Board of Governors of the Federal Reserve System 

Office of the Comptroller of the Currency 

Securities and Exchange Commission. 

Joint Report on Efforts of the Private Sector to Implement the 

Interagency Paper on Sound Practices to Strengthen 

the Resilience of the U.S. Financial System. 

April 2006 

Introduction 

Congress in the Intelligence Reform and Terrorism Prevention Act 

("Terrorism Prevention Act") 

[note:] 1

 Intelligence Reform and Terrorism Prevention Act of 2004, Section 7803(e), S. 2845 ("Emergency 

Securities Response Act of 2004") (December 17, 2004). [end of note.] 

required the Federal Reserve, the Office of the 

Comptroller of the Currency, and the Securities Exchange Commission (agencies) to 

prepare a study, due no later than April 30, 2006, on the efforts of the private sector to 

implement the Interagency Paper on Sound Practices to Strengthen the Resilience of the 

U.S. Financial System 

[note:] 2

 Sound Practices Paper, Securities Exchange Act Release No. 47638 (April 7, 2003), 68 FR 17809 

(April 11, 2003). [end of note.] 

(Sound Practices Paper). As directed in the legislation, this 

report discusses the efforts of private sector financial services firms covered by the Sound 

Practices Paper to implement enhanced business continuity plans, and the extent to which 

implementation has been done in a geographically dispersed manner. This report also 

addresses the agencies' views whether the Sound Practices Paper should be expanded to a 

larger range of private sector financial services firms that play significant roles in critical 

financial markets and whether legislative and regulatory changes are needed to expedite 

implementation by affected firms and optimize business continuity planning by the 

financial services industry. 

As discussed below, the regulated financial firms have made progress in 

implementing the Sound Practices Paper. Even though the sound practices are 

guidelines, covered firms have agreed to implement them and are working closely with 

the agencies to meet supervisory expectations. In this regard, the core clearing and 

settlement organizations, which present the greatest potential risk to the operation of the 

financial system, have made significant investments in their operating infrastructures, and 

all have achieved substantial implementation of the sound practices. Firms that play 

significant roles in critical financial markets have completed or should complete during 

2006 substantial implementation of the sound practices. Supervisory staffs of the 

agencies are in the process of reviewing verification information and assessing whether 

the sound practices have been effectively implemented. 

The agencies believe that the sound practices are an appropriate point of 

reference for mitigating the impact of a wide-scale disruption by all private sector 

financial services firms. However, they do not believe that expanding the current scope 

of the application of the Sound Practices Paper would provide sufficient additional 

resilience to outweigh the costs to financial market participants. The Sound Practices 

Paper expressly encourages all financial firms to review and consider implementation of 
the sound practices, and some firms have been responsive to this request in the design of 

their business continuity plans. In addition, the agencies continue to monitor the risk to 

the financial system a supervised institution's failure could pose and have contacted firms 

that, based on more recent information, now meet the definition of core clearing and 

settlement organization or firm that plays significant roles in critical financial markets to 

ask them to implement the sound practices. 

Sound Practices Paper and Implementation Efforts of Covered Firms 

Scope of Sound Practices Paper. One of the lessons learned during the events 

of September 11 is that firms across the financial system are highly interdependent. An 

operational disruption at one can create settlement risk and, ultimately, credit and 

liquidity risks at others. The Sound Practices Paper, which builds on longstanding 

principles of business continuity management, is meant to address the external risk that 

financial firms pose to the smooth operation of the financial system, and is based on the 

premise that firms that provide critical services or otherwise present significant external 

risk during a wide-scale disruption have a shared obligation to meet higher recovery 

standards in order to minimize systemic risk. 

[note:] 3 

Systemic risk is defined in the Sound Practices Paper as "the risk that the failure of one 

participant in a transfer system or financial market to meet its required obligations will cause 

other participants to be unable to meet their obligations when due, causing significant liquidity or 

credit problems or threatening the stability of financial markets." The use of the term is based on 

the international definition of systemic risk in payments and settlement systems contained in "A 

glossary of terms in payment and settlement systems," Committee on Payment and Settlement 

Systems, Bank for International Settlements (2001). [end of note.] 

