WELLS NELSON & ASSOCIATES, LLC Business Continuity Plan and Contingency Planning v.3 Last updated 12/16/2008 Last updated 01/15/2009 Last updated

Transcription

1 WELLS NELSON & ASSOCIATES, LLC Business Continuity Plan and Contingency Planning v.3 Last updated 12/16/2008 Last updated 01/15/2009 Last updated 05/28/2009 Last updated 03/15/2010 Last Updated 05/27/2010 Last Updated 03/07/2011

2 1.0 - Introduction Planning for the business continuity of in the aftermath of a disaster is a complex task. Preparation for, response to, and recovery from a disaster affecting the administrative and operational functions of the firm requires the cooperative efforts of different internal and external personnel. This document records the Plan that outlines and coordinates these efforts, reflecting the analyses by the firm s Business Continuity Management Team (BCMT) (See Exhibit A for list of BCMT personnel). For use in the event of a disaster, this document identifies key operational and document control systems and key decisions that should be implemented in the case of a Significant Business Disruption (SBD) Firm Policy In the event of a SBD it is the policy of to react quickly and efficiently and according to pre-tested and pre-planned procedures to ensure the safety of our employees, associates, customers, as well as critical operational and account data. We will provide information to employees, associates and clients both pre and post SBD to ensure operations are run as smooth as possible during this critical time How To Use This Document Use this document to learn about the issues involved in planning for the continuity of the critical and essential business functions at as a checklist of preparation tasks, for training personnel, and for recovering from a SBD Definitions Business Continuity Plan (BCP) The primary objective of this Business Continuity Plan (BCP) is to enable the Firm to survive a disaster and to re-establish normal business operations. In order to survive, the Firm must assure that critical operations can resume normal processing within a reasonable time frame. Significant Business Disruption (SBD) Our firm s business continuity plan covers three types of disruptions: Firm Disruptions (FD) - Includes but is not limited to firm disruptions such as a building fire, a building power outage, computer or network malfunction or virus infection disruption or disconnection of telephone services. Local Disruptions (LD) - Includes but is not limited to local disruptions such as regional floods, fire, terrorist attack, earthquake, tornado, hurricane, chemical spill or regional power, telephone or internet outages. Regional Disruptions (RD) - Includes but is not limited to regional disruptions such as power grid failure or regionally affected natural disaster or terrorist attack. Mission Critical Systems For purposes of Rule 3510, FINRA defines "mission critical system" as "any system that is necessary, depending on the nature of a member's business, to ensure prompt and accurate processing of securities transactions, including, but not limited to, order taking, order entry, execution, comparison, allocation, clearance and settlement of securities transactions, the maintenance of customer accounts, access to customer accounts and the delivery of funds and securities." This definition is substantially similar to the SEC's definition of "mission critical system" in its Y2K Rules Distribution As the written record of the firm s Business Continuity Plan, this document is distributed to each member of the Business Continuity Management Team (BCMT). Additionally a copy of this plan will be located at each Office, OSJ, Non-OSJ and satellite branch locations listed in Exhibit B of this document. The firm s BCP master document is located at the firm s headquarters. We will make available this plan to FINRA Staff promptly upon request. An electronic copy of our plan is located on the firm s server wellsnelson/wna/bcp and at the firm s Service Bureau Securities Compliance Advisors, LLC located at 8105 NW 8 th Street, Oklahoma City, Oklahoma

