Communities need their banks to continue operating. Businesses need to know that funds can still be transferred; consumers need to be assured their paychecks get credited, and automatic payments will still get made. They can’t be left worrying that, on top of what else has befallen them, their bank account isn’t operating right. And while some customers hit hard by disaster might be understanding, customers spared significant interruption won’t be happy to find their bank not working as usual.
Every community bank and credit union has a disaster recovery plan. But that doesn’t mean every institution has a good one. Within the last 18 months, our region has suffered electrical outages that lasted for weeks, tornadoes that decimated neighborhoods, earthquakes that shook buildings, snowstorms that felled urban forests, mudslides, flooding and more. Being ready to operate in Disaster Recovery mode is no longer a “what if…” longshot scenario. Now it’s just a guessing game of “when” and “how often?”
That’s why it’s critical for community banks, especially, to understand what it means to be able to operate when disasters arrive, and to have everyone trained in what to do. Large national banks often have redundant systems and remote back office operations. If calamity visits Massachusetts, they can pick up from an operations center in North Carolina. But community banks don’t have as many options. And if they can’t operate at least close to normally when there’s a problem, consumers will find an institution that can.
Knowing The Drill
Where most local banks and credit unions fall down is not in realizing that they should have a disaster recovery plan, but in not testing it and updating it enough. It’s one thing to buy a fire extinguisher for your kitchen, but it doesn’t do you much good if the food is aflame and you can’t remember where you put it.
Smart banks test their plans repeatedly, and unexpectedly. At least annually, and preferably twice a year, employees should show up to work and find that they have to operate that day as though a natural disaster hit. There should be no warning, and no leeway. If the scenario is there’s no electricity, they should be operating in the dark. The phones shouldn’t work. Or if there’s a backup generator, they should be operating on only the amount of power the generator can supply.
At Bankers’ Bank Northeast, we routinely work with banks on this kind of testing. Frequently, we’ll get notice from a bank’s senior management that they intend to put their back office into “DR Mode” on a certain day, so we know they won’t be using normal procedures, and we’ll be ready to help guide their staff through things like processing wire transfers manually. But we also work with banks that don’t give us notice – that’s when they’re testing us, too, to see how well the backup to their backup handles things.
This kind of preparedness is particularly useful in ferreting out flaws in a plan, and in finding creative alternatives. For example, many institutions have thousands of ACH transactions in their pipelines – automatic withdrawals and deposits that their customers rely on. When there’s some advance warning of potential disaster coming – we knew Superstorm Sandy was coming days before it arrived – institutions can “warehouse” their ACH with their correspondent institution, allowing those automated debits and credits to occur even if the bank itself can’t initiate the action.
This kind of testing helps banks and credit unions understand all their options. So, of course, does actually operating through a real disaster. One thing many banks have discovered is that it might be smart to stock up on cash when calamity is imminent. Once it strikes, if roadways get shut down, getting more cash might be difficult. And no bank wants to tell its customers that it’s “out of money.”
But one critical area that often needs the most attention is also one of the simplest things to get right. When banks go into Disaster Recovery mode, they need to interact with their own providers. But those providers – be they a correspondent bank, the Fed, FHLB or third party operations center – can’t just deal with anyone at the bank. Each has a list of authorized personnel. Too often, though, that list is out of date – it’s not uncommon in a list of five names to see two, three or four of those people no longer employed at the bank. If that happens when a real disaster occurs, the bank better hope that the last one or two people aren’t on vacation. Better to simply keep the contact list updated. In addition, it’s important the authorized personnel have their security code/password on hand so that the provider can accurately identify and authorize the requested transaction.
Customers want, and need, to be able to count on their bank, no matter what. By testing, reviewing, and staying prepared, community banks can be sure they’re able to operate when their communities need them the most. Test now test often, and review everything. After all, snow is coming.
Crystal Sides is senior vice president and enterprise risk manager for Bankers’ Bank Northeast. The bank, based in Glastonbury, Conn., serves more than 200 community banks and credit unions throughout New England, New York and New Jersey.
