Financial Regulators Encourage and Expect Firms to Continue Assisting Businesses During the Coronavirus Pandemic

To help our clients navigate the coronavirus (COVID-19) crisis, Arnold & Porter has established a Coronavirus Task Force covering a wide range of issues and challenges. Subscribe to our "Coronavirus (COVID-19)" mailing list to receive our latest client Advisories and register for upcoming webinars.

I. INTRODUCTION

With the heightened concerns of COVID-19, commonly referred to as the coronavirus, over the past few days, and observations of its impact on the global economy, federal and state financial regulators have issued guidance reminding regulated firms of the need to enhance their business continuity plans to address pandemics, and encouraging firms to continue meeting the financial needs of businesses and other customers that are impacted by the coronavirus. Both federal and state financial regulators have also extended regulatory relief, or indicated a willingness to extend regulatory relief, to regulated entities to reduce burden and minimize disruptions to operations. These actions are in addition to the monetary policy actions of the Board of Governors of the Federal Reserve System (Federal Reserve Board) in trying to avoid liquidity issues in the financial market and maintain the financial stability of the economy.

Below is a high-level summary of the guidance and statements released by several federal and state financial regulators, with links to the relevant agency websites. The key takeaways based on guidance and notices released thus far are also highlighted below. Additional notices and guidance are expected from the regulators and supervisory agencies as further developments related to the impact of the coronavirus on financial services occur. Firms should ensure that they are signed up for alerts from their relevant regulators and supervisory agencies. If additional regulatory relief is needed, firms should communicate any reasonable needs to their regulators and supervisory agencies, considering that the regulators and agencies have indicated a willingness to make additional accommodations on a case-by-case basis.

II. Key Takeaways

• The Federal Financial Institutions Examination Council (FFIEC) has updated its guidance on business continuity planning. A firm's business continuity plan needs to include sections dedicated to pandemic planning and be sufficiently flexible to address widespread issues and potential impacts of a pandemic that are not limited in duration or scope (geography- or industry-wise).
• Unlike business continuity planning that contemplates isolated incidents, natural or man-made disasters, or matters that are limited in duration or scope, pandemic planning requires sufficient flexibility to address widespread impacts from the pandemic that are not necessarily limited in duration or scope. Therefore, pandemic planning needs to be much more fluid and tailored toward the size of the institution as well as the complexity of services and activities of an institution.
• In addition to releasing guidance, the New York Department of Financial Services (NYDFS) is requiring all regulated institutions to submit written responses of assurance to the agency (i) describing the institution's plan of preparedness to manage the risk of disruption of its services operations, and (ii) describing the institution's plan regarding managing the potential financial risk arising from the coronavirus. Under separate guidance, the NYDFS is also requiring institutions engaged in virtual currency business activity to provide a written response of assurance relating to operational and financial risk arising from the coronavirus. Responses are to be submitted as soon as possible, but no later than April 9, 2020.
• Firms should re-evaluate the business continuity plans of critical and key third-party service providers to ensure that the service providers can continue performance during this pandemic. In reviewing the business continuity plan of a service provider, firms should identify any risks that can be mitigated as part of the firm's business continuity plan.
• Firms should communicate to their regulators any potential challenges with meeting on-going or scheduled regulatory obligations (e.g. onsite examinations, responding to information requests, routine reporting obligations, etc.), including any regulatory relief that is needed to mitigate burden on a firm that is not otherwise covered by the guidance. Regulators have indicated a willingness to consider other regulatory relief needs of firms to minimize disruption to business.
• Regulated institutions are expected to maintain safe and sound practices and be flexible but prudent in assisting businesses and other customers impacted by the coronavirus. The Federal Deposit Insurance Corporation (FDIC) and the Office of the Comptroller of the Currency (OCC) have issued guidance including specific examples of the types of accommodations that banks should extend customers during this pandemic. With respect to lending, banks are expected to use reasonable judgment in lending decisions, and modifications of existing loans should be evaluated individually to determine whether they represent troubled debt restructurings.
• For publicly traded financial institutions, the Securities Exchange Commission (SEC) has granted conditional regulatory relief with respect to the deadline for submission of certain routine forms, such as quarterly and annual reports. However, firms are expected to continue disclosing any material risks or issues related to the coronavirus, and insiders are expected to abstain from insider transactions based on material information prior to public disclosure.
• The Financial Industry Regulatory Authority, Inc. (FINRA) has also updated its guidance on business continuity plans for its members and is extending regulatory relief with respect to certain routine disclosures and examinations (e.g., Form U4, continuing education requirements, office applications, routine examinations, etc.). FINRA also encourages its members to communicate any other concerns with regulatory obligations that impact the ability to provide services to customers (e.g., issues that may arise due to staffing issues, or the need for certain staff to work remotely).
• The Financial Crimes Enforcement Network (FinCEN) encourages financial institutions to contact FinCEN and their functional regulator as soon as practicable with concerns about potential delays in the ability to file reports required under the Bank Secrecy Act.FinCEN also cautions financial institutions remain alert about malicious or fraudulent transactions similar to those that occur in the wake of natural disasters.

