Guide
FINRA Business Continuity Plan Requirements: A Guide for Broker-Dealers
FINRA Rule 4370 requires every member firm to keep a written business continuity plan. Here is what the plan must cover, who must approve it and the technology that makes it work.
Key takeaways
- FINRA Rule 4370 requires a written business continuity plan, updated after any material change and reviewed every year.
- The plan must address 10 minimum elements, from data backup and recovery to how customers get prompt access to their funds and securities.
- A member of senior management who is a registered principal must approve the plan and conduct the annual review.
- Most of the elements depend on technology, so your backups, remote access and communication tools need to match what the plan promises.
The rule
What FINRA Rule 4370 requires
Every FINRA member firm must create and maintain a written business continuity plan with procedures for an emergency or significant business disruption. The procedures must be reasonably designed to let the firm meet its existing obligations to customers, and they must address the firm’s relationships with other broker-dealers and counterparties. The plan must be made available promptly to FINRA staff on request.
The firm must update the plan after any material change to its operations, structure, business or location, and review it every year to decide whether changes are needed. The elements can be tailored to the size and needs of the firm. If an element does not apply, the plan must document why it was left out. If the firm relies on another entity, such as a clearing firm or a technology vendor, for any element or mission critical system, the plan must address that relationship.
Checklist
The 10 elements every FINRA business continuity plan must address
- Data backup and recovery, for both hard copy and electronic records: books and records, email and client files, with protected offsite copies and tested restores.
- All mission critical systems: the systems needed to process securities transactions promptly and accurately, maintain and access customer accounts and deliver funds and securities, including systems run by your clearing firm or vendors.
- Financial and operational assessments: written procedures that let the firm identify changes in its operational, financial and credit risk exposures.
- Alternate communications between customers and the firm, such as phone forwarding, website notices and secondary email.
- Alternate communications between the firm and its employees, such as call trees, mobile phones and Microsoft Teams.
- Alternate physical location of employees, including secure remote work when the office cannot be used.
- Critical business constituent, bank and counterparty impact: how a disruption at a key business partner, bank or counterparty affects the firm.
- Regulatory reporting: how the firm keeps filing required reports during a disruption.
- Communications with regulators: how the firm stays in contact with FINRA and other regulators.
- Prompt customer access to funds and securities: how customers will get prompt access to their funds and securities if the firm determines it is unable to continue its business.
Other requirements
Approval, customer disclosure and emergency contacts
- Senior management approval: a member of senior management who is also a registered principal must approve the plan and is responsible for the annual review.
- Customer disclosure: firms must tell customers how the plan addresses a future significant business disruption and how the firm plans to respond to events of varying scope. At a minimum, the disclosure is given in writing at account opening, posted on the firm’s website and mailed on request.
- Emergency contacts: firms report emergency contact information to FINRA, including two emergency contact persons. At least one must be a member of senior management and a registered principal. Contact information must be updated promptly after any material change, and the designations reviewed as Rule 4517 prescribes.
- Investment advisers: Rule 4370 applies to FINRA member firms. SEC-registered advisers are not covered by it, but SEC guidance on adviser compliance programs lists business continuity among the topics an adviser’s policies should address.
Technology
The IT side of a business continuity plan
Most of the 10 elements depend on systems that have to work when the office, a server or a key vendor does not. A plan that looks complete on paper can still fail if the technology behind it was never tested. Check that your IT covers these points:
- Backups of email, books and records and client files, kept offsite, protected from deletion and restored in a test on a schedule
- A separate backup of Microsoft 365 email, OneDrive, SharePoint and Teams data
- Remote access protected by multi-factor authentication, so staff can work securely from an alternate location
- A phone system that can forward calls to mobile phones or another office
- A written recovery order, with how long each mission critical system can be down
- A current list of vendors, clearing firm contacts and support numbers kept outside your own systems
- A tabletop exercise or recovery test each year, with the results recorded for the annual review
Managed IT
How FinFortify helps broker-dealers with business continuity
Our backup and disaster recovery services provide the backups, restore testing records and technical recovery steps a FINRA business continuity plan relies on. As part of our managed IT services for financial firms, we document mission critical systems, set up secure remote work and help your firm review the technology side of the plan every year. See also our IT compliance services.
This guide is general information about IT and cybersecurity practices, not legal advice. Your compliance officer or counsel should confirm how each rule applies to your firm.
FAQ
FINRA business continuity plan questions
What does FINRA Rule 4370 require?
A written business continuity plan that addresses 10 minimum elements where they apply, is updated after material changes, is reviewed every year and is approved by a member of senior management who is a registered principal. Firms must also disclose a summary of the plan to customers and report emergency contacts to FINRA.
How often must a broker-dealer review its business continuity plan?
At least once a year, and the plan must also be updated whenever there is a material change to the firm’s operations, structure, business or location.
Does the plan have to cover our clearing firm and vendors?
Yes. If the firm relies on another entity for any of the required elements or for a mission critical system, the plan must address that relationship.
Make sure your plan works when you need it
Talk with us about the technology behind your business continuity plan.
