American Bankers AssociationOctober 21, 2002
Jennifer J. Johnson, Esq.
Jonathan G. Katz, Esq.
Office of the Comptroller of the Currency
Ms. Christine Tomczak
Re: Draft Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System Ladies and Gentlemen: On August 30, 2002, the Federal Reserve Board, the Office of the Comptroller of the Currency and the Securities and Exchange Commission, in concert with the New York State Banking Department and the Federal Reserve Bank of New York (the agencies), published a draft White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System. In the paper, the agencies outlined a series of "lessons learned" regarding the resilience of critical U.S. financial markets in the face of wide-scale disruptions, identified a number of sound practices to strengthen the resiliency of our financial system and financial centers, and requested comment on these sound practices. The American Bankers Association (ABA) brings together all categories of banking institutions to best represent the interests of this rapidly changing industry. Its membership - which includes community, regional and money center banks and holding companies, as well as savings associations, trust companies and savings banks - makes ABA the largest banking trade association in the country. The ABA Securities Association (ABASA) is a separately chartered trade association and non-profit affiliate of the ABA whose mission is to represent the interests of banks underwriting and dealing in securities, proprietary mutual funds and derivatives. ABASA supports bank securities operations through research, education, compliance assistance and "peer group" opportunities. The ABA and ABASA wish at the onset to express its strong support for the agencies efforts in publishing the White Paper. The agencies have thoughtfully outlined the vast number of issues that the financial services industry currently faces regarding business recovery and resumption. The comments in this letter concerning the sound practices contained in the White Paper should be read from this perspective. The ABA and ABASA are also heartened at the strengthening public/private partnership that is emerging. For instance, the agencies' draft White Paper was only crafted after a number of discussions with members of the financial services sector, including representatives from ABA and ABASA member institutions. We are also very supportive of the formation of the Financial Services Sector Coordinating Council, on which ABA serves. It is our opinion that the Council will provide a valuable forum for the financial sectors' trade associations to share mutual concerns regarding business continuity and infrastructure protection. We are concerned about the ultimate use intended for the White Paper. It is our understanding that the agencies plan to incorporate these sound practices into supervisory expectations or other forms of guidance. The ABA and ABASA believe that it is premature to move immediately from the White Paper to a set of regulatory policies. It is more productive, in our view, to continue the dialogue that began as a prelude to the draft paper, and that the ultimate goal should be the perpetuation of an effective public/private partnership whose mission is the development of a more resilient financial system. On balance, it appears that to the extent that the White Paper ultimately becomes a form of regulatory guidance, the agencies have diverged from the practice of risk-based supervision and adopted a more prescriptive approach to the risks toward business continuity than exist for any other form of risk management. It is our belief that hard and fast regulations disrupt the ability of individual institutions to make business continuity expenditure and other management decisions based upon the risk that the institution perceives to their critical systems. 1. Economic Impact The White Paper, in our opinion, does not give sufficient credence to the significant financial expenditures that would be necessary to achieve the proposed standard for business resumption and back-up facilities and personnel. An institution should, on a risk-basis, have some discretion to conduct their own cost-benefit analysis to determine the relative value of a particular business continuity strategy. Specific mandates as to resumption schedules and minimum distances take away this discretion and drive up costs. 2. Applicability and Definitions The sound practices contained within the White Paper focus on minimizing immediate systemic effects of wide-scale regional disruption of critical wholesale financial markets, and therefore do not address issues relating to retail financial services. The ABA and ABASA believe that this distinction is appropriate, and therefore supports the intentional exclusion of issues relating to retail financial services. We recommend that the final draft of the White Paper go further by specifically exempting from its application large automated clearing house (ACH) providers and clearinghouses (such as the Federal Reserve's ACH and Electronic Payments Network), since such ACH payments are commonly differentiated from large wholesale payments and settlements. The agencies identified a broad industry consensus on three business continuity objectives:
The agencies view these sound practices as being most applicable to organizations that present a type of systemic risk in the event they are unable to recover or resume critical activities that support critical markets. These organizations, in the agencies view, fall into two categories:
