# Regulation Systems Compliance and Integrity > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2013-05888 ## Record - **Collection:** Federal Register - **Document type:** Proposed Rule - **Published:** March 25, 2013 - **Citation:** 78 FR 18084 ## Text SECURITIES AND EXCHANGE COMMISSION 17 CFR Parts 242 and 249 [Release No. 34-69077; File No. S7-01-13] RIN 3235-AL43 Regulation Systems Compliance and Integrity AGENCY: Securities and Exchange Commission. ACTION: Proposed rule and form; proposed rule amendment. SUMMARY: The Securities and Exchange Commission (“Commission”) is proposing Regulation Systems Compliance and Integrity (“Regulation SCI”) under the Securities Exchange Act of 1934 (“Exchange Act”) and conforming amendments to Regulation ATS under the Exchange Act. Proposed Regulation SCI would apply to certain self-regulatory organizations (including registered clearing agencies), alternative trading systems (“ATSs”), plan processors, and exempt clearing agencies subject to the Commission's Automation Review Policy (collectively, “SCI entities”), and would require these SCI entities to comply with requirements with respect to their automated systems that support the performance of their regulated activities. DATES: Comments should be submitted on or before May 24, 2013. ADDRESSES: Interested persons should submit comments by any of the following methods: Electronic Comments Use the Commission's Internet comment form ( http://www.sec.gov/rules/proposed.shtml ); or Send an email to rule-comments@sec.gov . Please include File Number S7-01-13 on the subject line; or Use the Federal eRulemaking Portal ( http://www.regulations.gov ). Follow the instructions for submitting comments. Paper Comments Send paper comments in triplicate to Elizabeth M. Murphy, Secretary, Securities and Exchange Commission, 100 F Street NE., Washington, DC 20549-1090. All comment letters should refer to File No. S7-01-13. This file number should be included on the subject line if email is used. To help us process and review your comments more efficiently, please use only one method. The Commission will post all comments on the Commission's Internet Web site ( http://www.sec.gov/rules/proposed.shtml ). Comments are also available for public inspection and copying in the Commission's Public Reference Room, 100 F Street NE., Washington, DC 20549 on official business days between the hours of 10 a.m. and 3 p.m. All comments received will be posted without change; we do not edit personal information from submissions. You should submit only information that you wish to make publicly available. FOR FURTHER INFORMATION CONTACT: Heidi Pilpel, Special Counsel, Office of Market Supervision, at (202) 551-5666, Sara Hawkins, Special Counsel, Office of Market Supervision, at (202) 551-5523, Jonathan Balcom, Special Counsel, Office of Market Supervision, at (202) 551-5737, Yue Ding, Attorney, Office of Market Supervision, at (202) 551-5842, Dhawal Sharma, Attorney, Office of Market Supervision, at (202) 551-5779, Elizabeth C. Badawy, Senior Accountant, Office of Market Supervision, at (202) 551-5612, and Gordon Fuller, Senior Special Counsel, Office of Market Operations, at (202) 551-5686, Division of Trading and Markets, Securities and Exchange Commission, 100 F Street NE., Washington, DC 20549-7010. SUPPLEMENTARY INFORMATION: Proposed Regulation SCI would supersede and replace the Commission's current Automation Review Policy (“ARP”), established by the Commission's two policy statements, each titled “Automated Systems of Self-Regulatory Organizations,” issued in 1989 and 1991. 1 Regulation SCI also would supersede and replace aspects of those policy statements codified in Rule 301(b)(6) under the Exchange Act, 2 applicable to significant-volume ATSs. 3 Proposed Regulation SCI would require SCI entities to establish written policies and procedures reasonably designed to ensure that their systems have levels of capacity, integrity, resiliency, availability, and security adequate to maintain their operational capability and promote the maintenance of fair and orderly markets, and that they operate in the manner intended. It would also require SCI entities to mandate participation by designated members or participants in scheduled testing of the operation of their business continuity and disaster recovery plans, including backup systems, and to coordinate such testing on an industry- or sector-wide basis with other SCI entities. In addition, proposed Regulation SCI would require notices and reports to be provided to the Commission on a new proposed Form SCI regarding, among other things, SCI events and material systems changes, and would require SCI entities to take corrective action upon any responsible SCI personnel becoming aware of SCI events. SCI events would be defined to include systems disruptions, systems compliance issues, and systems intrusions. The proposed regulation would further require that information regarding certain types of SCI events be disseminated to members or participants of SCI entities. In addition, proposed Regulation SCI would require SCI entities to conduct a review of their systems by objective personnel at least annually, and would require SCI entities to maintain certain books and records. The Commission also is proposing to modify the volume thresholds in Regulation ATS 4 for significant-volume ATSs, apply them to SCI ATSs (as defined below), and move this standard from Regulation ATS to proposed Regulation SCI. 1 See Securities Exchange Act Release Nos. 27445 (November 16, 1989), 54 FR 48703 (November 24, 1989) (“ARP I Release” or “ARP I”) and 29185 (May 9, 1991), 56 FR 22490 (May 15, 1991) (“ARP II Release” or “ARP II” and, together with ARP I, the “ARP policy statements”). 2 See 17 CFR 242.301(b)(6). See also Securities Exchange Act Release No. 40760 (December 8, 1998), 63 FR 70844 (December 22, 1998) (“ATS Release”). 3 See infra note 26. 4 17 CFR 242.300-303 (“Regulation ATS”). Table of Contents I. Background A. History and Evolution of the Automation Review Policy Inspection Program B. Evolution of the Markets Since the Inception of the ARP Inspection Program C. Successes and Limitations of the Current ARP Inspection Program D. Recent Events II. Proposed Codification and Enhancement of ARP Inspection Program III. Proposed Regulation SCI A. Overview B. Proposed Rule 1000(a): Definitions Establishing the Scope of Regulation SCI 1. SCI Entities 2. Definition of SCI Systems and SCI Security Systems 3. SCI Events a. Systems Disruption b. Systems Compliance Issue c. Systems Intrusion d. Dissemination SCI events 4. Material Systems Changes C. Proposed Rule 1000(b): Obligations of SCI Entities 1. Policies and Procedures to Safeguard Capacity, Integrity, Resiliency, Availability, and Security a. Proposed Rule 1000(b)(1)(i) b. Proposed Rule 1000(b)(1)(ii) 2. Systems Compliance 3. SCI Events—Action required; Notification a. Corrective Action b. Commission Notification c. Dissemination of Information to Members or Participants 4. Notification of Material Systems Changes 5. Review of Systems 6. Periodic Reports 7. Proposed Rule 1000(b)(9): SCI Entity Business Continuity and Disaster Recovery Plans Testing Requirements for Members or Participants D. Proposed Rule 1000(c)-(f): Recordkeeping, Electronic Filing on Form SCI, and Access 1. Recordkeeping Requirements 2. Electronic Submission of Reports, Notifications, and Other Communications on Form SCI 3. Access to the Systems of an SCI Entity E. New Proposed Form SCI 1. Notice of SCI Events Pursuant to Proposed Rule 1000(b)(4) 2. Notices of Material Changes Pursuant to Proposed Rule 1000(b)(6) 3. Reports Submitted Pursuant to Rule 1000(b)(8) 4. Notifications of Member or Participant Designation Standards and List of Designees Pursuant to Proposed Rule 1000(b)(9) 5. Other Information and Electronic Signature F. Request for Comment on Applying Proposed Regulation SCI to Security-Based Swap Data Repositories and Security-Based Swap Execution Facilities G. Solicitation of Comment Regarding Potential Inclusion of Broker-Dealers, Other than SCI ATSs, and Other Types of Entities IV. Paperwork Reduction Act V. Economic Analysis A. Background B. Economic Baseline C. Consideration of Costs and Benefits, and the Effect on Efficiency, Competition, and Capital Formation D. Request for Comment on Economic Analysis VI. Consideration of Impact on the Economy VII. Regulatory Flexibility Act Certification VIII. Statutory Authority and Text of Proposed Amendments I. Background A. History and Evolution of the Automation Review Policy Inspection Program Section 11A(a)(2) of the Exchange Act, 5 enacted as part of the Securities Acts Amendments of 1975 (“1975 Amendments”), 6 directs the Commission, having due regard for the public interest, the protection of investors, and the maintenance of fair and orderly markets, to use its authority under the Exchange Act to facilitate the establishment of a national market system for securities in accordance with the Congressional findings and objectives set forth in Section 11A(a)(1) of the Exchange Act. 7 Among the findings and objectives in Section 11A(a)(1) is that “[n]ew data processing and communications techniques create the opportunity for more efficient and effective market operations” 8 and “[i]t is in the public interest and appropriate for the protection of investors and the maintenance of fair and orderly markets to assure * * * the economically efficient execution of securities transactions.” 9 In addition, Sections 6(b), 15A, and 17A(b)(3) of the Exchange Act impose obligations on national securities exchanges, national securities associations, and clearing agencies, respectively, to be “so organized” and “[have] the capacity to * * * carry out the purposes of [the Exchange Act].” 10 5 15 U.S.C. 78k-1(a)(2). 6 Public Law 94-29, 89 Stat. 97 (1975). 7 15 U.S.C. 78k-1(a)(1). 8 Section 11A(a)(1)(B) of the Exchange Act, 15 U.S.C. 78k-1(a)(1)(B). 9 Section 11A(a)(1)(C)(i) of the Exchange Act, 15 U.S.C. 78k-1(a)(1)(C)(i). Further, the Senate Committee Report accompanying the 1975 Amendments states further that a paramount objective of a national market system is “the maintenance of stable and orderly markets with maximum capacity for absorbing trading imbalances without undue price movements.” Senate Comm. On Banking, Housing and Urban Affairs, Report to accompany S. 249, Sen. Rep. 94-75, 94th Cong., 1st Sess. at 7 (1975). 10 See Sections 6(b)(1), 15A(b)(2), and 17A(b)(3) of the Exchange Act, 15 U.S.C. 78f(b)(1), 78 o -3(b)(2), 78q-1(b)(3), respectively. See also Section 2 of the Exchange Act, 15 U.S.C. 78b, and Section 19 of the Exchange Act, 15 U.S.C. 78s. For over two decades, Commission staff has worked with SROs to assess their automated systems under the Commission's ARP inspection program (“ARP Inspection Program”), a voluntary information technology review program created in response to the October 1987 market break. 11 In 1989, the Commission published ARP I, its first formal policy statement regarding steps that SROs should take in connection with their automated systems. 12 In ARP I, the Commission discussed the development by SROs of automated execution, market information, and trade comparison systems to accommodate increased trading activity from the 1960s through the 1980s. 13 The Commission acknowledged improvements in efficiency during that time period, but noted that the October 1987 market break had exposed that automated systems remained vulnerable to operational problems during extreme high volume periods. The Commission also expressed concern about the potential for systems failures to negatively impact public investors, broker-dealer risk exposure, and market efficiency. 14 The Commission further stated in ARP I that market movements should be “the result of market participants' changing expectations about the direction of the market for a particular security, or group of securities, and not the result of investor confusion or panic resulting from operational failures or delays in SRO automated trading or market information systems.” 15 The Commission issued ARP I as a result of these concerns, and stated that SROs should “establish comprehensive planning and assessment programs to test systems capacity and vulnerability.” 16 In particular, the Commission recommended that each SRO should: (1) Establish current and future capacity estimates for its automated order routing and execution, market information, and trade comparison systems; (2) periodically conduct capacity stress tests to determine the behavior of automated systems under a variety of simulated conditions; and (3) contract with independent reviewers to assess annually whether these systems could perform adequately at their estimated current and future capacity levels and have adequate protection against physical threat. 17 In addition, ARP I called for each SRO to have its automated systems reviewed annually by an “independent reviewer.” 18 11 See ARP I, supra note 1, 54 FR 48706. 12 See ARP I, supra note 1, 54 FR 48705-48706, stating that SROs should “take certain steps to ensure that their automated systems have the capacity to accommodate current and reasonably anticipated future trading volume levels and respond to localized emergency conditions.” In ARP I, the Commission also defined the terms “automated systems” and “automated trading systems” to refer “collectively to computer systems for listed and OTC equities, as well as options, that electronically route orders to applicable market makers and systems that electronically route and execute orders, including the data networks that feed the systems * * * [and encompass] systems that disseminate transaction and quotation information and conduct trade comparisons prior to settlement, including the associated communication networks.” See id. at n. 21. See also id. at n. 26 (stating that the Commission may suggest expansion of the ARP I policy statement to cover “other SRO computer-driven support systems for, among other things, clearance and settlement, and market surveillance, if the Commission finds it necessary to ensure the maintenance of fair and orderly markets”). 13 See id. at 48705. 14 See id. at 48705. The Commission noted that problems encountered by trading systems during the October 1987 market break included: (i) Inadequate computer capacity causing queues of unprocessed orders to develop that, in turn, resulted in significant delays in order execution; (ii) inadequate contingency plans to accommodate increased order traffic; (iii) delays in the transmission of transaction reports to both member firms and markets; and (iv) delays in order processing. 15 See id. at 48705. 16 See id. at 48705-48706. 