Investment advisers have a fiduciary duty to act in the best interest of their clients. This duty applies even when (especially when) an event or situation significantly impacts an adviser’s ability to communicate and work with her clients. In recent years, securities regulators have issued rules and guidance to address the need for investment advisers and other financial services professionals to engage in business continuity and succession planning to help avoid and prevent harm to clients when unexpected events happen. In light of these rules and guidance, advisers who fail to adequately develop and execute business continuity and succession plans face exposure to regulatory actions and lawsuits for failing to fulfill their legal and contractual duties.
This article provides a summary of key initiatives undertaken by NASAA, the SEC, and FINRA to address and highlight the need for business continuity and succession planning in the financial services industry.
The North American Securities Administrators Association
In 2015, the North American Securities Administrators Association (NASAA) drafted a Model Rule that would require state-registered investment advisers to implement procedures for business continuity and succession planning. A Business Continuity Plan (BCP) is a set of procedures that ensure the adviser’s business will continue performing critical functions during a significant business interruption. The BCP outlines specific actions the adviser should take during different situations. These actions are meant to both reduce and manage the risks associated with such disruptions.
A BCP should include a succession plan, which is a series of procedures to follow when a key person is unexpectedly unable to perform. This key person may be the investment adviser herself, or a person affiliated with the adviser. The succession plan ensures continuity of the business’s day-to-day operations and services, and guides the smooth winding down of an adviser’s business in the case of the adviser’s disability, incapacity, or death.
Alongside the Model Rule, NASAA provided guidance for state-registered investment advisers who are drafting their BCPs. This guidance is helpful to those seeking to build or reinforce a BCP to keep clients’ best interests in mind. According to NASAA, an investment adviser’s BCP should address the following:
Protection, backup, and recovery of the adviser’s books and records. Investment advisors are already required to maintain records of their books under the Investment Advisers Act of 1940, but many advisers maintain only paper copies. In the event of a natural disaster, such as a tornado or hurricane, these paper records could be destroyed. Under the Model Rule, advisers would be required to back up these paper files – presumably in electronic form – and have a way to access the backup files if the hardcopies are destroyed.
A method of communication with customers, employees, and regulators to use during a signification business interruption. During significant business interruptions an investment adviser may have difficulty in contacting clients. Phone lines and electricity often go out during natural disasters, making it impossible to access software where client contact information is stored. Even if the power is on, advisers may not be able to travel to their offices to make phone calls or send emails to clients. Under the Model Rule, advisers need to establish a mode of communication when their usual methods are unavailable. Cloud-based programs are one possible option, as client information stored in the cloud is accessible from any physical location. Advisers have to do more than merely access their clients’ information; they have to actually be able to contact their clients during a significant business interruption. Cloud-based email services or social media platforms are viable options, but advisers must assess what is best for their firm individually.
Office relocation, if necessary. During larger business interruptions, such as hurricanes, an investment adviser may not have access to her office for an extended period of time. The Model Rule requires that her BCP identify options for setting up shop in an alternative location. Firms that use cloud-based or web-based systems will have an easier time relocating, but those with hardcopy, location-based systems will face some difficulty.
Naming people to be responsible in the event of the death or disability of key personnel. The succession plan segment of an investment adviser’s BCP addresses situations in which the adviser is unexpectedly no longer able to serve her clients. If the adviser suddenly becomes disabled or dies, the question becomes who is accountable for making sure the adviser’s clients are properly served? The Model Rule requires advisers to identify a person to be responsible for notifying regulators and vendors, and communicating with clients.
Methods to minimize service interruptions and client harm in the event of significant business interruption. Outside of the first four requirements, an investment adviser should evaluate her firm and think of different scenarios that may arise during potential significant business interruptions. The adviser should then develop comprehensive plans to minimize disruption in each potential scenario.
The Securities and Exchange Commission
In 2016, the Securities and Exchange Commission (SEC) proposed a new rule under the Investment Advisers Act of 1940. This rule, called the Adviser Business Continuity and Transition Plans Rule, is similar to NASAA’s Model Rule. Under the SEC’s proposed rule, registered investment advisers would be required to adopt a BCP addressing:
Maintenance of critical operations/systems and data protection programs
Pre-decided alternate physical locations
Plans for communication with clients and key personnel
Review of third-party service providers
A transition plan in case the adviser is unable to continue providing advisory services and needs to wind down its operations
Although the proposed rule has not been finalized, many advisers are already taking action to enhance their BCPs and succession plans to comply with the proposed rule.
The Financial Industry Regulatory Authority
Finally, the Financial Industry Regulatory Authority (FINRA) has an existing rule relating to business continuity planning – Rule 4370. According to Rule 4370, FINRA Members’ written BCPs must address the following:
Data back-up and recovery (hard copy and electronic) systems
All mission critical systems
Financial and operational assessments
Alternate communications between customers and the member
Alternate communications between the member and its employees
Alternate physical location of employees
Critical business constituent, bank, and counter-party impact
Communications with regulators
How the member will assure customers' prompt access to their funds and securities in the event that the member determines that it is unable to continue its business
Investment advisers that are dually registered as a broker-dealer, or that work closely with a broker-dealer subject to this and other FINRA rules, should keep in mind how Rule 4370 applies to their investment advisory clients, and how this Rule interacts with state or SEC rules on business and succession planning applicable to the adviser.
Brian Edstrom is a Shareholder and Attorney at Avisen Legal, P.A. He brings to Avisen seven years of experience working for federal and state regulators.
Emilee Walters is our first Avisen Legal Fellow alum and a third-year law student at the St. Thomas School of Law. Emilee is an Avisen Fellow exploring a legal career in business law.