The Sound Practices Paper identifies resumption or recovery objectives for 

critical clearing and settlement activities by two groups of firms. The first group is core 

clearing and settlement organizations, which are the firms that provide clearing and 

settlement services for critical financial markets or act as large-value payment system 

operators and present systemic risk should they be unable to operate. 

[note:] 4

 The critical financial markets identified in the Sound Practices Paper are federal funds, foreign 

exchange, commercial paper, U.S. government and agency securities, and corporate debt and 

equity securities. It is understood that wholesale payments services provided by depository 

institutions underpin all of the critical markets. [end of note.] 

The second group 

is firms that play significant roles in one or more critical financial markets by 

participating (on behalf of themselves or their customers) with sufficient market share (at 

least five percent) such that their failure to settle their own or their customers' material 

pending transactions by the end of the business day could present systemic risk. The 

agencies were careful to limit the scope of the paper to the financial firms that, because of 

the settlement risk they present, should be expected to target higher resilience standards 

than they might otherwise choose for purposes of mitigating their particular business 

risks. 

The definitions of a core clearing and settlement organization and a firm that 

plays a significant role in a critical financial market were adopted in the Sound Practices 

Paper after considerable study of the operation of the financial system and reflect the 
joint views of the agencies, industry members, and the public. The agencies published a 

draft of the Sound Practices Paper in the Federal Register on September 5, 2002, and 

approximately 90 comments were received. 

[note:]5

 67 FR 56835, September 5, 2002. [end of note.] 

Based on the comments, the definitions 

were refined. For example, the commenters advised the agencies to use at least a five 

percent U.S. dollar volume threshold as the criterion for a significant firm. 

[note:] 6

 The draft paper asked whether the definition of "firm that plays a significant role in a critical 

financial market" should include some specific dollar or volume threshold and specifically 

suggested five, seven and ten percent market shares as possible criteria. [end of note.] 

At the time 

the final paper was published, the agencies specifically contacted each firm that, based on 

the analysis of available data, was determined to meet one or more of the criteria in a 

critical financial market and asked the firm to implement the sound practices. 

The Sound Practices Paper is designed to assure that the two groups of firms 

will be able quickly to recover operations sufficient to complete material open 

transactions thereby minimizing the settlement risk to the financial system. Accordingly, 

the sound practices include meeting the objective of recovering or resuming clearing and 

settlement activities within-the-business-day on which a disruption occurs and 

maintaining geographically dispersed resources sufficient to meet those recovery or 

resumption objectives. By identifying specific risk-based recovery standards, the Sound 

Practices Paper seeks to assure that there will be a relatively consistent degree of 

preparedness across these firms. 

Implementation of Sound Practices by Covered Firms. The core clearing and 

settlement organizations were asked to substantially implement the sound practices by the 

end of 2004. This was extended to the end of 2005 in light of the amount of work and 

investment required to meet the agencies' expectations that these organizations 

demonstrate the ability to recover and resume critical clearing and settlement activities 

within a two-hour timeframe from a geographically remote backup site. The core 

clearing and settlement organizations, which are located in Manhattan, demonstrated a 

significant commitment to implement the sound practices within this timeframe. They all 

now have data and operations centers that are geographically remote from primary sites. 

All but one of the core clearing and settlement organizations had to establish completely 

new data centers and operations facilities in order to meet the required geographic 

diversity. Several of the core clearing and settlement organizations share or periodically 

shift processing work between the primary and remote backup sites, which provides 

assurance that they will be able to continue clearing and settlements in the event of a 

disruption at either location. Supervisory staffs are reviewing verification and testing 

documentation for one organization that plans to shift processing to backup sites when a 

disruption occurs, and for another that completed its remote data center at the end of 

2005. 

