Quick Answer
State-registered advisers must maintain a written business continuity plan covering 5 required elements: records recovery, alternate communications (customers, personnel, vendors, custodians, and regulators), office relocation, staff duties, and minimizing disruption/client harm. The NASAA model rule sets no fixed review cadence; the annual-review requirement comes from a separate FINRA broker-dealer rule, not this one.
The final piece of the ethical framework addresses what happens when things go wrong, not ethically, but operationally. A natural disaster, cyberattack, or the death of a key principal can disrupt client service. Regulators expect advisers to plan for these scenarios in advance.
NASAA Model Rule on Business Continuity and Succession Planning
The NASAA Model Rule on Business Continuity and Succession Planning requires state-registered investment advisers to establish, implement, and maintain written business continuity plans (BCPs).
The plan must be based on the facts and circumstances of the adviser's business, including:
- Size of the firm
- Types of services provided
- Number of office locations
Exam Tip: Gotchas
- The NASAA Model Rule on Business Continuity and Succession Planning applies to state-registered advisers only. No SEC rule explicitly requires federal-covered advisers to maintain a BCP: the SEC proposed one in 2016 but never adopted it. Having a BCP is a best practice for federal-covered advisers, not a named regulatory mandate.
Required BCP Elements
The model rule enumerates 5 required elements, not 6. "Client notification" is folded into the alternate-communications element rather than being its own line item, and "succession planning" appears in the rule's title/fiduciary rationale and NASAA's accompanying guidance rather than as a separately numbered element:
| # | Element | Purpose |
|---|---|---|
| 1 | Protection, backup, and recovery of books and records | Ensure records survive a disruption |
| 2 | Alternate communications | Backup methods for reaching customers, key personnel, employees, vendors, service providers (including third-party custodians), and regulators, including notice of a significant disruption or the death/unavailability of key personnel |
| 3 | Office relocation | Plan for operating if the primary site is temporarily or permanently unavailable |
| 4 | Assignment of duties | Qualified responsible persons handle duties if key personnel die or become unavailable |
| 5 | Minimizing disruptions and client harm | A catch-all requirement to otherwise limit service disruption and client harm from a sudden interruption |
Exam Tip: Gotchas
- The plan must cover vendors, service providers, and custodians, not just clients, employees, and regulators. "Alternate communications" is the broadest element and lists all of these groups by name.
- Don't teach "succession planning" and "client notification" as separate numbered rule elements. Client notification is part of the alternate-communications element; succession planning is addressed by the rule's title and NASAA's accompanying guidance, not as one of the 5 enumerated requirements itself.
Maintenance Requirements
- The NASAA model rule sets no fixed review cadence: the adviser reviews, tests, and updates the BCP based on its facts and circumstances
- Updates should reflect changes in the firm's business model, personnel, technology, or regulatory requirements
- The plan should be tested periodically to ensure it works
- Note: the at least annually review requirement comes from the FINRA broker-dealer business-continuity rule, which does not govern state-registered investment advisers
Succession Planning
Succession planning is addressed by the model rule's title and NASAA's accompanying guidance, and is especially important for smaller advisory firms, even though it isn't one of the rule's 5 separately numbered elements:
- Who takes over the advisory business if the principal dies or becomes incapacitated
- Client relationship continuity: how clients will be served during a transition
- Regulatory obligations: ensuring ongoing compliance during the transition period
Exam Tip: Gotchas
- BCPs must be in WRITING. The NASAA rule sets no fixed review cadence (review and update based on facts and circumstances and after significant business changes; the annual cadence is a FINRA broker-dealer requirement, not the NASAA IA rule). A verbal plan is always a violation of the written-plan requirement. Simply going several years without an update is not automatically a violation on its own, but a plan that has become stale or no longer reflects the firm's actual business is a maintenance violation.
What Should You Check on Exam Day?
- Can you name the FIVE required BCP elements (records recovery, alternate communications, office relocation, assignment of duties, minimizing disruption/client harm), and explain that succession planning and client notification are NOT separate numbered elements?
- Do you know the NASAA continuity rule applies to state-registered advisers, not to federal-covered advisers?
- Can you explain why "no SEC BCP rule for federal-covered advisers" is a fact, not a loophole? (A 2016 SEC proposal was never adopted, so having one is a best practice, not a mandate.)
- Do you know the NASAA rule sets no fixed review cadence, and that the annual-review standard belongs to a separate FINRA broker-dealer rule?
- Does "alternate communications" in your answer include vendors, service providers, and custodians, not just clients, employees, and regulators?