[Federal Register Volume 81, Number 128 (Tuesday, July 5, 2016)]
[Proposed Rules]
[Pages 43530-43556]
[FR Doc No: 2016-15675]

=======================================================================
-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

17 CFR Part 275

[Release No. IA-4439; File No. S7-13-16]
RIN 3235-AL62

Adviser Business Continuity and Transition Plans

AGENCY: Securities and Exchange Commission.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Securities and Exchange Commission (``Commission'' or
``SEC'') is proposing a new rule and rule amendments under the
Investment Advisers Act of 1940 (``Advisers Act''). The proposed rule
would require SEC-registered investment advisers to adopt and implement
written business continuity and transition plans reasonably designed to
address operational and other risks related to a significant disruption
in the investment adviser's operations. The proposal would also amend
rule 204-2 under the Advisers Act to require SEC-registered investment
advisers to make and keep all business continuity and transition plans
that are currently in effect or at any time within the past five years
were in effect.

DATES: Comments should be received on or before September 6, 2016.

ADDRESSES: Comments may be submitted by any of the following methods:

Electronic Comments

     Use the Commission's Internet comment form (http://www.sec.gov/rules/proposed.shtml); or
     Send an email to<EMAIL_ADDRESS>Please include
File Number S7-13-16 on the subject line; or
     Use the Federal eRulemaking Portal (http://www.regulations.gov). Follow the instructions for submitting comments.

Paper Comments

     Send paper comments to Brent J. Fields, Secretary,
Securities and Exchange Commission, 100 F Street NE., Washington, DC
20549-1090.

All submissions should refer to File Number S7-13-16. This file number
should be included on the subject line if email is used. To help us
process and review your comments more efficiently, please use only one
method. The Commission will post all comments on the Commission's
Internet Web site (http://www.sec.gov/rules/proposed.shtml). Comments
are also available for Web site viewing and printing in the
Commission's Public Reference Room, 100 F Street NE., Washington, DC
20549, on official business days between the hours of 10 a.m. and 3
p.m. All comments received will be posted without change; we do not
edit personal identifying information from submissions. You should
submit only information that you wish to make available publicly.
    Studies, memoranda, or other substantive items may be added by the
Commission or staff to the comment file during this rulemaking. A
notification of the inclusion in the comment file of any such materials
will be made available on the Commission's Web site. To ensure direct
electronic receipt of such notifications, sign up through the ``Stay
Connected'' option at www.sec.gov to receive notifications by email.

FOR FURTHER INFORMATION CONTACT: Andrea Ottomanelli Magovern, Senior
Counsel, Zeena Abdul-Rahman, Senior Counsel, John Foley, Senior
Counsel, or Alpa Patel, Branch Chief, at (202) 551- 6787 or
<EMAIL_ADDRESS>Investment Adviser Rulemaking Office, Division of
Investment Management, Securities and Exchange Commission, 100 F Street
NE., Washington, DC 20549-8549.

SUPPLEMENTARY INFORMATION: The Commission is proposing for public
comment new rule 206(4)-4 [17 CFR 275. 206(4)-4] and amendments to rule
204-2 [17 CFR 275.204-2] under the Advisers Act [15 U.S.C. 80b].

Table of Contents

I. Adviser Business Continuity and Transition Plans
    A. Introduction
    B. Background
    1. Business Continuity Planning
    2. Transition Planning
    C. Discussion
    1. Adopt and Implement Business Continuity and Transition Plans
    2. Annual Review
    3. Recordkeeping

II. Economic Analysis
    A. Introduction
    B. Economic Baseline
    C. Benefits and Costs and Effects on Efficiency, Competition,
and Capital Formation
    1. Benefits
    2. Costs
    3. Effects on Efficiency, Competition, and Capital Formation
    D. Reasonable Alternatives
    1. Require Public Availability of Business Continuity and
Transition Plans
    2. Require Business Continuity Plans and/or Transition Plans,
but Do Not Specify Required Components
    3. Require Specific Mechanisms for Addressing Certain Risks in
Every Plan
    4. Vary the Requirements of the Proposed Rule for Different
Subsets of Registered Advisers
    E. Request for Comment
III. Paperwork Reduction Act
    A. The Proposed Rules
    1. Rule 206(4)-4
    2. Rule 204-2
    B. Request for Comment
IV. Initial Regulatory Flexibility Analysis
    A. Reasons for and Objectives of the Proposed Actions
    B. Legal Basis
    C. Small Entities Subject to the Rule and Rule Amendments
    D. Projected Reporting, Recordkeeping and Other Compliance
Requirements
    1. Rule 206(4)-4
    2. Rule 204-2
    E. Duplicative, Overlapping, or Conflicting Federal Rules
    F. Significant Alternatives
    G. Solicitation of Comments
V. Consideration of Impact on the Economy
VI. Statutory Authority

I. Adviser Business Continuity and Transition Plans

A. Introduction

    Today, there are approximately 12,000 investment advisers
registered with the Commission that collectively manage over $67
trillion in assets, an increase of over 140% in the past 10 years.\1\
Advisers manage assets for, and provide investment advice to, a wide
variety of clients, including individuals, charitable organizations,
endowments, retirement plans, and various pooled investment vehicles
such as mutual funds and private funds. Investors turn to advisers for
a variety of services such as helping them to identify financial goals
(including investing for a child's education or preparing for
retirement), analyzing an existing financial portfolio, determining an
appropriate asset allocation, and providing portfolio management or
investment recommendations to help achieve financial goals. Advisers
also play an important role in counseling and advising clients on
complex financial instruments and investments, and in providing advice
and guidance on weathering changing market conditions. The range of
services provided by advisers, and the continued growth in the number
of advisers and assets under management, reflect the critical role
investment advisers play in our capital markets and the importance of
the services they provide to approximately 30 million clients.\2\
---------------------------------------------------------------------------

    \1\ Based on data from the Commission's Investment Adviser
Registration Depository (``IARD'') as of January 4, 2016.
    \2\ Id.
---------------------------------------------------------------------------

    Investment advisers today also participate in and are part of an
increasingly complex financial services industry. Advisers are relying
on technology to a greater extent, managing more complicated portfolios
and strategies that often include complex investments, and are
increasingly relying on the services of third parties such as
custodians, brokers and dealers, pricing services, and technology
vendors \3\ that support their operations.\4\
---------------------------------------------------------------------------

    \3\ We use the terms ``vendor'' and ``service provider''
interchangeably throughout this release.
    \4\ There has been an increase in the diversity of investment
portfolios, strategies, and securities types, the complexity of
portfolio management and operations, and the interconnectedness and
interdependencies of the financial industry. See generally, Global
Association of Risk Professionals (GARP), Risk Principles for Asset
Managers, Prepared by the GARP Buy Side Risk Managers Forum (Sept.
2015) (``Risk Principles for Asset Managers'') at Section 5:
Operational Risk Principles, available at http://go.garp.org/l/39542/2015-09-30/315zdc/39542/90066/BSRMF_Risk_Principles_2015.pdf.
---------------------------------------------------------------------------

    Although the types of registered investment advisers and their
business models may vary significantly, they generally share certain
fundamental operational risks. Of particular concern to the Commission
are those risks that may impact the ability of an adviser and its
personnel to continue operations, provide services to clients and
investors, or, in certain circumstances, transition the management of
accounts to another adviser. Such operational risks include, but are
not limited to, technological failures with respect to systems and
processes (whether proprietary or provided by third-party vendors
supporting the adviser's activities), and the loss of adviser or client
data, personnel, or access to the adviser's physical location(s) and
facilities.
    Operational risks can arise from internal and external business
continuity events. An internal event, such as a facility problem at an
adviser's primary office location, or an external event, such as a
weather-related emergency or cyber-attack, could impact an adviser's
ongoing operations and its ability to provide client services. For
example, both types of events could prevent advisory personnel from
accessing the adviser's office or its systems or documents at a
particular office location. Under these circumstances, an adviser and
its personnel may be unable to provide services to the adviser's
clients and continue its operations while affected by the disruption,
which could result in client harm.\5\ Similarly, operational risks can
arise in the context of a transition event. If, for example, an adviser
is winding down or ceasing operations during a time of stress, then an
adviser's ability to safeguard client assets could be impacted.
---------------------------------------------------------------------------

    \5\ As discussed in Section I.B.1. of this release, if an
adviser is unable to provide services to its clients, its clients'
interests may be at risk. This risk could include the risk of loss
if, for example, an adviser lacks the ability to make trades in a
portfolio, is unable to receive or implement directions from
clients, or if clients are unable to access their assets or
accounts.
---------------------------------------------------------------------------

    We understand that many investment advisers, like other financial
services firms, already have taken critical steps to address and
mitigate the risks of business disruptions, regardless of the source,
as a prudent business measure.\6\ Industry participants have also
stated that the highly competitive environment in which advisers
operate encourages proper risk management and contributes to advisers'
attentiveness to operational risks.\7\ Advisers may recognize the

potential for significant reputational damage and other costs
associated with such risks.\8\ For many advisers, the management of
operational risks is part of the normal course of business to mitigate
issues that could negatively impact client relationships and the
management of client assets (including potential losses).\9\
Deterioration in client relationships or financial losses could cause
clients to move their accounts to another adviser or other financial
services firm, and if done on a large scale, prompt the adviser to
transition its business through a sale or other means or to wind down
its operations and exit the market.
---------------------------------------------------------------------------

    \6\ See infra notes 26-27 and accompanying text (discussing
compliance policies and procedures required by rule 206(4)-7 under
the Advisers Act); see also Comment Letter of BlackRock, Inc. to the
Financial Stability Oversight Council's (``FSOC'') Notice Seeking
Comment on Asset Management Products and Activities (``FSOC
Notice'') (Mar. 25, 2015) (``BlackRock FSOC Comment Letter'') at 10
(``In the normal course of business, asset managers implement
measures to mitigate the impact of potentially disruptive events
through operational risk management programs, including maintaining
business continuity plans . . . and technology disaster recovery
plans . . . .''); Comment Letter of Investment Company Institute to
FSOC Notice (Mar. 25, 2015) (``ICI FSOC Comment Letter'') at 69
(noting that ``funds and key service providers to the industry have
robust plans and strategies in place to facilitate the continuation
or resumption of business operations in the event of an emergency,
regardless of the cause''); Comment Letter of Vanguard to FSOC
Notice (Mar. 25, 2015) (``Vanguard FSOC Comment Letter'') at 23
(``The purpose of business continuity plans is to develop
alternative ways to carry out normal business functions without
access to facilities, systems, and/or key third-party providers of
goods or services to the funds or its adviser.'').
    \7\ See, e.g., Comment Letter of Fidelity Investments to FSOC
Notice (Mar. 25, 2015) (``Fidelity FSOC Comment Letter'') at 22
(``It is not correct to imply that competitive pressures push
managers toward less risk management; in fact those pressures push
funds to improve their risk management practices.''); BlackRock FSOC
Comment Letter at 63 (``The asset management industry is highly
competitive and there are numerous competitors across asset classes
and investment strategies.''); ICI FSOC Comment Letter at 61
(``Regulated fund investors have considerable choice. The industry
is highly competitive, with up to several hundred funds available
within each investment category. Along with investment performance,
the quality of shareholder services is a highly important factor in
attracting and retaining fund investors.'').
    \8\ See, e.g., BlackRock FSOC Comment Letter at 55 (``Issues
related to operational and business continuity risk can be costly
and/or harm an asset manager's reputation with its clients.'');
Comment Letter of Managed Funds Association to FSOC Notice (Mar. 25,
2015) (``MFA FSOC Comment Letter'') at 45 (``It is in every
manager's self-interest to have appropriate plans in place to handle
emergencies.'').
    \9\ See, e.g., BlackRock FSOC Comment Letter at 10 (``In the
normal course of business, asset managers implement measures to
mitigate the impact of potentially disruptive events through
operational risk management programs, including maintaining business
continuity plans . . . .''); Fidelity FSOC Comment Letter at 32
(``Fidelity devotes significant time and resources to ensuring that
we can provide the services our clients expect even in exigent
circumstances.'').
---------------------------------------------------------------------------

