2013-11452. Self-Regulatory Organizations; Chicago Board Options Exchange, Incorporated; Notice of Filing of a Proposed Rule Change, as Modified by Amendment Nos. 1 and 2, Relating to Trading Permit Holder Business Continuity Plans

May 8, 2013.

Pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 (the “Act”),^[1] and Rule 19b-4 thereunder,^[2] notice is hereby given that on April 24, 2013, Chicago Board Options Exchange, Incorporated (the “Exchange” or “CBOE”) filed with the Securities and Exchange Commission (the “Commission”) the proposed rule change as described in Items I, II, and III below, which Items have been prepared by the Exchange. On May 7, 2013, the Exchange filed Amendment No. 1 to the proposed rule change.^[3] On May 8, 2013, the Exchange filed Amendment No. 2 to the proposed rule change.^[4] The Commission is publishing this notice to solicit comments on the proposed rule change, as modified by Amendment Nos. 1 and 2, from interested persons.

I. Self-Regulatory Organization's Statement of the Terms of Substance of the Proposed Rule Change

The Exchange proposes to amend Rule 4.3 to require Trading Permit Holders (“TPHs”) to create and maintain a Business Continuity Plan (“BCP”). The text of the proposed rule change is provided below.

(additions are italicized; deletions are [bracketed])

* * * * *

Chicago Board Options Exchange, Incorporated Rules

* * * * *

Rule 4.3. [Reserved] Business Continuity Plans

[Reserved.]

(a) Each TPH must create and maintain a written business continuity plan identifying procedures relating to an emergency or significant business disruption. Such procedures must be reasonably designed to enable the TPH to meet its existing obligations to customers. In addition, such procedures must address the TPH's existing relationships with other broker-dealers and third parties. The business continuity plan must be made available promptly upon request to Exchange staff.

(b) Each TPH must update its plan in the event of any material change to the TPH's operations, structure, business or location. Each TPH must also conduct an annual documented review of its business continuity plan to determine whether any modifications are necessary in light of changes to the TPH's operations, structure, business, or location. TPHs must designate a member of senior management to approve the plan and he or she shall be responsible for conducting the required annual review. The review must be made available promptly upon request to Exchange staff. In connection to an annual review, each TPH must conduct an annual test of its business continuity plan if such TPH has public customers. If the TPH does not have public customers, the TPH must only conduct such testing once every two years. The initial testing of a TPHs business continuity plan should be made within one calendar year of the approval of this rule. In addition, each TPH must conduct such testing during the first calendar year of becoming a TPH.

(c) The elements that comprise a business continuity plan are flexible and may be tailored to the size and needs of a TPH. Each plan, however, must at a minimum, address:

(1) Data back-up and recovery (hard copy and electronic);

(2) All mission critical systems;

(3) Financial and operational assessments;

(4) Alternate communications between customers and the TPH;

(5) Alternate communications between the TPH and its employees;

(6) Alternate physical location of employees;

(7) Critical business constituent, bank, and counter-party impact;

(8) Regulatory reporting;

(9) Communications with regulators, including the Exchange; and

(10) How the TPH will assure customers' prompt access to their funds and securities in the event that the TPH determines that it is unable to continue its business.

Each TPH must address the above-listed categories to the extent applicable and necessary. If any of the above-listed categories is not applicable, the TPH's business continuity plan need not address the category. The TPH's business continuity plan, however, must document the rationale for not including such category in its plan. If a TPH relies on another entity for any one of the above-listed categories or any mission critical system, the TPH's business continuity plan must address this relationship.

(d) Each TPH must disclose to its customers how its business continuity plan addresses the possibility of a future significant business disruption and how the TPH plans to respond to events of varying scope. At a minimum, such disclosure must be made in writing to customers at account opening, posted on the TPH's Web site (if the TPH maintains a Web site), and mailed to customers upon request.

(e) Emergency Contact.

(i) Each TPH shall report to the Exchange, via such electronic or other means as the Exchange may specify, prescribed emergency contact information for the TPH. The emergency contact information for the TPH includes designation of two associated persons as emergency contact persons. The emergency contact person shall be a member of senior management of the TPH and have knowledge of the TPH's business operations. A TPH with only one associated person shall designate as a second emergency contact person an individual, either registered with another firm or nonregistered, who has knowledge of the TPH's business operations (e.g., the member's attorney, accountant, or clearing firm contact).

(ii) Each TPH must promptly update its emergency contact information, via such electronic or other means as the Exchange may specify, in the event of any material change. With respect to the designated emergency contact persons, each TPH must identify, review, and, if necessary, update such designations.

* * * Interpretations and Policies:

(01.) For purposes of this Rule, “Mission critical system” means any system that is necessary, depending on the nature of a TPH's business, to ensure prompt and accurate processing of securities transactions, including, but not limited to, order taking, order entry, execution, comparison, allocation, clearance and settlement of securities transactions, the maintenance of customer accounts, access to customer accounts and the delivery of funds and securities.

