THE OPTIONS CLEARING CORPORATION
November 12, 2002
Jennifer J. Johnson
Office of the Comptroller of the Currency
Jonathan G. Katz
Re: Draft Interagency White Paper on Sound Practices to Strengthen the
Ladies and Gentlemen:
The Options Clearing Corporation ("OCC") is pleased to comment on the "Draft Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System" ("Draft Interagency White Paper") released jointly by the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, and the Securities and Exchange Commission ("the agencies"). OCC strongly supports the efforts of the agencies to strengthen the infrastructure of the U.S. financial markets by articulating sound practices of business continuity planning.
OCC is a registered securities clearing agency and a registered derivatives clearing organization. OCC is the largest clearing organization in the world for financial derivative instruments and is the first clearinghouse to receive a "AAA" rating from Standard & Poor's Corporation. OCC clears all exchange traded SEC-regulated options in the United States. These options are traded on the American Stock Exchange, the Chicago Board Options Exchange, the International Securities Exchange, the Pacific Exchange and the Philadelphia Stock Exchange. OCC has also entered into clearing agreements with Nasdaq LIFFE, LLC ("NQLX") and OneChicago, a joint venture among the Chicago Board Options Exchange, Chicago Mercantile Exchange, and Chicago Board of Trade, to clear security futures (and, in the case of NQLX, broad-based stock index futures) to be traded on those markets.
OCC is pleased that the agencies recognize throughout the Draft Interagency White Paper that one size does not fit all with regard to sound practices for business continuity planning. Translating the sound practices identified by the agencies into operational reality will be a significant challenge for all entities, regardless of their size or role in the U.S. financial markets. The sound practices, therefore, should be clear but flexible so that entities of all sizes can comply with them in the way most appropriate to their circumstances. For example, it is simply not feasible for OCC, with its 350 employees, to maintain the same business continuity facilities as organizations with thousands of employees and vast financial resources. That said, OCC has always had a state of the art business continuity plan, and the changes that OCC is making in response to the events of September 11, 2001 will strengthen an already robust plan. OCC is committed to operating within the highest standards of business continuity planning in order to be in a position to fulfil its function within the U.S. financial system. When fully implemented, OCC's updated business continuity plan will be consistent with all of the sound practices identified in the Draft Interagency White Paper.
Overall, OCC thinks that the practices outlined by the Draft Interagency White Paper are appropriate and relevant to strengthening the resilience of the financial services industry. However, we do believe that some of the principles and practices enunicated in the Draft Interagency White Paper require clarification and/or revision. We also believe that the agencies and the entities that they regulate would be well served by another opportunity for comment prior to publication of a final interagency statement. This second round of comment on a new draft will help to refine the agencies' thinking on this important issue and will ensure that the affected entities have sufficient involvement in the process of developing the supervisory standards with which they must comply.
At the same time, OCC strongly believes that the agencies must carefully balance the need for comment by affected entities against the risk of providing a "road map" on possible vulnerabilities of the U.S. financial markets to terrorists and others with malicious intent. We are concerned that publication of the Draft Interagency White Paper may have focused too much attention on potential targets in the infrastructure supporting the U.S. financial markets. We respectfully ask the agencies not to lose sight of the continuing need for security in any public solicitation of further comment on the issues raised by the Draft Interagency White Paper.
Definitions of "Core Clearing and Settlement Organizations" and "Significant" Firms
OCC recommends that the agencies clarify the definition of "core clearing and settlement organizations" to insure that the definition encompasses all relevant entities. The Draft Interagency White Paper defines "core clearing and settlement organizations" as market utilities that provide critical clearing and settlement services for financial markets.1 The term financial market is not defined in the Draft Interagency White Paper. However, the Draft Interagency White Paper defines "critical markets" as the markets for federal funds, foreign exchange, commercial paper, and for government, corporate, and mortgage-backed securities.2 This definition of "critical markets" seems to exclude the securities and futures markets that trade derivatives overlying these financial instruments. In light of the longstanding recognition that the markets for equities, options on equities, and futures on equity indexes constitute one market,3 OCC is surprised that some facets of this integrated market do not appear to be covered by the Draft Interagency White Paper.
Failing to identify the markets for derivatives on securities as "critical markets" and their clearing organizations as "core clearing and settlement organizations" would seriously undermine the goals of the Draft Interagency White Paper. The markets for derivatives on securities trade a significant and growing volume of contracts representing a large dollar value. Perhaps as important, these markets provide crucial hedging facilities for the participants in the markets for corporate securities, which are identified as a "critical market" by the Draft Interagency White Paper. The clearing organizations for these markets play a critical role in managing the financial risk of the U.S. financial markets. Preserving the financial markets as a whole in the event of a regional disaster requires preservation of the derivative markets and their supporting infrastructure. Incomplete definitions of "critical market" and "core clearing and settlement organizations" could undermine the goal of the Draft Interagency White Paper.
