# Regulation Systems Compliance and Integrity > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2023-05775 ## Record - **Collection:** Federal Register - **Document type:** Proposed Rule - **Published:** April 14, 2023 - **Citation:** 88 FR 23146 ## Text SECURITIES AND EXCHANGE COMMISSION 17 CFR Parts 242 and 249 [Release No. 34-97143; File No. S7-07-23] RIN 3235-AN25 Regulation Systems Compliance and Integrity AGENCY: Securities and Exchange Commission. ACTION: Proposed rule. SUMMARY: The Securities and Exchange Commission (“Commission” or “SEC”) is proposing amendments to Regulation Systems Compliance and Integrity (“Regulation SCI”) under the Securities Exchange Act of 1934 (“Exchange Act”). The proposed amendments would expand the definition of “SCI entity” to include a broader range of key market participants in the U.S. securities market infrastructure, and update certain provisions of Regulation SCI to take account of developments in the technology landscape of the markets since the adoption of Regulation SCI in 2014. The proposed expansion would add the following entities to the definition of “SCI entity”: registered security-based swap data repositories (“SBSDRs”); registered broker-dealers exceeding an asset or transaction activity threshold; and additional clearing agencies exempted from registration. The proposed updates would amend provisions of Regulation SCI relating to systems classification and lifecycle management; third party/vendor management; cybersecurity; the SCI review; the role of current SCI industry standards; and recordkeeping and related matters. Further, the Commission is requesting comment on whether significant-volume alternative trading systems (ATSs) and/or broker-dealers using electronic or automated systems for trading of corporate debt securities or municipal securities should be subject to Regulation SCI. DATES: Comments should be received on or before June 13, 2023. ADDRESSES: Comments may be submitted by any of the following methods: Electronic Comments • Use the Commission's internet comment form ( https://www.sec.gov/rules/proposed.shtml ); or • Send an email to rule-comments@sec.gov . Please include File Number S7-07-23 on the subject line. Paper Comments • Send paper comments to, Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549-1090. All submissions should refer to File Number S7-07-23. This file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method of submission. The Commission will post all comments on the Commission's website ( https://www.sec.gov/rules/proposed.shtml ). Comments are also available for website viewing and printing in the Commission's Public Reference Room, 100 F Street NE, Washington, DC 20549 on official business days between the hours of 10 a.m. and 3 p.m. Operating conditions may limit access to the Commission's Public Reference Room. All comments received will be posted without change. Persons submitting comments are cautioned that we do not redact or edit personal identifying information from comment submissions. You should submit only information that you wish to make available publicly. Studies, memoranda, or other substantive items may be added by the Commission or staff to the comment file during this rulemaking. A notification of the inclusion in the comment file of any materials will be made available on our website. To ensure direct electronic receipt of such notifications, sign up through the “Stay Connected” option at www.sec.gov to receive notifications by email. FOR FURTHER INFORMATION CONTACT: Heidi Pilpel, Senior Special Counsel; David Liu, Special Counsel; Sara Hawkins, Special Counsel; Gita Subramaniam, Special Counsel; Josh Nimmo, Special Counsel; An Phan, Special Counsel, at (202) 551-5500, Office of Market Supervision, Division of Trading and Markets, U.S. Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549. SUPPLEMENTARY INFORMATION: The Commission is proposing amendments to the following rules under the Exchange Act and conforming amendments to Form SCI. Commission reference CFR citation (17 CFR) Rule 1000 § 242.1000 Rule 1001 § 242.1001 Rule 1001(a) § 242.1001(a) Rule 1001(a)(2) § 242.1001(a)(2) Rule 1001(a)(2)(v) § 242.1001(a)(2)(v) Rule 1001(a)(2)(vi) § 242.1001(a)(2)(vi) Rule 1001(a)(2)(vii) § 242.1001(a)(2)(vii) Rule 1001(a)(4) § 242.1001(a)(4) Rule 1002 § 242.1002 Rule 1002(b) § 242.1002(b) Rule 1002(b)(4)(ii)(B) § 242.1002(b)(4)(ii)(B) Rule 1002(b)(5) § 242.1002(b)(5) Rule 1002(b)(5)(i) § 242.1002(b)(5)(i) Rule 1002(b)(5)(ii) § 242.1002(b)(5)(ii) Rule 1002(c) § 242.1002(c) Rule 1002(c)(3) § 242.1002(c)(3) Rule 1002(c)(4) § 242.1002(c)(4) Rule 1002(c)(4)(i) § 242.1002(c)(4)(i) Rule 1002(c)(4)(ii) § 242.1002(c)(4)(ii) Rule 1003 § 242.1003 Rule 1003(b) § 242.1003(b) Rule 1003(b)(1) § 242.1003(b)(1) Rule 1003(b)(2) § 242.1003(b)(2) Rule 1003(b)(3) § 242.1003(b)(3) Rule 1004 § 242.1004 Rule 1004(a) § 242.1004(a) Rule 1004(b) § 242.1004(b) Rule 1005 § 242.1005 Rule 1005(c) § 242.1005(c) I. Introduction II. Background and Overview A. History of Regulation SCI B. Current Regulation SCI 1. SCI Entities and SCI Systems 2. Reasonably Designed Policies and Procedures 3. SCI Events 4. Systems Changes and SCI Review 5. Business Continuity and Disaster Recovery Testing with Members/Participants 6. Recordkeeping and Other Provisions (Rules 1005-1007) C. Overview of Proposed Amendments