Securities Industry Association
The Bond Market Association

October 21, 2002

Jennifer J. Johnson
Secretary
Board of Governors of the Federal Reserve System
20th Street and Constitution Avenue, NW
Washington, D.C. 20551
Re: Docket No. R-1128

Office of the Comptroller of the Currency
250 E Street, SW
Public Information Room
Mail Stop 1-5
Washington, D.C. 20219
Attention: Docket No. 02-13
Fax No. (202) 874-4448

Jonathan G. Katz
Secretary
Securities and Exchange Commission
450 5th Street NW
Washington, D.C. 20549-0609
Re: File No. S7-32-02

Elizabeth McCaul
Superintendent, New York State Banking Department
2 Rector St.
New York, NY 10006-1894

    Re: Draft Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System; Board Docket R-1128, OCC Docket 02-13, SEC File No. S7-32-02.

To whom it may concern:

The Securities Industry Association1 and the Bond Market Association2 ("the Associations") are pleased to offer their comments in response to the White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System. The White Paper reflects the preliminary conclusions of the Board of Governors of the Federal Reserve System, the Comptroller of the Currency, the Securities and Exchange Commission, and the New York State Banking Department with respect to factors affecting the resilience of the critical markets and activities in the U.S. financial system in the event of a wide-scale regional disruption. The paper also offers the preliminary conclusions of the agencies with respect to a set of sound practices for core clearing and settlement organizations and other firms that play significant roles in critical financial markets. Finally, the paper also suggests an appropriate timetable for implementing these sound practices. Following the comment period, the agencies intend to publish a final version of the paper, which they intend to incorporate into supervisory expectations or other forms of guidance.

SUMMARY OF RECOMMENDATIONS

  • Clarify that the purpose of the White Paper is to focus the attention of core and significant market participants on the need to engage in risk assessment exercises and have updated business continuity plans that address critical processes.

  • Present any specific scenarios and sound practices as non-exclusive, non-binding examples of business continuity planning observed by the various agencies. Core and significant firms, in consultation with other stakeholders in the financial community, should have flexibility in developing the specifics of the scenarios and practices that make up an individual plan.

  • Provide for another draft and comment period prior to final publication to ensure meaningful comment once certain issues and concepts are further clarified by the agencies.

GENERAL COMMENTS

We applaud the excellent cooperation exhibited by the agencies in soliciting the views of our member firms and preparing guidance for business continuity planning. The Associations strongly recommend that these cooperative efforts continue, particularly if the ultimate goal is publication of supervisory expectations or another form of guidance. Because firms create business continuity plans for the entire enterprise, it is critical that guidance be consistent for separately regulated entities of the same financial institution.

The broker-dealer community has also been working diligently, both as individual firms and collectively through the Associations, on the issue of business continuity planning. The tragic events of September 11 exposed vulnerabilities in business continuity plans, which firms undertook to address immediately. That resolve would have existed independent of regulatory pressure because of the strong competitive pressure that exists for firms to prepare for disruptions, including the demands of customers and counter-parties and other interdependent entities. The prodigious amount of work committed to planning is borne out by the results of a recently conducted SIA Business Continuity Planning ("BCP") Benchmarking Survey (to firms with 250 employees or more) designed to give BCP professionals in the financial sector a snapshot on what other firms were doing with their recovery programs. The survey found that additional reporting lines for business continuity had been added at the very top levels of the organizations and that the top priorities (of almost equal value) are people recovery, technology recovery (including telecommunications), and program assumptions. The survey also found that testing is an important priority. The survey also shows that, since September 11, personnel relocation changes have become further diversified with some firms moving further from their primary site, some diversifying their recovery location(s), some firms separating their people from technology, and some firms opting for other solutions. Also, the survey shows that, since September 11, all aspects of firms' BCP programs have gone through thorough review and many scenario assumptions have changed (i.e., from single building/small incident to multiple buildings/large area).

In December 2001, SIA formed a BCP Committee by incorporating a preexisting informal industry forum known as the Securities Industry Business Continuity Management Group. The Committee's mission is to:

  • Provide a forum for securities firms, industry organizations, and service providers to share specific plans and business continuity information.

