Executive Summary
After completing the public comment period, NASAA has just implemented a new “Model Rule” that will require investment advisers to adopt a “Business Continuity and Succession Plan” for the RIA practice. Notably, the rule would apply only for state-registered investment advisers, although the SEC has recently announced it is considering a parallel rule for SEC-based RIA firms as well.
The ultimate requirement of the Model Rule is that advisors would be required to establish a written plan about how they will handle the transition of everything from books and records of the firm, to ongoing servicing of clients (or at least, an orderly wind down), along with an alternate means of communicating with clients, in the event of either a natural disaster, or the unexpected death or disability of the advisor. In other words, how will the RIA fulfill its fiduciary duty and ensure continuity of service for clients, in light of recent natural disaster events like Hurricanes Katrina and Sandy, or the simple fact that with a sole proprietor advisor the clients might not even know the advisor had passed away and that no one was looking after their assets anymore!
Ultimately, the Rule will not actually have the force of law until it is adopted by individual states in the coming months, but nonetheless the pressure is on now for advisors to begin to prepare their written plan, which state examiners will likely want to see the next time the RIA is audited.
Fortunately, many of the continuity provisions can realistically be achieved by adopting cloud-based services that have a robust backup and disaster recovery process of their own. However, the requirement for “[unexpected] succession planning” in particular may be a challenge for many advisory firms, who must ensure continuity for clients (or at least an orderly wind-down) but may not want to sell the practice now. Will NASAA’s new Model Rule spawn an increase in the number of providers who offer an “exit planning” arrangement for advisors who do want to remain in their practice, but need a continuity solution in the event of death or disability?
NASAA Model Rule 203(a)-1A For RIA Business Continuity And Succession Planning
On April 17th, the North American Securities Administrators Association (NASAA) adopted its new Model Rule 203(a)-1A, which would require that (state-registered) investment advisers adopt a “Business Continuity and Succession Plan” for their business. Specifically, the rule will require the following:
Every investment adviser shall establish, implement, and maintain written procedures relating to a Business Continuity and Succession Plan. The plan shall be based upon the facts and circumstances of the investment adviser’s business model including the size of the firm, type(s) of services provided, and the number of locations of the investment adviser. The plan shall provide for at least the following:
1. The protection, backup, and recovery of books and records.
2. Alternate means of communications with customers, key personnel, employees, vendors, service providers (including third-party custodians),and regulators, including, but not limited to, providing notice of a significant business interruption or the death or unavailability of key personnel or other disruptions or cessation of business activities.
3. Office relocation in the event of temporary or permanent loss of a principal place of business.
4. Assignment of duties to qualified responsible persons in the event of the death or unavailability of key personnel.
5. Otherwise minimizing service disruptions and client harm that could result from a sudden significant business interruption
Notably, while dubbed a rule on “business continuity and succession planning”, the true focus of the rule – as evidenced by the above provisions – is really on business continuity more than true succession planning. This is not a surprise, given events like hurricanes Katrina and Sandy in the past decade that have shown just how “disrupted” an RIA can be when a major disaster occurs. Yet in a world where an RIA has a fiduciary duty to clients, it’s not enough to just recognize that service to clients could be disrupted by a natural disaster; regulators expect a plan to be in place to ensure reasonable continuity of service for clients, despite a natural disaster, including a way to communicate with them and manage the affairs of the business itself.
Notwithstanding the disaster recovery and business continuity focus, though, a key provision of the new model rule is the 4th section, which explicitly requires an assignment of duties to (qualified) responsible persons in the event of death of a key person – which for many small RIA practices, is the founder/owner/advisor. In fact, for a number of solo practitioners, if the advisor were to unexpected die or suddenly become incapacitated, clients literally might not even know for days, weeks, or even months, that the advisor was gone. If the firm simply delivered hourly or project plans, that might not necessarily be a huge disruption, but it is especially concerning issue if the advisor is (or at least, was!) responsible for managing assets on an ongoing discretionary basis and the clients don’t even know that there’s no one steering the ship anymore! Accordingly, the Model Rule requires a plan for how continuity of service could be maintained for clients, and how key responsibilities would be reassigned, in the event of a loss of key personnel (including the advisor/owner themselves).
