On June 28, 2016, the U.S. Securities and Exchange Commission (the “SEC”) proposed a rule that would make it unlawful for SEC-registered investment advisers to provide investment advice unless the adviser adopts and implements a written business continuity and transition plan (a “BCP”) and reviews that plan at least annually. Although the SEC had previously indicated its expectation that an adviser’s policies and procedures address BCPs in guidance to Rule 206(4)-7 under the Investment Advisers Act of 1940 (the “Advisers Act”), the SEC now proposes to specifically require BCPs. Furthermore, the SEC believes that examinations of advisers’ plans have revealed that they are not sufficiently robust, particularly given the increasing operational complexity of advisory firms and their growing dependence on technology. To address this perceived weakness in advisers’ BCPs, the SEC also proposes to mandate elements of such plans.
Specifically, the proposed rule requires SEC-registered advisers to adopt and implement written BCPs reasonably designed to address operational and other risks related to a significant disruption in the firm’s operations. While the SEC did not specifically define the term “significant business disruptions,” the term has generally been understood to include, among other things, natural disasters, acts of terrorism, cyber-attacks, equipment or system failures, or unexpected loss of a service provider, facilities or key personnel.
Under the proposed rule, an adviser’s BCP must include policies and procedures addressing the following:
- the maintenance of critical operations and systems, and the protection, backup and recovery of data;
- pre-arranged alternate physical location(s) of the adviser’s office(s) and/or employees;
- communications with clients, employees, service providers, and regulators;
- identification and assessment of third-party services critical to the operation of the advisers; and
- a plan of transition that accounts for the possible winding down of the adviser’s business or the transition of the adviser’s business to others in the event the adviser is unable to continue providing advisory services.
While the proposed rule contains specific guidance for each element of a BCP, the staff acknowledged that an adviser’s specific plan need only address the operational and other risks faced by the adviser, taking into consideration the nature and complexity of the adviser’s business, its clients, and its key personnel. For example, the BCP of a large adviser with multiple offices and product lines likely would differ significantly from that of a small adviser offering a single product.
An adviser’s BCP must also address the transition of an adviser’s business. The transition components of a BCP must include:
- policies and procedures intended to safeguard, transfer and/or distribute client assets during transition;
- policies and procedures facilitating the prompt generation of any client-specific information necessary to transition each client account;
- information regarding the corporate governance structure of the adviser;
- the identification of any material financial resources available to the adviser; and
- an assessment of the applicable law and contractual obligations governing the adviser and its clients, including pooled investment vehicles, implicated by the adviser’s transition.
The transition component of the BCP “should also contain policies and procedures that would facilitate the prompt generation of any client-specific information necessary to transition a client account, such as the identity of custodians, positions, counterparties, collateral, and related records of each client,” and enable senior executives to “be able to quickly identify the important decision‑makers within the organization and understand the inter-relationships between the adviser and any affiliated entities to be able to assess whether and how issues at an affiliate may affect the advisory entity.” The proposed rule requires that the adviser’s transition plan consider any material financial resources available to the adviser in times of stress, in order to continue operating, or ways to reduce expenses.
Separately, the proposed rule would require each covered adviser to review the adequacy of its BCP and the effectiveness of its implementation at least annually. The review generally should consider any changes to the adviser’s products, services, operations, critical third-party service providers, structure, business activities, client types, location, and any regulatory changes that might suggest a need to revise the plan. The review generally should include an analysis of whether a BCP adequately protects client interests from being placed at risk and to mitigate such risks even in the event the adviser experiences a significant disruption in its operations. In addition, annual reviews generally should address weaknesses an adviser may have identified in any testing it has done or assessments that have been performed to address the adequacy and effectiveness of its BCP, as well as any lessons learned if an event required the plan to be carried out during the previous year, including any changes made or contemplated as a result of the event.
The SEC is also proposing to amend the “books and records retention rule” under the Advisers Act to require covered advisers to maintain copies of all written BCPs that are in effect or were in effect at any time during the last five years. The proposed rule would also require that advisers keep any records documenting their annual review for five years from the end of the fiscal year in which the review was conducted.