3 1.5 - Testing, Updating and Training All updates are made with the approval and recommendation of the BCMT. Once approved it is the responsibility of the CSO to distribute the updated copies of the BCP to each branch location Approval BCP Authority The CSO is responsible for training, reviewing and at least a testing of and approval of the BCP. In the event that the CSO cannot fulfill these responsibilities, the ASO has the responsibility to execute the above duties on behalf of the firm and is to be fully involved in all aspects of the BCP planning, training and execution of the plan Maintenance Ensuring that the Plan reflects ongoing changes to resources is crucial. This task includes updating the Plan and revising this document to reflect updates; testing the updated Plan; and training personnel. The Business Continuity Management Team is responsible for this comprehensive maintenance task Testing Testing the Business Continuity Plan is an essential element of preparedness. Partial tests of individual components and recovery plans will be conducted on at least a quarterly basis. A comprehensive exercise of our continuity capabilities and support by our designated recovery facilities will be performed on an annual basis. Exhibit C is a record of both individual component and full Plan testing results and recommendations made by the BCMT. Quarterly, the Business Continuity Management Team ensures that the selected components of the Plan undergo a review and the BCMT will confirm the incorporation of all changes since the prior quarter. Annually, the Business Continuity Management Team initiates a complete review of the Plan, which could result in major revisions to this document. These revisions will be distributed to all authorized personnel, who exchange their old plans for the newly revised plans. At that time the Coordinators will provide an annual status report on continuity planning to the Administrative Computing Steering Committee Training Training on the BCP will be done by the CSO at least annually and given at the firm s annual compliance meeting. As significant changes occur in the plan the CSO will hold separate training meetings as needed Key Business Information & Critical Systems Business Description Our firm conducts business primarily in fixed income securities. Our firm is an introducing firm and does not perform any type of clearing function for itself or others. Furthermore, we do not hold customer funds or securities. We accept and enter orders. All transactions are sent to our clearing firm, which executes our orders, compares them, allocates them, clears and settles them. Our clearing firm also maintains our customers accounts, can grant customers access to them, and delivers funds and securities. Our firm services both retail customers and institutional customers Clearing Firm Our clearing firm is First Southwest Company. Review Exhibit G for contact information Office Locations See Exhibit B for our firm s office locations. 3

4 2.4 - Alternative Physical Location(s) of Employees See Exhibit B for our firm s alternative physical locations Customer Access to Funds and Securities Our firm does not maintain custody of customers funds or securities, which are maintained at our clearing firm, First Southwest Company. In the event of an internal or external SBD, if telephone service is available, our registered persons will take customer orders or instructions and contact our clearing firm on their behalf. The firm will make this information available to customers through its disclosure policy. If SIPC determines that we are unable to meet our obligations to our customers or if our liabilities exceed our assets in violation of Securities Exchange Act Rule 15c3-1, SIPC may seek to appoint a trustee to disburse our assets to customers. We will assist SIPC and the trustee by providing our books and records identifying customer accounts subject to SIPC regulation Data Back-Up and Recovery (Hard Copy and Electronic) Our firm maintains its primary hard copy books and records and its electronic records at our main office identified in Exhibit B. Edward Franklin Wells is responsible for the maintenance of these books and records. See Exhibit E for firm s mission critical documents and forms. The firm backs up its mission critical documents daily by using tape backup and keeps a copy at 1758 Lionsgate Circle Bethany, OK In the event of an internal or external SBD that causes the loss of our mission critical documents, we will either physically recover the storage media or electronically recover data from our back-up site. If our primary site is inoperable, we will continue operations from our back-up site or an alternate location Financial and Operational Assessments Operational Risk In the event of an SBD, we will immediately identify what means will permit us to communicate with our customers, employees, critical business constituents, critical banks, critical counter-parties, and regulators. Although the effects of an SBD will determine the means of alternative communication, the communications options we will employ will include our firm s telephone voice mail, cell-phone, , etc. In addition, we will retrieve our business records as described in the section 2.6 above. (Data Back-up and Recovery) Financial and Credit Risk In the event of an SBD, we will determine the value and liquidity of our investments and other assets to evaluate our ability to continue to fund our operations and remain in capital compliance. We will contact our critical banks and existing clients to apprise them of our financial status. If we determine that we may be unable to meet our obligations to our existing clients or otherwise continue to fund our operations, we will request additional financing from our bank or other credit sources to fulfill our obligations to our customers and clients. If we cannot remedy a capital deficiency, we will file appropriate notices with our regulators and immediately take appropriate steps Mission Critical Systems Our firm s mission critical systems are those that ensure prompt communication with our clients and their representatives Mission Critical Communication Methods The following are our firm s mission critical communication methods: Telephone; Fax; ; and 4

