Self-Regulatory Organizations; Chicago Board Options Exchange, Incorporated; Notice of Filing of a Proposed Rule Change, as Modified by Amendment Nos. 1 and 2, Relating to Trading Permit Holder Business Continuity Plans, 28666-28669 [2013-11452]

Agencies

• SECURITIES AND EXCHANGE COMMISSION

[Federal Register Volume 78, Number 94 (Wednesday, May 15, 2013)]
[Notices]
[Pages 28666-28669]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2013-11452]


-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-69537; File No. SR-CBOE-2013-045]


Self-Regulatory Organizations; Chicago Board Options Exchange, 
Incorporated; Notice of Filing of a Proposed Rule Change, as Modified 
by Amendment Nos. 1 and 2, Relating to Trading Permit Holder Business 
Continuity Plans

May 8, 2013.
    Pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 
(the ``Act''),\1\ and Rule 19b-4 thereunder,\2\ notice is hereby given 
that on April 24, 2013, Chicago Board Options Exchange, Incorporated 
(the ``Exchange'' or ``CBOE'') filed with the Securities and Exchange 
Commission (the ``Commission'') the proposed rule change as described 
in Items I, II, and III below, which Items have been prepared by the 
Exchange. On May 7, 2013, the Exchange filed Amendment No. 1 to the 
proposed rule change.\3\ On May 8, 2013, the Exchange filed Amendment 
No. 2 to the proposed rule change.\4\ The Commission is publishing this 
notice to solicit comments on the proposed rule change, as modified by 
Amendment Nos. 1 and 2, from interested persons.
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 78s(b)(1).
    \2\ 17 CFR 240.19b-4.
    \3\ In Amendment No. 1, the Exchange modified Exhibit 1 to 
provide a statutory basis for the proposed rule change.
    \4\ In Amendment No. 2, the Exchange modified Exhibit 1 to 
replace Section II.B, Self-Regulatory Organization's Statement on 
Burden on Competition.
---------------------------------------------------------------------------

I. Self-Regulatory Organization's Statement of the Terms of Substance 
of the Proposed Rule Change

    The Exchange proposes to amend Rule 4.3 to require Trading Permit 
Holders (``TPHs'') to create and maintain a Business Continuity Plan 
(``BCP''). The text of the proposed rule change is provided below.

(additions are italicized; deletions are [bracketed])
* * * * *
Chicago Board Options Exchange, Incorporated Rules
* * * * *
    Rule 4.3. [Reserved] Business Continuity Plans
    [Reserved.]
    (a) Each TPH must create and maintain a written business continuity 
plan identifying procedures relating to an emergency or significant 
business disruption. Such procedures must be reasonably designed to 
enable the TPH to meet its existing obligations to customers. In 
addition, such procedures must address the TPH's existing relationships 
with other broker-dealers and third parties. The business continuity 
plan must be made available promptly upon request to Exchange staff.
    (b) Each TPH must update its plan in the event of any material 
change to the TPH's operations, structure, business or location. Each 
TPH must also conduct an annual documented review of its business 
continuity plan to determine whether any modifications are necessary in 
light of changes to the TPH's operations, structure, business, or 
location. TPHs must designate a member of senior management to approve 
the plan and he or she shall be responsible for conducting the required 
annual review. The review must be made available promptly upon request 
to Exchange staff. In connection to an annual review, each TPH must 
conduct an annual test of its business continuity plan if such TPH has 
public customers. If the TPH does not have public customers, the TPH 
must only conduct such testing once every two years. The initial 
testing of a TPHs business continuity plan should be made within one 
calendar year of the approval of this rule. In addition, each TPH must 
conduct such testing during the first calendar year of becoming a TPH.
    (c) The elements that comprise a business continuity plan are 
flexible and may be tailored to the size and needs of a TPH. Each plan, 
however, must at a minimum, address:
    (1) Data back-up and recovery (hard copy and electronic);
    (2) All mission critical systems;
    (3) Financial and operational assessments;
    (4) Alternate communications between customers and the TPH;
    (5) Alternate communications between the TPH and its employees;
    (6) Alternate physical location of employees;
    (7) Critical business constituent, bank, and counter-party impact;
    (8) Regulatory reporting;
    (9) Communications with regulators, including the Exchange; and
    (10) How the TPH will assure customers' prompt access to their 
funds and securities in the event that the TPH determines that it is 
unable to continue its business.
    Each TPH must address the above-listed categories to the extent 
applicable and necessary. If any of the above-listed categories is not 
applicable, the TPH's business continuity plan need not address the 
category. The TPH's

