Self-Regulatory Organizations; National Association of Securities Dealers, Inc. and New York Stock Exchange, Inc.; Order Approving Proposed Rule Changes Relating to Business Continuity Planning of Members and Notice of Filing and Order Granting Accelerated Approval of NASD Amendment Nos. 6, 7, and 8

I. Introduction

Pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 (”Act”) and Rule 19b-4 thereunder, the National Association of Securities Dealers, Inc. (“NASD”) on August 7, 2002, and the New York Stock Exchange, Inc. (“NYSE”) on August 16, 2002, filed with the Securities and Exchange Commission (“SEC” or “Commission”) proposed rule changes that would require every member to establish and maintain a business continuity plan (“BCP”) and to provide either NASD or NYSE, as appropriate, with certain emergency contact information. On September 9, 2002, the Commission published notice of both proposals in the Federal Register (“Original Notices”). The Commission received four comments in response to the Original Notices. Thereafter, NASD and NYSE submitted amendments to their respective proposals, which contained their responses to the comment letters. The Commission published notice of the amended proposals in the Federal Register (“Second Notices”). The Commission received four comment letters in response to the Second Notices. Subsequently, NYSE submitted a fourth amendment and NASD submitted its fourth and fifth amendments, which amended the proposals as published in the Second Notices and responded to the comments received in response to the Second Notices. The Commission published notice of these amendments on September 26, 2003 (“Third Notices”). The Commission received 14 comments in response to the Third Notices. On February 10, 2004, NASD submitted a sixth amendment, which responded to the issues raised by the commenters in response to the Third Notice. NASD submitted its seventh and eight amendments on March 23, 2004, and April 5, 2004, respectively, which made minor changes to its proposal. Finally, on March 24, 2004, NYSE submitted a letter responding to the issues raised by the commenters in response to the Third Notice.

This order approves the NASD and NYSE proposals, as amended, and approves NASD Amendment Nos. 6, 7, and 8 on an accelerated basis. In addition, the Commission solicits comment from interested persons on NASD Amendment Nos. 6, 7, and 8.

II. Description of the Proposals

Proposed NASD Rule 3510(a) and proposed NYSE Rule 446(a) set forth a basic requirement for NASD and NYSE members and member organizations to create, maintain, review, and update a written BCP that identifies procedures relating to an emergency or significant business disruption. Under the proposed rules, members' BCPs “must be reasonably designed to enable the member to meet its existing obligations to customers” and address members' existing relationships with other broker-dealers and counter-parties. A member of NASD or NYSE is required to make its BCP available to its respective self-regulatory organization (“SRO”) upon request.

Proposed NASD Rule 3510(b) and proposed NYSE Rule 446(b) require each member to update its BCP in the event of any material change to the member's operations, structure, business, or location. In addition, the proposed rules require every member to conduct, at a minimum, an annual review of its BCP to determine whether any modifications are necessary in light of changes to the member's operations, structure, business, or location.

Both proposed rules require that a BCP be approved by the member. Proposed NASD Rule 3510(d) requires a member of senior management, who must be a registered principal, to approve a BCP and be responsible for conducting the annual review. Proposed NYSE Rule 446(g) requires a senior officer, as defined in NYSE Rule 351(e), to approve and review the BCP on an annual basis.

The proposed rules set forth the elements that a BCP must address, if applicable, which shall be tailored to the size and needs of the member. Specifically, each BCP must address data back-up and recovery (hard copy and electronic); mission critical systems; financial and operational assessments; alternate communications between customers and the member; alternate communications between the member and its employees; alternate physical location of employees; critical business constituent, bank, and counterparty impact; regulatory reporting; communications with regulators; and how the member will assure customers' prompt access to their funds and securities in the event that the member determines that it is unable to continue its business. Finally, if a member relies on another entity for any of the required elements, the BCP must address the relationship with the third party.

