On Monday, March 9, 2020, FINRA issued Regulatory Notice 20-08, titled Pandemic-Related Business Continuity Planning, Guidance and Regulatory Relief, to provide guidance and regulatory relief to its members confronting operational and other disruptions resulting from the outbreak of coronavirus (COVID-19).
FINRA Rule 4370 (Business Continuity Plans and Emergency Contact Information) requires that member firms create and maintain a Business Continuity Plan to ensure that firms can meet obligations to customers and other stakeholders in the event of an emergency or significant business disruption. Because of the unprecedented nature of the coronavirus outbreak, FINRA provided tailored guidance on the following topics, among others, to assist its member firms confronting operational issues as a result of the pandemic:
Remote Offices, Telework Arrangements, and Emergency Office Relocations – FINRA encouraged member firms to consider implementing temporary measures such as social distancing, travel restrictions, and revised sick leave policies, and to encourage remote working arrangements to mitigate the impact of a pandemic. FINRA reminded firms of the importance of having a well-established supervisory system that is reasonably designed to supervise the activities of associated persons while working from alternative or remote locations and encouraged members to test-use their remote locations or arrangements prior to disruptive events to ensure the ability to securely connect to and use critical systems.
FINRA also announced that it would temporarily suspend the requirement to maintain updated Form U4 information regarding the office of employment address for any registered person who is required to temporarily relocate due to COVID-19. It also waived the requirement to submit branch office applications on Forms BR for newly opened temporary office locations or space-sharing arrangements established as a result of emergency circumstances. However, FINRA asked member firms to use “best efforts” to provide written notification to a firm’s Risk Monitoring Analyst when that firm relocates personnel to a temporary non-registered location, reminded members of the heightened risks concerning customer privacy, information security and recordkeeping when moving operations to an emergency location, and instructed firms to mitigate these risks appropriately.
Cybersecurity – FINRA instructed firms to consider the increased risk of cyber events because of aberrant large-scale remote work arrangements and the confusion and anxiety associated with the virus itself. FINRA emphasized the importance of being vigilant when surveilling against cyber threats and suggested that firms take specific steps to reduce risks, most importantly through employee education and by ensuring that all cybersecurity technology is up to date.
Communicating with Customers – Given recent extreme market movements, FINRA instructed member firms to plan for the operational challenges caused by higher-than-usual customer call volumes and to ensure that customers have ready access to funds and securities. FINRA encouraged firms to place a notice on their website to provide customers with alternative contacts in the event that a customer wants to execute trades, or to access funds or securities, and is unable to reach a registered representative. FINRA also reminded firms that supervisory control policies and procedures should be in place to mitigate risks concerning communications with customers.
Regulatory Filings and Responses to FINRA Inquires, Matters and Investigations – If a member firm has difficulty making timely regulatory filings (e.g. FOCUS filings, Supplemental FOCUS Information, Form Custody filings) or responses to regulatory inquiries or investigations as a result of the pandemic, it should contact its Risk Monitoring Analyst or the relevant FINRA department to seek an extension. Under appropriate circumstances, FINRA will waive late fees incurred by the member firm. However, FINRA reminds firms of the requirements regarding reserve formula computations and required deposits that are intended to protect customer funds and securities.
