business disruptions. Stakeholders conveyed their appreciation for the rule’s straightforward approach and expressed a preference for maintaining the current flexible approach.7 In addition, commenters to Regulatory Notice 20-42 generally indicated that the rule worked well and expressed the view that the rule provided member firms with the necessary flexibility to successfully execute their BCPs and respond to the pandemic.8
As described below, some stakeholders suggested incorporating additional prescriptive requirements into the rule and a BCP testing requirement. Some stakeholders suggested eliminating the requirement that a member firm provide the BCP disclosure to customers at account opening, and indicated that, as a general matter, additional guidance on effective practices would be welcome.
Some stakeholders suggested that FINRA consider amending the rule to expressly address a BCP testing requirement, with some supporting a mandatory testing requirement, while other stakeholders recommended that such requirement be left to the discretion of the firm. Several commenters to Regulatory Notice 20-42 stated that members regularly test their BCPs and suggested that testing was helpful in preparing firms for activating their BCPs during the pandemic.9
While the rule does not specifically mandate BCP testing, the rule does require a firm to conduct an annual review of its BCP to determine whether any modifications are necessary in light of changes to the firm’s operations, structure, business or location. FINRA has publicly stated that this review may encompass testing BCP functionality, which would help a firm determine whether the BCP is “reasonably designed.”10 In addition, the 2019 Report on Examination Findings and Observations (2019 Exam Report) includes annual testing as an observed effective practice used by member firms to fulfill their obligations under the rule.11
Providing BCP Disclosure to Customers at Account Opening
Some stakeholders questioned the need to provide the BCP disclosure at account opening. These stakeholders suggested eliminating the temporal aspect of the BCP disclosure. Some external stakeholders indicated that the requirement to provide written BCP disclosure at customer account opening adds significant volume to the account opening packet and is more granular than necessary for customers.
Approximately 68 percent of survey respondents indicated that they do not believe that it is particularly useful for firms to provide a copy of the firm’s BCP to new customers. Survey respondents shared a variety of reasons for this view. Other views included that information contained in the BCP is confidential and that it is too much information for customers to understand. On the other hand, approximately 32 percent of survey respondents indicated that providing the BCP to customers was beneficial, stating that some customers do ask about the BCP or have read it.
FINRA has published guidance stating that firms are not required to disclose their actual BCP, including any proprietary information, but rather can provide appropriate levels of summary information about how the firm will address the possibility of a future significant business disruption and how the firm plans to respond to events of varying scope.12 FINRA has also stated that member firms can satisfy their delivery obligations under FINRA rules by using electronic media, subject to compliance with standards established by the SEC on the use of electronic media for delivery purpose.13 Because survey respondents indicated that some customers request and read the BCP, FINRA does not propose to alter the current disclosure requirement.
Minimum Elements of a BCP
One stakeholder recommended supplementing the rule’s minimum BCP requirements set forth under Rule 4370(c) to include other categories such as critical data backup, cloud usage and storage, vendor relationships, and alternative business locations. The stakeholder also suggested a requirement for a firm to adopt a separate disaster recovery plan (DRP) and an incident response plan and to integrate those plans with the BCP. The majority of survey respondents indicated agreement that the DRP and incident response plans should be integrated with the BCP if the firm has these plans.
In comments to Regulatory Notice 20-42, one stakeholder suggested adding criteria to Rule 4370 that address sustained and catastrophic disruptions, such as providing long-term secure remote access to firm systems; creating rapid succession plans for lost principals and employees; and alternative procedures for supervising employees. Some stakeholders conveyed their observations about the industry’s increased use of and reliance on third-party vendors, and that the rule does not specifically address third-party dependencies and their attendant risks, particularly concentration risk. In contrast, the majority of stakeholders suggested retaining the rule’s current approach and allowing a member firm the flexibility to tailor the BCP to the size and needs of its business.
Based on stakeholder feedback, including feedback subsequent to the survey regarding firms’ experiences during the pandemic, we believe that the rule’s flexible, non-prescriptive and risk-based approach has been effective in ensuring firms of different sizes are prepared for potential business disruptions. Moreover, the rule is intended to ensure that a firm can meet its existing obligations to customers in a significant business disruption regardless of the length of the business disruption. Accordingly, FINRA does not propose amending the minimum elements of a BCP at this time.
