Roger W Ferguson, Jr: Business continuity after September 11
Remarks by Mr Roger W Ferguson, Jr, Vice-Chairman of the Board of Governors of the US Federal
Reserve System, at the SWIFT Sibos World Forum, Geneva, 3 October 2002.
* * *
Good afternoon ladies and gentlemen. I would like to thank the SWIFT organization for inviting me to
speak to you about disaster recovery and business continuity, one of the main topics you have been
discussing this week. It has now been a little more than one year since the events of September 11.
Since then, bankers and the regulatory authorities in various financial centers have been intensively
discussing new business-continuity challenges. This forum is very important for two reasons. First,
SWIFT itself is a critical service provider for the largest financial institutions and markets. SWIFT's
efforts to provide leadership in strengthening business continuity are both welcome and important.
Second, the annual Sibos meetings bring together financial industry leaders from around the world to
discuss common issues affecting funds transfer, securities clearing, and other payment and settlement
businesses. The people at this conference have both the responsibility and the experience to address
serious common issues involving disaster recovery and business continuity. This afternoon I would like
to share some thoughts with you about business-continuity challenges and to discuss a white paper
on this topic that regulators in the United States have recently published for public consultation. I
would also like to underscore the opportunities and responsibilities that financial firms and their
financial utilities have in this new environment.
Lessons from September 11 about business continuity in financial markets
One of the essential lessons of September 11 is that the human spirit is both noble and resilient in the
face of tragedy. Many acts of heroism have been recorded. I am sure that many more have not been
recorded. Unparalleled cooperation in the financial markets supported both assistance to those in
need and resumption of day-to-day operations. In the end, although the financial markets quickly
returned to normal operations, I hope that we have learned from our experiences and are able, in a
continuing spirit of cooperation, to address the vulnerabilities of the financial industry that were
revealed by those events.
It is critical that we vigorously address the possibility of terrorist attacks in areas where major financial
markets or operational centers are concentrated. In discussions with financial institutions, someone
typically asks, What are the specific threats or scenarios that we need to guard against? The answer
to this question is not easy because law-enforcement officials and knowledgeable experts discuss a
wide range of scenarios, including some with very serious consequences. In addition, the next event
may be the one that we have not foreseen. We have therefore concluded that, for key planning
purposes, financial institutions and financial authorities should place more emphasis on the potential
effects of regional disruptions than on the potential sources of those disruptions.
At the national and international level, we must focus on the systemic risk that could result from
largescale, regional disruptions in one or more financial centers. In a recent white paper issued jointly by
the Federal Reserve, the Comptroller of the Currency, the Securities and Exchange Commission, and
the New York State Banking Department, we identified critical financial markets in the United States.
These include the markets for federal funds, foreign exchange, and commercial paper, as well as the
markets for government, corporate, and mortgage-backed securities. Additionally, most of these
markets are closely integrated with global financial markets with respect to institutional participation
and liquidity management as well as pricing and overall risk management.
From working with clearing organizations and private financial firms since September 11, we know that
they are taking steps to reassess their vulnerabilities to regional events. They have strong incentives
to strengthen their own resiliency. Their counterparties expect it. The regulatory community has also
been working hard to strengthen the foundations of critical markets, for three reasons. First, because
clearing and settlement functions are performed as part of an interdependent network of activity, there
is a concern that the incentives of one organization to strengthen resilience may not fully reflect either
the impact of its loss on others or the benefits of its greater resilience for the entire market. Second,
there is a concern that in times of cost pressures organizations may be tempted to overly discount the
risk of future regional events. Third, there is a concern that competitive pressures will lead some firms
to delay improvements in resilience in the hope that others will shoulder the responsibility. In other
words, there is a concern that some private organizations may not make sufficient and consistent
investments in resilience for the sake of the industry as a whole.