    While we understand that many investment advisers already have
taken steps to address and mitigate the risks of business
disruptions,\10\ our staff has observed a wide range of practices by
advisers in addressing operational risk management. The staff
frequently observes advisers managing operational and other risks
through internal practices, procedures, and controls that are typically
assessed by the adviser's legal, compliance, or audit staff, and often
sees independent third-party assessments performed by audit or
compliance firms.\11\ However, the staff also has observed advisers
with less robust planning, causing them to experience interruptions in
their key business operations and inconsistently maintain
communications with clients and employees during periods of stress.\12\
As discussed further below, our staff has noted weaknesses in some
adviser BCPs with respect to consideration of widespread disruptions,
alternate locations, vendor relationships, telecommunications and
technology, communications plans, and review and testing.\13\ Although
disparate practices may exist in light of the varying size and
complexity of registrants, to effectively mitigate such risks we are
proposing to require all SEC-registered investment advisers to have
plans that are reasonably designed to address operational and other
risks related to a significant disruption in the investment adviser's
operations.
---------------------------------------------------------------------------

    \10\ See, e.g., Comment Letter of Securities Industry and
Financial Markets Association and the Investment Adviser Association
to FSOC Notice (Mar. 25, 2015) (``SIMFA/IAA FSOC Comment Letter'')
at 43 (``Of potentially more significant interest, asset managers
are keenly focused on business continuity planning, disaster
recovery, data protection, and cybersecurity issues--not just
because of regulatory requirements . . . but also as a business
imperative.'').
    \11\ We recognize that some asset management firms have well-
established sophisticated enterprise risk management (``ERM'')
practices built upon widely followed frameworks. See, e.g., SIMFA/
IAA FSOC Comment Letter at 42-43. The letter notes that in larger
more sophisticated asset managers, operational risks can be
addressed by an ERM framework such as the Committee of Sponsoring
Organizations (``COSO'') framework that works to identify key risk
elements within the firm and how those elements are monitored and
risks mitigated. See COSO, Enterprise Risk Management--Integrated
Framework (Sept. 2004), available at http://www.coso.org/Publications/ERM/COSO_ERM_ExecutiveSummary.pdf. We understand that
investment advisers with ERM programs typically consider business
continuity as part of their broader management of operational risks.
Accordingly, we believe that an adviser's business continuity and
transition plan under the proposed rule could be a part of the
adviser's existing ERM program.
    \12\ See NEP Risk Alert, infra note 30, at 3.
    \13\ See NEP Risk Alert, infra note 30; see also infra notes 31-
35 and accompanying text.
---------------------------------------------------------------------------

    As described in more detail below, we are concerned about the
adequacy of some advisers' plans to address operational and other risks
associated with business resiliency. Our experience indicates that
clients of advisers who do not have robust plans in place to address
the operational and other risks related to significant disruptions in
their operations are at greater risk of harm during such a disruption
than the clients of advisers who do have such plans in place. As
fiduciaries, investment advisers owe their clients a duty of care and a
duty of loyalty, requiring them to put their clients' interests above
their own.\14\ As part of their fiduciary duty, advisers are obligated
to take steps to protect client interests from being placed at risk as
a result of the adviser's inability to provide advisory services.\15\
---------------------------------------------------------------------------

    \14\ See SEC v. Capital Gains Research Bureau, Inc., 375 U.S.
180, 191, 194 (1963) (noting that the Advisers Act ``reflects a
congressional recognition `of the delicate fiduciary nature of an
investment advisory relationship''' and stating that ``[c]ourts have
imposed on a fiduciary an affirmative duty of `utmost good faith,
and full and fair disclosure of all material facts,' as well as an
affirmative obligation `to employ reasonable care to avoid
misleading' his clients'' (citations omitted)); Transamerica
Mortgage Advisors, Inc. v. Lewis, 444 U.S. 11, 17 (1979) (noting
that the Advisers Act's ``legislative history leaves no doubt that
Congress intended to impose enforceable fiduciary obligations'').
    \15\ See Compliance Programs of Investment Companies and
Investment Advisers, Advisers Act Rel. No. 2204 (Dec. 17, 2003) [68
FR 74714 (Dec. 24, 2003)] (``Compliance Program Adopting Release'')
at n.22 (noting this fiduciary obligation in the context of BCPs).
---------------------------------------------------------------------------

    Section 206(4) of the Advisers Act authorizes the Commission to
adopt rules and regulations that ``define, and prescribe means
reasonably designed to prevent, such acts, practices, and courses of
business as are fraudulent, deceptive, or manipulative.'' Because an
adviser's fiduciary duty obligates it to take steps to protect client
interests from being placed at risk as a result of the adviser's
inability to provide advisory services, clients are entitled to assume
that advisers have taken the steps necessary to protect those interests
in times of stress, whether that stress is specific to the adviser or
the result of broader market and industry events. We believe it would
be fraudulent and deceptive for an adviser to hold itself out as
providing advisory services unless it has taken steps to protect
clients' interests from being placed at risk as a result of the
adviser's inability (whether temporary or permanent) to provide those
services.
    Accordingly, we believe advisers should be required to establish
strong operational policies and procedures that manage the risks
associated with business continuity and transitions. These policies and
procedures should increase the likelihood that advisers are as prepared
as possible to continue operations during times of stress and that they
have taken steps to minimize risks that could lead to disruptions in
their operations. These policies and procedures also should increase
the likelihood that clients are not harmed in the event of a
significant disruption in their adviser's operations. Therefore, today
we are proposing to require SEC-registered advisers to adopt and
implement written business continuity and transition plans that include
certain specific components, and to maintain relevant records of those
plans, in order to facilitate robust business continuity and transition
planning across all SEC-registered advisers.

B. Background

1. Business Continuity Planning
    The rapid recovery and resumption of the financial markets and the
activities that support them underpins the resiliency of the U.S.
financial system.\16\

Business continuity planning is a critical activity that supports
resiliency and one that financial services firms, including investment
advisers, generally should engage in to address the inherent risks they
face in serving their clients' needs. Federal and state financial
market and services regulators, including the Commission, have sought
to highlight and address operational risks and the tools necessary to
manage them, including fulsome business continuity planning for many
financial industry participants.\17\
---------------------------------------------------------------------------

    \16\ See Interagency Paper on Sound Practices to Strengthen the
Resilience of the U.S. Financial System, Securities Exchange Act
Rel. No. 47638 (Apr. 7, 2003) [68 FR 17809 (Apr. 11, 2003)]
(``Interagency Paper''); cf. infra note 21 and accompanying text.
    \17\ See Regulation Systems Compliance and Integrity, Securities
Exchange Act Rel. No. 73639 (Nov. 19, 2014) [79 FR 72251 (Dec. 5,
2014)] (``Regulation SCI Adopting Release''); see also Policy
Statement: Business Continuity Planning for Trading Markets,
Securities Exchange Act Rel. No. 48545 (Sept. 25, 2003). In
addition, we note that banks are subject to the Federal Financial
Institutions Examination Council's (``FFIEC'') business continuity
guidelines, which state that financial institutions should develop
comprehensive BCPs and that ``[t]he goal of the BCP should be to
minimize financial losses to the institution, serve customers and
financial markets with minimal disruptions, and mitigate the
negative effects of disruptions on business operations.'' See FFIEC,
IT Examination Handbook, Business Continuity Planning (Feb. 2015)
(``FFIEC Handbook''), available at http://ithandbook.ffiec.gov/ITBooklets/FFIEC_ITBooklet_BusinessContinuityPlanning.pdf; see also
Board of Governors of the Federal Reserve System, Supervisory Letter
SR 15-3 (Feb. 6, 2015), available at http://www.federalreserve.gov/bankinforeg/srletters/sr1503.htm. The FFIEC is an ``interagency body
empowered to prescribe uniform principles, standards, and report
forms for the federal examination of financial institutions by the
Board of Governors of the Federal Reserve System (FRB), the Federal
Deposit Insurance Corporation (FDIC), the National Credit Union
Administration (NCUA), the Office of the Comptroller of the Currency
(OCC), and the Consumer Financial Protection Bureau (CFPB).'' See
FFIEC, available at https://www.ffiec.gov.
---------------------------------------------------------------------------

    For example, the Financial Industry Regulatory Authority
(``FINRA'') requires broker-dealers to establish business continuity
plans (``BCPs'') reasonably designed to meet existing customer
obligations and address relationships with other broker-dealers and
counterparties.\18\ Additionally, the Commodity Futures Trading
Commission (``CFTC'') has adopted regulations that require swap dealers
and major swap participants to establish and maintain BCPs that are
designed to enable the regulated entity ``to continue or to resume any
operations by the next business day with minimal disturbance to its
counterparties and the market.'' \19\ The North American Securities
Administrator Association (``NASAA'') also recently adopted a model
rule that, if adopted in a particular state, would require investment
advisers registered in that state to have business continuity and
succession plans in place that minimize ``service disruptions and
client harm that could result from a sudden significant business
disruption.'' \20\
---------------------------------------------------------------------------

    \18\ See FINRA Rule 4370 (requiring that member BCPs address
certain elements, including data backup and recovery, all mission
critical systems, alternate communications, alternate physical
location of employees, and critical business constituent (i.e., a
business with which a member firm has an ongoing commercial
relationship in support of the member's operating activities), bank
and counter-party impact); see also NASD, Notice to Members 04-37:
Business Continuity Plans (May 2004), available at https://www.finra.org/sites/default/files/NoticeDocument/p003095.pdf. We
note that investment advisers that are also registered as broker-
dealers would have to comply with FINRA's rule as well as the
proposed rule. However, as noted herein, we have modeled much of the
proposed rule, including the required components of a business
continuity and transition plan, on BCP requirements for other
financial services firms that we believe share similar
vulnerabilities as investment advisers. See infra notes 61-62 and
accompanying text.
    \19\ See 17 CFR 23.603(a). Relevant BCPs must be designed to
recover all documentation and data required to be maintained by
applicable law and regulation, and are required to include certain
required components that are related to, among other things, data
backup, systems maintenance, communications, geographic diversity,
and third parties. See infra notes 62, 71, 79, and 86.
    \20\ See NASAA Model Rule 203(a)-1A (stating that all plans
should provide for backup of books and records, alternate means of
communication, office relocations, assignment of duties to qualified
persons in the event of death or unavailability of key personnel,
and otherwise minimizing service disruption and client harm); see
also Mark Schoeff Jr., State Regulators to Require Continuity Plans,
Investment News, (Apr. 22, 2015), available at http://www.investmentnews.com/article/20150422/FREE/150429965/state-regulators-to-require-continuity-plans.
---------------------------------------------------------------------------

    In addition, we recently adopted rules to strengthen the technology
infrastructure of the U.S. securities markets by adopting Regulation
Systems Compliance and Integrity, or Regulation SCI, which applies to,
among other things, self-regulatory organizations, certain alternative
trading systems, and certain exempt clearing agencies.\21\
Specifically, Regulation SCI is designed to reduce the occurrence of
systems issues and improve resiliency for key market participants when
these problems do occur, and requires, among other things, relevant
entities to have and test business continuity and disaster recovery
plans. While these regulations and those of other regulatory bodies
address different entities, they generally highlight similar principles
of business continuity planning, including the need to address critical
systems, data backup, communications, alternate and/or geographically
diverse locations, and third-party relationships.
---------------------------------------------------------------------------

    \21\ See Regulation SCI Adopting Release, supra note 17. Among
other things, Regulation SCI requires SCI entities to establish and
test business continuity and disaster recovery plans that include
maintaining backup and recovery capabilities sufficiently resilient
and geographically diverse and that are reasonably designed to
achieve next business day resumption of trading and two-hour
resumption of critical systems in the event of a wide-scale
disruption. See 17 CFR 242.1001(a)(2)(v). Further, Regulation SCI
sets forth business continuity and disaster recovery plan testing
requirements for SCI entities. See 17 CFR 242.1004.
---------------------------------------------------------------------------

    Regulatory authorities have also acted collectively and in
consultation with each other to address operational risks in light of
the interconnectedness and interdependency of financial market
participants. For example, the Commission, along with the Board of
Governors of the Federal Reserve System (``Federal Reserve'') and the
Office of the Comptroller of the Currency, issued the Interagency Paper
on Sound Practices to Strengthen the Resilience of the Financial
System, which sets forth business continuity objectives for all
financial firms and the U.S. financial system as a whole.\22\ More
recently, FSOC issued a request for public comment on, among other
things, operational risks and transition planning as it relates to the
asset management industry.\23\
---------------------------------------------------------------------------

