Business continuity plan

A business continuity plan is a firm's documented answer to the question "what happens if we cannot operate normally?" Significant business disruptions include natural disasters, power or telecommunications failures, cyberattacks, building loss, and the death or incapacity of key personnel. The plan must be in writing, approved by senior management, and reviewed at least annually or whenever the firm's operations change materially.

A compliant plan addresses a standard list of areas: data backup and recovery, alternate physical locations and communication systems, how customers can access their funds and securities if the firm is unreachable, how the firm will communicate with customers, employees, and regulators, and how mission-critical systems will be restored. Firms must also disclose the plan's key elements to customers — typically at account opening and on the firm's website — so investors know what to expect and whom to contact.

The underlying purpose is investor protection rather than the firm's own survival. Even if a firm ultimately winds down, the plan should ensure customers can reach their assets promptly. Continuity planning overlaps heavily with cybersecurity: a ransomware incident is a business disruption, and the same backup, access, and notification procedures apply. Succession planning for a solo investment adviser is treated as part of continuity as well.

Continuity requirements show up on the SIE as part of brokerage account administration, and on the Series 65 and Series 66 within the ethics and regulatory sections, where they sit alongside cybersecurity and recordkeeping obligations. Know that the plan must be written, annually reviewed, disclosed to customers, and focused on giving customers prompt access to their funds and securities.