Firms that have adopted separate DRPs or incident response plans may benefit from integrating the plans with the BCP as suggested by the survey respondents. Regarding third-party vendors, FINRA recently addressed more broadly member firms’ responsibilities when outsourcing responsibilities to third parties.14
One of the questions in the survey asked respondents to indicate the types of events that triggered their BCP. Technology system failures, natural disaster or weather-related incidents, and infrastructure failures (e.g., blackouts or grid failures) were the most commonly cited triggering events for activating the BCP prior to the COVID pandemic.15 While the survey distributed during the BCP Rule Review indicated that a greater proportion of large firms activated their BCP in the last five years than small firms, there was widespread activation of BCPs by member firms of different sizes during the pandemic. During the Pandemic Review, some stakeholders indicated that they expressly address pandemics as triggering events in their BCPs, while other commenters indicated that they address disaster events or public health events, but not pandemics specifically, as triggering events. Some stakeholders indicated that they intended to revise their BCPs to expressly address pandemics.
Remote Work Arrangements
Some external stakeholders conveyed that use of remote work arrangements and cloud computing services prior to the pandemic made member firms better positioned to transition to a remote work environment during the pandemic.16 External stakeholders indicated that some firm BCPs incorporated temporary use of alternate work locations but did not incorporate widespread and continued use of remote work arrangements. In response to the pandemic, some firms revised their BCPs to expressly incorporate remote work arrangements.
Some stakeholders expressed an interest in having additional guidance on BCP effective practices. One stakeholder recommended that FINRA provide additional guidance on effective practices pertaining to data protection and failover testing tailored by business model or size, internal and external communication between employees, counterparties, vendors and government regulators during a BCP event, industry-wide training, an assessment of mission critical systems, and cybersecurity. The majority of survey respondents agreed that guidance or effective practices would help their firm prepare a more comprehensive BCP. In contrast, another stakeholder stated that the current guidance and administrative processes are efficient and effective. The stakeholder indicated that due to the evolving threat environment, prescriptive guidance to business continuity planning may not result in significant benefits.
Beginning in March 2020, FINRA published: (1) guidance and temporary regulatory relief for member firms due to the pandemic, including FAQs regarding business continuity planning; (2) Regulatory Notice 20-08 regarding pandemic-related business continuity planning, guidance and regulatory relief; and (3) Regulatory Notice 20-16 sharing practices implemented by firms to transition to, and supervise in, a remote work environment during the pandemic.17 In addition, FINRA published a revised Small Firm Business Continuity Plan Template to modernize the template and incorporate feedback received during the retrospective review (e.g., to reflect increased use of remote work arrangements). The template is an optional tool for member firms.
The Pandemic Review sought feedback from member firms about pandemic-related regulatory and operational impacts on firms and other stakeholders. In addition to soliciting feedback on business continuity planning, the Pandemic Review also sought comments on other areas covering remote offices, alternative work arrangements and remote inspections; engaging with FINRA and FINRA processes; qualification examinations; investors’ experiences; and the economic impacts of specified FINRA rules. Given the exigent health and safety concerns and the significant impacts of the pandemic on member firms, investors and other stakeholders, FINRA provided guidance and temporary regulatory relief to firms, associated persons and other individuals through the issuance of FINRA communications, FAQs and temporary rule amendments, without compromising critical investor protection measures or fair processes.18 In addition, FINRA launched several initiatives to respond to issues and questions that arose during the pandemic.
