September 11 lessons: core firms need out-of-region back-up within a year

WASHINGTON -- US regulators said in late August they expect the US financial system’s core clearing and settlement firms to begin setting up out-of-region back-up resources within the next year in the light of lessons learned from the devastating September 11 attacks last year on New York’s financial district.

And the firms should aim to have their services up and running again on the same business day that a disaster occurs, said the regulators. But they noted that the emerging industry objective is in fact for a recovery-time target of no later than two hours after the event (see box below).

The regulators also expect those organisations and other financial firms that play a significant role in critical financial markets, to adopt sound practices to strengthen the resilience of the US financial system in the face of a wide-scale, regional disaster. The sound practices were outlined in a draft joint white paper issued by four US regulatory agencies as the first anniversary of the September 11 attacks approached.

The attacks exposed the weakness of having back-up sites in the general region of New York, even if several miles from ground zero, let alone the dangers of having such sites only a few blocks from primary locations.

The paper defines a regional disruption as one that causes severe disruption of transport, telecommunications, power and other infrastructure across a metropolitan or other geographic area.

The four agencies behind the white paper are the Federal Reserve Board, the Office of the Comptroller of the Currency, the Securities and Exchange Commission and the New York State Banking Department.

The four see the paper’s sound practices as most applicable to those such as core clearing and settlement firms that present a type of systemic risk should they be unable to resume "critical activities that support critical markets".

Industry comments on the paper must be made by October 21. Firms will be expected to make any revisions to their current disaster recovery plans that might be needed to comply with the sound practices within 180 days of the agencies issuing their final views.

The white paper identifies three business continuity objectives that have special importance after September 11. These are: rapid recovery of critical operations following a wide-scale, regional disruption; rapid recovery of critical operations following the loss or inaccessibility of staff in at least one major operating location and a high level of confidence that critical internal and external continuity arrangements are effective and compatible.

The paper defines critical markets as the markets for federal funds, foreign exchange and commercial paper as well as the markets for government, corporate and mortgaged-backed bonds.

The paper says firms that play significant roles in critical financial markets are those that participate in sufficient volume or value that their failure to perform critical operations by end of the business day could present systemic risk.

The agencies believe that many, if not most, of the 15 to 20 major banks and the five to 10 major securities firms, and possibly others, play at least one significant role in at least one critical market.

The regulators are thinking of providing additional guidance in terms of market-share or dollar-value thresholds, for example, to help firms identify the category into which they fall. But agencies believe the lessons of September 11 are relevant to all firms involved in the financial system. All firms must therefore decide the extent to which it would be practicable to achieve the broader business recovery targets for critical activities in the near future.

Firms can expect the agencies to review recovery plans for their reasonableness and to take a keen interest in the way they address risk relative to a firm’s position in a critical market or in effecting large value payments.

This will include looking at the probable effects that a disruption of a firm’s activities would have on the financial system. The agencies will look at how firms identify their critical activities, the appropriateness of the recovery and resumption objectives they set, and the adequacy of their plans for achieving those targets.

The regulators will review whether recovery-time and resumption-time targets and implementation plans are consistent with market and peer expectations.

Finally, the agencies will review the firm’s assessment and test plans and results to confirm whether the firm is able to manage its business risks appropriately should a wide-scale, regional disruption occur.

Draft Interagency White Paper on Sound Practices to Strengthen the Resilience of the US Financial System

is available on the website of the Federal Reserve Board, www.federalreserve.gov. It is also available on the websites of the Office of the Comptroller of the Comptroller of the Currency, the Securities and Exchange Commission and the New York Federal Reserve Bank.

Up and running inside two hours is the target The draft joint white paper on sound practices for strengthening the resilience of the US financial system in the face of major regional disruption (see main story) puts the practices under four heads. The regulatory agencies said the practices should reduce the potential of a regional disruption to have an undue impact on one or more critical markets because primary and back-up processes and staff are concentrated in a particular geographic area. First, core clearing and settlement firms and other firms playing significant roles in critical financial markets should identify all critical activities they perform in support of the markets. Second, the clearing and settlement firms should plan both to recover and resume their critical activities fully within the day of any disaster and the emerging industry objective appears to be a resumption-target no later than two hours after the event. For firms playing significant roles in the markets the emerging industry objective appears to be for a recovery target not later than four hours after the event. Third, firms should maintain sufficient out-of-region resources to meet recovery and resumption targets. The arrangements can range from a firm setting up its own out-of-region back-up site for data and operations to arranging for the use of remote outsourced sites. Out-of-region back-up sites should not depend on the same labour pool or infrastructure used by the primary site, and their labour pools should not both be vulnerable to simultaneous evacuation or inaccessibility. Fourth, firms should routinely use or test their individual recovery targets to ensure they work properly. Firms should also co-operate to design and schedule cross-organisation tests to assure the compatibility of individual plans within and across critical markets.