The banks and broker-dealers that were identified as firms that play a 

significant role in one or more critical financial markets were asked to implement the 

sound practices. Supervisory staffs are still assessing whether significant firms have 

substantially achieved the sound practices. Based on supervisory reports to date, it 
appears that the significant firms either have substantially achieved or should 

substantially achieve the sound practices during 2006. Five of the firms are still 

implementing the sound practices: two are finalizing arrangements for operations centers 

and three are finalizing arrangements for data centers that support their clearance and 

settlement activities in one or more critical markets. 

[note:] 7

 The Sound Practices Paper noted that the three-year implementation target (April 2006) could 

be an aggressive target for some firms and allowed for a longer implementation period for such 

firms as necessary. [end of note.] 

Supervisory reports indicate that 

these firms have substantially implemented the sound practices in other respects. Even 

though the sound practices are guidelines, covered firms have agreed to implement them 

and are working closely with the agencies to meet supervisory expectations. 

Accordingly, the agencies do not believe there is a need for legislative or regulatory 

changes to optimize implementation by covered firms. 

With respect to achieving geographic diversity of primary and backup sites, 

significant firms are meeting the expectations of the Sound Practices Paper. The Sound 

Practices Paper expressly does not mandate minimum mileage requirements for distances 

between primary and backup facilities; rather each firm has flexibility to implement the 

sound practices based on its own risk profile in consultation with its regulatory agency. 

Significant firms have or are establishing geographically diverse backup sites, in many 

cases hundreds of miles away from their primary sites, and all firms have made 

measurable improvements in their backup arrangements. As the Sound Practices Paper 

states, long-standing principles of business continuity suggest that backup arrangements 

should be as far from primary sites as necessary to avoid being subject to the same set of 

risks as the primary location. As part of their sound practices review, supervisory staffs 

of the agencies are discussing recovery arrangements with significant firms to determine 

the extent to which firms are able to avoid reliance on the same infrastructure 

components, including the impact of a wide-scale evacuation, although as discussed 

infra, firms may not always be able to obtain complete information about certain critical 

infrastructure constraints. 

Implementation of the sound practices has led covered firms to make 

significant investments in backup facilities, technology, and staff. As a result, covered 

firms have increased their resilience to a wide-scale disruption, and the U.S. financial 

system is considerably more likely to recover rapidly from such an event. 

Expansion of Scope of Sound Practices Paper. In considering whether there 

is a need to expand the scope of the Sound Practices Paper, it is important to consider the 

resilience of the financial system overall. A broad range of financial services firms falls 

under a scheme of federal regulation and many of them already are subject to either 

regulatory or market-based expectations pertaining to recovery objectives and business 

continuity planning. But, even before the modern banking and securities statutes and 

regulations were adopted, the financial industry was expected to meet a very high 

standard of care in the handling of customers' funds, securities, and confidential financial 

information. Thus, financial institutions have a long-standing culture that emphasizes 

strong internal controls, physical and cyber security, and a comprehensive approach to 
business continuity planning that recognizes the importance of recovering and resuming 

business operations. The financial sector is recognized as one of the most resilient of the 

commercial sectors and it performed extremely well during and following the events of 

September 11. 

All federally insured banking organizations are subject to supervisory 

guidance on business continuity. In April 2003, the Federal Financial Institutions 

Examination Council (FFIEC) issued expanded guidance on business continuity 

planning. 

[note:] 8

 The FFIEC is a formal interagency body empowered to prescribe uniform principles, standards, 

and report forms for the federal examination of financial institutions by the Federal Reserve, the 

Federal Deposit Insurance Corporation, the National Credit Union Administration, the Office of 

the Comptroller of the Currency, and the Office of Thrift Supervision—the federal banking 

agencies--and to make recommendations to promote uniformity in the supervision of financial 

institutions. The guidance cited in the paragraph can be accessed at www.ffiec.gov. [end of note.] 

The guidance addresses both operations and business risk issues that all 

depository institutions must incorporate into their business continuity plans. The 

guidance specifically refers to the need to plan and test for recovery of critical business 

lines and functions--such as retail banking services--in the event of a wide-scale 

disruption, as well as scenarios in which physical or cyber assets (e.g., consumer 

information) and personnel are lost. Subsequently, the FFIEC issued guidance on 

managing risks associated with information technology operations, management, 

electronic banking, outsourcing, and wholesale and retail payments systems. These areas 

are part of the banking agencies' ongoing, on-site examination programs. 

