Self-Regulatory Organizations; Notice of Filing of Amendment No. 3 to a Proposed Rule Change by the New York Stock Exchange, Inc. Relating to Business Continuity and Contingency Planning

Pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 (“Act”) and Rule 19b-4 thereunder, notice is hereby given that on March 27, 2003, the New York Stock Exchange, Inc. (“NYSE” or “Exchange”) filed with the Securities and Exhange Commission (“Commission”) Amendment No. 3 to the proposed rule change as described in Items I, II, and III below, which Items have been prepared by the Exchange. The NYSE submitted the proposed rule change to the Commission on August 16, 2002, and it was published in the Federal Register on September 9, 2002 (“Original Notice”). The NYSE subsequently submitted amendments to the proposed rule change on January 13, 2003, and March 7, 2003. Amendment No. 3 incorporates and replaces Amendments Nos. 1 and 2 in their entirety. The Commission is publishing Amendment No. 3 to solicit comments on the proposed rule change, as amended, from interested persons.

I. Self-Regulatory Organization's Statement of the Terms of Substance of the Proposed Rule Change

The Exchange is proposing to clarify that proposed new NYSE Rule 446 (“Business Continuity and Contingency Plans”)—which would require members and member organizations to develop, maintain, review, and update business continuity and contingency plans that establish procedures to be followed in the event of an emergency or significant business disruption—also would require such plans to be reasonably designed to enable members and member organizations to continue their businesses in the event of a significant business disruption.

Below is the text of the proposed rule change, as amended. The base text is that provided in the Original Notice. Language added by Amendment No. 3 is in italics; language deleted by Amendment No. 3 is in brackets:

Business Continuity and Contingency Plans

New Rule 446

(a) Members and member organizations must develop and maintain a written business continuity and contingency plan establishing procedures [to be followed in the event of] relating to an emergency or significant business disruption. Such procedures must be reasonably designed to enable members and member organizations to continue their businesses in the event of a future significant business disruption. Members and member organizations must make such plan available to the Exchange upon request.

(b) Members and member organizations must conduct, at a minimum, a yearly review of their business continuity and contingency plan to determine whether any modifications are necessary in light of changes to the member's or member organization's operations, structure, business or location. In the event of a material change to a member's or member organization's operations, structure, business or location, the member or member organization must promptly update its business continuity and contingency plan.

(c) The [requirements of] elements that comprise a business continuity and contingency plan shall be tailored to the size and needs of a member or member organization so as to enable the member or member organization to continue its business in the event of a future significant business disruption. Each plan, however, must, at a minimum, address, if applicable:

(1) books and records back-up and recovery (hard copy and electronic);

(2) identification of all mission critical systems and back-up for such systems;

(3) financial and operational risk assessments;

(4) alternate communications between customers and the firm;

(5) alternate communications between the firm and its employees;

(6) alternate physical location of employees;

(7) business constituent, bank and counter-party impact;

(8) regulatory reporting; and

(9) communications with regulators.

To the extent that any of the above items is not applicable, the member's or member organization's business continuity and contingency plan must specify the item(s) and state the rationale for not including each such item(s) in its plan. If a member or member organization relies on another entity for any of the above-listed categories or any mission critical system, the member's or member organization's business continuity and contingency plan must address this relationship.

(d) The term “mission critical system,” for purposes of this Rule, means any system that is necessary, depending on the nature of a member's or member organization's business, to ensure prompt and accurate processing of securities transactions, including order taking, entry, execution, comparison, allocation, clearance and settlement of securities transactions, the maintenance of customer accounts, access to customer accounts and the delivery of funds and securities.

(e) The term “financial and operational risk assessments,” for purposes of this Rule, means a set of written procedures that allow members and member organizations to identify changes in their operational, financial, and credit risk exposure.

(f) Members and member organizations must designate a senior officer, as defined in Rule 351(e), to approve the Plan, who shall also be responsible for the required annual review, as well as an Emergency Contact Person(s). Such individuals must be identified to the Exchange (by name, title, mailing address, e-mail address, telephone number, and facsimile number). Prompt notification must be given to the Exchange of any change in such designations.

II. Self-Regulatory Organization's Statement of the Purpose of, and Statutory Basis for, the Proposed Rule Change

In its filing with the Commission, the NYSE included statements concerning the purpose of and basis for the proposed rule change and discussed any comments it received on the proposed rule change. The text of these statements may be examined at the places specified in Item IV below. The NYSE has prepared summaries, set forth in Sections A, B, and C below, of the most significant aspects of such statements.