Of course, the caveat to all of this is that as a “Model Rule”, NASAA has merely drafted a sample version of a rule, which individual states must still adopt for the rule to actually gain the force of law. And even once states do adopt the Model Rule, these rules would only apply to an RIA actually registered in that state, which means it will be some time (months or a year or two?) before any RIAs are really subject to the new provisions, and even then applicability will still be on a state-by-state basis (though notably, some states already have a similar rule in place). In addition, because states only have jurisdiction over state-registered investment advisers, the new rules would not apply to any RIA that is directly registered with the SEC (though the SEC recently indicated that it is considering whether to adopt a succession planning rule of its own).
Notwithstanding the fact that it will take time to implement, though, the reality is that NASAA’s new Model Rule will create new requirements for state-registered investment advisers to begin considering a number of key areas regarding the continuity of their business in the event of a natural disaster or an “unexpected succession” event like the death or sudden disability of the advisor/owner (or another key staff member).
Parsing The Key Provisions: Books And Records, Alternative Means Of Communication, And “Unexpected” Succession Planning
In considering the Model Rule, beyond the general provision that an RIA should try to minimize service disruptions to clients, the key issues to consider fall into four categories: books and records, communication, office relocation, and succession duties of key personnel. While advisors should be certain to consult with their own compliance attorney for a detailed consideration, we can review the issues as highlighted by the guidance and case examples tied to the NASAA Model Rule itself.
Backup And Recovery Of Books And Records
An RIA is already required under the Investment Advisers Act of 1940 to maintain proper books and records for the advisory firm, including the financials of the business, all communications with clients relating to investment advice, client agreements, and more. However, historically most or all of this material has been maintained in the form of physical paper files, which presents a significant challenge in the event of a natural disaster like a hurricane (or even a ‘man-made’ disaster like a fire). What happens if the physical files are outright destroyed?
Under the new Model Rule, an RIA will need to have some answer to this question. Ostensibly, scanning and maintaining a version of the files in electronic form may be one remedy – it is at least a backup to the physical file. However, if the firm’s solution is to convert all the books and records into digital files stored on a local computer or server, the continuity problem remains because a natural disaster that destroys the physical files may well destroy the computers/servers located in the same place (or at least, render them equally unreachable).
Accordingly, it seems likely that advisors will want to look to maintain digital, cloud-based backup files for all the firm’s key books and records. Of course, transitioning key client information online also means that the firm must be cognizant to use vendors that have effective cybersecurity measures of their own to maintain the privacy of client data as well. Nonetheless, it seems the reality is that just keeping physical files local, with digital backups on local computers, may not fully satisfy the new regulatory expectations for business continuity regarding books and records!
Alternative Method Of Communication
Continuing the theme of managing an RIA in the event of a natural disaster, the next question that arises is how an advisor would maintain communication with clients. After all, in a true natural disaster, a phone system might be offline for days or more, not to mention the electricity that powers the advisory firm’s computers and CRM software where all the client phone numbers are held. Similarly, if the RIA’s offices are not accessible – or its computers lack power – going into the office to send clients a blast email may not be feasible either.
Here, again, it seems likely that cloud-based solutions may be a viable alternative. A cloud-based CRM would provide a means to access client phone numbers and other contact information, even if the advisory firm was inaccessible (assuming, of course, that the CRM and other information is hosted on a third-party system, and not merely as a VPN connection back to the advisor’s servers housed in that inaccessible office!).
Of course, it’s not enough to just have access to the client contact information online in the event of a natural disaster; there still must be a means to send out that communication. Here, again, web-based communication systems – from a cloud-based email service, to using a third-party email solution like MailChimp – might be feasible to address the issue. Notably, social media platforms like Twitter (which have robust systems of their own to stay online even with a natural disaster) might also conceivably be used as an alternative means of communication for clients (presuming the clients have been notified in advance that to look there for communication), as a way to send out a broad-based notice of where the advisor can be reached in the event the RIA offices are unreachable.
