The OSC wants registered firms’ “go bags” packed and ready: how firms can tailor their packing lists and how owners can protect their legacies

Regulatory expectations

The Ontario Securities Commission (OSC) has made it clear that registered firms are expected to be prepared for any significant business disruption from day one. Firms are expected to implement a well documented, tested, and communicated business continuity plan (BCP) to manage the impact of events causing significant business disruptions to a registered firm - including the impact to clients and business operations in the event of death, incapacitation, or prolonged absence of key individuals.

The OSC has provided detailed and expanded guidance on how registrants - not just small firms and sole proprietors - can meet this expectation in the OSC’s Staff Notice 33-756 Registration, Inspections and Examinations Division Summary Report for Dealers, Advisers, and Investment Fund Managers (the 2024 Report) (see here for BLG’s full analysis of the 2024 Report).

Evolution of BCP guidance

The 2024 Report segment focused on BCPs builds on an email blast the regulator circulated in January 2024 which, in turn, was based on the 2017 CSA Staff Notice Guidance on Small Firm Compliance and Regulatory Obligations (2017 Staff Notice). The CSA may well regret having described the application of the 2017 Staff Notice so narrowly.

While the guidance on significant business interruptions and succession planning is targeted at registrants who are sole proprietorships, we have since learned that it was certainly intended to apply far more broadly.

She who fails to plan, plans to fail

While it isn’t news that firms are required to have a written BCP, the following nuances and guidance may not be as familiar. The OSC wants firms to consider these elements of a BCP where appropriate for the firm’s size and business model:

• Procedures to mitigate, respond to, and recover from business interruptions and any other types of disturbances that may disrupt day-to-day operations.
• Mechanisms for how the firm will communicate with clients, key personnel, third-party service providers and regulators.
• Procedures to protect, back up and recover the firm’s books and records (in the event of a cyber incident or natural disaster).
• Details about the relocation of the firm’s head office or principal place of business in the event of a permanent or temporary need to move those locations.
• Discussion of the firm’s business succession or wind-down procedures. This includes the assignment of duties to key personnel in the event of death, incapacitation, or prolonged temporary absence of a sole registered individual, including who will be responsible for notifying the regulator.
• Ensuring that the BCP executor is authorized to provide instructions to third-party service providers on behalf of the firm and to communicate with regulators.
• Details about the information that clients need to know about the BCP to ensure it can be properly executed. For example, providing clients with the name and contact details of the BCP executor, explaining to clients how they can access their assets in the event of loss of the firm’s key personnel, or providing clients with the name and contact details of the relationship manager at the custodian where their assets are held.
• Training for firm employees, including on the specific duties required of them if the BCP were to be activated.
• Details on how often the BCP needs to be updated and its effectiveness assessed.
• A plan for how the firm will assess the adequacy of third-party service providers’ BCPs.

It’s all in the execution

In the 2024 Report, the OSC goes further than in past BCP-related guidance, stating that firms should consider designating a party who can act as the executor of the BCP. Of note, small firms will be expected to have appointed a BCP executor by the time the firm applies for registration.

Additionally, small firms with only one registered individual and no other support or administrative staff may need to designate a BCP executor who is external to the firm. The OSC suggests that this external executor could be legal counsel, a spouse, relative, or another registrant. However, the OSC also requires that the external BCP executor possesses the knowledge, authority, and qualifications to carry out the BCP executor role in compliance with securities legislation. This means that it is very likely that small firms will need to engage another registrant or legal counsel to discharge this duty.

If a firm appoints an external BCP executor, the OSC expects to see the following in place:

• A written agreement that allows the BCP executor to understand and acknowledge their responsibilities. This includes the need for a confidentiality agreement since it is highly likely that the BCP executor will have access to confidential client information. Where applicable, the firm should obtain authorization to share this confidential information, for example, in its Relationship Information Disclosure.
• The BCP executor must be familiar with the firm’s BCP and the firm’s business to enable a proper wind down or to allow the executor to temporarily manage the firm or facilitate the transfer of the firm’s client assets.
• The BCP executor should understand securities legislation and registration requirements to conduct registrable activities, including awareness of associated costs, such as filing for exemptive relief.
• Conflicts of interest must be considered between both firms where one firm appoints another registrant as its external BCP executor.

Given confidentiality and potential conflicts issues, firms may wish to go straight to their legal counsel to act as the external BCP executor and to draft the required documentation.

The 2024 Report is a timely prompt for firms to ensure their BCPs will pass regulatory muster and that all parties involved in executing the BCP are authorized, empowered, and knowledgeable enough to do so. Careful consideration should be given to issues such as conflicts of interest, confidentiality, and—given the prevalence of reliance on third-party service providers—ensuring familiarity with and adequacy of critical third-party BCPs.

Business planning opportunities beyond compliance

Owners of registered firms may also wish to take this opportunity to plan for and protect their legacies from anticipated and unanticipated risks.

Firm owners should consider adopting a fully integrated plan – one that covers off business continuity and that accommodates continuous change, growth and the development of human, social, intellectual and financial capital throughout the firm’s lifecycle and that of its owners.

To achieve these goals, we encourage owners to tailor the firm’s BCP - including its succession plan - and their personal incapacity and estate planning documents to suit their needs. Small firm owners can begin to assess their needs by asking themselves:

• what do I want to leave behind?
• do I have a clear exit strategy, and can it be implemented?
• how will my family be taken care of if I pass?
• which, if any, employees can carry on the firm for me? Do they require training to do so?

Owners should have appropriate wills, powers of attorney, and other estate and incapacity planning documents in place to ensure that someone is entitled to step into their shoes as business owner (either as shareholder or sole proprietor, depending on how the firm is structured). Appropriate wills and powers of attorney are required to ensure that someone is entitled to vote shares (for example, to appoint corporate directors) and to sell shares in the event of the sale of a firm, in addition to dealing with the owner’s other assets and planning needs.

To ensure that regulatory expectations and succession-planning goals are met, the executors and attorneys appointed under wills and powers of attorney should work in concert with the BCP executor to ensure the firm continues to run smoothly, to protect client assets and to retain the value of the firm for the firm owner and their families.