(.02) For purposes of this Rule, “Financial and operational assessment” means a set of written procedures that allow a TPH to identify changes in its operational, financial, and credit risk exposures.

(.03) For purposes of paragraph (b), each TPH must conduct a risk analysis to identify and quantify those areas of its business that are critical to day to day operation of business. Based upon this analysis, the TPH should test their business continuity plan to verify potential impacts. At a minimum each TPH should test Mission Critical areas that support its operations including, but not limited to, testing of financing lines that support the day to day functioning of the business. This testing should culminate in a report that identifies the date of the test, what areas of the business that were tested, who participated in the test, the result of the test, the identification of recommendations, and a timeframe to implement such recommendations. This report must be approved and signed by a member of senior management.

* * * * *

CBOE Stock Exchange (CBSX)

Rules

* * * * *

Appendix A—Applicability of Rules of the Exchange

* * * * *

4.3 Business Continuity Plans

* * * * *

The text of the proposed rule change is also available on the Exchange's Web site (http://www.cboe.com/​AboutCBOE/​CBOELegalRegulatoryHome.aspx), at the Exchange's Office of the Secretary, and at the Commission's Public Reference Room.

II. Self-Regulatory Organization's Statement of the Purpose of, and Statutory Basis for, the Proposed Rule Change

In its filing with the Commission, the Exchange included statements concerning the purpose of and basis for the proposed rule change and discussed any comments it received on the proposed rule change. The text of these statements may be examined at the places specified in Item IV below. The Exchange has prepared summaries, set forth in sections A, B, and C below, of the most significant aspects of such statements.

A. Self-Regulatory Organization's Statement of the Purpose of, and Statutory Basis for, the Proposed Rule Change

1. Purpose

The Exchange is proposing to amend Rule 4.3 to require TPHs to create and maintain a BCP. Currently, the Exchange has no such requirement. The Exchange believes adopting this new requirement will ensure TPHs are prepared in the event of an emergency or other disruption to their business. A disruption could be a natural disaster which could inhibit one or more functions of the TPHs business or could be more technical in nature like a systems failure of one or more of the TPHs systems. In addition, the disruption could be caused by a third party. For example, the Exchange may be unable to operate which would cause a disruption for the TPH. By creating a requirement [sic] each TPH must have a BCP, the Exchange is attempting to better ensure the marketplace will not be disrupted in the case of an emergency or other circumstance. Thus, the Exchange is proposing to adopt language in Rule 4.3 to outline this requirement for TPHs. The proposed rule change would also add text to CBOE Stock Exchange (“CBSX”) Appendix A to make explicit the proposed Rule 4.3 would apply to CBSX as well.

The proposed rule change will require TPHs to create and maintain a written BCP identifying procedures relating to an emergency or significant business disruption. These procedures must be reasonably designed to meet the TPH's customers' needs and address existing relationships with broker-dealers and other third parties. The Exchange believes that adding such requirement will ensure that TPHs are prepared to react to such instance [sic] which could potentially negatively impact their participation on the Exchange. In addition, the proposed rule change would require TPHs to make the BCP promptly available to Exchange staff upon request. This requirement would allow the Exchange to regulate these plans while ensuring TPHs are in compliance with the proposed rule change.

The proposed rule change further requires TPHs to update their BCPs upon any material change. At a minimum, TPHs will be required to conduct a documented annual review of the BCP. TPHs must designate a member of senior management to approve the BCP, and he or she shall be responsible for conducting this annual review. The proposed rule change would require TPHs to make this review promptly available to Exchange staff upon request. An annual documented review requirement ensures that TPH BCPs will be re-visited on a periodic basis if not already done so and also allows the Exchange to request the review for compliance of the Rule. By requiring the annual review to be conducted by a member of senior management, the Exchange is ensuring that the appropriate employees of the TPH are aware of the procedures in place. In connection to an annual review, each TPH must conduct testing of its BCP.

The proposed rule change would require at least an annual test of the BCP if the TPH has public customers or once every two years if the TPH does not have public customers. In addition, the proposed rule change would require the testing of the BCP to be completed upon the first calendar year of becoming a TPH. This testing timeframe requirement will help to ensure that the BCP is effective prior to the necessary use of such plan. The Exchange is also proposing to add language to describe what the test should entail and how it should be documented. More specifically, the Exchange is proposing to add language stating that each TPH must conduct a risk analysis to identify and quantify those areas of its business that are critical to day to day operation of business. Based upon this analysis, the TPH should test their business continuity plan to verify potential impacts. The Exchange is proposing to state that at a minimum each TPH should test Mission Critical areas which would include, but not be limited to, testing of financing lines that support the day to day functioning of the business. The Exchange believes that by adding this element to the testing requirements, TPHs will need to test critical functions of their operations and their ability to sustain in the event something should effects its business.

