Year 2000 Business Continuity/Business Resumption Contingency Planning

BSP CIRCULAR LETTER Series of 1999

TO : All Banks

SUBJECT : Year 2000 Business Continuity/Business Resumption Contingency Planning

Introduction

At the turn of the century, the Year 2000 Problem may result to unexpected events, one of which is the potential for business disruption among financial institutions. While due diligence is being exercised by each institution in dealing with the problem, its (Year 2000 problem) unique nature and time element add more complexity to the on-going Year 2000 remediation efforts and Year 2000 risk management of the institution. Experts around the globe have recognized that notwithstanding the successful efforts to thoroughly renovate, validate or test, and implement Year 2000-ready systems, the potential exists that some systems will not operate as expected. Thus, business continuity planning or business resumption contingency planning 1 ,as part of the organization's overall Year 2000 risk management, is a must.

As supervisory authority and in keeping with its responsibility to preserve public confidence in the banking sector, Bangko Sentral shall see to it that each financial institution has a business continuity plan in place. Consequently, all financial institutions are required to formulate comprehensive contingency measures that will cover both the technical and business service disruption aspects of the Year 2000 problem — giving priority to the business continuity of identified mission-critical systems.

This Circular-letter establishes the timetable requirement of Bangko Sentral for banks to formulate a business contingency plan. In addition, it provides guidelines in formulating a Year 2000 business contingency plan. Bangko Sentral based these guidelines on pronouncements by international organizations such as the Joint Year 2000 Council as organized for International Settlement's (BIS) and bank supervisors around the globe. Bangko Sentral recognizes that contingency plan may vary from one bank to another, thus, the guidelines set out this Circular-letter does not intend to be a blue-print for contingency planning in every institution, but merely a guide. However, the overall goal of the business contingency plan must be to ensure that there will be minimal disruptions of basic services to the institution and its customers, to minimize financial losses (through lost business opportunities or asset deterioration), and to ensure a timely resumption of normal operations in the event of a Year 2000 disruption.

It is emphasized that business continuity or business resumption contingency planning is different from remediation contingency planning as the latter will involve efforts by financial institutions and their service providers and software vendors to mitigate the Year 2000 risks that are associated with the failure to renovate, validate, and implement mission-critical systems that are Year 2000-ready. Even with the presence of a comprehensive contingency plan, Bangko Sentral expects banks to substantially complete by June 30, 1999, the implementation of its Year 2000 ready mission-critical systems.

Timetable

Activity

Deadline

All financial institutions should have a business continuity plan in place

June 30, 1999

Submission to Bangko Sentral of the formulated contingency plan

July 14, 1999

Contingency plan already tested, rehearsed, validated and approved by senior management

September 30, 1999

Submission of written representation that the contingency plan was tested, rehearsed, validated and approved by senior management of the bank (see format on Annex "A")

October 7, 1999

Bangko Sentral recognizes that contingency plans need to be updated to adapt to current situation and newly identified risks not previously considered. Each Financial institution should immediately furnish Bangko Sentral of any revisions made to the submitted contingency plan.

Independent Validation of the Contingency Plan

It is the responsibility of the senior management to ensure that formulated business continuity plans are adequately tested and validated. Senior management must ensure that there are existing methods which will effectively validate the feasibility of formulated contingency plans. Examples of validation methods may include, but are not limited to, simulations, role-play, walk-throughs, and alternative site reviews.

The validation phase must be performed by an independent group or individual not involved directly in developing the Year 2000 business continuity plan such as the internal auditor, external auditor or a qualified consultant. In the case of external auditor however, special engagements, at the instance and for the account of the bank, may be necessary, as this review/validation may not be part of their traditional audit of banks.

Evaluation of Plan by Bangko Sentral Examiners

As part of its Year 2000 supervisory activities, Bangko Sentral shall perform an evaluation of the contingency plan submitted by financial institutions. This shall be performed off-site and/or through visits to the bank. This evaluation is not intended to be a substitute for the independent validation of the institution's contingency plan as discussed in the preceding paragraph.

Bangko Sentral recognizes that each financial institution has its own unique information system structure and the degree of complexity in business operations differs from one bank to another. While there are features and activities that are present in any contingency plan, the examiner will nevertheless need to exercise his judgment in evaluating the adequacy of the bank's Year 2000 business continuity plan.

Confidentiality of Submitted Contingency Plan

All contingency plans submitted to BSP are confidential and are governed by the confidentiality provision under Section 27 of The New Central Bank Act (R.A. No. 7653).

Modes of Reporting

The contingency plan may be submitted through either mail, courier or delivery by bank messenger services. Banks which are linked to Bangko Sentral through Lotus CC/Mail may request for the electronic transmission of the required plan provided that the bank shall  immediately send to the appropriate supervising and examining department through fax, the covering letter of the submitted contingency plan as signed by the banks chief executive officer or his duly authorized signatory.

The written representation by the bank shall not be electronically transmitted, as this requires signature of the bank's senior management.

This Circular-Letter shall take effect immediately.

ALBERTO V. REYES Deputy Governor