Talking BCP With the Federal Reserve Bank of N.Y.

As financial-services firms have resumed everyday activities and even returned to their downtown Manhattan offices, business-continuity planning and disaster recovery continue to be important industry issues. The Securities Industry Association has formed a committee to explore business continuity and has issued a "Lessons Learned" informational paper. The NASD has put out a request for comment on proposed rules requiring member firms to create and maintain business-continuity plans.

The Federal Reserve Bank of New York has also been focusing on BCP and disaster recovery and how the financial industry can better prepare itself in the wake of Sept. 11. The bank hosted a Financial Industry Summit on Business Continuity in February to discuss new business-continuity issues and share what, if anything, needed to be improved upon moving forward. About 20 representatives from the financial-services industry attended the summit, which was co-sponsored by the Controller of the Currency, the New York State Banking Department and the Securities and Exchange Commission. Wall Street & Technology's Senior Associate Editor Cristina McEachern recently spoke with Christopher McCurdy, senior vice president in the bank supervision group of the Federal Reserve Bank of New York, to get an update on these activities.

WS&T: What important information came out of the Financial Industry Summit event?

McCurdy: The upshot of the event was a feeling that there is a fair bit of activity going on at various securities firms, banks and broker/dealers to put their strategies in place for business continuity in light of Sept. 11. It seems that the old strategies, such as single-site outages and moving people to another nearby building, are no longer the only things to prepare against. And the feeling is that it's important to consider loss or inaccessibility of staff. A number of businesses were in the midst of revising and thinking about their strategies and at the end of the meeting the idea was that people from the four agencies would continue to follow up on a bilateral basis with each of the firms that had been at the financial summit.

WS&T: What will come out of those discussions?

McCurdy: As a result of those discussions, the four agencies will be forming their views on sound practices for business continuity, especially with regard to clearance and settlement and how to deal with the problems discussed. The expectation from Vice Chairman Ferguson at the meeting was that those sound practices would be available before the end of the summer.

WS&T: How far along is that process?

McCurdy: What we've been doing since the Summit, what Vice Chairman Ferguson has charged us with, is all four of the agencies have been meeting with each of the firms and we are conducting those interviews with an eye towards developing our views on sound practices.

WS&T: Towards the end of the summer, when you do come out with the paper, is it going to be made up of recommendations or any regulations?

McCurdy: It's too soon to tell exactly what the conclusion will be - we'll have to sort out what makes sense going forward. We don't want to preclude or appear to preclude a conclusion to this, but the key goal is to get all of the regulators on the same page because we understand the need to have them be compatible with what we're doing. But the sound practices suggest that they are not recommendations or mandates but they are a measuring stick against which firms could see where they are and get an idea of what expectations their regulators might have over time in terms of what it takes to be sound in the face of those sorts of issues.

WS&T: In terms of clearance and settlement and processing there were some problems. Will there be any mandates in that area?

McCurdy: The banking agencies - the OCC, FDIC, Federal Reserve - they are reviewing their existing guidance on business continuity and disaster recovery.

WS&T: Not necessarily anything coming out soon?

McCurdy: Not right away, we would want to make sure that the two dovetail so we're not saying one thing one place and something very different in another.

WS&T: What types of topics or problems are you discussing with the participating firms?

McCurdy: The topics are mainly what the activities are that the firms feel are key to the functioning of the markets. What do they feel are the main processes that they need in order to support them? And then any important objectives and a review of practices would include the following: Rapid resumption in the face of wide scale or regional disruptions, how to deal with loss or inaccessibility of staff and what sorts of testing and other ongoing activities would be useful to perform so that they have confidence to be able to do those.

WS&T: How many firms are you talking with?

McCurdy: We had about 20 at the summit and we're doing our best to get to each one of them.

We're all in a room together and the bilateral nature is the four agencies and somebody from one of the participating firms, for example.

WS&T: How will the four agencies release the findings?

McCurdy: The sound-practices practice would, in effect, come from the four of us.

WS&T: Are there any other ongoing initiatives in terms of business-continuity planning and disaster recovery?

McCurdy: There are always supervisory activities that would be carried on by any one of those agencies that might relate to these activities. But in terms of this kind of coordinated due diligence on what's going on out there and what makes sense, this will pretty much be it that I know of.

---

Focusing On BCP

At the Financial Industry Summit on Business Continuity, Roger Ferguson, vice chairman of the Federal Reserve Bank of New York, outlined three areas of vulnerability that regulators and financial firms have found following Sept. 11.

1. Contingency planning generally did not account for region-wide events and some firms found they lost both primary and back-up site. In addition, there were concerns about the loss or inaccessibility of staff.

2. Market-based and geographic concentrations were readily evident and became a source of vulnerability.

3. Critical interdependencies across the industry were apparent. This became evident in the impact of key infrastructure providers on a wide range of financial institutions. Even institutions removed from the New York City area were significantly affected by interdependencies.

Some questions being discussed with participating firms in order to produce a "sound-practices" approach to BCP include:

- What are the costs and benefits of the different approaches to BCP and what would lead firms to adopt one or the other?

- What are the key practices on which the industry should focus in the effort to strengthen BCP?

- What are reasonable recovery times for critical operations and do these need to be consistent across the industry?

-What decisions are firms making now and how prepared is the industry today?

- What can be done to improve crisis management?