In addition, over the past thirty years the clearing and settlement infrastructure has become
increasingly concentrated in the United States and in some other countries as financial firms have
pursued the advantages of economies of scale and invested in technology to reduce costs and
streamline procedures. In Europe, this process accelerated following the introduction of the euro. Not
surprisingly, the overall consolidation of infrastructure has been accompanied by increasing technical
linkages and interdependence within and across markets. In this type of environment, significant single
points of failure within clearing and settlement processes can have far-reaching effects throughout the
financial markets.
To address these concerns, the regulatory community has adopted a strategy to help reduce systemic
risk from regional disruptions to the clearing and settlement infrastructure. This strategy has three
broad components: first, prevention; second, management; third, testing and assurance. The objective
is to reduce the probability that a regional event would bring critical financial markets to a standstill and
to ensure the smooth operation of critical infrastructure, if possible. Another objective is to allow the
most active firms, at a minimum, to wind up transactions, manage the related financial risk, and to
resume trading as soon as commercially reasonable.
Sound practices
Our recent white paper sets out several sound practices to achieve these objectives. To help prevent
and contain the effects of a regional event, financial utilities and critical firms should regionally diversify
their back offices and operational sites that support clearing and settlement for critical markets. In
particular, primary operations and backup operations need to be significantly more diverse in order to
meet the greater regional risks. The old model of having primary and backup operations centers in
close proximity so that they can be served by a common labor pool does not address the possibility of
a significant threat to an entire region and labor pool.
To help manage a regional event, the white paper sets out as a sound practice that financial utilities
should plan to recover and fully resume operations on an intraday basis. The paper notes that an
emerging sound practice is for these utilities to plan to recover and to resume operations within two
hours or less. Of course, actual recovery times will depend on circumstances. However, the objective
of rapid intraday recovery provides an important focal point for planning and testing by both utilities
and their financial institution customers. I should note that the Federal Reserve's own current recovery
objectives for Fedwire are much more aggressive than two hours.
The paper recognizes clearly that financial firms' ability to recover their overall operations is critically
dependent on their financial utilities. This means, in general, that the utilities will have to recover and
resume operations more quickly than their participants in order to enable those participants and the
overall market to recover in an orderly way. Many financial institutions are shareholders and board
members as well as participants in private-sector utilities. It will be very important for the management
of these utilities and their shareholder-participants to work closely to ensure that the recovery and
resumption strategies of both the utilities and the participants meet sound practices and are consistent
with one another.
The white paper also proposes that firms that play significant roles in critical financial markets should
plan to recover their operations sufficiently so that they can clear and settle trades that have already
been executed, as well as complete funds-transfer and other critical operations, on the same business
day that an event occurs. The paper notes that an emerging sound practice in the industry would call
on these significant players to plan to recover in four hours or less, again depending somewhat on
circumstances.
To help prepare for a regional event, the white paper encourages greater contingency and assurance
testing. As we learned from Y2K and again from September 11, testing is one of the vital elements of
contingency planning. Our white paper recommends that financial utilities and firms that play
significant roles in critical markets routinely use or test their recovery and resumption arrangements for
the required connectivity, functionality, and capacity.
In particular, greater testing between the backup facilities of financial utilities and the backup facilities
of their critical members would help the clearing and settlement infrastructure perform more smoothly
in the event of a regional disruption. Much more coordinated testing among utilities and firms serving
different markets would also help in the management of problems involving cross-market clearing and
settlement linkages. Obviously, in preparing for Y2K we engaged in very large-scale testing. In the
current context we understand that there may ultimately be diminishing returns from repeated testing
and that we must learn from our experiences in preparing for Y2K. The industry again is working
together to help define reasonable and meaningful tests and to cooperate by participating in them. In
the United States, the Federal Reserve and Clearing House Interbank Payments System (CHIPS)
have already coordinated their test schedules. The Federal Reserve Bank of New York's Payment
Risk Committee, the Securities Industry Association, and the Banking Industry Technology Secretariat
are working together to address testing and similar issues. As I have said before, this spirit of
cooperation in addressing critical, cross-industry problems of business continuity and testing is
welcome.