The Exchange is further proposing to add language specifying that this testing should culminate in a report that identifies the date of the test, what areas of the business that were tested, who participated in the test, the result of the test, the identification of recommendations, and a timeframe to implement such recommendations. This report must be approved and signed by a member of senior management. The Exchange believes documentation of this testing is critical for purposes of not only documenting the test was administered, but the required recommendations will help the TPH in distinguishes potential areas in the BCP that could use improvements. The Exchange also believes that requiring the testing to be signed by a member of senior management would ensure the correct people are looking at the strength of the BCP and potential holes within it giving those weaknesses a better chance of being improved upon. The Exchange is finally proposing to require this testing to be completed within one year of the approval of this rule. A new TPH will have one calendar year from becoming a TPH to test their BCP.

Next, the proposed rule change enumerates the minimum elements, to the extent those elements are applicable and necessary to the TPH's business, that such BCP must address. More specifically, the proposed rule change requires the BCP at a minimum addresses: (1) Data back-up and recovery (hard copy and electronic), (2) all mission critical systems, (3) financial and operational assessments, (4) alternate communications between customers and the TPH, (5) alternate communications between the TPH and its employees, (6) alternate physical location of employees, (7) critical business constituent, bank, and counter-party impact, (8) regulatory reporting, (9) communications with regulators, including the Exchange, and (10) how the TPH will assure customers' prompt access to their funds and securities in the event that the TPH determines that it is unable to continue its business. The Exchange is proposing to add Rule 4.3.01 to define, for purposes of this proposed rule, “mission critical system” as any system that is necessary (depending on the nature of the TPH's business) to ensure prompt and accurate processing of securities transaction which would include but not be limited to, “order taking, order entry, execution, comparison, allocation, clearance and settlement of securities transactions, the maintenance of customer accounts, access to customer accounts, and the delivery of funds and securities.” In addition, the Exchange is proposing to add Rule 4.3.02 to define, for purposes of this proposed rule, “Financial and operation assessment” as “a set of written procedures that allow a TPH to identify changes in its operational, financial, and credit risk exposure.”

If these elements are not applicable to a certain TPH, that TPH must document the rationale for not including the element within their BCP. In addition, if the TPH relies on another entity for any of the listed minimum elements, the TPH must address this structure in the BCP. By creating minimum elements, the Exchange is hoping to maintain an element of consistency in the BCPs while ensuring the BCPs are comprehensive and fulfilling their purpose. The Exchange does, however, realize that all TPHs are unique, and thus, not all elements may be applicable. Rather than allow for TPHs to merely disregard these elements, the Exchange is proposing to require TPHs to specifically refer to why these elements are not applicable to their business within their BCP.

Each TPH also must disclose to its customers how its BCP addresses the possibility of a future significant business disruption and how the member plans to respond to events of varying scope. Each TPH must make this disclosure, at a minimum, in writing to customers at account opening, by posting it on the TPH's Web site (if the member maintains a Web site), and by mailing it to customers upon request. The creation of a BCP is not fully effective unless all customers of a TPH are aware of the procedures in place. The Exchange believes this requirement protects investors by giving them notice to the TPHs anticipated responses to certain circumstances. It further allows the customers of TPHs to prepare appropriate procedures as well.

The proposed rule change also requires each TPH to report information for two emergency contacts. These contacts shall be members of the senior management of the TPH, or in the case the TPH only has one member of Senior Management, the emergency contact may be an individual who has knowledge of the TPH's business operations. This requirement requires these contacts remain up to date and allows the Exchange to contact the correct person at a TPH in the event the TPH must utilize the procedures in place in the BCP. Finally, the proposed rule change would also add text to CBSX Appendix A to make explicit the proposed Rule 4.3 would apply to CBSX members as well. The Exchange believes this text will serve to create a consistency between the Exchange and CBSX.

The Exchange will announce the implementation date of the proposed rule change in a Regulatory Circular to be published no later than 30 days following the approval date. The implementation date will be no later than 90 days following the approval date.

