The Financial Industry Regulatory Authority (FINRA) has published new guidance and specific regulatory relief (the Notice) for its broker-dealer members regarding the impact of the coronavirus disease (COVID-19) pandemic. Given the specific requirements for FINRA members to have business continuity plans (BCP) in place to address emergencies or significant business disruptions, FINRA is encouraging its members to review their BCP procedures in light of challenges posed by the pandemic and has granted some specific relief to members and individual registered representatives for certain filing obligations. FINRA has also indicated that it may permit flexibility in meeting additional other requirements, including filing and response deadlines.
BCP Requirements
Broker-dealers that are FINRA members have the general obligation, under FINRA Rule 4370, to create, maintain, and regularly review a BCP that identifies procedures for operating during an emergency or significant business disruption. The core of the BCP requirements is ensuring that broker-dealers are able to meet their obligations to customers, counterparties, and regulators during an emergency, with the BCP designed to be tailored to the size and needs of the firm.
The Notice follows prior guidance issued by FINRA in 2009 for BCPs in the context of the H1N1 pandemic. In response to the COVID-19 pandemic, the Notice focuses on several areas, notably (1) evaluating current BCP procedures in response to current events; (2) managing the impact and risks of remote work, telework, and space-sharing arrangements; and (3) maintaining communications and filing obligations during disruptions related to the COVID-19 outbreak.
Review of Current BCP Implementation
First and foremost, the Notice stresses that members must do their own analysis of whether the current pandemic constitutes an emergency or significant business disruption for the firm specifically, therefore requiring activation of its existing BCP. If the firm elects to activate its BCP, the Notice encourages members to notify their FINRA Risk Monitoring Analyst (RMA) to discuss the activation and to discuss any issues they may be facing, including any disruptions to business and whether those disruptions are solved or ongoing. Also, firms are encouraged to use the current pandemic to specifically assess whether their BCP is “sufficiently flexible to address a wide range of possible effects in the event of a pandemic in the United States” (for example, firms should compare the measures currently implemented in response to the COVID-19 pandemic against the measures provided for in their existing BCP and modifying the BCP accordingly). Finally, members are cautioned to stay aware of ongoing developments with the COVID-19 pandemic in order to resume normal operations when the pandemic-related risks decrease.
Remote Offices, Telework, and Shared-Space Arrangements
FINRA acknowledges that firms may consider employing a variety of work and office arrangements to mitigate the impact of the COVID-19 pandemic. These measures include remote office or telework arrangements for specific or a broad range of employees, or within their current office space employing social distancing, travel restrictions, revised sick leave policies, special leave, or specialized seating plans. FINRA expects that if members resort to remote-work or telework arrangements that their supervisory system will be reasonably designed to supervise their associated persons under these arrangements. However, FINRA states that the ability to complete scheduled on-site inspections of branch offices may need to be postponed during the pandemic, with such ability needing to be “re-evaluated depending on the duration and severity of the pandemic.”
Notably, FINRA specifically provides regulatory relief to FINRA members by temporarily suspending requirements to update Form U4 information, or to submit branch office applications on Form BR, regarding locations where registered representatives have temporarily relocated due to COVID-19. While not conditioning such relief on any other factors, the Notice states that FINRA members should use “best efforts” to provide written notification to the firm’s Risk Monitoring Analyst (RMA) “as soon as possible” after establishing a new temporary office or space-sharing arrangement that is not a registered location. The notification should provide the RMA with information including the office address, names of member firm(s) involved, names of registered personnel, contact number, and the expected duration. This notice should also advise the RMA if the firm will be sharing space with another entity and the type of business it is engaged in, and cautions that firms should remain vigilant for the added risks such arrangements may create (for example, customer privacy, information security, and recordkeeping considerations), in particular when contacted through these alternate means, when exercising diligence to validate the identities of customers for order processing and distributions of customer funds.
FINRA also emphasizes the degree to which its pandemic-related measures could increase the risk of cyber events. In addition to noting the risk posed by increased use of remote-office and telework arrangements, FINRA notes that heightened anxiety and confusion about the pandemic among associated persons could increase the risk of events like phishing attacks or other intrusions. FINRA notes that before using alternate work arrangements, firms should test those arrangements before activating them, and more specifically ensuring that relevant systems and entitlements are properly updated and tested, adequate protections are deployed (for example, security patches and multifactor authentication), and reminders to associated persons of heightened risks and the need for vigilance are provided.
Communications and Filing Obligations
At the core of BCP requirements, the Notice stresses the importance of maintaining contact with the firm’s customers, counterparties, and regulators. FINRA notes that the pandemic could cause significantly increased levels of customer communications, which could create operational challenges in addition to those otherwise caused by the pandemic. If firms find themselves unable to service their customers, FINRA encourages firms to promptly place a notification on their website advising customers who they may contact for execution of a trade, information about their accounts, and access to funds and securities.
FINRA of course notes that BCPs must include providing FINRA with emergency contact information, which should be reviewed in light of the current pandemic to confirm FINRA has a reliable means of contacting the firm. FINRA directs firms that are unable to contact FINRA through their regular contacts to call FINRA’s Call Center at 301-590-6500, which FINRA notes will be re-routed if there is a significant business disruption at FINRA’s primary call center.
If any firm has difficulty making timely regulatory filings or responding to regulatory inquires, FINRA encourages firms to contact their RMA or relevant FINRA personnel to request extensions. The Notice clarifies that FINRA may waive any applicable late fees depending on the circumstances, and if the member is unable to transmit required data to FINRA, the firm should retain the relevant data until it can be transmitted. If individuals who have a qualifications exam or continuing education window that is due to expire during the pandemic, they are encouraged to contact FINRA for an extension. Moreover, if associated persons volunteer or are called into active military duty as a result of the pandemic, FINRA reminds firms of their existing guidance for registrations for such persons.
The Notice also reminds firms (without granting any relief) of their obligations to maintain accurate customer reserve formula computations and required deposits, in accordance with the customer protection rule.
Takeaways
As broker-dealers continue to confront the evolving challenges associated with the COVID-19 pandemic and related market turbulence, they should ensure that their response to the pandemic is conducted in accordance with their required BCP procedures. Broker-dealers, at a minimum, should be documenting whether BCP activation is warranted, when it occurs, and whether contact with FINRA and other regulators is warranted at any point during BCP activation. The implementation of pandemic-related measures, such as alternate work arrangements for employees, should be closely monitored for other hazards such as cybersecurity risks, continuity of communications, and regulatory responsiveness. Finally, if firms find themselves implementing measures not contemplated by their existing BCPs, they should ensure that the procedures are revised based on lessons learned during the current pandemic.
Alston & Bird has formed a multidisciplinary task force to advise clients on the business and legal implications of the coronavirus (COVID-19). You can view all our work on the coronavirus across industries and subscribe to our future webinars and advisories.