Broker Outages: What Recovery Plans Mean for Your Money

Picture the moment your trading app freezes on a busy morning. You have an order half-filled, a stop-loss you want to move, and a nagging feeling that the market is not waiting for anyone. In that moment, the most important thing about your broker is not its logo or its advertising. It is whether a backup system is quietly humming in the background, ready to take over.

That background machinery is what regulators call operational resilience: a firm's ability to keep delivering its important services through disruption, and to recover sensibly when it cannot. In the UK, the Financial Conduct Authority (FCA) expects firms to map the people, processes, technology, facilities and information needed to deliver each important business service, including dependencies on third parties. It also requires firms to set and stay within an impact tolerance — the maximum disruption they can absorb before harm becomes unacceptable, judged by factors such as the number of clients affected, potential client losses, and the vulnerability of the client base.

Nothing about that is a personal recommendation or a promise. It is a description of the guardrails regulators have built, and why they matter to an ordinary investor staring at a spinning wheel.

The parts of the plan that touch your account

Three technical ideas sit underneath all of this. First, failover: the switch from a primary system to a backup, ideally so smooth that you never notice. Second, RTO, or recovery time objective: the target for how long a disrupted service can take to come back. Third, RPO, or recovery point objective: how much recent data — say, the last few minutes of order records — a firm can afford to lose in a restore. Think of RTO as "how long until the lights come back" and RPO as "how much of yesterday's handwritten notes got saved before the power cut."

These are not abstract engineering preferences. In the US, FINRA's Rule 4370 requires broker-dealers to create, maintain and review at least annually a written business continuity plan (BCP) for emergencies or significant business disruptions. The plan must be appropriate to the scale and scope of the business, and must cover, at minimum, data backup and recovery, mission critical systems, alternate communications with customers and staff, alternate physical locations, and how the firm will assure customers prompt access to their funds and securities if it decides it cannot continue operating. Firms must disclose a summary of that plan to customers at account opening, post it on their website if they have one, and mail it on request. The point, as FINRA explains, is to help customers make informed decisions about where to keep their money.

Notably, firms do not have to hand over the plan itself. They summarise how they would respond to disruptions of varying scope — a building, a city, a region — and may mention backup arrangements without revealing exact locations. So when you read one, look for specifics: alternative phone numbers, clearing firm details, and realistic estimates of recovery time.

Custody rules are the quiet safety net

There is a second layer that has little to do with software and everything to do with where your assets actually sit. In the US, the Customer Protection Rule — SEC Rule 15c3-3 — requires broker-dealers to maintain physical possession or control of fully paid and excess margin securities carried for customers, and to hold cash in a separate reserve bank account for the exclusive benefit of customers, calculated under a prescribed formula. Financially, it is the difference between your shares being yours and your shares being a line item in someone else's liquidity plan.

This matters during outages because a technology failure and a solvency problem are not the same thing, and the safeguards are designed for different jobs. A good failover protects access. Segregation protects ownership. You want both, and one does not excuse the other.

What regulators have learned from real outages

FINRA's own review of Rule 4370 found recurring weak spots across firms: mission critical systems that were incomplete, notably cybersecurity tools and trading desk or vendor systems; insufficient capacity to handle a surge of customer enquiries during an incident; plans not updated when firms adopted new technology; emergency contact details left stale as staff came and went; and critical documents that were unreachable when primary systems went down. None of these are exotic. They are the compliance equivalent of discovering the fire extinguisher is empty — an unhelpful surprise at precisely the wrong time.

One enforcement case is instructive without being a morality tale about any single firm. A large self-directed platform suffered repeated outages that stopped customers trading and reaching funds. FINRA found that its business continuity plan was not reasonably designed to meet customer obligations: the plan said orders could be taken through "other methods" without naming any, claimed clients could be reached by phone despite no telephone line being available, and focused on physical disruptions while overlooking technological ones such as third-party outages. The firm was fined and ordered to pay customer reparations and overhaul its plan. The lesson for clients is plain: a template copied from elsewhere is not a plan.

Third parties, the cloud and the limits of blame

Most modern brokers lean on outside providers — cloud hosting, market data, clearing, network infrastructure. The FCA is explicit that firms cannot delegate regulatory responsibility to a third party, and that intra-group outsourcing to a parent or sister company must meet the same requirements as outsourcing to a stranger. Cloud services delivering important business functions are treated as a form of potentially material outsourcing. The FCA, Bank of England and PRA have also begun jointly overseeing critical third parties whose failure could threaten confidence in the UK financial system — while stressing that firms, boards and senior management remain accountable for their own resilience.

Jurisdiction matters here, and it matters a lot. The rules described above are UK and US frameworks; other markets have their own supervisors, timelines and thresholds. The FCA has said new incident reporting and third party notification requirements for financial services firms will come into force on 18 March 2027, following publication of the requirements in March 2026, with firms given 12 months to prepare. If you hold accounts across borders, do not assume the protections travel with you.

Questions worth asking before the lights flicker

You cannot audit your broker, but you can read what it publishes. Does the continuity disclosure name actual alternate contact routes, or just promise "other channels"? Does it address technology and vendor failures, not only fires and floods? Does it explain how you would reach your funds if the firm stopped operating? Regulators have been clear that membership of an investor protection scheme does not, by itself, discharge a firm's continuity obligations.

And notice the pattern in the supervisory guidance: review annually, test what you can, update when the business changes, and keep contact details current. That is not glamorous. Resilient plumbing rarely is — until the day it is the only thing standing between you and a very long morning.

None of this removes uncertainty. Outages happen, backups sometimes disappoint, and rules differ by country and by the type of firm you use. What the obligations do is make resilience a documented, testable expectation rather than a hopeful vibe — and give you a fair set of questions to ask before you need the answer.