2. Statutory Basis

The Exchange believes the proposed rule change is consistent with the Securities Exchange Act of 1934 (the “Act”) and the rules and regulations thereunder applicable to the Exchange and, in particular, the requirements of Section 6(b) of the Act.^[5] Specifically, the Exchange believes the proposed rule change is consistent with the Section 6(b)(5) ^[6] requirements that the rules of an exchange be designed to prevent fraudulent and manipulative acts and practices, to promote just and equitable principles of trade, to foster cooperation and coordination with persons engaged in regulating, clearing, settling, processing information with respect to, and facilitating transactions in securities, to remove impediments to and perfect the mechanism of a free and open market and a national market system, and, in general, to protect investors and the public interest. Additionally, the Exchange believes the proposed rule change is consistent with the Section 6(b)(5) ^[7] requirement that the rules of an exchange not be designed to permit unfair discrimination between customers, issuers, brokers, or dealers because the proposed rule change will require all TPHs to create and maintain a BCP regardless of the kind of business they perform on the Exchange. In particular, the proposed rule change will help ensure that TPHs are prepared in the event of a significant business disruption. This will seek to stabilize the market in the event a TPH, or multiple TPHs at the same time, face(s) a situation where their participation in the market place might be compromised. In addition, other exchanges [sic] have similar rules ^[8] requiring procedures in place for these situations, and, thus, the Exchange believes harmonizing these requirements would protect the marketplace as a whole.

The Exchange also believes the proposed rule change is consistent with Section 6(b)(1) of the Act,^[9] which provides that the Exchange be organized and have the capacity to be able to carry out the purposes of the Act and to enforce compliance by the Exchange's Trading Permit Holders and persons associated with its Trading Permit Holders with the Act, the rules and regulations thereunder, and the rules of the Exchange. Specifically, the Exchange believes that requiring TPHs to have a BCP helps to ensure TPHs have the ability to continue to comply with the Act and Exchange rules in instances of an emergency or other disruption.

B. Self-Regulatory Organization's Statement on Burden on Competition

CBOE does not believe that the proposed rule change will impose any burden on competition that is not necessary or appropriate in furtherance of the purposes of the Act. Specifically, the Exchange does not believe requiring TPHs to create and maintain a BCP will burden competition as it will not change any activity on the Exchange. Instead, the proposed rule change will require TPHs to have a plan to function as they normally do in the event of an emergency or other severe business disruption.

C. Self-Regulatory Organization's Statement on Comments on the Proposed Rule Change Received From Members, Participants or Others

The Exchange neither solicited nor received comments on the proposed rule change.

III. Date of Effectiveness of the Proposed Rule Change and Timing for Commission Action

Within 45 days of the date of publication of this notice in the Federal Register or within such longer period up to 90 days (i) as the Commission may designate if it finds such longer period to be appropriate and publishes its reasons for so finding or (ii) as to which the Exchange consents, the Commission will:

A. By order approve or disapprove such proposed rule change, or

B. institute proceedings to determine whether the proposed rule change should be disapproved.

IV. Solicitation of Comments

Interested persons are invited to submit written data, views, and arguments concerning the foregoing, including whether the proposed rule change is consistent with the Act. Comments may be submitted by any of the following methods:

Electronic Comments

• Use the Commission's Internet comment form (http://www.sec.gov/​rules/​sro.shtml ); or
• Send an email to [e-mail]. Please include File Number SR-CBOE-2013-045 on the subject line.

Paper Comments

• Send paper comments in triplicate to Elizabeth M. Murphy, Secretary, Securities and Exchange Commission, 100 F Street NE., Washington, DC 20549-1090.

All submissions should refer to File Number SR-CBOE-2013-045. This file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method. The Commission will post all comments on the Commission's Internet Web site (http://www.sec.gov/​rules/​sro.shtml ). Copies of the submission, all subsequent amendments, all written statements with respect to the proposed rule change that are filed with the Commission, and all written communications relating to the proposed rule change between the Commission and any person, other than those that may be withheld from the public in accordance with the provisions of 5 U.S.C. 552, will be available for Web site viewing and printing in the Commission's Public Reference Room, 100 F Street NE., Washington, DC 20549-1090, on official business days between the hours of 10:00 a.m. and 3:00 p.m. Copies of such filing also will be available for inspection and copying at the principal offices of the Exchange. All comments received will be posted without change; the Commission does not edit personal identifying information from submissions. You should submit only information that you wish to make available publicly. All submissions should refer to File Number SR-CBOE-2013-045, and should be submitted on or before June 5, 2013.

For the Commission, by the Division of Trading and Markets, pursuant to delegated authority.^[10]

Kevin M. O'Neill,

Deputy Secretary.

Footnotes

1.  15 U.S.C. 78s(b)(1).

2.  17 CFR 240.19b-4.

3.  In Amendment No. 1, the Exchange modified Exhibit 1 to provide a statutory basis for the proposed rule change.

4.  In Amendment No. 2, the Exchange modified Exhibit 1 to replace Section II.B, Self-Regulatory Organization's Statement on Burden on Competition.

5.  15 U.S.C. 78f(b).

6.  15 U.S.C. 78f(b)(5).

7.  Id.

8.  See Financial Industry Regulatory Authority Rule (“FINRA”) Rule 4370.

9.  15 U.S.C. 78f(b)(1).

10.  17 CFR 200.30-3(a)(12).