12.4 Continuity Governance, Contacts and Disclosures

BCP Governance, Review, and Approval

A business continuity plan is only as reliable as its ongoing governance and operational maintenance. Rule 4370 establishes strict structural requirements for BCP administration:

• Mandatory Annual Review: Under Rule 4370, the designated senior manager who is a registered principal is responsible for a comprehensive review of the BCP at least annually to evaluate its effectiveness, test backup procedures, review vendor recovery capabilities, and incorporate lessons learned from tabletop crisis simulations.
• Senior Management Written Approval: The BCP must be formally approved in writing by a member of the broker-dealer's senior management, who must also be an appropriately qualified registered principal.
• Prompt Material Modifications: The firm cannot wait for the annual review cycle if significant operational changes occur. The BCP must be updated promptly upon any material change in:
  1. The firm's business lines, product offerings, or operating structure;
  2. Physical office locations, data centers, or headquarters;
  3. Key clearing arrangements, custodial relationships, or technology vendors.

Emergency Contact Information Requirements (FINRA Rule 4370(f))

To ensure regulatory authorities can immediately reach authorized leadership during a crisis, FINRA mandates centralized emergency contact registration through the FINRA Contact System (FCS):

Designation of Emergency Contact Persons (ECPs)

• Minimum of Two Contacts: Every member broker-dealer must designate at least two Emergency Contact Persons (ECPs) with FINRA.
• Registered Principal Requirement: Normally designate two associated persons. At least one must be senior management and a registered principal. A second who is not a principal must be senior management with knowledge of business operations.
• Senior Management Requirement: At least one of the designated emergency contacts must be a member of the broker-dealer's senior management.
• Small Firm Statutory Exception: If a member has only one associated person, the second emergency contact person may be an associated person or an unregistered individual who possesses direct knowledge of the firm's business operations and can assist regulatory authorities (such as the firm's outside legal counsel, independent accountant, or designated clearing firm contact).

Mandatory FCS Update Timelines

1. Prompt 30-Day Update Rule: The broker-dealer must update its emergency contact information in the FINRA Contact System promptly, and in no event later than 30 calendar days following any change in contact details (such as a resignation, phone number change, or replacement of an ECP).
2. Annual FCS Verification Rule: Within 17 business days of the end of each calendar year, the firm must electronically review and re-verify its emergency contact data in FCS, submitting confirmation to FINRA that the records remain accurate and current.

Customer BCP Disclosures (FINRA Rule 4370(e))

Transparency with the investing public is essential to maintaining confidence during market crises. FINRA Rule 4370(e) mandates that every member firm provide customers with a clear, concise written BCP disclosure statement:

Disclosure Content Requirements

The disclosure statement must summarize the firm's business continuity plan and explain:

• How the broker-dealer plans to respond to events of varying scope (comparing localized internal disruptions with broad regional disruptions);
• The firm's anticipated recovery time objectives for critical operational functions;
• Alternate communication methods available to customers during an emergency; and
• Explicit instructions explaining how customers can access their funds and securities—including contact details for the firm's carrying/clearing broker-dealer—in the event that the introducing firm's primary offices become completely unreachable.

Mandatory Delivery Methods

Broker-dealers must deliver this disclosure to customers through three mandatory distribution channels:

1. At Account Opening: Delivered in writing (electronically or hard copy) to every customer at the time the new account is opened;
2. Prominently on the Public Website: Posted on the member’s website if it maintains one; and
3. Mailed Upon Request: Transmitted promptly in writing to any customer who requests a copy.

Sources checked 2026-10-20: FINRA supervision, FINRA annual certification, FINRA continuity.