[[Page 28667]]

business continuity plan, however, must document the rationale for not 
including such category in its plan. If a TPH relies on another entity 
for any one of the above-listed categories or any mission critical 
system, the TPH's business continuity plan must address this 
relationship.
    (d) Each TPH must disclose to its customers how its business 
continuity plan addresses the possibility of a future significant 
business disruption and how the TPH plans to respond to events of 
varying scope. At a minimum, such disclosure must be made in writing to 
customers at account opening, posted on the TPH's Web site (if the TPH 
maintains a Web site), and mailed to customers upon request.
    (e) Emergency Contact.
    (i) Each TPH shall report to the Exchange, via such electronic or 
other means as the Exchange may specify, prescribed emergency contact 
information for the TPH. The emergency contact information for the TPH 
includes designation of two associated persons as emergency contact 
persons. The emergency contact person shall be a member of senior 
management of the TPH and have knowledge of the TPH's business 
operations. A TPH with only one associated person shall designate as a 
second emergency contact person an individual, either registered with 
another firm or nonregistered, who has knowledge of the TPH's business 
operations (e.g., the member's attorney, accountant, or clearing firm 
contact).
    (ii) Each TPH must promptly update its emergency contact 
information, via such electronic or other means as the Exchange may 
specify, in the event of any material change. With respect to the 
designated emergency contact persons, each TPH must identify, review, 
and, if necessary, update such designations.
    * * * Interpretations and Policies:
    (01.) For purposes of this Rule, ``Mission critical system'' means 
any system that is necessary, depending on the nature of a TPH's 
business, to ensure prompt and accurate processing of securities 
transactions, including, but not limited to, order taking, order entry, 
execution, comparison, allocation, clearance and settlement of 
securities transactions, the maintenance of customer accounts, access 
to customer accounts and the delivery of funds and securities.
    (.02) For purposes of this Rule, ``Financial and operational 
assessment'' means a set of written procedures that allow a TPH to 
identify changes in its operational, financial, and credit risk 
exposures.
    (.03) For purposes of paragraph (b), each TPH must conduct a risk 
analysis to identify and quantify those areas of its business that are 
critical to day to day operation of business. Based upon this analysis, 
the TPH should test their business continuity plan to verify potential 
impacts. At a minimum each TPH should test Mission Critical areas that 
support its operations including, but not limited to, testing of 
financing lines that support the day to day functioning of the 
business. This testing should culminate in a report that identifies the 
date of the test, what areas of the business that were tested, who 
participated in the test, the result of the test, the identification of 
recommendations, and a timeframe to implement such recommendations. 
This report must be approved and signed by a member of senior 
management.
* * * * *
CBOE Stock Exchange (CBSX)
Rules
* * * * *

Appendix A--Applicability of Rules of the Exchange

* * * * *

4.3 Business Continuity Plans

* * * * *
    The text of the proposed rule change is also available on the 
Exchange's Web site (https://www.cboe.com/AboutCBOE/CBOELegalRegulatoryHome.aspx), at the Exchange's Office of the 
Secretary, and at the Commission's Public Reference Room.

II. Self-Regulatory Organization's Statement of the Purpose of, and 
Statutory Basis for, the Proposed Rule Change

    In its filing with the Commission, the Exchange included statements 
concerning the purpose of and basis for the proposed rule change and 
discussed any comments it received on the proposed rule change. The 
text of these statements may be examined at the places specified in 
Item IV below. The Exchange has prepared summaries, set forth in 
sections A, B, and C below, of the most significant aspects of such 
statements.