17 See id. at 48706-48707. With respect to capacity estimates and testing, the Commission urged SROs to institute procedures for stress testing using “standards generally set by the computer industry,” and report the results of stress testing to Commission staff. The Commission also requested comment on whether it should mandate specific standards for the SROs to follow, and if so, what those standards should be. See id. With respect to vulnerability of systems to external and internal threat, the Commission requested in ARP I that SROs assess the susceptibility of automated systems to computer viruses, unauthorized use, computer vandalism, and failures as result of catastrophic events (such as fire, power outages, and earthquakes), and promptly notify Commission staff of any instances in which unauthorized persons gained or attempted to gain access to SRO systems, and follow up with a written report of the problem, its cause, and the steps taken to prevent a recurrence. 18 See id. In 1991, the Commission published ARP II. 19 In ARP II, the Commission further articulated its views on how SROs should conduct independent reviews. 20 ARP II stated that such reviews and analysis should: “(1) Cover significant elements of the operations of the automation process, including the capacity planning and testing process, contingency planning, systems development methodology and vulnerability assessment; (2) be performed on a cyclical basis by competent and independent audit personnel following established audit procedures and standards; and (3) result in the presentation of a report to senior SRO management on the recommendations and conclusions of the independent reviewer, which report should be made available to Commission staff for its review and comment.” 21 19 See ARP II Release, 56 FR 22490, supra note 1. 20 See id. 21 See id. at 22491. In ARP II the Commission also explained that, in its view, “a critical element to the success of the capacity planning and testing, security assessment and contingency planning processes for [automated] systems is obtaining an objective review of those planning processes by persons independent of the planning process to ensure that adequate controls and procedures have been developed and implemented.” Id. In addition, ARP II addressed how SROs should notify the Commission of material systems changes and significant systems problems. Specifically, ARP II stated that SROs should notify Commission staff of significant additions, deletions, or other changes to their automated systems on an annual and an as-needed basis, as well as provide real-time notification of unusual events, such as significant outages involving automated systems. 22 Further, in ARP II, the Commission again suggested development of standards to meet the ARP policy statements, stating that “the SROs, and other interested parties should begin the process of exploring the establishment of (1) standards for determining capacity levels for the SROs' automated trading systems; (2) generally accepted computer security standards that would be effective for SRO automated systems; and (3) additional standards regarding audits of computer systems.” 23 22 See id. at 22491. 23 See id. The current ARP Inspection Program was developed by Commission staff to implement the ARP policy statements, 24 and has garnered participation by all active registered clearing agencies, all registered national securities exchanges, the Financial Industry Regulatory Authority (“FINRA”), the only registered national securities association, one exempt clearing agency, and one ATS. 25 In 1998, the Commission adopted Regulation ATS which, among other things, imposed by rule certain aspects of ARP I and ARP II on significant-volume ATSs. 26 Thereafter, administration of these aspects of Regulation ATS was incorporated into the ARP Inspection Program. 24 While participation in the ARP Inspection Program is voluntary, the underpinnings of ARP I and ARP II are rooted in Exchange Act requirements. See supra notes 5-10 and accompanying text. 25 See infra note 91 and accompanying text. One ATS currently complies voluntarily with the ARP Inspection Program. However, ARP staff has conducted ARP inspections of other ATSs over the course of the history of the ARP Inspection Program. See also infra notes, 134-135 and accompanying text. 26 See Rule 301(b)(6) of Regulation ATS, 17 CFR 242.301(b)(6). With regard to systems that support order entry, order routing, order execution, transaction reporting, and trade comparison, Regulation ATS requires significant-volume ATSs to: establish reasonable current and future capacity estimates; conduct periodic capacity stress tests of critical systems to determine their ability to accurately, timely and efficiently process transactions; develop and implement reasonable procedures to review and keep current system development and testing methodology; review system and data center vulnerability to threats; establish adequate contingency and disaster recovery plans; perform annual independent reviews of systems to ensure compliance with the above listed requirements and perform review by senior management of reports containing the recommendations and conclusions of the independent review; and promptly notify the Commission of material systems outages and significant systems changes. See Rule 301(b)(6)(ii) of Regulation ATS, 17 CFR 242.301(b)(6)(ii). Regulation ATS defines significant-volume ATSs as ATSs that, during at least 4 of the preceding 6 calendar months, had: (i) with respect to any NMS stock, 20 percent or more of the average daily volume reported by an effective transaction reporting plan; (ii) with respect to equity securities that are not NMS stocks and for which transactions are reported to a self-regulatory organization, 20 percent or more of the average daily volume as calculated by the self-regulatory organization to which such transactions are reported; (iii) with respect to municipal securities, 20 percent or more of the average daily volume traded in the United States; or (iv) with respect to corporate debt securities, 20 percent or more of the average daily volume traded in the United States. See Rule 301(b)(6)(i) of Regulation ATS, 17 CFR 242.301(b)(6)(i). Under the ARP Inspection Program, staff in the Commission's Division of Trading and Markets (“ARP staff”) conduct inspections of ARP entity systems, attend periodic technology briefings presented by ARP entity staff, monitor the progress of planned significant system changes, and respond to reports of system failures, disruptions, and other systems problems of ARP entities. An ARP inspection typically includes ARP staff review of information technology documentation, testing of selected controls, and interviews with information technology staff and management of the ARP entity. 27 27 ARP inspections are typically conducted independently from the inspections and examinations of SROs, ATSs, and broker-dealers conducted by staff in the Commission's Office of Compliance Inspections and Examinations (“OCIE”) for compliance with the federal securities laws and rules thereunder. Just as markets have become increasingly automated and information technology programs and practices at ARP entities have changed, ARP inspections also have evolved considerably over the past 20 years. Today, the ARP Inspection Program covers nine general inspection areas, or information technology “domains:” application controls; capacity planning; computer operations and production environment controls; contingency planning; information security and networking; audit; outsourcing; physical security; and systems development methodology. 28 The goal of an ARP inspection is to evaluate whether an ARP entity's controls over its information technology resources in each domain are consistent with ARP and industry guidelines, 29 as identified by ARP staff from a variety of information technology publications that ARP staff believes reflect industry standards for securities market participants. 28 Each domain itself contains subcategories. For example, “contingency planning” includes business continuity, disaster recovery, and pandemic planning, among other things. 29 The domains covered during an ARP inspection depend in part upon whether the inspection is a regular inspection or a “for-cause” inspection. Typically, however, to make the most efficient use of resources, a single ARP inspection will cover fewer than nine domains. Most recently, these publications have included, among others, publications issued by the Federal Financial Institutions Examination Council (“FFIEC”) and the National Institute of Standards and Technology (“NIST”). 30 ARP staff has also relied on the 2003 Interagency White Paper on Sound Practices to Strengthen the Resiliency of the U.S. Financial System 31 and the 2003 Policy Statement on Business Continuity Planning for Trading Markets. 32 Since 2003, however, the Commission has not issued formal guidance on which publications establish the most appropriate guidelines for ARP entities. At the conclusion of an ARP inspection, ARP staff typically issues a report to the ARP entity with an assessment of its information technology program with respect to its critical systems, including any recommendations for improvement. 30 Other examples of publications that ARP staff has referred to include those issued by the Center for Internet Security ( http://benchmarks.cisecurity.org/en-us/?route=downloads.benchmarks ); Information Systems Audit and Control Association ( Control Objections for Information Technology Framework, available at: http://www.isaca.org/Knowledge-Center/cobit/Pages/COBIT-Online.aspx); Defense Information Systems Agency, Security Technical Implementation Guides (available at http://iase.disa.mil/stigs/index.html ); and Government Accountability Office ( Federal Information System Controls Audit Manual (February 2009), available at: http://www.gao.gov/assets/80/77142.pdf ). 31 See Securities Exchange Act Release No. 47638 (April 7, 2003), 68 FR 17809 (April 11, 2003) (Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial Systems) (“2003 Interagency White Paper”). 32 See Securities Exchange Act Release No. 48545 (September 25, 2003), 68 FR 56656 (October 1, 2003) (Policy Statement: Business Continuity Planning for Trading Markets) (“2003 Policy Statement on Business Continuity Planning for Trading Markets”). Another significant aspect of the ARP Inspection Program relates to the monitoring of planned significant systems changes and reports of systems problems at ARP entities. As noted above, ARP II stated that SROs should notify Commission staff of significant additions, deletions, or other changes to their automated systems on an annual and an as-needed basis, as well as provide real-time notification of unusual events, such as significant outages involving automated systems. 33 Likewise, Regulation ATS requires significant-volume ATSs to promptly notify the Commission of material systems outages and significant systems changes. 34 33 See supra note 22 and accompanying text. 34 See 17 CFR 242.301(b)(6)(ii)(G). See also supra note 26. In addition to the Commission's ARP policy statements and Rule 301(b)(6) of Regulation ATS, Commission staff has provided guidance to ARP entities on how the staff believes they should report planned systems changes and systems issues to the Commission. For example, in 2001, Commission staff sent a letter to the SROs and other participants in the ARP Inspection Program to clarify what should be considered a “significant system change” and a “significant system outage” for purposes of reporting systems changes and problems to Commission staff. 35 Further, in 2009, Commission staff sent a letter to the national securities exchanges and FINRA expressing the staff's view that SROs are obligated to ensure that their systems' operations comply with the federal securities laws and rules and the SRO's rules, and that failure to satisfy this obligation could lead to sanctions under Section 19(h)(1) of the Exchange Act. 36 Unlike ARP I, ARP II, and Rule 301(b)(6) of Regulation ATS, the 2001 Staff ARP Interpretive Letter and 2009 Staff Systems Compliance Letter were not issued by the Commission and constitute only staff guidance. Proposed Regulation SCI, if adopted, would consolidate and supersede all such staff guidance, as well as the Commission's ARP policy statements and Rule 301(b)(6) of Regulation ATS. 35 In June 2001, staff from the Division of Market Regulation sent a letter to the SROs and other participants in the ARP Inspection Program regarding Guidance for Systems Outage and System Change Notifications (“2001 Staff ARP Interpretive Letter”), advising them that the staff considers a significant system change to include: (i) Major systems architectural changes; (ii) reconfiguration of systems that cause a variance greater than five percent in throughput or storage; (iii) introduction of new business functions or services; (iv) material changes in systems; (v) changes to external interfaces; (vi) changes that could increase susceptibility to major outages; (vii) changes that could increase risks to data security; (viii) a change that was, or will be, reported or referred to the entity's board of directors or senior management; or (ix) changes that may require allocation or use of significant resources. The 2001 Staff ARP Interpretive Letter also advised that Commission staff considers a “significant system outage” to include an outage that results in: (i) Failure to maintain service level agreements or constraints; (ii) disruption of normal operations, including switchover to back-up equipment with no possibility of near-term recovery of primary hardware; (iii) loss of use of any system; (iv) loss of transactions; (v) excessive back-ups or delays in processing; (vi) loss of ability to disseminate vital information; (vii) communication of an outage situation to other external entities; (viii) a report or referral of an event to the entity's board of directors or senior management; (ix) a serious threat to systems operations even though systems operations are not disrupted; or (x) a queuing of data between system components or queuing of messages to or from customers of such duration that a customer's normal service delivery is affected. The 2001 Staff ARP Interpretive Letter is available at http://www.sec.gov/divisions/marketreg/sroautomation.shtml. 