Business Continuity Planning – Disclosure Statement

Introduction

In this Business Continuity Disclosure Statement, learn how Raymond James works to mitigate risks inherent in unforeseen business interruptions.

With Business Continuity in Mind

Raymond James institutes the best practices developed by industry organizations for creating practical and effective business continuity plans. The firm periodically conducts a Business Impact Analysis (BIA) of business processes. This analysis identifies risks, critical processes, and related dependencies (both technology dependencies and dependencies on other processes).

Armed with this information, each business area prioritizes recovery procedures, since some processes have more urgent restoration requirements than others. Each business area also creates continuity plans that are reviewed by the Business Continuity Management team to ensure they meet appropriate guidelines and can be properly coordinated with the plans of other business areas. Each business continuity plan takes into consideration the response to building, personnel, technology and supplier outages.

To diminish risks posed by local and regional disruptions, Raymond James maintains geographically dispersed operational locations as part of its overall resiliency. In the event of an emergency at the St. Petersburg international headquarters, off-site locations are staffed to continue production work. Additionally, critical personnel have the ability to work remotely to address scenarios like severe weather or pandemic.

A Dedicated Team

Raymond James established the Business Continuity Management (BCM) group, a dedicated team of professionals that oversees the firm’s business continuity management strategy. BCM works closely with business units and the Information Technology department to employ a standardized framework for building, maintaining and testing business continuity plans. Firm plans are created using an all-hazards approach, including baseline requirements and strategies that address incidents of varying scope.

Leading Incident Management

A corporate Crisis Management function, comprised of senior management representing key areas of the firm, manages incidents that might affect the firm’s associates and clients. Crisis Management assesses and directs the firm’s response to an incident, ensuring the safety and security of all associates and continuity of critical processes. The decision to enact the plan would be made by the Crisis Management Team, with advisement from the Executive Committee. The firm also maintains plans that cover the response procedures related to these types of incidents, including severe weather, infectious disease, and cyber threats.

About the Technology and Data Recovery Process

Raymond James employs a dual-data-center strategy in which critical client data and systems housed at the primary location are replicated at an alternate location, ensuring accessibility. It is the firm’s goal to recover from an event requiring a processing switch to the alternate site with minimal disruption to core business functions. In addition, data retention and backup procedures are in place, including tape backup and offsite storage, offering a tertiary layer of data accessibility should the need arise. Our main data center, located in Colorado, is protected with redundant equipment, UPS, and generators. Raymond James uses data replication to the back-up data center in Michigan and so that most applications will not lose more than 15 minutes’ worth of data. The recovery time for the majority of our critical applications is 24 hours.

Plan Testing and Validation

To assess recovery capability, periodic testing is vital. Therefore, Raymond James requires that all Business Continuity and Disaster Recovery plans be tested on a regular basis. The amount and frequency of Business Continuity Plan testing is determined by a risk based approach, with critical processes tested on an annual basis. Testing takes into consideration building, personnel, technology and supplier outages. The firm also maintains incident response plans that cover hazards related to these types of incidents including severe weather, infectious disease and cyber threat plans.

In addition, the firm reviews recovery plans on a regular basis to ensure they are compliant with standards and are maintained according to the guidelines established by the BCM team. The BCM team assists the business with designing plans to allow for continued operations of critical business functions, including providing clients with prompt access to their funds and securities.

Raymond James Keeps Clients Informed

Providing stakeholders with information about the crisis is a key component of the Raymond James Crisis Management protocol. In the event of a business disruption, clients can obtain information about the status of their accounts and access to their funds and securities by contacting their financial advisors. If their financial advisors are unavailable, clients can contact Client Services at 1-800-647-7378. In addition, clients can find up-to-date information about the operating status of the firm athttp://www.raymondjames.com. For questions or more information about Business Continuity at Raymond James, contact the Business Continuity Office at BusinessContinuity@RaymondJames.com.

The Nature of Events: Limitations Disclaimer

Due to the unpredictable nature of events causing significant business disruptions, Raymond James does not guarantee that systems will always be available or recoverable within the timeframes noted above.