A. Self-Regulatory Organization's Statement of the Purpose of, and Statutory Basis for, the Proposed Rule Change

1. Purpose

The purpose of this amendment is to clarify that the language of proposed NYSE Rule 446 is intended to require not only that members and member organizations conduct a planning process to create a written business continuity and contingency plan, but also that the plan resulting from such process be reasonably designed to enable members and member organizations to continue their businesses in the event of a future significant business disruption.

As described in detail in the Original Notice, the tragic events of September 11, 2001, and their disruptive impact on the manner in which the securities industry operates have re-emphasized the need for greater contingency planning for business continuity. Accordingly, the Exchange has proposed new NYSE Rule 446 which would require members and member organizations to develop, maintain, review, and update business continuity and contingency plans that establish procedures to be followed in the event of an emergency or significant business disruption. Members and member organizations would be required to make such plans available to the Exchange upon request. The proposed rule also would require that members and member organizations designate and notify the Exchange of a senior officer designated to approve and annually review the plans and to designate an emergency contact person(s).

The purpose of Amendment No. 3 is to address concerns that a literal reading of proposed NYSE Rule 446, as set forth in the Original Notice, could suggest that the rule would require members and member organizations only to create, maintain and periodically review a business continuity and contingency plan, but would not obligate members and member organizations to develop a plan that is effective in enabling the member or member organization to continue its business in the event of a future significant business disruption. The Exchange did not intend to propose a rule which limits the scope of its members' and member organizations' responsibilities in establishing such plans. In this regard, in its description of the purpose of the proposed rule change, the Exchange stated that the “disruptive impact” of September 11, 2001 “re-emphasized the need for greater contingency planning for business continuity.” Implicit in planning for “business continuity” is the requirement that members” and member organizations' business plans make it possible for them to continue operating in the event of a significant business disruption. Accordingly, the NYSE believes that members and member organizations should be obligated to develop a business continuity and contingency plan that is reasonably designed, in light of particular characteristics of the firm, to allow the firm to recover as early as practicable in the event of a future significant business interruption.

Accordingly, the Exchange is amending the language of proposed NYSE Rule 446 to clarify that the proposed rule change is intended to require the creation of not only a written business continuity and contingency plan, but also a reasonably effective plan. In light of the concerns regarding the clarity of the original proposed rule text, the Exchange believes that this amendment to the proposed rule change should be published for comment to ensure that interested persons are given notice of the clarification and an opportunity to comment thereon.

2. Statutory Basis

The NYSE believes that the proposed rule change, as amended, is consistent with the requirements of the Act and the rules and regulations thereunder applicable to a national securities exchange and, in particular, with the requirements of Section 6(b)(5) of the Act. Under that section, the rules of the Exchange must be designed to, among other things, foster cooperation and coordination with persons engaged in regulating, clearing, settling, processing information with respect to, and facilitating transactions in, securities; to remove impediments to and perfect the mechanism of a free and open market and a national market system; and, in general, to protect investors and the public interest.

B. Self-Regulatory Organization's Statement on Burden on Competition

The NYSE does not believe that the proposed rule change, as amended, would result in any burden on competition that is not necessary or appropriate in furtherance of the purposes of the Act.

C. Self-Regulation Organization's Statement on Comments on the Proposed Rule Change Received from Members, Participants, or Others

The NYSE received three written comment letters in response to the Original Notice. In response to the comment letters, the Exchange identified the following issues that warranted amendment and/or further clarification:

Annual Review of Business Continuity and Contingency Plans (“BCPs”)

Proposed NYSE Rule 446(b) would require members and member organizations to conduct a yearly review of their business continuity and contingency plans to determine whether any modifications are necessary in light of changes to the member's or member organization's operations, structure, business or location. Some commenters believed that the yearly review requirement was inadequate. Although commenters cited different events that should trigger an update of a BCP, most commenters who dissented believed that the plans should be updated more frequently.

The Exchange believes that BCPs must be updated whenever there is a material change in a firm's operations, structure, business, or location that affects the information set forth in the BCP. In response to industry comments, the Exchange is amending the proposed rule to expand upon this requirement to include the following language:

Members and member organizations must conduct, at a minimum, a yearly review of their business continuity and contingency plan. In the event of a material change to a member's or member organization's operations, structure, business or location, the member or member organization must promptly update its business continuity and contingency plan.

This added language emphasizes that this requirement would be in addition to the yearly review.

