Financial services firms must maintain Business Continuity Plans (BCPs) that document Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for all critical systems, test those plans annually, and be able to demonstrate recovery capability to regulators. FINRA Rule 4370 requires broker-dealers to notify FINRA of significant disruptions within 24 hours. Most financial regulators expect RTOs of 4 hours or less for mission-critical systems and RPOs of no more than 24 hours.
What RTO and RPO Mean for Financial Firms
Every disaster recovery plan is built around two numbers:
- RTO (Recovery Time Objective): How long you can be down before it becomes unacceptable. For a broker-dealer during market hours, an RTO of 4+ hours means missed trades, client exposure, and regulatory scrutiny. For an RIA, 24 hours may be tolerable for planning functions but not for client reporting.
- RPO (Recovery Point Objective): How much data you can afford to lose. An RPO of 4 hours means you can lose up to 4 hours of transaction data. For financial firms where every trade and communication must be preserved, RPOs of 1 hour or less are typically required for critical systems.
Your RTO and RPO targets should be set based on actual business and regulatory requirements, not just what's technically easy to achieve. Then your DR infrastructure must actually deliver those targets — which requires regular testing.
FINRA BCP Requirements in Detail
FINRA Rule 4370 requires each member firm to create and maintain a written Business Continuity Plan that addresses ten specific elements:
- Data backup and recovery (both on-site and off-site)
- All mission critical systems
- Financial and operational assessments
- Alternate communications between customers and the firm
- Alternate communications between the firm and its employees
- Alternate physical location of employees
- Critical business constituent, bank, and counterparty impact
- Regulatory reporting
- Customer access to funds and securities during disruption
- Annual review of the plan
FINRA also requires that firms provide customers with a summary of the BCP, including how customers can access their accounts during a disruption. This must be on your website and available upon request.
SEC Business Continuity Requirements for Investment Advisers
Registered investment advisers under Rule 206(4)-7 must adopt policies and procedures that include business continuity provisions. The 2023 cybersecurity rules explicitly added BCP requirements to the written cybersecurity policy requirement. Key elements:
- Succession planning: who operates the firm if a key person is unavailable?
- Customer communications: how will you notify clients of a significant disruption?
- Transfer of assets: can assets be transferred to another adviser if the firm cannot continue operations?
- Backup systems and data: documented recovery procedures for portfolio and CRM systems
Building the IT Infrastructure Behind Your BCP
A BCP document that describes recovery capabilities you don't actually have is worse than not having a plan — it creates liability when you can't deliver what you promised.
IT infrastructure requirements to support a compliant financial services BCP:
- Backup frequency: To achieve a 1-4 hour RPO, you need backup intervals no longer than 1-4 hours. Continuous data protection or hourly snapshots for critical systems.
- Offsite backup: Your backup must be in a different geographic location than your primary systems. Cloud-based backup to Azure, AWS, or purpose-built financial services backup platforms satisfies this.
- Alternate work site: Staff must be able to work from alternate locations — which means cloud-based or VPN-accessible systems, not applications that only run on office servers.
- Backup communications: If your primary internet connection fails, what's the backup? LTE failover routers provide automatic failover for most firms.
- Testing: FINRA examiners ask when you last tested your BCP. Annual testing should include actual data restoration from backup, not just reviewing the plan document.
Testing: What Actually Counts
Annual BCP testing for regulatory purposes should include:
- Tabletop exercise: Walk through specific scenarios (ransomware attack, office fire, key person unavailable) with management and document the discussion and findings
- Technical restoration test: Actually restore a system or database from backup and verify it works. Document the process and outcome.
- Communication test: Verify that emergency contact lists are current and that communication systems (alternate phone, email) work
- Alternate site test: Have staff work from alternate locations (home or secondary office) and verify all critical systems are accessible
Document all tests with dates, participants, findings, and any remediation actions taken. This documentation is what you show FINRA examiners.
Frequently Asked Questions
How often does FINRA require BCP testing?
FINRA Rule 4370 requires an annual review of the BCP. Examiners expect to see documentation of actual tests, not just policy reviews. Most compliance consultants recommend an annual tabletop exercise plus a technical restoration test of backup systems.
Can I use a cloud-only infrastructure for financial services DR?
Yes, and it's often more resilient than on-premise infrastructure. Cloud platforms like Microsoft Azure and AWS offer geographic redundancy, automated failover, and tested backup services. The key is documenting your cloud DR configuration and testing restoration — regulators care about tested capability, not architectural elegance.
What happens if we experience a significant disruption and our BCP fails?
FINRA Rule 4370 requires notification to FINRA within 24 hours of a significant disruption. The SEC has similar requirements under the 2023 cybersecurity rules. Failure to maintain and test a BCP can result in examination findings, fines, and enhanced supervision. The 2012 Hurricane Sandy event led FINRA to significantly strengthen BCP examination focus.