  • Identify and develop business continuity plans and projects that have an industry-wide, rather than a firm-specific, focus.

  • Provide a liaison between the securities industry and government legislators, regulators, and service providers, as well as to related industries such as telecommunications and power utilities.

Similarly, The Bond Market Association also formed a Business Continuity Management Council ("BCMC"), which serves as a standing advisory committee of their Board to advise on, and coordinate, their activities relating to fixed income business or industry utility disruptions and policy responses to the September 11th tragedy. The BCMC is composed of members of preexisting committees of The Bond Market Association, in addition to others with expertise in business continuity planning. The Bond Market Association is mindful of the need to ensure careful coordination with other industry groups that are working in this area, and will in particular provide input on an ongoing basis to SIA's BCP Committee, as its work relates to fixed income issues.

In May 2002, the Associations responded to a similar proposed rule from the Board of Directors of the National Association of Securities Dealers, Inc. ("NASD") concerning Business Continuity Plans and Emergency Contact Information.

In September 2002, the Associations responded to rule proposals of the New York Stock Exchange ("NYSE") and the National Association of Securities Dealers ("NASD") relating to business continuity and contingency planning. In their letter, the Associations expressed their support for the approach of requiring members to maintain auditable, updated plans that establish the firms' procedures to be followed in the event of a significant disruption. Moreover, the NASD and the NYSE chose to identify the elements of continuity that plans should address - alternate physical location of firm and its employees, books and records back-up, alternate means of communication, etc. - rather than mandate what the plan ought to be. In fact, the theme that features prominently in both proposals is that plans should reflect the diverse nature of the member firm community and thus, the proposed rule ought to allow member firms to tailor plans to suit their, size, business, and structure.

Managing business continuity risk is not just a priority for financial institutions in managing a business; it is at the core of the services that they sell to the public. For this reason, financial institutions are especially qualified to successfully identify and manage this risk and therefore, ought to be given the opportunity to develop risk management practices as firms and as members of a responsible, interdependent financial community.

On the other hand, we respect the need of the agencies to be assured that critical financial markets and core and significant participants are studying the risks and planning accordingly. As the paper notes, the resilience of the financial system is only as strong as its weakest link and good planning will still require regulators to ensure that all of parties, including core and significant firms and critical financial (exchanges, utilities, etc.) and non-financial (telecommunications, government, etc.) entities participate in this effort. The Associations support identifying the processes and functions such as value transfers and pending transactions, as well as funding and posting of collateral that are deemed essential to recovery. The Associations also believe it is appropriate for the agencies to distinguish core and significant participants, although it will be just as important for the regulators to be sensitive to language that may be used to equate critical with capable, and thereby hurt the interests of many robust, smaller firms.

Beyond ensuring that core and significant firms have updated plans that address certain basic elements of continuity for critical processes elements of continuity in critical areas, we believe it is difficult if not impossible for the agencies to describe either the risks that an individual firm ought to consider or the means (or practices) that the firm ought to use to manage them. The Associations are concerned that some of the ideas presented in the White Paper go beyond illustrative examples and are intended to bind firms to a specific scenario and a specific plan or plan element. As the White Paper notes, firms feel strongly that "one size does not fit all." For example in specifying the base-line event for planning as a "wide-scale regional disruption," and suggesting that there exists an industry consensus around a sound practice of planning for separate labor pools, the White Paper makes questionable assumptions and conclusions that could limit the approaches that a firm might consider in light of its assessment of risk and the demands of its customers and the interdependent participants in its industry.

The Associations applaud the agencies receptivity to different approaches and ideas that is plainly evident in the document. Many of our comments stem from a concern that, because the agencies are also regulators, some of the more specific notions of guidance will give the ideas presented in this White Paper unintended legal weight and set standards. Moreover, many of the questions posed in the Request for Comment section seem aimed at the possibility of developing more specific guidance, which the Associations feel will apply a "one size fits all" approach for a diverse group of firms. The results of firms' planning efforts are always available for inspection by the appropriate examining authorities, who can determine whether the specific elements of any plan address the general goals and principles laid out by the agencies.

