On March 9, 2020, the Financial Industry Regulatory Authority (FINRA) updated its guidance for broker-dealers’ pandemic-related business continuity plans (BCPs) and issued regulatory guidance and relief from some of their obligations in response to the novel coronavirus (COVID-19) global pandemic. FINRA made clear that Regulatory Notice 20-08 imposes no new rules or obligations on members and applies only to members’ obligations under FINRA’s rules and regulations and not those of other securities regulators. Acknowledging the evolving nature of the crisis, FINRA also invited members to consult with the organization to address additional compliance challenges as they arise, noting that additional regulatory guidance and relief may be provided at a later date. Finally, FINRA indicated that Regulatory Notice 20-08 will remain effective until a subsequent notice of cessation is published.
Under FINRA Rule 4370, all member broker-dealers must create and maintain a written BCP that lays out procedures relating to emergencies and other significant business disruptions. Members must review their BCPs at least annually and also implement updates whenever any material changes to the firm’s operations, structure, business or location occur. BCPs must be flexible and tailored to each member’s needs, while also addressing a list of specified minimum requirements, so long as they apply to the member’s business. Finally, Rule 4370 obligates members to disclose to customers how its BCP addresses potentially significant disruptions, and to provide FINRA with designated emergency contact information.
FINRA previously issued global pandemic guidance to members in October 2009 with Regulatory Notice 09-59 in response to the H1N1 outbreak. Regulatory Notice 09-59 released the results of FINRA’s 2009 Pandemic Survey, which indicated that member firms were most frequently concerned with challenges to their business in the form of absenteeism, telecommunications disruptions, and remote work arrangements, but also expressed concern for disruptions to market infrastructure and counterparties, market volatility, and regulatory filing issues. Firms expressed the greatest interest in FINRA addressing filing obligations, continuing education, and emergency office locations,. Due to the lack of severity of the H1N1 outbreak and the impact to members’ business, however, FINRA did not issue specific guidance or regulatory relief at the time.
Regulatory Notice 20-08
Regulatory Notice 20-08 appears to reflect many of the lessons learned from FINRA’s 2009 Pandemic Survey, as most of the topics identified in Regulatory Notice 09-59 are addressed therein. In particular, FINRA addressed the following issues:
- Consider Pandemic-Related Preparedness in BCPs – FINRA advised members to review their BCPs and to assess their flexibility to handle a wide range of issues stemming from significant disruptions in a pandemic. Firms were advised to particularly focus on matters pertaining to social distancing and personnel concerns (including absenteeism, remote office use, and telework arrangements) and operational limits and challenges that may develop (e.g., limitations on potential travel and transportation, and technological interruptions and slowdowns). Firms were also encouraged to test remote office or telework arrangements with associated persons prior to needing to activate BCPs to ensure connectivity to critical firm systems even from residences. Further, FINRA advised firms to consider the potential need to secure premium or dedicated telecommunications services. Finally, members were advised that testing of BCPs should account for potential increases in cybersecurity risks during this period.
- Remote Offices and Telework Arrangements – To address increases in social distancing measures, travel restrictions, and modified sick leave policies firms may employ, FINRA advised firms that to continue satisfying all supervision requirements under Rule 3110, they should establish and maintain a supervisory system reasonably designed to account for supervising associated persons who are working remotely.
- Cybersecurity Risks – FINRA also advised firms to be cognizant of the increased risk of cybersecurity events resulting from remote office and telework arrangements. In particular, FINRA advised firms to “remain vigilant” about cyber threats, and take the following steps to reduce their risk:
- Ensure that virtual private networks (VPNs) and other remote access systems have received all available updates;
- Check that system entitlements are current;
- Utilize multi-factor authentication for remote access by associated persons; and
- Provide associated persons with education and other reminders on cyber risks.
- Communications Challenges – FINRA also addressed potential communications challenges likely to develop during the COVID-19 pandemic, involving both customers and necessary interactions with FINRA.
- With Customers – FINRA noted that customer calls and online requests may rise due to high market volatility. Firms were encouraged to evaluate in advance their BCPs concerning communications preparedness, and to make sure that customers will have access to funds and securities. FINRA advised firms to examine and amend their supervisory policies and procedures to mitigate the risk of disruptions to online, telephonic, and mail-based communications with customers. Further, should registered representatives become unavailable, FINRA encouraged firms to post notice on their website, and provide customers with updated contact information for trade execution.