36 In December 2009, staff from the Division of Trading and Markets and Office of Compliance Inspections and Examinations sent a letter (“2009 Staff Systems Compliance Letter”) to each national securities exchange and FINRA reminding each of its obligation to ensure that its systems' operations are consistent with the federal securities laws and rules and the SRO's rules, and clarifying the staff's expectations regarding SRO systems compliance. The 2009 Staff Systems Compliance Letter also expressed the staff's view that SROs and other participants in the ARP Inspection Program should have effective written policies and procedures for systems development and maintenance that provide for adequate regulatory oversight, including testing of system changes, controls over system changes, and independent audits. The 2009 Staff Systems Compliance Letter also expressed the staff's expectation that, if an SRO becomes aware of a system function that could lead or has led to a failure to comply with the federal securities laws or rules, or the SRO's rules, the SRO should immediately take appropriate corrective action including, at a minimum, devoting adequate resources to remedy the issue as soon as possible, and notifying Commission staff and (if appropriate) the public of the compliance issue and efforts to rectify it. The 2009 Staff Systems Compliance Letter was sent to BATS, BATS-Y, CBOE, C2, CHX, EDGA, EDGX, FINRA, ISE, Nasdaq, Nasdaq OMX BX, Nasdaq OMX Phlx, NSX, NYSE, NYSE MKT (f/k/a NYSE Amex), NYSE Arca. See infra notes 47 and 51. In addition, OCIE conducts inspections of SROs, as part of the Commission's oversight of them. Unlike ARP inspections, however, which focus on information technology controls, OCIE primarily conducts risk-based examinations of securities exchanges, FINRA, and other SROs to evaluate whether they and their member firms are complying with the Exchange Act and the rules thereunder, as well as SRO rules. Examples of OCIE risk-based examination areas include: governance, regulatory funding, trading regulation, member firm examination programs, disciplinary programs for member firms, and exchange programs for listing compliance. In 2011, OCIE conducted baseline assessments of all of the national securities exchanges then operating. These assessments included these areas, among others, but did not include examinations of the exchanges' systems, as systems inspections are conducted under the ARP Inspection Program. 37 As part of the Commission's oversight of the SROs, OCIE also reviews systems compliance issues reported to Commission staff. The information gained from OCIE's review of reported systems compliance issues helps to inform its examination risk-assessments for SROs. 37 See text accompanying notes 24-29. B. Evolution of the Markets Since the Inception of the ARP Inspection Program Since the inception of the ARP Inspection Program more than two decades ago, the securities markets have experienced sweeping changes, evolving from a collection of relatively few, mostly manual markets, to a larger number and broader variety of trading centers that are almost completely automated, and dependent upon sophisticated technology and extremely fast and interconnected systems. Regulatory developments, such as Regulation NMS, 38 decimalization, 39 Regulation ATS, 40 and the Order Handling Rules, 41 also have impacted the structure of the markets by, among other things, mandating and providing incentives that encourage automation and speed. Although some markets today retain trading floors and accommodate some degree of manual interaction, these markets also have implemented electronic trading for their products. In stock markets, for example, in almost all cases, the volume of electronic trading dominates any residual manual activity. 42 In addition, in recent years, the new trading systems developed by existing or new exchanges and ATSs rely almost exclusively on fully-electronic, automated technology to execute trades. 43 As a result, the overwhelming majority of securities transactions today are executed on such automated systems. 44 A primary driver and catalyst of this transformation has been the continual evolution of technologies for generating, routing, and executing orders. These technologies have dramatically improved the speed, capacity, and sophistication of the trading functions that are available to market participants. 45 The increased speed and capacity of automated systems in the current market structure has contributed to surging message traffic. 46 38 17 CFR 242.600-612. See also Securities Exchange Act Release No. 51808 (June 9, 2005), 70 FR 37496 (June 29, 2005). 39 See Securities Exchange Act Release No. 42360 (January 28, 2000), 65 FR 5003 (February 2, 2000). 40 17 CFR 242.300-303. See also ATS Release, supra note 2. 41 Securities Exchange Act Release No. (September 6, 1996), 61 FR 48290 (September 12, 1996). See also Concept Release on Equity Market Structure, supra note 42, at 3594. 42 See, e.g., Securities Exchange Act Release No. 61358 (January 14, 2010), 75 FR 3594, 3594-95 (January 21, 2010) (Concept Release on Equity Market Structure). See also Securities Exchange Act Release No. 58845 (October 24, 2008), 73 FR 64379 (October 29, 2008) (SR-NYSE-2008-46) (order approving NYSE's New Market Model, an electronic trading system with floor-based components). 43 See, e.g., Securities Exchange Act Release Nos. 62716 (August 13, 2010), 75 FR 51295 (August 19, 2010) (order approving the exchange registration application of BATS-Y Exchange, Inc.); 61698 (March 12, 2010), 75 FR 13151 (March 18, 2010) (order approving the exchange registration applications of EDGA Exchange Inc. and EDGX Exchange Inc.); 57478 (March 12, 2008), 73 FR 14521 (March 18, 2008) (order approving a proposed rule change, as amended, by the NASDAQ Stock Market LLC to establish rules governing the trading of options on the NASDAQ Options Market). 44 For example, less than 30 percent of stock trading takes place on listing exchanges as orders are dispersed to more than 50 competing venues, almost all of which are fully electronic. See, e.g., http://www.batstrading.com/market_summary. See also Concept Release on Equity Market Structure, supra note 42, for a more detailed discussion of equity market structure. 45 For example, the speed of trading has increased to the point that the fastest traders now measure their latencies in microseconds. See Concept Release on Equity Market Structure, supra note 42, at 3598. 46 See, e.g., “Climbing Mount Message: How Exchanges are Managing Peaks,” Markets Media (posted on June 29, 2012), available at: http://marketsmedia.com/climbing-mount-message-exchanges-managing-peaks/ (noting that message volumes across U.S. exchanges hit a daily peak of 4.47 million messages per second). In addition to these changes, there has been an increase in the number of trading venues, particularly for equities. No longer is trading in equities dominated by one or two trading venues. Today, 13 national securities exchanges trade equities, with no single stock exchange having an overall market share of greater than twenty percent of consolidated volume for all NMS stocks, 47 but each with a protected quotation 48 that may not be traded through by other markets. 49 ATSs, including electronic communications networks (“ECNs”) and dark pools, as well as broker-dealer internalizers, also execute substantial volumes of securities transactions. 50 Each of these trading venues is connected with the others through a vast web of linkages, including those that provide connectivity, routing services, and market data. The number of venues trading options has likewise grown, with 11 national securities exchanges currently trading options, up from five as recently as 2004. 51 47 See, e.g., market volume statistics reported by BATS Exchange, Inc., available at: http://www.batstrading.com/market_summary (no single national securities exchange executed more than 20 percent of volume in NMS stocks during the 5-day period ending February 7, 2013). The following national securities exchanges have equities trading platforms: (1) BATS Exchange, Inc. (“BATS”); (2) BATS Y-Exchange, Inc. (“BATS-Y”); (3) Chicago Board Options Exchange, Incorporated (“CBOE”); (4) Chicago Stock Exchange, Inc. (“CHX”); (5) EDGA Exchange, Inc. (“EDGA”); (6) EDGX Exchange, Inc. (“EDGX”); (7) NASDAQ OMX BX, Inc. (“Nasdaq OMX BX”); (8) NASDAQ OMX PHLX LLC (“Nasdaq OMX Phlx”); (9) NASDAQ Stock Market LLC (“Nasdaq”); (10) National Stock Exchange, Inc. (“NSX”); (11) New York Stock Exchange LLC (“NYSE”); (12) NYSE MKT LLC (“NYSE MKT”); and (13) NYSE Arca, Inc. (“NYSE Arca”). 48 A “protected quotation” is defined by Regulation NMS as a quotation in an NMS stock that (i) is displayed by an automated trading center; (ii) is disseminated pursuant to an effective national market system plan; and (iii) is an automated quotation that is the best bid or best offer of a national securities exchange, the best bid or best offer of The Nasdaq Stock Market, Inc., or the best bid or best offer of a national securities association other than the best bid or best offer of The Nasdaq Stock Market, Inc. See Rule 600(b)(57)-(58) of Regulation NMS, 17 CFR 242.600(b)(57)-(58). 49 See Rule 611(a)(1) of Regulation NMS, 17 CFR 242.601(a)(1). 50 See Concept Release on Equity Market Structure, supra note 42. 51 The following venues trade options today: (1) BATS Exchange Options Market; (2) Boston Options Exchange LLC (“BOX”); (3) C2 Options Exchange, Incorporated (“C2”); (4) CBOE; (5) International Securities Exchange, LLC (“ISE”); (6) Miami International Securities Exchange, LLC (“MIAX”); (7) NASDAQ Options Market; (8) NASDAQ OMX BX Options; (9) Nasdaq OMX Phlx; (10) NYSE Amex Options; and (11) NYSE Arca. The increased number of trading venues, dispersal of trading volume, and the resulting reliance on a variety of automated systems and intermarket linkages have increased competition and thus investor choice, but have also increased the complexity of the markets and the challenges for market participants seeking to manage their information technology programs and to ensure compliance with Commission rules. 52 These changes have also substantially heightened the potential for systems problems originating from any number of sources to broadly affect the market. Given the increased interconnectedness of the markets, a trading venue may not always recognize the true impact and cost of a problem that originates with one of its systems. 52 For example, one important type of linkage in the current market structure was created to comply with legal obligations to protect against trade-throughs as required by Rule 611 of Regulation NMS under the Exchange Act, 17 CFR 242.611. A trade-through is the execution of a trade at a price inferior to a protected quotation for an NMS stock. Importantly, Rule 611 applies to all trading centers, not just those that display protected quotations. Trading center is defined broadly in Rule 600(b)(78) of Regulation NMS to include, among others, all exchanges, all ATSs (including ECNs and dark pools), all OTC market makers, and any other broker-dealer that executes orders internally, whether as agent or principal. See Concept Release on Equity Market Structure, supra note 42, at 3601. C. Successes and Limitations of the Current ARP Inspection Program While the Commission generally considers the ARP Inspection Program to have been successful in improving the automated systems of the SROs and other entities participating in the program over the past 20 years, the Commission is mindful of its limitations. For example, because the ARP Inspection Program is established pursuant to Commission policy statements, rather than Commission rules, 53 the Commission's ability to assure compliance with ARP standards with certainty or adequate thoroughness is limited. In particular, the Commission may not be able to fully address major or systemic market problems at all entities that would meet the proposed definition of SCI entity. Further, the Government Accountability Office (“GAO”) has identified the voluntary nature of the ARP Inspection Program as a limitation of the program and recommended that the Commission make compliance with ARP guidelines mandatory. 54 53 As discussed in infra Section III.B.1, no ATS currently meets the volume thresholds in Rule 301(b)(6) of Regulation ATS. 54 See GAO, Financial Market Preparedness: Improvements Made, but More Action Needed to Prepare for Wide-Scale Disasters, Report No. GAO-04-984 (September 27, 2004). GAO cited instances in which the GAO believed that entities participating in the ARP Inspection Program failed to adequately address or implement ARP staff recommendations as the reasoning behind its recommendation to make compliance with ARP guidelines mandatory. As noted in supra Section I.A, the obligations underlying the policy statements are statutorily mandated. The Commission believes that the continuing evolution of the securities markets to the current state, where they have become almost entirely electronic and highly dependent on sophisticated trading and other technology (including complex regulatory and surveillance systems, as well as systems relating to the provision of market data, intermarket routing and connectivity, and a variety of other member and issuer services), has posed challenges for the ARP Inspection Program. Accordingly, the Commission believes that the guidance in the ARP policy statements should be updated and formalized, and that clarity with respect to a variety of important matters, including regarding appropriate industry practices, notice to the Commission of all SCI events and to members or participants of SCI entities of certain systems problems, Commission access to systems, and procedures designed to better ensure that SRO systems comply with the SRO's own rules, would improve the Commission's oversight capabilities. Furthermore, given the importance of ensuring that an SRO's trading and other systems are operated in accordance with its rules, the Commission believes that improvements in SRO procedures could help to ensure that such systems are operating in compliance with relevant rules, and to promptly identify and address any instances of non-compliance. 55 55 Section 19(b)(1) of the Exchange Act requires each SRO to file with the Commission any proposed rule or any proposed change in, addition to, or deletion from the rules of such SRO (a “proposed rule change”), accompanied by a concise general statement of the basis and purpose of such proposed rule change, and provides that no proposed rule change shall take effect unless approved by the Commission or otherwise permitted in accordance with the provisions of this section. See 15 U.S.C. 78s(b)(1). An SRO's failure to file a proposed rule change when required would be a violation of Section 19(b)(1). D. Recent Events In the Commission's view, recent events further highlight why rulemaking in this area may be warranted. On May 6, 2010, according to a report by the staffs of the Commission and the Commodity Futures Trading Commission (“CFTC”), the prices of many U.S.-based equity products experienced an extraordinarily rapid decline and recovery, with major equity indices in both the futures and securities markets, each already down over four percent from their prior day close, suddenly plummeting a further five to six percent in a matter of minutes before rebounding almost as quickly. 