Proposed NASD Rule 3510(e) and proposed NYSE Rule 446(d) each require a member to disclose to its customers how its BCP addresses the possibility of a future significant business disruption and how the member plans to respond to events of varying scope. Such disclosure, at a minimum, must be made in writing to customers at account opening, posted on the member's Web site (if the member maintains a Web site), and mailed to customers upon request. As proposed, an NASD or NYSE member would not be required to disclose its actual plan. Instead, the member would be required to disclose only a summary of how its BCP addressed the possibility of significant business disruptions and generally how the member planned to respond.

Proposed NASD Rule 3520(a) requires each member to report to NASD emergency contact information, which includes the designation of two emergency contact persons. The emergency contact persons must be members of senior management and registered principals. Proposed NASD Rule 3520(b) requires members to promptly update emergency contact information in the event of a material change and requires the member's Executive Representative, or his or her designee, to review and update such emergency contact information within 17 days after the end of each calendar quarter.

Proposed NYSE Rule 446(g) requires a member or member organization to designate one or more emergency contact persons who must be senior officers of the firm; to provide the name, title, mailing address, e-mail address, telephone number, and fax number of such person(s); and to notify NYSE promptly of any change in such designations.

NASD proposes that the effectiveness of its new rules be calculated from the date of publication of the Commission's approval order, with different effective dates for clearing firms and introducing firms. Each NASD-member clearing firm must establish a BCP, as required under proposed NASD Rule 3510, within 120 days of the publication of the Commission's approval order. An NASD-member introducing firm must establish a BCP, as required under proposed NASD Rule 3510, within 150 days of the publication of the Commission's approval order. All NASD members (both clearing and introducing firms) must designate their emergency contact persons, as required in proposed NASD Rule 3520, within 60 days of publication of the Commission's approval order. NYSE proposes that its rule will take effect 120 days after Commission approval.

Finally, NASD proposes to offer an optional repository service for its members' BCPs. In its Amendment No. 8, however, NASD stated that this online repository service would be operated through an outside vendor and that any NASD members wishing to use this service would pay a monthly fee directly to the repository.

III. Summary of Comments

In total, the Commission received 22 comment letters on the proposed rule changes. Generally, the commenters supported the proposed new rules. As noted above, NASD and NYSE generally addressed the issues raised in the comment letters received in response to the Original Notices and the Second Notices in subsequent amendments. These amendments, including NASD's and NYSE's responses to the comment letters, were published by the Commission in the Federal Register. In response to the Third Notices, the Commission received 14 comment letters. NASD and NYSE submitted responses to the issues raised in the comments letters the Commission received in response to the Third Notices. The issues raised by the commenters in response to the Third Notices and NASD and NYSE responses are summarized below.

A. Meeting Existing Obligations to Customers

In the Third Notices, NASD and NYSE amended their respective proposals to provide that the procedures set forth in a BCP should be reasonably designed to enable a member to meet its existing obligations to customers and address existing relationships with other broker-dealers and counter-parties. A majority of commenters advocated returning to the language published in the Second Notices, which stated that each member's plan must be “reasonably designed to enable the member to continue its business.” Specifically, the Joint Commenters argued that the phrase “meet its existing obligation to customers” was vague and did not adequately clarify that a member would not be required to continue its business. They also argued that the phrase “address their existing relationships with other broker-dealers and counter-parties” did not stipulate what level of detail would be required in the BCP and appeared to add new requirements to the BCP rather than clarifying that a member would not be required to stay in business.

NASD and NYSE, in response, declined to amend their proposals as suggested. In explaining their decision not to amend this provision of the proposed rules, NASD and NYSE noted the following statement made by the Commission:

The decision by a broker-dealer to risk capital or provide brokerage services on an ongoing basis is, in essence, a matter of business judgment. Given the competitive nature of the securities business, however, the Commission expects there to be incentives for broker-dealers to be prepared to participate in the markets following a wide-scale disruption as soon as the markets' trading facilities become available.

