Page 1 of 2 

BOARD OF GOVERNORS

OF THE

FEDERAL RESERVE SYSTEM

WASHINGTON, D.C. 20551 

DIVISION OF SUPERVISION

AND REGULATION

DIVISION OF CONSUMER AND 

COMMUNITY AFFAIRS

SR 20-3 

CA 20-2 

March 10, 2020 

TO THE OFFICER IN CHARGE OF SUPERVISION AT EACH FEDERAL RESERVE 

BANK AND TO INSTITUTIONS SUPERVISED BY THE FEDERAL RESERVE

SUBJECT: Interagency Statement on Pandemic Planning

Applicability: This letter is relevant to all institutions supervised by the Federal Reserve. 

The member agencies of the Federal Financial Institutions Examination Council (FFIEC) 

recently updated guidance identifying actions that financial institutions should take to minimize 

the potential adverse effects of a pandemic.1 As discussed in the attached Interagency Statement 

on Pandemic Planning, financial institutions should periodically review related risk management 

plans, including business continuity plans, to ensure that they are able to continue to deliver 

products and services in a wide range of scenarios and with minimal disruption.2 With the 

issuance of this interagency statement, SR letter 07-18, “FFIEC Guidance on Pandemic 

Planning,” and SR letter 06-5, “Influenza Pandemic Preparedness,” are superseded.

Reserve Banks are asked to distribute this letter to the Federal Reserve-supervised 

institutions in their districts, as well as to their supervisory and examination staff. Questions 

regarding the revised guidance should be addressed: 

• Division of Supervision and Regulation: Matthew Hayduk, Manager, Systems and

Operational Resiliency Policy section, at 202-973-6190.

• Division of Consumer and Community Affairs: Phyllis Harwell, Associate Director, at

(202) 452-3658.

1 Refer to the FFIEC March 6, 2020, press release at https://www.ffiec.gov/press/pr030620.htm

2 Additional information is available in the FFIEC Business Continuity Management Examination Handbook at 

https://ithandbook.ffiec.gov/it-booklets.aspx. 
Page 2 of 2 

In addition, questions may be sent via the Board’s public website.3

Michael S. Gibson Eric S. Belsky

Director Director

Division of Supervision Division of Consumer and

and Regulation Community Affairs

Attachment:

• Interagency Statement on Pandemic Planning 

Supersedes:

• SR letter 07-18, “FFIEC Guidance on Pandemic Planning” 

• SR letter 06-5, “Influenza Pandemic Preparedness” 

 

3 http://www.federalreserve.gov/apps/contactus/feedback.aspx
1 of 10

Interagency Statement on Pandemic Planning

PURPOSE

The Federal Financial Institutions Examination Council (FFIEC) on behalf of its member 

agencies1 are issuing guidance to remind financial institutions that business continuity plans 

should address the threat of a pandemic outbreak and its potential impact on the delivery of 

critical financial services. This guidance is an update to the 2007 Interagency Statement on 

Pandemic Planning as well as the “Interagency Advisory on Influenza Pandemic 

Preparedness” issued on March 15, 2006 by the Board of Governors of the Federal Reserve 

System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the 

Currency, and the Office of Thrift Supervision, as well as the “Letter to Credit Union 06-

CU-06 - Influenza Pandemic Preparedness” issued by the National Credit Union 

Administration in March 2006. 

This guidance identifies actions that financial institutions should take to minimize the 

potential adverse effects of a pandemic. Specifically, the institution’s business continuity 

plan(s) (BCP) should address pandemics and provide for a preventive program, a 

documented strategy scaled to the stages of a pandemic outbreak, a comprehensive 

framework to ensure the continuance of critical operations, a testing program, and an 

oversight program to ensure that the plan is reviewed and updated. The pandemic segment 

of the BCP must be sufficiently flexible to address a wide range of possible effects that 

could result from a pandemic, and also be reflective of the institution’s size, complexity, 

and business activities.

BACKGROUND

Pandemics are defined as an outbreak of a disease that occurs over a wide geographic area 

and affects an exceptionally high proportion of the population, possibly worldwide. Several 

pandemics have occurred throughout history and experts predict that we will experience at 

least one pandemic outbreak in this century. 

It is unknown if an infectious disease outbreak will result in a pandemic. The widespread 

nature of a virus or infectious disease and the possibility that it may mutate raises concerns 

about transmission among humans, with potentially devastating consequences. 

