NYSE Rulemaking
re: Business Continuity and Contingency Planning
Securities and Exchange Commission
(Release No. 34-48502; File No. SR-NYSE-2002-35)
September 17, 2003
Self-Regulatory Organizations; Notice of Filing of Amendment No. 4 to a Proposed Rule Change by the New York Stock Exchange, Inc. Relating to Business Continuity and Contingency Planning
Pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 ("Act")1 and Rule 19b-4 thereunder,2 notice is hereby given that on September 15, 2003, the New York Stock Exchange, Inc. ("NYSE" or "Exchange") filed with the Securities and Exhange Commission ("Commission") Amendment No. 43 to the proposed rule change as described in Items I, II, and III below, which Items have been prepared by the Exchange. The NYSE submitted the original proposed rule change to the Commission on August 16, 2002, and it was published in the Federal Register on September 9, 2002.4 The NYSE subsequently submitted amendments to the proposed rule change on January 13, 2003;5 March 7, 2003;6 and March 27, 2003.7 Amendment No. 3 incorporated and replaced Amendments Nos. 1 and 2 in their entirety. The Commission published Amendment No. 3 for comment in the Federal Register on April 3, 2003.8 In response to comments received, the NYSE is proposing this Amendment No. 4. The Commission is publishing this notice to solicit comments on the proposed rule change, as amended, from interested persons.
I. Self-Regulatory Organization's Statement of the Terms of Substance of the Proposed Rule Change
The Exchange is filing with the Commission amendments to proposed new NYSE Rule 446 ("Business Continuity and Contingency Plans"). The proposed rule would require members and member organizations to develop, maintain, review, and update business continuity and contingency plans relating to an emergency or significant business disruption.
Below is the text of the proposed rule change, as amended. The base text is that provided in Amendment No. 3. Language added by Amendment No. 4 is in italics; language deleted by Amendment No. 4 is in brackets.
* * * * *
Business Continuity and Contingency Plans
New Rule 446
(a) Members and member organizations must develop and maintain a written business continuity and contingency plan establishing procedures relating to an emergency or significant business disruption. Such procedures must be reasonably designed to enable members and member organizations [to continue their businesses in the event of a future significant business disruption] to meet their existing obligations to customers. In addition, such procedures must address their existing relationships with other broker-dealers, and counter-parties. Members and member organizations must make such plan available to the Exchange upon request.
(b) Members and member organizations must conduct, at a minimum, a yearly review of their business continuity and contingency plan to determine whether any modifications are necessary in light of changes to the member's or member organization's operations, structure, business or location. In the event of a material change to a member's or member organization's operations, structure, business or location, the member or member organization must promptly update its business continuity and contingency plan.
(c) The elements that comprise a business continuity and contingency plan shall be tailored to the size and needs of a member or member organization [so as to enable the member or member organization to continue its business in the event of a future significant business disruption]. Each plan, however, must, at a minimum, address, if applicable:
1) books and records back-up and recovery (hard copy and electronic);
2) identification of all mission critical systems and back-up for such systems;
3) financial and operational risk assessments;
4) alternate communications between customers and the firm;
5) alternate communications between the firm and its employees;
6) alternate physical location of employees;
7) critical business constituent, bank and counter-party impact;
8) regulatory reporting; [and]
9) communications with regulators; and
10) how the member or member organization will assure customers prompt access to their funds and securities in the event the member or member organization determines it is unable to continue its business.
To the extent that any of the above items is not applicable, the member's or member organization's business continuity and contingency plan must specify the item(s) and state the rationale for not including each such item(s) in its plan. If a member or member organization relies on another entity for any of the above-listed categories or any mission critical system, the member's or member organization's business continuity and contingency plan must address this relationship.
(d) Each member or member organization must disclose to its customers how its business continuity and contingency plan addresses the possibility of a future significant business disruption and how the member or member organization plans to respond to events of varying scope. At a minimum, such disclosure must be made in writing to customers at account opening, posted on the Internet website of the member or member organization (if applicable) and mailed to customers upon request.