    \22\ See Interagency Paper, supra note 16. The objectives
discussed in the paper include (i) rapid recovery and timely
resumption of critical operations following a wide-scale disruption;
(ii) rapid recovery and timely resumption of critical operations
following the loss or inaccessibility of staff in at least one major
operating location; and (iii) a high level of confidence, through
ongoing use or robust testing, that critical internal and external
continuity arrangements are effective and compatible. The paper also
sets forth four sound practices for core clearing and settlement
organizations and firms that play significant roles in critical
financial markets, including (i) identifying clearing and settlement
activities in support of critical financial markets, (ii)
determining appropriate recovery and resumption objectives, (iii)
maintaining sufficient geographically dispersed resources to meet
such objectives, and (iv) routinely using or testing recovery and
resumption arrangements. See id. In addition, in 2012-2013, the
Commission's Office of Compliance Inspections and Examinations
(``OCIE''), along with FINRA and the CFTC, jointly reviewed a number
of firms' business continuity and disaster recovery planning and
published their joint observations on best practices and lessons
learned. See Joint Review of Business Continuity and Disaster
Recovery of Firms by the Commission's National Examination Program,
CFTC's Division of Swap Dealers and Intermediary Oversight and FINRA
(Aug. 16, 2013) (``Joint Review of Business Continuity''), available
at https://www.sec.gov/about/offices/ocie/jointobservations-bcps08072013.pdf.
    Financial services industry participants have also been pro-
active in addressing resiliency issues. See, e.g., Financial
Services Sector Coordinating Council (established to coordinate
infrastructure and homeland security activities within the financial
services industry comprised on financial trade associations,
financial utilities and financial firms), available at https://www.fsscc.org.
    \23\ See FSOC Notice (Dec. 24, 2014) [79 FR 77488 (Dec. 24,
2014)], available at http://www.treasury.gov/initiatives/fsoc/rulemaking/Documents/Notice%20Seeking%20Comment%20on%20Asset%20Management%20Products%20and%20Activities.pdf; see also FSOC, Update on Review of Asset
Management Products and Activities (Apr. 18, 2016), available at
https://www.treasury.gov/initiatives/fsoc/news/Documents/FSOC%20Update%20on%20Review%20of%20Asset%20Management%20Products%20and%20Activities.pdf. Although our rulemaking proposal is independent
of FSOC, several commenters responding to the FSOC Notice discussed
operational risks and transition issues related to investment
advisers, and we have considered and discussed relevant comments
throughout this release. Comments submitted in response to the FSOC
Notice are available at https://www.regulations.gov/#!docketBrowser;rpp=25;po=0;dct=PS;D=FSOC-2014-0001.

---------------------------------------------------------------------------

    The Commission addressed business continuity planning with respect
to investment advisers in a general way when it adopted rule 206(4)-7
under the Advisers Act (``Compliance Program Rule''). Under the rule,
advisers are required to consider their fiduciary and regulatory
obligations under the Advisers Act, and adopt and implement written
compliance policies and procedures reasonably designed to prevent
violations of the Advisers Act.\24\ At the time it adopted the rule,
the Commission was concerned that not all advisers had adopted adequate
compliance programs and as a result, clients and investors were being
harmed.\25\ In the release adopting the Compliance Program Rule, the
Commission stated that an adviser's compliance policies and procedures
should address BCPs to the extent that they are relevant to an
adviser.\26\ The Commission did not, however, identify critical
components of a BCP or discuss specific issues or areas that advisers
should consider in developing such plans.
---------------------------------------------------------------------------

    \24\ See rule 206(4)-7; Compliance Program Adopting Release,
supra note 15, at section II.A.1. Rule 206(4)-7 makes it unlawful
for advisers to provide investment advice unless they adopt and
implement written compliance policies and procedures reasonably
designed to prevent violations by the adviser and its supervised
persons of the Advisers Act and rules thereunder.
    \25\ The Commission noted that it and state securities
authorities had recently discovered unlawful conduct involving a
number of advisers, broker-dealers, and other service providers
where personnel of these entities engaged in, or actively assisted
others in engaging in, inappropriate market timing, late trading of
fund shares, and the misuse of material, nonpublic information about
fund portfolios. The Commission noted that these personnel had
breached their fiduciary obligations to the funds involved and their
shareholders by placing their own interests or the interests of the
fund adviser ahead of the interests of fund shareholders. See
Compliance Program Adopting Release, supra note 15, at section I.
    \26\ Id. The Commission identified ten areas adviser compliance
programs should address, including BCPs.
---------------------------------------------------------------------------

    As discussed above, an adviser's fiduciary obligations require it
to take steps to protect its clients' interests from being placed at
risk as a result of the adviser's inability to provide advisory
services.\27\ This fiduciary duty fosters trust between the client and
its adviser, such that the client relies on the adviser to act in its
best interests and safeguard its assets as appropriate, even during
times of stress.\28\ If an adviser is unable to provide advisory
services after, for example, a natural disaster, a cyber-attack, an act
of terrorism, technology failures, or the departure of key personnel,
its temporary inability to continue operations may put clients'
interests at risk and prevent it from meeting its fiduciary duty to
clients. This risk could include the risk of loss if, for example, an
adviser lacks the ability to make trades in a portfolio, is unable to
receive or implement directions from clients, or if clients are unable
to access their assets or accounts. As part of its fiduciary duty to
protect client interests, an adviser also should take steps to minimize
operational and other risks that could lead to a significant business
disruption like, for example, a systems failure. In order to do so,
advisers should generally assess and inventory the components of their
business and minimize the scope of its vulnerability to a significant
business disruption. While we recognize that an adviser may not be able
to prevent significant business disruptions (e.g., a natural disaster,
terrorist attack, loss of service from a third-party), we believe
robust planning for significant business disruptions can help to
mitigate their effects and, in some cases, minimize the likelihood of
their occurrence.
---------------------------------------------------------------------------

    \27\ See id. at n.22. The Commission also has stated that
``clients of an adviser that is engaged in the active management of
their assets would ordinarily be placed at risk if the adviser
ceased operations.'' Id.
    \28\ See generally SEC v. Capital Gains Research Bureau, Inc.,
supra note 14 at 191 (``A fiduciary owes its clients more than mere
honesty and good faith alone. ''); Investment Adviser Association,
What is an Investment Adviser?, available at http://www.investmentadviser.org/eweb/dynamicpage.aspx?webcode=whatisia
(noting that because advisers owe a fiduciary duty to their clients,
they ``[stand] in a special relationship of trust and confidence
with [their] clients'' and that such fiduciary duty generally
includes the duty to place the clients' interests first ``at all
times'').
---------------------------------------------------------------------------

    Various weather-related events have tested, on a large scale, the
effectiveness of existing BCP components of advisers' compliance
programs.\29\ In addition, these events provided our examination staff
the opportunity to review, observe, and assess the operations and
resiliency of BCPs across many advisers. The examination staff followed
these reviews by issuing public reports of their findings and effective
practices.\30\
---------------------------------------------------------------------------

    \29\ For example, Hurricane Katrina in 2005 and, as discussed in
this release, Hurricane Sandy in 2012 presented challenges to
advisers affected by those storms.
    \30\ See National Exam Program Risk Alert, SEC Examinations of
Business Continuity Plans of Certain Advisers Following Operational
Disruptions Caused by Weather-Related Events Last Year (Aug. 27,
2013) (``NEP Risk Alert''), available at https://www.sec.gov/about/offices/ocie/business-continuity-plans-risk-alert.pdf. The
examination was part of a joint review by the SEC's OCIE, FINRA and
the CFTC of relevant firms' business continuity and disaster
recovery planning in the wake of Hurricane Sandy. Together, these
entities issued a joint statement setting forth best practices and
lessons learned as a result of their review. See Joint Review of
Business Continuity, supra note 22; see also SEC Compliance Alert
(June 2007) (``Compliance Alert''), available at https://www.sec.gov/about/offices/ocie/complialert.htm.
---------------------------------------------------------------------------

    Hurricane Sandy broadly impacted the industry and its operations
because of the duration and point of impact of the storm, which
affected parts of New York, New Jersey, and the surrounding areas,
where numerous financial services providers (both markets and
participants) are concentrated. In the aftermath of the hurricane,
examiners observed that the degree of specificity of advisers' written
BCPs varied and that some advisers' BCPs did not ``adequately address
and anticipate widespread events.'' \31\ In addition, with respect to
alternative locations, examination staff noted that some advisers did
not have geographically diverse office locations, even when they
recognized that diversification would be appropriate.\32\ Additionally,
they observed with respect to vendor relationships and
telecommunications/technology, that certain advisers did not evaluate
the BCPs of their service providers or engage service providers to
ensure their backup servers worked properly, and that some advisers
reported that they did not keep updated lists of their vendors and
respective contacts.\33\ Moreover, with respect to communications
plans, the examination staff observed that some advisers inconsistently
planned how to contact and deploy employees during a crisis,
inconsistently maintained communications with clients and employees,
and did not identify which personnel were responsible for executing and
implementing the various portions of the BCP.\34\ Finally, with respect
to review and testing, our examination staff reported that some
advisers ``inadequately tested their BCPs relative to their advisory
businesses.'' \35\ These observations illustrate our experience that
business continuity planning among investment advisers

can be uneven and, in some instances, may not be sufficiently robust to
mitigate the potential adverse effects of a significant business
disruption on clients.
---------------------------------------------------------------------------

    \31\ See NEP Risk Alert, supra note 30, at 3.
    \32\ See NEP Risk Alert, supra note 30, at 4.
    \33\ See NEP Risk Alert, supra note 30, at 4-5.
    \34\ See NEP Risk Alert, supra note 30, at 6.
    \35\ See NEP Risk Alert, supra note 30, at 7.
---------------------------------------------------------------------------

    Additionally, the operational complexity of advisers has increased
over the years and many advisers' operations are highly dependent on
technology, including investment processes (e.g., trading, risk
management operations) and client services.\36\ It is critical for
investment advisers to focus on resiliency so that they can continue to
provide services to their clients when events impact the availability
of systems, facilities, and staff. The ability to recover such systems,
including third-party vendor provided platforms and services, and
business operations in a timeframe that meets business requirements is
important to mitigating the consequences of disruptive events.\37\
---------------------------------------------------------------------------

    \36\ See, e.g., Blackrock, The Role of Technology Within Asset
Management (Aug. 2014), at 1, available at http://www.blackrock.com/corporate/en-us/literature/whitepaper/viewpoint-asset-management-technology-aug-2014.pdf (``Asset managers require systems to
facilitate the maintenance of data and flow of information in the
investment process, such as trading counterparties and custodians.
Technology provides the unseen `plumbing' that ensures information
flows smoothly throughout the ecosystem.''). The paper also notes
that a robust asset management process requires both experienced
professionals and technology, and that integrated investment
technology enhances the quality of large volumes of data, supports
consistent investment workflows and enables timely communications
for both internal functions and with external parties.
    \37\ See, e.g., infra note 90.
---------------------------------------------------------------------------

    Based on the staff's observations from examinations, and the ever-
growing complexity of, and risks to, operations, we are concerned that
some advisers may not have robust BCPs. When a client entrusts an
adviser to manage its assets, the client does so with the expectation
that the adviser will act in its best interests and safeguard its
assets as appropriate, even in times of stress. We believe that without
robust business continuity planning, an adviser's clients may be placed
at risk in times of stress. Accordingly, to facilitate such robust
planning across all SEC-registered advisers, we are proposing to
require that these advisers address certain components in their
business continuity and transition plans.
2. Transition Planning
    Operational risks are not limited to affecting the day-to-day
operations of an adviser, but can lead to a financial services firm
having to cease or wind-down operations while also considering how to
safeguard client or investor assets. The 2008 financial crisis
demonstrated that providers of financial services are at risk of having
to exit the market unexpectedly and having to do so quickly.\38\ As
with traditional business continuity planning, regardless of whether
the risk is internal or external to the firm, a reasonably designed
plan assessing various risks related to a business transition (e.g.,
operational and other risks related to transitioning client assets) and
how to react to transition events should ameliorate the impact of
transitions on clients.\39\ After the financial crisis, Congress
addressed the need for this type of advance planning for certain
institutions in the Dodd-Frank Wall Street Reform and Consumer
Protection Act, which mandated regulations that require certain
financial institutions to plan for ``rapid and orderly resolution in
the event of material financial distress or failure.''\40\
---------------------------------------------------------------------------