III. Overview of Guidance and Notices

A. FFIEC Updated Guidance on Business Continuity Plans

On March 6, 2020, the FFIEC, which is comprised of the Federal Reserve Board, the FDIC, the OCC, the National Credit Union Association (NCUA), and the Consumer Financial Protection Bureau (CFPB), updated its guidance related to business continuity planning to include additional considerations related to pandemic planning (FFIEC Guidance) in light of the coronavirus and its anticipated impact on the financial system. The FFIEC Guidance identifies actions that financial institutions should take to minimize the potential adverse effects of a pandemic. Specifically, the guidance (i) explains the difference between traditional business continuity planning and pandemic planning, (ii) highlights the traditional phases of business continuity planning (planning, preparing, responding, and recovering), noting that pandemic planning requires additional actions to identify and prioritize essential functions of employees and resources, and (iii) cites other sources for pandemic planning activities. In summary:

• Business continuity plans should address pandemics and provide for:
  • A preventive program (including monitoring of potential outbreaks, educating employees, providing appropriate hygiene training and tools, and coordinating with critical service providers);
  • A documented strategy that provides for scaling the institution's pandemic efforts to be consistent with the effects of a particular stage of a pandemic outbreak (e.g., Centers for Disease Control and Prevention);
  • A comprehensive framework of facilities, systems, or procedures that provide the firm with the capability to continue its critical operations during staff shortages for prolonged periods;
  • A testing program to ensure that the planning practices and capabilities are effective and will allow critical operations to continue; and
  • An oversight program to ensure ongoing review and updates.
• Pandemic planning differs from typical business continuity planning in that business continuity planning is usually limited to a specific incident, technical disruptions and natural/man-made disasters that typically will only affect a specific geographic area, facility or system, and therefore can be mitigated by focusing on resiliency and recovery considerations. Pandemic planning, on the other hand, should be sufficiently flexible to address a wide range of possible effects that may not be limited in duration or scope, and be reflective of an institution's size, complexity, and business activities.
• The potential impact of a pandemic on the delivery of a financial institution's critical financial services should be incorporated into the ongoing business impact analysis and risk assessment processes.
• The considerations that are part of traditional business continuity planning are also relevant for pandemic planning, including the cyclical process of planning, preparing, responding and recovering, board and senior management responsibilities, business impact analysis, risk assessment/risk management, and risk monitoring and testing.

B. Interagency Statement of Banking Regulators

On March 9, 2020, the federal banking regulators (including the CFPB and the NCUA) and the Conference of State Bank Supervisors issued a press release encouraging financial institutions to meet the financial needs of customers and members affected by coronavirus. To assist in these efforts, the regulators are expected to reduce certain regulatory burdens associated with routine examinations, regulatory filings (e.g., branch and office applications) and for decisions made by institutions with respect to providing banking services. Specifically, the regulators announced that:

• Prudent efforts that are consistent with safe and sound lending practices should not be subject to examiner criticism;
• Regulators will work with affected financial institutions in scheduling exams or inspections to minimize disruption or regulatory burden and will also consider other requests for reasonable regulatory relief; and
• Regulators will expedite, as appropriate, any request to provide more convenient availability of services in affected communities that are necessary due to staffing or other challenges. (e.g., the need to establish temporary offices or branches).

C. Assurances Required by the NYDFS and Efforts at Regulatory Relief

On March 10, 2020, the NYDFS issued three sets of coronavirus guidance for regulated financial institutions, as well as guidance for regulated entities engaged in the virtual currency business in New York. Under the guidance, regulated financial institutions are required to provide NYDFS with written responses of assurances related to potential financial risk to the institution arising from the coronavirus outbreak and the operational preparedness of the institution. Regulated virtual currency businesses are also required to provide written responses of assurances related to operational and financial risk arising from the coronavirus outbreak. Responses are expected to include certain elements, as set forth in the relevant guidance, and all responses are due as soon as possible but no later than April 9, 2020.

