Earlier this week, the staff of the SEC’s Division of Investment Management issued a guidance update on business continuity plans for registered investment companies. The update provides the staff’s views on considerations for funds as they assess the complex’s ability to continue operations after a business disruption. While the guidance recognizes that funds cannot anticipate and prevent all business disruptions, the staff states that business continuity planning can help funds mitigate “the impact of significant business disruptions on operations and in servicing investors, as well as in complying with the federal securities laws throughout business continuity events.”
The IM guidance uses the events of last August, when a systems malfunction prevented BNY Mellon from calculating the NAVs of hundreds of funds, to highlight the need for funds to consider business continuity planning. The staff used outreach by IM’s Risk and Examinations Office as well as the SEC’s Office of Compliance Inspections and Examinations during and after the August 2015 incident to inform the guidance. The staff noted during the outreach that most fund complexes have disaster recovery plans covering critical functions performed on behalf of funds. In the staff’s view, critical service providers include the service providers listed in Rule 38a-1 (the adviser, principal underwriter, administrator, and transfer agent), as well as the custodians and pricing agents used by the complex.
According to the guidance, “notable practices” in funds’ business continuity plans include:
- The facilities, technology, employees, and activities conducted by the adviser, affiliates and third party service providers with respect to critical services they perform for the funds
- A broad cross-section of employees from key functional areas
- Involvement by the fund CCO and/or CCO of another entity in the complex in third party oversight conducted by other personnel
- Annual presentations by the adviser and/or critical service providers to the funds’ boards with CCO participation
- Annual testing of the plan, with updates to the board
- CCO and/or other staff monitoring of business continuity outages with reports to the board as warranted.
In addition, the guidance suggests that fund business continuity plans contemplate the following with respect to key service providers:
- Back-up process and contingency plans
- Monitoring incidents and communications protocols
- Understanding the interrelationships among business continuity plans of key service providers
- Contemplating various scenarios.
The guidance was issued on the same day that the Commission issued a rule proposal that would require registered investment advisers to adopt business continuity and transition plans.