A. Self-Regulatory Organization's Statement of the Purpose of, and 
Statutory Basis for, the Proposed Rule Change

1. Purpose
    The Exchange is proposing to amend Rule 4.3 to require TPHs to 
create and maintain a BCP. Currently, the Exchange has no such 
requirement. The Exchange believes adopting this new requirement will 
ensure TPHs are prepared in the event of an emergency or other 
disruption to their business. A disruption could be a natural disaster 
which could inhibit one or more functions of the TPHs business or could 
be more technical in nature like a systems failure of one or more of 
the TPHs systems. In addition, the disruption could be caused by a 
third party. For example, the Exchange may be unable to operate which 
would cause a disruption for the TPH. By creating a requirement [sic] 
each TPH must have a BCP, the Exchange is attempting to better ensure 
the marketplace will not be disrupted in the case of an emergency or 
other circumstance. Thus, the Exchange is proposing to adopt language 
in Rule 4.3 to outline this requirement for TPHs. The proposed rule 
change would also add text to CBOE Stock Exchange (``CBSX'') Appendix A 
to make explicit the proposed Rule 4.3 would apply to CBSX as well.
    The proposed rule change will require TPHs to create and maintain a 
written BCP identifying procedures relating to an emergency or 
significant business disruption. These procedures must be reasonably 
designed to meet the TPH's customers' needs and address existing 
relationships with broker-dealers and other third parties. The Exchange 
believes that adding such requirement will ensure that TPHs are 
prepared to react to such instance [sic] which could potentially 
negatively impact their participation on the Exchange. In addition, the 
proposed rule change would require TPHs to make the BCP promptly 
available to Exchange staff upon request. This requirement would allow 
the Exchange to regulate these plans while ensuring TPHs are in 
compliance with the proposed rule change.
    The proposed rule change further requires TPHs to update their BCPs 
upon any material change. At a minimum, TPHs will be required to 
conduct a documented annual review of the BCP. TPHs must designate a 
member of senior management to approve the BCP, and he or she shall be 
responsible for conducting this annual review. The proposed rule change 
would require TPHs to make this review promptly available to Exchange 
staff upon request. An annual documented review requirement ensures 
that TPH BCPs will be re-visited on a periodic basis if not already 
done so and also allows the Exchange to request the review for 
compliance of the Rule. By requiring the annual review to be conducted 
by a member of senior management, the Exchange is ensuring that the 
appropriate employees of the TPH are

[[Page 28668]]