(e)[(d)] The term "mission critical system," for purposes of this Rule, means any system that is necessary, depending on the nature of a member's or member organization's business, to ensure prompt and accurate processing of securities transactions, including order taking, entry, execution, comparison, allocation, clearance and settlement of securities transactions, the maintenance of customer accounts, access to customer accounts and the delivery of funds and securities.
(f)[(e)] The term "financial and operational risk assessments," for purposes of this Rule, means a set of written procedures that allow members and member organizations to identify changes in their operational, financial, and credit risk exposure.
(g)[(f)] Members and member organizations must designate a senior officer, as defined in Rule 351(e), to approve the Plan, who shall also be responsible for the required annual review, as well as an Emergency Contact Person(s). Such individuals must be identified to the Exchange (by name, title, mailing address, e-mail address, telephone number, and facsimile number). Prompt notification must be given to the Exchange of any change in such designations.
* * * * *
II. Self-Regulatory Organization's Statement of the Purpose of, and Statutory Basis for, the Proposed Rule Change
In its filing with the Commission, the NYSE included statements concerning the purpose of and basis for the proposed rule change, as amended, and discussed any comments it received on the proposed rule change. The text of these statements may be examined at the places specified in Item IV below. The NYSE has prepared summaries, set forth in Sections A, B, and C below, of the most significant aspects of such statements.
A. Self-Regulatory Organization's Statement of the Purpose of, and Statutory Basis for, the Proposed Rule Change
1. Purpose
The purpose of this filing is to amend SR-NYSE-2002-35, a proposed new rule that would require members and member organizations to develop, maintain, review, and update business continuity and contingency plans ("BCPs"), which establish procedures relating to an emergency or significant business disruption. As discussed in more detail below, the proposed amendments to the filing are the result of written comments received to the filing and conversations with Commission staff.
A similar proposal has been submitted by the National Association of Securities Dealers ("NASD").9
Background
On August 16, 2002, the Exchange filed with the Commission proposed new NYSE Rule 446 that would require members and member organizations to establish and maintain business continuity and contingency plans.10 The Original Notice was published for comment in the Federal Register on September 9, 2002.11
The Commission received three comment letters in response to the original proposals of the NYSE and the NASD relating to business continuity planning.12 The Exchange filed Amendment Nos. 1 and 2 that responded to these comments.
Upon consideration of subsequent comments received from the staff of the Commission concerning proposed NYSE Rule 446, the Exchange filed Amendment No. 3 on March 27, 2003, to, among other things, clarify the intent of the proposal. Amendment No. 3 incorporated and replaced Amendment Nos. 1 and 2 in their entirety and was published in the Federal Register on April 3, 2003.13 The Commission received one comment letter in response to the NYSE's Amendment No. 3,14 and three comment letters in response to the comparable amendment filed by NASD.15
- Business Constituent, Bank and Counter-party Impact
Proposed NYSE Rule 446(c)(7) would require that a member's or member organization's BCP address "business constituent, bank and counter-party impact." A commenter asked for clarification of this category.16 Under this proposed category, members and member organizations would be required to establish procedures that assess the impact that a significant business disruption would have on business constituents (businesses with which a member or member organization has an on-going commercial relationship pertaining to the support of the member's or member organization's operating activities), banks (lenders), and counter-parties (such as other broker-dealers or institutional customers). In addition, members and member organizations would be required to provide for alternative actions or arrangements with respect to their contractual relationships with business constituents, banks, and counter-parties upon the occurrence of a material business disruption to either party. The Exchange's Information Memo announcing adoption of the rule would provide the guidance described above with regard to clarification of this requirement.
As discussed in more detail below, the proposed amendments to this provision of the rule received additional comments upon its publication in the Federal Register. The Exchange is responding to those comments in this Amendment No. 4.
- BCPs Should be Reasonably Designed to Enable a Firm to Continue its Business
As originally proposed, a literal reading of proposed NYSE Rule 446, could have suggested that the rule would require members and member organizations to create, maintain, and periodically review a BCP that would have to be effective in enabling them to continue their business in the event of a future significant business disruption.
