IIROC has scheduled the next biennial industry business continuity planning (BCP) test for Saturday October 23, 2021. As with the previous IIROC-sponsored industry BCP test in 2019, the test date coincides with industry test dates in the United States to facilitate participation by market participants who have operations in both the Canadian and American markets. The 2021 industry BCP test is comprised of three elements:
Incident Response Plan (IRP) exercise mandatory for all test participants
Crises Communication Centre exercise mandatory for all test participants
Simulated Trading exercise mandatory for IIROC Dealer Members who are “participant dealers” above a specific trading threshold.
The 2021 industry BCP test is conducted in accordance with section 12.4.1 of National Instrument 21-101 Marketplace Operation (NI 21-101) which states:
- “A marketplace, recognized clearing agency, information processor, and participant dealer must participate in all industry-wide business continuity tests, as determined by a regulation services provider, regulator, or in Québec, the securities regulatory authority.”
This requirement and its implementation through IIROC’s biennial industry BCP test reflect the fact that it is critically important for stakeholders to adequately test BCP policies and procedures (including IRPs) that are reasonably designed to ensure the provision of key services and prompt client access to their assets. The industry BCP test also complements IIROC Rule 17.16, which requires every Dealer Member to establish and maintain a business continuity plan identifying the necessary procedures to be undertaken during an emergency or significant business disruption. Every Dealer Member must also conduct an annual review and test of its BCP, and provide an annual CEO certification to IIROC addressing their BCP and compliance with IIROC rules.
Incident Response Plan Exercise
The 2021 industry BCP test will include a new market disruption simulation component so that all participants may test and assess whether their IRPs and protocols are up-to-date and effective. This new component of the test will be developed with the Canadian Securities Administrators and structured as a hands-on simulation based scenario and incident response plan exercise.
The purpose of the incident response plan exercise is for all test participants to gain insights into:
the adequacy of their IRPs under a simulated industry-wide market disruption event
the efficiency and effectiveness of the coordination and communication within and between organizations and regulators
opportunities to improve their IRPs.
Participants of the incident response plan exercise should ideally be members of their organization’s incident response team and/or crisis management team. Participants may include operations, legal and risk personnel, management or other staff well positioned to respond to a market disruption event. In addition to Dealer Member participants, the CSA and IIROC intend to include participants from marketplaces, clearing agencies and regulatory bodies in the incident response plan exercise.
Simulated Trading Exercise and Crises Communication Centre Exercise
The test scenario for these two elements of 2021 BCP test is for IIROC Dealer Member participants to test out of their production/primary data processing sites while the service provider participants will be testing out of their disaster recovery (DR) data processing sites.
IIROC Dealer Members that are “participant dealers” and other market participants subject to section 12.4.1 of National Instrument 21-101 Marketplace Operation (NI 21-101) are required to participate in the 2021 BCP test. A listing of IIROC Dealer Members that are participant dealers as of September 2020 is available in English here and in French here.
IIROC’s Financial and Operations Advisory Section’s Contingency Planning Subcommittee developed the following criteria to ensure participation by those firms that it reasonably determined are, taken as a whole, the minimum necessary for the maintenance of fair and orderly markets in the event of a significant business disruption affecting the Canadian markets:
participant dealers who are IIROC Dealer Members with trading volumes above 1 billion net trades/year in FY 2020 will be required to process test scripts to simulate trading activity, and also to participate in the concurrent testing of IIROC’s Crisis Communication Centre (CCC)
participant dealers who are IIROC Dealer Members with trading volumes below the 1 billion net trades/year threshold in FY 2020 will be required to participate in the CCC test and may elect to process test scripts to simulate trading activity.
IIROC staff expect to contact all IIROC Dealer Members in January 2021 to confirm their level of participation in the 2021 industry BCP test. To safeguard potentially sensitive information regarding trading activity, IIROC will notify participant dealers subject to NI 21-101 who meet the trading volume threshold on an individual basis. IIROC Dealer Members who are not “participant dealers” subject to NI 21-101 are invited to voluntarily participate in the 2021 industry BCP test.
All test participants are required to report their results to IIROC so we may evaluate the efficacy of the test and identify issues to consider in future test cycles.
IIROC thanks our Dealer Members and other key test participants including the exchanges, service providers and other market participants, in advance for their valued cooperation with respect to this important undertaking. The 2021 industry BCP test represents an opportunity for the Canadian capital markets community to demonstrate its ability to recover from a significant disruptive event and test IRPs.
IIROC will form an industry Working Group in early 2021 to oversee the preparation for the test.