Don't invest unless you're prepared to lose all the money you invest. This is a high-risk investment and you shouldn't expect protection if something goes wrong.
Aurex Limited (hereafter referred to as “the Company” or “Aurex”) was incorporated in the Seychelles under incorporation number 810627-1.
The purpose of this Business Continuity Plan (in headereshe referred to as “BCP” or “the Plan”) is to prepare the Company in the event of business disruption caused by factors not foreseen and to restore services to the widest extent possible at a minimum time frame. The Company has put in place comprehensive business continuity procedures that are designed to minimize network failure and to recover as rapidly as possible when a failure occurs. The main factors that may cause business disruption include among others, disease, fire, natural disaster and cyber-attacks.
The BCP outlines the Company’s existing operations and risks that are expected to occur. Data will be received, stored and backed-up on a daily basis to an external drive that will be maintained at the Company’s premised in the Seychelles. The aforementioned data include intra-day trading data, static data, trading data and client positions, which will be backed-up every minute. The Company will also store company files and general business information.
Aurex utilized the back-up procedures for the relocation or the recovery of operations in response to varying levels of disruptions and also to archive certain information for regulatory and compliance purposes. The objectives of this BCP is inter alia, to ensure the health and safety of all staff, mitigate negative publicity, preserve and maintain relationships with clients, minimize financial loss as well as interruptions to the organization’s ability to provide its services.
The Company’s BCP evaluates the business disruption situation, makes financial and operational assessments and initiate the appropriate actions that need to be taken in order to protect all of Company’s books and records and allow clients to transact business. The Company’s procedures aim to protect the Company’s records, safeguard the employees’ personal information as well as the Company’s property and ensure the recovery of operation to allow for the continuation of business. Disaster Recovery Plans and Procedures are periodically tested to ensure continuous and reliable service to clients.
The Company may face significant risks, both internal and external. The latter includes disruptions that have influence only on the Company’s business, operations and ability to communicate with clients, employees and partners. An example is business disruption that occurs from fire. The former, affects the operations of the securities markets. Several factors that increase the likelihood of occurrence of external risks are terrorist attacks, flood and regional disruption.
The Company will take all appropriate measures to mitigate the risks. Firstly, in the event an internal or external risk occurs, the Company will immediately identify all the means that permit communications with clients, employees, critical business constituents, banks, counterparties and regulators. All the Company’s employees will be relocated from the affected office to another building. The employees will be able to access the Company’s systems and work remotely and the Company will be able to communicate with them through their cell phones.
The Company will implement effective procedures to safeguard clients’ funds as required by the Securities Conduct of Business Regulations 2008. The clients’ funds will be segregated from the Company’s funds and the Company will be performing frequent reconciliation. In addition, the Company will ensure that for the clients’ funds accounts correlated coding will be used in order to have them named as “Client Account(s)”. The Company’s business does not affect any securities transactions in relation to customer’s orders; therefore, client’s funds will be intact in the event a disaster occurs. Also, the Company will still have access to critical data, which are systems (data normally backed up in cloud), which is necessary for the monitoring of clients margins and positions. The customers will be able to close any open positions via telephone to the Company’s Dealing function. The responsible officer shall proceed with the relevant identification procedures before the closure of a position, such as request of client’s name, registered residential address, registered email address, client’s identification number, trading account number and /or other details so as to verify the client’s ID and crosscheck with Company’s records etc. The Company will use a robust electronic back-up system to maintain its electronic records. The electronic records include inter alia subscription agreements, trading records and internal accounting records. This system will be provided by a cloud service provider. The aforementioned service provider will be subject to a different power grid and the Company will have arrangements in place to move to a temporary office at a short notice if required. The back-up office will be serviced by a different telecommunications provider and it will be on a different power grid to the one that the Company will have on its primary office. Finally, the Company’s aim is to immediately identify and recover data as quickly as possible in the event of a disaster.