to Regulation SCI III. Proposed Amendments to Regulation SCI A. Definition of SCI Entity 1. Evolution: Current and Proposed SCI Entities 2. New Proposed SCI Entities 3. General Request for Comment on Proposed Expansion of SCI Entities B. Request for Comment Regarding Significant-Volume Fixed Income ATSs and Broker-Dealers Using Electronic or Automated Systems for Trading of Corporate Debt Securities or Municipal Securities 1. Discussion 2. Request for Comment C. Strengthening Obligations of SCI Entities 1. Systems Classification and Lifecycle Management 2. Third-Party Provider Management 3. Security 4. SCI Review 5. Current SCI Industry Standards 6. Other Changes D. SCI Entities Subject to the Exchange Act Cybersecurity Proposal and/or Regulation S-P 1. Discussion 2. Request for Comment IV. Paperwork Reduction Act A. Summary of Collections of Information B. Proposed Use of Information 1. Rule 1001 of Regulation SCI 2. Rule 1002 of Regulation SCI 3. Rule 1003 of Regulation SCI 4. Rule 1004 of Regulation SCI 5. Rule 1005 and 1007 of Regulation SCI 6. Rule 1006 of Regulation SCI C. Respondents D. Total Initial and Annual Reporting Burdens 1. Rule 1001 2. Rule 1002 3. Rule 1003 4. Rule 1004 5. Rule 1005 6. Rule 1006 7. Summary of the Information Collection Burden E. Collection of Information Is Mandatory F. Confidentiality of Responses to Collection of Information G. Request for Comment V. Economic Analysis A. Introduction B. Baseline 1. New SCI Entities 2. Existing SCI Entities: 3. Current Market Practice 4. Other Affected Parties C. Analysis of Benefits and Costs of Proposed Amendments 1. General Benefits and Costs of Proposed Amendments 2. Expansion to New SCI Entities 3. Specific Benefits and Costs of Regulation SCI Requirements for All SCI Entities D. Efficiency, Competition, and Capital Formation Analysis E. Reasonable Alternatives 1. Limiting the Scope of the Regulation SCI Provisions for New SCI Entities 2. Mandating Compliance with Current SCI Industry Standards 3. Requiring Diversity of Back-Up Plan Resources 4. Penetration Testing Frequency 5. Attestation for Critical SCI System Vendors 6. Transaction Activity Threshold for SCI Broker-Dealers 7. Limitation on Definition of “SCI Systems” for SCI Broker-Dealers VI. Regulatory Flexibility Act Certification A. “Small Entity” Definitions B. Current SCI Entities 1. SCI SROs 2. The MSRB 3. SCI ATSs C. Proposed SCI Entities 1. SBSDRs 2. SCI Broker-dealers 3. Exempt Clearing Agencies D. Certification Statutory Authority I. Introduction The U.S. securities markets are among the largest and most liquid in the world, attracting a wide variety of issuers and broad investor participation, and are essential for capital formation, job creation, and economic growth, both domestically and across the globe. The fair and orderly functioning of the U.S. securities markets is critically important to the U.S. economy. In 2014, recognizing the decades-long transformation of many U.S. securities markets from primarily manual markets to those that had become almost entirely electronic and highly dependent on sophisticated technology, including complex and interconnected trading, clearing, routing, market data, regulatory, surveillance and other technological systems, the Commission adopted 17 CFR 242.1000 through 242.1007 (“Regulation SCI”) to supersede and replace the Commission's voluntary Automation Review Policy Program (“ARP”) and certain provisions of 17 CFR 242.300 through 242.304 (“Regulation ATS”). 1 Regulation SCI, which applies to “SCI entities” with respect to their “SCI systems” and “indirect SCI systems,” was the Commission's first formal extensive regulatory framework for oversight of the core technology of the U.S. securities markets. 1 See Securities Exchange Act Release No. 73639 (Nov. 19, 2014), 79 FR 72252 (Dec. 5, 2014) (“SCI Adopting Release”). The U.S. securities markets have demonstrated resilience since the adoption of Regulation SCI, with some market observers crediting Regulation SCI in helping to ensure that markets and market participants were prepared for the unprecedented trading volumes and volatility experienced in March 2020 at the onset of the COVID-19 pandemic. 2 The U.S. securities markets continue to experience changes and new challenges, however. The growth of electronic trading allows ever-increasing volumes of securities transactions in a broader range of asset classes to take place at increasing speed by competing trading platforms, including those offered by broker-dealers that play multiple roles in the markets. 3 In addition, new types of registered entities that are highly dependent on interconnected technology have entered the markets. 4 The prevalence of remote workforces, furthered by the COVID-19 pandemic, 5 and increased outsourcing to third-party providers, including cloud service providers, continue to drive the markets' and market participants' reliance on new and evolving technology. 6 While these advances demonstrate the dynamic and adaptable nature of the U.S. securities markets and market participants, the greater dispersal, sophistication, and interconnection of the technology underpinning our markets bring potential new risks. These risks include not only the heightened risk of exposure to cybersecurity events from threat actors intent on doing harm, but also operational systems problems that can and do arise inadvertently. 