Policy Statement: Business Continuity Planning for Trading Markets

Securities and Exchange Commission

[Release No. 34-48545; File No. S7-17-03]

Agency: Securities and Exchange Commission.

Action: Policy statement; request for comment.

Summary: The Securities and Exchange Commission (Commission) is issuing a Policy Statement setting forth its view that self-regulatory organizations operating trading markets (SRO Markets) and electronic communications networks (ECNs) should apply certain basic principles in their business continuity planning within the specified implementation timeframe. The Commission also requests comments on the Policy Statement. After the comment period has closed, the Commission may re-evaluate the Policy Statement in light of the comments received.

Dates: Effective Date: October 1, 2003. Comments must be received on or beforeOctober 31, 2003.

Address: All comments concerning the Policy Statement should be submitted in triplicate to Jonathan G. Katz, Secretary, Securities and Exchange Commission, 450 5th Street, NW, Washington, DC 20549-0609. Comments can be submitted electronically at the following E-mail address: rule-comments@sec.gov. All comment letters should refer to File No. S7-17-03; this file number should be included on the subject line if E-mail is used. To help us process and review your comments more effectively, comments should be sent by one method — U.S. mail or electronic mail only. All comments received will be available for public inspection and copying in the Commission's Public Reference Room, 450 5th Street, NW, Washington, DC 20549. Electronically submitted comment letters will be posted on the Commission's Internet Web site (http://www.sec.gov). The Commission does not edit personal identifying information, such as names or e-mail addresses from electronic submissions. Submit only the information you wish to make publicly available.

For Further Information Contact: Robert Colby, Deputy Director (202) 942-0094; David Shillman, Associate Director, (202) 942-0072; or Peter Chepucavage, Attorney Fellow, (202) 942-0163, Division of Market Regulation, Securities and Exchange Commission, 450 5th Street, NW, Washington DC 20549-1001.

Supplementary Information:

I. Background

A critical "lesson learned" from the events of September 11, 2001 is the need for more rigorous business continuity planning in the financial sector to address problems of wider geographic scope and longer duration than those previously addressed. These events made clear the possibility of a large-scale regional disaster, resulting in a broad consensus in the financial community that business continuity planning needs to adapt to plan for events of wider scope and, in general, become more robust and resilient. Since the September 11 attacks, the U.S. securities markets and market participants have taken significant steps toward this goal by demonstrably improving the robustness of their business continuity plans.

The Commission and other financial regulators also have been devoting substantial resources to efforts designed to strengthen the resilience of the financial sector. For example, the Commission, together with the Board of Governors of the Federal Reserve System and the Office of the Comptroller of the Currency, recently published an Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System (Interagency Paper),¹ that identified "sound practices" relating to business continuity planning for certain key market participants. The goal of this project was to minimize the immediate systemic effects of a wide-scale disruption by assuring that the key payment and settlement systems could resume operation promptly following a wide-scale disaster, and major participants in those systems could recover sufficiently to complete pending transactions. In this way, market participants unaffected by the disaster could continue to operate with minimal disruption and, when those impacted by the event were in a position to resume operations, the critical infrastructure would be available for them to do so. The sound practices identified by the Interagency Paper include: (1) intraday resumption or recovery goals; (2) maintenance of sufficient geographically dispersed resources to meet those goals; and (3) routine testing of business continuity arrangements. The Interagency Paper, however, focuses only on the key payment and settlement systems, and does not address the resilience of the trading markets.

Separately, Commission staff has been reviewing, on an ongoing basis, the efforts of the organized securities markets — the exchanges, Nasdaq, and ECNs — to strengthen their resilience in the post-September 11 environment. To date, these markets have taken a variety of steps to improve their physical security, information system protections, and business continuity capabilities. For example, the New York Stock Exchange (NYSE) has taken substantial measures to physically secure its Wall Street trading floor, and has established an off-site alternative trading floor that could be activated on a next-day basis if the NYSE's Wall Street trading floor was rendered inaccessible. Commission staff continues to work with the organized markets to further increase the robustness of their individual plans. In addition, Commission staff has been exploring with the markets the possibility of mutual back-up arrangements. For example, at the staff's urging, the NYSE and Nasdaq have agreed to serve as back-up trading platforms for each other's securities if a catastrophic event forced an extended closure of one market.

Earlier this year, the Government Accounting Office (GAO) issued a Report² recommending, among other things, that the Commission work with the securities industry to develop goals and strategies to resume trading in securities as rapidly as appropriate in the event of future disruptions, and determine sound business continuity practices that organizations would need to meet these goals. The Commission agreed with the GAO that more needs to be done to prepare the securities markets for the resumption of trading in the event of a crisis, and indicated an intent to consider identifying a time frame against which markets should plan to resume trading following a wide-scale regional disaster.³ By establishing a specific resumption goal, the Commission would provide the securities markets with a consistent benchmark to use in developing more resilient business continuity plans.

II. Policy Statement

In view of the importance of the trading markets to the U.S. financial system, the Commission believes it appropriate⁴ for the SRO Markets and ECNs to prepare for the resumption of trading in the event of a "wide-scale disruption."⁵ Among other things, the trading markets provide the means for financial institutions to adjust their cash and securities positions, and those of their customers, in order to effectively manage liquidity, market, and other risks. These markets also are critical to the capital raising process and for funding daily business operations. With over half of all U.S. households invested in the capital markets, the mechanisms for managing and valuing that wealth — the trading markets — must be highly-resilient.

