SEC Proposes New Rule Requiring Registered Investment Advisers to Adopt Written Business Continuity and Transition Plans

July 6, 2016

On June 28, 2016, the SEC formally proposed a new rule ("Rule 206(4)-4") under the Investment Advisers Act of 1940, as amended (the "Advisers Act"), that would require registered investment advisers ("RIAs") to adopt and implement written business continuity and transition plans and to review no less frequently than annually the adequacy and effectiveness of such plans.  The proposed rule is subject to a 60-day comment period, which will expire on September 6, 2016.[1]

As proposed, Rule 206(4)-4 would require RIAs to adopt written business continuity and transition plans "reasonably designed to address operational and other risks related to a significant disruption in the investment adviser’s operations."  Such plans would be required to address at least the following two elements of disruption risk:

• Business continuity after a significant business disruption; and
• Business transition in the event the RIA is unable to continue providing investment advisory services to clients.

Each of these requirements is elaborated on below.

Proposed Rule 206(4)-4 would require the business continuity plans adopted by an RIA to include written policies and procedures addressing at least the following elements in the event of a significant business disruption:

• Maintenance of critical operations and systems, including the protection, backup and recovery of client records and other critical data;
• Pre-arranged alternative worksites for the RIA’s personnel;
• Communication with the RIA’s clients, employees, service providers, and regulators; and
• Identification and assessment of third party services critical to the operation of the RIA.

In general, these requirements are not new.  Since the adoption of the Compliance Program Rule (Rule 206(4)-7) in 2003, RIAs have in practice been required to adopt written business continuity and disaster recovery plans pursuant to SEC Staff interpretive guidance.  Although proposed Rule 206(4)-4 would impose more specificity as to the required elements of a business continuity and disaster recovery plan than has previously been the case, most RIAs should already have plans in place that comply in most material respects with the required elements of the proposed new Rule. 

Proposed Rule 206(4)-4 would also require RIAs to adopt a written plan of transition "that accounts for the possible winding down of the RIA’s business or the transition of the RIA’s business to others in the event the RIA is unable to continue providing investment advisory services."  Such a plan would be required to include policies and procedures addressing at least the following:

• The safeguarding, transfer and/or distribution of client assets during transition;
• Facilitation of the prompt generation of any client-specific information necessary to transition each client account;
• Information regarding the corporate governance structure of the RIA;[2]
• Identification of any material financial resources available to the RIA; and
• An assessment of applicable law and contractual obligations governing the RIA and its clients (including any pooled investment vehicles) implicated by the RIA’s transition.

These business succession requirements are new, and most RIAs would need to develop compliance policies and procedures to address them. 

Proposed Rule 206(4)-4 grows out of a regulatory trend that focuses on operational risk in the financial services industry as a potential source of systemic risk to the U.S. financial system as a whole, particularly in light of the industry’s heavy dependence on technology.  As the SEC notes in the Proposing Release for Rule 206(4)-4, many financial regulators already have rules in place requiring the financial firms under their oversight to adopt written business continuity and transition plans.  In addition, in 2014, the Financial Stability Oversight Council ("FSOC"), a body created under Dodd-Frank to monitor for and coordinate the Federal regulatory responses to potential systemic risks to the U.S. financial system, issued a request for public comment on the financial products and activities of the asset management industry, including operational risks and transition planning.  The SEC’s focus on cybersecurity as one of its top examination priorities over the past several years can also be seen as part of this trend. 

Clients should reach out to their Gibson Dunn contacts if they have any questions regarding proposed Rule 206(4)-4 or any other regulatory matters.

                [1]              A copy of the SEC’s Proposing Release for Rule 206(4)-4 may be found on the SEC’s website at https://www.sec.gov/rules/proposed/2016/ia-4439.pdf. 

                [2]              In its Proposing Release, the SEC states that the purpose of this requirement is to identify key decision-makers within an RIA’s organization and to address whether and how any inter-relationships between an RIA and its affiliates might affect the transition process.  The Release goes on to state that an RIA’s transition plan should include an organization chart and other information about the RIA’s ownership and management structure, including the identity and contact information for key personnel, and the identity of any affiliates whose dissolution or distress could lead to a change in or material impact on the RIA’s operations.