    \38\ See Financial Crisis Inquiry Commission, Final Report of
the National Commission on the Causes of the Financial and Economic
Crisis in the United States (Jan. 2011) at 22-23, available at
https://www.gpo.gov/fdsys/pkg/GPO-FCIC/pdf/GPO-FCIC.pdf (``In
January 2008, Bank of America announced it would acquire the ailing
lender Countrywide. . . . Bear Stearns . . . was bought by JP Morgan
with government assistance in the spring. Before the summer was
over, Fannie Mae and Freddie Mac would be put into conservatorship.
Then, in September, Lehman Brothers failed and the remaining
investment banks, Merrill Lynch, Goldman Sachs, and Morgan Stanley,
struggled as they lost the market's confidence. AIG . . . was
rescued by the government. Finally, many commercial banks and
thrifts . . . teetered. IndyMac had already failed over the summer;
in September, Washington Mutual became the largest bank failure in
U.S. history. In October, Wachovia struck a deal to be acquired by
Wells Fargo.''). Several of the financial services firms mentioned
in this report included asset management subsidiaries.
    \39\ Both transition planning and business continuity planning
relate to instances where an adviser may be unable to provide
advisory services and where advance planning for those instances
would benefit advisers and their clients. We note that in the
Compliance Program Adopting Release, the Commission noted the risks
to advisory clients if an adviser ceased operations. See Compliance
Program Adopting Release, supra note 15.
    \40\ See section 165(d) of the Dodd-Frank Act [12 U.S.C. 5365];
see also Resolution Plans Required, 76 FR 67323 (Nov. 1, 2011)
(``Resolution Plans''). We are not proposing that advisers adopt
resolution plans or ``living wills'' similar to that which certain
financial institutions must now adopt under FDIC and Federal Reserve
rules because investment advisers do not interact with the
government in the same way as banks. For example, advisers do not
accept insured ``deposits,'' do not have access to the Federal
Reserve discount window, and do not use their own balance sheets
when trading client assets.
---------------------------------------------------------------------------

    In the normal course of business, it is our understanding that
advisers routinely transition client accounts without a significant
impact to themselves, their clients, or the financial markets.\41\ We
believe that much of this is largely attributable to the agency
relationship of advisers managing the assets on behalf of their clients
and the regulatory framework supporting this relationship whereby
advisory client assets for which the adviser has custody are required
to be held at a qualified custodian, such as a bank or broker-
dealer.\42\ Because client assets custodied by an adviser must be held
at a qualified custodian and segregated from the adviser's assets, we
have observed that transitioning accounts from one adviser to another
can largely be a streamlined process that in many cases may not involve
the physical movement or sale of assets.\43\ Pooled investment vehicle
clients generally have the ability to terminate the advisory contract
of the adviser or remove the governing body that may provide advisory
services (e.g., general partner or managing member) and appoint a new
adviser or governing body if they so desire, while separate account
clients can generally terminate the advisory contract and appoint a new
adviser to manage their assets, all while their assets are typically
maintained at a qualified custodian.\44\
---------------------------------------------------------------------------

    \41\ See, e.g., BlackRock FSOC Comment Letter (noting that
``[t]ransitioning the management of client assets from one manager
to another regularly occurs in the normal course of business'' and
listing 19 previous examples of advisers or funds exiting the market
without great market impact); SIMFA/IAA FSOC Comment Letter (noting
that ``managers and funds routinely enter and exit the asset
management industry'' and citing an Investment Company Institute
paper to note that, in 2013, ``48 mutual fund sponsors left the
business without any impact or distress''); Comment Letter of PIMCO
to FSOC Notice (Mar. 25, 2015); Vanguard FSOC Comment Letter. In
addition, we understand that specialized transition managers exist
to manage assets during a transition from one adviser to another.
See, e.g., BlackRock FSOC Comment Letter at 66.
    \42\ See rule 206(4)-2 under the Advisers Act. The use of
custodians that traditionally provide those services provide
protection for client assets from the adverse effects of stress at
an adviser. We also note that approximately 96.7% of SEC-registered
advisers are not related to the custodians that hold client assets.
Based on data from the Commission's IARD as of January 4, 2016.
    \43\ Client assets are not part of the adviser's balance sheet.
Client assets are not subject to the liquidation or potential
bankruptcy process of an asset manager and are not subject to the
adviser's creditors.
    \44\ We note that to the extent a new adviser does not have a
relationship with the same custodian used by the previous adviser,
assets may need to be transferred to a different custodian.
Additionally, we note that complications could arise with respect to
the transfer of shareholder records when transitioning client
accounts to another adviser.
---------------------------------------------------------------------------

    In addition, we are aware of instances of non-routine disruptions
at large advisory businesses that have resulted in transitions to new
advisers or new ownership without appearing to have a significant
adverse impact on clients, fund investors, or the financial

markets.\45\ Advisers routinely enter and exit the market and are
capable of transferring client assets to another adviser or
distributing such assets back to the client without negatively
impacting the client.\46\ Cases of advisory firms experiencing
transition events are often caused by a rapid decrease in assets under
management, which can occur for a variety of reasons, including poor
performance or an event causing reputational harm.\47\ To help ensure
that a transition is as seamless as possible, an adviser must be aware
of the impediments that should be addressed to minimize potential
client impact.
---------------------------------------------------------------------------

    \45\ For example, although a unique situation, advisory firm
Neuberger Berman spun out of Lehman Brothers during the 2008
financial crisis into a private company. See also infra note 52
(discussing the circumstances of the Neuberger Berman sale).
    \46\ See supra note 41.
    \47\ See, e.g., Trevor Hunnicutt, F-Squared Files for
Bankruptcy, Investment News (July 8, 2015) (``F-Squared Article''),
available at http://www.investmentnews.com/article/20150708/FREE/150709926/f-squared-files-for-bankruptcy (noting that after settling
charges with the SEC for false performance claims, F-squared started
losing assets under management); Christine Dugas & Sandra Block
Strong, Strong Capital, Founder to Pay $140M in Settlement, USA
Today (May 20, 2004), available at http://usatoday30.usatoday.com/money/perfi/funds/2004-05-20-strong-settle_x.htm (noting that after
Strong Capital Management (``Strong'') and its founder settled
charges with the SEC for allowing and engaging in undisclosed
frequent trading in Strong mutual funds, Strong funds had a ``net
outflow of investor assets totaling $4.9 billion''); see also In the
Matter of F-Squared Investments, Inc., Advisers Act Rel. No. 3988
(Dec. 22, 2014) (settled enforcement action); In the Matter of
Strong Capital Management, et al., Securities Exchange Act Rel. No.
49741 (May 20, 2004) (settled enforcement action); infra note 60.
---------------------------------------------------------------------------

    We are also aware of transitions involving funds under stress that
have not been seamless or without problem.\48\ For example, in one
instance, an adviser's proprietary system used on behalf of a fund
client had limitations on the pricing of fund shares that could not be
efficiently modified to accommodate certain events, which in turn
impeded the processing of fund redemption transactions and the
reconciliation, liquidation, and transfer of investor accounts on a
timely basis.\49\ In addition, while maintaining assets with a
custodian may ease the transfer of those assets, the adviser may have
important or private information concerning its clients or their
strategies and goals that would need to be transitioned securely and
efficiently.\50\
---------------------------------------------------------------------------

    \48\ See, e.g., BlackRock FSOC Comment Letter (citing to the
wind-down of Long-Term Capital Management in 2000 and Reserve
Primary Fund in 2008 and noting that regulatory intervention was
necessary for the funds involved).
    \49\ See In the Matter of The Reserve Fund, et al., Investment
Company Act Rel. No. 28386 (Sept. 22, 2008) (finding that the
temporary suspension of the right of redemption and postponement of
payment for shares which had been submitted for redemption but for
which payment had not been made was necessary for the protection of
shareholders); see also The Reserve Delays Primary Fund
Distributions, MFWire.com (Oct. 14, 2008), available at http://www.mfwire.com/article.asp?storyID=19638&bhcp=1 (``The process of
determining accurately the number of shares each investor held in
the Primary Fund has proven to be extremely complex and could not be
completed in the originally anticipated time frame.''); The Reserve
Furnishes More Details On Primary Fund Redemptions, MFWire.com (Oct.
16, 2008), available at http://www.mfwire.com/article.asp?storyID=19656&bhcp=1 (``[W]e have been working
diligently to enhance our existing software and add new programs to
hasten the distribution process.'').
    \50\ See generally Regulation S-P, 17 CFR 248 (establishing
general requirements and restrictions on a financial institutions'
ability to disclose nonpublic personal information about consumers,
including clients, to nonaffiliated third parties and exceptions
associated therewith).
---------------------------------------------------------------------------

    Moreover, the 2008 financial crisis illustrated that one firm's
distress may at times have a broader impact on the financial markets
and overall economy.\51\ Advisers could be impacted by broader market
events in a number of ways that could affect an adviser's ability to
continue operations and possibly lead to a transition event. For
example, advisers are often owned by or affiliated with other financial
services firms who themselves may be in distress. An adviser may be
affected by such distress to the extent the distress negatively impacts
the adviser's reputation, if it relies on a distressed affiliate for
certain systems or services, or if it is an asset that a distressed
parent sells.\52\ Under circumstances such as these, we are concerned
about the adviser's ability to continue to act in the clients' best
interests.
---------------------------------------------------------------------------

    \51\ See generally Joint Report, infra note 72.
    \52\ See, e.g., Lehman Brothers selling its asset management arm
after declaring bankruptcy. Sam Mamudi, Neuberger Berman Sold to
Private Equity, Market Watch (Sept. 29, 2008), available at http://www.marketwatch.com/story/neuberger-berman-sold-to-private-equity-for-215-billion.
---------------------------------------------------------------------------

    Proper planning and preparation for possible distress and other
significant disruptions in an adviser's operations is essential so
that, if an entity has to exit the market, it can do so in an orderly
manner, with minimal or no impact on its clients. As discussed above,
an adviser's fiduciary duty obligates it to take steps to protect
client interests from being placed at risk as a result of the adviser's
inability to provide advisory services and, thus, it would be
fraudulent and deceptive for an adviser to hold itself out as providing
advisory services unless it has taken such steps.\53\ Such advance
planning and preparation may minimize an adviser's exposure to
operational and other risks and, therefore, lessen the possibility of a
significant disruption in its operations, and also may lessen any
potential impact on the broader financial markets. Accordingly, and as
discussed in more detail below, we believe that SEC-registered advisers
should be required to adopt and implement a written business continuity
and transition plan that is tailored to the risks associated with the
adviser's operations and includes certain components, reflecting its
critical role as an agent for its clients.
---------------------------------------------------------------------------

    \53\ See supra section I.A; see also section 206(4) of the
Advisers Act.
---------------------------------------------------------------------------

C. Discussion

    We believe it is appropriate at this time to propose a rule
requiring SEC-registered advisers to adopt and implement a business
continuity and transition plan\54\ that is reasonably designed to
address operational and other risks related to a significant disruption
in an adviser's operations and that addresses certain specified
components.\55\ We recognize that, pursuant to the Compliance Program
Rule, most SEC-registered investment advisers may already have BCPs in
place as part of their compliance policies and procedures \56\ and that
those plans (or other plans) may also address transition planning.\57\
However, it has been our staff's experience that the robustness of
these BCPs is inconsistent across investment advisers. We believe that
requiring a business

continuity and transition plan that addresses operational and other
risks by rule and specifying certain components of such a plan will
facilitate the adoption and implementation of robust plans by all SEC-
registered investment advisers that address critical areas and that
should be effective and workable during a significant disruption in an
adviser's operations. Moreover, we believe requiring such plans will
benefit advisory clients because advisers will likely be better
prepared to deal with business continuity and transition events if and
when they occur and will better mitigate risks attendant with their
operations and business practices, thereby reducing the likelihood of
client harm as the result of a significant disruption in an adviser's
operations.
---------------------------------------------------------------------------