FINRA Guidance, Temporary Regulatory Relief and Initiatives
FINRA’s guidance, temporary regulatory relief and initiatives during the pandemic include:
- Regulatory Notice 20-08 (March 2020) regarding pandemic-related business continuity planning, guidance and regulatory relief to member firms from some requirements;
- Regulatory Notice 20-13 (May 2020) reminding firms of the risks and challenges of fraud during the pandemic;
- Regulatory Notice 20-16 (May 2020) sharing practices implemented by firms to transition to, and supervise in, a remote work environment during the pandemic;
- Information Notice 3/26/20 providing cybersecurity measures to consider as firms respond to the pandemic;
- Regulatory Notice 21-29 noting recent trends in examination findings, observations and disciplinary actions and providing questions firms may consider when evaluating their systems, procedures and controls relating to third-party vendor management;
- 2021 Report on FINRA’s Examination and Risk Monitoring Program identifying rule and key related considerations for member firm compliance programs, summarizing noteworthy findings from recent examinations, outlining effective practices that FINRA observed during its oversight, and providing additional resources that may be helpful to member firms in fulfilling their compliance obligations;
- issuing several notices and other communications to alert firms about rising threats relating to cybersecurity threats, including imposer websites,19 phishing attacks20 and ACH fraud;21
- holding roundtable discussions with firms and issuing Regulatory Notice 21-18 (May 2021) to share effective practices to address risks relating to online takeover attempts, which increased during the pandemic;
- delivering a series of virtual panels to assist firms with transitioning to remote work, including but not limited to remote inspections, supervision, arbitration, financial crime and cybersecurity;
- issuing several FAQs providing guidance and temporary regulatory relief;
- issuing an FAQ regarding the hosting of virtual business entertainment events or meetings;
- adopting temporary amendments to FINRA rules;22
- adopting amendments to Rule 1010 (Electronic Filing Requirements for Uniform Forms) to permit firms to obtain an electronic signature on the Form U4 and a conforming amendment to Rule 2263 (Arbitration Disclosure to Associated Persons Signing or Acknowledging Form U4);23
- delivering an online testing service for candidates seeking to take some qualification exams remotely;24
- publishing several Investor Insights regarding the effects of the pandemic;25
- forming a COVID Fraud Task Force in March 2020 to establish a coordinated response across the organization to potential COVID-related fraud in the broker-dealer industry and in U.S. markets; and
- providing as a resource to member firms a list of active state shelter-in-place and stay-at-home orders that imposed workplace restrictions at the start of the COVID-19 pandemic.
FINRA’s pandemic-related guidance, temporary regulatory relief and initiative information, as well as links to SEC pandemic-related guidance and resources relevant to member firms, are available on a consolidated COVID-19 webpage that FINRA created at the outset of the pandemic.
Remote Offices, Remote Inspections and MAP Rules
To mitigate the impacts of the pandemic, member firms have relied heavily on remote offices and alternative work arrangements (e.g., working from home or a backup or recovery location) for a broad range of personnel. Commenters to Regulatory Notice 20-42 most frequently raised issues related to member firms’ use of remote offices and remote inspections after the pandemic. Several commenters also expressed concern about implications under the Membership Application Program (MAP) rules if member firms are required to register many offices due to remote work.26 As discussed below, FINRA is considering these interrelated issues and potential changes to the current framework.
Commenters to Regulatory Notice 20-42 generally expect strong continued interest in remote work after the pandemic. Commenters generally stated that technology, including centralized firm systems and supervision, supported the transition to remote work during the pandemic. Many commenters emphasized that the “branch office” and “office of supervisory jurisdiction” (OSJ) definitions in FINRA Rule 3110 (Supervision) should be revisited to reflect member firms’ use of technology and evolving work arrangements. Several commenters expressed concern that without amendments, personal residences of many associated persons will need to be registered (and inspected) to facilitate remote work arrangements after the pandemic. Several commenters supported a transition of the office definitions to a risk-based approach (e.g., whether funds and securities are handled at the location), rather than a location-based approach.
Rule 3110 and Form BR share definitions.27 One commenter noted that it does not believe the definitions should be amended without a full vetting of the circumstances under which more lenient definitions may be abused or lead to risks to investors. This commenter stated that the desire to increase the use of remote offices and alternative work arrangements does not change the regulatory reasons behind the definitions.
FINRA is engaging with stakeholders to reevaluate Rule 3110(f) (Definitions) and the potentially significant supervisory impacts that may result from changing the current framework for defining a branch office and the exclusions.
Remote Inspections under Rule 3110
In part due to the changing office environment noted above, commenters generally supported allowing member firms to conduct remote inspections to satisfy their Rule 3110(c) (Internal Inspections) obligations. However, some stakeholders emphasized the continued value of firms conducting onsite inspections. Member firms and trade associations indicated that they believe that firms’ remote inspections have been effective. Several commenters to Regulatory Notice 20-42 also indicated that their remote inspection findings for 2020 were similar to onsite inspection findings for prior years.
Several member firms and trade associations supported the transition to a risk-based approach to allow for remote inspections of lower risk locations. Some commenters to Regulatory Notice 20-42 indicated that, even if remote inspections were permitted, onsite inspections would continue to have a role (e.g., for higher risk locations or for each location on a periodic basis). Several commenters shared information regarding how they conduct remote inspections and why they believe the approach is effective.