That said, while there is little doubt that the trading markets collectively are critical to the U.S. financial system, the Commission is of the view that, individually, the markets present a lesser degree of systemic vulnerability than the key clearance and settlement utilities. For one, trading activity is relatively fungible across markets. In today's diverse U.S. national market system, very few securities are traded only in one market. As a result, the Commission believes that, were any single securities market to become incapacitated, trading could be shifted to one or more of the remaining markets. Accordingly, the business continuity planning principles for individual trading markets, set forth below, are somewhat less stringent than the sound practices for the key payment and settlement systems outlined in the Interagency Paper.

Specifically, the Commission expects each SRO Market and ECN to apply the following principles in its business continuity planning:

• Each SRO Market and ECN should have a business continuity plan that anticipates the resumption of trading, in the securities traded by that market, no later than the next business day following a wide-scale disruption.⁶ The resilience of the SRO Market or ECN prescribed by such plans should reflect the extent of alternative trading venues for the securities traded by that market, including the number of sole listings on the market, the market share of the market, and the number of sole members or subscribers of the market. Business continuity plans may focus on strengthening the SRO Market's or ECN's own resilience, on backup arrangements with other markets, or both.
   
• Assuring resumption of trading activities by a market by the next business day generally requires geographic diversity between primary and backup sites.⁷ To be fully resilient, backup sites should not rely on the same infrastructure components (e.g., transportation, telecommunications, water supply, and electric power) used by the primary site, and the operation of such sites should not be impaired by a wide-scale evacuation at or the inaccessibility of staff that service the primary site.
   
• The SRO Markets also should assure the full resilience of important shared information systems, such as the consolidated market data stream generated for the equity and options markets. The market data collection and dissemination systems, for example, are critical to the functioning of the trading markets because of their reliance on accurate and current pricing information.
   
• The effectiveness of back-up arrangements in recovering from a wide-scale disruption should be confirmed through testing.
   
• Each SRO Market and ECN should implement plans reflecting these principles as soon as practicable and strive to do so no later than the end of 2004.

The Commission staff intends to engage in an ongoing and individualized dialogue with each SRO Market and ECN to discuss application of these principles in a manner most appropriate for the particular trading market.

The Commission believes every reasonable effort should be made to assure the prompt and smooth resumption of trading following a wide-scale disruption, and that application of the principles described above is a critical step in achieving that goal. Nevertheless, the Commission notes that, depending on the facts and circumstances of a given event, it may be prudent to defer the reopening of a particular market or markets even if, from a technical standpoint, the resumption of trading is possible. In the case of a disruption of the securities markets, the Commission has a fundamental regulatory interest in assuring the prompt — yet smooth — resumption of trading. Deciding when to reopen the markets will involve an assessment of the operational capabilities of the markets and major market participants, as well as the clearance and settlement system. In a given situation, difficult judgments may be required to strike the appropriate balance between the desire to resume trading as soon as possible, and the practical necessity of waiting long enough to minimize the risk that, when trading resumes, it will be of inferior quality or interrupted by further problems.

Finally, the Commission believes that the establishment of a next-business day resumption goal for the SRO Markets and ECNs should serve as a useful resumption benchmark for securities firms as well. The decision by a broker-dealer to risk capital or provide brokerage services on an ongoing basis is, in essence, a matter of business judgment. Given the competitive nature of the securities business, however, the Commission expects there to be incentives for broker-dealers to be prepared to participate in the markets following a wide-scale disruption as soon as the markets' trading facilities become available.

III. Conclusion

The Commission believes it important for the SRO Markets and ECNs to take concrete steps to strengthen their resilience to address the continuing, serious risks to the U.S. financial system posed by the post-September 11 environment. To date, the trading markets have made significant progress in increasing the robustness of their business continuity plans. By applying the principles outlined in this Policy Statement, the

Commission believes the SRO Markets and ECNs will better assure their own resilience and that of the U.S. financial system. In so doing, they will be promoting one of the paramount objectives of the U.S. securities laws — the maintenance of fair, stable, and orderly markets.

By the Commission.

Dated: September 25, 2003

Endnotes

¹ Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System, SEC Release No. 34-47638 (April 7, 2003).

² Report to Congressional Requesters of the United States General Accounting Office entitled Potential Terrorist Attacks: Additional Actions Would Better Prepare Critical Financial Market Participants (February 12, 2003).

³ See Testimony of Robert L.D. Colby, Deputy Director, Division of Market Regulation, U.S. Securities and Exchange Commission, at Hearing Before the House Subcommittee on Capital Markets, Insurance, and Government Sponsored Enterprises, Committee on Financial Services, entitled Recovery and Renewal: Protecting the Capital Markets Against Terrorism Post 9/11 (February 12, 2003).

⁴ Among other things, the Commission believes that the Policy Statement is consistent with and in furtherance of Sections 2 and 11A (a) (1) (B) and (C) of the Securities Exchange Act of 1934.

⁵ The term "wide-scale disruption" has the same meaning here as in the Interagency Paper. Specifically, a "wide-scale disruption" is an event that causes a severe disruption or destruction of transportation, telecommunications, power, or other critical infrastructure components across a metropolitan or other geographic area and the adjacent communities that are economically integrated with it; or that results in a wide-scale evacuation or inaccessibility of the population within normal commuting range of the disruption's origin.

⁶ Consistent with the approach taken in the Interagency Paper, the next-day resumption objective should provide a concrete goal to plan for and test against. This should not be regarded as a hard and fast deadline that must be met in every emergency situation. Various external factors, such as time of day, scope of disruption, and status of critical infrastructure — particularly telecommunications — can affect actual recovery times.

7 As in the Interagency Paper, however, the Commission does not believe it is necessary or appropriate to prescribe specific mileage requirements for geographically-dispersed backup sites.