COVID-19 was declared a global health emergency of international concern by the World Health Organisation (WHO) on 30 January 2020. The outbreak poses a threat to many organisations and presents a number of business continuity issues for the financial services sector. This article addresses some of the immediate issues which regulated firms in the UAE financial free zones should be considering in order to remain resilient, and compliant. It may also be useful by analogy for firms in the UAE outside the financial free zones, and elsewhere.

Why should financial services firms be concerned about COVID-19?

COVID-19 has the potential to create significant disruption for all businesses and to have varying degrees of commercial impact. In addition to dealing with these issues, regulated firms operating in the Dubai International Financial Centre and the Abu Dhabi Global Market are required to consider the potential regulatory impacts and, importantly, to have in place effective business continuity arrangements.

Both Dubai Financial Services Authority and Financial Services Regulatory Authority rules require firms to have in place "adequate arrangements to ensure that it can continue to function and meet its obligations under [applicable legislation in the financial free zone] in the event of an unforeseen interruption."  Firms are also required to keep their business continuity arrangements up to date and regularly tested to ensure their effectiveness.

COVID-19 is likely to test regulated firms' business continuity arrangements and crisis management capability. Although the regulators may have some sympathy in the circumstances, given that firms have had adequate warning, and time to prepare, firms whose business continuity arrangements fail, or result in customer detriment or loss, may face close regulatory scrutiny.

Recommended action plan for COVID-19 readiness

If a firm has not done so already, it should assess the adequacy of its business continuity plan (BCP) in the face of expected COVID-19 developments. Firms should assess whether the BCP is fit for purpose based on current WHO and UAE government guidelines, as well as stress testing against potential worst case scenarios, including key staff or business functions being out of action for two or more weeks. We also recommend that firms:

  • Develop a COVID-19-specific contingency plan (COVID Plan) which:
  1. addresses all possible business interruption scenarios. For example, firms which execute trades for clients on exchanges should ensure that they can continue to service clients in the event that all their employees need to work from home or remotely in other countries. Insurers need to ensure that they can continue to handle claims, particularly in the medical insurance space;
  2. considers alternative ways of working to prevent spread of infection. For example, home working, increased use of video conferencing and calls to avoid face to face contact; and
  3. includes strategies which deal with possible scenarios, such as a reduction in business or key staff shortages.
  • Communicate the COVID Plan to key personnel across the business.
  • Designate a COVID team to take responsibility for operating the COVID Plan should a pandemic occur.

What are the BCP issues that should be addressed immediately?

We recommend that regulated firms address the following matters without delay:

Communications

 Does the firm's BCP include a comprehensive plan to allow key personnel to continue to communicate effectively in the event of disruption, including a back-up plan. For example, using email groups and messaging tools? Has the communication plan been disseminated to all staff and are email and mobile phone lists up to date?

Decision-making

 Have arrangements been made to ensure that effective decision making can continue in a scenario where one or more key personnel are out of action for two or more weeks? Is it clear who would take the helm in the chain of command where one or more key personnel are out of action?

Health guidelines

 Firms should ensure that they familiarise themselves and keep up to date with UAE Government and public health advice. Firms should communicate clearly to employees what they need to do to take precautions - such as avoiding travel to affected areas or coming into contact with infected people. Firms should have very clear guidance for employees about remote working, self-quarantine, attending events, travel to high-risk countries, and customer meetings. Firms should advise employees what to do if they think they may have caught or been exposed to the virus.

Remote working

 Are the firm's arrangements for remote working effective and have they been tested? Do employees have the tools they need and have they been trained to use them? Are business critical teams set up to work effectively from home and has this been tested?

Bandwidth

 Does the firm currently have sufficient bandwidth and server processing power for all or even a majority of employees to work remotely? Has the firm's telecoms provider confirmed this and has it been tested? Is there a back-up solution?

Continued compliance with conduct of business rules

 Does the BCP, and in particular remote working, permit the firm to continue to comply with conduct rules? For example, for firms which execute trades for clients, can calls be recorded if received on mobile phones? If not, can client trading instructions be handled by email? Can record-keeping requirements continue to be met? Do the firm's terms of business allow for alternative methods of communications, or contain a "force majeure" clause.

Outsourcing and service providers

 Has the firm ensured that its outsourced service providers can continue to provide crucial services? Do the outsourcing terms align or deal adequately with the firm's BCP? If not, the BCP may be wholly or partially ineffective. Is there a back-up plan and has the firm discussed business continuity with the service provider?

Coordinating with the wider group

 For firms which are part of a group, does the BCP address a scenario where the wider group is facing the same crisis scenario?

Communicating with the regulator

 Does the BCP address arrangements for communicating effectively with the regulator, and continuing to make required notifications?

The above list is not exhaustive. Firms need to be prepared to address contingencies and more remote risks as they crystalise. The key to successfully navigating a crisis is to be adequately prepared, communicate effectively, and to be sufficiently flexible to pivot strategically should the need arise.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.