Notwithstanding these additional reporting obligations under the NYDFS guidance, NYDFS is aware of the need to minimize regulatory burdens at this time and to minimize disruptions to business. On March 10, 2020, the NYDFS issued guidance for New York state regulated banks, credit unions and licensed lenders regarding supporting businesses impacted by the coronavirus and recommending reasonable accommodations to assist businesses that have been impacted (e.g., easing credit terms for new loans, offering payment accommodations like deferment, changes in due dates and modification of existing terms to avoid delinquencies, and waiving overdraft and late fees). Additionally, on March 12, 2020, the NYDFS issued an order granting temporary regulatory relief for regulated entities with respect to compliance of laws and regulations under New York Banking Law related to office relocations and meetings of boards, trustees and governing bodies of financial institutions. Additionally, the NYDFS has extended the submission deadline for certain reporting obligations of regulated entities and persons by 45 days from the original respective due date, including the certifications of compliance with cybersecurity requirements (excluding notices of a cybersecurity event) and certain annual and quarterly reports. The NYDFS has not extended the deadline for submission of plans to address the cessation of the London Interbank Offered Rate (LIBOR) and related transition risk.

D. Links to Relevant Banking Guidance and Resources

Below are relevant links to the webpages of the federal banking agencies, the CSBS and NYDFS related to continuing operations during the coronavirus Pandemic. The agencies are sending updates on an ongoing basis. Therefore, we highly recommend that financial institutions sign-up for direct alerts from their regulators.

Federal Reserve: Coronavirus Disease 2019 (COVID-19) Resources. 

FDIC: Coronavirus (COVID-19) Information for Bankers and Consumers.

OCC: COVID-19 (Coronavirus).

Conference of State Bank Supervisors: Information on COVID-19 Coronavirus.

NYDFS: Coronavirus: Information for Industry and Regulated Entities.

E. FinCEN and Reporting Obligations Under the Bank Secrecy Act

On March 16, FinCEN issued a release requesting all financial institutions impacted by the coronavirus pandemic to contact FinCEN and their functional regulators as soon as practicable regarding concerns about any potential delays in the ability to file reports required under the Bank Secrecy Act.  FinCEN also cautions financial institutions to remain alert about malicious or fraudulent transactions similar to those that occur in the wake of natural disasters, and identified the following emerging trends based on their monitoring of public reports and Bank Secrecy Act reports of potential illicit behavior connected to the coronavirus, including (i) imposter scams; (ii) investor scams; (iii) product scams; and (iv) insider trading.  FinCEN also directs institutions to its existing advisory, FIN-2017-A007 “Advisory to Financial Institutions Regarding Disaster-Related Fraud” (October 31, 2017), for descriptions of other relevant typologies, such as benefits fraud, charities fraud, and cyber-related fraud.

F. The SEC Extends Regulatory Relief for Publicly Traded Companies

The SEC is providing conditional regulatory relief for certain publicly traded company filing obligations under the federal securities laws. Specifically, the SEC is providing companies impacted by the coronavirus with the ability to request additional time (up to 45 days) to file Form S-3s, Form S-8s, Form 8-Ks and Form 6-Ks. Companies are, however, encouraged to disclose material information related to impacts of the coronavirus on a timely basis and to avoid selective disclosures as well as insider transactions prior to disclosure of material information to the public.

The SEC has also issued guidance allowing for alternatives to complying with federal proxy rules for upcoming annual meetings in light of health, transportation, and other logistical issues raised by the coronavirus. Changes in date, location, or time, as well as "virtual" shareholder meetings (which are governed by state law) are discussed, as well as alternatives for presentation of shareholder proposals by proponents or their representatives in compliance with the Exchange Act.

G. FINRA's Guidance for Registered Firms

Similar to the guidance issued by the federal banking regulators related to pandemic planning and business continuity preparedness, FINRA released a regulatory notice reminding member firms of the need to include pandemic-related considerations in business continuity plans, including plans that are sufficiently flexible to address a wide range of possible effects in the event of a pandemic. The business continuity plan requirements of FINRA members are set out in FINRA's emergency preparedness rule at Rule 4370. The new guidance discusses various aspects of a business continuity plan related to a pandemic, including remote offices and telework arrangements, cybersecurity, extensions to submission deadlines for regulatory filings and responses to FINRA inquiries, matters, and investigations, emergency office relocations, military personnel and national guard protections, and qualification examinations and continuing education.

Similar to the other financial regulators, FINRA is extending regulatory relief to member firms from certain requirements, including suspending the requirement to maintain updated Form U4 information related to offices of employee address for registered persons, as well as branch office applications for any newly opened temporary office locations or space-sharing arrangements. FINRA is also willing to provide member firms with extra time to respond to open inquiries, investigations or upcoming filings, and may waive any late fees incurred by a member firm based on the member firm's particular circumstance. Additionally, any affected person who has a qualifications examination or continuing education window that is expiring may contact FINRA to request an extension. FINRA's webpage, which includes all related FINRA guidance, notices and rules related to operations during the coronavirus epidemic, may be found here.

*********

Financial institutions or others that have questions about these initiatives or about business continuity planning generally are encouraged to contact any of the authors or your Arnold & Porter contact. The firm's Financial Services group would be pleased to assist with any questions you may have.

© Arnold & Porter Kaye Scholer LLP 2020 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.