Business Continuity Plan (“BCP”)
Emergency Contact Persons
The firm’s critical vendor contact information as well as employee contact information including cell phone number, home address, and alternate email address are maintained by the firm in a separate document. The firm’s administrative manager will update the emergency contact information as needed, but will confirm on an annual basis at minimum whether the information currently on file is accurate.
Firm’s Policy in Responding to SBDs
The firm’s policy is to respond to any significant business disruption (“SBD”) so as to:
- Safeguard employees’ lives and the firm’s property, including all of the firm’s books and records
- Make a financial and operational assessment
- Quickly recover and resume operations
- Make applicable regulatory filings
- Provide the firm’s clients with the ability to communicate with appropriate investment advisory professionals
The firm’s plan anticipates two kinds of SBDs:
- Internal SBDs affect only the firm’s ability to communicate and do business, such as a fire in one of the buildings where the firm’s personnel are employed.
- External SBDs prevent the operation of a number of firms and/or the securities markets, such as a terrorist attack, natural disaster, or wide-scale, regional disruption such as a power outage. The firm’s response to external SBDs relies more heavily on other organizations and systems’ BCPs because the firm relies on them for business continuity planning, training, and implementation
Approval and Execution Authority
Jason Barsema has the authority to execute this BCP and is responsible for initially approving the firm’s BCP and for conducting a required annual plan review.
Plan Location and Access
The firm will maintain copies of its current BCP, the annual reviews, and records of any changes that have been made to the BCP for inspection. Electronic copies of the firm’s current BCP are stored within the CCO’s files.
Business Description
The firm engages in the purchase and sale of publicly traded equity and fixed income securities, investment banking advisory services, sale of private placement securities, and insurance products including variable annuities.
Office Locations
200 W. Jackson, Suite 1800, Chicago, IL, 60606, is the location of the firm’s corporate headquarters. It maintains copies of all corporate records, all employee registration files, advertising, sales literature, complaints, client engagement contracts, client acceptance paperwork, and similar records.
Electronic records are maintained by the firm’s applicable vendors.
Employees of the firm may travel to their primary office location or client site by means of foot, car, subway, train, bus, boat, or plane.
Alternative Physical Locations of Employees
In the event of an SBD, the firm will allow the affected personnel to work from home so long as they can connect with the firm’s network. If working from home is not an option, the firm will work with neighboring businesses to find adequate workspace for the firm’s staff. The firm maintains a list of available executive suite locations for immediate use as well as available office space where mid-term and long-term space is available.
Clients’ Access to Funds and Securities
The firm does not maintain custody of its clients’ funds or securities. The client has direct access to the custodian and therefore will have no interruption to such access in the unlikely event of Halo Securities inability to conduct or remain in business.
Data Back-Up and Recovery (Hard Copy and Electronic)
The firm maintains its primary hard copy books and records, including legal and regulatory filings and financial records, at its corporate headquarters. Individual client files and certain other files, such as advertising, sales literature, complaints, human resource records, etc., are maintained at the headquarters office location.
Electronic email records are maintained with Global Relay. The firm backs up its electronic records daily by a third-party data warehousing provider. In the event of an internal or external SBD that causes the loss of paper records, the firm will physically recover them from the firm’s back-up site. If the primary site is inoperable, the firm will continue operations from a back-up site or an alternate location. For the loss of electronic records, the firm will either physically recover the storage media or electronically recover data from its back-up site.
Access to Software, Passwords, and User Access Instructions
The firm and its affiliates’ disaster recovery and back-up manager or designee shall store the following information in its headquarters and the offsite location:
- Instructions to access each software program utilized by the firm’s professionals
- List of user names, user IDs, and passwords
- List of authorized administrators (preferably residing in different office locations)
- Bank access and names of authorized individuals who can deal with and otherwise effect transactions with the bank on behalf of the firm and its affiliates
Financial and Operational Assessments
Operational Risk
In the event of an SBD, the firm will immediately identify which means of communication are available for use with its clients, employees, critical business constituents, critical banks, and regulators. The means of communication to be identified as available will include telephone/voice mail, including a special line for clients, employees, and business constituents; facsimile transmission; and communication through the postal service, carrier, or courier as applicable. In addition, the firm will retrieve key activity records as described in the Data Back-Up and Recovery section above.
Financial and Credit Risk
In the event of an SBD, the firm will determine the value and liquidity of its investments and other assets to evaluate its ability to continue to fund operations. The firm will contact its critical banks and investors to apprise them of its financial status. If the firm determines that it may be unable to meet its obligations or otherwise continue to fund operations, it will request additional financing from its bank or other credit sources to fulfill its obligations to its clients. If the firm cannot remedy a capital deficiency, it will take appropriate steps to negotiate with other financing sources, including key service vendors.