    \54\ We recognize that business continuity planning and
transition planning address different circumstances (i.e. one
addresses the continuation of a business while the other addresses
the winding down of a business). See infra note 60 and accompanying
text. However, both business continuity planning and transition
planning pertain to instances where an adviser may be unable to
provide advisory services and where advance planning for those
instances would benefit advisers and their clients. In this release
and in proposed rule 206(4)-4, we refer to an adviser adopting ``a''
business continuity and transition plan. The proposed rule would not
require an adviser to consolidate all of the components described in
proposed rule 206(4)-4 into one document. An adviser may maintain
separate plans that address the components identified in proposed
rule 206(4)-4.
    \55\ We note that the Commission has explicitly required BCPs in
other contexts, and that FINRA has adopted specific rules on BCPs
for broker-dealers. See Regulation SCI Adopting Release, supra note
17; FINRA Rule 4370. Further, NASAA has also issued a model rule for
states to apply to state-registered advisers, which tend to be
smaller in scale and size than advisers registered with the
Commission. See NASAA Model Rule 203(a)-1A.
    \56\ See, e.g., BlackRock FSOC Comment Letter at 10 (noting that
asset managers maintain BCPs); Fidelity FSOC Comment Letter at 32-33
(discussing BCPs).
    \57\ We understand that in practice, adviser BCPs focus on risks
from events that would limit or impact normal operations, such as
natural disasters or systems failures, but also can address
transition planning. See supra note 39 (discussing the Compliance
Program Adopting Release and language therein regarding risks to
clients if an adviser ceases operations).
---------------------------------------------------------------------------

    We are proposing new rule 206(4)-4 under the Advisers Act and
amendments to rule 204-2 under the Advisers Act. Under rule 206(4)-4,
it would be unlawful for an SEC-registered investment adviser to
provide investment advice unless the adviser adopts and implements a
written business continuity and transition plan and reviews that plan
at least annually. The proposed amendments to rule 204-2 would require
those advisers to make and keep copies of all written business
continuity and transition plans that are in effect or were in effect at
any time during the last five years, as well as any records documenting
the adviser's annual review of its business continuity and transition
plan.
1. Adopt and Implement Business Continuity and Transition Plans
    The proposed rule would require SEC-registered advisers to adopt
and implement written business continuity and transition plans
reasonably designed to address operational and other risks related to a
significant disruption in the investment adviser's operations.\58\
These plans would include policies and procedures concerning (1)
business continuity after a significant business disruption, and (2)
business transition in the event the investment adviser is unable to
continue providing investment advisory services to clients. Business
continuity situations generally include natural disasters, acts of
terrorism, cyber-attacks, equipment or system failures, or unexpected
loss of a service provider, facilities, or key personnel. Business
transitions generally include situations where the adviser exits the
market and thus is no longer able to serve its clients, including when
it merges with another adviser, sells its business or a portion
thereof,\59\ or in unusual situations, enters bankruptcy
proceedings.\60\
---------------------------------------------------------------------------

    \58\ See proposed rule 206(4)-4. We note that adviser BCPs are
also often referred to as business continuity and disaster recovery
plans; however, we have chosen to use the term ``business continuity
and transition plan'' to refer to plans required under the proposed
rule. We believe, however, that such plans would encompass disaster
recovery planning because any robust BCP would need to plan for the
recovery of its business operations and systems in order to be able
to continue providing services to clients. See proposed rule 206(4)-
4(b)(2)(i) (requiring business continuity and transition plans to
include maintenance of critical operations and systems, and the
protection, backup, and recovery of data).
    \59\ See proposed rule 206(4)-4(b). We note with respect to
business transitions that there may be circumstances where an
adviser is unable to provide advisory services for only a portion of
its business, but is able to continue providing services with
respect to another portion of its business, and thus, only exits a
particular market. An adviser's business continuity and transition
plan generally should address the possibility of such a partial
transition. Cf. infra note 60 and accompanying text (discussing
business transitions generally).
    \60\ For example, in 2015, F-Squared Investments, Inc. filed for
bankruptcy and arranged for its investment strategies to be managed
by another adviser. See F-Squared Article, supra note 47. In
addition, in 2005, funds managed by Strong were acquired by Wells
Fargo & Company and the ``legal entities comprising the Strong . . .
complex were subsequently liquidated.'' See BlackRock FSOC Comment
Letter at 62-63 (discussing the Strong transition); see also Press
Release, Wells Fargo Agrees to Acquire $34 Billion in Assets Under
Management From Strong Financial Corporation, Wells Fargo (May 26,
2004), available at http://www.wellscap.com/docs/press_releases/5.26.04.pdf.
---------------------------------------------------------------------------

    The proposed rule is intended to help ensure that an adviser's
policies and procedures minimize material service disruptions and any
potential client harm from such disruptions. Advisers should keep this
focus at the forefront when reviewing their business operations and
developing their policies and procedures. Accordingly, the proposed
rule would require an SEC-registered adviser's business continuity and
transition plan to include policies and procedures designed to minimize
material service disruptions, including policies and procedures that
address certain specific components. We recognize that advisers'
business models and operations vary, but we believe that every business
continuity and transition plan must generally address operational and
other risks related to a significant disruption in the adviser's
operations and must address certain key components to plan and prepare
for such disruptions.\61\ While we believe advisers should generally
assess and inventory all of the components of their businesses in order
to develop their business continuity and transition plans and tailor
their plans to the specific risks their businesses face, we also
believe that identifying these key components should facilitate the
adoption and implementation of robust BCPs by all SEC-registered
investment advisers.
---------------------------------------------------------------------------

    \61\ See supra notes 30-35 and accompanying text (discussing
certain key elements of BCPs). Other regulatory bodies and
organizations also have recognized key elements of business
continuity plans. See 17 CFR 23.603 (setting forth essential
components of BCPs for swap dealers and major swap participants);
FINRA Rule 4370 (setting forth minimum elements that a business
continuity plan should address); NASAA Model Rule 203(a)-1A (stating
certain elements the plan should address); FFIEC Handbook, supra
note 17, at G-1 (discussing components of effective BCPs).
---------------------------------------------------------------------------

    Under the proposed rule, the content of an SEC-registered adviser's
business continuity and transition plan would be based upon risks
associated with the adviser's operations and would include policies and
procedures designed to minimize material service disruptions, including
policies and procedures that address the following: \62\ (1)
Maintenance of critical operations and systems, and the protection,
backup, and recovery of data; \63\ (2) pre-arranged alternate physical
location(s) of the adviser's office(s) and/or employees; \64\ (3)
communications with clients, employees, service providers, and
regulators; \65\ (4) identification and assessment of third-party
services critical to the operation of the adviser; \66\ and (5) plan of
transition that accounts for the possible winding down of the adviser's
business or the transition of the adviser's business to others in the

event the adviser is unable to continue providing advisory
services.\67\
---------------------------------------------------------------------------

    \62\ We have modeled the proposed rule on BCP requirements for
other financial services firms that we believe share similar
vulnerabilities as investment advisers, as well as our staff's
examinations experiences, which have highlighted a number of best
practices as well as a number of areas for improvement specific to
investment advisers. For example, to assist advisers in considering
their own business continuity issues, the examination staff
previously identified a number of ``lessons learned'' from its
examinations of advisers that were affected by Hurricane Katrina.
See Compliance Alert, supra note 30. The staff noted certain
provisions in disaster recovery plans that appeared to be effective
in allowing an adviser to provide ``uninterrupted advisory services
to clients in a compliant manner after a disaster'' including (i) a
pre-arranged remote location for short-term and possible long-term
use; (ii) alternate communication protocols to contact staff and
clients; (iii) remote access to business records and client data
through appropriately secured means; (iv) temporary lodging for key
staff where necessary and effective training of staff on how to
fulfill essential duties in the event of a disaster; (v) maintaining
accurate and up-to-date contact information for all third-party
service providers and familiarity with the BCPs of those providers;
(vi) contingency arrangements for loss of key personnel; (vii)
periodic testing, evaluation and revision of the plan; and (viii)
maintaining sufficient insurance and financial liquidity to prevent
any interruption of the performance of compliant advisory services.
    \63\ See proposed rule 206(4)-4(b)(2)(i).
    \64\ See proposed rule 206(4)-4(b)(2)(ii).
    \65\ See proposed rule 206(4)-4(b)(2)(iii).
    \66\ See proposed rule 206(4)-4(b)(2)(iv).
    \67\ As discussed more below, the plan of transition would have
to include (1) policies and procedures intended to safeguard,
transfer and/or distribute client assets during transition; (2)
information regarding the corporate governance of the adviser; (3)
the identification of any material financial resources available to
the adviser; (4) policies and procedures facilitating the prompt
generation of any client-specific information necessary to
transition each client account; and (5) an assessment of the
applicable law and contractual obligations governing the adviser and
its clients, including pooled investment vehicles, implicated by the
adviser's transition. See proposed rule 206(4)-4(b)(2)(v).
---------------------------------------------------------------------------

    While each SEC-registered adviser's business continuity and
transition plan must address the components set forth in the proposed
rule, we recognize that the degree to which an adviser's plan addresses
a required component will depend upon the nature of each particular
adviser's business. We also recognize that business models and
operations vary significantly among advisers.\68\ The proposed rule
thus would require that the plan be reasonably designed to address the
operational and other risks of an adviser and thus advisers need only
take into account the risks associated with its particular operations,
including the nature and complexity of the adviser's business, its
clients, and its key personnel.\69\ For example, we believe that the
business continuity and transition plan of a large adviser with
multiple locations, offices, or business lines likely would differ
significantly from that of a small adviser with a single office or only
a few investment professionals and employees. Additionally, we believe
that the business continuity and transition plan of an adviser with a
complex internal technology infrastructure likely would differ from
that of an adviser that primarily uses an outsourced model.\70\ The
complexity and risks associated with these diverse business models
could be substantially different, and our proposed rule is designed to
give advisers the flexibility to create business continuity and
transition plans that accommodate such differences.
---------------------------------------------------------------------------

    \68\ See Comment Letter of Wellington Management Group LLP to
FSOC Notice (Mar. 25, 2015) at 2 (``The unique characteristics of
today's asset management industry (agency and advice based: Low
barriers to entry: High substitutability among managers: And highly
competitive) result in a large number of asset management firms that
are organized in a variety of models.'').
    \69\ See, e.g., BlackRock FSOC Comment Letter at 9 (noting that
``understanding the differences in operating models is crucial'' in
assessing the potential operational risk of an asset manager).
    \70\ Id. at 71. A larger adviser may conduct (insource) some or
all middle and back office functions (e.g., securities
administration, accounting, and recordkeeping) internally. Whereas
in an outsourced model, the asset management firm hires third-party
providers to perform various middle and back office functions.
---------------------------------------------------------------------------

a. Maintenance of Critical Operations and Systems, and the Protection,
Backup, and Recovery of Data, Including Client Records
    The proposed rule would require advisers' business continuity and
transition plans to include policies and procedures on the maintenance
of critical operations and systems, and the protection, backup, and
recovery of data, including client records.\71\ With respect to
maintaining critical operations/systems, an adviser's plan generally
should identify and prioritize critical functions, operations, and
systems and consider alternatives and redundancies to help maintain the
continuation of operations in the event of a significant business
disruption.\72\ When evaluating which operations and systems are
critical, advisers generally should consider those that are utilized
for prompt and accurate processing of portfolio securities transactions
on behalf of clients, including the management, trading, allocation,
clearance and settlement of such transactions. Advisers generally
should also consider operations and systems that are critical to the
valuation and maintenance of client accounts, access to client
accounts, and the delivery of funds and securities. This typically will
include identification and assessment of third-party services that
support certain functions, as activities conducted may involve systems
and processes that the adviser controls and others that may be wholly
or partially dependent on third-party vendors, which we address below.
Advisers generally also should identify which key personnel either
provide critical functions to the adviser or support critical
operations or systems of the adviser such that the temporary or
permanent loss of those individuals would disrupt the adviser's ability
to provide services to its clients.
---------------------------------------------------------------------------

