Business Continuity Plan (“BCP”)
I. Emergency Contact Persons
Welton Street (the “Firm”) has two emergency contact persons:
These names will be updated in the event of a material change, and our Executive
Representative will review them within 17 business days of the end of each year.
II. Firm Policy
Welton Street’s policy is to respond to a Significant Business Disruption
(SBD) by safeguarding employees’ lives and Firm property, making a financial
and operational assessment, quickly recovering and resuming operations, protecting
all of the Firm’s books and records, and allowing our customers to transact
business. In the event that we are unable to continue our business, we will promptly
update our website with contact information.
A. Significant Business Disruptions (“SBDs”)
Our plan anticipates two kinds of SBDs: internal and external. Internal SBDs affect
only our Firm’s ability to communicate and do business, such as a fire in
our building. External SBDs prevent the operation of the securities markets or a
number of firms, such as a terrorist attack, a city flood, or a wide-scale, regional
disruption. Our response to an external SBD relies more heavily on other organizations
and systems.
B. Approval and Execution Authority
Mark Quam, the Firm’s President, is responsible for approving the plan and
for conducting the required annual review. Mark Quam has the authority to execute
this BCP.
C. Plan Location and Access
Our Firm will maintain copies of its BCP plan and the annual reviews, and the changes
that have been made to it for inspection. An electronic copy of our plan is located
on our server.
III. Business Description
Our Firm acts as an agent for the sale of Direct Participation Programs (“DPP”)
offered by various plan sponsors. Our Firm does not perform any type of clearing
function for itself or others. Furthermore, we do not hold customer funds or securities.
We accept and enter orders. All transactions are sent to the Firm offering the DPP.
These firms also maintain our customers’ account information.
IV. Office Locations
Our Firm has one office which is located in Englewood, Colorado.
A. Office Location #1
Our home office is located at 9780 Mount Pyramid Court, Suite 400, Englewood, CO
80112. Our main telephone number is (888) 569-1031. Our employees may travel to
the home office by means of foot, car, train, or bus. We engage in order taking
and entry at this location.
V. Alternative Physical Location(s) of Employees
In the event our home office location becomes unavailable employees will be instructed
to work from home. Welton Street personnel have remote access capabilities via the
firms VPN site or the Welton Street website. All employees will receive training
on emergency procedures and system access. Emergency routing will allow forwarding
of all lines to a set of pre-determined phone numbers. If available the Welton Street
extranet site will detail the state of operations as well as methods for contact.
VI. Customers’ Access to Funds and Securities
Our Firm does not maintain custody of customers’ funds or securities, which
are maintained at the selling broker-dealer or their transfer agent or clearing
Firm. In the event of an internal or external SBD, if telephone service is available,
our registered persons will take customer orders or instructions and contact selling
plan sponsors on their behalf. If our Web access is available, we will post on our
site how customers may access their funds and securities. The site will also include
all available means to communicate with us. We will make this information available
to customers through our disclosure policy.
Our Firm is a member of the Securities Investor Protection Corporation (“SIPC”).
If SIPC determines that we are unable to meet our obligations to our customers or
if our liabilities exceed our assets in violation of Securities Exchange Act Rule
15c3-1, SIPC may seek to appoint a trustee to disburse our assets to customers.
We will assist SIPC and the trustee by providing our books and records identifying
customer accounts subject to SIPC regulation.
VII. Data Back-Up and Recovery (Hard Copy and Electronic)
Our Firm maintains its primary hard copy books and records and its electronic records
at 9780 Mount Pyramid Court, Suite 400, Englewood, Colorado 80112. Mark Quam is
responsible for the maintenance of these books and records. Our Firm maintains the
following document types and forms that are not transmitted to the selling plan
sponsor:
- New Account Forms and associated documents
- Customer Identification Records
- Firm financial records
Welton Street is in the process of securing remote back-up servers at an offsite
location to insure system availability. In the current environment all data is backed
up using the following procedures.