Similarly, all broker-dealers are subject to regulatory requirements with 

respect to establishing and maintaining business continuity plans and setting appropriate 

recovery objectives. Broker-dealers refer to the recovery time objectives of the trading 

markets as a benchmark for their own business resumption plans. 

[note:] 9

 See footnote 13 infra. [end of note.] 

On April 16, 2004, 

the SEC approved rules of the NYSE and NASD, the primary self-regulatory 

organizations (SROs) for broker-dealers, requiring member firms to maintain business 

continuity plans that address a series of specified topics (including assuring that 

customers can have prompt access to their funds and securities in the event the member 

does not continue in business). These firms are inspected against SRO rules on a regular 

basis. Moreover, market discipline also provides a strong incentive for firms to 

voluntarily improve their resilience: investors and counterparties want to know a 

financial firm's resilience. The securities industry, which bore the heavy brunt of the 

events of September 11, has been extremely active in encouraging the resilience of all 

market participants. Indeed, in October 2005, trade associations for the securities, fixed 

income and derivatives industries sponsored a market-wide test that provided the 

opportunity to submit, execute, and settle test orders. The test received wide participation 

and had very positive results; a similar test will be held in October 2006. Most recently, 

the industry has been proactive in raising awareness of the need to augment business 

continuity plans to address pandemic flu. 

[note:] 10

 Beginning in September 2005, industry members have sponsored several open meetings in 

order to be briefed about avian flu by medical authorities, discuss evolving crisis response plans 

for New York City, and to share best practices. Industry associations, such as the Financial 
Service Sector Coordinating Council, are helping to coordinate efforts and recently issued an 

advisory paper entitled Preparations for "Avian Flu" in January 2006. See 

www.fsscc.org/reports/avianflu.html. In March, the Federal Reserve and OCC (along with other 

banking regulators) advised supervised institutions to incorporate the risks posed by pandemic flu 

into business continuity plans. [end of note.] 

The responsibility for managing business continuity applies even if a financial 

institution outsources to a third party the performance of services and processes that are 

subject to regulation and examination by its supervising agency (e.g., asset management, 

customer account processing, retail and wholesale payment clearing and settlement, and 

business continuity and disaster recovery services). It is the agencies' position that, 

notwithstanding the use of a service provider to perform various activities, a regulated 

financial institution cannot shift responsibility for compliance and risk management to 

the service provider. For example, a registered broker-dealer may contract with a service 

provider to keep and maintain certain records on its behalf, but the broker-dealer may not 

delegate to the service provider compliance responsibility with respect to the 

recordkeeping requirements of the federal securities laws. Should a service provider not 

have the appropriate level of resilience, a financial institution would be required to move 

to a provider that can demonstrate an appropriate level of resilience. 

[note:] 11

 The larger service providers have robust backup facilities and recovery objectives tailored to 

client firm requirements. Moreover, the agencies understand that since September 11, service 

providers are being carefully scrutinized by client financial institutions for recovery capabilities 

and cyber security. [end of note.] 

The Bank Service 

Company Act specifically authorizes the federal banking agencies to examine third 

parties that provide certain services to banks to the same extent as if such services were 

being performed by the bank itself on its own premises. 

[note:] 12

 12 U.S.C. § 1861 et seq. The federal banking agencies utilize a risk-based process to identify 

those technology service providers that should be examined jointly; the process includes 

identifying the types of services provided, as well as the number and the aggregate size of insured 

financial institutions serviced. In addition, each agency identifies service providers that could be 

examined as part of its regular bank supervisory process. [end of note.] 

The scope of service provider 

examinations may include assessments of firms' audit functions; organizational structures 

and management oversight; product and service development and delivery; customer 

support; vendor management; information technology; information security; disaster 

recovery; and business continuity. 

These regulatory programs and industry initiatives form a sound foundation 

upon which certain firms that are subject to the Sound Practices Paper are expected to 

build even more resilience because of the potential risk they present to the financial 

system. 

