March 20, 2020 - Securities Group News: Investment Advisors, Is Your Business Continuity Plan Effective In The Novel Coronavirus World?
By: Anthony R. Leone
The Novel Coronavirus (COVID-19) has affected the daily lives of millions and has impacted some to a far greater extent. The virus is affecting every business and industry—especially those businesses connected with the financial markets. For investment advisors, no greater case can be made to demonstrate the importance of having an effective business continuity plan in place. Whether you lack a plan, or have an existing plan that is old or obsolete, it’s never too late to put an effective plan in place. In addition to regulatory considerations, careful reflection in times like these suggest that having a business continuity plan will provide some degree of peace of mind for principals and clients alike and further free mental bandwidth to assess extreme market volatility and address client angst. Below is a refresher on current regulatory requirements and guidelines for both advisors registered with the SEC and those advisors registered in Massachusetts and Connecticut. In addition, we offer five critical considerations in evaluating or implementing a business continuity plan in light of COVID-19.
While there are no specific federal requirements concerning business continuity plans, Rule 206(4)-7 of the Investment Advisers Act of 1940 (the “Act”) has long been interpreted to implicitly require advisors to implement a business continuity plan. Rule 206(4)-7 specifically requires that advisors have in place “written policies and procedures reasonably designed to prevent violation” of the Act. Importantly the Act also requires yearly testing of said policies and procedures. In 2016, the SEC proposed, but did not adopt Rule 206(4)-4 (the “Proposed Rule”), which would have specifically mandated the adoption of business continuity plans. Again, while never enacted, the Proposed Rule provides prudent guidance for implementing an effective business continuity plan. In particular, the Proposed Rule would have required a business continuity plan which included provisions concerning: (1) maintenance of critical operations and systems, and the protection, backup, and recovery of data, including client records; (2) alternative physical office locations; (3) consideration of communication systems with clients, employees, service providers, and regulators; (4) assessment of critical third-parties; and (5) transition of the advisory business.
Like the SEC, neither Massachusetts nor Connecticut have direct regulations on the books. However, both states have issued guidance identifying business continuity plans as “best practices” and “important.” Massachusetts has even gone as far to comment that it is “gathering data and information on how best to address this topic . . . .”1 More broadly, the North American Securities Administrators Association (“NASAA”) has published its model rule for suggested implementation by states. Similar to the SEC’s proposed rule, the NASAA rule requires “[t]he protection, backup, and recovery of books and records . . . [a]lternate means of communications with customers, key personnel, employees, vendors, service providers (including third-party custodians), and regulators, including, but not limited to, providing notice of a significant business interruption or the death or unavailability of key personnel or other disruptions or cessation of business activities . . . [o]ffice relocation in the event of temporary or permanent loss of a principal place of business . . . [a]ssignment of duties to qualified responsible persons in the event of the death or unavailability of key personnel [and] [o]therwise minimizing service disruptions and client harm that could result from a sudden significant business interruption.”
With SEC and state guidance in mind, we believe that the first step in developing or refining a business continuity plan is to think honestly about the size and complexity of your advisory practice. Obviously, what will be appropriate for a large advisor with offices in multiple locations will not be appropriate or necessary for the thousands of sole proprietors working from a home office. An advisor refining or implementing a business continuity plan, regardless of size and complexity, should at a minimum consider the following issues:
These items, in addition to others that may arise based on the size and complexity of the advisor’s business, should be assessed and refined annually. Such review will ensure both a familiarity and comfort with the effectiveness of proscribed action in times of need, but also to ensure continued compliance with any new laws and regulations which may have changed. The bottom line is that it is certain COVID-19 has already, or will in the future, cause advisors to operate through secondary systems, and it is also likely that the continuing impact may prompt the SEC and states to revisit the need for specific regulations addressing business continuity plans informed by the Novel Coronavirus crisis. For now, even in the midst of this crisis, it is important for investment advisors to revise business continuity plans as necessary, or draft one as a way to address potential issues.
2020 Murtha Cullina LLP All Rights Reserved.