56 According to the May 6 Staff Report, many individual equity securities and exchange traded funds suffered similar price declines and reversals within a short period of time, falling 5, 10, or even 15 percent before recovering most, if not all, of their losses. 57 The May 6 Staff Report stated that some equities experienced even more severe price moves, both up and down, with over 20,000 trades in more than 300 securities executed at prices more than 60 percent away from their values just moments before. 58 56 See Findings Regarding The Market Events Of May 6, 2010, Report Of The Staffs Of The CFTC And SEC To The Joint Advisory Committee On Emerging Regulatory Issues, September 30, 2010 (“May 6 Staff Report”). 57 See id. 58 These trades subsequently were broken by the exchanges and FINRA. See id. Among the key findings in the May 6 Staff Report was that the interaction between automated execution programs and algorithmic trading strategies can quickly erode liquidity and result in disorderly markets, and that concerns about data integrity, especially those that involve the publication of trades and quotes to the consolidated tape, can contribute to pauses or halts in many automated trading systems and in turn lead to a reduction in general market liquidity. 59 According to the May 6 Staff Report, the events of May 6, 2010 clearly demonstrate the importance of data in today's world of fully automated trading strategies and systems, and that fair and orderly markets require the maintenance of high standards for robust, accessible, and timely market data. 60 59 See id. at 78. 60 See id. at 8. Both before and after the May 6, 2010 incident, individual markets have also experienced other systems-related issues. In February 2011, NASDAQ OMX Group, Inc. revealed that hackers had penetrated certain of its computer networks, though Nasdaq reported that at no point did this intrusion compromise Nasdaq's trading systems. 61 In October 2011, the Commission sanctioned EDGX and EDGA, two national securities exchanges, and their affiliated broker, Direct Edge ECN LLC, for violations of federal securities laws arising from systems incidents. 62 In the Direct Edge Order, the Commission noted that the “violations occurred against the backdrop of weaknesses in Respondents' systems, processes, and controls.” 63 61 See announcement by Nasdaq OMX (February 5, 2011), available at: http://www.nasdaq.com/includes/announcement-2-5-11.aspx (accessed May 20, 2011). See also Devlin Barrett, “Hackers Penetrate NASDAQ Computers,” Wall St. J., February 5, 2011, at A1; Devlin Barrett et al., “NASDAQ Confirms Breach in Network,” Wall St. J., February 7, 2011, at C1. 62 See Securities Exchange Act Release No. 65556, In the Matter of EDGX Exchange, Inc., EDGA Exchange, Inc. and Direct Edge ECN LLC (settled action: October 13, 2011), available at: http://www.sec.gov/litigation/admin/2011/34-65556.pdf (“Direct Edge Order”); see also Commission News Release, 2011-208, “SEC Sanctions Direct Edge Electronic Exchanges and Orders Remedial Measures to Strengthen Systems and Controls” (October 13, 2011). EDGX, EDGA, and their affiliated routing broker, Direct Edge ECN LLC (dba DE Route), consented to an Order Instituting Administrative and Cease-and-Desist Proceedings Pursuant to Sections 19(h) and 21C of the Securities Exchange Act of 1934, Making Findings, and Imposing Remedial Sanctions and a Cease-and-Desist Order. 63 See Direct Edge Order, supra note 62, at 3. More recently, in 2012, systems issues hampered the initial public offerings of BATS Global Markets, Inc. and Facebook, Inc. 64 On March 23, 2012, BATS announced that a “software bug” caused BATS to shut down the IPO of its own stock, BATS Global Markets, Inc. 65 On May 18, 2012, issues with Nasdaq's trading systems delayed the start of trading in the high-profile IPO of Facebook, Inc. and some market participants experienced delays in notifications over whether orders had been filled. 66 64 See also infra note 334 and accompanying text. 65 See “BATS BZX Exchange Post-Mortem” by BATS, March 23, 2012, available at: www.batstrading.com/alerts (accessed July 2, 2012). 66 See “Post-Mortem for NASDAQ issues related to the Facebook Inc. (FB) IPO Cross on Friday, May 18, 2012” by NASDAQ, May 18, 2012, available at: http://www.nasdaqtrader.com/TraderNews.aspx?id=ETA2012-20 (accessed July 2, 2012). While these are illustrative high-profile examples, they are not the only instances of disruptions and other systems problems experienced by SROs and ATSs. 67 Moreover, the risks associated with cybersecurity, and how to protect against systems intrusions, are increasingly of concern to all types of entities, including public companies. 68 67 The Commission notes that outages have occurred on foreign markets recently as well. See, e.g., Kana Inagaki and Kosaku Narioka, “Tokyo Tackles Trading Glitch,” Wall St. J., February 2, 2012; and Neil Shah and Carrick Mellenkamp, “London Exchange Paralyzed by Glitch,” Wall St. J., September 9, 2008, Europe Business News. See also discussion in infra Section III.C.1.b regarding business continuity planning during October 2012 due to Superstorm Sandy. 68 See, e.g., CF Disclosure Guidance: Topic No. 2, Cybersecurity (October 13, 2011), available at: http://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm (providing the Division of Corporation Finance's views regarding disclosure obligations relating to cybersecurity risks and cyber incidents). On October 2, 2012, the Commission conducted a roundtable entitled “Technology and Trading: Promoting Stability in Today's Markets” (“Roundtable”). 69 The Roundtable examined the relationship between the operational stability and integrity of the securities market and the ways in which market participants design, implement, and manage complex and interconnected trading technologies. 70 Panelists offered their views on how market participants could prevent, or at least mitigate, technology errors as well as how error response could be improved. 69 See Securities Exchange Act Release No. 67802 (September 7, 2012), 77 FR 56697 (September 13, 2012) (File No. 4-652). A webcast of the Roundtable is available at: www.sec.gov/news/otherwebcasts/2012/ttr100212.shtml. 70 See Securities Exchange Act Release No. 67725 (August 24, 2012), 77 FR 52766 (August 30, 2012) (File No. 4-652). The Roundtable included panelists from academia, clearing agencies, national securities exchanges, broker-dealers, and other organizations. Panelists for the first panel were: Dr. Nancy Leveson, Professor of Aeronautics and Astronautics and Engineering Systems, MIT (“MIT”); Sudhanshu Arya, Managing Director, ITG (“ITG”); Chris Isaacson, Chief Operating Officer, BATS Exchange (“BATS”); Dave Lauer, Market Structure and HFT Consultant, Better Markets, Inc. (“Better Markets”); Jamil Nazarali, Head of Citadel Execution Services, Citadel (“Citadel”); Lou Pastina, Executive Vice President—NYSE Operations, NYSE (“NYSE”); Christopher Rigg, Partner—Financial Services Industry, IBM (“IBM”); and Jonathan Ross, Chief Technology Officer, GETCO LLC (“Getco”). Panelists for the second panel were: Dr. M. Lynne Markus, Professor of Information and Process Management, Bentley University (“Bentley”); David Bloom, Head of UBS Group Technology (“UBS”); Chad Cook, Chief Technology Officer, Lime Brokerage LLC (“Lime”); Anna Ewing, Executive Vice President and Chief Information Officer, Nasdaq; Albert Gambale, Managing Director and Chief Development Officer, Depository Trust and Clearing Corp. (“DTCC”); Saro Jahani, Chief Information Officer, Direct Edge (“DE”); and Lou Steinberg, Chief Technology Officer, TD Ameritrade (“TDA”). See Technology and Trading: Promoting Stability in Today's Markets Roundtable — Participant Bios, available at: http://www.sec.gov/news/otherwebcasts/2012/ttr100212-bios.htm. The Roundtable was announced on August 3, 2012, following a report by Knight Capital Group, Inc. (“Knight”) that, on August 1, 2012, it “experienced a technology issue at the opening of trading at the NYSE * * * [which was] related to Knight's installation of trading software and resulted in Knight sending numerous erroneous orders in NYSE-listed securities into the market * * * Knight * * * traded out of its entire erroneous trade position, which * * * resulted in a realized pre-tax loss of approximately $440 million.” See Knight Capital Group Provides Update Regarding August 1st Disruption To Routing In NYSE-listed Securities (August 2, 2012), available at: http://www.knight.com/investorRelations/pressReleases.asp?compid=105070&releaseID=1721599. Although the Knight incident highlights the importance of the integrity of broker-dealer systems, the focus of the Roundtable was not limited to broker-dealers. But see infra Section III.G, soliciting comment regarding the potential inclusion of broker-dealers, other than SCI ATSs, in the proposed definition of SCI entity. Although the discussion was wide-ranging, several themes emerged, with panelists generally agreeing that areas of focus across the industry should be on adherence to best practices, improved quality assurance, more robust testing, increased pre-trade and post-trade risk controls, real-time monitoring of systems, and improved communications when systems problems occur. The panelists also discussed whether there should be regulatory or other mandates for quality standards and industry testing, and whether specific mechanisms, such as “kill switches,” 71 would be useful to protect the markets from technology errors and to advance the goal of bolstering investor confidence in the markets. 72 Several panelists also stated that, given the frequency of coding changes in the current market environment, testing of software changes should be far more robust. 73 71 The term “kill switch” is a shorthand expression used by market participants, including Roundtable participants and Roundtable commenters, to refer to mechanisms pursuant to which one or more limits on trading could be established by a trading venue for its participants that, if exceeded, would authorize the trading venue to stop accepting incoming orders from such participant. See also infra note 76 and accompanying text. 72 With regard to quality assurance in particular, Roundtable panelists differed on the role of third parties in providing quality assurance, with some panelists believing that, given the difficulty for an outside party to understand the complex systems of trading firms and other market participants, such a role should be performed by internal staff who are better able to understand such systems, with other panelists opining that there it was critical that independent parties provide quality assurance. 73 Panelists urging greater testing in general and industry testing in particular included those from BATS, Better Markets, DE, ITG, Getco, Nasdaq, NYSE, and TDA. In addition to the Roundtable panels, the Commission solicited comment with respect to the Roundtable's topics, and received statements from some of the Roundtable panelists, as well as comment letters from the public. 74 Many comment letters specifically recommended improved testing as a way to aid error prevention. 75 In addition, several commenters expressed support for a “kill-switch” mechanism that would permit exchanges or other market centers to terminate a firm's trading activity if such activity was posing a threat to market integrity. 76 74 See http://www.sec.gov/comments/4-652/4-652.shtml, listing and publishing all comment letters received by the Commission with respect to the Roundtable. The letters received cover a broad array of topics, some of which are unrelated to proposed Regulation SCI. This proposing release discusses and references the following letters when relevant to the discussion of proposed Regulation SCI: Letter dated September 5, 2012, from James J. Angel, Ph.D., CFA, Georgetown University and the Wharton School, University of Pennsylvania (“Angel”); Letter dated September 27, 2012, from Eric Swanson, BATS Global Markets, Inc.; Letter dated October 2, 2012, from Dave Lauer, Market Structure and HFT Consultant, Better Markets (“Better Markets”); Letter dated October 1, 2012, from Jamil Nazarali, Citadel (“Citadel”); Letter dated October 23, 2012, from Scott Goebel, Senior Vice President and General Counsel, Fidelity Management & Research Company (“Fidelity”); Letter dated November 1, 2012, from Arsalan Shahid, Program Director, Financial Information Forum (“FIF”); Letter dated October 19, 2012, from Courtney Doyle McGuinn, Operations Director, FIX Protocol Ltd. (“FIX”); Letter dated October 1, 2012, from Elizabeth K. King, Head of Regulatory Affairs, GETCO LLC (“Getco”); Letter dated October 18, 2012, from Adam Nunes, President, Hudson River Trading LLC (“Hudson”); Letter dated September 23, 2012, from Patrick J. Healy, CEO, Issuer Advisory Group LLC (“IAG”); Letter dated October 23, 2012, from Karrie McMillan, General Counsel, Investment Company Institute (“ICI”); Letter dated October 22, 2012, from James P. Selway III, Managing Director, Head of Liquidity Management, and Sudhanshu Arya, Managing Director, Head of Technology for Liquidity Management, ITG Inc. (“ITG”); Letter dated September 28, 2012, from Joseph M. Mecane, NYSE Euronext; Richard G. Ketchum, FINRA; Eric Noll, Nasdaq OMX, Inc.; Christopher A. Isaacson, BATS Global Markets, Inc.; Bryan Harkins, DirectEdge; David Herron, Chicago Stock Exchange; Murray Pozmanter, The Depository Trust & Clearing Corporation; Bank of America Merrill Lynch; Citadel LLC; Citigroup Global Markets Inc.; Deutsche Bank Securities Inc.; GETCO; Goldman, Sachs & Co/Goldman Sachs Execution and Clearing; IMC Chicago LLC; ITG, Inc.; Jane Street; J.P. Morgan Securities LLC; RBC Capital Markets, LLC; RGM Advisors, LLC; Two Sigma Securities; UBS Securities LLC; Virtu Financial; Wells Fargo Securities (“Industry Working Group”); Letter dated September 25, 2012, from R. T. Leuchtkafer (“Leuchtkafer”); Letter dated August 14, 2012, from Stuart J. Kaswell, Executive Vice President, Managing Director & General Counsel, Managed Funds Association (“MFA”); Letter dated October 1, 2012, from Richard Gorelick, RGM Advisors, Cameron Smith, Quantlab, and Peter Nabicht, Allston Trading (“RGM”); Letter dated September 28, 2012, from Nasser A. Sharara, Managing Director, Product Management, Raptor Trading Systems (“Raptor”); Letter dated October 1, 2012, from Lou Steinberg, Managing Director, Chief Technology Officer, TDA (“TDA”); Letter dated October 24, 2012, from David Weisberger, Executive Principal, Two Sigma Securities, LLC (“Two Sigma”). 