2 See, e.g., Shane Remolina, Is Remote Trading Leading to a Paradigm Shift on the Trading Desk?, Traders Magazine (May 20, 2020), available at www.tradersmagazine.com/departments/buyside/is-remote-trading-leading-to-a-paradigm-shift-on-the-trading-desk (observing “no outages” at the stock exchanges in Mar. 2020 in contrast to “glitches” experienced in 2000s); Financial Industry Regulatory Authority, Inc. (“FINRA”), Market Structure & COVID-19: Handling Increased Volatility and Volumes (Apr. 28, 2020), available at https://www.finra.org/media-center/finra-unscripted/market-structure-covid19-coronavirus (observing that market infrastructure and integrity held during the challenges in Mar. 2020, and crediting Regulation SCI, among other regulatory protections). 3 See, e.g., Securities Industry and Financial Markets Association (“SIFMA”), SIFMA Insights: Electronic Trading Market Structure Primer (Oct. 2019), available at https://www.sifma.org/wp-content/uploads/2019/10/SIFMA-Insights-Electronic-Trading-Market-Structure-Primer.pdf (summarizing electronic trading history and trends in different markets). See also SEC Staff Report on Algorithmic Trading in U.S. Capital Markets at 16-19, 37 (Aug. 5, 2020), available at https://www.sec.gov/files/marketstructure/research/algo_trading_report_2020.pdf (discussing broker-dealer ATSs and internalizers, and other in-house sources of liquidity, such as single-dealer platforms (“SDPs”), and central risk books operated by broker-dealers) (“Algorithmic Trading Report”). Staff reports, Investor Bulletins, and other staff documents (including those cited herein) represent the views of Commission staff and are not a rule, regulation, or statement of the Commission. The Commission has neither approved nor disapproved the content of these staff documents and, like all staff statements, they have no legal force or effect, do not alter or amend applicable law, and create no new or additional obligations for any person. 4 See infra section III.A.2.a (discussing registered SBSDRs). 5 See FS-ISAC, Navigating Cyber 2021 (Apr. 2021), available at https://www.fsisac.com/navigatingcyber2021-report . See also Vikki Davis, Combating the cybersecurity risks of working home, Cyber Magazine (Dec. 2, 2021), available at https://cybermagazine.com/cyber-security/combating-cybersecurity-risks-working-home . 6 See, e.g., Angus Loten, Cloud Demand Drives Data Center Market to New Records, Wall St. J. (Feb. 27, 2020); Angus Loten, CIOs Accelerate Pre-Pandemic Cloud Push, Wall St. J. (Apr. 26, 2021). As the Commission has acknowledged, Regulation SCI is not, nor can it be, designed to guarantee that SCI entities have flawless systems. 7 Rather, its goals are to strengthen the technology infrastructure of the U.S. securities markets and improve its resilience when technology falls short. 8 To help achieve these goals, the regulation requires that SCI entities have policies and procedures reasonably designed to ensure that their systems have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain their operational capability and promote the maintenance of fair and orderly markets, and requires measures that facilitate the Commission's oversight of securities market technology infrastructure. 9 Consistent with the goals of addressing technological vulnerabilities and improving oversight of the core technology of key U.S. securities market entities, the Commission is proposing amendments to Regulation SCI that would expand its application to additional key market participants and update certain of its provisions to take account of the evolution of technology and trading since the rule's adoption in 2014. The application of Regulation SCI to a broader range of entities together with updates to certain provisions—including to account for heightened cybersecurity risks, wider use of cloud service providers, and the increasingly complex and interconnected nature of SCI entities' systems—should help ensure that the technology infrastructure of the U.S. securities markets remains robust, resilient, and secure. 7 See SCI Adopting Release, supra note 1, at 72291, 72351. 8 See id. at 72257. 9 See generally SCI Adopting Release, supra note 1, at 72299, 72372, 72402, 72404-05. The Commission has issued other proposals related to cybersecurity that would apply to SCI entities as well as other entities under the Commission's jurisdiction. 10 Regulation SCI, currently, and as proposed to be amended, however, differs from these proposals in terms of its purpose and scope. Regulation SCI applies to entities designated as key market participants because they play a significant role in the U.S. securities markets and/or have the potential to impact investors, the overall market, or the trading of individual securities in the event of a systems issue. Regulation SCI requires key market participants to (i) have policies and procedures in place to help ensure the robustness and resiliency of their market technology systems, and (ii) provide certain notices and reports to the Commission, and in some cases, market participants, to facilitate Commission oversight of securities market infrastructure. While Regulation SCI has cybersecurity aspects and certain of the proposed amendments to Regulation SCI would update policies and procedures requirements designed to keep SCI systems and indirect SCI systems secure, the proposed amendments are designed, more broadly, to ensure that SCI entities (current and proposed) have systems technology adequate to maintain operational capability of the systems on which the maintenance of fair and orderly markets depend. 