In its Amendment No. 4, NASD stated that it did not intend members to interpret its rule to require them to continue their business in the event of a significant business disruption. NYSE stated that it believed that further amendment was not warranted because its position that members are not required to continue its business is clear and that this position is consistent with the Commission's Policy Statement.

B. Plan Elements

1. Critical Business Constituent, Banks, and Counter-Party Impact

In responding to the Third Notices, one commenter commended the revision to limit the scope of this provision to “critical” counter-parties. However, the commenter requested that NASD and NYSE communicate any criteria that they develop to define such critical relationships at the earliest opportunity. Another commenter argued that the proposal appeared to impose on members the “impossible requirement” of addressing how they would remedy the possible failure of industry-wide systems on which all parties must rely, such as the Depository Trust Company. Several commenters argued that because the terms are not defined the intent of the rule language was vague and ambiguous. Finally, one commenter recommended that NASD and NYSE should use the same rule language to avoid confusion.

In its Amendment No. 6, NASD responded that it believed that members should be responsible for identifying those relationships that it deems critical for purposes of complying with the rule. NASD, however, did state that it would consider, based on its experience with the rule following its adoption, whether to enumerate specific relationships that it views critical to all members. In addition, NASD amended its proposal to read “critical business constituent, bank, and counter-party impact” so that it is identical to the NYSE proposal.

2. Customer Access to Funds and Securities

As noted above, proposed NASD Rule 3510(c)(9) and proposed NYSE 446(c)(10) requires a member's BCP to address “[h]ow the member will assure customers” prompt access to their funds and securities in the event that the member determines that it is unable to continue its business.” This new language was published in the Third Notices. NASD and NYSE stated that this new category should help to ensure that, if a member is unable to continue its business following a significant business disruption, customers could access their funds or securities held through the member.

In response to the Third Notices, one commenter argued that the obligations placed on a firm under the proposed rules might conflict with the obligations of the firm imposed by the Securities Investor Protection Corporation (“SIPC”). NASD and NYSE stated that they did not believe that the provisions conflict with SIPC rules and did not intend for the proposed rule change to have any effect on a member's obligations under such rules. The new provisions require a member only to address how it would assure such access. NASD and NYSE continued that, if a member believed that SIPC rules might affect a member's response to this subsection, the member should address SIPC rules in its BCP. Finally, NASD and NYSE noted that a member could not rely on SIPC membership, by itself, to satisfy its obligations under the proposed rules, because SIPC involvement in the liquidation of a broker-dealer is limited to SIPC's authority under the Securities Investor Protection Act of 1970.

C. Disclosure

In the Third Notices, NASD and NYSE proposed that members disclose to their customers how their BCPs address a future significant business disruption. Several commenters argued that the disclosure provision would be burdensome and costly. The Joint Commenters, for example, maintained that the cost of delivering the summary BCP to customers at account opening outweighed any benefits. The Joint Commenters also noted that a customer receives large amounts of information at account opening and, “as more information is added, the import of the information becomes lost and the customer becomes increasingly frustrated with the account opening process.” Another commenter echoed that “providing a summary that is not easily understood will lead to customer confusion.” This commenter argued that “deficient business continuity plans by member firms can be detected and deterred sufficiently through the regulatory audit process” rather than through public disclosure. In the alternative, the commenter recommended that it would be sufficient for a firm to post its summary BCP on its Web site and provide it on demand rather than to provide it to every customer at account opening. Another commenter—noting that it had identified over 200 mission critical functions in its various departments and developed a response plan for each of these functions—argued that it would be impossible to summarize these plans in any meaningful way.

Two comments raised concerns about disclosing potentially confidential and proprietary information. One commenter also argued that a firm might be subject to liability for breach of contract or misrepresentation if it determined to vary a course of action from what was disclosed in its summary BCP in order to react more appropriately in a recovery situation.