    \71\ We note that Regulation SCI also includes requirements
regarding the maintenance of systems. Rule 1001(a) requires each SCI
entity to establish, maintain, and enforce policies and procedures
that are reasonably designed to ensure that its ``SCI systems'' have
levels of capacity, integrity, resiliency, availability, and
security, adequate to maintain the SCI entity's operational
capability and promote the maintenance of fair and orderly markets.
Moreover, rule 1001(a)(2)(v) also requires that these policies and
procedures include business continuity and disaster recovery plans
that are reasonably designed to achieve two-hour resumption of
``critical SCI systems'' following a wide-scale disruption. 17 CFR
242.1001. We note that in the Regulation SCI Adopting Release, the
Commission stated that it would monitor and evaluate the
implementation of Regulation SCI, the risks posed by systems of
other market participants, and the continued evolution of the
securities markets, and in the future may consider extending the
types of requirements in Regulation SCI to other market
participants, including investment advisers. See Regulation SCI
Adopting Release, supra note 17, at 72259. We note that the proposed
rule would not apply Regulation SCI to investment advisers. Rather,
the Commission is proposing this rule in light of the specific
operations and businesses of investment advisers and the risks they
present.
     In addition to Regulation SCI, we note, as discussed above,
that our staff has previously highlighted the importance of access
to business records and client data as well as backup servers and
other telecommunications services in the context of business
continuity planning. See supra notes 30 and 33, and accompanying
text. We also note that other regulatory bodies and organizations
have stressed the importance of critical systems and data protection
in the context of BCPs. See, e.g., 17 CFR 23.603(b)(1), (4) and (6)
(requiring BCPs to include identification of documents, data,
facilities and infrastructure, as well as backup or copying of
documents and data, essential to operations, and procedures for and
the maintenance of backup facilities, systems and infrastructure);
FINRA Rule 4370(c)(1) and (2) (requiring BCPs to address data backup
and recovery (both hard copy and electronic) as well as mission
critical systems); NASAA Model Rule 203(a)-1A(1) (stating that BCPs
should provide for ``protection, backup and recovery of books and
records''); SIFMA, Business Continuity Planning Expanded Practices
Guidelines (Apr. 2011) (``SIFMA Guidelines'') at 27 and 32,
available at http://www.sifma.org/uploadedfiles/services/bcp/sifma-bc-practices-guidelines2011-04.pdf (noting that businesses should
ensure ``the functionality and availability of critical business
applications'' and ``that redundant copies of vital records'' are
securely stored and available during an emergency).
    \72\ Following the publication of the Interagency Paper, the
Commission, together with the Federal Reserve and the Office of the
Comptroller of the Currency, issued a joint report that discussed
the industry's efforts to implement the recommendations contained in
the Interagency Paper (``Joint Report''). The Joint Report notes
that the Interagency Paper addresses reasonable recovery time
objectives and identifies specific risk-based recovery standards in
order ``to assure that there will be a relatively consistent degree
of preparedness across'' the industry. See Joint Report on Efforts
of the Private Sector to Implement the Interagency Paper on Sound
Practices to Strengthen the Resilience of the U.S. Financial System
(Apr. 2006) at 3, available at https://www.sec.gov/news/press/studies/2006/soundpractices.pdf; see also MFA FSOC Comment Letter at
45 (citing to the MFA's recommendations to hedge fund managers that
they design and implement business continuity/disaster recovery
plans ``reasonably designed to: (1) Identify and prioritize critical
business functions. . .'').
---------------------------------------------------------------------------

    We believe that by considering alternatives and redundancies for
critical operations and systems in advance of significant business
disruptions, an adviser will be able to prioritize, recover, and resume
key aspects of its business in a timely manner and consequently be
better able to act in its clients' best interests and continue
providing services to its clients during such a disruption.\73\ For

example, if most securities operations functions (post-trade
processing, corporate actions, reconciliation, etc.) are handled
internally by the adviser,\74\ then the adviser's plans should address
the backup systems or other alternative processes or procedures that
will be used or followed in the event of a business disruption where
standard operations may not be available. Additionally, we believe that
contingency plans with respect to key personnel generally should
address both the temporary or permanent loss of such personnel. For
example, loss of key personnel could result from an employee's sudden
departure from the adviser or could be due to a weather related event
that renders the employee temporarily unavailable. Accordingly, an
adviser's business continuity and transition plan generally should
include short-term arrangements, such as which specific individuals
would satisfy the role(s) of key personnel when unavailable, and long-
term arrangements regarding succession planning and how an adviser will
replace key personnel.\75\
---------------------------------------------------------------------------

    \73\ Investment advisers should also generally consider in their
business continuity planning circumstances in which a service
provider (including another investment adviser that provides
operations or systems to the adviser) is permanently unable to
provide the adviser with critical operations or systems. See, e.g,
Financial Conduct Authority, Outsourcing in the Asset Management
Industry: Thematic Project Findings Report (Nov. 2013) (``FCA
Paper''), available at http://www.fca.org.uk/static/documents/thematic-reviews/tr13-10.pdf (``Based on our initial assessment of
asset managers last year, we concluded that firms in the sample were
unprepared for a failure of their service provider.''). The FCA
Paper suggested that asset managers should review their own
outsourcing arrangements and where appropriate (i) ``enhance their
contingency plans for the failure of a service provider providing
critical activities, taking into account industry-led guiding
principles where applicable'' and (ii) ``assess the effectiveness of
their oversight arrangements to oversee critical activities
outsourced to a service provider, making sure the required expertise
is in place.''
    \74\ As discussed above, investment advisers that are also
registered broker-dealers will be subject to both the proposed rule
and FINRA's rule 4370 regarding BCPs. While we believe the two rules
are largely complementary, we note that SEC-registered advisers
would have to comply with the requirements of proposed rule 206(4)-4
with respect to their advisory functions. See supra note 18.
    \75\ An adviser should also consider whether the departure of
key personnel may trigger contractual obligations with clients,
investors, or counterparties. For example, private funds clients may
contain redemption rights for its investors upon the departure of
specified investment personnel.
---------------------------------------------------------------------------

    With respect to data protection, backup, and recovery, a business
continuity and transition plan generally should address both hard copy
and electronic backup, as appropriate.\76\ A reasonably designed
business continuity and transition plan generally should recognize that
significant business disruptions may prevent access to electronic
copies of data (e.g., power or internet outage) and hard copies of data
(e.g., cannot access building where data is located). Such a plan
should also recognize the important role electronic records can play in
carrying out the adviser's plan of transition in a timely manner.
---------------------------------------------------------------------------

    \76\ This proposed requirement would be consistent with the
existing requirement for SEC-registered investment advisers to
maintain specific books and records relating to its investment
advisory business. See rule 204-2(a) and (g). The ``books and
record'' rule requires advisers to have procedures: to reasonably
protect electronic records from loss, alteration, or destruction; to
limit access to electronic records; and to assure that electronic
records that are created from hard copy are complete, true, and
legible. See rule 204-2(g)(3).
---------------------------------------------------------------------------

    Additionally, in connection with data backup and recovery, a
business continuity and transition plan generally should include an
inventory of key documents (e.g., organizational documents, contracts,
policies and procedures), including the location and description of the
item, and a list of the adviser's service providers relationships that
are necessary to maintaining functional operations. This documentation
generally should include details of the adviser's management structure,
risk management processes, and financial and regulatory reporting
requirements. We believe such documentation would make it easier for an
adviser and its employees to access important operations/systems,
documents, and relationships during a significant business disruption.
    Finally, we note with respect to data protection, backup and
recovery, one type of potentially significant business disruption is a
cyber-attack. An adviser generally should consider and address as
relevant the operational and other risks related to cyber-attacks.\77\
We believe exposure to compliance and operational risks that may be
caused by cybersecurity incidents can be mitigated by addressing such
risks in the context of business continuity planning.\78\
---------------------------------------------------------------------------

    \77\ Our staff recently highlighted a number of measures for
advisers to consider in the context of cybersecurity and noted that
``advisers should identify their . . . compliance obligations under
the federal securities laws and take into account these obligations
when assessing their ability to prevent, detect and respond to cyber
attacks.'' See Cybersecurity Guidance, IM Guidance Update (Apr.
2015), available at http://www.sec.gov/investment/im-guidance-2015-02.pdf. In March 2014, the Commission hosted a roundtable on
cybersecurity, which highlighted the Commission's focus on
cybersecurity-related issues and a number of Commission actions
relating to cybersecurity. The Commission is also focused on
cybersecurity risk issues related to investment advisers, including
data protection and identity theft vulnerabilities. See Chair Mary
Jo White, Opening Statement at SEC Roundtable on Cybersecurity (Mar.
26, 2014), available at http://www.sec.gov/News/PublicStmt/Detail/PublicStmt/1370541286468; see also Identity Theft Red Flags Rules,
Securities Exchange Act Rel. No. 69359 (Apr. 10, 2013); see also
Cybersecurity Roundtable, SEC, available at http://www.sec.gov/spotlight/cybersecurity-roundtable.shtml (providing information on
the roundtable). We also note that the National Institute of
Standards and Technology (``NIST'') has issued a framework for
improving cybersecurity and that it recently sought comment on this
framework. See NIST, Framework for Improving Critical Infrastructure
Cybersecurity (Feb. 12, 2014), available at http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf; NIST,
Cybersecurity Framework--Overview, available at http://www.nist.gov/cyberframework/# (discussing requests for comment on the
cybersecurity framework).
    \78\ We recognize that advisers also may have additional
policies and procedures to address compliance and operational risks
related to cybersecurity incidents.
---------------------------------------------------------------------------

b. Pre-Arranged Alternate Physical Location(s)
    The proposed new rule would also require an adviser's business
continuity and transition plan to include pre-arranged alternate
physical location(s) of its office(s) and/or employees. As our staff
has indicated a number of times, alternate or remote locations are
essential for an adviser to continue providing services during a
significant business disruption.\79\ Accordingly, when developing
business continuity and transition plans, advisers generally should
consider the geographic diversity of their offices or remote sites and
employees, as well as access to the systems, technology, and resources
necessary to continue operations at different locations in the event of
a disruption.\80\ For example, an adviser

may recognize that a significant business disruption could limit access
to its primary or only office for an extended period of time and,
therefore, establish a satellite office or plan to use a remote site in
another location or geographic region and may also allow remote access
by employees so the adviser could continue to have access to the
facilities, systems, and personnel necessary to carry on its
business.\81\
---------------------------------------------------------------------------

    \79\ See supra notes 30 and 32, and accompanying text; see also
Regulation SCI Adopting Release, supra note 17 (requiring an SCI
entity's business continuity and disaster recovery plan to include
``geographically diverse'' backup and recovery capabilities). We
note that other regulatory bodies and organizations have also
recognized the importance of alternate sites and geographic
diversity in business continuity planning. See, e.g., 17 CFR
23.603(b)(5) (requiring backup facilities, infrastructure and
alternative staffing in geographically separate areas); FINRA Rule
4370(c)(6) (requiring BCPs to address ``alternate physical location
of employees''); NASAA Model Rule 203(a)-1A(3) (stating that BCPs
should provide for ``office relocation in the event of temporary or
permanent loss of a principal place of business''); FFIEC Handbook,
supra note 17, at G14 (stating that a ``BCP should address site
relocation for short-, medium-, and long-term disaster and
disruption scenarios''); Interagency Paper, supra note 16 (noting
that backup sites should not rely on the same infrastructure
components used by the primary site, should not be impaired by a
wide-scale evacuation at or the inaccessibility of staff that
service the primary site, and should consider staffing needs at the
backup site if the firm relies on the same labor pool for both its
primary and back up sites).
    \80\ We are not proposing to require that an adviser's business
continuity and transition plan include an alternative location at a
specified distance away from its primary location because we
believe, as discussed above, that an adviser's plan should be
tailored to its particular operations and that, while a specified
distance may be appropriate for one adviser's alternate location, it
may not be appropriate for all advisers. Nonetheless, we believe
advisers generally should consider whether their alternative
locations are in such close proximity to each other or to its
primary location that they may be sharing common infrastructure
providers and thus, that the alternative locations would be
similarly affected by an external event.
    \81\ An adviser should consider the technology, systems, and
resources necessary for employees working remotely to continue to
securely conduct the adviser's business.
---------------------------------------------------------------------------

c. Communications With Clients, Employees, Service Providers, and
Regulators
    Under the proposed rule, a business continuity and transition plan
would also need to address communications with clients, employees,
service providers, and regulators. We believe that communication plans
are an essential element of effective business continuity and
transition plans and generally should cover communications with parties
involved in the critical aspects of the adviser's operations.\82\ For
example, if an adviser's employees are unaware that a disruption has
occurred and the adviser's business continuity and transition plan has
been activated, the plan will likely fail. An adviser's communication
plan generally should cover, among other things, the methods, systems,
backup systems, and protocols that will be used for communications, how
employees are informed of a significant business disruption, how
employees should communicate during such a disruption, and contingency
arrangements communicating who would be responsible for taking on other
responsibilities in the event of loss of key personnel.\83\ Adviser
business continuity and transition plans generally should also address
employee training, so that in the event of a significant business
disruption employees understand their specific roles and
responsibilities and are able to carry out the adviser's plan.
---------------------------------------------------------------------------