- With FINRA – FINRA also noted the importance of firms reviewing their required emergency contact information to ensure FINRA always has a reliable means of contact. Should a firm’s usual contact become unavailable due to COVID-19 or another business disruption, firms were requested to give notice by calling FINRA’s Call Center.
- On-Site Inspections – Recognizing the increased likelihood of remote working and temporary office arrangements, FINRA indicated it would consider temporary postponement of on-site branch office inspections. FINRA acknowledged, however, that this may undercut its own annual regulatory obligation and requested that firms document all of their efforts to properly supervise branch offices despite the operational challenges.
- Form U4/Form BR – Until further notice, FINRA has suspended the requirement to update the working addresses of all registered representatives on their Forms U4. FINRA has also temporarily suspended firms’ requirement to submit Form BR applications where (a) opening temporary offices; or (b) entering into space-sharing arrangements. Instead, FINRA has requested that firms address personnel relocations to unregistered locations by using best efforts to provide a written notification to their FINRA Risk Monitoring Analyst as soon as possible with contact information. However, firms must still account for using temporary non-branch offices, both when utilizing space-sharing arrangements and for office relocations and the re-routing of customer calls to other offices.
- Regulatory Filings and Responses – Recognizing the difficulty the COVID-19 pandemic may create with certain timely regulatory filings and responses to inquiries or investigations, firms were advised to contact their FINRA Risk Monitoring Analysts to seek extensions on filing deadlines. Further, FINRA indicated that depending upon each firm’s circumstances, it may also waive any late filing fees that are incurred. Despite the relief, member firms were advised that in the event of communication disruptions they should still seek to ensure they file all regulatory information in the future by maintaining relevant data until it can be transmitted to FINRA. Further, firms were reminded that even in the pandemic, they were still obligated to satisfy their obligations under SEC Rule 15c3-3 (the “Customer Protection Rule”) to conduct reserve formula computations and make required deposits, as such obligations exist to protect the funds and securities of each member’s customers.
- Qualification Examinations and Regulatory Element Continuing Education – For those associated persons of member firms that are prevented from satisfying qualification examination and continuing education requirements within their permissible timeline due to the COVID-19 pandemic, persons were encouraged to contact FINRA about obtaining an extension and also to call the FINRA Call Center if additional questions or information are necessary.
- Military Personnel and National Guard – FINRA also reminded those associated persons of members who volunteer or are called into active military duty under a declaration of emergency due to the COVID-19 pandemic that FINRA Rule 1210 already provides specific relief from certain of their Registration Requirements. In particular, firms may specifically designate such persons as “inactive” to FINRA, while maintaining their “registered” status for FINRA purposes.
Regulatory Notice 20-08 should provide much needed help to firms seeking to comply with all regulatory obligations while navigating the challenges posed by increased remote work arrangements and the other social distancing measures advised by medical professionals to stem the spread of the coronavirus. Firms will continue to be required, however, to maintain an adequate supervisory system notwithstanding the challenges faced in responding to the COVID-19 pandemic. Firms should also recognize that FINRA continues to expect compliance with other regulatory obligations not address in the Notice, and is likely to pay particular attention to compliance with the Customer Protection Rule.
Much of the current regulatory guidance and relief appears to reflect the same subjects identified by firms in the 2009 Pandemic Survey, evidencing that FINRA appears willing to consider firms’ input when providing guidance on how to adapt BCPs to account for necessary social distancing measures, and relief from other obligations. Firms should consider providing additional feedback to FINRA on any additional issues with regulatory compliance under the circumstances.
Finally, firms must remember that the guidance and regulatory relief in Regulatory Notice 20-08 is temporary. As such, they should to pay close attention to future regulatory notices issued by FINRA that either (a) extend additional guidance or regulatory relief; or (b) announce the cessation of the guidance and relief provided in this Regulatory Notice 20-08.
 See FINRA Rule 4370(c). (Requiring BCPs to at a minimum address: (1) Data back-up and recovery (hard copy and electronic); (2) All mission critical systems; (3) Financial and operational assessments; (4) Alternate communications between customers and the member; (5) Alternate communications between the member and its employees; (6) Alternate physical location of employees; (7) Critical business constituent, bank, and counter-party impact; (8) Regulatory reporting; (9) Communications with regulators; and (10) How the member will assure customers’ prompt access to their funds and securities in the event that the member determines that it is unable to continue its business.)
 As examples, FINRA cited to customer privacy, information security, or recordkeeping obligations of the member.
 For example, FINRA specifically pointed to the difficulties of validating customer identities when accepting orders and requesting disbursement of funds.