The trading markets operated by the SROs and electronic communications 

networks (ECNs) also are subject to supervisory expectations that they will have robust, 

risk-based business continuity planning programs. 

[note:] 13

 See Policy Statement: Business Continuity Planning for Trading Markets, Securities Exchange 

Act Release No. 48545 (September 25, 2003), 68 FR 56656 (October 1, 2003). The Policy 

Statement states that the SRO-operated markets and ECNs should have plans permitting 

restoration of trading activities no later than the next business day following a wide-scale 

disruption. [end of note.] 

Moreover, the trading markets and 
their supporting organizations have taken additional steps, both individually and 

collectively, to address the potential short-term effects on the equity securities trading 

markets of wide-scale disruptions at major financial centers. While the trading markets 

play an important role in the nation's financial system and have a public, even iconic, 

profile, in the aftermath of the events of September 11, the trading markets were closed 

for several days due to the lack of telecommunications connectivity without engendering 

any long-term impact on the financial health of the economy, the financial sector or a loss 

of confidence by investors. 

The agencies believe that this test--whether the financial system can tolerate a 

disruption of one or more entities without degrading its operations, creating settlement 

risk of a systemic nature, or causing a loss of public confidence—should remain the 

paramount consideration in determining whether a firm should be subject to the Sound 

Practices Paper. For example, investment companies, which provide access to the 

securities markets for many retail investors, do not individually maintain sufficient 

market share to meet the criteria. The entire investment company industry accounts for 

approximately 20 percent of the aggregate market value of U.S. common stocks. In the 

equity market, which accounts for the largest amount of assets invested in investment 

funds, each of the top three mutual fund management companies in terms of percentage 

of market value of U.S. stocks has equity assets under management of less than five 

percent of the market value of all stocks. 

[note:] 14

 For the market value of all stocks traded in the United States, see United States Federal 

Reserve, Flow of Funds Accounts of the United States--Z.1 Release, March 9, 2006. For the 

value of equity assets under management by leading mutual fund management companies, see 

Lipper Analytical New Applications (asset data as of January 31, 2006). The Lipper data 

includes retail equity mutual funds and equity mutual funds only available to insurance company 

separate accounts. [end of note.] 

Another example involves the impact a 

disruption at a transfer agent would have on the markets. Transfer agents record changes 

of ownership, maintain the issuer's security holder records, cancel and issue certificates, 

and distribute dividends. While it is true that transfer agents provide services in support 

of the completion of secondary trades, a disruption at a transfer agent is unlikely to have 

an immediate impact on the operation of securities markets. This is because the 

corporate securities markets require broker-dealers to settle transactions through a core 

clearing and settlement organization where securities are registered in the core clearing 

organization's nominee name. As a result, a majority of these transactions settle without 

changes in record ownership by the transfer agent. 

The agencies recognize that a significant disruption at any of these 

organizations would degrade the functioning of the financial sector in various ways and 

result in inefficiencies for consumers and other market participants. However, it is clear 

that some would have a more pronounced impact than others based on the role they play 

in the U.S. financial system. Other than the core clearing and settlement organizations, 

the consequences of a disruption at these organizations would vary along a continuum. 

However, a disruption in their operations could be tolerated for a brief period, or their 

operations could, to a certain extent and with some loss of function, be shifted to or 

performed by other market participants. In fact, competing markets and financial 

institutions are positioning themselves to absorb the business of a disrupted entity. The 
sheer breadth and competitive structure of the financial services industry, as well as the 

number of exchanges and over-the-counter markets, provide a high degree of redundancy 

across the sector. 

[note:] 15

 For example, there are thousands of banks; most consumers use more than one bank, and they 

have alternative ways to access cash, other assets, and credit. The first firms to recover from a 

wide-scale disruption will gain market share vis-a-vis their slower competitors. [end of note.] 