    \82\ As discussed above, our staff has previously noted the
important role that communication plans can play in business
continuity planning. See supra notes 30 and 34 and accompanying
text. Additionally, we note that other regulatory bodies and
organizations have focused on communications in the context of BCPs.
See, e.g., 17 CFR 23.603(b)(3) (requiring BCPs to include
communication plans with respect to employees, vendors, and
regulatory authorities); FINRA Rule 4370(c)(4), (5), and (9)
(requiring BCPs to address communications with customers, employees
and regulators); NASAA Model Rule 203(a)-1A(2) (stating that BCPs
should provide for alternate communications with ``customers, key
personnel, employees, vendors, service provides. . .and regulators.
. . .''); FFIEC Handbook, supra note 17, at G-4 (stating that
``[c]ommunication is a critical aspect of a BCP and should include
communication with employees, . . . regulators, vendors/suppliers
(detailed contact information), [and] customers (notification
procedures) . . . .'').
    \83\ See supra section I.C.1.a.
---------------------------------------------------------------------------

    Moreover, advisers should consider when and how it is in their
clients' best interests to be informed of a significant business
disruption and/or its impact. Accordingly, with respect to clients, a
business continuity and transition plan generally should include the
process by which the adviser would have prompt access to client records
that include the name and relevant contact and account information for
each client as well as investors in private funds sponsored by the
investment adviser.\84\ These plans generally should include how
clients will be made aware of and updated about a significant business
disruption that materially impacts ongoing client services (e.g.,
periodic updates to Web sites and customer service lines) and, when
applicable, how clients will be contacted and advised if account access
is impacted during such a disruption.
---------------------------------------------------------------------------

    \84\ For a private fund to qualify for the exclusion from the
definition of ``investment company'' in either section 3(c)(1) or
3(c)(7) of the Investment Company Act of 1940 (``Investment Company
Act'') or rely on various offering exemptions under the Securities
Act of 1933, the private fund is already required to have a
reasonable belief regarding certain qualification information with
regard to its beneficial owners that are U.S. persons. See, e.g., 17
CFR 270.2a51-1(h), 17 CFR 230.501(a). While the private fund may not
be required to have such detailed information about non-U.S. person
beneficial owners, we understand it generally has contact
information readily available.
---------------------------------------------------------------------------

    Similarly, an adviser's communication plan with its service
providers generally should include, among other things, how the service
provider will be notified of a significant business disruption at the
adviser as well as how the adviser will be notified of a significant
business disruption at a service provider, and how the entities will
communicate with one another and clients or investors (where
applicable) \85\ during a disruption. With respect to communications
with the adviser's regulators, the adviser's business continuity and
transition plan generally should include the contact information for
relevant regulator(s), and identify the personnel responsible for
notifying, as well as under what circumstances it would notify, such
regulator(s) of a significant business disruption.
---------------------------------------------------------------------------

    \85\ For example, pooled investment vehicles generally rely on
their investment advisers to arrange for and interact with fund
service providers. If an adviser to an investment company, for
example, outsources certain back office functions, such as transfer
agency to a third-party vendor, its business continuity and
transition plan should address coordination of communications with
the transfer agent to investors in the fund, as well as with
intermediaries servicing investors who also are beneficial owners of
the fund.
---------------------------------------------------------------------------

d. Identification and Assessment of Third-Party Services Critical to
the Operation of the Adviser
    The proposed rule would require an adviser's business continuity
and transition plan to include the identification and assessment of
third-party services critical to the operation of the adviser.\86\ We
understand advisers frequently outsource certain functions or aspects
of their operations or use third-parties' systems or vendors for their
middle and back office functions in order to permit the adviser to
focus on front office core functions, such as portfolio management and
trading.\87\ To the extent critical services are outsourced to third-
parties, we believe that an adviser generally should be prepared for
significant business disruptions that could impair its ability to act
in its clients' best interests by having a business continuity and
transition plan that addresses the critical services provided to it by
such third parties.\88\
---------------------------------------------------------------------------

    \86\ We note that Regulation SCI includes specific requirements
with respect to the resumption of ``critical SCI systems,''
differentiating these systems from other systems covered by the
regulation. See 17 CFR 242.1000 and 242.1001(a)(2)(v) of Regulation
SCI. In addition, as discussed above, our staff has previously noted
the importance of addressing third-party relationships in the
context of BCPs. See supra notes 30 and 33, and accompanying text.
Additionally, we note that other regulatory bodies and organizations
have noted that BCPs should address third-party relationships. See,
e.g., 17 CFR 23.603(b)(7) (requiring ``identification of potential
business interruptions encountered by third parties that are
necessary to continued operations'' and ``a plan to minimize the
impact''); FINRA Rule 4370(c)(7) (requiring BCPs to address
``critical business constituent, bank, and counterparty impact'');
SIFMA Guidelines, supra note 71, at 30 (stating that BCPs should
include internal and external business partners and that firms
should be familiar with the BCPs and risks of those partners).
    \87\ For example, we frequently see middle office functions such
as administration of the front office and trades and related
transactions, including securities operations and processing
(confirmation, routing, matching, and settlement trades), pricing/
valuation, reconciliation (both cash and positions), and post trade
compliance and reporting, outsourced to third parties.
    \88\ The nature of advisory business is such that advisers
typically depend on a number of third-party service providers and
systems vendors (e.g., broker-dealers, custodians, etc.) in
providing services to their clients.
---------------------------------------------------------------------------

    In this regard, an adviser's business continuity and transition
plan should identify critical functions and services provided by the
adviser to its clients, and third-party vendors supporting or
conducting critical functions or services for the adviser and/or on the
adviser's behalf.\89\ An adviser generally should

consider a variety of factors when identifying and prioritizing which
service providers should be deemed critical, such as the day-to-day
operational reliance on the service provider and the existence of a
backup process or multiple providers, whether or not the service
provided includes direct contact with clients or investors, and whether
the service provider is maintaining critical records or able to access
personally identifiable information, among other things. We would
generally consider critical service providers to at least include those
providing services related to portfolio management, the custody of
client assets, trade execution and related processing, pricing, client
servicing and/or recordkeeping, and financial and regulatory reporting.
---------------------------------------------------------------------------

    \89\ The Joint Report noted that, notwithstanding the use of a
service provider to perform various activities, a firm ``cannot
shift responsibility for compliance and risk management to the
service provider. . . . Should a service provider not have the
appropriate level of resilience, a financial institution would be
required to move to a provider that can demonstrate an appropriate
level of resilience.'' See Joint Report, supra note 72 at 6.
     We also encourage advisers to be familiar with the terms of
their contracts with critical service providers, including any
provisions regarding the termination or assignment of the contract
and any notice requirements related to those provisions.
---------------------------------------------------------------------------

    Once an adviser identifies its critical service providers, it
should review and assess how these service providers plan to maintain
business continuity when faced with significant business disruptions
and consider how this planning will affect the adviser's
operations.\90\ For example, if an adviser's business continuity and
transition plan contemplates that it will rely on a particular service
provider for a critical service, the adviser generally should be aware
of whether the service provider has a BCP and if that BCP provides
alternatives, including backup plans, to allow it to continue providing
critical services during a significant business disruption. If the
service provider does not have a BCP or if its BCP does not provide for
such alternatives, the adviser generally should consider alternatives
for such critical services, which may include other service providers
or internal functions or processes that can serve as a backup or
contingency for such critical services.\91\
---------------------------------------------------------------------------

    \90\ In late August 2015, Bank of New York Mellon (``BNY
Mellon''), a service provider that provides custodial and
administrative services to mutual funds, closed-end funds, and
exchange-traded funds, experienced a breakdown in one of its third-
party systems (SunGard's InvestOne) used to calculate numerous
client funds' net asset values (``NAVs''). As a result of this
breakdown, BNY Mellon was unable to deliver timely system-generated
NAVs to certain clients for several days, which resulted in certain
clients pricing their shares using stale or manually calculated NAVs
and certain ETFs using stale baskets. Once the automated system was
restored, ETF baskets were updated and certain funds had to review
the NAVs used while the automated system was down and make any
necessary corrections. See, e.g., Stephen Foley, BNY Mellon Close to
Resolving Software Glitch, Financial Times (Aug. 31, 2015),
available at http://www.ft.com/intl/cms/s/0/47d5860a-4f2b-11e5-b029-b9d50a74fd14.html; Jessica Toonkel & Tim McLaughlin, BNY Mellon
Pricing Glitch Affects Billions of Dollars of Funds, Reuters (Aug.
26, 2015), available at http://www.reuters.com/article/bnymellon-funds-nav-idUSL1N1111QY20150826; Barrington Partners White Paper, An
Extraordinary Week: Shared Experiences from Inside the Fund
Accounting System Failure of 2015 (Nov. 2015), available at http://www.mfdf.org/images/uploads/blog_files/SharedExperiencefromFASystemFailure2015.pdf; Transcript of the BNY
Mellon Teleconference Hosted by Gerald Hassell on the Sungard Issue,
available at https://www.bnymellon.com/_global-assets/pdf/events/transcript-of-bny-mellon-teleconference-on-sungard-issue.pdf.
    \91\ We recognize that it may not be feasible or may be cost
prohibitive for an adviser to retain backup service providers,
vendors, and/or systems for all critical services. In such cases, an
adviser should consider backup plans, functions and/or processes to
address how it will manage the loss of a critical service.
---------------------------------------------------------------------------

    We also recognize that advisers often play a key role in
identifying, arranging for, and overseeing other service providers for
certain of their clients as part of their sponsoring roles. For
example, an adviser may arrange for a particular administrator or
pricing vendor for a registered investment company client or private
fund client.\92\ Accordingly, we believe an adviser should generally
review and assess how the critical service providers it arranges and/or
oversees for its clients plan to maintain business continuity when
faced with significant business disruptions and consider how this
planning will affect its clients' operations.\93\
---------------------------------------------------------------------------

    \92\ See supra note 85.
    \93\ See, e.g., supra note 89.
---------------------------------------------------------------------------

    We understand that many advisers currently take a variety of steps
to understand the operational and other risks of their service
providers and those of certain clients' critical service providers,\94\
such as reviewing a summary of a service provider's BCP, due diligence
questionnaires, an assurance report on controls by an independent
party,\95\ certifications or other information regarding a provider's
operational resiliency or implementation of compliance policies,
procedures, and controls relating to its systems, results of any
testing, and conducting onsite visits. Factors such as the significance
of the service provider to advisory operations, the type of service
provided, and the adviser's ability to require or request actions of
its service providers will impact the steps that advisers should
consider taking.
---------------------------------------------------------------------------

    \94\ See, e.g., BlackRock FSOC Comment Letter; see also Risk
Principles for Asset Managers, supra note 4, at 19 (``The increased
level of outsourcing to third party service providers has changed
not only their outsourcing risk profile but such significant changes
to an organization's business model can lead to many process and
control changes and could therefore increase the exposure to other
(operational) risk areas (e.g., country risk and service provider
oversight)''); cf. rule 38a-1(a)(2) (requiring registered investment
company boards to approve policies and procedures that provide for
the oversight of compliance by the fund's investment adviser and
certain other named service providers). Such approval must be based
on a finding that the policies and procedures are reasonably
designed to prevent violations of the federal securities laws by the
fund, the investment adviser and the other named service providers.
See id.
    \95\ See Investment Company Institute, Financial Intermediary
Controls and Compliance Assessment Engagements (Dec. 2015) at 8,
available at https://www.ici.org/pdf/ppr_15_ficca.pdf (identifying a
financial intermediary's ``Business Continuity/Disaster Recovery
Program'' as one of 17 areas of focus that ``should be addressed on
an annual basis as part of the financial intermediary's controls and
compliance engagements.''); see also AICPA, Reporting on Controls at
a Service Organization (2015), available at http://www.aicpa.org/Research/Standards/AuditAttest/DownloadableDocuments/AT-00801.pdf.
Many advisers review SSAE 16 reports that are prepared by an
independent public accountant in accordance with the American
Institute of CPAs' Auditing Standards Boards' Statement on Standards
for Attestation Engagements No. 16, Reporting on Controls at a
Service Organization. These reports provide assurances that the
service provider has established a system of internal controls, that
the internal controls are suitably designed to achieve specified
objectives, and that the internal controls are operating
effectively.
---------------------------------------------------------------------------

e. Transition Plan
    Under the proposed rule, an adviser's business continuity and
transition plan would have to include a plan of transition that
accounts for the possible winding down of the adviser's business or the
transition of the adviser's business to others in the event the adviser
is unable to continue providing advisory services.\96\ Advisers facing
the decision to exit the market commonly do so by: (1) Selling the
adviser or substantially all of the assets and liabilities of the
adviser, including the existing advisory contracts with its clients, to
a new owner; (2) selling certain business lines or operations to

another adviser; \97\ or (3) the orderly liquidation of fund clients or
termination of separately managed account relationships.\98\ Regardless
of the method an adviser chooses to effect a transition, we believe
that assessing and planning for potential impediments associated with
that method should help an adviser act in its clients' best interests
by seeking to mitigate potentially negative effects on its clients and
investors.\99\
---------------------------------------------------------------------------