The adverse economic effects of a pandemic could be significant, both nationally and 

internationally. Due to their crucial financial and economic role, financial institutions 

 

1 The FFIEC comprises principals of the Board of Governors of the Federal Reserve System, Federal Deposit Insurance 

Corporation, National Credit Union Administration, Office of the Comptroller of the Currency, Consumer Financial 

Protection Bureau, and the State Liaison Committee.
2 of 10

should have plans in place that describe how they will manage through a pandemic event. 

Sound planning should minimize the disruptions to the local and national economy and 

should help the institution maintain the trust and confidence of its customers. 

DIFFERENCES BETWEEN TRADITIONAL BUSINESS CONTINUITY 

PLANNING AND PANDEMIC PLANNING

There are distinct differences between pandemic planning and traditional business 

continuity planning. When developing business continuity plans, financial institution 

management typically considers the effect of various natural or man-made disasters that 

may differ in their severity. These disasters may or may not be predictable, but they are 

usually short in duration or limited in scope.2 In most cases, malicious activity, technical 

disruptions, and natural/man-made disasters typically will only affect a specific geographic 

area, facility, or system. These threats can usually be mitigated by focusing on resiliency 

and recovery considerations. 

Pandemic planning presents unique challenges to financial institution management. Unlike 

natural disasters, technical disasters, malicious acts, or terrorist events, the impact of a 

pandemic is much more difficult to determine because of the anticipated difference in scale 

and duration. The nature of the global economy virtually ensures that the effects of a 

pandemic event will be widespread and threaten not just a limited geographical region or 

area, but potentially every continent. In addition, while traditional disasters and disruptions 

normally have limited time durations, pandemics generally occur in multiple waves, each 

lasting two to three months. Consequently, no individual or organization is safe from the 

adverse effects that might result from a pandemic event. Experts predict that perhaps the 

most significant challenge likely from a severe pandemic event will be staffing shortages 

due to absenteeism. These differences and challenges highlight the need for all financial 

institutions, no matter their size, to plan for a pandemic event when developing their BCP. 

Pandemic plans should be sufficiently flexible to effectively address a wide range of 

possible effects that could result from a pandemic. Pandemic plans need to reflect the 

institution’s size, complexity, and business activities. The potential impact of a pandemic on 

the delivery of a financial institution’s critical financial services should be incorporated into 

the ongoing business impact analysis and risk assessment processes.

The institution’s BCP should then be revised, if needed, to reflect the conclusions of its 

business impact analysis and risk assessment.

 

2 As evidenced by Hurricane Katrina, while the duration of a specific natural disaster may be relatively brief, the social and 

economic recovery from such events can be prolonged.
3 of 10

To address the unique challenges posed by a pandemic, the financial institution’s BCP 

should provide for: 

1. A preventive program to reduce the likelihood that an institution’s operations will be 

significantly affected by a pandemic event, including: monitoring of potential 

outbreaks, educating employees, communicating and coordinating with critical service 

providers and suppliers, in addition to providing appropriate hygiene training and tools 

to employees.

2. A documented strategy that provides for scaling the institution’s pandemic efforts so 

they are consistent with the effects of a particular stage of a pandemic outbreak, such 

as the 6 intervals described by the Center for Disease Control and Prevention (CDC) 

(https://www.cdc.gov/flu/pandemic-resources/national-strategy/intervalsframework.html). The strategy will also need to outline plans describing how to 

recover from a pandemic wave and proper preparations for any following wave(s). 

Furthermore, the strategy should include plans for re-entering personnel into the 

workplace. 

3. A comprehensive framework of facilities, systems, or procedures that provide the 

organization the capability to continue its critical operations in the event that large 

numbers3 of the institution’s staff are unavailable for prolonged periods. Such 

procedures could include social distancing to minimize staff contact, telecommuting, 

redirecting customers from branch to electronic banking services, or conducting 

operations from alternative sites. Consideration should be given toward visitor 

procedures and whether restrictions should be implemented for visitors accessing the 

facilities. The framework should consider the impact of customer reactions and the 

potential demand for, and increased reliance on, online banking, telephone banking, 

ATMs, and call support services. In addition, consideration should be given to possible 

actions by public health and other government authorities that may affect critical 

business functions of a financial institution. 

4. A testing program to ensure that the institution’s pandemic planning practices and 

capabilities are effective and will allow critical operations to continue. 

5. An oversight program to ensure ongoing review and updates to the pandemic plan so 

that policies, standards, and procedures include up-to-date, relevant information 

 

3 A planning assumption from The Implementation Plan for the National Strategy for Pandemic Influenza is that 

rates of absenteeism will depend on the severity of the pandemic. In a severe pandemic, absenteeism attributable 

to illness, the need to care for ill family members, and fear of infection may reach 40 percent during the peak 

weeks of a community outbreak, with lower rates of absenteeism during the weeks before and after the peak.