Minimum Requirements of a BCP

Proposed Rule 446(c) would set forth the minimum requirements that a BCP must address. Plans would, at a minimum, be required to address: Books and records back-up and recovery (hard copy and electronic); identification of all mission critical systems and back-up for such systems; financial and operational risk assessments; alternate communications between customers and the firm; alternate communications between the firm and its employees; alternate physical location of employees; business constituent, bank, and counter-party impact; regulatory reporting; and communications with regulators.

One commenter stated that all of the items listed above may not be applicable to all members and member organizations. In response to industry comments, the Exchange is amending proposed NYSE Rule 446(c) to include the language “if applicable.” In addition, the rule would require that, if an item is not applicable, a member's or member organization's BCP would have to specify the item(s) and state the rationale for not including such item(s) in its plan. Further, the rule would state that, if a member or member organization relies on another entity for any of the above-listed categories or any mission critical system, the member's or member organization's business continuity and contingency plan must address this relationship.

Business Constituent, Bank and Counterparty Impact

Proposed NYSE Rule 446(c)(7) would require that a member's or member organization's BCP address “business constituent, bank and counterparty impact.” A commenter asked for clarification of this category. Under this proposed category, members and member organizations would be required to establish procedures that assess the impact that a significant business disruption has on business constituents (businesses with which a member or member organization has an on-going commercial relationship pertaining to the support of the member's or member organization's operating activities), banks (lenders), and counter-parties (such as other broker-dealers or institutional customers). In addition, members and member organizations would be required to provide for alternative actions or arrangements with respect to their contractual relationships with business constituents, banks, and counter-parties upon the occurrence of a material business disruption to either party. An Exchange Information Memo announcing adoption of the rule will provide the guidance described above with regard to this requirement of the rule.

Emergency Contact Information

Proposed NYSE Rule 446(f) would require members and member organizations to designate and identify to the Exchange a senior officer to approve and review BCPs, as well as an emergency contact person(s). Prompt notification would have to be given to the Exchange in the event of a change in such designations. While commenters supported this requirement, one commenter suggested that the SROs take a “proactive role in the gathering of this contact information.” The Exchange believes that it has taken a proactive approach in that regard. The Exchange previously required (effective August 30, 2002) that members and member organizations furnish BCP contact information to the Exchange in addition to contact information on other key personnel and that such information be reviewed and updated on a quarterly basis. Such changes in designation are made by members and member organizations through the Exchange's Electronic Filing Platform (“EFP”). The Exchange also established a new emergency notification telephone line (1-866-NYSEDIAL) and website (www.nyse.com/memberinfo) for members and member organizations to access and obtain up-to-date information concerning a disruption to normal NYSE business operations.

Participation in a Corporate-Wide BCP

One commenter raised an issue that, when a member or member organization participates in a corporate-wide BCP of its parent corporation (non-member or member organization) that satisfies the proposed rule requirements, this requirement inappropriately imposes Exchange rules upon non-member organization parents. The Exchange believes that if a member or member organization chooses to participate in a parent company's corporate-wide business continuity plan, the record-keeping, supervision, creation, execution, or updating of that plan must comply with NYSE rules. Participating in a corporate-wide continuity plan is an alternative and is intended to give firms greater flexibility in complying with the proposed rule.

III. Date of Effectiveness of the Proposed Rule Change and Timing for Commission Action

Within 35 days of the date of publication of this notice in the Federal Register or with such longer period (i) as the Commission may designate up to 90 days of such date if it finds such longer period to be appropriate and publishes its reasons for so finding, or (ii) as to which the Exchange consents, the Commission will:

(A) By order approve such proposed rule change; or

(B) Institute proceedings to determine whether the proposed rule change should be disapproved.

IV. Solicitation of Comments

Interested persons are invited to submit written data, views, and arguments concerning the foregoing, including whether the proposed rule change, as amended, is consistent with the Act. Persons making written submissions should file six copies thereof with the Secretary, Securities and Exchange Commission, 450 Fifth Street NW., Washington DC 20549-0609. Copies of the submission, all subsequent amendments, all written statements with respect to the proposed rule change that are filed with the Commission, and all written communications relating to the proposed rule change between the Commission and any person, other than those that may be withheld from the public in accordance with the provisions of 5 U.S.C. 552, will be available for inspection and copying in the Commission's Public Reference Room. Copies of such filings will also be available for inspection and copying at the principal office of the CBOE. All submissions should refer to File No. SR-NYSE-2002-35 and should be submitted by April 24, 2003.