    \96\ Cf. FINRA Rule 4370(c)(10) (requiring BCPs to address
``[h]ow the member will assure customers' prompt access to their
funds and securities in the event that the member determines that it
is unable to continue its business''); NASAA Model Rule 203(a)-1A(4)
(stating that BCPs should provide for the ``[a]ssignment of duties
to qualified responsible persons in the event of the death or
unavailability of key personnel''). Transition of an adviser's
business to others generally would, for example, include a situation
where the adviser is a sole proprietor who is no longer able to
provide advisory services and is, therefore, transferring its
business to another person/firm or winding down operations entirely.
Such succession/transition planning generally should be accounted
for in the context of an adviser's plan of transition.
    \97\ See supra note 59 (discussing partial transitions of an
adviser's business).
    \98\ See, e.g., Prudential Financial Inc. 2014 Resolution Plan:
Public Section (June 30, 2014), available at http://www.federalreserve.gov/bankinforeg/resolution-plans/prudential-fin-1g-20140701.pdf; American International Group, Inc. Resolution Plan
Section 1: Public Section (July 1, 2014), available at http://www.federalreserve.gov/bankinforeg/resolution-plans/aig-1g-20140701.pdf. These two nonbank financial companies have been
designated ``systemically'' important by FSOC and also have
investment adviser subsidiaries. The publicly-available summaries of
their resolution plans filed with the Federal Reserve indicate that
they would seek to either sell their advisory businesses or seek
Chapter 11 bankruptcy proceedings for their advisory entities.
    \99\ An adviser may also wish to consider in the context of its
transition plan, if and when it would be appropriate to use a
transition manager. A transition manager facilitates and coordinates
``the transition of asset management from one manager to another, or
from one asset class or investment strategy to another.'' See supra
note 41.
---------------------------------------------------------------------------

    We believe that a plan of transition generally should account for
transitions in both normal and stressed market conditions,\100\ and
generally should consider each type of advisory client, the adviser's
contractual obligations to clients, counterparties, and service
providers, and the relevant regulatory regimes under which the adviser
operates.\101\ Under the proposed rule, the transition components of a
business continuity and transition plan would have to include (1)
policies and procedures intended to safeguard, transfer and/or
distribute client assets during transition; (2) policies and procedures
facilitating the prompt generation of any client-specific information
necessary to transition each client account; (3) information regarding
the corporate governance structure of the adviser; (4) the
identification of any material financial resources available to the
adviser; and (5) an assessment of the applicable law and contractual
obligations governing the adviser and its clients, including pooled
investment vehicles, implicated by the adviser's transition. Each of
the proposed required components of an adviser's transition plan is
designed to help an adviser be well prepared for a transition so that
it can act quickly and in its clients' best interests if and when a
transition occurs.
---------------------------------------------------------------------------

    \100\ See supra notes 38-39 and accompanying text (discussing
the 2008 financial crisis and transition planning generally).
    \101\ In addition to contractual obligations to its clients and
vendors, an adviser that provides other services to entities, such
as to another adviser, generally should consider its contractual
obligations as a service provider to those other entities as it
plans for a transition event.
---------------------------------------------------------------------------

    We believe that preserving the safety of client assets and the
ability to promptly produce and transfer the information necessary for
the ongoing management of client assets is fundamental to an adviser
acting in the best interests of its clients. The adviser's policies and
procedures addressing how the adviser intends to safeguard, transfer
and/or distribute client assets in the event of a transition generally
should consider the unique attributes of each type of the adviser's
clients (e.g., registered investment companies, private funds,
separately managed accounts) and how the adviser plans to transfer
accurate client information to other advisers or their service
providers. For example, the transfer of client information with respect
to registered investment companies and private funds may be more
complex than that of separately managed accounts because registered
investment companies and private funds typically have multiple
investors, whereas separately managed accounts typically have only one
investor.
    It is our understanding that the methods for safeguarding,
transferring, and/or distributing client assets may vary by client type
and that the best method for one client might not be the best method
for another.\102\ Thus, we believe an adviser's policies and procedures
should appropriately account for the different methods in which it
plans to safeguard, transfer, and/or distribute assets of its different
types of clients. Additionally, if a client account holds assets that
would require special instruction or treatment in the event of
transition, an adviser's policies and procedures generally should
address such instruction or treatment.\103\
---------------------------------------------------------------------------

    \102\ For example, if the adviser manages registered investment
companies, the investment companies' board(s) may determine that the
best method for transferring the assets of these funds is to
reorganize them into funds managed by a new adviser. Separately
managed accounts, however, would not be reorganized, but may have
other considerations unique to them, such as whether a new custodian
would be necessary for a new adviser.
    \103\ For example, it is our understanding that when
transitioning accounts from one adviser to another, derivatives
positions require special treatment in that they are typically
unwound rather than transferred to the new adviser and that the
terms of the derivatives instrument may dictate whether and how such
unwinding takes place.
---------------------------------------------------------------------------

    Further, the transition plan should also contain policies and
procedures that would facilitate the prompt generation of any client-
specific information necessary to transition a client account, such as
the identity of custodians, positions, counterparties, collateral, and
related records of each client. Similar to the need to have accurate
and accessible client information in the event of a business continuity
scenario, we believe that this information is necessary to effect a
smooth transition of the management of client accounts.
    We believe senior executives at an investment adviser generally,
and especially in times of stress, should be able to quickly identify
the important decision-makers within the organization and understand
the inter-relationships between the adviser and any affiliated entities
to be able to assess whether and how issues at an affiliate may affect
the advisory entity. For example, an adviser that uses an affiliate as
a qualified custodian may face additional issues if the transition
event is related to that affiliate's operations. We believe that this
information is necessary if the adviser needs to assess the manner in
which it can exit the market with minimal adverse effect on its clients
or to take steps necessary to protect itself from issues that may stem
from an affiliated entity. Accordingly, with respect to the adviser's
corporate governance structure, the transition component of a business
continuity and transition plan generally should include an
organizational chart and other information about the adviser's
ownership and management structure, including the identity and contact
information for key personnel, and the identity of affiliates (both
foreign and domestic) whose dissolution or distress could lead to a
change in or material impact to the adviser's business operations.\104\
---------------------------------------------------------------------------

    \104\ An advisory entity may be adversely affected by an
affiliate's distress if, for example, the adviser and distressed
affiliate share systems, personnel, sources of financing, or similar
names.
---------------------------------------------------------------------------

    Registered investment advisers manage a variety of products and
security types, with investments in and investors from various
jurisdictions and are subject to a variety of contractual and legal
obligations and regulatory regimes. An adviser's ability to seamlessly
transition advisory services could be impacted by its or its clients'
contractual obligations or the various regulatory regimes under which
the adviser or its advisory client may be subject. For example, an
adviser's insolvency or termination may trigger a termination clause in
a client's

derivative contract.\105\ Also, the board and shareholders of a
registered investment company must approve an advisory contract with
any new adviser \106\ and the Advisers Act requires advisory contracts
to include a provision that a contract cannot be assigned without
client consent.\107\ Other regulatory regimes may require regulatory
approval for certain acts,\108\ which may be further complicated by the
need for cross-border cooperation if the adviser operates in multiple
jurisdictions \109\ or the adviser's pooled investment vehicle clients
are domiciled in different jurisdictions.\110\ Accordingly, we are
proposing that an adviser's transition plan include an assessment of
the applicable law and contractual obligations governing the adviser
and its clients, including pooled investment vehicles, implicated by
the adviser's transition.
---------------------------------------------------------------------------

    \105\ Some ISDA contracts include the default provision allowing
for the counterparty to terminate a contract upon the change of
advisers.
    \106\ Section 15(a) of the Investment Company Act states that
``[i]t shall be unlawful for any person to serve or act as
investment adviser of a registered investment company except
pursuant to a written contact, which . . . has been approved by the
vote of a majority of the outstanding securities of such registered
company . . . .'' Additionally, section 15(c) of the Investment
Company Act states that ``it shall be unlawful for any registered
investment company having a board of directors to enter into . . .
any contract or agreement, written or oral, whereby a person
undertakes regularly to serve or act as investment adviser of . . .
such company, unless the terms of such contract or agreement and any
renewal thereof have been approved by the vote of a majority of
directors, who are not parties to such contract or agreement or
interested persons of any such party, cast in person at a meeting
called for the purpose of voting on such approval.'' But see, e.g.,
rule 15a-4 under the Investment Company Act (allowing funds, in
certain circumstances, to enter into interim advisory agreements
without an in-person board meeting and without the fund's
shareholders first approving the agreement); see generally JP Morgan
Chase/Bear Stearns Asset Management, SEC Staff No-Action Letter
(July 14, 2008) (providing staff no-action relief following the US-
government-brokered emergency sale of Bear Stearns Companies Inc. to
JP Morgan Chase & Co., to allow Bear Stearns Asset Management to
continue to serve as investment adviser to its funds without prior
in-person approval by the funds' board of directors due to the
extraordinary circumstances surrounding the sale of its parent
company).
    \107\ Section 205(a)(2) of the Advisers Act requires any
investment advisory contract to contain a provision indicating
``that no assignment of such contract shall be made by the
investment adviser without the consent of the other party to the
contract.'' Section 202(a)(1) of the Advisers Act defines
``assignment,'' for purposes of the Advisers Act, to include ``any
direct or indirect transfer or hypothecation of an investment
advisory contract by the assignor or of a controlling block of the
assignor's outstanding voting securities by a security holder of the
assignor. . . .''
    \108\ See, e.g., Third Avenue Trust and Third Avenue Management
LLC, Investment Company Act Rel. No. 31943 (Dec. 16, 2015) (Notice
and Temporary Order) (permitting the suspension of the right of
redemption of Third Avenue Trust's outstanding redeemable
securities).
    \109\ For example, as of January 4, 2016, the number of foreign
registrations of SEC-registered investment advisers was 2,279,
representing 1,051 SEC-registered investment advisers, some of which
were registered in multiple foreign jurisdictions. Additionally,
there were 780 foreign investment advisers registered with the
Commission as of that same date. Based on data from IARD.
    \110\ When evaluating options for Long-Term Capital Management,
L.P. during its collapse, the effects of the fund filing for
bankruptcy were not clear because the fund was managed by an
advisory entity domiciled in Delaware and located in Connecticut,
while the fund itself was domiciled in the Cayman Islands, where the
rights of its counterparties to liquidate collateral under the U.S.
Bankruptcy Code would have been delayed because the fund would have
likely had to seek bankruptcy protection in the Cayman Islands
courts, under Cayman law. See Report of The President's Working
Group on Financial Markets, Hedge Funds, Leverage, and the Lessons
of Long-Term Capital Management (Apr. 28, 1999), available at
https://www.treasury.gov/resource-center/fin-mkts/Documents/hedgfund.pdf.
---------------------------------------------------------------------------

    Finally, we believe it is important for an adviser to have
considered in advance its strategy for either avoiding or facilitating
a transition of its business and client accounts in the event the
adviser is in material financial distress such that its ability to
continue providing advisory services to its clients or otherwise acting
in its clients' best interests could be impacted or undermined.\111\
Accordingly, the proposed rule requires that the adviser's plan of
transition consider any material financial resources available to the
adviser. For example, the adviser could identify any material sources
of funding, liquidity, or capital it would seek in times of stress in