Targeted Examination Letter on Business Continuity Plans

November 2012

In coordination with the SEC and the CFTC, we are conducting a review of the impact of Hurricane Sandy on firms' operations and their ability to conduct business at a time when business continuity plans were enacted.  Please be mindful to address both the securities and futures side of your business in your response.  In connection with our review, we are requesting that responses to the following questions be provided in writing on or before December 16, 2012:

General

  1. Briefly describe the portions of your Business Continuity Plan ("BCP") that were implemented in connection with Hurricane Sandy, if any.  Did you utilize locations or take steps that were not part of the firm's BCP?
  2. Which business lines were deemed critical? For each of these business lines, how did you prepare staff before the storm? What obstacles did the staff have to overcome during and after the storm, including accessing alternative sites?
  3. If you planned to relocate employees to an alternate site, how many miles away was the back-up site from your main office?  Was the location of this site far enough away from your primary location to avoid the same physical infrastructure problems?  Was it on a different power grid, different central telecommunication circuit?  If staff worked from home, were they able to do so effectively, including adequate system access?
  4. Did your alternative site have current data available and the necessary equipment and systems to recover and maintain critical operations or services?  If not, what critical operation or services could not be maintained?
  5. Did you have sufficient and adequately trained staff at your alternative site?
  6. Is your alternate site able to be used effectively during a prolonged period in which your main facility cannot be used?
  7. When did your firm last test its BCP plan?  Please state what was tested as part of the BCP plan.  Was the BCP plan test a partial or full test?  What were the results of the test?
  8. Describe any significant problems experienced with vendors or outsourcing providers, including exchanges, clearing facilities, pricing feeds, service bureaus or other regulated or unregulated entities.  Please identify the date when these problems occurred and were resolved.
  9. Where were Compliance personnel located and what limitations, if any, were encountered in carrying out compliance responsibilities?
  10. How dependent were you on any single telecommunication system or other provider to perform?  What functions does the single telecommunication system or other provider perform?
  11. What were the main lessons learned from the recent event regarding the effectiveness of your BCP?  Will your BCP assumptions change? What updates do you plan to make to your BCP given the recent event and lessons learned?
  12. Is there anything the industry can do jointly to be better prepared for any future event?

Trading

  1. Where are the firm's primary trading locations?
  2. Where are the firm's alternate trading locations?
  3. How many trading staff are located at the primary locations?
  4. Does the alternate trading location require the physical presence of trading staff from the primary location?  How was the alternate location staffed?
  5. What processes are performed to transfer trading activities from the primary to alternate trading location?  Where/how are these processes performed?
  6. How did you last test trading at the firm's alternate location?  Was testing performed in conjunction with market centers?  What were the results of these tests?  Does your firm have connectivity to the backup sites of the exchanges or other trading markets to which you send orders?  If so how does such connectivity to the backup sites differ, if at all, from your firm's connectivity to the markets' primary sites?
  7. Did your firm test the various futures markets electronic trading platforms during BCP testing?  If so, please state which markets you tested with, when, the scope of the test and the results of the test.
  8. Was your firm ready to trade on A90RCA as the primary NYSE market at the opening of business on Monday morning, October 29, 2012? If not, what issues would have prevented you from trading?  Did you previously participate in testing of the "Print as N" initiative?  If so, when and what were the results?
  9. Has your firm participated previously in the testing of BCP plans for exchanges or other trading markets (e.g., ATSs) other than NYSE?  If so, when and what were the results?  If not, has your firm previously been offered the chance to participate in the testing of such BCP plans but decided not to participate?
  10. What testing does the firm conduct to ensure that BCP systems (including Order Management Systems and Execution Management Systems) function to mirror all regular trading workflows?
  11. What is the firm's capability to trade products remotely?  To what extent can your firm operate from the firm's alternate trading location (e.g. percentage of the firm's trading staff)?  Full operation or partial resumption of business?  Please describe how the firm defines a partial resumption of business (would the firm be limited in the products it could trade, the percentage of markets that could be made, etc.)?
  12. Prior to Hurricane Sandy, when was the last time trading occurred from the alternate trading location?

Customers

  1. How were communications with the firm's customers impacted during the contingency event?  If alternative communication efforts were utilized, what were they and were they effective?
  2. Did customers have access to their funds at all times?  Were customers able to fully engage in transactions when the securities and futures markets reopened?  How does the firm generally receive orders from its customers?  Did the firm experience issues receiving orders from its customers?  If so, when was this problem rectified?

Financial/Regulatory

  1. What if any regulatory relief was required and requested?  Please include when relief was requested, the entity to whom relief was requested (SEC, FINRA, CFTC, NFA), and whether such relief was granted.
  2. Did the firm experience settlement issues, securities or futures, during the week of October 29th?
  3. What issues did the firm have with its banks, DTCC, or futures clearing exchanges if any (e.g. clearance of securities and futures, margin, pricing, etc.) and how were they resolved?
  4. Did the firm experience issues with its books and records during the event or thereafter and how were they resolved?
  5. How is compliance with financial responsibility rules factored into the firm's BCP?

Please note that your responses will be shared with the SEC, who may share them with the CFTC.