Office Relocation And Disruptions To The Principal Place Of Business
Notably, the NASAA rule itself has little in the way of guidance regarding office relocation, beyond acknowledging that it is an issue an RIA should consider. Given natural disasters in recent years like Hurricanes Katrina and Sandy, the reality is that an advisor could unexpectedly find an office inaccessible for an extended period of time… which ultimately is an issue not merely in the near term to secure books and records and maintain client communication, but where to “set up shop” again in the event that it may not be feasible to return to the original office location anytime soon!
On the other hand, it is again notable that for firms whose key client data and systems are primarily web-based, it may be “relatively” easy to relocate the firm’s key personnel and offices in the event of a natural disaster, as any location with a secure internet connection could serve in a pinch!
(Unexpected) Succession Planning And Transitioning Responsibilities Of Key Personnel
When it comes to the “succession planning” section of the NASAA Model Rule, the issue is not the typical long-term succession plan for an advisory firm, but a plan for how to handle an “unexpected” need to execute a succession plan; in other words, what is the “exit plan” if the advisor/owner dies or is suddenly disabled? Who is responsible for ensuring that clients are served properly in the event of such a business disruption?
In the case of many small state-registered advisory firms, the reality is that there are often few if any staff members; if the advisor/owner was suddenly no longer available, there could literally be no one else to serve the clients at all! Of course, if the advisor is the sole owner and participant and passes away, the business will likely be wound down anyway – and an orderly wind down is a permissible path to “succession” under the Model Rule. Even in such a situation, though, there must still be a process for how the business will be wound down in an orderly manner, who will be responsible for communicating to clients, notifying regulators and key vendors, etc.
A further complication for managing “unexpected” succession planning, in the event of the death of the owner in particular, is that in the case of a state-registered RIA that is a sole proprietor, the registration of the RIA, the advisory agreements with the clients, and the very existence of the business itself dies with the advisor. The same may be true for other types of business entities, depending on state law (e.g., some but not all states would also render a single-member LLC terminated as a business entity after the death of the single-member owner).
The fact that the death of the owner can literally mean the death of the business creates several additional complications for managing continuity and a “succession” plan. For instance, even if the advisory firm has staff who can continue to serve clients in the near term if the owner suddenly passes away, it still may not be legal for the staff to render any services to the clients if the investment adviser registration itself has ended. Similarly, if the firm’s advisory agreements between clients and the advisor are terminated at the death of the advisor, staff would have to re-engage the clients with a new advisory agreement to be paid for ongoing services – which, again, the staff also could not do because a new client agreement would require a registered investment adviser, which would no longer exist at that point!
In fact, even an executor may have difficulty just trying to wind down an advisory firm after the death of an owner. The potential termination of RIA status and client advisory agreements could limit the executor’s ability to even just liquidate client portfolios, and any client fees paid in advance that have to be refunded would now become part of the probate process! In addition, the executor may struggle to gain access to key systems – like the firm’s CRM system – if the vendor contract and permission to access private client information also died with the advisor.
Similar challenges can arise in the event that the advisory firm’s “succession”/continuity plan involves an agreement with another advisor to buy the practice and/or service the clients. The acquiring advisor may not have access to any private client information in order to contact the clients to execute on the agreement – at least, unless the advisory firm executes a separate/additional arrangement in its privacy policy with clients to permit the release of information under such circumstances. The advisory agreements with clients may also not be transferrable, depending on the state’s laws and whether the advisory agreement was with the (deceased) advisor or the advisory firm as an entity, which would also have to be planned around. And of course, there’s the simple question of whether the acquiring advisor in such a situation even has the capacity to take on and serve the clients in the first place (i.e., in a situation where two sole proprietors agree to buy each other out in the event of death or disability, but with an existing client base of their own neither actually has the capacity to handle all the clients of the other!).
Regulatory Enforcement Of The Business Continuity And Succession Planning Rule For An RIA
Ultimately, the point of NASAA’s new Model Rule is not actually to enforce against a business continuity or succession plan when the disaster occurs and the plan is executed, but to establish that such a plan is in place to begin with (should that disaster occur in the future). In other words, regulators will not necessarily be scrutinizing how an RIA handles an actual disaster event, but instead will be looking to see what written plan is in place for how such an event would be handled.
