The Commodity Futures Trading Commission (the "CFTC") has approved a National Futures Association ("NFA") rule that will become effective on July 1, 2003. Compliance Rule 2-38 (the "Rule") requires all NFA members (each, a "Member") to establish and maintain a written business continuity and disaster recovery plan (a "Plan") that outlines procedures to be followed during an emergency or a significant business disruption.
What areas of concern should a Plan address?
Under the Rule, all Members should have a Plan reasonably designed to enable them to continue operating, to reestablish operations, or to transfer their business to other Members with minimal disruption to their customers, other Members and the commodity futures markets. Although each Plan will be tailored to the individual needs of each Member, at a minimum, each Plan should address the following:
- Establishment of back-up facilities, systems and personnel. Such back-up facilities should be in a different geographic area from, be located in a different power grid than, and use a different telecommunications carrier than the Member's primary facilities. The back-up facilities may include arrangements for the temporary use of facilities, systems and personnel provided by third parties.
- Backing up and copying of essential documents and data (e.g., general ledger) on a periodic basis and storing the information off-site in either hard-copy or electronic format.
- Considering the impact of business interruptions encountered by third parties and identifying ways to minimize that impact.
- Developing a communication plan to contact essential parties such as employees, customers, carrying brokers, vendors and disaster recovery specialists.
Additional areas essential to a Member's business or operations must also be included in the Plan as appropriate.
How should a Member maintain a Plan?
A Member must update its Plan as necessary to respond to material changes in the Member's operations. Each Member must also periodically conduct and evidence reasonable effectiveness reviews. In addition, each Member should distribute and explain its Plan to its key employees and communicate the essential components to all employees. Copies of the Plan should be kept at one or more off-site locations readily accessible to key employees.
What information is the Member required to provide to the NFA?
The Rule requires Members to provide the NFA with the name and contact information for an individual whom the NFA can contact during an emergency. In addition, each Member that is an introducing broker, commodity pool operator or commodity trading advisor having more than one principal, and each Member that is a futures commission merchant, must also provide the NFA with the name and contact information for a second individual who can be contacted in the event that the NFA cannot reach the first individual. Such individual or individuals must be authorized to make key decisions in the event of an emergency. Furthermore, each Member must update the information about such individual or individuals upon request.
Please note, however, that Members are not currently required to provide the NFA with the above information as the NFA is currently updating its systems to make this process as smooth as possible. The NFA will make a separate announcement when its systems are ready.
*article courtesy of Dorsey & Whitney LLP