LPL Financial & Affiliate Enterprise Resiliency Strategy

LPL Financial Enterprise Resiliency Summary

I. Program Summary

Business continuity planning at LPL Financial is supported by an enterprise program and incorporated into the firm’s business processes for all affiliates and departments. The Enterprise Resiliency Program balances reasonable assessments of resiliency risk inclusive of business continuity, and disaster recovery and crisis management, placing the highest priority on the physical safety and security of our financial professionals and employees, while preparing for loss of facilities and technologies

LPL Financial, its teams, employees, and affiliated financial professionals cannot always guarantee mitigation or a specific recovery time following a disruption caused by large scale events, which may include government breakdown, or widespread interruption of public services or infrastructure. In those circumstances, LPL Financial’s teams, employees, and affiliated financial professionals will make every reasonable effort to resume normal business operations as quickly as possible.

II. Enterprise Resiliency Policy

LPL Financial governs its Enterprise Resiliency Program through a documented and implemented corporate policy reviewed and approved annually. LPL Financial and its affiliates recognize the importance of protecting our employees, financial professionals, and clients through business continuity, disaster recovery and crisis management practices. LPL Financial executes these practices to minimize operational risk, achieve business goals, and comply with laws, rules, and regulations to protect the firm and our clients.

The Enterprise Resiliency Policy applies to all employees of LPL Financial, its affiliates, third-party vendors, and partners. It establishes minimum requirements for maintaining the availability of mission critical business processes after an unplanned significant business disruption. The policy includes defining, maintaining and testing recovery plans for critical business processes and technology applications within all of LPL Financial’s business units so that they can remain operational after an unplanned business disruption.

Securities industry regulations require LPL Financial to create and maintain a business continuity plan tailored to its size and need, and reasonably designed to enable LPL Financial to meet its existing obligations to its clients or other counter-parties. In alignment with these regulatory requirements, the resiliency plan for LPL Financial is designed to address key areas of concern including, but not limited to, business continuity plans for the recovery of business processes, technology disaster recovery plans for the recovery of applications and infrastructure, and crisis management plans to support event response and coordination, providing coverage for all affiliates and business units.

At a minimum, the LPL Financial business continuity plan is reviewed, updated, and tested annually. Additionally, the firm’s primary internal and external application providers periodically conduct testing of their own back-up capabilities to ensure that, in the event of an emergency or significant business disruption, they will be able to provide LPL Financial with the critical services needed to continue its business.

III. Program Overview

Time is of the essence when confronted with an unplanned business disruption that impacts LPL Financial Operations. The Enterprise Resiliency Program focuses on regular assessment of the firm’s readiness for business disruption, accounting for employees and assembling leaders to execute their business continuity plans. In keeping with regulatory requirements, the business continuity plan for LPL Financial LLC and its affiliates is designed to address key areas of concern with the primary objective of providing uninterrupted service to financial professionals and clients by mitigating impacts, and recovering mission critical business processes and applications.

The program is examined periodically by internal auditors and regulatory examiners, and is designed to meet regulatory requirements and United States financial industry standards in all states where LPL Financial, LLC conducts business.

IV. Governance

The program is managed centrally within the Enterprise Risk Department, and provides governance and oversight for enterprise operational resiliency risks related to business continuity, disaster recovery, and crisis management activities.

V. Planning

All business units and subsidiaries must develop and maintain recovery plans commensurate with the criticality of the business processes as required under the established corporate policy. The criticality of a process is determined by a Business Impact Analysis (BIA) that drives the strategy, recovery time objective, recovery point objective, and frequency of testing. Each recovery plan adheres to a standard development lifecycle process, and meets specific design and data requirements.

VI. Testing

Business processes and their supporting technologies within LPL Financial are included in resiliency testing that assesses and validates controls and recovery capabilities, including response readiness for the firm to confirm it can operate as expected during an unplanned business disruption. The frequency of testing is determined by the criticality of the business processes and supporting technology with test results and compliance governance and oversight provided by the firm’s Enterprise Resiliency Team.

VII. Response Teams

Across the firm, LPL Financial has dedicated response teams with defined communications processes to ensure prompt dissemination of information to financial professionals, clients, and employees impacted by a business disruption. At the time of the event, the Enterprise Resiliency Team will lead efforts to engage the key stakeholders, assess the situation, assemble response and recovery teams, and act to mitigate operational impact.

VIII. Resiliency Resources

a. Human Capital

In keeping with LPL Financial’s focus on resiliency in the face of a business disruption, all business continuity plans include procedures for addressing temporary unavailability of staff during events like natural disasters, pandemics, and unplanned outages. Priority consideration is given to the life safety of employees and the community. Recovery activities that cannot be performed with reasonable security of injury or life safety will be deferred until deemed safe to perform.

b. Facilities

In the unlikely event of a citywide or regional disruption, and as part of its commitment to providing uninterrupted service to financial professionals and clients, LPL Financial’s business continuity plans include geographically dispersed backup facilities and other recovery locations for critical business processes, including off-site and virtual command centers, to direct response and recovery activities. In the event any such disruption occurs, LPL Financial has developed alternative service arrangements, systems, locations, and contingency plans to sustain critical processing and ensure any service affected is quickly restored.

c. Technology

LPL Financial has geographically dispersed data centers, employing advanced recovery and resilience technologies, to mitigate impacts and ensure recovery can be accomplished within established time objectives. Critical customer data and application services are backed up electronically, and intraday transactions are recorded to allow for data recovery. Tests of the recovery plans are conducted regularly.

Tracking number: 1-05369530