In their responses, NASD and NYSE stated that they continued to believe that this requirement was necessary to enable customers to make educated decisions about whether to place their funds and securities at a specific broker-dealer. NASD and NYSE also stated that they believe that these provisions would encourage members to create adequate contingency plans. In response to one commenter's concern about disclosing confidential and proprietary information, NYSE stated that a member would be required only to summarize the manner in which its BCP addresses the possibility of significant business disruptions. NASD and NYSE reiterated that members would not be required to disclose the specific location of any back-up facilities, any proprietary information contained in the plan, or the parties with whom the member has back-up arrangements.

In order to make the disclosure meaningful, NASD and NYSE stated that, when addressing events of varying scope, a member should: (1) Provide specific scenarios of varying severity (e.g., a firm-only business disruption, a disruption to a single building, a disruption to a business district, a city-wide disruption and a regional disruption); (2) state whether it plans to continue business during that scenario and, if so, its planned recovery time; and (3) provide general information on its intended response. Furthermore, NASD and NYSE stated that the disclosure requirement was necessary to enable customers to make educated decisions about whether to place their funds and securities at a specific firm. Finally, in response to the liability concern, NASD and NYSE stated that a member could include in its BCP cautionary language to the effect that the plan was subject to modification, that an updated plan would be promptly posted on the member's website, and that customers also could obtain an updated plan by requesting a written copy by mail. Plans also can be flexible enough to provide for individualized responses to various events.

D. Emergency Contact Information

In response to the NASD Third Notice, one commenter asserted that NASD's discussion in its Amendment No. 4 suggests that the Executive Representative should have the authority to make potentially time sensitive decisions on behalf of the firm, which may conflict with the governing charter of many member firms. In its Amendment No. 6, however, NASD stated it “in no way sought to alter the scope of authority of a member's Executive Representative to make these types of decisions.”

E. Implementation

In response to the Second Notices, one commenter recommended that the proposed rules should become effective 360 days from the publication of the final rules in the Federal Register. After the Third Notices, this commenter reiterated its view that the proposed implementation schedule was too aggressive, suggesting instead that NASD and NYSE should follow the Commission's implementation dates for trading markets set forth in the Policy Statement. NASD and NYSE both responded that they do not believe that this comparison is appropriate. The Policy Statement sets forth the Commission's view that self regulatory organizations (“SROs”) that operate trading markets and electronic communications networks (“ECNs”) should, among other things, plan to resume trading operations by the next business day in response to a wide-scale business disruption. The current proposals require a member only to create and maintain a BCP that is reasonably designed to meet the member's obligations to its customers and that addresses certain enumerated areas. NYSE also noted that many firms, as a matter of best practices, have already established BCPs. Therefore, NASD and NYSE declined to amend the effective dates.

IV. Discussion

One of the critical “lessons learned” from the events of September 11, 2001, is the need for more rigorous business continuity planning in the financial services industry. Since September 11, the resilience of the U.S. securities markets has been a matter of principal concern to the Commission and to other regulators. In April 2003, for example, the Commission—together with the Office of the Comptroller of the Currency and the Board of Governors of the Federal Reserve System—issued an Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System, which noted that, “because of the interdependent nature of the U.S. financial markets, all financial firms have a role in improving the overall resilience of the financial system. It therefore is appropriate for all financial firms to review their business continuity plans * * * ”.

Subsequently, the Commission issued the Policy Statement, which set forth the Commission's view that SROs that operate trading markets and ECNs should apply certain basic principles in their business continuity planning within a specified timeframe. Specifically, the Commission stated that it expected each SRO market and ECN, among other things, to have a BCP that anticipates the resumption of trading no later than the next business day following a wide-scale business disruption, and that this generally requires geographic diversity between primary and back-up sites. In the Policy Statement, the Commission declined to establish new regulatory requirements for non-ECN broker-dealers but did state:

The establishment of a next-business day resumption goal for the SRO Markets and ECNs should serve as a useful resumption benchmark for securities firms as well. The decision by a broker-dealer to risk capital or provide brokerage services on an ongoing basis is, in essence, a matter of business judgment. Given the competitive nature of the securities business, however, the Commission expects there to be incentives for broker-dealers to be prepared to participate in the markets following a wide-scale disruption as soon as the markets' trading facilities become available.

