In connection with the Press Release announcing a Rule Proposal regarding adoption of written business continuity and transition plans by SEC-registered investment advisers, the Division of Investment Management also distributed a Guidance Update (No. 2016-04) discussing BCPs for registered investment companies (RICs). RICs have been expected to address business continuity since the 2003 adoption of Rule 38a-1, but the Update focuses on the oversight of and business continuity issues that may arise out of the industry-standard usage of third-party “critical fund service providers” by RICs, concluding that consideration of the robustness of the BCPs of critical fund service providers and the interrelationships of such critical fund service providers to one another will leave RICs better prepared to deal with business continuity events.

In addition to the service providers identified in Rule 38a-1 (each of a RIC’s adviser, principal underwriters, administrators and transfer agents), the staff also identifies custodians and pricing agents as critical fund service providers subject to the ambit of the Update.  The Update notes that a RIC’s BCP should contemplate whether key functions performed by a critical fund service provider are performed by an affiliate, a true third-party service provider or a combination thereof, and also suggests RICs consider the following lessons learned from past business continuity events in the industry and SEC staff outreach efforts related thereto when formulating the RIC’s BCP as it relates to critical fund service providers:

• Examining critical fund service providers’ backup processes and redundancies, the robustness of their contingency plans and how they will maintain operations during an incident;

• Monitoring whether the critical fund service providers have experienced an incident (including cyber breaches), how that could impair the critical fund service provider’s ability to provide services, and establishing communication protocols to successfully navigate such events, including:

  • Internal communications at the RIC and with its board;

  • External communications with affected and unaffected critical fund service providers, intermediaries, investors, regulators and press, as appropriate;

  • Maintaining updated and accessible contact information for essential communications; and

  • Communicating timely updates, progress reports and next steps during an event.

• Understanding how the BCPs of critical fund service providers relate to each other to ensure continuity of operations or prompt resumption of operations following an event; and

• Contemplating how a critical fund service provider disruption would impact RIC operations and investors and plans to manage the response to potential disruptions arising out of different scenarios (both internal and external).

The Update also underscores the RIC’s board’s oversight responsibility, stating the staff’s view that boards should discuss risk mitigation and the robustness of continuity planning with the RIC’s adviser and other critical fund service providers.

As with the proposed investment adviser BCP rule, the Update reflects the staff’s acknowledgement that no BCP or BCP-related policy can anticipate or prevent every business continuity event as well as the staff’s belief that appropriate planning and considerations of the issues described can help mitigate the impact of such events and assist a RIC in complying with its obligations under the federal securities laws during an event.