10 These include a proposal to adopt new rules requiring broker-dealers, major security-based swap participants, national securities exchanges, national securities associations, security-based swap data repositories, security-based swap dealers, transfer agents, and the Municipal Securities Rulemaking Board (“MSRB”) to adopt and implement written cybersecurity policies and procedures reasonably designed to address cybersecurity risks to their “information systems” and notify the Commission and the public of significant cybersecurity incidents affecting their information systems. See Securities Exchange Release No. 97142 (Mar. 15, 2023), 88 FR 20212 (April 5, 2023) (proposing 17 CFR 242.10) (for ease of reference, this proposal is referred to as the “Exchange Act Cybersecurity Proposal”). See also Securities Exchange Release No. 97141 (Mar. 15, 2023), 88 FR 20616 (April 6, 2023) (proposing to amend 17 CFR part 248, subpart A (“Regulation S-P”), to, among other things, require broker-dealers, investment companies, SEC-registered investment advisers, and transfer agents to adopt incident response programs to address unauthorized access to or use of customer records and information, including procedures for providing timely notification to individuals affected by an information security incident designed to help affected individuals respond appropriately) (“Regulation S-P 2023 Proposing Release”). See infra section III.D (discussing of how SCI entities would be affected if the Exchange Act Cybersecurity Proposal, Regulation S-P 2023 Proposing Release, and this proposal are all adopted as proposed). In addition, the Commission has pending proposals to address cybersecurity risk with respect to investment advisers, investment companies, and public companies. See Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies, Release Nos. 33-11028, 34-94917, IA-5956, IC-34497 (Feb. 9, 2022), 87 FR 13524 (Mar. 9, 2022) (“IA/IC Cybersecurity Proposing Release”); Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release Nos. 33-11038, 34-94382, IC-34529 (Mar. 9, 2022), 87 FR 16590 (Mar. 23, 2022). The Commission has reopened the comment period for the IA/IC Cybersecurity Proposing Release to allow interested persons additional time to analyze the issues and prepare their comments in light of other regulatory developments, including the proposed rules and amendments regarding this proposal, the Exchange Act Cybersecurity Proposal and the Regulation S-P 2023 Proposing Release. The Commission encourages commenters to review those proposals to determine whether they might affect their comments on this proposing release. II. Background and Overview A. History of Regulation SCI The Commission adopted Regulation SCI in 2014 to supersede and replace the Commission's legacy voluntary ARP Program as well as certain provisions of Regulation ATS. 11 In doing so, the Commission sought to strengthen the technology infrastructure of the U.S. securities markets, reduce the occurrence of systems issues in those markets, improve their resiliency when technological issues arise, and establish an updated and formalized regulatory framework, thereby helping to ensure more effective Commission oversight of such systems. 12 Several factors contributed to the Commission's decision to adopt this regulation. Recognizing the growing importance of technology in the securities markets, the Commission issued the ARP I and ARP II Policy Statements in 1989 and 1991, respectively. 13 In the decades that followed, key market participants in the securities industry increasingly relied on ever more complex technologies for trading and clearance and settlement of securities. The increased reliance on technology introduced challenges for the securities markets, as evidenced by a variety of market disruptions occurring in a relatively short time period. 14 The Commission convened a roundtable entitled “Technology and Trading: Promoting Stability in Today's Markets” (“Technology Roundtable”) in 2012. 15 Shortly thereafter, following Superstorm Sandy on the U.S. East Coast, the U.S. national securities exchanges closed for two business days in light of concerns over the physical safety of personnel and the possibility of technical issues. 16 These and other developments in U.S. securities markets led the Commission to consider the effectiveness of the 1980s and 90s-era ARP Program. The focus of the ARP Program was to ensure that the self-regulatory organizations (“SROs”) had adequate capacity, security, and business continuity plans by, among other things, reporting to the Commission staff their planned systems changes 30 days in advance and reporting outages in trading and related systems. 