75 See, e.g., letters from Angel, BATS, Better Markets, Citadel, Fidelity, FIF, FIX, Getco, Hudson, IAG, ICI, ITG, Industry Working Group, Leuchtkafer, MFA, RGM, and Two Sigma, supra note 74. Some of these commenters specifically urged greater integration testing and stated that testing with exchanges and other market centers under simulated market conditions were necessary in today's extremely fast and interconnected markets. One commenter (Angel) suggested that exchanges operate completely from their backup data centers one day each year to test such systems and market participants' connectivity to them. 76 See, e.g., letters from Angel, BATS, Citadel, FIF, Getco, IAG, Industry Working Group, MFA, RGM, and Raptor, supra note 74. See also letters from Fidelity, FIX, Hudson and ITG, supra note 74, submitted after the Roundtable, suggesting possible approaches for establishing kill switch criteria. See also supra note 71, describing the use of the term “kill switch” in this release. The Commission believes that the information presented at the Roundtable and received from commenters, as broadly outlined above, highlights that quality standards, testing, and improved error response mechanisms are among the issues needing very thoughtful and focused attention in today's securities markets. 77 In formulating proposed Regulation SCI, the Commission has considered the information and views discussed at the Roundtable and received from commenters. 77 The Commission notes that Roundtable panelists and commenters offering their views and suggestions generally did so in the context of discussing the market as a whole, rather than focusing on the roles and regulatory status of different types of market participants. However, some commented on the utility of the ARP Inspection Program and suggested that it could be expanded. See, e.g., letter from Leuchtkafer, supra note 74. In addition, the panelists from Getco, Nasdaq, and NYSE also suggested that ARP could be expanded, with the panelist from NYSE in particular advocating that the applicability of any new ARP-related regulations not be limited to SROs. One commenter suggested that the Commission update and formalize the ARP Inspection Program before extending it to other market participants. See letter from Fidelity, supra note 74. This commenter added further that, if the ARP program is extended to other market participants, it should not include a requirement that broker-dealers submit certain information, such as algorithmic code changes, for independent review. See also infra Section III.G, soliciting comment on whether the requirements of proposed Regulation SCI should apply, in whole or in part, to broker-dealers or a subset thereof. Most recently, the U.S. national securities exchanges closed for two business days in the wake of Superstorm Sandy, a major storm that hit the East Coast of the United States during October 2012, and which caused significant damage in lower Manhattan, among other places. 78 Press reports stated that, while the markets planned to open on the first day of the storm (with the NYSE planning to operate under its contingency plan as an electronic-only venue), 79 after consultation with market participants, including the Commission and its staff, and in light of concerns over the physical safety of personnel and the possibility of technical issues, the national securities exchanges jointly decided not to open for trading on October 29 and October 30, 2012. 80 The market closures occurred even though the securities industry's annual test of how trading firms, market operators and their utilities could operate through an emergency using backup sites, backup communications, and disaster recovery facilities occurred on October 27, 2012, just two days before the storm. 81 According to press reports, the test did not uncover issues that would preclude markets from opening two days later with backup systems, if they so chose. 82 In addition, NYSE's contingency plan was tested seven months prior to the storm, though press reports indicate that a large number of NYSE members did not participate. 83 The Commission also has considered the impact of Superstorm Sandy on the securities markets, particularly with respect to business continuity planning and testing, in formulating proposed Regulation SCI. 78 See “NYSE to Remain Open for Trading While Physical Trading Floor and New York Building Close in Accordance with Actions Taken by City and State Officials,” (October 28, 2012) (“NYSE Floor Closure Statement”), available at: http://www.nyse.com/press/1351243407197.html; and “NYSE Euronext Statement on Closure of U.S. Markets on Monday Oct. 29 and Pending Confirmation on Tuesday, Oct. 30, 2012,” (October 28, 2012) (“NYSE Closure Statement”), available at: http://www.nyse.com/press/1351243418010.html. 79 The NYSE had initially planned to act pursuant to NYSE Rule 49 (Emergency Powers), which permits a designated official of the NYSE, in the event of an emergency (as defined in Section 12(k)(7) of the Exchange Act), to designate NYSE Arca to receive and process bids and offers and to execute orders on behalf of the NYSE. See “NYSE Contingency Trading Plan in effect for Monday, October 29, 2012,” (October 28, 2012) (“Market Operations Update”), available at: http://markets.nyx.com/nyse/trader-updates/view/11503. The Commission approved NYSE Rule 49 on December 16, 2009. See Securities Exchange Act Release No. 61177 (December 16, 2009), 74 FR 68643 (December 28, 2009) (SR-NYSE-2009-105) (approving proposed rule change by the NYSE relating to the designation of NYSE Arca as the NYSE's alternative trading facility in an emergency). 80 See, e.g., “A giant storm and the struggle over closing Wall Street,” October 31, 2012, available at: http://www.reuters.com/article/2012/10/31/us-storm-sandy-nyse-insight-idUSBRE89T0F920121031. See also, e.g., NYSE Closure Statement, supra note 78. 81 See, e.g., “Storm Over Wall Street Going Dark,” November 12, 2012, available at: http://www.tradersmagazine.com/news/storm-over-wall-street-going-dark-110526-1.html. 82 See id. See also http://www.sifma.org/services/bcp/industry-testing. 83 See id. and NYSE Floor Closure Statement, supra note 78. II. Proposed Codification and Enhancement of ARP Inspection Program In the Commission's view, the convergence of several developments—the evolution of the markets to become significantly more dependent upon sophisticated automated systems, the limitations of the existing ARP Inspection Program, and the lessons of recent events—highlight the need to consider an updated and formalized regulatory framework for ensuring that the U.S. securities trading markets develop and maintain systems with adequate capacity, integrity, resiliency, availability, and security, and reinforce the requirement that such systems operate in compliance with the Exchange Act. The Commission is proposing new Regulation SCI because the Commission preliminarily believes that it would further the goals of the national market system and reinforce Exchange Act obligations to require entities important to the functioning of the U.S. securities markets to carefully design, develop, test, maintain, and surveil systems integral to their operations. Proposed Regulation SCI would replace the two ARP policy statements. Although proposed Regulation SCI would codify in a Commission rule many of the principles of the ARP policy statements with which SROs and other participants in the ARP Inspection Program are familiar, the proposed rule would apply to more entities than the current ARP Inspection Program and would place obligations not currently included in the ARP policy statements on entities subject to the rule. Specifically, proposed Regulation SCI would apply to “SCI entities,” a term that would include “SCI SROs,” “SCI ATSs,” “plan processors,” and “exempt clearing agencies subject to ARP.” 84 84 Each of these terms is discussed in detail in Section III.B.1 below. Further, to help ensure that the proposed rule covers key systems of SCI entities, the proposed rule would define (for purposes of Regulation SCI) the term “SCI systems” to mean those systems of, or operated by or on behalf of, an SCI entity that directly support trading, clearance and settlement, order routing, market data, regulation, or surveillance. In addition, the term “SCI security systems” would include systems that share network resources with SCI systems that, if breached, would be reasonably likely to pose a security threat to such systems. 85 The proposed rule also would define several other terms intended to specify what types of systems changes and problems (“SCI events”) the Commission considers to be most significant and, therefore, preliminarily believes should be covered by the proposed rule's requirements. 85 See infra Section III.B.2 for a discussion of the proposed definitions of SCI systems and SCI security systems. In addition, proposed Regulation SCI would specify the obligations SCI entities would have with respect to covered systems and SCI events. Specifically, proposed Regulation SCI would require that each SCI entity: (1) Establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, SCI security systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets; (2) establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in the manner intended; (3) respond to SCI events with appropriate corrective action; (4) report SCI events to the Commission and submit follow-up reports, as applicable; (5) disseminate information regarding certain SCI events to members or participants of the SCI entity; (6) report material systems changes to the Commission; (7) conduct an SCI review of its systems not less than once each calendar year; (8) submit certain periodic reports to the Commission, including a report of the SCI review, together with any response by senior management; (9) mandate participation by designated members or participants in scheduled testing of the operation of the SCI entity's business continuity and disaster recovery plans, including backup systems, and coordinate such testing on an industry- or sector-wide basis 86 with other SCI entities; and (10) make, keep, and preserve records relating to the matters covered by Regulation SCI, and provide them to Commission representatives upon request. The proposal also would require that an SCI entity submit all required written notifications and reports to the Commission electronically using new proposed Form SCI. 86 See infra Section III.C.7 for a discussion of the terms industry-wide and sector-wide. III. Proposed Regulation SCI A. Overview The purpose of proposed Regulation SCI is to enhance the Commission's regulatory supervision of SCI entities and thereby further the goals of the national market system by helping to ensure the capacity, integrity, resiliency, availability, and security, and enhance compliance with federal securities laws and regulations, of automated systems relating to the U.S. securities markets through the formalization of standards to which their automated systems would be held, and a regulatory framework for ensuring more effective Commission oversight of these systems. Proposed Rule 1000(a) sets forth several definitions designed to establish the scope of the new rule. Proposed Rule 1000(b) sets forth the obligations that would be imposed on SCI entities with respect to systems and systems issues. Proposed Rules 1000(c)-(f) set forth recordkeeping and electronic filing requirements and address certain other related matters. B. Proposed Rule 1000(a): Definitions Establishing the Scope of Regulation SCI A series of definitions set forth in proposed Rule 1000(a) relate to the scope of proposed Regulation SCI. These include the definitions for “SCI entity,” “SCI systems,” “SCI security systems,” “SCI event,” “systems disruption,” “systems compliance issue,” “systems intrusion,” “dissemination SCI event,” and “material systems change.” 1. SCI Entities Although the ARP policy statements are rooted in Exchange Act requirements, the ARP Inspection Program has developed without the promulgation of Commission rules applicable to SROs or plan processors. Under the ARP Inspection Program, Commission staff conducts inspections of SROs to assess the capacity, integrity, resiliency, availability, and security of their systems. These inspections also have historically included the systems of entities that process and disseminate quotation and transaction data on behalf of the Consolidated Tape Association System (“CTA Plan”), Consolidated Quotation System (“CQS Plan”), Joint Self-Regulatory Organization Plan Governing the Collection, Consolidation, and Dissemination of Quotation and Transaction Information for Nasdaq-Listed Securities Traded on Exchanges on an Unlisted Trading Privileges Basis (“Nasdaq UTP Plan”), and Options Price Reporting Authority (“OPRA Plan”). 87 The ARP Inspection Program has also included one exempt clearing agency. 88 Pursuant to Rule 301(b)(6) of Regulation ATS, certain aspects of the ARP policy statements apply mandatorily to significant-volume ATSs, as they are currently defined under Regulation ATS. 89 However, because no ATSs currently meet the significant-volume thresholds specified in Rule 301(b)(6) of Regulation ATS, 90 compliance with the ARP Inspection Program is not mandatory at this time for any ATS. 91 Proposed Regulation SCI would provide mandatory uniform requirements for “SCI entities.” Proposed Rule 1000(a) would define “SCI entity” as an “SCI self-regulatory organization, SCI alternative trading system, plan processor, or exempt clearing agency subject to ARP.” The proposed rule also would define each of these terms for the purpose of designating specifically the entities that the Commission preliminarily believes should be subject to the rule. 87 See ARP I Release, supra note 1, at n. 8 and n. 17. Each of the CTA Plan, CQS Plan, Nasdaq UTP Plan, and OPRA Plan, is a “national market system plan” (“NMS Plan”) as defined under Rule 600(a)(43) of Regulation NMS under the Exchange Act, 17 CFR 242.600(a)(43). Rule 600(a)(55) of Regulation NMS under the Exchange Act, 17 CFR 242.600(a)(55), defines a “plan processor” as “any self-regulatory organization or securities information processor acting as an exclusive processor in connection with the development, implementation and/or operation of any facility contemplated by an effective national market system plan.” Section 3(a)(22)(B) of the Exchange Act, 15 U.S.C. 78c(22)(B), defines “exclusive processor” to mean “any securities information processor or self-regulatory organization which, directly or indirectly, engages on an exclusive basis on behalf of any national securities exchange or registered securities association, or any national securities exchange or registered securities association which engages on an exclusive basis on its own behalf, in collecting, processing, or preparing for distribution or publication any information with respect to (i) transactions or quotations on or effected or made by means of any facility of such exchange or (ii) quotations distributed or published by means of any electronic system operated or controlled by such association.” As a processor involved in collecting, processing, and preparing for distribution transaction and quotation information, the processor of each of the CTA Plan, CQS Plan, Nasdaq UTP Plan, and OPRA Plan meets the definition of “exclusive processor;” and because each acts as an exclusive processor in connection with an NMS Plan, each also meets the definition of “plan processor” under Rule 600(a)(55) of Regulation NMS, as well as proposed Rule 1000(a) of Regulation SCI. For ease of reference, an NMS Plan having a current or future “plan processor” is referred to herein as an “SCI Plan.” The Commission notes that not every processor of an NMS Plan would be a “plan processor,” as proposed to be defined in Rule 1000(a), and therefore not every processor of an NMS Plan would be an SCI entity subject to the requirements of proposed Regulation SCI. For example, the processor of the Symbol Reservation System associated with the National Market System Plan for the Selection and Reservation of Securities Symbols (File No. 4-533) would not be a “plan processor” subject to Regulation SCI because it does not meet the “exclusive processor” statutory definition, as it is not involved in collecting, processing, and preparing for distribution transaction and quotation information. 