Certain public health measures (closing schools, quarantining household) are likely to increase rates of absenteeism.
4 of 10

provided by governmental sources or by the institution’s monitoring program.

The methodologies detailed in the FFIEC’s Business Continuity Management (BCM) 

booklet4 provide a sound framework for institutions developing and/or updating their 

pandemic plan, as well as a means to integrate these key activities into the final pandemic 

plan. 

The U.S. Government and industry associations have issued extensive and comprehensive 

guidance to assist institutions of all types in developing plans for pandemic events. 

Institutions should review the following: 

• The National Strategy for Pandemic Influenza (National Strategy) and the

Implementation Plan for the National Strategy for Pandemic Influenza (National 

Implementation Plan) issued by the federal government provide a complete guide 

to pandemic planning. The documents can be found at:

https://www.cdc.gov/flu/pandemic-resources/planning-preparedness/nationalstrategy-planning.html 

• The Department of Homeland Security (DHS) published The Pandemic Influenza 

Preparedness, Response, and Recovery Guide for Critical Infrastructure and Key 

Resources. This document is one of the tools DHS developed to enhance 

pandemic planning. It provides a source listing of primary government and 

pandemic influenza-specific background material, references, and contacts. 

Institutions may find the Continuity of Operations – Essential (COP-E) planning 

process especially useful. The document can be found at:

https://www.cdc.gov/flu/pandemic-resources/planning-preparedness/nationalstrategy-planning.html

• The Department of Health and Human Services Center for Disease Control 

published Community Mitigation Guidelines To Prevent Pandemic Influenza – 

United States, 2017. This document provides information about community 

actions that may be taken to limit the impact from pandemic influenza when 

vaccine and antiviral medications are in short supply or unavailable. Financial 

institutions may be asked to plan for the use of the identified interventions to help 

limit the spread of a pandemic, prevent disease and death, lessen the impact on the 

economy, and keeps society functioning. The document can be found at: 

https://www.cdc.gov/flu/pandemic-resources/planning-preparedness/nationalstrategy-planning.html

• The Department of Health and Human Services (DHHS) has published a series of 

checklists that are intended to aid preparation for a pandemic in a coordinated and 

consistent manner across all segments of society. Included are checklists for state 

and local governments, for U.S. businesses with overseas operations, for the 

Workplace, for Individuals and Families, for Schools, for Health Care, and for 

 

4 This guidance was updated in 2019. The FFIEC’s Business Continuity Planning booklet was renamed as Business 

Continuity Management (BCM). The booklet can be accessed at: 

https://ithandbook.ffiec.gov/media/296178/ffiec_itbooklet_businesscontinuitymanagement.pdf
5 of 10

Community Organizations. They can also be found at:

http://www.pandemicflu.gov/.

PHASES: PLANNING, PREPARING, RESPONDING, AND RECOVERING

Traditional business continuity planning and pandemic planning require management to 

follow a cyclical process of planning, preparing, responding, and recovering. However, 

pandemic planning requires additional actions to identify and prioritize essential 

functions, employees, and resources within the institution and across other business 

sectors. The issues discussed below highlight the specific challenges faced by 

management and the mitigating controls that should be considered when developing a 

pandemic plan. 

BOARD AND SENIOR MANAGEMENT RESPONSIBILITIES

As with other BCM activities, pandemic planning should not be viewed as solely an 

Information Technology (IT) issue, but rather as a significant risk to the entire business. 

As such, an institution’s pandemic planning activities should involve senior business 

management from all functional, business and product areas, including administrative, 

human resources, legal, IT support functions, and key product lines. 

An institution’s board of directors is responsible for overseeing the development of the 

pandemic plan. The board or a committee thereof should also approve the institution’s 

written plan and ensure that senior management is investing sufficient resources into 

planning, monitoring, and testing the final plan. 

Senior management is responsible for developing the pandemic plan and translating the 

plan into specific policies, processes, and procedures. Senior management is also 

responsible for communicating the plan throughout the institution to ensure consistent 

understanding of the key elements of the plan and to ensure that employees understand 

their role and responsibilities in responding to a pandemic event. Finally, senior 

management is responsible for ensuring that the plan is regularly tested and remains 

relevant to the scope and complexity of the institution’s operations. 