5 The ability to access the internet. Recovery-time objectives provide concrete goals to plan for and test against. They are not, however, hard and fast deadlines that must be met in every emergency situation, and various external factors surrounding a disruption, such as time of day, scope of disruption, and status of critical infrastructure particularly telecommunications can affect actual recovery times Mission Critical Systems Our firm s mission critical systems are those that ensure prompt and accurate processing of securities transactions, including order taking, entry, execution, comparison, allocation, clearance and settlement of securities transactions, the maintenance of customer accounts, access to customer accounts, and the delivery of funds and securities. More specifically, these systems include: ADP/SIS (Securities Industry Software). This system is through our clearing firm First Southwest Company via VPN which allows our firm to enter equity, municipal and corporate trades. We have primary responsibility for establishing and maintaining our business relationships with our customers and have sole responsibility for our mission critical functions of order taking [and] entry [and execution]. Our clearing firm provides, through contract, the execution, comparison, allocation, clearance and settlement of securities transactions, the maintenance of customer accounts, access to customer accounts, and the delivery of funds and securities. Our clearing firm contract provides that our clearing firm will maintain a business continuity plan and the capacity to execute that plan. Our clearing firm represents that it will advise us of any material changes to its plan that might affect our ability to maintain our business [and presented us with an executive summary of its plan, which is attached]. In the event our clearing firm executes its plan, it represents that it will notify us of such execution and provides us equal access to services as its other customers. If we reasonably determine that our clearing firm has not or cannot put its plan in place quickly enough to meet our needs, or is otherwise unable to provide access to such services, our clearing firm represents that it will assist us in seeking services from an alternative source. Our clearing firm represents that it backs up our records at a remote site. Our clearing firm represents that it operates a back-up operating facility in a geographically separate area with the capability to conduct the same volume of business as its primary site. Our clearing firm has also confirmed the effectiveness of its back-up arrangements to recover from a wide scale disruption by testing. Recovery-time objectives provide concrete goals to plan for and test against. They are not, however, hard and fast deadlines that must be met in every emergency situation, and various external factors surrounding a disruption, such as time of day, scope of disruption, and status of critical infrastructure particularly telecommunications can affect actual recovery times. Recovery refers to the restoration of clearing and settlement activities after a wide-scale disruption; resumption refers to the capacity to accept and process new transactions and payments after a wide-scale disruption Firm s Mission Critical Systems Order Taking Currently, our firm receives orders from customers via telephone or in personal visits by the customer. During an SBD, either internal or external, we will take orders via telephone, and in addition, as communications permit, we will inform our customers when communications become available to tell them what alternatives they have to send their orders to us. Customers will be informed of alternatives by website, fax or telephone. If necessary, we will advise our customers to place orders directly with our clearing firm First Southwest at (800) Order Entry Currently, our firm enters orders by recording them on paper and electronically and sending them to our clearing firm electronically or telephonically. We place customer orders through ADP/SIS (Securities Industry Software). 5

6 In the event of an internal SBD, we will enter and send records to our clearing firm by the fastest alternative means available, which include telephone and facsimile. In the event of an external SBD, we will maintain the order in electronic or paper format, and deliver the order to the clearing firm by the fastest means available when it resumes operations. In addition, during an internal SBD, we may need to refer our customers to deal directly with our clearing firm for order entry Order Execution We currently execute orders by ADP/SIS through VPN with First Southwest Company. In the event of an internal SBD, we would fax or call in our trades to First Southwest Company Mission Critical Systems Provided by Our Clearing Firm Our firm relies, by contract, on our clearing firm to provide order execution, order comparison, order allocation, and the maintenance of customer accounts, delivery of funds and securities, and access to customer accounts Alternate Communications between the Firm, Customers, Employees, and Regulators Customers We now communicate with our customers using the telephone, , fax, U.S. mail, and personal visits at our firm or at the other s locations. In the event of an SBD, we will assess which means of communication are still available to us, and use the means closest in speed and form (written or oral) to the means that we have used in the past to communicate with the other party. For example, if we have communicated with a party by but the Internet is unavailable, we will call them on the telephone and follow up where a record is needed with paper copy through the U.S. mail Employees We now communicate with our employees using the telephone, , and in person. In the event of an SBD, we will assess which means of communication are still available to us, and use the means closest in speed and form (written or oral) to the means that we have used in the past to communicate with the other party. We will also employ a call tree so that senior management can reach all employees quickly during an SBD. The call tree includes all staff home and office phone numbers. The call tree is located via internet access at smarsh.com. We have identified persons, noted below, who live near each other and may reach each other in person: The person to invoke use of the call tree is: Edward F. Wells Caller Edward F. Wells Office: Home: Cell: Call Recipients Dwight VonFeldt Office: Home: Cell: Mark VonFeldt Office: Home: Cell: Keith McDonald Office: Home: Cell:

7 Ken Bonds Office: Home: Cell: Brett McDonald Office: Cell: James Lisle Office: Home: Cell: James Barnes Office: Home: Cell: Jack Thompson Office: Home: Cell: David F. Aboud Office: Home: Cell: Mary Andrews Office: Home: Cell: Larry Edzards Office: Home: Cell: Caller Joyce SandersOffice: Home: Cell: Call Recipients Loralann Brennan Office: Home: Cell: Steven Perry Office: Home: Cell: Colin Wagner Office: Home: Cell:

8 James Britton Office: Home: Cell: Craig Cunningham Office: Home: Cell: Lesa Huff Office: Home: Cell: Randall Nelson Office: Home: Cell: Sheila Visconti Office: Home: Cell: Michael Kellner Office: Home: Cell: Regulators We are currently members of the following SROs: The Financial Industry Regulatory Authority, Inc. We communicate with our regulators using the telephone, , fax, U.S. mail, and in person. In the event of an SBD, we will assess which means of communication are still available to us, and use the means closest in speed and form (written or oral) to the means that we have used in the past to communicate with the other party Critical Business Constituents, Banks, and Counter-Parties Business constituents We have contacted our critical business constituents (businesses with which we have an ongoing commercial relationship in support of our operating activities, such as vendors providing us critical services), and determined the extent to which we can continue our business relationship with them in light of the internal or external SBD. We will quickly establish alternative arrangements if a business constituent can no longer provide the needed goods or services when we need them because of a SBD to them or our firm. Our major suppliers are: Internet: Logix Communications ; Telephone: Logix Communications: Greaves Communications: (pager) (mobile) (Telephone Equipment Vendor) 8

9 Boomberg: A/C (OK) and (AR) S/N SID Banks We have contacted our banks and lenders to determine if they can continue to provide the financing that we will need in light of the internal or external SBD. The banks maintaining our operating accounts are: Stillwater National Bank & Trust Company,6305 Waterford, Suite 205,Oklahoma City, OK 73118, (405) , Contact: Johnson Hightower Counter-Parties The clearing company maintaining our Proprietary Account of Introducing Brokers/Dealers (PAIB account) is: First Southwest Company,325 N. St. Paul Street, Suite 800,Dallas, TX (800) , Contact: John Muschalek Regulatory Reporting Our firm is subject to regulation by: SEC, FINRA and various state securities Departments. We now file reports with our regulators using paper copies in the U.S. mail, and electronically using fax, , and the Internet. In the event of an SBD, we will check with the SEC, FINRA, and other regulators to determine which means of filing are still available to us, and use the means closest in speed and form (written or oral) to our previous filing method. In the event that we cannot contact our regulators, we will continue to file required reports using the communication means available to us. See Exhibit F for Regulator contact information Disclosure of Business Continuity Plan We disclose in writing a summary of our BCP to customers at account opening We also post the summary on our Web site and mail it to customers upon request. Our summary addresses the possibility of a future SBD and how we plan to respond to events of varying scope Updates and Annual Review Our firm will update this plan whenever we have a material change to our operations, structure, business or location. In addition, our firm will review this BCP annually in January of each year, and modify it for any changes in our operations, structure, business, or location SBD Event Plan In the event of a SBD the following plan will be followed: 1. If a Significant Business Disruption event causes the evacuation of our facility at Two Leadership Square, 211 N. Robinson, Suite 1600, Oklahoma City, OK Wells Nelson will declare a business continuity event, and activate the business continuity plan. Wells staff and associates will be relocated to our secondary address located at 401 S. Boston, Suite 2520, Tulsa OK The Business Continuity Management Team (BCMT) will begin a program to contact current clients, regulators, banks, and business constituents via , telephone, fax to provide instructions and important 9