aware of the procedures in place. In connection to an annual review, 
each TPH must conduct testing of its BCP.
    The proposed rule change would require at least an annual test of 
the BCP if the TPH has public customers or once every two years if the 
TPH does not have public customers. In addition, the proposed rule 
change would require the testing of the BCP to be completed upon the 
first calendar year of becoming a TPH. This testing timeframe 
requirement will help to ensure that the BCP is effective prior to the 
necessary use of such plan. The Exchange is also proposing to add 
language to describe what the test should entail and how it should be 
documented. More specifically, the Exchange is proposing to add 
language stating that each TPH must conduct a risk analysis to identify 
and quantify those areas of its business that are critical to day to 
day operation of business. Based upon this analysis, the TPH should 
test their business continuity plan to verify potential impacts. The 
Exchange is proposing to state that at a minimum each TPH should test 
Mission Critical areas which would include, but not be limited to, 
testing of financing lines that support the day to day functioning of 
the business. The Exchange believes that by adding this element to the 
testing requirements, TPHs will need to test critical functions of 
their operations and their ability to sustain in the event something 
should effects its business.
    The Exchange is further proposing to add language specifying that 
this testing should culminate in a report that identifies the date of 
the test, what areas of the business that were tested, who participated 
in the test, the result of the test, the identification of 
recommendations, and a timeframe to implement such recommendations. 
This report must be approved and signed by a member of senior 
management. The Exchange believes documentation of this testing is 
critical for purposes of not only documenting the test was 
administered, but the required recommendations will help the TPH in 
distinguishes potential areas in the BCP that could use improvements. 
The Exchange also believes that requiring the testing to be signed by a 
member of senior management would ensure the correct people are looking 
at the strength of the BCP and potential holes within it giving those 
weaknesses a better chance of being improved upon. The Exchange is 
finally proposing to require this testing to be completed within one 
year of the approval of this rule. A new TPH will have one calendar 
year from becoming a TPH to test their BCP.
    Next, the proposed rule change enumerates the minimum elements, to 
the extent those elements are applicable and necessary to the TPH's 
business, that such BCP must address. More specifically, the proposed 
rule change requires the BCP at a minimum addresses: (1) Data back-up 
and recovery (hard copy and electronic), (2) all mission critical 
systems, (3) financial and operational assessments, (4) alternate 
communications between customers and the TPH, (5) alternate 
communications between the TPH and its employees, (6) alternate 
physical location of employees, (7) critical business constituent, 
bank, and counter-party impact, (8) regulatory reporting, (9) 
communications with regulators, including the Exchange, and (10) how 
the TPH will assure customers' prompt access to their funds and 
securities in the event that the TPH determines that it is unable to 
continue its business. The Exchange is proposing to add Rule 4.3.01 to 
define, for purposes of this proposed rule, ``mission critical system'' 
as any system that is necessary (depending on the nature of the TPH's 
business) to ensure prompt and accurate processing of securities 
transaction which would include but not be limited to, ``order taking, 
order entry, execution, comparison, allocation, clearance and 
settlement of securities transactions, the maintenance of customer 
accounts, access to customer accounts, and the delivery of funds and 
securities.'' In addition, the Exchange is proposing to add Rule 4.3.02 
to define, for purposes of this proposed rule, ``Financial and 
operation assessment'' as ``a set of written procedures that allow a 
TPH to identify changes in its operational, financial, and credit risk 
exposure.''
    If these elements are not applicable to a certain TPH, that TPH 
must document the rationale for not including the element within their 
BCP. In addition, if the TPH relies on another entity for any of the 
listed minimum elements, the TPH must address this structure in the 
BCP. By creating minimum elements, the Exchange is hoping to maintain 
an element of consistency in the BCPs while ensuring the BCPs are 
comprehensive and fulfilling their purpose. The Exchange does, however, 
realize that all TPHs are unique, and thus, not all elements may be 
applicable. Rather than allow for TPHs to merely disregard these 
elements, the Exchange is proposing to require TPHs to specifically 
refer to why these elements are not applicable to their business within 
their BCP.
    Each TPH also must disclose to its customers how its BCP addresses 
the possibility of a future significant business disruption and how the 
member plans to respond to events of varying scope. Each TPH must make 
this disclosure, at a minimum, in writing to customers at account 
opening, by posting it on the TPH's Web site (if the member maintains a 
Web site), and by mailing it to customers upon request. The creation of 
a BCP is not fully effective unless all customers of a TPH are aware of 
the procedures in place. The Exchange believes this requirement 
protects investors by giving them notice to the TPHs anticipated 
responses to certain circumstances. It further allows the customers of 
TPHs to prepare appropriate procedures as well.
    The proposed rule change also requires each TPH to report 
information for two emergency contacts. These contacts shall be members 
of the senior management of the TPH, or in the case the TPH only has 
one member of Senior Management, the emergency contact may be an 
individual who has knowledge of the TPH's business operations. This 
requirement requires these contacts remain up to date and allows the 
Exchange to contact the correct person at a TPH in the event the TPH 
must utilize the procedures in place in the BCP. Finally, the proposed 
rule change would also add text to CBSX Appendix A to make explicit the 
proposed Rule 4.3 would apply to CBSX members as well. The Exchange 
believes this text will serve to create a consistency between the 
Exchange and CBSX.
    The Exchange will announce the implementation date of the proposed 
rule change in a Regulatory Circular to be published no later than 30 
days following the approval date. The implementation date will be no 
later than 90 days following the approval date.
2. Statutory Basis
    The Exchange believes the proposed rule change is consistent with 
the Securities Exchange Act of 1934 (the ``Act'') and the rules and 
regulations thereunder applicable to the Exchange and, in particular, 
the requirements of Section 6(b) of the Act.\5\ Specifically, the 
Exchange believes the proposed rule change is consistent with the 
Section 6(b)(5) \6\ requirements that the rules of an exchange be 
designed to prevent fraudulent and manipulative acts and practices, to 
promote just and equitable principles of trade, to foster cooperation 
and coordination with persons engaged in regulating, clearing, 
settling, processing information with respect to,

[[Page 28669]]

and facilitating transactions in securities, to remove impediments to 
and perfect the mechanism of a free and open market and a national 
market system, and, in general, to protect investors and the public 
interest. Additionally, the Exchange believes the proposed rule change 
is consistent with the Section 6(b)(5) \7\ requirement that the rules 
of an exchange not be designed to permit unfair discrimination between 
customers, issuers, brokers, or dealers because the proposed rule 
change will require all TPHs to create and maintain a BCP regardless of 
the kind of business they perform on the Exchange. In particular, the 
proposed rule change will help ensure that TPHs are prepared in the 
event of a significant business disruption. This will seek to stabilize 
the market in the event a TPH, or multiple TPHs at the same time, 
face(s) a situation where their participation in the market place might 
be compromised. In addition, other exchanges [sic] have similar rules 
\8\ requiring procedures in place for these situations, and, thus, the 
Exchange believes harmonizing these requirements would protect the 
marketplace as a whole.
---------------------------------------------------------------------------