INCORPORATING PANDEMIC RISK INTO THE BUSINESS IMPACT ANALYSIS

The potential effects of a pandemic should be a part of the financial institution’s overall 

BCM business impact analysis (BIA). The BIA should: 

• Assess and prioritize essential business functions and processes that may be 

affected by a pandemic; 

• Identify the potential impact of a pandemic on the institution's essential business 
6 of 10

functions5 and processes, and supporting resources;

• Identify the potential impact of a pandemic on customers: those that could be 

most affected and those that could have the greatest impact on the (local) 

economy; 

• Identify the legal and regulatory requirements for the institution’s business 

functions and processes;

• Estimate the maximum downtime associated with the institution’s business 

functions and processes that may occur during a pandemic;

• Assess cross training conducted for key business positions and processes; and 

• Evaluate the plans of critical service providers for operating during a pandemic. 

Financial institutions should evaluate the plans and monitor the servicers to ensure 

critical services are available. Financial institutions may wish to have back-up 

arrangements to mitigate any risk. Special attention should be directed at the 

institution’s ability to access leased premises and whether sufficient internet 

access capacity is available if telecommuting is a key risk mitigation strategy.

Incorporating the impact of pandemic risk into the institution’s BCP involves additional 

complexity since typical disaster or emergency response mechanisms and methods may 

not be feasible. For example, moving employees to an alternate facility that is typically 

used during a natural disaster or other emergency, may not be an appropriate or feasible 

way to continue operations in a pandemic. There may be a shortage of available staff to

relocate and it is possible that an alternate site might also be affected by the pandemic. 

DHS provides a list of twelve planning assumptions that institutions should consider when 

developing the impact analysis.6

The pandemic issues considered in the impact analysis also should involve forecasting 

employee absenteeism and considering family care issues that may affect business 

operations.7 DHS believes rates of absenteeism will depend on the severity of the 

pandemic. In a severe pandemic, absenteeism attributable to illness, the need to care for ill 

family members and fear of infection may reach 40 percent during the peak weeks of a 

community outbreak, with lower rates of absenteeism during the weeks before and after 

the peak. Certain public health measures (e.g. closing schools, quarantining household 

contacts of infected individuals, or altering or ceasing public transportation schedules) are 

likely to increase the rate of absenteeism.

A key part of an institution’s BIA that addresses pandemics is to examine external factors. 

For example, assessing the impact of critical interdependencies will involve making 

 

5 The Department of Homeland Security (DHS) Pandemic Influenza Preparedness, Response, and Recovery Guide and is 

available at: https://www.dhs.gov/sites/default/files/publications/cikrpandemicinfluenzaguide.pdf

6 See The National Implementation Plan at http://www.pandemicflu.gov/plan/community/commitigation.html.

7 Ibid.
7 of 10

planning assumptions regarding the availability of external services and prioritizing the 

effect of possible disruptions. In addition, potential travel restrictions imposed by health 

and emergency management officials may limit access to those services, even if they are 

still operating. 

RISK ASSESSMENT/RISK MANAGEMENT

As noted in the main body of this booklet, the institution’s risk assessment process is 

critical and has a significant bearing on whether BCM efforts will be successful. Important 

risk assessment and risk management steps that are important for pandemic planning

include: 

• Prioritizing the severity of potential business disruptions resulting from a 

pandemic, based on the institution’s estimate of impact and probability of 

occurrence on operations; 

• Performing a “gap analysis” that compares existing business processes and 

procedures with what is needed to mitigate the severity of potential business 

disruptions resulting from a pandemic; 

• Developing a written pandemic plan to follow during a possible pandemic event; 

• Reviewing and approving the pandemic plan by the board or a committee thereof 

and senior management at least annually; and 

• Communicating and disseminating the plan and the current status of the pandemic 

to employees. 

Specific risk assessment and risk management actions arising from a pandemic include 

the following: 

Coordination with Third Parties

Open communication and coordination with third parties, including critical service 

providers, is an important aspect of pandemic planning. Financial institutions should 

coordinate information sharing efforts through participation in business and 

community working groups and develop coalitions with outside parties to provide 

support and maintenance for vital services during a pandemic. Efforts could include 

consideration of cooperative arrangements with other financial institutions within the 

institution’s geographical trade area. In addition, management should coordinate its 

pandemic planning efforts with local public health and emergency management 

teams, identify authorities that can take specific actions (e.g., who has the ability to 

close a building or alter transportation), and plan to alert local and state agencies 

regarding significant employee absenteeism that may be caused by a sudden 

pandemic outbreak. Communication with customers and the media is also critical to 

ensure that accurate information is disseminated about business operations. 

Critical interdependency challenges require management to ensure an adequate 

reserve of essential supplies and to proactively manage maintenance of equipment to 
8 of 10

ensure sustainability during service disruptions. Management should also monitor its 

service providers, identify potential weaknesses in the service and supply chains, and 

develop potential alternatives for obtaining critical services and supplies.