SWIFT played a very important role in preparations for Y2K and since September 11 has been
working to share ideas and coordinate testing with other organizations. I hope the results of your
meetings this week will provide additional ideas and the ongoing support necessary to address the
difficult issues involved in strengthening the industry's level of testing. SWIFT clearly can play an
important role in promoting and facilitating testing. More broadly, SWIFT can adopt and foster
emerging best practices for business continuity.
Challenges in addressing the risks of regional disruptions
I would now like to identify three primary challenges in implementing a strategy to address regional
disruptions. These challenges involve people, business, and technology.
In developing strategies for regional disruption, we must recognize that the safety of people--our
colleagues, employees, and their families--is paramount. Different strategies of regional diversification,
along with efforts to strengthen security and crisis response within regions, will help protect our
people. One of the challenges that we face, however, is how to increase individual safety without
losing the efficiencies that we have gained from concentrating staff and expertise at critical geographic
locations.
The effect of regional diversification on business also presents challenges. Firms will both incur costs
and reap benefits with diversification, but it is often difficult to justify adding costs to address
contingencies. Firms inevitably have a number of strategic priorities and projects that contend for
resources. We also recognize that some firms are in different positions than others in addressing
regional issues. Some firms have a national or international "footprint" that makes it somewhat easier
to take important measures to diversify operational centers and back-office operations. Others,
because of historical circumstances or regional specialization, have harder decisions to make. These
issues are always difficult.
Firms that play significant roles in critical markets, in particular, need to think very carefully about the
new situation we are facing, along with their importance to their customers, counterparties, and the
markets generally. At the highest levels of major firms, there is a real need for leadership in dealing
with an issue that goes beyond ordinary business decisions. Our white paper asks a series of
questions about how to identify critical firms that need to adopt sound practices for regional
diversification and seeks guidance on cost and similar issues.
The third important challenge involves technology. Some key technologies for data storage and
communication do not accommodate regional diversification as readily as we all would like. The
challenge here will be to modify existing arrangements, solve technological problems, and find new
ways to facilitate diversification. I am sure that the firms attending Sibos are very aware of these
issues, and I trust that the market for these technologies will see a flow of very creative solutions over
the coming months.
I would like to add a note about telecommunications. We have known for some time that our progress
in automating the financial markets has made us highly dependent on telecommunications. In our own
discussions within the Federal Reserve and our discussions with others, the issue of
telecommunications circuit diversity is very important. I encourage firms to take this issue seriously
and to discuss it with individual telecommunications providers, industry groups, and appropriate
government officials.
Conclusion
In taking the next steps to strengthen the foundations of our critical financial markets, we need to
constantly remember how dependent we are on one another. We will not accomplish our task if one or
two organizations strengthen their resilience and others do not. Instead, we need to work hard to
adopt consistent strategies to meet regional risks that together address prevention, management, and
testing.
The importance of creating and maintaining a highly resilient financial services sector is self-evident.
Similarly, the challenges to achieving that goal are numerous, involving, as I indicated, people,
business, and technology. Given the importance and complexity of this topic, senior management will
need to become fully engaged.
At the international level, the openness of our financial systems means that the business-continuity
practices in one country can affect critical markets in another. We will therefore need to share
information and sound practices that will help us address regional risks in various countries. At this
stage, this does not necessarily mean traditional regulatory coordination. Rather, private firms and the
financial authorities will need to work together within their various communities and with each other to
make our key business-continuity practices more robust and more consistent.
We also need to recognize that new business-continuity strategies need to be practical. We are
looking forward to receiving the views of market participants and other knowledgeable experts to help
ensure that the final white paper ultimately sets out sound practices that are well grounded and
practical. As we work through these new challenges, however, we must keep in mind that to do
nothing would leave serious risks unaddressed.
I would like to close by noting the importance of our financial centers. These cities are a source of
work, play, and inspiration for millions of people. These cities need to be vibrant and resilient, even as
new challenges arise for security and stability. Our financial policies to address new regional
challenges should be designed to strengthen the resilience of these great centers and their people,
not to abandon them. The regional diversification of back offices and operational sites is intended as a
prudent strategy that will enable financial centers and their markets to continue to serve as robust
sources of economic progress.