    \5\ 15 U.S.C. 78f(b).
    \6\ 15 U.S.C. 78f(b)(5).
    \7\ Id.
    \8\ See Financial Industry Regulatory Authority Rule (``FINRA'') 
Rule 4370.
---------------------------------------------------------------------------

    The Exchange also believes the proposed rule change is consistent 
with Section 6(b)(1) of the Act,\9\ which provides that the Exchange be 
organized and have the capacity to be able to carry out the purposes of 
the Act and to enforce compliance by the Exchange's Trading Permit 
Holders and persons associated with its Trading Permit Holders with the 
Act, the rules and regulations thereunder, and the rules of the 
Exchange. Specifically, the Exchange believes that requiring TPHs to 
have a BCP helps to ensure TPHs have the ability to continue to comply 
with the Act and Exchange rules in instances of an emergency or other 
disruption.
---------------------------------------------------------------------------

    \9\ 15 U.S.C. 78f(b)(1).
---------------------------------------------------------------------------

B. Self-Regulatory Organization's Statement on Burden on Competition

    CBOE does not believe that the proposed rule change will impose any 
burden on competition that is not necessary or appropriate in 
furtherance of the purposes of the Act. Specifically, the Exchange does 
not believe requiring TPHs to create and maintain a BCP will burden 
competition as it will not change any activity on the Exchange. 
Instead, the proposed rule change will require TPHs to have a plan to 
function as they normally do in the event of an emergency or other 
severe business disruption.

C. Self-Regulatory Organization's Statement on Comments on the Proposed 
Rule Change Received From Members, Participants or Others

    The Exchange neither solicited nor received comments on the 
proposed rule change.

III. Date of Effectiveness of the Proposed Rule Change and Timing for 
Commission Action

    Within 45 days of the date of publication of this notice in the 
Federal Register or within such longer period up to 90 days (i) as the 
Commission may designate if it finds such longer period to be 
appropriate and publishes its reasons for so finding or (ii) as to 
which the Exchange consents, the Commission will:
    A. By order approve or disapprove such proposed rule change, or
    B. institute proceedings to determine whether the proposed rule 
change should be disapproved.

IV. Solicitation of Comments

    Interested persons are invited to submit written data, views, and 
arguments concerning the foregoing, including whether the proposed rule 
change is consistent with the Act. Comments may be submitted by any of 
the following methods:

Electronic Comments

     Use the Commission's Internet comment form (https://www.sec.gov/rules/sro.shtml ); or
     Send an email to rule-comments@sec.gov. Please include 
File Number SR-CBOE-2013-045 on the subject line.

Paper Comments

     Send paper comments in triplicate to Elizabeth M. Murphy, 
Secretary, Securities and Exchange Commission, 100 F Street NE., 
Washington, DC 20549-1090.

All submissions should refer to File Number SR-CBOE-2013-045. This file 
number should be included on the subject line if email is used. To help 
the Commission process and review your comments more efficiently, 
please use only one method. The Commission will post all comments on 
the Commission's Internet Web site (https://www.sec.gov/rules/sro.shtml 
). Copies of the submission, all subsequent amendments, all written 
statements with respect to the proposed rule change that are filed with 
the Commission, and all written communications relating to the proposed 
rule change between the Commission and any person, other than those 
that may be withheld from the public in accordance with the provisions 
of 5 U.S.C. 552, will be available for Web site viewing and printing in 
the Commission's Public Reference Room, 100 F Street NE., Washington, 
DC 20549-1090, on official business days between the hours of 10:00 
a.m. and 3:00 p.m. Copies of such filing also will be available for 
inspection and copying at the principal offices of the Exchange. All 
comments received will be posted without change; the Commission does 
not edit personal identifying information from submissions. You should 
submit only information that you wish to make available publicly. All 
submissions should refer to File Number SR-CBOE-2013-045, and should be 
submitted on or before June 5, 2013.

    For the Commission, by the Division of Trading and Markets, 
pursuant to delegated authority.\10\
---------------------------------------------------------------------------

    \10\ 17 CFR 200.30-3(a)(12).
---------------------------------------------------------------------------

Kevin M. O'Neill,
Deputy Secretary.
[FR Doc. 2013-11452 Filed 5-14-13; 8:45 am]
BILLING CODE 8011-01-P