17 While the ARP Policy Statements were rooted in Exchange Act requirements, as policy statements rather than Commission rules, compliance was voluntary and in many instances the SROs did not fully disclose problems that occurred. In the SCI Proposing Release, the Commission stated that “the continuing evolution of the securities markets to the current state, where they have become almost entirely electronic and highly dependent on sophisticated trading and other technology (including complex regulatory and surveillance systems, as well as systems relating to the provision of market data, intermarket routing and connectivity, and a variety of other member and issuer services), has posed challenges for the ARP Inspection Program.” 18 Informed by its review of recent technology problems in the markets, the discussions at the Technology Roundtable, and its evaluation of the ARP Program, 19 the Commission proposed Regulation SCI in 2013 to help address the technological vulnerabilities, and improve Commission oversight, of the core technology of key U.S. securities markets entities, including national securities exchanges and associations, significant-volume ATSs, clearing agencies, and plan processors. 20 After considering the views of a wide variety of commenters, the Commission adopted Regulation SCI in 2014. 21 In the SCI Adopting Release, the Commission stated that it was taking a “measured approach” and pursuing an “incremental expansion from the entities covered under the ARP Inspection Program” given the potential costs of compliance with Regulation SCI. 22 It added, however, that this approach would allow it “to monitor and evaluate the implementation of Regulation SCI, the risks posed by the systems of other market participants, and the continued evolution of the securities markets, such that it may consider, in the future, extending the types of requirements in Regulation SCI to additional categories of market participants, such as non-ATS broker-dealers, security-based swap dealers, investment advisers, investment companies, transfer agents, and other key market participants.” 23 In 2021, the Commission amended Regulation SCI to add certain “competing consolidators” to the definition of SCI entity. 24 Specifically, a competing consolidator that exceeds a five percent consolidated market data gross revenue threshold over a specified time period is an SCI competing consolidator because it is a significant source of consolidated market data for NMS stocks on which market participants rely. 25 11 See generally SCI Adopting Release, supra note 1. 12 See SCI Adopting Release, supra note 1, at 72252-56 (discussing the background of Regulation SCI). 13 See Securities Exchange Act Release Nos. 27445 (Nov. 16, 1989), 54 FR 48703 (Nov. 24, 1989), and 29185 (May 9, 1991), 56 FR 22490 (May 15, 1991). 14 See Securities Exchange Act Release No. 69077 (Mar. 8, 2013), 78 FR 18083, 18089 (Mar. 25, 2013) (“SCI Proposing Release”) (citing, among other things, Findings Regarding the Market Events of May 6, 2010, Report of the Staffs of the Commodity Futures Trading Commission (“CFTC”) and SEC to the Joint Advisory Committee on Emerging Regulatory Issues (Sept. 30, 2010) (“Staff Report”) and discussing hackers penetrating certain Nasdaq OMX Group, Inc. computer networks in 2011, a “software bug” that hampered the initial public offerings of BATS Global Markets, Inc. in 2012, and issues with Nasdaq's trading systems delaying the start of trading in the high-profile initial public offering of Facebook, Inc.). 15 See Securities Exchange Act Release No. 67802 (Sept. 7, 2012), 77 FR 56697 (Sept. 13, 2012) (File No. 4-652); Technology Roundtable Transcript, available at https://www.sec.gov/news/otherwebcasts/2012/ttr100212-transcript.pdf . A webcast of the Roundtable is available at www.sec.gov/news/otherwebcasts/2012/ttr100212.shtml . The Technology Roundtable examined the relationship between the operational stability and integrity of the securities market and the ways in which market participants design, implement, and manage complex and interconnected trading technologies. The Technology Roundtable also highlighted that quality standards, testing, and improved response mechanisms were issues ripe for consideration. See SCI Proposing Release, supra note 14, at 18090-91 (providing for further discussion of the Technology Roundtable). 16 See SCI Proposing Release, supra note 14, at 18091. See also SCI Adopting Release, supra note 1, at 72254-72255 (summarizing additional disruptions during the period between publication of the SCI Proposing and Adopting Releases). 17 See supra note 13. 18 SCI Proposing Release, supra note 14, at 18089. 19 See SCI Proposing Release, supra note 14, at 18085-91 for a further discussion of these considerations. 20 As further explained in the SCI Adopting Release, the term “plan processor” means “any self-regulatory organization or securities information processor acting as an exclusive processor in connection with the development, implementation and/or operation of any facility contemplated by an effective national market system plan.” See SCI Adopting Release, supra note 1, at 72270 n. 196. This term refers to the securities information processors that are exclusive processors (and frequently referred to as the “SIPs”) that collect and process (for distribution) quotation data and/or transaction reports on behalf of the Consolidated Tape Association System (“CTA Plan”), Consolidated Quotation System (“CQS Plan”), Joint Self-Regulatory Organization Plan Governing the Collection, Consolidation, and Dissemination of Quotation and Transaction Information for Nasdaq-Listed Securities Traded on Exchanges on an Unlisted Trading