OCC also recommends clarification of the definition of "firms that play significant roles in critical financial markets." The agencies should ensure that such firms and other key market participants are aware of their classification as such. However, the agencies should do so privately, in a way that avoids raising their profile as potential targets. Knowledge of the identity of these "significant" firms can help to focus and enhance the business continuity efforts of other "significant" firms, "core clearing and settlement organizations," and other participants in the U.S. financial markets. Clear identification of these "significant" firms will also promote appropriate supervision by the agencies. Identifying which firms are "significant" in a particular market is extremely important in our highly integrated, interdependent financial system. Coordination between critical organizations is as important as robust individual plans. Inadequate business continuity planning by even one "significant" firm could compromise the recovery and resumption objectives articulated in the Draft Interagency White Paper.
Recovery and Resumption Objectives
The Draft Interagency White Paper identifies a resumption-time target of no later than two hours for core clearing and settlement organizations.4 OCC is very concerned that this target is too rigid and too aggressive, at least at this time. OCC's technical infrastructure has the theoretical capability to meet this requirement. However, depending on the nature of the wide-scale, regional disruption that OCC has to deal with, this goal may not be realistic. OCC's updated business continuity plan hinges on significant geographic dispersion of its activities so that OCC can recover and resume its critical activities as quickly as possible. However, a clearing organization's ability to resume critical activities is not merely a function of managing its own complex infrastructure. OCC, like other core clearing and settlement organizations, is dependent on other industry entities such as banks and other core clearing and settlement organizations. Clearing organizations are also dependent on utilities beyond the jurisdiction of the agencies. The performance of all of these entities, over which a clearing organization has no control, may make it impossible for the clearing organization to meet a two-hour resumption target. While OCC agrees that the ultimate goal of the industry should be to achieve a resumption of critical activities in a matter of hours after a wide-scale, regional disruption, the agencies should not seek to mandate a specific time period that would apply in all circumstances.
Out-of-Region Labor Resources
OCC recommends reconsideration of the agencies' view that out-of-region back-up locations should not be dependent on the same labor pool as the primary site.5 Unlike the recommendation for separate infrastructure components (transportation, telecommunications, water supply and electrical, IT) at out-of-region back-up locations, OCC does not believe that it is feasible for entities of OCC's size to have primary site and back-up site labor pools that are totally independent. Employees at a secondary site may need to be integrated into the operations of the primary site for training and readiness purposes and to avoid productivity and morale problems that would result if the staff at the secondary site were not being fully occupied on a daily basis. Aside from productivity issues, entities of OCC's size do not have the financial resources to fully staff a geographically remote back-up site with employees whose skills are not utilized daily. The staff at OCC's secondary site will have the skills necessary to provide all core processing services in an emergency. Under normal circumstances, however, they will form part of an integrated labor pool; and when OCC operates from either site, staff of the other site will be involved. The agencies note that there are a variety of ways that firms staff remote back-up sites in a cost-effective manner.6 OCC recommends that the agencies integrate these flexible, effective alternatives into their description of the sound practices for out-of-region labor forces.
Routine Test and Recovery
OCC agrees that rigorous internal testing of recovery procedures and infrastructures is an important part of any robust business continuity plan. However, OCC is concerned by the statement in the Draft Interagency White Paper that coordinated cross-organizational testing of business continuity plans is a sound practice at this time.7 Financial services industry firms and clearing organizations are devoting significant resources to adjusting their business continuity plans to address the issues identified by the real life experience of September 11, 2001. At this time, OCC thinks that individual firms should focus on updating their business continuity plans in response to these events, rather than engaging in labor intensive and costly testing of existing business continuity plans that are currently in a state of flux and will soon be superseded by more robust plans. Instead, OCC recommends that the agencies suggest flexible guidelines and goals for individual entities to conduct tests. Once all significant firms and core clearing and settlement organizations are complying with sound practices, the effort and expense of an industry-wide test may be appropriate.
Many companies, including "significant" firms and "core clearing and settlement organizations" rely on a small number of IT business recovery providers. Vendors of these services, such as SunGard and IBM, host the recovery operations of many businesses at one or more locations. In the event of a wide-scale, regional disaster, with multiple companies declaring disasters at the same time, it is highly likely that the capacity at these recovery sites would be available only on a first come, first served basis. The agencies may want to address whether it is a sound practice to include such sites in a business continuity plan. Maintaining a dedicated recovery site can be a significant financial burden. However, it may be possible for firms to share business recovery sites with other "significant" or "core" entities. The agencies should recognize the selective sharing of recovery sites with dedicated equipment and staff for each entity as a sound practice that reduces concentration risk while making the financial outlays more tolerable for the industry.
Thank you again for the opportunity to comment on the proposed rules. If you would like to discuss any of these issues further, please contact the undersigned at The Options Clearing Corporation at (312) 322-2069.
cc: Chairman Harvey Pitt, SEC