Welton Street maintains back-up copies of this critical information electronically
on our main server. Many of these records are maintained in PDF files. Mark Quam
is responsible for the maintenance of these back-up books and records. (In addition,
much of the client information is duplicated by the various plan sponsors selling
the DPPs.)
The Firm runs a data backup of all server data, email databases and network storage
locations to high capacity tape media each night of the week from Monday through
Friday nights. Tape library hardware is employed, which allows all of the above
mentioned data, for all servers, to be written to two backup tapes for each nightly
backup session.
The tapes utilized for the Monday through Thursday night backups remain inside the
library hardware and are copied over each week. These are used for short-term data
restores where the lost data being restored was lost less then a week ago.
The tapes utilized for Friday night backups are stored offsite with our Contractor,
Iron Mountain, on the Wednesday following the Friday night backup. There are five
(5) sets of Friday night back-up tapes that correspond to the weeks of any given
month. When there are only four (4) Fridays in a month, then only four (4) sets
of the Friday tapes are used, but if there happens to be five (5) Fridays in a month,
then all five (5) sets are used. These tapes remain with the Contractor until they
are needed again (e.g. the first Friday of a new month will overwrite the tapes
used on the first Friday on the previous month).
On the last business day of each month, a set of Monthly tapes is used, and then
stored with the Contractor until needed again on the last business day on the next
month. Also, on the last business day of the calendar year, a set of Yearly tapes
is used and then stored by the Contractor until needed again on the last business
day of the following year.
Tape backups are tested on a periodic basis by IT personnel by restoring data from
the tapes back to the servers in order to assure proper operation of the backup
software and tape library hardware. In addition, backup logs are monitored daily
as well as the backup server’s system logs in an effort to detect any problems
or discrepancies.
VIII. Financial and Operational Assessments
A. Operational Risk
In the event of an SBD, we will immediately identify what means will permit us to
communicate with our customers, employees, critical business constituents, critical
banks, critical counter-parties, and regulators. Although the effects of an SBD
will determine the means of alternative communication, the communications options
we will employ will include our Web site, telephone rerouting voice mail and email
etc. In addition, we will retrieve our key activity records as described in the
section above.
B. Financial and Credit Risk
In the event of an SBD, we will determine the value and liquidity of our investments
and other assets to evaluate our ability to continue to fund our operations and
remain in capital compliance. We will contact our sponsor firms, critical banks,
and investors to apprise them of our financial status. If we determine that we may
be unable to meet our obligations to those counter-parties or otherwise continue
to fund our operations, we will request additional financing from our bank or other
credit sources to fulfill our obligations to our customers and clients. If we cannot
remedy a capital deficiency, we will file appropriate notices with our regulators
and immediately take appropriate steps as recommended by them.
IX. Mission Critical Systems
Critical Information Systems and Allowable Downtime
The IT systems offered and supported by the IT department, in terms of recovery
from an SBD, can be split into the two categories of Mission Critical and Non-Mission
Critical. The IT department recognizes that all systems hold value and play important
roles in the daily operations of the companies, and that opinions may vary as to
the levels of importance of each system depending on a user’s function within
the business. The IT department will always strive to restore all supported information
systems as quickly as possible, but believes that adherence to the below hierarchy
of system restoration will advance the SBD recovery process and work toward the
greater goal of business continuity.
Systems deemed Mission Critical will carry a maximum allowable downtime, in the
event of an SBD, of 24 hours. Those other systems that are deemed Non-Mission Critical
will carry a maximum allowable downtime of 72 hours.
A. Mission Critical Systems
- Microsoft Exchange email servers (two)
- External telephone system
B. Non-Mission Critical Systems
- Wireless (mobile) email services
- Web server functionality
- MAS-90 accounting software
- Virtual Private Networking (VPN) connectivity
- User and company data storage
SBD Response and Action List
- Welton Street’s external telephone lines will be rerouted to employee cell
phones. Welton Street personnel will respond as quickly as possible to their calls.
- IT personnel will recover the most recent backup tapes from offsite, if none are
able to be recovered from the IT base of operations. IT personnel will then update
email servers latest email data available on tape and then put online for web mail
access.