Privileges Basis (“Nasdaq UTP Plan”), and Options Price Reporting Authority (“OPRA Plan”). The CTA Plan and Nasdaq UTP Plan (applicable to national market system (“NMS”) stocks) are each a “transaction reporting plan” as well as a “national market system plan” as defined in 17 CFR 242.600 (“Rule 600” of Regulation NMS). The OPRA Plan (applicable to exchange-listed options) is a national market system plan. See infra note 212. See also text accompanying note 212 (discussing these Plans and how transaction reports containing the price and volume associated with a transaction involving the purchase or sale of a security are currently, and anticipated in the future to be, readily available to enable SCI ATSs and SCI broker-dealers to ascertain the total average daily dollar volume traded in NMS stock and exchange-listed options in a calendar month and self-assess if they exceed the proposed transaction activity thresholds discussed below). 21 See generally SCI Adopting Release, supra note 1. 22 Id. at 72259. 23 Id. See also supra note 10 and accompanying text (referencing other cybersecurity rules proposed to apply to Commission registrants). 24 See Securities Exchange Act Release No. 90610 (Dec. 9, 2020), 86 FR 18596, 18659-18676 (Apr. 9, 2021) (“Market Data Infrastructure Adopting Release”) (adopting rules with respect to competing consolidators and defining “competing consolidator” to mean a securities information processor required to be registered pursuant to 17 CFR 242.614 (“Rule 614”) or a national securities exchange or national securities association that receives information with respect to quotations for and transactions in NMS stocks and generates a consolidated market data product for dissemination to any person). 25 An “SCI competing consolidator” is any competing consolidator, which during at least four of the preceding six calendar months, accounted for five percent or more of consolidated market data gross revenue paid to the effective national market system plan or plans required under 17 CFR 242.603(b) (“Rule 603(b)”) for NMS stocks (1) listed on the New York Stock Exchange, (2) listed on The Nasdaq Stock Market, or (3) listed on national securities exchanges other than the New York Stock Exchange or The Nasdaq Stock Market, as reported by such plan or plans pursuant to the terms thereof. See Rule 1000. An SCI competing consolidator is subject to Regulation SCI, and a competing consolidator for which Regulation SCI does not apply is subject the systems capability requirement in 17 CFR 242.614(d)(9) (“Rule 614(d)(9)” of Regulation NMS). See infra note 28 and accompanying text. B. Current Regulation SCI 1. SCI Entities and SCI Systems Regulation SCI applies to “SCI entities.” 26 SCI entities are those that the Commission has determined are market participants that play a significant role in the U.S. securities markets and/or have the potential to impact investors, the overall market, or the trading of individual securities in the event of certain types of systems problems. 27 Today SCI entities comprise the self-regulatory organizations (excluding securities futures exchanges) (“SCI SROs”), ATSs meeting certain volume thresholds with respect to NMS stocks and non-NMS stocks (“SCI ATSs”), exclusive disseminators of consolidated market data (“plan processors”), certain competing disseminators of consolidated market (“SCI competing consolidators” 28 ), and certain exempt clearing agencies. 29 26 See 17 CFR 242.1000 (defining the term “SCI entity” and terms included therein). 27 See SCI Adopting Release, supra note 1, at 72259. Although some commenters had urged that Regulation SCI apply to fewer entities and only the most systemically important entities, the Commission disagreed, stating, “[L]imiting the applicability of Regulation SCI to only the most systemically important entities posing the highest risk to the markets is too limited of a category of market participants, as it would exclude certain entities that, in the Commission's view, have the potential to pose significant risks to the securities markets should an SCI event occur.” Id. 28 See supra notes 24-25 (stating the definitions of competing consolidator and SCI competing consolidator). SCI competing consolidators are subject to Regulation SCI after a one-year transition period. See Market Data Infrastructure Adopting Release, supra note 24, at 18604. Competing consolidators in the transition period and competing consolidators below the gross revenue threshold are subject to a tailored set of operational capability and resiliency obligations designed to help ensure that the provision of consolidated market data products is prompt, accurate, and reliable. See Market Data Infrastructure Adopting Release, supra note 24, at 18690-97 (providing for a full discussion of systems capability requirements for competing consolidators (that are not subject to Regulation SCI), but instead subject to Rule 614(d)(9)). 