Beginning in 2020, FINRA adopted two temporary rules to account for pandemic-related operational challenges related to satisfying Rule 3110(c) obligations. Rule 3110.16 extended the time by which firms could satisfy their year 2020 inspection obligations to March 31, 2021. Rule 3110.17 permitted member firms to complete their inspections of all offices and non-branch locations for year 2020 remotely by March 31, 2021, and for year 2021 remotely by December 31, 2021, subject to specified terms.28 In September 2021, FINRA extended Rule 3110.17 to include calendar year 2022 inspection obligations through June 30, 2022.29
FINRA is considering modifications to firms’ obligations under Rule 3110(c) and the current framework for defining offices as an OSJ, branch office and non-branch location.
As member firms fully implement their return-to-office plans, they may need to register as branch offices some of their currently temporary locations or new locations established as a result of the “new normal.” For many member firms, resuming the requirement to designate and register offices on Form BR may result in an increase in the number of offices (registered or unregistered) that could exceed the MAP rule’s safe harbor thresholds or could otherwise represent a material change in business operations that would require the submission of a continuing membership application (CMA) for FINRA’s approval. Several commenters expressed concern about how the potential increase in the number of offices due to remote work arrangements could require a CMA under the MAP rules.30 Several commenters offered suggestions to mitigate the impact of such a scenario. For example, one commenter offered three potential solutions: (1) remove the requirement to submit a CMA and permit a member firm to rely on MAP’s safe harbor provision if such firm (that is not a defined disciplined firm under FINRA rules) would like to expand the number of office locations with no material change to the products and services being offered by the member firm; (2) carve out certain types of office locations, including a primary residence, from the business expansion application requirement, which could be effected in tandem with redefining “OSJ,” “branch office” and “non-branch location”; or (3) expand the annual thresholds for new offices.
FINRA is considering the concerns and potential ways to find a balanced approach in assisting members navigate to the “new normal,” including the application of the MAP rules.
Engaging with FINRA and FINRA Processes
Engagement with member firms has been a critical part of FINRA’s assessment of the need for and appropriateness of guidance, temporary regulatory relief and other initiatives during the pandemic. In addition, FINRA has underscored the importance of member firms communicating with FINRA regarding whether, among other things, examinations, regulatory filings, and responses to FINRA inquiries, matters and investigations may be impacted by the pandemic.
During the pandemic, we engaged in ongoing conversations with firms to discuss the impact of the pandemic on their business and their compliance programs, including but not limited to, transition to remote work, remote supervision, increased market volatility, new cybersecurity threats and return to office plans. This approach allowed us to monitor emerging trends and develop a deeper understanding of the risks facing firms in each business model across all firm groupings – Retail, Diversified, Carrying & Clearing, Capital Markets and Trading & Execution – and proactively provide more nuanced and targeted regulatory relief and guidance.
We are also continuing to evaluate and continuously improve our exam and risk monitoring programs and process, including improving tools, processes and guidance to enhance our interactions with firms on an on-going basis and during exams.
A commenter to Regulatory Notice 20-42 encouraged FINRA to: (1) review the mechanisms used by member firms to provide required regulatory notifications to FINRA with an eye to potential enhancements to the notice fields; and (2) include additional mechanisms, as alternative means of compliance, to give options to member firms. FINRA is considering technology solutions to address these processes.
Leveraging technology has been critical to carrying out FINRA’s regulatory mission and responsibilities. For example, FINRA temporarily amended certain timing, method of service and other procedural requirements in FINRA rules to allow, among other things, service of some documents by email.31 In addition, as noted above, FINRA adopted amendments to Rule 1010 to permit firms to obtain an electronic signature on the Form U4 and a conforming amendment to Rule 2263.32
Due to health and safety concerns and testing center closures and capacity constraints, FINRA provided relief to persons seeking to take qualification examinations. Notably, beginning in 2020, FINRA extended open examination enrollment windows and extended the period for persons to function as principals or operations professionals without passing the appropriate qualification examination as allowed by FINRA Rules 1210.04 and 1220(b)(3)(B), respectively.33
In addition, since July 2020, FINRA and NASAA have delivered an online testing service for candidates seeking to take FINRA's Securities Industry Essentials (SIE), Series 6, and Series 7 exams and NASAA's Series 63, Series 65 and Series 66 exams remotely. Beginning in February 2021, FINRA adopted an interim accommodation request process to allow candidates to take additional FINRA exams online, including the Series 24, Series 57, Series 79 and Series 99 exams.34
Most commenters to Regulatory Notice 20-42 supported allowing candidates to take qualification exams remotely and expanding the tests that are offered remotely. However, some commenters indicated challenges in scheduling onsite and remote qualification examinations due to limited capacity. Some commenters also indicated technical issues with taking exams remotely (e.g., lack of broadband internet in rural locations or incompatibility of test software with firm computers).