While the Exchange did not intend to propose a rule which limits the scope of its members' and member organizations' responsibilities in establishing such plans, the rule text did not make clear the NYSE's intention when it first proposed the Rule — that members and member organizations should be obligated to develop a business continuity and contingency plan that is reasonably designed, in light of particular characteristics of the firm, to allow the firm to recover as early as practicable in the event of a future significant business interruption.
Amendment No. 3, as proposed, made clear that the rule would require the creation of not only a written business continuity and contingency plan, but also a reasonably effective plan, to enable a firm to recover as early as practicable in the event of a future significant business interruption.
Amendment No. 4
- Business Constituent, Bank, and Counter-party Impact
As noted above, the Exchange had received comments upon the publication of the changes proposed in Amendment No. 3. A commenter suggested that the requirement to provide for alternative actions or arrangements places an undue burden on members and member organizations, might upset existing contracts, and presupposes that all such actions or arrangements are sufficiently critical to require consideration of alternatives. The commenter suggested that the Exchange "remove the sentence suggesting a requirement to provide for alternatives so as not to confuse the goal of making assessments with the goal of planning alternatives."17
The Exchange disagrees with the commenter that the provision is unduly burdensome or that it might upset existing contracts. The provision would require only that a member or member organization consider and include in its BCP alternative steps that the firm would take in the event that a member's or member organization's critical business constituents, bank, or counter-parties were inaccessible. The rule would not mandate that a member or member organization enter into supplemental contracts or conditional agreements. For example, if a member or member organization were to determine that a telecommunications company was a critical business constituent, the member or member organization would then be required to identify procedures or actions that could be followed in the event that this business constituent was unavailable. Alternatively, the member or member organization could enter into a supplemental agreement with another telecommunications service to provide back-up services. The rule would permit each member or member organization to adopt an approach in dealing with its business constituents, banks, and counter-parties that is best suited to the member's or member organization's particular operations, structure, business, and location. It would require a member or member organization only to assess the effect of a significant business disruption on its business constituents, banks, and counter-parties and determine appropriate actions if faced with any such situation.
The Exchange, however, recognizes that certain business constituent, banking, and counter-party relationships might not be critical to a firm's business or operations. Therefore, in response to comments, the Exchange is amending the category of "business constituent, bank, and counter-party impact" in proposed NYSE Rule 446(c)(7) to read, "[c]ritical business constituents, banks, and counter-parties." Members and member organizations would be responsible for identifying those relationships that they deem critical for purposes of complying with the rule. The Exchange will consider, based on its experience in working with the rule following its adoption, whether to enumerate specific relationships that it views as critical to all members and member organizations.
- BCPs Should be Reasonably Designed to Enable a Firm to Continue its Business
The commenters expressed concern that the language added by Amendment No. 3 to proposed NYSE Rule 446(a) would create a new obligation on a member or member organization to continue its business after a significant business disruption.18 This is not the intention of the proposal. The proposal would not deprive a member or member organization of its autonomy to choose to cease its operations at any time, provided it did so in a manner consistent with applicable laws and Commission and Exchange rules. Nevertheless, to clarify that the rule would not create a new obligation for members and member organizations to continue their businesses, the Exchange is amending the proposed rule.
Specifically, the proposed rule text stating that "[s]uch procedures must be reasonably designed to enable the member or member organization to continue its business in the event of future significant business disruptions" is being amended to read, "[s]uch procedures must be reasonably designed to enable the member or member organization to meet its existing obligations to customers. In addition, such procedures must address its existing relationships with other broker-dealers and counter-parties."
The general principle that firms are not required to remain in business is further recognized in a related amendment that the Exchange is now proposing to make with respect to the categories that a member's or member organization's plan must, at a minimum, address. In particular, following discussions with Commission staff and NASD staff, the Exchange is amending proposed NYSE Rule 446(c) to require a plan to address how a member or member organization would assure customers' prompt access to their funds and securities in the event that the member determines it is unable to continue its business. This new category is intended to address how customers holding funds or securities at the member or member organization would be able to access their funds and/or securities if a member or member organization were unable to continue its business following a significant business disruption.