88 See infra notes 133-135 and accompanying text. 89 See 17 CFR 242.301(b)(6). See also supra note 26. 90 17 CFR 242.301(b)(6). 91 One ATS currently participates voluntarily in the ARP Inspection Program, though, in the past, other ATSs have also participated in the ARP Inspection Program. Proposed Rule 1000(a) would define the term “SCI self-regulatory organization.” The definition of “SCI self-regulatory organization,” or “SCI SRO,” would be consistent with the definition of “self-regulatory organization” set forth in Section 3(a)(26) of the Exchange Act, 92 and would cover all national securities exchanges registered under Section 6(b) of the Exchange Act, 93 registered securities associations, 94 registered clearing agencies, 95 and the Municipal Securities Rulemaking Board (“MSRB”). 96 The definition would, however, exclude an exchange that lists or trades security futures products that is notice-registered with the Commission as a national securities exchange pursuant to Section 6(g) of the Exchange Act, as well as any limited purpose national securities association registered with the Commission pursuant to Exchange Act Section 15A(k). 97 Accordingly, the definition of SCI SRO in proposed Rule 1000(a) would mandate that all national securities exchanges registered under Section 6(b) of the Exchange Act, all registered securities associations, all registered clearing agencies, and the MSRB, comply with Regulation SCI. 98 92 See 15 U.S.C. 78c(a)(26): “The term `self-regulatory organization' means any national securities exchange, registered securities association, or registered clearing agency, or (solely for purposes of sections 19(b), 19(c), and 23(b) of this title) the Municipal Securities Rulemaking Board established by section 15B of this title.” See infra note 96. 93 Currently, these registered national securities exchanges are: (1) BATS; (2) BATS-Y; (3) BOX; (4) CBOE; (5) C2; (6) CHX; (7) EDGA; (8) EDGX; (9) ISE; (10) MIAX; (11) Nasdaq OMX BX; (12) Nasdaq OMX Phlx; (13) Nasdaq; (14) NSX; (15) NYSE; (16) NYSE MKT; and (17) NYSE Arca. 94 FINRA is the only registered national securities association. 95 Currently, there are seven clearing agencies (Depository Trust Company (“DTC”); Fixed Income Clearing Corporation (“FICC”); National Securities Clearing Corporation (“NSCC”); Options Clearing Corporation (“OCC”); ICE Clear Credit; ICE Clear Europe; and CME) with active operations that are registered with the Commission. See also infra notes 133-135 and accompanying text. The Commission notes that it recently adopted Rule 17Ad-22, which requires registered clearing agencies to have effective risk management policies and procedures in place. See Securities Exchange Act Release No. 68080 (October 22, 2012), 77 FR 66220 (November 2, 2012). Among other things, Rule 17Ad-22(d)(4) requires that registered clearing agencies “[i]dentify sources of operational risk and minimize them through the development of appropriate systems, controls, and procedures; implement systems that are reliable, resilient and secure, and have adequate, scalable capacity; and have business continuity plans that allow for timely recovery of operations and fulfillment of a clearing agency's obligations.” In its adopting release, the Commission stated that Rule 17Ad-22(d)(4) “* * * complements the existing guidance provided by the Commission in its Automation Review Policy Statements and the Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System.” Similarly, the Commission preliminarily believes that proposed Regulation SCI, to the extent it addresses areas of risk management similar to those addressed by Rule 17Ad-22(d)(4), complements Rule 17Ad-22(d)(4). See also infra note 203. 96 15 U.S.C. 78c(a)(26). See also supra note 92. Historically, the ARP Inspection Program has not included the MSRB, but instead has focused on entities having trading, quotation and transaction reporting, and clearance and settlement systems more closely connected to the equities and options markets. In considering the entities that should be subject to proposed Regulation SCI, the Commission preliminarily believes that it would be appropriate to apply proposed Regulation SCI to all SROs (subject to the exception noted in infra note 97), of which the MSRB is one, particularly given the fact that the MSRB is the only SRO relating to municipal securities and is the sole provider of consolidated market data for the municipal securities market. Specifically, in 2008, the Commission amended Rule 15c2-12 to designate the MSRB as the single centralized disclosure repository for continuing municipal securities disclosure. In 2009, the MSRB established the Electronic Municipal Market Access system (“EMMA”). EMMA now serves as the official repository of municipal securities disclosure, providing the public with free access to relevant municipal securities data, and is the central database for information about municipal securities offerings, issuers, and obligors. Additionally, the MSRB's Real-Time Transaction Reporting System (“RTRS”), with limited exceptions, requires municipal bond dealers to submit transaction data to the MSRB within 15 minutes of trade execution, and such near real-time post-trade transaction data can be accessed through the MSRB's EMMA Web site. While pre-trade price information is not as readily available in the municipal securities market, the Commission's Report on the Municipal Securities Market also recommends that the Commission and MSRB explore the feasibility of enhancing EMMA to collect best bids and offers from material ATSs and make them publicly available on fair and reasonable terms. See Report on the Municipal Securities Market (July 31, 2012), available at: http://www.sec.gov/news/studies/2012/munireport073112.pdf. 97 See 15 U.S.C. 78f(g); 15 U.S.C. 78 o -3(k). These entities are security futures exchanges and the National Futures Association, for which the CFTC serves as their primary regulator. The Commission preliminarily believes that it would be appropriate to defer to the CFTC regarding the systems integrity of these entities. 98 For any SCI SRO that is a national securities exchange, any facility of such national securities exchange, as defined in Section 3(a)(2) of the Exchange Act, 15 U.S.C. 78c(a)(2), also would be covered because such facilities are included within the definition of “exchange” in Section 3(a)(1) of the Exchange Act, 15 U.S.C. 78c(a)(1). Proposed Rule 1000(a) would define the term “SCI alternative trading system,” or “SCI ATS,” as an alternative trading system, as defined in § 242.300(a), which during at least four of the preceding six calendar months, had: (1) With respect to NMS stocks—(i) five percent or more in any single NMS stock, and 0.25 percent or more in all NMS stocks, of the average daily dollar volume reported by an effective transaction reporting plan, or (ii) one percent or more, in all NMS stocks, of the average daily dollar volume reported by an effective transaction reporting plan; (2) with respect to equity securities that are not NMS stocks and for which transactions are reported to a self-regulatory organization, five percent or more of the average daily dollar volume as calculated by the self-regulatory organization to which such transactions are reported; or (3) with respect to municipal securities or corporate debt securities, five percent or more of either—(i) the average daily dollar volume traded in the United States, or (ii) the average daily transaction volume traded in the United States. 99 99 Proposed Regulation SCI includes specific quantitative requirements, such as proposed Rule 1000(a), which would include numerical thresholds in the definition of SCI ATS. The Commission recognizes that the specificity of each such quantitative threshold could be read by some to imply a definitive conclusion based on quantitative analysis of that threshold and its alternatives. The numerical thresholds in the definition of SCI ATS have not been derived from econometric or mathematical models. Instead, they reflect a preliminary assessment by the Commission, based on qualitative and some quantitative analysis, of the likely economic consequences of the specific quantitative thresholds proposed to be included in the definition. There are a number of challenges presented in conducting such a quantitative analysis in a robust fashion as discussed in this section. Accordingly, the selection of the particular quantitative thresholds for the definition of SCI ATS reflects a qualitative and preliminary quantitative assessment by the Commission regarding the appropriate thresholds. In making such assessments and, in turn, selecting the proposed quantitative thresholds, the Commission has reviewed data from OATS and other sources. The Commission emphasizes that it invites comment, including relevant data and analysis, regarding all aspects of the various quantitative standards reflected in the proposed rules. As proposed, ATSs would be covered if they met the proposed thresholds for at least four of the preceding six months, which the Commission preliminarily believes is an appropriate time period over which to evaluate the trading volume of an ATS. 100 The Commission preliminarily believes that this time period would help ensure that the standards are not so low as to capture ATSs whose volume would still be considered relatively low, but, for example, that may have had an anomalous increase in trading on a given day or small number of days. 100 The proposed measurement period would remain unchanged from the period currently in Rule 301(b)(6) of Regulation ATS. The proposed definition would modify the thresholds currently appearing in Rule 301(b)(6) of Regulation ATS that apply to significant-volume ATSs. 101 Specifically, the proposed definition would: Use average daily dollar volume thresholds, instead of an average daily share volume threshold, for ATSs that trade NMS stocks or equity securities that are not NMS stocks (“non-NMS stocks”); use alternative average daily dollar and transaction volume-based tests for ATSs that trade municipal securities or corporate debt securities; lower the volume thresholds applicable to ATSs for each category of asset class; and move the proposed thresholds to Rule 1000(a) of proposed Regulation SCI. In particular, with respect to NMS stocks, the Commission proposes to change the volume threshold from 20 percent of average daily volume in any NMS stock such that an ATS that trades NMS stocks that meets either of the following two alternative threshold tests would be subject to the requirements of proposed Regulation SCI: (i) Five percent or more in any NMS stock, and 0.25 percent or more in all NMS stocks, of the average daily dollar volume reported by an effective transaction reporting plan; or (ii) one percent or more, in all NMS stocks, of the average daily dollar volume reported by an effective transaction reporting plan. This change is designed to ensure that proposed Regulation SCI is applied to an ATS that could have a significant impact on the NMS stock market as a whole, as well as an ATS that could have a significant impact on a single NMS stock and some impact on the NMS stock market as a whole at the same time. 102 Specifically, by imposing both a single NMS stock threshold and an all NMS stocks threshold in (i) above, proposed Regulation SCI would not apply to an ATS that has a large volume in a small NMS stock and little volume in all other NMS stocks. Based on data collected from FINRA's Order Audit Trail System (“OATS data”) for one week of trading in May 2012, 103 the Commission preliminarily believes that approximately 10 ATSs trading NMS stocks would exceed the proposed thresholds and fall within the definition of SCI entity, accounting for approximately 87 percent of the dollar volume market share of all ATSs trading NMS stocks. 101 17 CFR 242.301(b)(6). See also supra note 26. 102 Under the proposed thresholds, inactive ATSs would not be included in the definition of SCI ATS. The Commission has considered barriers to entry and the promotion of competition in setting the threshold ( see discussion at infra Section V.C.4.b) such that new ATSs trading NMS stocks would be able to commence operations without, at least initially, being required to comply with—and thereby not incurring the costs associated with—proposed Regulation SCI. If the proposed thresholds are adopted, a new ATS could engage in limited trading in any one NMS stock or all NMS stocks, until it reached an average daily dollar volume of five percent or more in any one NMS stock and 0.25 percent or more in all NMS stocks, or one percent in all NMS stocks, over four of the preceding six months. Because a new ATS could begin trading in NMS stocks for at least three months ( i.e., less than four of the preceding six months), and conduct such trading at any dollar volume level without being subject to proposed Regulation SCI, and would have to exceed the specified volume levels for the requisite period to become so subject, the Commission preliminarily believes that these proposed thresholds should not prevent a new ATS entrant from having the opportunity to initiate and develop its business. 