FINRA will continue to monitor the delivery of qualification exams, including vendor performance and online delivery of some exams, and address any issues that arise. In addition, FINRA is considering and discussing with other stakeholders the potential role of online examinations post-pandemic.
Virtual Arguments and Hearings
While FINRA postponed in-person arbitration hearings and mediation sessions in response to the pandemic, FINRA permitted arbitration hearings and mediation sessions to proceed virtually either by party agreement or arbitration panel order. From March 2020 through November 2021, FINRA had 589 cases with one or more virtual evidentiary hearings.
Some commenters to Regulatory Notice 20-42 suggested changes to virtual arguments and hearings for greater effectiveness. For example, the University of Miami School of Law Investor Rights Clinic suggested that “FINRA should continue providing investors the option to conduct arbitration proceedings on Zoom but should make this option available at the investor’s choice without the need for agreement by the parties or a contested motion."
FINRA has temporarily amended its rules to allow evidentiary hearings in disciplinary actions, eligibility proceedings, temporary and permanent cease and desist orders, and appeals of MAP decisions to be conducted by video conference, if warranted by the current COVID-19-related public health risks posed by an in-person hearing. The temporary amendments also allow oral arguments in appeals of disciplinary actions to be conducted by videoconference. The temporary amendments are in effect through March 31, 2022, pending any future extensions.35
FINRA is also considering our approach to offering virtual arbitration pre-hearing conferences and hearings more broadly. FINRA Dispute Resolution Services (DRS) has formed a Zoom Arbitration Task Force with industry representatives and investor counsel to help us continue to improve our future Zoom offerings. In addition, effective August 2, 2021, all FINRA DRS hearing locations are open for in-person proceedings.36
Communications with the Public
Due to changed communications practices during the pandemic, FINRA published FAQs regarding application of FINRA rules to some types of virtual communications (e.g., live video or audio conferencing platforms, virtual meetings hosted or attended by third-parties and visual aids, such as whiteboard or dynamic charts, used during live presentations).37 The FAQs clarified that the supervision requirements for virtual communications depend on the nature and number of persons participating in the communication as well as the form of the communication (e.g., unscripted live appearance, audio, text, graphics, or video). The FAQs also discussed circumstances under which a firm may become entangled with or adopt the virtual communications of third parties.
1 The two comment letters were from: Christopher W. Bok, Director, Financial Information Forum (FIF) (April 25, 2019) and Thomas M. Wagner, Managing Director, Securities Industry and Financial Markets Association (SIFMA) (April 26, 2019).
