The Financial Information Forum
October 21, 2002
Jennifer J. Johnson
Office of the Comptroller of the Currency
Re: Draft Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System; Board Docket R-1128, OCC Docket 02-13, SEC File No. S7-32-02
The Financial Information Forum (FIF)1 welcomes the opportunity to comment on the Draft Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System. FIF was formed in 1996 to provide an opportunity for participants to discuss and act upon events and issues that affect the securities processing and market data communities. Through topic-oriented working groups, FIF participants focus on critical issues and productive solutions to technology developments, regulatory practices, and other industry changes. FIF is unique among industry organizations in that its subscriber base includes key third party service providers to the securities industry (including prominent providers of back office and accounting services and real time market data), as well as vendors, exchanges, data consolidators, clearing firms, buy and sell side firms. Changes in the industry impact different organizations in different ways. What might constitute a burden to one type of organization presents an opportunity to another. The cross section of FIF participants helps identify and address areas of common interest or concern allowing well-rounded and objective viewpoints to emerge.
Although regulation, guidance or other changes in the industry are directed at firms, those entities that support firms as third parties are also deeply involved and directly impacted by the same issues as they strive to support their customers in an increasing competitive and rapidly changing environment. Since FIF participants provide data processing services for most broker dealers, FIF has an important role in delivering solutions that are effective in accomplishing BCP and other major objectives.
In the past, the FIF has worked closely with the Securities Industry Association, the Bond Market Association, and with the regulators on the implementation of a wide array of industry initiatives including Y2k, decimalization, STP, and the NASD OATS and TRACE systems. FIF is currently involved in the industry's BCP efforts in the area of industry testing, command centers and service provider inclusion in industry-wide efforts under the leadership of the SIA BCP Steering Committee.
FIF is wholly supportive of the agency efforts to reach out to the financial industry for input to a collective and consistent set of guidelines outlined in draft form in the white paper. FIF has been a participant and observer in many of the meetings held to discuss the white paper and lends its wholehearted support to the SIA and TBMA for the comments in their letter. FIF wishes to touch briefly on a few areas of the white paper for comment, emphasizing that FIF's viewpoint constitutes a "hybrid" of constituent views rather than a single entity or entity type in the industry.
Definitions of Critical Markets/Products
While the white paper gave a good indication of the products and markets viewed as "critical" and subsequent verbal contact between the Agencies with firms and organizations provided more explicit clarification (such as the inclusion of equities under the umbrella term "corporates"), FIF believes that the final viewpoint should contain a concise, definitive list of critical products and markets. Market sizing information is available from industry sources and could be utilized as one of the factors in defining the effected markets. Further, the use of common, industry standard terms in such a list would ease compliance and support a more consistent interpretation of the guidelines.
FIF understands the tiered structure outlined in the white paper and suggests that the final draft provide enough information so that firms have a clear understanding of whether or not they fall into the critical category and what is expected of them should they move from non-critical to critical (or vice versa) at some time in the future.
FIF believes that the term "core clearing and settlement organization" refers to industry utilities (or quasi-utilities), and not to clearing firms, as such. Regardless of how large a clearing firm is, there are numerous other options available in the marketplace. FIF's interpretation is that a clearing firm could well be designated as a "critical firm" but not a core clearing and settlement organization. While FIF believes its interpretation is correct on this point, clarity on the distinction between core clearing and settlement organizations and critical firms would be helpful.
Another factor to consider is a firm's capability to switch to another service. Firms exercise the capability to switch clearing firms and service bureaus. This is not the case with core clearing and settlement organizations.
FIF agrees that the distance between primary and back-up processing sites is a critical consideration in managing business continuity and operational risk. However, because there are other equally critical considerations such as regional infrastructure attributes regarding power grids and telecommunications central offices as single points of failure, as well as technology, labor access and transportation issues that must be factored in to the overall BCP risk management plan, FIF does not believe that a particular distance requirement would be effective as a measurement of compliance. In fact, if a strict distance requirement is imposed firms could be in a position of having to preference this one consideration over a more balanced overall plan for risk mitigation. For example, the determination of distance is related to decisions regarding access to labor, especially for an extended period.
Clearly, access to available and trained labor is vital to any business continuity plan and should be included in industry level guidance. However the characteristics described in the portion of the white paper on separate labor pools appear to be too restrictive to allow flexible, workable alternatives across this broad and deeply diversified industry. In some cases, completely separate and distinct labor pools may be difficult to come by for all positions should the back-up location be in a remote, non-metropolitan area. For example, while the remote site may be staffed full time with cross-trained operations employees and technical support, it is unlikely that literal duplication of every critical and high level management or systems executive is feasible or commercially justifiable. FIF suggests that more flexible language be incorporated to allow for innovation and custom staffing solutions regarding access to labor.
Time to implement
FIF believes that at least one more interim phase of guidance and industry feedback will be necessary prior to making any implementation considerations. Once final views are published, a one-year period should be sufficient for individual industry participants to complete their BCP project plans. Those plans should contain implementation timeframes and targets, but these will necessarily differ due to the vast differences in firms and their circumstances.
The agencies recognize the interdependence of industry participants and as a result the need to test scenarios with other participants. The industry has a superior track record in executing appropriate industry testing with Y2K and decimals being recent examples. FIF already observes the cooperation of all industry entities in developing reasonable and prudent BCP test plans.
Government Interim Relief and Agency Guidance
FIF applauds the Agencies for their cooperative combined effort in providing consistent and reasonable guidance on industry business continuity plans. Any efforts to coordinate with regulators (both domestic and global) to ensure consistency of guidance would ease and speed compliance and also help ensure that the industry as a whole could embrace industry wide sound practices rather than just those critical entities identified. A thorough examination of applicable rules and regulations that might be eased in the event of a disaster, or relief from anti-trust considerations during critical cross industry planning processes would benefit the industry effort.
While market forces and competition alone are powerful drivers, FIF is confident that well articulated guidance issued by the Agencies would assist the industry in achieving the highest levels of business continuity preparation. As opposed to a more restrictive regulation approach, FIF believes that Agency guidance would encourage a greater penetration of compliance across industry firms, non-critical as well as critical, by allowing competition to drive the application of flexible and innovative solutions to meet a common challenge.
We hope that these comments are helpful. If you require any clarification, please contact Charlotte Cooney at (212) 720-0661 or Tom Jordan at (212) 652-4460.