Accordingly, as the new Model Rule is adopted in various states – ostensibly with some grace period like 6 or 12 months for RIAs to get up to speed? – it will be up to (state-registered) investment advisers to craft their continuity and succession plan, in a manner that addresses all of the key areas articulated in the model rule, from the handling of books and records to an alternative means of communication with clients to how an untimely death or disability of a key person would be handled. And as the next state RIA exam cycle occurs after the rule has been adopted, examiners will likely ask the RIA for a copy of that continuity and succession plan, to evaluate its thoroughness in covering the key areas, with perhaps some eye to the overall feasibility of the plan (could it realistically be executed in the first place, or does it have fatal flaws, such as key contracts or legal agreements that would die with the owner/advisor?).
To the extent a business and continuity plan does not meet the requirements, it would presumably be cited as an exam deficiency, with a time window for the RIA to take corrective action (i.e., to actually establish the plan). Notably, though, the actual rule is rather flexible, explicitly stating that the expected plan would be based on the facts and circumstances of the adviser’s business model and other details; in other words, the implication is that regulators will be flexible to recognize that continuity plans will vary based on the needs of the business and its clientele, at least as long as the basic requirements are met.
Business Continuity Vs “True” Succession Planning And Filling The Exit Planning Void
In the end, while NASAA’s Model Rule is framed as one for “Business Continuity and Succession Planning”, the reality is that it’s really predominantly about business continuity. Even its provisions about succession planning are in the context of executing an “unexpected” succession plan to provide continuity to clients with a sudden exit of the owner/advisor, not the execution of a “typical” longer-term internal or external succession plan for the advisory business.
Nonetheless, the Model Rule does highlight both the importance and the challenges of ensuring continuity of client service and the business itself in the event of death of a primary owner, and indirectly makes the point that more advisors might consider or feel pressure to use formal entities (e.g., an LLC that survives the death of its owner, or an S corporation) to ensure continuity beyond what can be achieved as a sole proprietor. And more generally, the rule emphasizes the fact that “continuity planning” is not just about planning for events like natural disasters (which matter too) but around the potential of a “forced exit” of the advisor in the form of a sudden death or disability.
Arguably, NASAA’s Model Rule also highlights the fact that there remains a real gap in services for advisors who do want to have a continuity plan for clients in the event of death or disability, but don’t want to be forced into selling the practice or merging into a larger firm now – an “exit” plan, rather than a succession plan. Thus far, there are only a few firms that are offering revocable buy/sell agreements that RIAs can use as a stop-gap for exit and continuity planning – including our own PRISM offering from Pinnacle Advisor Solutions, and a similar “succession” solution from Focus Financial Partners. As the NASAA Model Rule is adopted in more and more states going forward, it wouldn’t be surprising to see more exit planning solutions develop. And the increased focus on valuing a business for the legislatively required “succession” plans may also create more interest in valuation services like FP Transitions.
The bottom line, though, is simply this – with the NASAA Model Rule adopted for state-registered investment advisers, and the potential for a similar rule coming soon for SEC-based RIAs, advisory firms will soon be required to come up with some written plan about how to ensure continuity for clients in the event of major business disruptions, from a natural disaster to the death or disability of an advisory firm owner. Fortunately, the rising availability of cloud-based services can – properly structured – alleviate many of the continuity challenges faced in a natural disaster, but it will be up to advisors to ensure a similar continuity plan if the event of an “unexpected” succession plan, either by preparing for a sale or merger now, or finding a partner who is willing to purchase the practice as an “exit plan” transition in the event of death or sudden disability.
So what do you think? Does NASAA’s new Model Rule requirements seem reasonable as a requirement for RIAs to ensure continuity of service for clients? Do you anticipate challenges satisfying the new rule requirements? Do you see challenges to implementing the new rules in your own practice?
Disclosure: Michael Kitces is a partner in Pinnacle Advisory Group and Pinnacle Advisor Solutions, and the PRISM exit/succession planning solution mentioned in this article.