2 The comment letters were from: William C. Anderson, Chief Compliance Officer, American Funds Distributors, Inc., (Feb. 16, 2021) (American Funds); Richard Izzo, President, Association of Registration Management, Inc. (Feb. 19, 2021) (ARM); Kelli McMorrow, Head of Government Affairs, American Securities Association (Feb. 16, 2021) (ASA); John Chuff, President, BA Securities, LLC (Feb. 16, 2021) (BA Securities); Eric Arnold and Clifford Kirsch of Eversheds Sutherland on behalf of the Committee of Annuity Insurers (Feb. 16, 2021) (CAI); Michael Decker, Senior Vice President, Bond Dealers of America (Feb. 16, 2021) (BDA); Christopher W. Anderson, Chief Compliance Officer, Caldwell Sutter Capital, Inc. (Feb. 16, 2021) (Caldwell); Seth A. Miller, General Counsel, Executive Vice President, and Chief Risk Officer, Cambridge Investment Research, Inc. (Feb. 16, 2021) (Cambridge); Mark Quinn, Director of Regulatory Affairs, Cetera Financial Group (Feb. 16, 2021) (Cetera); Matthew J. Sugden, Vice President, Compliance, Commonwealth Financial Network (Feb. 16, 2021) (Commonwealth); Merri Jo Gillette, Deputy General Counsel, Edward Jones (Feb. 10, 2021) (Edward Jones); Seve Faure (Feb. 11, 2021); Carrie L. Chelko, Chief Compliance Officer, Fidelity Brokerage Services LLC, Richard O’Brien, Chief Compliance Officer, National Financial Services LLC, Fidelity Distributor Company LLC, Digital Brokerage Services LLC (Feb. 16, 2021) (Fidelity); Nanette K. Chern, Susan K. Moscaritolo, Susan L. La Fond, Jennifer A. Brunner, Chief Compliance Officers, Foreside family of companies (Jan. 26, 2021) (Foreside); Robin Traxler, Senior Vice President, Financial Services Institute (Feb. 11, 2021) (FSI); Kenneth I. Schindler, Chief Compliance Officer, GWFS Equities, Inc. (Feb. 9, 2021) (GWFS); Peggy E. Chait, Managing Director, and Howard Spindel, Senior Managing Director, Integrated Solutions (Feb. 16, 2021) (Integrated Solutions); Carlos Barrientos, Invex (Feb. 12, 2021) (Invex); Logan Sandler, Gabrielle Craft, and Alexandra Tipton, legal interns, University of Miami School of Law Investor Rights Clinic (Feb. 16, 2021) (IRC); Emily Micale, Director, Federal Regulatory Affairs, Insured Retirement Institute (Feb. 16, 2021) (IRI); Will H. Fuller, EVP, President, Annuities, Lincoln Financial Distributors & Lincoln Financial Network (Feb. 2021) (Lincoln); Michelle Bryan Oroschakoff, Chief Legal Officer, LPL Financial LLC (Feb. 16, 2021) (LPL); Jennifer Lewis, Lead Counsel, Broker-Dealer and Investment Adviser Practice Group, MML Investor Services, LLC (Feb. 16, 2021) (MML); Lisa Hopkins, President, North American Securities Administrators Association (Feb. 23, 2021) (NASAA); James Rabenstine, Vice President, Chief Compliance Officer, Nationwide Financial Services, Inc. (Feb. 11, 2021) (Nationwide); Matt Rothchild (Jan. 20, 2021) (Rothchild); Barbara Armeli, Senior Vice President, Chief Compliance Officer, Charles Schwab & Co., Inc. (Feb. 12, 2021) (Schwab); Kevin Zambrowicz, Managing Director & Associate General Counsel, Securities Industry and Financial Markets Association (Feb. 16, 2021) (SIFMA); Ruben Huertero, Legal Intern, Christine Lazaro, Director of the Securities Arbitration Clinic and Professor of Clinical Legal Education, Securities Arbitration Clinic at St. John’s University School of Law (Feb. 16, 2021) (St. John’s); Marc Gilman, General Counsel and VP of Compliance, Theta Lake, Inc. (Feb. 15, 2021) (Theta Lake); James T. McHale, Chief Compliance Officer, Wells Fargo Advisors (Feb. 16, 2021) (Wells Fargo); and Jennifer L. Szaro, XML Financial Group (Feb. 15, 2021) (XML Financial).
3 Rule 4370(c) requires that each BCP, must at a minimum, address: (1) data back-up and recovery (hard copy and electronic); (2) all mission critical systems; (3) financial and operational assessments; (4) alternate communications between customers and the member; (5) alternate communications between the member and its employees; (6) alternate physical location of employees; (7) critical business constituent, bank, and counter-party impact; (8) regulatory reporting; (9) communications with regulators; and (10) how the member will assure customers' prompt access to their funds and securities in the event that the member determines that it is unable to continue its business.
In June 2021, a firm was ordered to pay $70 million for systemic supervisory failures and customer harm, including, among other issues, failure to create a reasonably designed BCP to cover technology-related emergencies and to address all “mission critical systems” as required under Rule 4370. For example, the firm’s BCP was limited to events that physically prevented employees from working from the firm’s premises. The firm’s BCP was not reasonably tailored to the firm’s online business and large customer base. See FINRA press release (June 30, 2021). See also the 2021 Report on FINRA’s Risk Monitoring and Examination Activities stating that Rule 4370 applies to denials of service and other interruptions to members’ operations.
