BofA Securities, Inc. (“BofAS”) governs its business Continuity and Disaster Recovery Program through an established and documented Corporate Policy which is approved annually by the Board of Directors. BofAS and its affiliates, recognize the importance of protecting its employees, customers, and clients though industry-leading business continuity and disaster recovery management. BofAS has implemented business continuity and disaster recovery practices that enable critical business functions, technology, infrastructure, and architecture that support and deliver those functions to be defined, tested, maintained, and rapidly recovered in the event of an actual business interruption. The Business Continuity and Disaster Recovery Policy establish minimum requirements reasonably designed to maintain the availability of business functions in the event of a business interruption.
Business Continuity Management
Scope
The foundation of the Business Continuity and Disaster Recovery Program focuses on the ability to assess enterprise readiness, account for employees, and assemble leaders to execute their business continuity plans to provide uninterrupted service to customers and clients by recovering critical business functions and applications.
The business continuity program balances reasonable assessments of risk, with the highest priority placed on the physical safety and security of our customers and employees, while preparing for loss of facilities and technologies. Our long history of resilience during past disruptive events, from local occurrences, such as power outages, through larger events such as hurricanes and tsunamis, demonstrates both our commitment to excellence and our ability to deliver on that commitment.
Alternative Business Locations
As part of its commitment to providing uninterrupted service to customers and clients, BofAS extensive business continuity plans include geographically dispersed backup facilities and other recovery locations for critical business processes including, off-site command centers to direct recovery activities.
Access to Funds and Securities
With regard to client assets, nearly all market-traded securities are held in central depositories (such as the Depository Trust Co. in the U.S.) or with custodian banks, rather than in physical certificates. Ownership of the securities is reflected on a book-entry record-keeping basis with our custodian banks or depositories’ participants (such as BofAS) maintaining on their records the beneficial ownership positions of their customers. This structure is recognized worldwide as providing investors with an unsurpassed level of liquidity and security for the assets they choose to custody with major financial institutions. With respect to the critical systems that operate payment disbursements, those systems are supported for contingency processing in our recovery plans.
Processes – both automated and manual – are in place to meet client’s needs.
Technology, Data Backup and Recovery
BofAS has major data centers located across the globe, which include company owned and vendor managed facilities. An extensive array of advanced recovery technologies is employed to ensure that recovery can be accomplished within agreed-upon recovery time objectives. Critical customer data and application services are backed up electronically and to physical tapes, and intra-day transaction are recorded to allow recovery to the point of a disaster. Tests of the recovery plans are conducted regularly for all mainframe systems.
BofAS utilizes a variety of midrange/client server systems located throughout the enterprise. Recovery solutions are driven by the business functions supported by each system and recovery plans are scaled to both the individual system and the entire data center in which hardware resides.
Assessments
- Operational Risk: Our Business Continuity Plans address BofAS’ ability to maintain communications with clients and to retrieve key activity records through its mission critical systems.
- Financial and Credit Risk: Our Business Continuity Plans address the firm’s ability to fund operation sand maintain adequate financing and sufficient capital.
- All functions and supporting technologies are included in a comprehensive testing program that assesses and validates controls, recovery capabilities and response readiness for the Company and its third-party vendors to ensure all functions and supporting technologies operate as expected during a business interruption.
- In the event of a business disruption, specific business resumption plans include alternative means of access key activity reporting, as well as specific actions to be taken concerning liquidity.
Mission Critical Systems
As part of our plans, BofAS has identified the applications that are critical to each of our businesses. Alternative methods are in place to handle these critical functions and services for our clients.
- Order Taking, Entry and Execution
- Clearing, Settlement, Comparison, Delivery of Funds
- Maintenance of Client Accounts
- Access to Customer Accounts
Response and Communication
BofAS has dedicated response teams across the enterprise including defined communications processes to ensure our ability to rapidly disseminate important information not customers, clients, employees, third parties and government authorities affected by a business disruption.
The response process includes:
- Managing both readiness for and response execution at times of crisis and engaging critical external partners.
- Maintaining and expanding external Business Continuity & Disaster Recovery engagements in both public and private sectors to enable world class resiliency.
- Enhancing emerging risk management across the enterprise and enabling readiness through robust annual exercise program.
The business continuity program balances reasonable assessments of risk, with the highest priority placed on the physical safety and security of our customers and employees, while preparing for loss of facilities and technologies. Our long history of resilience during past disruptive events, from local occurrences, such as power outages, though larger events such as hurricanes and tsunamis, demonstrates both our commitment to excellence and our ability to deliver on that commitment.
BofAS cannot always guarantee a specific recovery time following a disruption caused by large – scale events that may lead to widespread interruption of public services or government breakdown. In those circumstances, we will make every reasonable effort to resume normal business as quickly as possible.
Any material changes to the above information will be available upon request. For more detailed information about our business continuity planning, please talk to your relationship manager.