29 See 17 CFR 242.1000 (defining the term SCI entity to mean “an SCI self-regulatory organization, SCI alternative trading system, plan processor, exempt clearing agency subject to ARP, or SCI competing consolidator” and also separately defining each of these terms). See also SCI Adopting Release, supra note 1, at 72258-72 (discussing the rationale for inclusion of SCI SROs, SCI ATSs, plan processors, and certain exempt clearing agencies in the original adopted definition of SCI entity); infra notes 83-84 and accompanying text (citing the releases explaining the expansion the definition of SCI entity to include SCI competing consolidators, and the recent proposal to further expand the definition of SCI entity to include certain ATSs that trade U.S. Treasury Securities or Agency Securities exceeding specified volume thresholds (“Government Securities ATSs”)). An SCI entity has obligations with respect to its “SCI systems,” “critical SCI systems,” and “indirect SCI systems.” 30 “SCI systems” are, broadly, the technology systems of, or operated by or on behalf of, an SCI entity that, with respect to securities, directly support at least one of six market functions: (i) trading; (ii) clearance and settlement; (iii) order routing; (iv) market data; (v) market regulation; or (vi) market surveillance. 31 In addition, Regulation SCI defines “critical SCI systems,” which are a subset of SCI systems, 32 and designated as such because they represent potential single points of failure in the U.S. securities markets. 33 30 See 17 CFR 242.1000 (defining the terms “SCI systems,” “critical SCI systems,” and “indirect SCI systems”). 31 Id. (defining SCI systems to mean “all computer, network, electronic, technical, automated, or similar systems of, or operated by or on behalf of, an SCI entity that, with respect to securities, directly support trading, clearance and settlement, routing, market data, market regulation, or market surveillance”). 32 Id. (defining critical SCI systems to mean any SCI systems of, or operated by or on behalf of, an SCI entity that: (1) Directly support functionality relating to: (i) Clearance and settlement systems of clearing agencies; (ii) Openings, reopenings, and closings on the primary listing market; (iii) Trading halts; (iv) Initial public offerings; (v) The provision of consolidated market data; or (vi) Exclusively listed securities; or (2) Provide functionality to the securities markets for which the availability of alternatives is significantly limited or nonexistent and without which there would be a material impact on fair and orderly markets). 33 As discussed in the SCI Adopting Release, “critical SCI systems” are subject to certain heightened resilience and information dissemination provisions of Regulation SCI on the rationale that, lacking or having limited substitutes, these systems pose the greatest risks to the continuous and orderly function of the markets if they malfunction. See SCI Adopting Release, supra note 1, at 72277-79 (providing additional discussion of critical SCI systems). The term “indirect SCI systems” describes systems of, or operated by or on behalf of, an SCI entity that, “if breached, would be reasonably likely to pose a security threat to SCI systems.” 34 The distinction between SCI systems and indirect SCI systems seeks to encourage SCI entities physically and/or logically to separate systems that perform or directly support securities market functions from those that perform other functions ( e.g., corporate email; general office systems for member regulation and recordkeeping). 35 34 Id. at 72279. 35 See SCI Adopting Release, supra note 1, at 72281 (“[I]f an SCI entity designs and implements security controls so that none of its non-SCI systems would be reasonably likely to pose a security threat to SCI systems, then it will have no indirect SCI systems. If, however, an SCI entity does have indirect SCI systems, then certain provisions of Regulation SCI will apply to those indirect SCI systems.”). Currently, the application of Regulation SCI is triggered when an entity meets the definition of SCI entity. If an entity meets the definition of SCI entity, Regulation SCI applies to its SCI systems and indirect SCI systems. The scope of an SCI entity's technology systems is determined by whether they are operated “by or on behalf of” the SCI entity and whether they directly support any of the six market functions enumerated in the definition. As a result, the SCI systems and indirect SCI systems of an SCI entity are neither limited by the type of security nor by the type of business in which an SCI entity primarily conducts its securities market activities. Thus, if an SCI entity elects to, or obtains the necessary approvals to, engage in market functions in multiple types of securities, Regulation SCI's obligations apply to the relevant functional systems relating to all such securities. 36 Accordingly, the SCI systems of an SCI entity may include systems pertaining to any type of security, whether those securities are NMS stocks, over-the-counter (OTC) equity securities, listed options, debt securities, security-based swaps (“SBS”), crypto asset securities, 37 or another type of security. 38 36 The current definition of “SCI systems,” includes the clause, “with respect to securities,” without limitation. SCI systems “means all computer, network, electronic, technical, automated, or similar systems of, or operated by or on behalf of, an SCI entity that, with respect to securities, directly support trading, clearance and settlement, order routing, market data, market regulation, or market surveillance.” See 17 CFR 242.1000 (emphasis added). But see infra section III.A.2.b.iv (discussing the proposed limitation to the definition of SCI systems for certain SCI broker-dealers). 