4 This requirement is intended to ensure that FINRA has a reliable means of contacting each member firm in the event of an emergency. One contact must be a member of senior management and a registered principal of the member firm and the second contact, if not a registered principal, must be a member of senior management who has knowledge of the firm’s business operations. For a firm that has only one associated person (e.g., a sole proprietorship without any other associated persons), the second emergency contact person may be an individual, either registered with another firm or nonregistered, who has knowledge of the member firm’s business operations, such as the firm’s attorney, accountant or clearing firm contact.
6 The comment letters that specifically addressed BCP were from: BDA; Cambridge; Commonwealth; Edward Jones; Fidelity; Foreside; FSI; GWFS; Integrated Solutions; Invex; LPL; MML; NASAA; SIFMA; and XML Financial.
7 Approximately 89 percent of survey respondents indicated their overall preference for the rule’s existing flexibility over imposing more prescriptive measures.
8 See, e.g., comments from Commonwealth, Edward Jones, FSI, GWFS, MML, SIFMA and XML Financial.
9 See, e.g., comments from Edward Jones and XML Financial.
10 See Business Continuity Planning FAQ, Question and Answer 18. See also Regulatory Notice 13-25 (August 2013) (joint advisory stating, in part, that firms should consider conducting full BCP tests, stress tests, and staff training).
11 As discussed in the 2019 Report on Examination Findings and Observations, FINRA has found some member firms encountering challenges where their BCPs did not reflect certain market conditions, business models or other circumstances (e.g., BCPs that did not identify all mission-critical systems, BCPs that were not updated after significant operational changes, and firms that lacked sufficient capacity to handle increased call volumes and online activity during a disruption). The 2019 Exam Report includes some observed effective practices at member firms, including engaging in annual testing and incorporating test results into firm training.
15 Approximately 26 percent of survey respondents cited technology system failures, approximately 22 percent cited natural disasters, and approximately 20 percent cited infrastructure failures.
16 The remote work arrangements prior to the pandemic included arrangements used to test a member firm’s BCP, as well as regular flexible work arrangements for staff.
19 See Regulatory Notice 20-30 (August 2020).
20 See Regulatory Notice 20-12 (May 2020); Regulatory Notice 20-27 (August 2020); Regulatory Notice 20-35 (October 2020); Regulatory Notice 20-40 (November 2020); Regulatory Notice 21-08 (March 2021); Regulatory Notice 21-20 (June 2020); Regulatory Notice 21-22 (June 2021); Regulatory Notice 21-30 (August 2021).
22 Pursuant to SR-FINRA-2020-040, FINRA has adopted temporary Supplementary Material .17 (Temporary Relief to Allow Remote Inspections for Calendar Year 2020 and Calendar Year 2021) under Rule 3110 to provide member firms the option, subject to specified requirements under the supplementary material, to complete remotely their calendar year 2020 and calendar year 2021 inspection obligations under Rule 3110(c) (Internal Inspections), without an on-site visit to the office or location. In September 2021, FINRA extended Rule 3110.17 to include calendar year 2022 inspection obligations through June 30, 2022. See SR-FINRA-2021-023.
Pursuant to SR-FINRA-2020-027, as extended by SR-FINRA-2020-042, SR-FINRA-2021-006, SR-FINRA-2021-019 and SR-FINRA-2021-031, FINRA has temporarily amended FINRA Rules 1015, 9261, 9524 and 9830 to allow hearings in connection with appeals of Membership Application Program decisions, disciplinary actions, eligibility proceedings and temporary and permanent cease and desist orders to be conducted by video conference, if warranted by the current COVID-19-related public health risks posed by an in-person hearing. The temporary amendments in SR-FINRA-2020-027 became operative on October 1, 2020, and are in effect through March 31, 2022, pending any future extensions.
Pursuant to SR-FINRA-2020-015, and as extended by SR-FINRA-2020-017, SR-FINRA-2020-022 SR-FINRA-2020-042, SR-FINRA-2021-006, SR-FINRA-2021-019 and SR-FINRA-2021-031, FINRA has temporarily amended certain timing, method of service and other procedural requirements in FINRA Rules 1012, 1015, 6490, 9132, 9133, 9146, 9321, 9341, 9349, 9351, 9522, 9524, 9525, 9559 and 9630. These temporary amendments are effective from May 8, 2020, through March 31, 2022, pending any future extensions.
