Potential Terrorist Attacks: Additional Actions Needed to Better Prepare Critical Financial Market Participants

In April 2003, SEC and other federal financial regulators issued the Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System. The paper established goals and practices for the resumption of trading after a disruption for key clearing and settlement organizations. In addition, in September 2003, SEC issued a policy statement that established recovery goals and business continuity guidelines for securities exchanges and ECNs.

In April 2003, SEC and other federal financial regulators issued the Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System. The paper established goals and practices for the resumption of trading after a disruption for key clearing and settlement organizations. In addition, in September 2003, SEC issued a policy statement that established recovery goals and business continuity guidelines for securities exchanges and ECNs. If organizations follow the guidelines in the interagency paper and the policy statement, they should be able to meet the relevant trading resumption goals.

In April of 2003, SEC and the banking regulators issued the "Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System." The Paper identifies business continuity practices and recovery goals for key clearing and settlement organizations. In September 2003, SEC issued a policy statement that establishes business continuity principles to be followed by securities exchanges and electronic clearing networks. Finally, in April 2004, SEC approved essentially identical rules from NASD and NYSE that require their members to develop business continuity plans that address various elements, including data backup and recovery as well as alternate means of communication with customers. While these rules do not require trading firms to actually have plans to resume operating or trading activities after a disaster, they do require broker-dealers to develop procedures to ensure that they promptly could provide customers with access to their funds and securities if the broker-dealers were unable to continue business operations.

To assure that trading in U.S. financial markets can resume after future disruptions in as timely a manner as appropriate, we recommended that SEC work with industry to test trading resumption strategies. SEC essentially delegated industry-wide testing to the Securities Industry Association (SIA). SIA, together with the Bond Market Association, the Futures Industry Association and the Financial Information Forum led a test on October 14, 2006, the second year for this industry-wide effort. More than 250 organizations, including broker-dealers, markets, service bureaus, and industry utilities participated, with test participants representing more than 80 percent of normal market volume. In addition, new test components were added to the 2006 test, such as money markets and payment system processors. Test results showed a 95 percent success rate overall for successful test connections. SIA officials told us that such tests will continue, on an annual basis, providing assurance that securities market participants can perform critical activities in the event of a disaster.

SEC Market Regulation Division staff told us that they are confident they will obtain approval of a rule that will make adherence to the ARP program mandatory for affected organizations the end of 2007. SEC staff told us they are exploring the possibility of recasting the current draft rule as a principles-based one rather than one that is a more specific rule and are travelling to the United Kingdom in September to learn how best to administer such rules. Their plan is to submit the revised rule, which will only require minor change to become more principles oriented, to the SEC Commissioners for approval and issuance by year end.

As documented in the GAO accomplishment report system for the duplicate report on this engagement (GAO-03-251), at that time, SEC hired two staff with MBAs and IT operational experience and is in the process of hiring an additional MBA with IT experience. Since then, as documented in GAO-06-2424A four more staff were hired for ARP.