103 Commission staff analyzed OATS data for the week of May 7-11, 2012, a week with average market activity and no holidays or shortened trading days, and thus intended to be a representative trading week. However, because the OATS data analysis does not consider trading volume over a six-month period and does not base the threshold test on four out of the preceding six calendar months as prescribed in proposed Rule 1000(a), it may overestimate the number of ATSs that would meet the proposed thresholds. For example, a large block trade during a single week could skew an ATS's numbers upward from what would be observed over the course of the four months with the highest volumes during a six-month period, particularly with respect to the proposed single-stock threshold. In addition, because the OATS data does not identify all ATSs and does not identify some ATSs uniquely, some ATSs may not be accounted for in the estimated number of ATSs that would meet the proposed threshold. Nevertheless, the Commission believes the analysis of OATS data offers useful insights. The Commission notes that its analysis of the OATS data does not reveal an obvious threshold level above which a particular subset of ATSs may be considered to have a significant impact on individual NMS stocks or the overall market, as compared to another subset of ATSs. The Commission preliminarily believes that inclusion of the proposed dual dollar volume threshold is appropriate to help prevent an ATS from avoiding the requirements of proposed Regulation SCI by circumventing one of the two threshold tests. The Commission also preliminarily believes that a threshold that accounts for 87 percent of the dollar volume market share of all ATSs trading NMS stocks is a reasonable level that would not exclude new entrants to the ATS market. 104 Moreover, the Commission preliminarily believes the proposed thresholds would appropriately include ATSs having NMS stock dollar volume comparable to the NMS stock dollar volume of the equity exchanges that are SCI SROs and therefore covered by proposed Regulation SCI. 105 104 The Commission preliminarily believes that the remaining 13 percent of the dollar volume of all ATSs trading NMS stocks is limited to trading conducted on small and new ATSs. See also supra note 102. 105 For example, based on trade and quotation data published by NYSE Euronext for the period July 1, 2012 through December 31, 2012, the national securities exchanges with the smallest market shares in NMS stocks (based on average daily dollar volume) had market shares slightly above and, in one case, below, the proposed 0.25 percent threshold in all NMS stocks (the market shares of CBOE, NSX, and NYSE MKT were approximately 0.44 percent, 0.27 percent, and 0.06 percent, respectively). Further, all national securities exchanges that trade NMS stocks had at least 5 percent or more of the average daily dollar volume in at least one NMS stock, with most exceeding such threshold for multiple NMS stocks. Since the time that the Commission originally adopted Regulation ATS, the equity markets have evolved significantly, resulting in an increase in the number of trading centers and a reduction in the concentration of trading activity. 106 As such, even smaller trading centers, such as certain ATSs, now collectively represent a significant source of liquidity for NMS stocks and, by comparison, no single registered securities exchange executes more than 20 percent of volume in NMS stocks. 107 Given these developments in market structure, the Commission preliminarily believes that setting the average daily dollar volume threshold for NMS stocks at five percent in any NMS stock and 0.25 percent in all NMS stocks, or one percent in all NMS stocks, is appropriate to help ensure that entities that have determined to participate (in more than a limited manner) in the national market system as markets that bring buyers and sellers together, are subject to the requirements of proposed Regulation SCI. In addition, the Commission preliminarily believes that it is appropriate to propose average daily dollar volume thresholds for NMS stocks, rather than average daily share volume thresholds, because, by using dollar volume, the price level of a stock will not skew an ATS's inclusion or exclusion from the definition of SCI entity, as may be the case when using share volume, and the use of dollar thresholds may better reflect the economic impact of trading activity. 108 106 See supra notes 47-51 and accompanying text. 107 See supra note 47. 108 For example, if a threshold is based on the average daily share volume in all NMS stocks, an ATS that transacts in a stock that has recently been through a stock split could experience a significant increase in its share volume (or, for reverse stock splits, a decrease in its share volume), whereas the dollar value transacted would remain the same. In sum, the Commission preliminarily believes that the proposed dollar volume thresholds for NMS stocks would further the goals of the national market system by ensuring that ATSs that meet the thresholds are subject to the same baseline standards as other SCI entities for systems capacity, integrity, resiliency, availability, and security. With respect to non-NMS stocks, municipal securities, and corporate debt securities, the Commission is proposing to lower the current thresholds in Rule 301(b)(6) of Regulation ATS. Specifically, the Commission is proposing to reduce the standard from 20 percent to five percent for these types of securities, 109 the same percentage threshold for such types of securities that triggers the fair access provisions of Rule 301(b)(5) of Regulation ATS. 110 The Commission preliminarily believes that ATSs that trade non-NMS stocks, municipal securities, and corporate debt securities above the proposed thresholds are those that play a significant role in the market for such securities and thus preliminarily believes that the proposed thresholds are appropriately designed. 109 See proposed Rule 1000(a). As discussed in this Section III.B.1, the thresholds in proposed Rule 1000(a) would be based on average daily dollar or transaction volume. 110 See Rule 301(b)(5) of Regulation ATS under the Exchange Act. 17 CFR 242.301(b)(5). With respect to non-NMS stocks for which transactions are reported to a self-regulatory organization, the Commission proposes to lower the threshold to five percent or more of the average daily dollar volume as calculated by the self-regulatory organization to which such transactions are reported. Using data from the first six months of 2012, the Commission believes that an ATS executing transactions in non-NMS stocks at a level exceeding five percent of the average daily dollar volume traded in the United States would be executing trades at a level exceeding $31 million daily. 111 Based on data collected from Form ATS-R for the second quarter of 2012, the Commission estimates that two ATSs would exceed this threshold and fall within the definition of SCI entity. The Commission requests comment on the accuracy of these estimates. 111 Source: Data provided by OTC Markets. With respect to municipal securities and corporate debt securities, the Commission proposes to lower the threshold to five percent or more of either: (i) The average daily dollar volume 112 traded in the United States; or (ii) the average daily transaction volume traded in the United States. The Commission preliminarily believes that this two-pronged threshold is appropriate for the debt market, as it should capture both ATSs that are focused on retail orders and facilitate a relatively greater number of trades with relatively lower dollar values, as well as those ATSs that are focused on institutional orders and facilitate a relatively lower number of trades with relatively greater dollar values. The Commission preliminarily believes that both of these thresholds are important in identifying ATSs that play a significant role in the debt markets for executing both retail- and institutional-sized trades. 113 112 As with the proposed measures for ATSs that trade NMS stocks or non-NMS stocks, the Commission is proposing to use average daily dollar volume for debt securities, which the Commission preliminarily believes is the measure most commonly used when analyzing daily trading volume in the debt markets. 113 Most corporate and municipal bond trades are small ( i.e., less than $100,000), but small trades do not account for most of the dollar volume in these markets. See, e.g., Edwards, Amy K., Harris, Lawrence and Piwowar, Michael S., Corporate Bond Market Transaction Costs and Transparency, Journal of Finance, Vol. 62, No. 3 (June 2007) and Lawrence E. Harris and Michael S. Piwowar, Secondary Trading Costs in the Municipal Bond Market, J.FIN. (June 2006). An ATS that specializes in large trades may account for a small portion of the trades but a large portion of the dollar volume. Likewise, an ATS that specializes in small trades may account for a small portion of the dollar volume but a large portion of the trades. Therefore, a systems disruption, systems compliance issue, or systems intrusion in either of these ATS types could potentially disrupt a large portion of the market. As the Commission stated in the ATS Release, “many of the same concerns about the trading of equity securities on alternative trading systems apply equally to the trading of fixed income securities on alternative trading systems. Specifically, it is important that markets with significant portions of the volume in particular instruments have adequate systems capacity, integrity, and security, regardless of whether those instruments are equity securities or debt securities. Similarly, as electronic systems for debt grow, it will become increasingly important for the fair operation of our markets for market participants to have fair access to significant market centers in debt securities. One of the consequences of the growing role of alternative trading systems in the securities markets generally is that debt securities are increasingly being traded on these systems, similar to the way equity securities are traded.” See ATS Release, supra note 2, at 70862. Using data from the first six months of 2012, the Commission believes that an ATS executing transactions in municipal securities at a level exceeding five percent of the average daily dollar volume traded in the United States would be executing trades at a level of at least approximately $550 million daily, 114 and that an ATS executing transactions in municipal securities at a level exceeding five percent of the average daily transaction volume traded in the United States would be executing an average of at least approximately 1,900 transactions daily. 115 Based on data collected from Form ATS-R for the second quarter of 2012, the Commission preliminarily believes that currently no ATSs executing transactions in municipal securities would exceed the proposed average daily dollar volume threshold and fall within the definition of SCI entity pursuant to that proposed prong. ATSs are not required to report transaction volume data for municipal securities on Form ATS-R. However, based on discussions with industry sources, the Commission preliminarily believes that three ATSs executing transactions in municipal securities would likely exceed the proposed average daily transaction volume threshold. 116 The Commission requests comment on the accuracy of these estimates. 114 For the period of January 1, 2012 to June 30, 2012, the average daily dollar volume of trades was over $11 billion. See http://emma.msrb.org/marketactivity/ViewStatistics.aspx (accessed January 30, 2013). Five percent of this amount is approximately $550 million. 115 For the period of January 1, 2012 to June 30, 2012, the average daily transaction volume was approximately 39,000. See http://emma.msrb.org/marketactivity/ViewStatistics.aspx (accessed January 30, 2013). Five percent of this amount is approximately 1,900 trades. 116 See, e.g., the Commission's Report on the Municipal Securities Market, supra note 96 at n.715. The Commission preliminarily believes that the three ATSs that would likely exceed the proposed average daily transaction volume threshold for municipal securities are the same three ATSs that would likely exceed the corresponding threshold for corporate debt securities. See infra note 119. Using data from the first six months of 2012, the Commission believes that an ATS executing transactions in corporate debt at a level exceeding five percent of the average daily dollar volume traded in the United States would be executing trades at a level of at least approximately $900 million daily, 117 and that an ATS executing transactions in corporate debt at a level exceeding five percent of the average daily transaction volume traded in the United States would be executing an average of at least approximately 2,100 transactions daily. 118 Based on data collected from Form ATS-R for the second quarter of 2012, the Commission preliminarily believes that currently no ATSs executing transactions in corporate debt would exceed the proposed average daily dollar volume threshold and fall within the definition of SCI entity pursuant to that proposed prong. ATSs are not required to report transaction volume data for corporate debt on Form ATS-R. However, based on discussions with industry sources, the Commission preliminarily believes that three ATSs executing transactions in corporate debt would likely exceed the proposed average daily transaction volume threshold. 119 The Commission requests comment on the accuracy of these estimates. 117 For the period of January to June 2012, the average daily dollar volume was approximately $18 billion. Five percent of this amount is approximately $900 million. See U.S. Bond Market Trading Volume, available at: http://www.sifma.org/research/statistics.aspx. 118 Source: Corporate bond transactions reported to TRACE from January through June 2012, excluding instruments subject to Rule 144A and April 6, 2012 (short trading day). 119 As noted above, the Commission preliminarily believes that the three ATSs that would likely exceed the proposed average daily transaction volume threshold for corporate debt securities are the same three ATSs that would likely exceed the corresponding threshold for municipal securities. See supra note 116. The Commission is proposing these numerical thresholds as a preliminary best estimate of when a market is of sufficient significance to the trading of the relevant asset class ( i.e., NMS stocks, non-NMS stocks, municipal securities, and corporate debt securities) as to warrant the protections and obligations of proposed Regulation SCI. As noted above, 120 the numerical thresholds in the definition of SCI ATS have not been derived from econometric or mathematical models. Instead, they reflect a preliminary assessment by the Commission, based on qualitative and some quantitative analysis, of the likely economic consequences of the specific quantitative thresholds proposed to be included in the definition. The Commission recognizes that there may reasonably be differing views as to what the threshold levels for inclusion should be and thus the Commission solicits comment on the appropriateness of the proposed threshold levels. 