FINRA’s guidance to broker-dealers on pandemic preparedness (coronavirus, COVID-19)

Introduction

In light of mounting concerns about COVID-19, aka the coronavirus, the Financial Industry Regulatory Authority (FINRA) recently published FINRA Regulatory Notice 20-08 – Pandemic-Related Business Continuity Planning, Guidance and Regulatory Relief. Notice 20-08 provides both guidance on pandemic preparedness and regulatory relief to impacted member firms. Notice 20-08 supplements previous guidance on pandemic preparedness that FINRA published in October 2009 in response to the outbreak of influenza A (H1N1) or swine flu. FINRA’s prior guidance is available at FINRA Regulatory Notice 09-59 – FINRA Provides Guidance on Pandemic Preparedness. Member firms are urged to review both notices carefully. Firms should also stay current with respect to COVID-19 related updates from the Centers for Disease Control and Preparedness (the CDC) including, in particular, the CDC’s interim guidance for businesses and employers.

Business continuity plan review

Notice 20-08 urges member firms to review their business continuity plans (BCPs) to ensure they are sufficiently flexible to address a wide range of possible effects in the event of a pandemic. In this regard, member firms may want to review the list of possible pandemic related effects set forth in Notice 09-59, which reflects FINRA’s survey of selected member firms with respect to preparedness for a global pandemic. Concerns identified by the survey participants as possibly arising from a pandemic included: absenteeism (25 percent), telecommunications disruptions (12 percent), and remote work arrangements (12 percent). Additional concerns included commuting (9 percent), provision of customer service (8 percent), transportation (6 percent), trade clearance and settlement (5 percent), counterparties (4 percent), market volatility (4 percent), regulatory filings (4 percent), power disruptions (2 percent), and access to online accounts (1 percent).

Emergency contact information

Notice 20-08 also urges each member firm to review its required emergency contacts to ensure that FINRA has a reliable means of contacting the firm. Member firms may register and update their emergency contact persons through the FINRA Contact System (FCS), which can be accessed through the FCS webpage. Firms that are unable to contact FINRA through their usual contacts due to pandemic or other business disruptions should contact FINRA’s Call Center at 301/590-6500.

BCP activation and business disruptions

Notice 20-08 also urges firms that have activated their BCPs or that are facing business disruptions, whether solved or ongoing, to contact their assigned FINRA Risk Monitoring Analyst.

Remote offices or telework arrangements

Notice 20-08 recognizes that member firms may employ a variety of methods to mitigate the impact of a pandemic, including social distancing, travel restrictions, revised sick leave policies, special pandemic leave time, or specialized seating plans for densely populated floors or buildings. Firms may also employ remote offices or telework arrangements, whether from home or a backup or recovery location.

Firms that use remote offices or telework arrangements should consider how such arrangements might affect their supervisory system and ensure that they establish and maintain a supervisory system that is reasonably designed to supervise the activities of each associated persons working from an alternative or remote location. Similarly, recently issued MSRB Notice 2020-07 also reminds regulated entities of their supervisory requirements in light of COVID-19 concerns.

Firms that use space-sharing arrangements should take into account and address the risks associated with sharing office space, including customer privacy, information security and record-keeping considerations.

Notice 20-08 also suggests that member firms may find it helpful to test broad use of remote offices or telework arrangements prior to activation. Notice 09-59 offers additional guidance and suggestions related to telecommuting preparedness as well as a discussion on regulatory and business considerations, with a particular focus on issues related to absenteeism, remote work arrangements and telecommunications.

Notice 09-59 also includes a list of actions and protocols that survey respondents had activated in response to the H1N1 pandemic. In addition to those listed above, these included:

• distribution of hand sanitizers, masks, gloves and hygiene products;
• increased sanitization and disinfection of facilities;
• increased use of communication channels to disseminate important health and safety information and calm employee and customer concerns;
• travel restrictions and quarantines (voluntary and/or mandatory) often based on CDC recommendations;
• minimization or elimination of group meetings;
• enhanced use of remote meeting and conference call capabilities;
• reassessment and revision of human resource policies and testing of information technology (IT) and remote work capabilities; and
• increased allowable sick time and encouragement to use such time.

Cybersecurity

Notice 20-08 also encourages firms to consider the increased cybersecurity risk that might arise due to the use of remote offices or telework arrangements or even heightened anxiety among associated persons. In particular, firms should consider the need to:

• ensure that virtual private networks and other remote access systems are properly patched with available security updates;
• check that system entitlements are current;
• employ the use of multi-factor authentication for remote access; and
• remind associated persons of cyber risks through education and other exercises designed to promote heightened vigilance.

Customer communications

Firms should consider that they may experience significantly increased customer call volumes or online account usage during a pandemic and should review their BCPs on communicating with customers to ensure customer access to funds and securities. As necessary, firms should also place notices on their websites to keep customers informed of contact persons regarding, trade execution, accounts, and access to funds or securities, and to address other concerns arising from absent employees and/or a reduced ability to communicate with customers.

Military personnel and national guard

Notice 20-08 reminds member firms that FINRA Rule 1210 provides specific relief to persons registered with FINRA who volunteer or are called into active military duty as may occur in the event of an emergency declaration arising from a pandemic. See FINRA’s Active Military Guidance webpage for further information and with respect to providing the required notifications.

Regulatory relief

Notice 20-08 also announces a variety of relief from regulatory requirements, including:

• Form U4 – A temporary suspension of requirements to maintain updated Form U4 information regarding employment addresses for registered persons who temporarily relocate due to COVID-19;
• Form BR – A waiver of the requirement that member firms submit branch office applications on Form BR for any newly opened temporary office locations or space-sharing arrangements established as a result of recent events – though in such case, the firm should use its best efforts to provide written notification to its FINRA Risk Monitoring Analyst in accordance with the requirements set forth in Notice 20-08.
• Regulatory Filings and Responses to FINRA Inquiries – Firms having difficulty making timely filings or responding to regulatory inquiries or investigations should contact their Risk Monitoring Analysts or relevant FINRA department to seek extensions.
• Qualification Examination and Continuing Education Window Expiration – Persons who have a qualification examination or continuing education window that is due to expire are encouraged to contact FINRA regarding an extension.