RIA Business Continuity and Disaster Recovery Planning

Many registered investment adviser (“RIA”) firms haven’t thought about what would happen to their business in the cases of death, being disabled, or even natural disaster. Even if the firm does have a plan, it is often outdated or the designated person(s) of succession are not aware of the decision or don’t have the proper instructions to move forward in the case that the firm experiences an interruption. The objective of establishing a business continuity plan is to hold the firm to their fiduciary obligations and minimize any potential harm to clients due to service interruption. Below we walk through some regulatory and business considerations in regards to business continuity and succession plans, types of firm interruptions, and tips on building your firm’s business continuity plan (“BCP”).

Rules and Regulations

For SEC-Registered Firms:

Rule 206(4)-7:

Under rule 206(4)-7, it is unlawful for an investment adviser registered with the Commission to provide investment advice unless the adviser has adopted and implemented written policies and procedures reasonably designed to prevent violation of the Advisers Act by the adviser or any of its supervised persons. The rule requires advisers to consider their fiduciary and regulatory obligations under the Advisers Act and to formalize policies and procedures to address them.

It is important to note that while federally-registered firms are required to have formal policies and procedures in place, presently there are no stated specific elements to include in the firm’s BCP. Rule 206(4)-7 “requires only that the policies and procedures be reasonably designed to prevent violation of the Advisers Act, and thus need only encompass compliance considerations relevant to the operations of the adviser.”

In June of 2016, the Securities and Exchange Commission proposed a new formal rule that would “require registered investment advisers to adopt and implement written business continuity and transition plans.” However, as it stands today, that rule proposal has not been finalized. Even without a finalized rule, the SEC has regularly stated that it expects RIA firms to have robust business continuity plans in effect today as part of a firm’s fiduciary obligation.

For State-Registered Firms:

NASAA Model Rule 203(a)-1A:

Every investment adviser shall establish, implement, and maintain written procedures relating to a Business Continuity and Succession Plan. The plan shall be based upon the facts and circumstances of the investment adviser’s business model including the size of the firm, type(s) of services provided, and the number of locations of the investment adviser.

This model rule is in effect for those states who have chosen to adopt it formally. Therefore, state-registered RIA firms may be obligated to this or a similar rule under their state’s specific regulatory requirements. 

Types of RIA Firm Interruptions

In each type of interruption, your plan should consist of:

1. Step-by-step process with contact persons and key responsibilities of each person
2. Different procedures in anticipation of different types of temporary interruptions

1. Temporary Interruption

A temporary business interruption includes incidents such as a power outage, internet outage, computer problems, or phone lines going down.

What to consider:

1. Recovery and backup of books and records
2. Alternate means of communicating with clients, vendors, service providers, regulators, and other key personnel
3. Means of monitoring client portfolios and entering trades

2. Extended Interruption

An extended interruption occurs when a firm has to relocate or replace office property or records due to destruction. An extended interruption could occur in the event of a fire, floor, or other natural disaster. Your firm’s BCP should address an extended interruption similar to a temporary interruption with a few additional considerations. 

What to consider:

1. Replacement of:
   1. communications equipment such as phones and computers
   2. books and records
2. Do your employees have the ability to work from home?
3. Do your vendors have a BCP?
4. Does your custodian have back up systems?
5. Are you able to establish a connection to your databases outside the office? 
6. Are you able to reach all of your employees?

3. Permanent Interruption

In the event of retirement, disability, or death of a firm owner, a BCP or succession plan should be set in place. 

Some considerations if:

1.  The firm continues to service clients:
   1. Who takes over the firm? 
   2. How will advisory responsibilities be transferred?
   3. Does the successor have access to the investment adviser registration depository (“IARD”) system?

1. The firm closes down:
   1. Who will communicate the dissolution of the firm?
   2. Who will file the form ADV-W?
   3. Who will store books and records?
   4. Do clients know how to contact their custodians or other relevant parties?
   5. How will unearned fees be refunded?

Tips on building and implementing your RIA firm’s business continuity plan

• Test your plan at least annually for different types of disruptions
• Test physical emergency and backup communication equipment
• Have a both a written and electronic copy of the plan
• Make sure each employee has a copy, has signed, and agreed to abide by the BCP
• If your clients will be transferred to another adviser, possibly get consent in advance
• Check your individual state laws

While there is not a “one-size-fits-all” business continuity plan for RIA firms, it is important to consider your firm’s business model, circumstances, current operations, firm size, and number of locations your firm has when designing a robust business continuity plan.