Commenters also questioned an amendment made by the Exchange to the proposed rule text. As originally proposed, Rule 446(a) would have required that a member or member organization have a plan identifying procedures "to be followed in the event of an emergency or significant business disruption." In Amendment No. 3, the Exchange changed "to be followed in the event of an emergency or significant business disruption" to "relating to an emergency or significant business disruption." The commenters believed that this new language was less clear than the language originally proposed.19 This amendment, however, intends only to reflect that a BCP might include information other than a list of procedures to be followed by the member or member organization in the event of a significant business disruption. For example, a BCP might reference an existing arrangement with another entity that permits the entity to perform services for the member or member organization in the event of a future business disruption. While this arrangement is not necessarily a procedure to be followed by the member or member organization in the event of a significant business disruption, it does reflect the member's or member organization's plan relating to a business disruption and should be included in the member's or member organization's BCP.
Following discussions with Commission staff and NASD staff, the Exchange is amending the proposed rule text to require each member or member organization to disclose to its customers how its business continuity plan addresses the possibility of a future significant business disruption and how the member or member organization plans to respond to events of varying scope. Furthermore, such disclosure must, at a minimum, be made in writing to customers at account opening, posted on the member's or member organization's Internet website (if the member or member organization maintains a website), and mailed to customers upon request.20
The Exchange believes that this requirement would allow investors to evaluate a member's or member organization's BCP when determining whether to place their funds and securities at the specific entity. This requirement also would deter members or member organizations from creating plans that do not adequately address contingency planning. The Exchange, however, notes that members and member organizations would not be required to disclose their entire plans; rather, each member or member organization would be required to create a summary of how its plan addresses the possibility of significant business disruptions and disclose the member's or member organization's general planned responses to significant business disruptions. Members and member organizations would not need to disclose such factors as: the specific location of any back-up facilities; any proprietary information contained in plan; and the parties with whom the member has back-up arrangements. Members and member organizations, however, would need to disclose the existence of back-up facilities and arrangements.
A commenter requested that the proposal indicate the time required for implementation and suggested that this time be 360 days from publication of the final Rule in the Federal Register.21 The NYSE believes that the rule should take effect 120 days after approval by the Commission.
2. Statutory Basis
The NYSE believes that the proposed rule change, as amended, is consistent with the requirements of the Act and the rules and regulations thereunder applicable to a national securities exchange and, in particular, with the requirements of Section 6(b)(5) of the Act.22 Under that section, the rules of the Exchange must be designed to, among other things, foster cooperation and coordination with persons engaged in regulating, clearing, settling, processing information with respect to, and facilitating transactions in, securities; to remove impediments to and perfect the mechanism of a free and open market and a national market system; and, in general, to protect investors and the public interest.
B. Self-Regulatory Organization's Statement on Burden on Competition
The NYSE does not believe that the proposed rule change, as amended, would result in any burden on competition that is not necessary or appropriate in furtherance of the purposes of the Act.
C. Self-Regulation Organization's Statement on Comments on the Proposed Rule Change Received from Members, Participants, or Others
The Exchange received written comments in response to the Original Notice that it responded to Amendment No. 3.23 The Exchange received comments in response to the publication of Amendment No. 3 that it has responded to above.24
III. Date of Effectiveness of the Proposed Rule Change and Timing for Commission Action
Within 35 days of the date of publication of this notice in the Federal Register or with such longer period (i) as the Commission may designate up to 90 days of such date if it finds such longer period to be appropriate and publishes its reasons for so finding, or (ii) as to which the Exchange consents, the Commission will:
(A) by order approve such proposed rule change; or
(B) institute proceedings to determine whether the proposed rule change should be disapproved.