Finally, the agencies should evaluate the impact of the guidance on competition in low margin businesses like clearing. To the degree that the White Paper includes guidance that limits a core or significant firm's ability to implement cost-efficient solutions, some firms may decide not to continue in the business. This has important repercussions for end-user firms, the competitiveness of the business vis-a-vis foreign providers of these same services, and the concentration of risk within the industry.

SPECIFIC COMMENTS

Scenario

As described above, the Associations believe the establishment of a baseline scenario - "a wide scale regional disruption" - for continuity planning purposes is inadvisable. First, the scenario provided is extremely vague since a wide-scale regional disruption could potentially involve anything from a power outage to a direct nuclear strike. Second, the impact of each type of disruption would be different for different firms in the region and their responses would vary accordingly. Third, optimizing a plan for any one scenario could make the plan less effective in addressing other scenarios.

Some scenarios simply cannot be defended against due to consequences that are either unforeseeable, like certain extreme scenarios, or that are not within the control of the core/significant firm community, like problems experienced by infrastructure providers. Firms will base their decisions on the likelihood of the event and the cost of preparing the firm for it in light of the firm's overall resources. The cost of defending against some scenarios may be so high as to make it impossible for some organizations to continue to operate profitably. While core and significant firms take their roles seriously and have a natural interest in protecting and preserving a profitable business model, the ability to recover costs is a fundamental requirement of any business venture. To suggest a single scenario for which all firms ought to plan is to impose an unnecessary constraint on sound business and business continuity planning decisions.

Labor Pool

The Associations believe that "access to labor" is the appropriate issue that firm continuity plans ought to address. The White Paper suggests that there is industry consensus for a sound practice involving separate labor pools. Specifically, the paper states that out of region back-up locations should not be dependent on the same labor pool or infrastructure components used by the primary site, and their respective labor pools should not be both vulnerable to simultaneous evacuation or inaccessibility. Depending on the intended meaning of "separate" to describe a labor pool plan, our members would not agree that such a consensus exists.

The Associations believe that such guidance is unnecessarily limiting in that it suggests a single approach to addressing the issue of access to labor. The approach leaves the impression that only a stand-by labor pool would suffice. Creating a stand-by labor pool with the requisite expertise would be expensive. The Associations maintain that firms are in the best position to judge their "people risk" and so ought to have the maximum flexibility to manage this risk.

Limiting a firm's options to address the labor issue could in some instances create inconsistencies with governmental economic development programs and, in some cases, contractual agreements between firms and local authorities. Both civic planning and business continuity are important policy objectives that need not conflict if firms have sufficient flexibility to plan for access to labor.

Geographical Diversity

Clearly, geographical diversity of facilities is an important element of business continuity planning. However, The Associations do not believe that the White Paper should recommend a specific distance or a sound practice that specifies an "out of region" approach. Distance is a factor that will mean different things to different firms in different locations under different scenarios. Firms have already made and continue to make significant investments in alternative sites and data centers based on risk assessments including costs and benefits. A prescriptive approach to distance in the White Paper would require changes to current plans that could result in a huge loss of this investment for many participants. Moreover, as previously mentioned, state and local laws and economic incentive plans are also important factors that may be inconsistent with some notions of geographical diversity.

The White Paper also notes that greater geographical diversity may be possible as a result of continued improvements in data transfer technology. The Associations understand the importance of back-up data to business continuity. However, the Associations believe that the emphasis on technology unfairly prioritizes available technology over other critical factors, like cost, that firms must weigh in planning for alternative locations. Singling out a factor for special consideration can have the effect of limiting the approaches that firms can use in addressing geographical diversity in its business continuity plan. The discussion of technology also tends to create unrealistic expectations for a timetable for the development and adoption of technology. A firm cannot predicate its business continuity plan on the promise of future advances in technology.

Rather than suggesting a specific approach to geographical diversity, the Associations recommend that the White Paper draw attention to the factors that should be considered when planning for geographical diversity, such as access to labor, water supply, transportation networks, and telecommunications and power infrastructure.

Timetable to Implement

To the degree that the White Paper produces specific guidance that requires firms to assess risk differently or consider new risk mitigation strategies, firms will have to expend significant resources to alter the plan they already have in place. Making strategy revisions is likely to take more than the 180 days suggested by the paper because business plans are typically drawn up a year in advance consistent with the annual budgeting cycle. The Associations recommend allowing one year to make these changes to the plan.