Accordingly, after careful consideration, the agencies do not recommend 

expanding the Sound Practices Paper to additional private sector financial services firms 

at this time. Firms subject to the Sound Practices Paper reflect the agencies' best 

judgment and the consensus of a broad array of financial sector participants as to those 

entities that present systemic risk to operation of the financial system. Moreover, the 

Sound Practices Paper is not a static document. In 2005, the agencies updated their 

market share data and identified an additional core clearing and settlement organization 

and several firms that now meet the five percent criteria of a firm that plays a significant 

role in a critical financial market. These firms have been contacted and have agreed to 

implement the Sound Practices Paper for those business lines. 

While the agencies do not recommend that the Sound Practices Paper be 

formally extended to a wider group of financial firms, the Paper encourages all financial 

firms to review and consider implementation of the sound practices, particularly if a 

firm's transactions levels approach those deemed to be significant. Moreover, 

commenters on the draft paper agreed that business continuity plans of all financial 

institutions should address the need for the rapid recovery and timely resumption of 

critical operations following a wide-scale disruption (including a loss or inaccessibility of 

staff in at least one major operating location); and strive for a high level of confidence, 

through ongoing use or robust testing, that critical internal and external continuity 

arrangements are effective and compatible. In fact, some firms not covered by the Sound 

Practices Paper have voluntarily implemented the sound practices, which suggests that 

the paper resonates with firms for business and competitive reasons and could become a 

benchmark for larger financial companies. 

The agencies are mindful of the risk that an unanticipated event, such as a 

terrorist attack, could occur in a manner that we have not seen before and for which we 

may not be completely prepared. Moreover, we live with the continuing threat of 

turbulent weather, which could severely damage the critical infrastructure and facilities of 

financial services firms. In addition, the financial services industry cannot fully protect 

against infrastructure disruptions of telecommunications, and it can only provide limited 

resilience against disruptions in other elements of the critical infrastructure, such as 

power, transportation, and water. Since September 11, the agencies and the financial 

services firms have worked hard at improving risk identification and management 

processes. Moreover, the agencies and financial firms have adopted a more forwardlooking, proactive approach to preparing for wide-scale disruptions than prior to 

September 11. Today, business continuity plans of financial firms are expected to focus 

on the impact of a disruption, rather than the cause of the disruption (all hazards 

approach). This helps ensure that high impact but low probability risks are incorporated 
into the planning process. At present, financial services firms are reviewing their 

business continuity arrangements to address the risks posed by a newly-identified threat--

pandemic flu. For almost 100 years, the nation has not had reason to plan for a protracted 

absentee rate of 30 to 50 percent of a firm's personnel for four to six weeks in waves over 

a 12 to 18 month period; yet today firms are working to find ways to contain the spread 

of such an influenza, protect employees, and maintain continuity of critical business 

operations. Therefore, while no business continuity plan provides complete protection 

against an unanticipated event, the agencies believe that the financial services firms are 

considerably more resilient than they were prior to September 11. 

Conclusion 

As discussed above, the core clearing and settlement organizations have 

substantially implemented the sound practices. While supervisory staffs are still 

reviewing verification documentation and test results, significant firms have achieved or 

should complete substantial implementation by the end of 2006. Because these firms are 

meeting their commitment to achieve the sound practices, the financial sector is 

considerably more resilient to a wide-scale disruption than they had been prior to 

September 11. As discussed, firms subject to the Sound Practices Paper reflect the 

agencies' best judgment and the consensus of a broad array of financial sector 

participants as to those entities that present systemic risk to the operation of the financial 

system. Other financial services firms also are subject to various post-September 11 

business continuity expectations and requirements, and many have made significant 

voluntary improvements in their resilience. Accordingly, the agencies do not see a need 

at this time to expand the Sound Practices Paper to cover additional private sector 

financial services firms, or to adopt additional legislative or regulatory requirements for 

supervised financial institutions. 

The U.S. economy and financial system are highly interdependent and risks 

posed by a wide-scale disruption cross the commercial sectors. Like other sectors, the 

financial sector worries about the resilience of the critical infrastructure to wide-scale 

disruption. The agencies strongly recommend that future work aimed at achieving 

greater resilience should be performed within this broader context by agencies or private 

sector umbrella groups that can speak across sectors.