With their respective proposals, NASD and NYSE are taking an important step in setting forth business continuity planning requirements for broker-dealers that allow for flexibility and the exercise of business judgment, yet at the same time assure that investors have sufficient information to evaluate the level of a firm's BCP and, in any event, that all customers have prompt access to their funds and securities. For the reasons discussed below, the Commission finds that the proposed rule changes, as amended, are consistent with the requirements of the Act and the regulations thereunder. In particular, the Commission believes that NASD's proposal is consistent with Section 15A(b)(6) of the Act which requires, among other things, that the rules of a national securities association be designed to prevent fraudulent and manipulative acts and practices, to promote just and equitable principles of trade, to remove impediments to and perfect the mechanism of a free and open market and a national market system, and in general to protect investors and the public interest. The Commission also believes that NYSE's proposal is consistent with Section 6(b)(5) of the Act which requires, among other things, that the rules of a national securities exchange be designed to prevent fraudulent and manipulative acts and practices, to promote just and equitable principles of trade, to remove impediments to and perfect the mechanism of a free and open market and a national market system, and in general to protect investors and the public interest.

The proposed rules will require member firms to establish written plans that address general areas of business continuity. Requiring every NASD and NYSE member to address how it would handle business disruptions of varying scope is an important first step in reducing the impact of any such disruptions. Although no plan can reasonably be expected to mitigate the effects of every crisis, a firm that has a BCP meeting the requirements of the proposed rules should be in a much better position to respond to a significant event. Furthermore, implementation of the proposed rules by all NASD and NYSE members collectively should reduce the adverse systemic consequences of a disruption that affects multiple firms in a particular area. Therefore, the Commission believes that the new rules should enhance the resilience of the U.S. financial markets generally.

The Commission agrees with the approach taken by the SROs to allow each member the flexibility to tailor its BCP to the nature, type, and scope of its business. The new rules require each member's BCP, at a minimum, to address various aspects of business continuity planning. Thus, the new rules envisage a planning process but do not—except with respect to customer access to funds and securities, described below—dictate the content of the plans that result from that process. For example, although a member firm would be required in its plan to address its mission critical systems and the back-up for such systems, the rules do not require a member to take specific actions such as establishing a back-up facility or obtaining a specified amount of redundant telecommunications capacity.

The Commission believes that NASD and NYSE have identified important elements that must be addressed in each member's BCP. While the new rules are primarily procedures-based rather than standards-based, they include an important provision to encourage NASD and NYSE members to develop thoughtful and robust plans: An obligation to disclose a summary of their BCPs to their customers. This obligation should harness market forces to improve the emergency preparedness of particular firms as well as the securities industry as a whole. The information contained in these public disclosures will allow individual customers (and potential customers) to compare the emergency preparedness of a broker-dealer to that of its competitors and help them to decide where to place their funds and securities. While the new rules establish few minimum standards that the BCP of every NASD or NYSE member must meet, a customer will be in a much better position to evaluate whether a particular firm's emergency preparedness meets his or her expectations.

The summary of the member's BCP that is disclosed to customers should include a discussion of how the broker-dealer intends to respond to events of varying scope (e.g., a firm-only disruption, a disruption to a single building, a disruption to a business district, a city-wide disruption, and a regional disruption); whether the broker-dealer intends to continue its business during each scenario and, if so, the planned recovery time; and how the broker-dealer intends to respond to each scenario. This requirement should give the summary BCP a basic framework against which it can readily be compared to other BCPs. The Commission believes that it is important for customers to understand the capabilities and plans of the NASD or NYSE member with which they choose to do business, and this disclosure should provide investors with such information.