10 contact information depending on the availability of the communications. This is based on the severity and type of SBD. 3. Wells Nelson s BCMT will ensure responses are implemented correctly Communications with Customers Outbound Communications Wells Nelson s BCMT will contact customers with information or instructions Inbound Communications It is the expectation that customers first contact the firm using the existing communication channels with Wells Nelson. If the existing communications fail, the customer should follow the contact instructions in the SBD Client Disclosure Form Data Security Wells Nelson produces and stores paper and/or tape back-up copies of all relevant access data and programs so that in the event that the security access files or programs are destroyed or corrupted due to an event, they can be quickly reconstructed in accordance with Securities and Exchange Commission regulations. In addition, all s are backed up in accordance with SEC Rule 17a-4 in an off-site location using a third party vendor. s can be easily accessed through the Smarsh Inc. Web access located at This web access will also be used as a back-up server if power is lost to the firm s mail server Physical Security Access If there is a security system failure at Wells Nelson s facilities due to an event, we will implement the following guidelines: Only Wells Nelson associates and authorized vendor support personnel will be allowed access. All access will be monitored. Any access required by associates, vendors, and consultants must be approved by the senior management. Vendors that must be on-site in order to perform any required maintenance or repairs must be accompanied by a Wells Nelson associate Senior Manager Approval I have approved this Business Continuity Plan as reasonably designed to enable our firm to meet its obligations to customers in the event of an SBD. Signed: Title: Date: 10

11 Business Continuity Management Team (BCMT) Exhibit A Name Title with the Firm Location Phone Date of BCMT Membership Edward F. Wells President/CSO Home /10/2004 Randall Nelson Assistant Supervisory Tulsa /10/2004 Officer (ASO) Home Office and Branch Locations List Location Address Two Leadership Square, 211 N. Robinson, Suite 1600,Oklahoma City, OK Phone Number Branch Manager Orders Taken at OSJ, Non-OSJ, this location (Yes/ or Satellite Office No) (405) N/A Home Office Yes 11 Exhibit B Transport Method Car, City Bus, Plane

12 401 S. Boston, Suite 2520, Tulsa, OK Dallas Parkway, Suite 240, Dallas, TX Andover Ct., Suite 580, Little Rock, AR (918) (972) (501) Randall Nelson Randall Nelson Randall Nelson OSJ Non-OSJ Non-OSJ No No No Car, City Bus, Plane Car, City Bus, Plane Car, Plane Alternative Location List Location Address Phone Number Fax Number 401 S. Boston, Suite 2520, Tulsa, OK (918) (918) Plan Review and Results Date Plan Reviewed Results of Review 04/05/2005 back-up and archiving Implemented new system using Frontbridge, a third party vendor. s are now backed up off site in accordance with SEC 17a-4. Also used the Frontbridge Web Access as a separate mail server for our firm in case of a power failure at our site. Exhibit C BCMT Signatory 04/05/2005 Call Tree Input call tree information on the Frontbridge Web Access site so that the call tree information can be accessed securely from any computer with internet access. 12/01/2008 back-up and archiving Changed system from Frontbridge to Smarsh, a third party vendor. s are still backed up off site in accordance with SEC 17a-4. Also use the Smarsh Web Access as a separate mail server for our firm in case of a power failure at our site. 03/15/2010 Various Changes Updated Call Tree, Backup location of data and added RI to state regulators. 05/27/2010 Various Changes Updated Call Tree; added telephone vendor mobile number and Updated Bloomberg account numbers for OK and AR offices. 12

13 03/07/2011 Address Change Update Main Office Address Emergency Contact Persons Exhibit D The below listed person are the emergency contacts for per FINRA Rule 3520: Contact Name Phone Alternate Alternative Phone Edward F. Wells ewells@wellsnelson.com beth1ed2@yahoo.com Randall Nelson rnelson@wellsnelson.com Knelson7@cox.net The above names will be updated as changes occur, and the firm s CSO will review them within 17 business days of the end of each quarter via the FINRA Contact System (NSC) located via the web at regulationformfiling.finra.com/contacts/ncs_contacts.aspx. 13