The ABA and ABASA believe that additional guidance is necessary as to the distinction between "core clearing and settlement organizations" and "firms that play a role in critical financial markets." The importance of the distinction is that the White Paper proposes that certain individual firms will be held to the higher business resumption standards the paper sets for core clearing and settlement organizations. We are currently uncertain of the competitive and economic implications of such a distinction. Would it be widely known which institutions were defined as core clearing and therefore subject to higher standards? Would customers gravitate toward such firms, or require those firms that were not defined as core clearing to meet the higher standard anyway? In addition, the White Paper does not address the issue of third party operating systems and the necessity that such systems be held to the same resumption standards as the companies they serve. Many firms use third party operating systems from such vendors as SunGard, ADP, and SEI. Even using such competent partners as these, recovery times are unclear. More to the point, such vendors may not be covered under the White Paper and would not, therefore, be required to adopt the business resumption standards the White Paper describes. Business resumption plans will only be as strong as the weakest link in the chain of activities leading up to recovery. Since these vendors are critical to most firms' operations, we believe further consideration should be given to establish procedures for applying the White Paper's resumption standards to third party vendors. 3. Business Resumption Standards The agencies recommend that firms playing significant roles in critical financial markets should, at a minimum, plan to recover on the same business day. The agencies also note that an emerging industry objective for such firms is to set a recovery-time target of no later than four hours after the event. The ABA and ABASA believe that a four-hour recovery standard for firms that play a significant role in critical markets is impractical. While a "gold standard" of four hours may be emerging, a standard of resuming critical activities the next business day is more practical and achievable. We also believe that the associated costs of such a requirement would have global competitive implications to the extent that the standards are not consistent worldwide. Firms should also be allowed to prioritize their recovery, recovering certain critical activities within the targeted time frames while recovering others within longer time frames. Distinctions should also be made between a firm's activities that need to be restored at full volume and those that can be recovered to the point at which they can handle critical volumes, with full volume at a later time. 4. Back-up Facilities The agencies propose that firms that play significant roles in critical markets, at a minimum, should have back-up arrangements with sufficient out-of-region staff, equipment, and data to recover their critical activities within their recovery-time objectives. Toward this goal, the agencies ask whether some minimum distance from primary sites should be specified for back-up facilities for core clearing and settlement organizations and firms that play significant roles in critical markets (e.g., 200 - 300 miles between primary and back-up sites). The ABA and ABASA support geographic separation. At the same time, we believe that, in proposing to set specific minimum distances for back-up facilities, the agencies are again deviating from a risk-based approach to regulation. The proposal takes away from management the discretion to make such decisions based upon the institution's unique characteristics, making it essentially the very "one-size-fits-all" approach that the agencies are specifically trying to avoid. 5. Timetable for Developing Plans and Implementing Sound Practices To ensure that enhanced business continuity plans are sufficiently coordinated among participants in critical markets, the agencies ask if specific implementation timeframes should be considered. They specifically ask if it is reasonable to expect firms that play significant roles in critical financial markets to achieve sound practices within the next few years. The agencies also inquire as to whether an outside date (e.g. 2007) be set for achieving sound practices to accommodate those firms that may require more time to adopt sound practices in a cost-effective manner, and whether such distant dates communicate a sufficient sense of urgency for the addressing of a wide-scale, regional disruption. The ABA and ABASA believe that an overall requirement that plans be completed by mid-to-late 2003 may be too aggressive. Implementation is dependent upon a variety of factors, the most important of which is a high degree of coordination and cooperation with the telecommunications sector. Also unresolved, but most important, is the existence of any economic incentives to fulfill the proposed White Paper requirements. Given the significant costs involved, we believe there is a role for government to provide such incentives, the existence of which would favorably impact the ability of both the financial services and the telecommunications sectors to enhance the resiliency of our nation's financial system. Conclusion The American Bankers Association and the ABA Securities Association sincerely appreciate the opportunity provided by the agencies to comment on this draft White Paper. We believe the White Paper has continued an important public\private dialogue, which we look forward to furthering this discussion in the near future. If you have any questions or comments on these matters, please contact Doug Johnson, Senior Policy Analyst at (202) 663-5059.
|