Identification of Triggering Events 

A triggering event occurs when an environmental change takes place that requires 

management to implement its response plans based on the pandemic alert status. 

Alerts may be issued by various organizations that have developed surveillance 

systems to monitor the progression of viral outbreaks. Depending on the severity of 

the alert, management may need to act quickly to implement elements of its pandemic 

response plans. Therefore, it is important for management to monitor national and 

international pandemic news sources in order to be aware of potential outbreaks. 

Management should monitor websites devoted to national health care issues, identify 

key points of contact for emergency and health care organizations, and assess 

potential implications for the financial institution if a pandemic occurs. Management 

also should communicate to employees and key service providers the actions it plans 

to take at specific triggering points. 

Employee Protection Strategies

Employee protection strategies are crucial to sustain an adequate workforce during a 

pandemic. Institutions should promote employee awareness by communicating the 

risks of a pandemic outbreak and discussing the steps employees can take to reduce 

the likelihood of contracting a pandemic virus. The following risk management 

strategies should be considered:

• Publicize the Centers for Disease Control and Prevention “Cover Your Cough” 

and “Clean Your Hands” programs or other general hygiene programs; 

• Encourage employees to avoid crowded places and public transportation systems;

• Implement “social distancing” techniques to minimize typical face-to-face contact 

through the use of teleconference calls, video conferencing, flexible work hours, 

telecommuting, encouraging customers to use online or telephone banking 

services, ATMs and drive-up windows; and 

• Review and consider the use of other non-pharmaceutical interventions developed 

by the Centers for Disease Control and Prevention (more information is available 

at: http://www.pandemicflu.gov/plan/community/commitigation.html).

Mitigating Controls

Despite the unique challenges posed by a pandemic, there are control processes that 

management can implement to mitigate risk and the effects of a pandemic. For 

example, to overcome some of the personnel challenges, management should ensure 

that employees are cross-trained and that succession plans have been developed. The 

institution may be able to leverage plans already established as part of traditional 

business continuity planning. 

Remote Access

During a pandemic there may be a high-reliance on employee telecommuting, which 
9 of 10

could put a strain on remote access capabilities such as capacity, bandwidth, and 

authentication mechanisms. Moreover, employees who typically work onsite may not 

have remote access authority or the necessary technology infrastructure to work at 

home. Analysis of remote access capabilities, mapping of related technology 

infrastructure to employee needs during a pandemic, assessing the infrastructure at 

the neighborhood level, and considering internal and external capacity are necessary 

to help ensure telecommuting strategies will work during a pandemic.

RISK MONITORING AND TESTING

As information from medical and governmental experts about the causes and effects of a 

pandemic continues to evolve, an institution’s pandemic plan must be sufficiently flexible 

to incorporate new information and risk mitigation approaches. As a result, risk monitoring 

and testing of the pandemic plan is important to the overall planning process. A key 

challenge for management is developing a testing program that provides a high degree of 

assurance that critical business processes, including supporting infrastructure, systems, and 

applications, will function even during a severe pandemic. A robust program should 

incorporate testing:

• Roles and responsibilities of management, employees, key suppliers, and 

customers;

• Key pandemic planning assumptions; 

• Increased reliance on online banking, telephone banking, and call center services; 

and 

• Remote access and telecommuting capabilities.

Test results should be reported to management, with appropriate updates made to the 

pandemic plan and testing program. 

Testing for a pandemic may require variations to the scope of traditional disaster recovery 

and business continuity testing, as potential test scenarios will most likely be different. 

Alternatives for pandemic testing can include: well-orchestrated “work at home” days for 

critical and essential employees to test remote access capabilities and infrastructure; crisis 

management team communication exercises; table top exercises that test various scenarios 

related to escalated absenteeism rates; additional or modified call-tree exercises; and 

community, regional or industry-wide exercises with members of the financial services 

sector to test the financial sector’s ability to respond to a pandemic-like crisis.
10 of 10

REFERENCES

In addition to references included above, institutions may find these web sites helpful in 

their pandemic planning activities: 

Centers for Disease Control (CDC)

https://www.cdc.gov/DiseasesConditions/

World Health Organization (WHO)

https://www.who.int/

U.S. Department of Labor: Occupational Safety and Health Administration (OSHA) 

https://www.osha.gov/Publications/influenza_pandemic.html

U.S. Department of State

https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html/

U.S. Department of Veterans Affairs (VA)

https://www.publichealth.va.gov/flu/pandemic/

U.S. Department of Health and Human Services (DHHS) 

http://www.dhhs.gov/nvpo/pandemics/index.html