With respect to the actual implementation of planned changes, the Associations support the flexible language included in the White Paper that recommends firms make changes as soon as "reasonably practicable."

Recovery Time

The Associations believe that there should be a clear distinction in any guidance issued by the agencies between the concepts of recovery and resumption. The key goal of recovery ought to be ensuring that critical firms complete transactions and manage financial risk. Recovery consists of core clearing and settlement of cash positions and in-flight transactions by the end of the business day, however defined. Recovery and resumption is a two-step process. Core clearing and settlement organizations, including value transfer networks, must be able to start business processes before critical markets begin the process of recovery. If the financial utilities are not able to recover, the other participants in the financial markets will not be able to recover in an orderly way.

The core clearing and settlement organizations must also be able to communicate that they are ready to begin processing prior to the running of the clock for recovery by the critical markets. The Associations believe that the financial utilities should be in a position to process transactions prior to the "end of day." The Associations believe that any guidance should address the time that business operations can be re-started, not the time that recovery will be complete. Actual recovery time will vary depending on the time and nature of the disruption and the impact felt by an individual firm. Although hard targets should be avoided, a sufficient window for significant firms to begin the recovery process, after the core clearance and settlement and value transfer networks have resumed business operations, would be four hours.

The White Paper should make clear that resumption, or the ability to initiate new transactions, is a decision appropriately left to individual firms.

Core Firms /Significant Firms

The Associations believe the White Paper could better clarify the distinction between core firms and significant firms, referred to as `core clearing and settlement organizations" and "firms that play significant roles in critical financial markets." The White Paper seems to distinguish the two based on involvement in clearance and settlement services. Yet some firms could conceivably fall into both categories for some functions or neither for other functions.

The Associations believe that it is appropriate to target guidance at firms whose role is critical to the continuity of the market and whose inability to perform critical functions would add systemic risk to the market. The Associations believe significant firms should be determined with reference to individual products. The methodology used for identifying significant firms ought to be clearly articulated by the agencies in order to provide adequate notice to affected firms. Furthermore, the methodology ought to be based on objective, material, publicly available data (i.e., volume), so that each firm can independently track its status. Finally, eligibility also ought to be determined according to historical, moving averages so that firms don't abruptly change status. Once eligibility status is determined, the firm ought to have a reasonable time to develop or revise its plan and then to implement. To be consistent with the discussion above on the timetable to implement, newly eligible firms ought to have one year to make plan changes, and be subject to the "reasonably practicable" standard for actual plan implementation.

The agencies should also have the discretion to provide exemptions from critical firm status on a case-by-case basis.

Regulations/Laws

As we learned in the period following September 11, a flexible approach to regulation during times of great stress can be integral to limiting the eventual damage. Then, regulators had to determine whether the failure of certain firms and customers to comply with regulations applied on a daily basis was the result of a willful failure to comply or the unavailability of records necessary to determine compliance. In the case of financial reporting rules, otherwise healthy firms that were unable to document compliance could have been faced with contractual and/or regulatory default had applicable rules not been relaxed. Regulators need to know in advance which stress points their regulations directly impact and to be prepared to be flexible. Being flexible also means having a plan to gather the information needed to make a quick decision. The plan should address the key market participants to contact, the appropriate questions to ask, and the possible options for the regulators to take.

The Associations believe that the following categories of regulation may be appropriate for such planning on the part of the agencies:

  • Timely announcements from regulators whether and to what extent a day will not be treated as a business day.

  • Registration and location requirements applicable to foreign workers and foreign offices to allow firms an overseas option in their plans.

  • Coordination with international regulators regarding any foreign regulation (i.e, data privacy) that could limit the ability of a firm to consider an overseas component in planning.

  • Broad antitrust exemption authority to allay any concerns about the appropriateness of cooperative steps that will be necessary for recovery and resumption and permit firms to consider reciprocal arrangements with other firms as another option in their continuity planning.

