SEC and FINRA conducting checks on hedge funds' BCP and DR post-Sandy

Operational Risk
05 Feb, 2013

Hedge funds have been advised to prepare for SEC and FINRA checks on their business continuity plans (BCP) and disaster recovery systems (DR) in light of Hurricane Sandy, Eze Castle Integration has warned.

“We have heard reports that the SEC and FINRA are asking managers about how their BCP and DR worked during the hurricane. While the regulators are not being overly intrusive, they do want to know how managers’ systems fared during the storm. Regulators want to know if there were any holes or shortcomings in their BCP or DR infrastructure and for managers to identify them,” said Bob Guilbert, managing director at Eze Castle Integration, speaking in Boston.

Dodd-Frank stipulates managers must have BCP and DR in place, although it defines them very broadly. Regulators have asked for firms to provide documentation outlining their BCP procedures, individuals within the organisation tasked with initiating BCP, recent testing of BCP, weaknesses uncovered during Hurricane Sandy and copies of communication between employees and third parties during the storm.

“The SEC and FINRA are approaching managers randomly, and not just those based in New York. The tests are not strategy-specific either. Regulators just want to understand how managers’ BCP worked during the storm so it is essential managers have their systems in place and that they are regularly tested,” commented Guilbert.

Guilbert doubted the Dodd-Frank stipulations on BCP or DR would become more prescriptive post-Sandy. “It is unlikely regulators will define BCP or DR in detail in Dodd-Frank,” said Guilbert.

Most experts and surveys have shown hedge funds fared well during the storm and were prepared with 98% telling a recent COOConnect poll they had BCP in place. However, midtown, which is home to most of New York’s hedge fund community, was not that badly impacted by the storm with 67% telling COOConnect their offices were too far away from the storm’s centre to be affected.

“Because managers knew the storm was coming, they were able to prepare effectively. Most had remote access and communication plans in order prior to the storm hitting while a lot of managers’ offices were away from the storm’s path. Furthermore, institutional investors will easily fail a fund if it does not have these sorts of BCP or DR systems in place,” he added.

COOConnect conducted a survey in December 2012 to assess how Hurricane Sandy affected hedge fund managers and their suppliers.  To view the findings click on Hurricane Sandy Report.