120 See supra note 99. The Commission recognizes that it is proposing numerically higher thresholds for non-NMS stocks, municipal securities, and corporate debt securities as compared to NMS stocks (five percent, as compared to one percent in all NMS stocks). While the Commission preliminarily believes that similar concerns about the trading of NMS stocks on ATSs apply to the trading of non-NMS stocks and debt securities on ATSs (namely, that markets with significant portions of the volume in particular instruments have adequate systems capacity, integrity, resiliency, availability, and security), the Commission notes that it has traditionally provided special safeguards with regard to NMS stocks in its rulemaking efforts relating to market structure. 121 121 See, e.g., Regulation NMS, 17 CFR 242.600-612; Securities Exchange Act Release No. 51808 (June 9, 2005), 70 FR 27496 (June 29, 2005). Further, in part due to the greater availability of, and reliance on, electronic trading for NMS stocks, the trading of such securities is generally more accessible to a wider range of investors and has resulted in increases in electronic trading volumes relative to 15 years ago, as compared to other markets, such as the debt markets, which still largely rely on manual trading. Because the degree of automation and electronic trading is generally lower in markets that trade non-NMS stocks and debt securities than in the markets that trade NMS stocks, the Commission preliminarily believes that a systems issue at an SCI entity that trades non-NMS stocks or debt securities would not have as significant an impact as readily as a systems issue at an SCI entity that trades NMS stocks. Therefore, the Commission preliminarily believes there is less need in the markets for those securities for more stringent thresholds that would trigger the requirements of proposed Regulation SCI. 122 For example, the most recent widely publicized issues involving systems problems and disruptions in the securities markets have generally all been related to NMS stocks. 123 The Commission also believes that imposition of a threshold that is set too low in markets that lack automation could have the unintended effects of discouraging automation in these markets and discouraging new entrants into these markets. For these reasons, the Commission preliminarily believes that it is appropriate at this time to apply a different threshold to ATSs trading NMS stocks than those ATSs trading non-NMS stocks, municipal securities, and corporate debt securities. 122 See also discussion in infra Section V.C.3.c. 123 See, e.g., supra notes 61-66 and accompanying text. Under Proposed Rule 1000(a), the term “plan processor” would have the meaning set forth in Rule 600(b)(55) of Regulation NMS, which defines “plan processor” as “any self-regulatory organization or securities information processor acting as an exclusive processor in connection with the development, implementation and/or operation of any facility contemplated by an effective national market system plan.” 124 As noted above, the ARP Inspection Program has developed to include the systems of the plan processors of the four current SCI Plans. 125 Any entity selected as the processor of an SCI Plan is responsible for operating and maintaining computer and communications facilities for the receipt, processing, validating, and dissemination of quotation and/or last sale price information generated by the members of such plan. 126 Although an entity selected as the processor of an SCI Plan acts on behalf of a committee of SROs, such entity is not required to be an SRO, nor is it required to be owned or operated by an SRO. 127 The Commission believes, however, that the systems of such entities, because they deal with key market data, form the “heart of the national market system,” 128 and should be subject to the same systems standards as SCI SROs, and proposes to include “plan processors” in the definition of SCI entity. 129 124 See 17 CFR 242.600(b)(55). 125 See supra note 87, defining the term “SCI Plan” and discussing plan processors. 126 See, e.g., CTA Plan Section V(d) and CQS Plan Section V(d), available at: http://www.nyxdata.com/cta; see also OPRA Plan, Section V, available at: http://www.opradata.com/pdf/opra_plan.pdf; and Nasdaq UTP Plan Section IV, available at: http://www.utpplan.com. 127 Pursuant to Section 11A of the Exchange Act (15 U.S.C. 78k-1), and Rule 609 of Regulation NMS thereunder (17 CFR 242.609), such entities, as “exclusive processors,” are required to register with the Commission as securities information processors on Form SIP. See 17 CFR 249.1001 (Form SIP, application for registration as a securities information processor or to amend such an application or registration). 128 See Concept Release on Equity Market Structure, supra note 42, at 3600 (quoting H.R. Rep. No. 94-229, 94th Cong., 1st Sess. 93 (1975)). 129 See supra note 87. Pursuant to its terms, each SCI Plan is required to periodically review its selection of its processor, and may in the future select a different processor for the SCI Plan than its current processor. 130 The proposed inclusion of “plan processors” in the definition of SCI entity is designed to ensure that the processor for an SCI Plan, regardless of its identity, is independently subject to the requirements of proposed Regulation SCI. Thus, the proposed definition would cover any entity selected as the processor for a current or future SCI Plan. 131 The Commission preliminarily believes that it is important for such plan processors to be subject to the requirements of proposed Regulation SCI because of the important role they serve in the national market system: Operating and maintaining computer and communications facilities for the receipt, processing, validating, and dissemination of quotation and/or last sale price information generated by the members of the plan. 132 130 See CTA Plan Section V(d) and CQS Plan Section V(d), available at: http://www.nyxdata.com/cta; OPRA Plan Section V, available at: http://www.opradata.com/pdf/opra_plan.pdf; and Nasdaq UTP Plan Section V, available at: http://www.utpplan.com. 131 Currently, the Securities Industry Automation Corporation (“SIAC”) is the processor for the CTA Plan, CQS Plan, and OPRA Plan and Nasdaq is the processor for the Nasdaq UTP Plan. SIAC is wholly owned by NYSE Euronext. Both SIAC and Nasdaq are registered with the Commission as securities information processors, as required by Section 11A(b)(1) of the Exchange Act, 15 U.S.C. 78k-1(b)(1), and in accordance with Rule 609 of Regulation NMS thereunder, 17 CFR 242.609. The Commission preliminarily believes that the proposed definition of plan processor also would include any entity selected and acting as exclusive processor of a future NMS plan, such as that contemplated by the Commission's rules to create a consolidated audit trail. See Securities Exchange Act No. 67457 (July 18, 2012), 77 FR 45722 (August 1, 2012) (“Consolidated Audit Trail Adopting Release”). 132 See supra note 126 and accompanying text. Under proposed Rule 1000(a), the term “exempt clearing agency subject to ARP” would mean “an entity that has received from the Commission an exemption from registration as a clearing agency under Section 17A of the Act, and whose exemption contains conditions that relate to the Commission's Automation Review Policies, or any Commission regulation that supersedes or replaces such policies.” This proposed definition of “exempt clearing agency subject to ARP” presently would apply to one entity, Global Joint Venture Matching Services—US, LLC (“Omgeo”). 133 133 On April 17, 2001, the Commission issued an order granting Omgeo an exemption from registration as a clearing agency subject to certain conditions and limitations in order that Omgeo might offer electronic trade confirmation and central matching services. See Global Joint Venture Matching Services—US, LLC; Order Granting Exemption from Registration as a Clearing Agency, Securities Exchange Act Release No. 44188 (April 17, 2001), 66 FR 20494 (April 23, 2001) (File No. 600-32) (“Omgeo Exemption Order”). Because the Commission granted it an exemption from clearing agency registration, Omgeo is not a self-regulatory organization. See id. at 20498, n.41. Among the operational conditions required by the Commission in the Omgeo Exemption Order were several that directly related to the ARP policy statements. 134 For the same reasons that it required Omgeo to abide by the conditions relating to the ARP policy statements set forth in the Omgeo Exemption Order, the Commission preliminarily believes it would be appropriate that Omgeo (or any similarly situated exempt clearing agency) should be subject to the requirements of proposed Regulation SCI, and thus is proposing to include any “exempt clearing agency subject to ARP” as explained above, within the definition of SCI entity. 135 134 These conditions required Omgeo to, among other things: Provide the Commission with an audit report addressing all areas discussed in the Commission ARP policy statements; provide annual reports prepared by competent, independent audit personnel in accordance with the annual risk assessment of the areas set forth in the ARP policy statements; report all significant systems outages to the Commission; provide advance notice of any material changes made to its electronic trade confirmation and central matching services; and respond and require its service providers to respond to requests from the Commission for additional information relating to its electronic trade confirmation and central matching services, and provide access to the Commission to conduct inspections of its facilities, records and personnel related to such services. See id. 135 In the Omgeo Exemption Order, the Commission stated that, “[b]ecause these conditions are designed to promote interoperability, the Commission intends to require substantially the same conditions of other Central Matching Services that obtain an exemption from registration as a clearing agency.” See id. Request for Comment 1. The Commission requests comment generally on the proposed definition of SCI entity and its constituent parts. Do commenters believe that entities of the type that would satisfy the proposed definition of SCI entity play significant roles in the U.S. securities markets such that they should be subject to proposed Regulation SCI? Why or why not? 2. Do commenters believe the scope of the proposed definition of SCI SRO is appropriate? Does the proposed definition of SCI SRO include types of entities that should not be subject to the proposed requirements, or exclude types of entities that should be subject to the proposed requirements? If so, please identify such types of entities and explain why they should or should not be included in the definition of SCI entity or SCI SRO. Should the definition of “SCI self-regulatory organization” include exchanges notice-registered with the Commission pursuant to 15 U.S.C. 78f(g) or a limited purpose national securities association registered with the Commission pursuant to 15 U.S.C. 78 o -3(k)? Do commenters believe that it is appropriate to defer to the CFTC regarding the systems compliance and integrity of such entities? Why or why not? 3. Do commenters believe that the proposed definition of “SCI alternative trading system” is appropriate? Why or why not? Do commenters believe that the proposed volume thresholds for the different asset classes under the proposed definition of SCI ATS are appropriate? Specifically, are the proposed average daily dollar volume thresholds of five percent or more in any NMS stock and 0.25 percent or more in all NMS stocks, or one percent or more in all NMS stocks, appropriate? Would higher or lower daily dollar volume thresholds for NMS stocks be more appropriate? 136 Please explain and provide data in support. Alternatively, would a different threshold measurement be more appropriate ( e.g., transaction volume, share volume, etc.)? If so, which and at what threshold level? 137 Please explain and provide data in support. 136 For example, based on data from FINRA's Order Audit Trail System, if the threshold were instead to be set at five percent or more in any NMS stock and 0.5 percent or more in all NMS stocks, the Commission preliminarily estimates that approximately nine ATSs would satisfy the thresholds, accounting for approximately 84 percent of the dollar-volume market share of all ATSs trading NMS stocks ( i.e., not including NMS stocks traded on SROs). If the threshold were instead to be set at five percent or more in any NMS stock and one percent or more in all NMS stocks, the Commission preliminarily estimates that approximately three ATSs would satisfy the thresholds, accounting for approximately 38 percent of the market share. Further, if the threshold were instead to be set at 0.25 percent in all NMS stocks, the Commission preliminarily estimates that approximately ten ATSs would satisfy the threshold. If the threshold were instead to be set at 0.5 percent in all NMS stocks, the Commission preliminarily estimates that approximately nine ATSs would satisfy the threshold. 137 For example, based on data collected from Form ATS-R for the second quarter of 2012 and consolidated NMS stock share volume from the first six months of 2012, if the threshold were instead to be set at 0.25 percent of average daily NMS stock consolidated share volume, the Commission preliminarily estimates that approximately 15 ATSs would satisfy the threshold, accounting for approximately 14 percent of the total average daily consolidated share volume. If the threshold were instead to be set at 0.5 percent of average daily NMS stock consolidated share volume, the Commission preliminarily estimates that approximately 12 ATSs would satisfy the threshold, accounting for approximately 13 percent of the total average daily consolidated share volume. If the threshold were instead to be set at one percent of average daily NMS stock consolidated share volume, the Commission preliminarily estimates that approximately 6 ATSs would satisfy the threshold, accounting for approximately nine percent of the total average daily consolidated share volume. Based on consolidated NMS stock share volume from the first six months of 2012, the Commission estimates that the equity securities exchanges with the smallest volume each account for approximately 0.2 percent to 0.4 percent of the total average daily con [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2013-05888. Public record. Not legal advice.