November 4, 2002
Jennifer J. Johnson
Board of Governors of the Federal Reserve System
20th Street and Constitution Avenue, NW
Washington, D.C. 20551
Re: Docket No. R-1128
Office of the Comptroller of the Currency
250 E Street, SW
Public Information Room
Mail Stop 1-5
Washington, D.C. 20219
Attention: Docket No. 02-13
Jonathan G. Katz
Securities and Exchange Commission
450 5th Street NW
Washington, D.C. 20549-0609
Re: File No. S7-32-02
New York State Banking Board
2 Rector Street
New York, New York 10006
|Re:||Draft Interagency White Paper On Sound Practices|
to Strengthen the Resilience of the U.S. Financial System
Ladies and Gentlemen:
The Depository Trust & Clearing Corporation on behalf of itself and its subsidiary companies (referred to collectively as "DTCC") welcomes the opportunity to comment on the Draft Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System (White Paper).
In the aftermath of the events of September 11, 2001, DTCC has taken a number of steps to enhance its business continuity plans. These plans, however, can only be fully successful to the extent that other critical industry players have also taken appropriate measures to prepare for such contingencies, though, in our view, the measures required may vary from firm to firm. Further, these entities must be able to communicate with core clearing and settlement organizations from several locations, including both their primary, as well as a remote, data center. Accordingly, we support the Agencies' overall effort to develop guidelines which will require core clearing and settlement organizations, such as DTCC, to manage business continuity capabilities. We also agree that other firms which play a significant role in critical financial markets, should similarly have guidelines which they can utilize in managing their business continuity capabilities from both primary and remote data centers, though we would anticipate that these guidelines would not necessarily be as rigorous or as prescriptive as those applying to core clearing and settlement organizations. DTCC concurs that the guidelines should cover continuity of financial services in the event of any significant business interruption.
While DTCC supports the Agencies' efforts, we believe, however, that there may be confusion among industry participants as to who fits within the enumerated categories. We urge the Agencies to provide clarification that will permit financial industry participants to recognize and correctly assess their roles in order that they may develop and implement appropriate business contingency measures. In addition, we urge the Agencies to promote awareness of the formulated business recovery standards among non-critical industry players and urge that such entities consider developing and implementing as necessary, business continuity measures appropriate for their level of activity.
The White Paper provides that to the extent sound practices require core clearing and settlement organizations to revise their plans, these revisions should be completed as soon as possible and no later than 180 days after the Agencies issue their final views. Since DTCC has been working on enhancing its business continuity plans since the events of September 11, it believes that it would not have a problem in meeting this timetable with respect to business continuity planning. As to the time necessary to implement the steps covered by DTCC's plan, it is clear that completion of the process which would permit us to achieve the optimum level of operational resiliency may require a longer period of time. In this regard, to the extent that adoption of a timetable will cover planning and implementation, DTCC believes that due consideration should be given to the following factors when considering the final timetables for the core clearing and settlement organizations: 1) requisite time involved in training, deploying and managing a redundant labor force, and 2) the availability of appropriate systems applications support at each operating location.
We are not certain that the timetables to be established for core clearing and settlement organizations should necessarily apply to other critical industry players in their own assessments of the necessary changes to their business continuity procedures. We believe that the Agencies should consider providing more general guidance on timing expectations, that would appropriately reflect the role that other critical industry players have in this process. Similarly, the guidance provided regarding the Agencies' expectations regarding implementation by these critical players of their plans to improve their own operational resiliency could be less prescriptive than that provided to the core organizations.
The White Paper addresses the issue of the location of back-up arrangements with sufficient out-of-region staff, equipment and data to recover critical activities within recovery time objectives. We do not believe that a fixed distance standard can be identified for all market participants, since their needs and approaches will necessarily vary. We would urge that this determination be left to each operating entity while requiring that each give due regard to the objectives espoused by the White Paper in making its determinations.
The White Paper indicated that core clearing and settlement organizations should plan to both recover and to resume fully within the day critical activities that support critical financial markets and that the general emerging industry objective appears to be a resumption-time target of no later than two hours after an event. Again, we urge the Agencies to reconsider the time frame set forth in the White Paper and create a standard that requires resumption of critical activities within an appropriate time frame which takes into consideration the time of day when an event occurs, the nature and extent of a disruption, as well as any system constraints that may play a role in impeding recovery within a single fixed period of time. Given the breadth of contingencies we must prepare for, a single standard seems inappropriate.
We believe that the Agency's ultimate guidance should recognize the possibility that, under certain circumstances, "recovery" of processing for a given day might not occur until the following day. Calendar date or "wall clock" dependencies that exist within the current data processing and business systems must be modified if these recovery objectives are to be met. Therefore, we urge the Agencies to take appropriate steps to raise this issue with industry members to encourage critical industry players to include in their systems development plans efforts to eliminate these dependencies within a reasonable period of time.
We hope these comments are helpful and would be pleased to discuss any of the issues raised in this response. If you have any questions regarding these matters, please contact me at (212) 855-3700.
Very truly yours,
/s/Dennis J. Dirks
Dennis J. Dirks
Chief Operating Officer
The Depository Trust & Clearing Corporation