14 Mission Critical Documents List Operational: Order Tickets Written Customer Instructions Cash and Securities Received and Forwarded Blotters Exhibit E Regulatory: Financial Statements Net Capital Computations 14

15 Regulator Contact Information FINRA District Poydras Street Suite 850, Energy Centre New Orleans, LA (504) Fax: (504) Exhibit F State Regulators Oklahoma (State of Domicile) Physical Address: Oklahoma Division of Securities Suite 860, First National Center 120 N. Robinson, Oklahoma City, OK Phone: (405) Alabama or (334) Oklahoma (405) Arkansas- (501) Pennsylvania - (717) Rhode Island - (401) Arizona- (602) Tennessee - (615) California - (866) Texas - (512) Colorado - (303) Utah - (801) Connecticut - (860) Virginia - (804) Florida- (850) Wyoming- (307) Georgia - (404) Iowa- (515) Illinois - (217) Indiana - (317) Kansas- (785) Kentucky- (502) Louisiana (225) Maryland - (410) Massachusetts - (617) Michigan- (517) Minnesota - (651) Mississippi - ( Missouri- (573) North Carolina- (919) North Dakota- (701)

16 New Jersey - (973) New Mexico - (505) New York - (212) Ohio (614) Clearing Firm Contact Information Main Contact Information Exhibit G Name Address Phone Website First Southwest Company 325 N. St. Paul Street, Suite 800, Dallas, TX Alternative Contact Information jmuschalek@firstsw.com Name Address Phone Website First Southwest Company 1021 Main Street, Suite jmuschalek@firstsw.com , Houston, TX

17 BCP Client Disclosure and Acknowledgement Date: 08/10/2004 Subject: Business Continuity Plans FINRA Rule 3510 Effective Date: 09/10/2004 Purpose of this disclosure The FINRA recently adopted business continuity rules (FINRA 3510). The rule requires all FINRA member firms to create and maintain written business continuity and contingency plan and procedures relating to an emergency or significant business disruption ( SBD ) Firm Policy In the event of a SBD it is the policy of to react quickly and efficiently and according to pre-tested and pre-planned procedures to ensure the safety of our employees, associates, customers, as well as critical operational and account data. We will provide information to employees, associates and clients both pre and post SBD to ensure operations are run as smooth as possible during this critical time. Significant Business Disruption (SBD) Definitions: Our firm s business continuity plan covers three types of disruptions: Firm Disruptions (FD) - Includes but are not limited to firm disruptions such as a building fire, a building power outage, computer or network malfunction or virus infection disruption or disconnection of telephone services. Local Disruptions (LD) - Includes but not limited to local disruptions such as regional floods, fire, terrorist attack, earthquake, tornado, hurricane, chemical spill or regional power, telephone or internet outages. Regional Disruptions (RD) - Includes but not limited to regional disruptions such as power grid failure or regionally affected natural disaster or terrorist attack. FD In the event of a FD, clients can call our alternative location at (918) for information and instructions. Under this scenario, Wells Nelson will plan to continue doing business under this scenario with a period of two hours of the FD. LD In the event of a LD, clients can call our alternative location at (918) or if the secondary location is effected by the LD, clients can call Securities Compliance Advisors at (405) for information and instructions. Under this scenario, Wells Nelson will close operations and inform our clients via phone, or website our recovery time. 17

18 RD In the event of a RD, clients can call our alternative location at (918) or if the secondary location is effected by the RD, clients can call Securities Compliance Advisors at (405) for information and instructions. Data Back-up backs up its critical information and stores this information at a designated off-site location in the event of a destruction of critical documents caused during a SBD. Plan review and updates This Business Continuity Plan is subject to change and is modified and tested at least annually for updates and revisions. An updated and current copy of this summary is posted and can be viewed at Clients can also request this document by calling the firm and a copy will be mailed via U.S mail to the client. 18