Additional expired temporary rule amendments:
Pursuant to SR-FINRA-2020-019, FINRA adopted temporary Supplementary Material .16 (Temporary Extension of Time to Complete Office Inspections) under FINRA Rule 3110 (Supervision) that extended the time by which member firms were required to complete their calendar year 2020 inspection obligations under Rule 3110(c) to March 31, 2021.
Pursuant to SR-FINRA-2020-026 as extended by SR-FINRA-2020-043 and SR-FINRA-2021-005, FINRA adopted: (1) temporary Supplementary Material .12 (Temporary Extension of the Limited Period for Registered Persons to Function as Principals) under FINRA Rule 1210 (Registration Requirements); and (2) temporary Supplementary Material .07 (Temporary Extension of the Limited Period for Persons to Function as Operations Professionals) under FINRA Rule 1220 (Registration Categories) that extended the 120-day period that individuals designated prior to March 3, 2021 could function as a principal or Operations Professional without having successfully passed an appropriate qualification examination through June 30, 2021.
25 See The Coronavirus Is Novel, but Crisis-related Scams Are Nothing New (Oct. 2020); COVID-19 Early Withdrawals (June 2020); Fraud and Your Investment Accounts During COVID-19 Pandemic (May 2020); Financial Peace of Mind in the Age of Coronavirus (March 2020); and Fraud and Coronavirus (COVID-19) (March 2020). The Investor Insight “COVID-19 Early Withdrawals” was published jointly by FINRA, NASAA and SEC staff. The Investor Insight “The Coronavirus Is Novel, but Crisis-related Scams Are Nothing New” was published jointly by NASAA and FINRA staff.
26 In Regulatory Notice 20-08, FINRA temporarily suspended the requirement to: (1) maintain updated Form U4 information regarding office of employment address for registered persons who temporarily relocate due to COVID-19; and (2) submit branch office applications on Form BR for any newly opened temporary office locations or space-sharing arrangements established as a result of the pandemic. In Regulatory Notice 20-08, FINRA stated that, when appropriate, we will publish a Regulatory Notice announcing a termination date for the regulatory relief that will provide member firms with time to make necessary operational adjustments.
27 Broker-dealers and state-registered investment advisers use Form BR (Uniform Branch Office Registration Form) for branch office registration, notice filing, closing or withdrawal in the appropriate jurisdictions or with SROs, including FINRA.
28 In 2020, FINRA adopted temporary Rules 3110.16 (Temporary Extension of Time to Complete Office Inspections) to extend the time by which a firm could complete its year 2020 inspections to March 31, 2021, and 3110.17 (Temporary Relief to Allow Remote Inspections for Calendar Year 2020 and Calendar Year 2021). Rule 3110.16 expired by its terms on March 31, 2021. See SR-FINRA-2020-019 and SR-FINRA-2020-040.
30 FINRA IM-1011-1 (Safe Harbor for Business Expansion) creates a safe harbor for a firm that is seeking to expand its business in three categories, one of which pertains to the number of offices (registered or unregistered). Subject to specified conditions and thresholds, a member firm may increase the number of offices without filing a CMA because such expansion is presumed not to be a material change in business for purposes of FINRA Rule 1017 (Application for Approval of Change in Ownership, Control, or Business Operations).
33 See Coronavirus Impact on FINRA-Administered Exams and SR-FINRA-2020-026, as extended by SR-FINRA-2020-043 and SR-FINRA-2021-005. Any pandemic-related exam window extension expired no later than June 30, 2021. The temporary relief permitting persons to function as principals or operations professionals without passing the appropriate qualification examination as allowed by FINRA Rules 1210.04 and 1220(b)(3)(B), respectively, expired by its terms on June 30, 2021.
34 See FINRA Online Exam Administration Request Form. To address the ongoing challenges facing exam candidates by the pandemic, effective February 24, 2021, FINRA adopted an interim accommodation request process to allow candidates to take additional FINRA exams online, including the Series 24, Series 57, Series 79 and Series 99 exams. Exam candidates seeking to take an exam online based on the interim accommodation request process must complete and submit to FINRA an Online Exam Administration Request Form.