  • Specific regulations which present issues potentially impacting liquidity during an emergency situation include:

    • Rule 15c3-1 (capital charges for aged failed trades)

    • Rule 15c3-3 (collateral pledges, reserve accounts and affiliate status)

    • Rules 23A and 23B (inter-affiliate transfers of funds and extensions of credit)

    • Rule 431 (collection of margin)

    • Federal Reserve Risk-Based Capital Guidelines (maintaining required daily positive margin)

    • Regulatory Treatment of Business Locations Generally (various restrictions, including Regulation X, Section 23A, and Rule 15a-6, limiting the ability of firms to "pass the book" on a temporary basis to allow functions to be assumed by a foreign affiliate).

Critical Markets/Products

We support identifying critical markets and products for additional guidance in the White Paper. The Associations agree with the recommendation to include foreign currency, commercial paper, government securities, corporate bonds and mortgage-backed securities, and would add cash equities, repos and reverse repo transactions. We believe that the criteria for identifying such products ought to be clearly defined in advance so that the agencies are not put in the position of making decisions about the relative importance of each product without the benefit of standards or context.

CONCLUSION

The Associations believe the White Paper can be most effective as a means of identifying the factors that core and significant firms need to address in business continuity planning without mandating what these plans ought to be. To the degree that specific scenarios and practices are included in the White Paper, they should be presented in context as part of a survey of non-binding, non-exclusive examples observed by the agencies. Finally, we believe that the interdependent nature of our industry requires that the agencies be vigilant with respect to the continuity planning of financial and non-financial entities, such as exchanges and power companies. The status of these interdependent entities will influence the success of the firms' own efforts.

We hope that these comments are helpful and we look forward to a continuation of the constructive dialogue that has helped focus our members' business continuity planning efforts. We would very much appreciate the opportunity to comment on a new draft of the White Paper once the agencies have a chance to clarify and refine some of the concepts it contains. Please feel free to contact Art Trager, Vice-President & Managing Director, Technology & Operations, SIA (212-618-0546; atrager@sia.com) or Rob Fry, Director of Fixed Income Operations, The Bond Market Association (212-440-9473; rfry@bondmarkets.com) with any additional questions you may have concerning these matters.

Very truly yours,

Jerry Klawitter
SIA Business Continuity
Planning Committee
Laura LaCosa
The Bond Market Association
Operations Council

cc: Board of Governors of the Federal Reserve System

Roger Ferguson, Vice Chairman

Securities and Exchange Commission
Division of Market Regulation
Annette L. Nazareth, Director
Robert Colby, Deputy Director

Federal Reserve Bank of New York
Laurence Sweet, Vice President

Depository Trust & Clearing Corporation
Dennis J. Dirks, President & C.O.O
Thomas F. Costa, President & C.O.O., GSCC
Jeffrey F. Ingber, Esq., Managing Director & General Counsel

Asset Managers Forum
Michael L. Wyne, Chair, Managing Director, Fischer, Francis, Trees & Watts
Kenneth Juster, Director

____________________________
1 The Securities Industry Association brings together the shared interests of more than 600 securities firms to accomplish common goals. SIA member-firms (including investment banks, broker-dealers, and mutual fund companies) are active in all U.S. and foreign markets and in all phases of corporate and public finance. The U.S. securities industry manages the accounts of nearly 93 million investors directly and indirectly through corporate, thrift, and pension plans. In the year 2001, the industry generated $198 billion in U.S. revenue and $358 billion in global revenues. Securities firms employ approximately 750,000 individuals in the United States. (More information about SIA is available on its home page: http://www.sia.com.)
2 The Bond Market Association represents securities firms and banks that underwrite, distribute and trade in fixed income securities, both domestically and internationally, including all primary dealers recognized by the Federal Reserve Bank of New York. Association members collectively represent in excess of 95% of the initial distribution and secondary market trading of municipal bonds, corporate bonds, mortgage and other asset-backed securities, and other fixed-income securities and are also actively involved in the funding markets for such securities, including the repurchase and securities lending markets. This letter was drafted based on the input of the following Association committees: Interagency White Paper Response Task Force, Government Operations Committee, MBS Operations Committee, Business Continuity Management Council, Operations Council and the Board of Directors. Further information regarding the Association and its members and activities can be obtained at (www.bondmarkets.com).