Charles Schwab CorporationThe Schwab Building
October 21, 2002 Via E-Mail to "rule-comments@sec.gov"
Via E-Mail to "reg.comments@federalreserve.gov"
Via E-Mail to "reg.comments@occ.treas.gov"
Re: Draft Interagency White Paper on Sound Practices to
Dear Sir or Madam: The Charles Schwab Corporation ("Schwab") appreciates the opportunity to comment on the Draft Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System (the "White Paper"). Schwab is a financial holding company, as defined in the Gramm-Leach-Bliley Act, serving broker-dealer clients through its Charles Schwab & Co., Inc., Schwab Capital Markets L.P. and CyberTrader, Inc. subsidiaries, and bank clients through U.S. Trust Corporation and its depository subsidiaries. Schwab has approximately eight million active customer accounts, most of whom are individual retail investors. We thus have a significant interest in regulatory and industry efforts to ensure that the U.S. financial markets recover as quickly as possible and remain accessible to our customers following a wide-spread regional disruption such as occurred on September 11, 2001. Like most financial services firms, Schwab has developed a business continuity plan designed to ensure that we can recover as quickly as possible from unforeseen service disruptions, system failures, emergencies, and natural disasters. We have committed significant capital expenditures to building redundancy and resilience into our technology platform, establishing reliable back-up systems and alternative communication channels, separating critical operational, application, and processing functions, and constructing primary and back-up data centers in geographic regions posing minimal risks of natural and other disasters. We have also devoted considerable resources to establishing contingency response teams and cross-training personnel to provide support to operational areas and service channels that could be affected by a disruption or disaster. As a result, we are keenly aware of the risk-based assessments and the technological and personnel challenges that underlie all business continuity planning. We support the agencies' commitment to strengthening the resilience of the U.S. financial markets through the development of industry and marketwide business continuity planning strategies. We also appreciate the agencies' willingness to work with the industry to ensure that these strategies are feasible and realistic. To that end, we concur with the comments on the White Paper submitted by the Securities Industry Association and the Financial Services Roundtable.1 We support their recommendation that the agencies avoid prescriptive or "one size fits all" requirements and instead provide guidance that allows firms to design business continuity plans that best address the risks associated with their operations. In particular, we support their recommendation that the agencies avoid imposing strict "out of region," separate labor pool, or minimum distance requirements for back-up facilities. We also agree that the recovery targets suggested in the White Paper are unrealistic and do not represent an emerging industry standard. Recovery time necessarily depends on a number of variables, such as the nature and extent of the disruption, the time it occurs, and the critical activities affected by it. Moreover, recovery time is often dependent on components of the nation's infrastructure external to the firm, such as telecommunications systems. We are writing separately to provide additional context for our position that the agencies should avoid imposing rigid "out of region" or minimum distance requirements on the location of back-up facilities. We also write to urge the agencies to expand the scope of their efforts to address retail financial services and to encourage greater coordination of recovery strategies among market participants, exchanges and utilities, and infrastructure providers. Location of Back-Up Facilities As do other commenters, we believe the best approach to this issue would be to provide general guidance specifying the factors that firms should take into consideration in determining where to locate their back-up facilities. These factors should include access to labor, water supply, transportation networks, and power and telecommunications infrastructure, as well as the susceptibility of the region in which facilities are located to natural disasters and other disruptions. So long as a firm's decision is based on a proper consideration of these and other factors, it should not be prohibited from locating its back-up facilities within the same geographic region as its primary facilities. We believe Schwab's back-up arrangements are an example of an effective in-region approach. We have established two fully redundant data centers in the Phoenix, Arizona metro region to support the operations of Charles Schwab & Co., Inc.2 We chose the Phoenix region as the site for our data centers based in large part on its lack of susceptibility to catastrophic natural disasters such as earthquakes, hurricanes, tornados, severe snow or rain storms, and flooding from overflowing rivers or dam breaks. The Phoenix region is also not a major commercial center, nor does it contain a high concentration of critical market facilities, high profile businesses, or government offices, thus reducing the likelihood that it might be a target for large-scale terrorist activity. Our selection of sites for our data centers within the Phoenix region was constrained by the distance limitations of current technologies, such as synchronous processing and data-mirroring (the facilities are approximately 10 miles apart). However, the sites we selected were chosen to minimize the threat that both facilities could be impacted by a single disaster or disruption. For example, both facilities are located outside the downtown Phoenix area, are on separate flood plains, and are supported by separate power grids and different telecommunication channels. In the event that both power grids are impacted by a single event, both facilities are equipped with generators capable of running for 72 hours before refueling. Each facility is accessible by alternate transportation routes which are free of bridges, tunnels, rivers or other structures that could potentially block access in the event of a natural disaster or act of sabotage.3 Finally, depending on the nature of the disruption to our primary facility, we can staff the back-up facility by transferring employees from the primary facility, using off-duty personnel, or bringing in staff from outside the area. We are currently working towards having the ability to operate both data centers remotely for several days in the unlikely event that neither facility is accessible. Inclusion of Retail Financial Services As we understand it, the White Paper is concerned primarily with ensuring that market utilities and critical firms recover their back office functions so that pending transactions can be completed, as opposed to ensuring that firms can resume operations and initiate new transactions. Indeed, the White Paper expressly states that the proposed sound practices focus on minimizing the immediate systemic effects of wide-scale regional disruption of critical wholesale financial markets and do not address issues relating to retail financial services. In our view, the agencies' focus should be on ensuring that the U.S. financial markets are up and running for retail consumers as soon as possible following a wide-spread regional disruption. This requires more than ensuring that critical market participants can meet their obligations to one another. It also includes addressing the ability of firms to resume their business operations and provide their customers with access to their accounts and the markets, as well as the ability of exchanges and other market centers to recover and resume operations. Retail consumers are, in the end, the most important market constituency, and the ultimate goal of any strategy to strengthen market resiliency should be to ensure that they can access their assets, financial services, and the markets as quickly as possible following a wide-scale disruption. It will be cold comfort for retail consumers to know that their financial institutions are able to balance their books if they cannot access their assets to pay their own mortgages and meet other obligations.4 Accordingly, we urge the agencies to take a more comprehensive approach that addresses access for retail consumers to their financial services providers. Finally, we believe it is essential that the agencies address the need for all critical components that support the U.S. financial systems -- including exchanges and other market centers, market utilities, and critical infrastructure providers such as telecommunications networks - to have coordinated business continuity strategies in place. Many of the problems following September 11 stemmed from the inability of the exchanges to resume operations, single points of failure in the telecommunications networks, and unilateral decisions made by certain market centers. This lack of coordination exacerbated the systems and operational issues facing financial services firms and created confusion for retail customers. * * * * * Again, we appreciate the opportunity to provide comments on the White Paper and look forward to continuing to work with the agencies and others in the industry on this important issue.
cc: Elizabeth McCaul
____________________________
|