IV. Solicitation of Comments
Interested persons are invited to submit written data, views, and arguments concerning the foregoing, including whether the proposed rule change, as amended, is consistent with the Act. Persons making written submissions should file six copies thereof with the Secretary, Securities and Exchange Commission, 450 Fifth Street NW, Washington DC 20549-0609. Copies of the submission, all subsequent amendments, all written statements with respect to the proposed rule change that are filed with the Commission, and all written communications relating to the proposed rule change between the Commission and any person, other than those that may be withheld from the public in accordance with the provisions of 5 U.S.C. 552, will be available for inspection and copying in the Commission's Public Reference Room. Copies of such filings will also be available for inspection and copying at the principal office of the CBOE. All submissions should refer to File No. SR-NYSE-2002-35 and should be submitted by [insert 21 days from the date of publication].
For the Commission, by the Division of Market Regulation, pursuant to delegated authority.25
Margaret H. McFarland
Deputy Secretary
Endnotes
1 15 U.S.C. 78s(b)(1).
2 17 CFR 240.19b-4.
3 See letter from Darla C. Stuckey, Corporate Secretary, NYSE, to Katherine A. England, Division of Market Regulation ("Division"), Commission, dated September 11, 2003 ("Amendment No. 4").
4 Securities Exchange Act Release No. 46443 (August 30, 2002), 67 FR 57264 ("Original Notice").
5 See letter from Darla C. Stuckey, Corporate Secretary, NYSE, to Nancy Sanow, Division, Commission, dated January 10, 2003 ("Amendment No. 1").
6 See letter from Darla C. Stuckey, Corporate Secretary, NYSE, to Katherine A. England, Division, Commission, dated March 6, 2003 ("Amendment No. 2").
7 See letter from Darla C. Stuckey, Corporate Secretary, NYSE, to Katherine A. England, Division, Commission, dated March 26, 2003 ("Amendment No. 3").
8 Securities Exchange Act Release No. 47584 (March 27, 2003), 68 FR 16334.
9 See Securities Exchange Act Release No. 46444 (August 30, 2002), 67 FR 57257 (September 9, 2002) (notice of original NASD proposal relating to business continuity planning); Securities Exchange Act Release No. 47441 (March 4, 2003), 68 FR 11432 (March 10, 2003) (notice of Amendment Nos. 1, 2, and 3 to NASD proposal).
10 On August 7, 2002, the NASD filed a similar proposal. See Securities Exchange Act Release No. 46444 (August 30, 2002), 67 FR 57257 (September 9, 2002) (SR-NASD-2002-108).
11 See supra note 4.
12 One commenter submitted a single letter that addressed both proposals. See letter from Melvyn Musson, Edward D. Jones & Co. ("Edward Jones"), to Jonathan G. Katz, Commission, dated September 30, 2002. A second commenter submitted two letters that addressed each proposal separately. See letters from Jerry W. Klawitter, Securities Industry Association and Bond Market Association, to Margaret H. McFarland, Deputy Secretary, Commission, dated September 30, 2002 ("SIA/BMA Letter 1"). A third commenter submitted a letter that addressed only the NASD proposal. See letter from Frances M. Stadler, Investment Company Institute, to Jonathan G. Katz, Secretary, Commission, dated September 30, 2002.
13 See supra note 8.
14 See letter from Securities Industry Association and the Bond Market Association to Jonathan G. Katz, Secretary, Commission, dated April 24, 2003 ("SIA/BMA Letter 2").
15 See letter from Securities Industry Association and the Bond Market Association to Jonathan G. Katz, Secretary, Commission, dated March 31, 2003; letter from Thomas K. Heard, A.G. Edwards & Sons, Inc. to Jonathan G. Katz, Secretary, Commission, dated March 31, 2003 ("A.G. Edwards Letter"); letter from Melvyn Musson, Edward Jones, to Jonathan G. Katz, Secretary, Commission, dated March 28, 2003.
16 See SIA/BMA Letter 1.
17 See SIA/BMA Letter 2.
18 See SIA/BMA Letter 2.
19 See SIA/BMA Letter 2; see also A.G. Edwards Letter.
20 See proposed NYSE Rule 446(d).
21 See SIA/BMA Letter 2.
22 15 U.S.C. 78f(b)(5).
23 See supra note 12.
24 See supra note 14-15.
25 17 CFR 200.30-3(a)(12).
http://www.sec.gov/rules/sro/34-48502.htm