The moment the Company will be exposed to financial/market risks (i.e. the value of a trade/investment will change and due to moves in market factors the net aggregate client’s exposure may differentiate so these movements may affect the Company’s profitability) and credit risks (inability of liquidity providers or credit institutions to replace funds), the value and liquidity of the investments and other assets will be determined. The reason is to evaluate the Company’s ability to continue to fund its operations and at the same time remain in capital compliance. Every person that will be directly or indirectly affected by disruptions occurred from the financial/market and credit risks will be contacted and informed immediately about the current financial status of the Company. The Company will take into consideration the relevant amount to be kept as a contingency fund, in the event the Company is unable to continue funding its operations or meet its financial obligations. These funds will be held in the shareholders’ bank accounts and in case of the Company’s inability to fund its operations then the relevant contribution will be made by its shareholder(s). This amount will be equal to six months of operating expenses and approximately USD 92,300. If the Company still needs additional capital to fulfill its obligations, then supplementary financing will be requested from one of the banks or other credit institution with which the Company has financial affairs with. If the Company is still unable to restore its capital, then appropriate notices will be filed to the regulator and the relevant authorities as well as effective measures will be taken i.e. fulfilling all its obligations to its clients and employees, including the below. Please note that the Company will also follow any effective measures that the Authority may provide.
The Company may be also exposed to cyber-attacks or other technological risks. Despite the low probabilities of occurrence, the disruptions of such risks will have an impact on the Company. For example, client database could be stolen and the operations of information systems could be damaged. Therefore, proper controls will be placed in order to mitigate the risks. Firstly, virus and firewall protection will be in place. Furthermore, full and incremental back-ups will preserve all important documents and will be performed on a regular basis for audit logs and files that are considered critical. Back-up media will be stored in a secure, geographically separate location from the original and isolated from environmental hazards. Moreover, technical support will be provided by an affiliate company (as per the Company’s Business Plan). The said entity will facilitate technology recovery and restoration activities, providing guidance on replacement equipment and systems, as required. Finally, the aforementioned affiliate company will coordinate the removal of salvageable equipment at disaster site that may be used for alternate site operations.
The Company takes also into consideration its ability to operate as a going concern. When evaluating an entity’s ability to meet its obligations, the Company shall consider quantitative and qualitative information about the following conditions and events, among other relevant conditions and events known and reasonably knowable at the date that the financial statements are issued:
Should the Company concludes that it cannot continue as a going concern the following measures will be considered:
The Representative Officer (RO) will be responsible for notifying the management, employees, and other stakeholders of any emergency that may occur, assuming control of the situation, identifying the range and scope of damage involved, implementing plans, identifying infrastructure outages and coordinating support from internal and external sources. Furthermore, in regard to public relations management, communications management is essential to control rumors, maintain contact with the media, emergency services and vendors, and other stakeholders, and assure employees and the wider public. The directors will be designated as the principal contacts with the media, regulatory agency, government agencies and other external organizations.
An emergency relocation center will be the Company’s Registered Office in Seychelles, from where operations can be managed in the event of a disruption. Operations management will include recovering and restoration. Decisions must be taken whether to repair the facility, relocate to an alternate location, or build a new facility. Employees must be re-deployed, and additional resources must be acquired, to restore business operations.
In the event a disaster occurs, all the Company’s employees will need to follow a list of responsibilities. The moment an employee identifies a disaster or has reasons to believe that a disaster may occur, the employee must immediately report it to the RO. After that, the RO will determine and prioritise the tasks and actions to be performed and assign responsibilities for those tasks and actions. In addition, a meeting will be held to identify the internal and external needs. A record of all recovery tasks and actions will be maintained the firm’s servers.
This BCP is intended to be a living document and as such must be reviewed annually and updated on a regular basis. Also, the Plan will be stress tested where necessary. It is important to review the listing of delegated personnel of the BCP and the phone numbers contained within the plan regularly which can be found in Schedule 1. The Plan will be stored in a common location where it can be viewed by all staff members at any time. Also, all the Company’s employees will be provided with hard copies of the BCP.
Initially, the Company’s management will hold a meeting in order to get acquainted with the plan. After that, a meeting will be held on an annual basis to review the plan. The Company will maintain an accurate record of the locations of equipment suppliers, data storage locations, portable power generators and implementation plans. The Company will maintain copies of its BCP and the annual reviews, and the changes that have been made to it for inspection. An electronic copy of this Plan is located on the firm’s servers.