FINRA-registered broker-dealers don’t get to treat business continuity as a best practice. Rule 4370 makes it a specific, named obligation with defined minimum elements, annual review requirements, and a customer disclosure duty most other industries never have to think about.
Who’s Covered and What’s Required
Rule 4370 requires every FINRA member firm to create and maintain a written business continuity plan with procedures reasonably designed to enable the firm to meet its existing obligations to customers during an emergency or significant business disruption. It applies to every registered broker-dealer, regardless of size — smaller firms are held to the same underlying requirement, just scaled to their operations.
The Minimum Elements
The rule specifies minimum categories: data backup and recovery, mission critical systems, financial and operational assessments, alternative communication methods with customers and employees, critical business constituent and counter-party relationships, bank and counter-party impact, regulatory reporting, communications with regulators, and ensuring customers have prompt access to their funds and securities.
You Can Skip a Category, But Only With Documentation
If a category isn’t applicable to a firm’s specific business, the plan doesn’t need to address it, but the firm’s plan must document the rationale for excluding it. Simply omitting a category without explanation is a compliance gap, not a permitted simplification.
Who Owns This
A member of senior management, who must also be a registered principal, has to approve the plan and conduct the required annual review to determine whether modifications are needed based on changes to the firm’s operations, structure, business, or location. This creates clear individual accountability for keeping the plan current, not just for its initial creation.
Updates Aren’t Limited to the Annual Cycle
Beyond the required annual review, a firm must update its plan whenever any material change occurs to its operations, structure, business, or location. A plan tied to outdated office locations, staff, or systems after a significant business change is itself a compliance gap, independent of the annual review cycle.
The Disclosure Requirement Most Industries Don’t Have
Firms must disclose to customers how their business continuity plan addresses the possibility of a significant business disruption, in writing when customers open an account, posted on the firm’s website if it maintains one, and provided by mail upon request. This customer-facing disclosure requirement is distinct from most other industries’ continuity obligations, which are typically internal-only.
Backup and Recovery Needs to Be Concrete
Data backup and recovery is one of the explicitly named minimum elements, meaning a firm’s continuity plan needs concrete, documented backup and recovery procedures for its systems and records, not just a general statement that backups exist. See our business impact analysis guide for how to identify and prioritize which systems and data need the strongest recovery guarantees.
Plan and Insurance Cover Different Things
Rule 4370 requires operational continuity procedures, while business interruption insurance addresses the financial impact of a disruption on the firm itself. See our business interruption insurance guide for what this coverage typically includes and its common limitations. Illinois’ rising severe weather frequency also needs to factor into the plan directly — see our severe weather preparedness guide for region-specific considerations relevant to alternate site and remote access planning.
How CelereTech Helps
CelereTech builds the technical infrastructure supporting Rule 4370’s required elements — tested data backup and recovery, mission-critical system resilience, and alternative communication capability — and helps document the plan in a form that supports the annual review and customer disclosure requirements the rule mandates, working alongside your compliance officer or counsel.