Last week the New York Department of Financial Services (the “Department”) issued letters to all its licensed financial institutions. Based on these letters (available here and here), all Department licensees must assess and plan for the financial risk of COVID-19 and, separately, develop operational plans for managing their response to the virus. The Department requires written responses “as soon as possible” but within 30 days in any case. As a result, impacted businesses should be actively preparing responses to the Department’s detailed request, if they have not already.

Citing the “potentially significant effects an outbreak of COVID-19 could have on your institutions,” the Department “requires that each regulated institution submit a response to DFS describing the institution’s plan of preparedness to manage the risk of disruption to its services and operations.” The Department’s letter regarding such operational preparedness indicates the topics that the Department expects to see reflected within such plans, including:

• Impact Minimization Measures – Preventative measures to minimize operational impact on customers and business partners;
• Scaled Strategies to Outbreak Stages – Documented strategies addressing the impact in stages, so the organizations approach may be scaled in accordance with the effects of the stage of an outbreak (with approximate deployment timeframes);
• Facilities, Resources and Testing Assessments – Assessment of all facilities (including alternative or back-up sites), systems, policies and procedures necessary to continue critical operations and services if members of the staff are unavailable for long periods (perhaps sick) or are working off-site, including an assessment and testing as to whether large scale off-site working arrangements can be activated and maintained to ensure operational continuity;
• Cyber and Fraud Are Contemplated in the Assessments – Any assessment should include an assessment of potential increased cyber-attacks and fraud;
• Employee Health Considerations – An assessment of employee protection strategies, critical to sustaining the entire workforce during the outbreak, including employee awareness and steps employees can take to reduce the likelihood of contracting COVID-19;
• Service Provider Assessments – Of the preparedness of critical outside-party service providers and suppliers (at a minimum, this anticipates contacting these providers and touching base as to their capabilities);
• Communications Plans– Development of a communication plan to effectively communicate with customers, counterparties and the public and to deliver important news and instructions to employees, along with establishing forums for questions to be asked and addressed;
• Testing, Governance and Oversight of the Overall COVID-19 Plan

In addition to operational planning, a separate letter issued by the Department requires institutions to additionally provide a plan “regarding managing the potential financial risk arising from COVID-19.” Such financial risk management plans must assess credit exposure to counterparties impacted by COVID-19 (potentially including stress testing or sensitivity analysis of loan portfolios); assess the valuation of assets impacted by COVID-19; assess overall financial impacts on earnings, profits, capital and liquidity; assess the credit risk ratings of the customers, counterparties and business sectors impacted by COVID-19; and assess “reasonable and prudent steps to assist those adversely impacted by COVID-19.”

The Department has issued a separate letter for institutions engaged in virtual currency activity, and requires operational and financial planning for these businesses as well. Finally, the Department issued a fourth letter on March 10 encouraging banks, credit unions and lenders to “consider all reasonable and prudent steps to assist businesses that have been adversely impacted by COVID-19,” including waiving fees, easing credit terms, and offering payment accommodations.

[View source.]