- IT personnel will work to bring all Non-Mission Critical systems online and make
them available to users as quickly as possible either from the alternate location
or from the base of operations, if usable. All Non-Mission Critical systems will
be brought back online before the designated 72 hour deadline.
1. Order Taking
Currently, our Firm receives orders via telephone from registered representatives
in the field. During an SBD, either internal or external, we will continue to take
orders through the methods that are available and reliable, and in addition, as
communications permit, we will inform our customers what alternatives they have
to send their orders. Customers will be informed of alternatives through our website
or telephone calls from either home office or field personnel. If necessary, we
will advise our customers to place orders directly with plan sponsors.
2. Order Execution
We currently execute orders by sending appropriate closing documents to plan sponsors.
In the event of an internal SBD, in which we were unable to send documents ourselves,
we could have the clients send their documents directly to the plan sponsors. Remote
access capability will allow for receipt and transmission of most client documents
via FTP site.
X. Alternate Communications Between the Firm and Customers, Employees, and Regulators
A. Customers
We communicate with our customers using the telephone, email, Web site, fax, U.S.
mail, and in-person visits by registered representatives. In the event of an SBD,
we will assess which means of communication are still available to us, and use the
means closest in speed and form (written or oral) to the means that we have used
in the past. For example, if we have communicated with a party by email but the
Internet is unavailable, we will call them on the telephone and follow up where
a record is needed with paper copy in the U.S. mail.
B. Employees
We now communicate with our employees using the telephone, email, and in person.
In the event of an SBD, we will assess which means of communication are still available
to us, and use the means closest in speed and form (written or oral) to the means
that we have used in the past. We will also employ a call tree so that senior management
can reach all employees quickly during an SBD. The call tree includes all staff
home and office phone numbers.
C. Regulators
We are currently a member of the following SROs: Financial Industry Regulatory Authority
(FINRA). We communicate with our regulators using the telephone, email, fax, U.S.
mail, and in person. In the event of an SBD, we will assess which means of communication
are still available to us, and use the means closest in speed and form (written
or oral) to the means that we have used in the past to communicate with the other
party.
XI. Critical Business Constituents, Banks, and Counter-Parties
A. Business Constituents
We have contacted our critical business constituents (businesses with which we have
an ongoing commercial relationship in support of our operating activities, such
as vendors providing us critical services), and determined the extent to which we
can continue our business relationship with them in light of an internal or external
SBD. We will quickly establish alternative arrangements if a business constituent
can no longer provide the needed goods or services when we need them because of
an SBD to them or our Firm.
B. Banks
We have contacted our banks and lenders to determine if they can continue to provide
the financing that we will need in light of an internal or external SBD. If our
bank and other lenders are unable to provide the financing, we will seek alternative
financing immediately.
C. Counter-Parties
We have contacted our critical counter-parties, such as other broker-dealers or
plan sponsors, to determine if we will be able to carry out our transactions with
them in light of an internal or external SBD. Where the transactions cannot be completed,
we will contact those counter-parties directly to make alternative arrangements
to complete those transactions as soon as possible.
XII. Regulatory Reporting
Our Firm is subject to regulation by the Securities and Exchange Commission (“SEC”),
the Financial Industry Regulatory Authority (“FINRA”) and various state
regulatory agencies. We file reports with our regulators using paper copies via
the U.S. mail, and electronically using fax, email, and the Internet. In the event
of an SBD, we will consult with the SEC, FINRA, and other regulators as necessary
to determine which means of filing are still available to us, and use the means
closest in speed and form (written or oral) to our previous filing method. In the
event that we cannot contact our regulators, we will continue to file required reports
using the communication means available to us.
XIII. Disclosure of Business Continuity Plan
We provide in writing a BCP disclosure statement to customers at account opening.
We also post the disclosure statement on our website and mail it to customers upon
request.
XIV. Updates and Annual Review
We will update this plan whenever we have a material change to our operations, structure,
business or location. In addition, our Firm will review this BCP annually to modify
it for any changes in our operations, structure, business, or location or those
of our clearing Firm.