On March 10, 2020, the New York State Department of Financial Services (NYSDFS), which regulates a variety of financial service entities such as banks, credit unions, check cashers, insurance companies, mortgage brokers, investment advisors, and cryptocurrency businesses, issued guidance in a series of “industry letters” and “circular letters” requesting “assurance” of operational preparedness relating to COVID-19. Such operation preparedness plans include a plan to maintain an adequate workforce, including remote work and other strategies to safeguard the workforce.

The NYSDFS has asked certain regulated entities to provide their operational plans “as soon as possible” but not later than April 9, 2020. The NYSDFS is asking regulated financial institutions to address operational preparedness and potential financial risk. The NYSDFS is also asking regulated insurance providers and cryptocurrency businesses to address the same concerns

According to the NYSDFS’s guidance, a regulated financial institution’s plan should generally include, at a minimum, the following:

1. “Preventative measures tailored to the institution’s specific profile and operations to mitigate the risk of operational disruption, which should include identifying the impact on customers, and counterparts;”

2. “A documented strategy addressing the impact of the outbreak in stages, so that the institution’s efforts can be appropriately scaled, consistent with the effects of a particular stage of the outbreak . . .;”

3. “Assessment of all facilities, . . . systems, policies and procedures necessary to continue critical operations and services if members of the staff are unavailable for long periods or are working off-site . . .;”

4. “An assessment of potential increased cyber-attacks and fraud;”

5. “Employee protection strategies, critical to sustaining an adequate workforce during the outbreak . . .;”

6. “Assessment of the preparedness of critical outside-party service providers and suppliers;”

7. “Development of a communication plan to effectively communicate with customers, counterparties and the public and to deliver important news and instructions to employees, along with establishing forums for questions to be asked and addressed;”

8. “Testing the plan to ensure the plan policies, processes and procedures are effective; and”

9. “Governance and oversight of the plan, including identifying the critical members of a response team, to ensure ongoing review and updates to the plan, including the tracking of relevant information from government sources and the institution’s own monitoring program.”

While each industry and circular letter differs somewhat, they explain that boards of directors are responsible for implementing COVID-19 operational plans, and senior management “is responsible for ensuring that effective policies, processes and procedures are in place to execute the plan and for communicating the plan throughout the institution to ensure consistency in approach so that employees understand their roles and responsibilities.”