Although the new NASD and NYSE rules are fundamentally process-based, every member is required to include one element in its BCP: A discussion of how the member will assure its customers' prompt access to their funds and securities in the event that the member is unable to operate. A broker-dealer that holds funds and securities on behalf of its customers is acting as the customers' agent. The Commission believes that it is reasonable and consistent with the Act for NASD and NYSE to require that a member address how it will assure customers' access to their funds and securities even if the member cannot operate or determines that it is not economically feasible to continue its business during or after a significant business disruption. The Commission expects that a discussion of this subject will appear on the summary BCP, as a likely concern of any customer is how to recover funds and securities if the broker-dealer is incapacitated.

The Commission believes that it is reasonable and consistent with the Act for NASD and NYSE to require each member to designate emergency contact persons and to provide NASD and NYSE (as appropriate) with emergency contact information for such persons. This information should facilitate efforts to coordinate efforts between NASD or NYSE and its members to resume operations after a significant business disruption. The Commission also believes that it is reasonable and consistent with the Act for NASD and NYSE to require each member to review and update its BCPs and its emergency contact information in the manner and at the times specified in the new rules.

The Commission believes that the implementation timeframes proposed by NASD and NYSE are reasonable and consistent with the Act. In particular, the Commission believes that it is reasonable for NASD to grant its NASD-member introducing firms 30 days more than NASD-member clearing firms, as introducing firms may need to incorporate the business recovery strategies of their clearing firms into their own plans.

The Commission believes that it is reasonable for NASD to arrange with an outside vendor to serve as a repository for its members' BCPs. Use of this service would be voluntary and subject to a monthly fee payable by a member directly to the repository. The Commission believes that this service may be beneficial to members during emergency situations. Specifically, it will enable a member to get a copy of its BCP even if its offices are not accessible.

Pursuant to Section 19(b)(2) of the Act, the Commission finds good cause for approving NASD Amendment Nos. 6, 7, and 8 prior to the thirtieth day after the date of publication of notice thereof in the Federal Register. These amendments make only minor revisions to the rule text that clarify the NASD proposal and do not alter its substance. In addition, the Commission believes that NASD's proposal should be approved, as amended by Amendments Nos. 6, 7, and 8, at the same time as the NYSE proposal to provide consistent regulation among NASD and NYSE members. Accordingly, the Commission believes that good cause exists to approve Amendment Nos. 6, 7, and 8 on an accelerated basis.

V. Solicitation of Comments on NASD Amendment Nos. 6, 7, and 8

Interested persons are invited to submit written data, views, and arguments concerning the foregoing, including whether NASD Amendment Nos. 6, 7, and 8 are consistent with the Act. Persons making written submissions should file six copies thereof with the Secretary, Securities and Exchange Commission, 450 Fifth Street NW., Washington, DC 20549-0609. Comments may also be submitted electronically at the following e-mail address: rule-comments@sec.gov. All comment letters should refer to File No. SR-NASD-2002-108. The file number should be included on the subject line if e-mail is used. To help the Commission process and review your comments more efficiently, comments should be sent in hardcopy or by e-mail but not by both methods. Copies of the submission, all subsequent amendments, all written statements with respect to the proposed rule change that are filed with the Commission, and all written communications relating to the proposed rule change between the Commission and any person, other than those that may be withheld from the public in accordance with the provisions of 5 U.S.C. 552, will be available for inspection and copying in the Commission's Public Reference Room. Copies of such filing will also be available for inspection and copying at the principal office of NASD. All submissions should refer to the File No. SR-NASD-2002-108 and should be submitted by May 4, 2004.

VI. Conclusion

It is therefore ordered, pursuant to Section 19(b)(2) of the Act, that the proposed rule changes (SR-NASD-2002-108 and SR-NYSE-2002-35), as amended, are approved.