Mission Critical Systems
The firm’s “mission critical systems” are those that ensure prompt and accurate processing of financial and accounting data, including data concerning individual engagements, client acceptance, information evidencing compliance with anti-money laundering requirements, and the firm’s email quarantine and archival system.
The firm has sole responsibility for establishing and maintaining business relationships with its clients. The firm will maintain a business continuity plan and the capacity to execute that plan.
The firm backs up its records and stores them at a remote or out-of-region site. The firm has also confirmed the effectiveness of its back-up arrangements by testing to recover from a wide-scale disruption; the firm tests its back-up arrangements periodically.
Recovery-time objectives provide concrete goals to plan for and test against. They are not, however, hard and fast deadlines that must be met in every emergency situation, and various external factors surrounding a disruption, such as time of day, scope of disruption, and status of critical infrastructure—particularly telecommunications—can affect actual recovery times. Recovery refers to the restoration of communication and record retention activities after a wide-scale disruption; resumption refers to the capacity to accept and process new transactions after a wide-scale disruption. The firm’s BCPSP generally has the following SBD recovery time and resumption objectives: recovery time period of 48 hours; resumption time of an additional 24 hours.
Alternate Communications Between the Firm and Its Clients, Employees, and Regulators
Clients
The firm currently communicates with its clients via telephone, email, the firm’s website, facsimile, U.S. mail, and in-person visits at either its offices or at the client’s location. In the event of an SBD, the firm will assess which means of communication are still available and use the means that are most like those that were used in the past to communicate with the client (considering both speed and form). For example, if the firm previously communicated with a client by email but the internet is unavailable as a result of the SBD, the firm’s representatives may opt to call the client and then follow up, where a record is needed, with a paper copy sent via U.S. mail.
Employees
The firm currently communicates with its employees in person and/or by telephone, email, or U.S. mail. In the event of an SBD, the firm will assess which means of communication are still available and use the means that are most like those that were used in the past to communicate with the employees (considering both speed and form). Where telephone communication is still available, the firm will also employ a call tree so that senior management can quickly reach all its personnel and key constituents. Copies of the firm’s employee contact list are regularly updated to include the most recent office, home, and cell phone information for each employee. The contact list is available online to appropriate personnel.
Regulators
The firm is subject to regulation by FINRA, the SEC, and the State of Illinois. The firm communicates with its regulators via telephone, email, fax, U.S. mail, and in person. In the event of an SBD, the firm will assess which means of communication are still available and use the means that are most like those that were used in the past to communicate with the regulator (considering both speed and form).
Critical Business Constituents, Banks, and Counterparties
Business Constituents
The firm has contacted its critical business constituents (businesses with which the firm has an ongoing commercial relationship in support of its operating activities) and determined the extent to which the firm can continue its business relationship with them in light of an internal or external SBD. The firm will quickly establish alternative arrangements if a business constituent can no longer provide the needed goods or services when the firm needs them because of an SBD.
Banks
The firm has contacted its banks and lenders to determine if they can continue to provide the financing that the firm will need in light of an internal or external SBD. The bank maintaining the firm’s operating account is Standard Bank. If the firm’s banks and other lenders are unable to provide financing, the firm will seek alternative financing immediately.
Regulatory Reporting
The firm is subject to regulation by FINRA, the SEC, and the State of Illinois. The firm currently files reports with its regulators electronically via fax, email, and the Internet. In the event of an SBD, the firm will check with its regulators to determine which means of filing are still available to use and will use the means closest in speed and form (written or oral) to previous filing method(s) used. In the event that the firm cannot contact its regulators, the firm will continue to file required reports using the communication means it finds are still available. The firm’s primary regulatory contact currently is the CCO.
Disclosure of Business Continuity Plan – Notices
The firm provides the required notice under FINRA rule 4370 at account opening and on the firm’s website. A copy is attached at Exhibit 3 of this Appendix 19.
Testing of the Plan
No less frequently than annually, the firm shall conduct a test to ensure that its personnel review the following items, to be addressed in your testing memo:
- Current vendors
- System access
- Personnel assignments
- Current identity theft, virus protection, anti-spam, encryption
- Insurance coverage as it relates to risk of data theft and related issues
- Remote access of data and information
- Recovery of data from the prior night’s close of business
- Confirmation of vendor internal testing
- How anomalies are identified and corrected by vendor