37 The term “digital asset” refers to an asset that is issued and/or transferred using distributed ledger or blockchain technology (“distributed ledger technology”), including, but not limited to, so-called “virtual currencies,” “coins,” and “tokens.” See Custody of Digital Asset Securities by Special Purpose Broker-Dealers, Securities Exchange Act Release No. 90788 (Dec. 23, 2020), 86 FR 11627, 11627 n.1 (Feb. 26, 2021) (“Crypto Asset Securities Custody Release”). A digital asset may or may not meet the definition of a “security” under the Federal securities laws. See, e.g., Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: The DAO, Securities Exchange Act Release No. 81207 (July 25, 2017) (“DAO 21(a) Report”), available at https://www.sec.gov/litigation/investreport/34-81207.pdf . See also SEC v. W.J. Howey Co., 328 U.S. 293 (1946). To the extent digital assets rely on cryptographic protocols, these types of assets also are commonly referred to as “crypto assets,” and “digital asset securities” can be referred to as “crypto asset securities.” For purposes of this release, the Commission does not distinguish between the terms “digital asset securities” and “crypto asset securities.” 38 Today, under the current definition of SCI systems, an SCI entity (current or future) that engages in market functions for any type of securities, including crypto asset securities, is required to assess whether the technological systems of, or operated by or on its behalf, with respect to securities, directly support at least one of six market functions: (i) trading; (ii) clearance and settlement; (iii) order routing; (iv) market data; (v) market regulation; or (vi) market surveillance. As discussed below, however, the Commission is proposing an amendment to the definition of SCI systems that would limit its scope solely for certain proposed SCI broker-dealers. See infra section III.A.2.b.iv. 2. Reasonably Designed Policies and Procedures The foundational principles of Regulation SCI are set forth in Rule 1001, which requires each SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain their operational capability and promote the maintenance of fair and orderly markets. 39 Rule 1001(a)(2) of Regulation SCI requires that, at a minimum, such policies and procedures include: current and future capacity planning; periodic stress testing; systems development and testing methodology; reviews and testing to identify vulnerabilities; business continuity and disaster recovery planning (inclusive of backup systems that are geographically diverse and designed to meet specified recovery time objectives); standards for market data collection, processing, and dissemination; and monitoring to identify potential systems problems. 40 Under 17 CFR 242.1001(a)(3) (“Rule 1001(a)(3)” of Regulation SCI), SCI entities must periodically review the effectiveness of these policies and procedures and take prompt action to remedy any deficiencies. 41 Rule 1001(a)(4) of Regulation SCI provides that an SCI entity's policies and procedures will be deemed to be reasonably designed if they are consistent with “current SCI industry standards,” which is defined to be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization; however, Rule 1001(a)(4) of Regulation SCI also makes clear that compliance with such “current SCI industry standards” is not the exclusive means to comply with these requirements. 42 39 See 17 CFR 242.1001(a)(1). 40 See 17 CFR 242.1001(a)(2). 41 See 17 CFR 242.1001(a)(3). 42 See 17 CFR 242.1001(a)(4). Under 17 CFR 242.1001(b)(1) (“Rule 1001(b)(1)” of Regulation SCI), each SCI entity is required to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Exchange Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable, and specifies certain minimum requirements for such policies and procedures. 43 In addition, 17 CFR 242.1001(b)(2) (“Rule 1001(b)(2)”) requires that at a minimum, these policies and procedures must include: testing of all SCI systems and any changes to SCI systems prior to implementation; a system of internal controls over changes to SCI systems; a plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by “responsible SCI personnel” (defined below) and by personnel familiar with applicable provisions of the Exchange Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and a plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues. 44 43 See 17 CFR 242.1001(b)(1). 44 See 17 CFR 242.1001(b)(2). Under 17 CFR 242.1001(b)(3) (“Rule 1001(b)(3)” of Regulation SCI), SCI entities must periodically review the effectiveness of these policies and procedures and take prompt action to remedy any deficiencies. 45 Under 17 CFR 242.1001(b)(4) (“Rule 1001(b)(4)” of Regulation SCI), individuals are provided with a safe harbor from liability under Rule 1001(b) if certain conditions are met. 46 45 See 17 CFR 242.1001(b)(3). 46 See 17 CFR 242.1001(b)(4). Further, 17 CFR 242.1001(c) (“Rule 1001(c)” of Regulation SCI), requires SCI entities to establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events. 47 Rule 1000 of Regulation SCI defines “responsible SCI personnel” to mean, for a particular SCI system or indirect SCI system impacted by an SCI event, such senior manager(s) of the SCI entity having responsibility for such system, and their designee(s). 48 Rule 1000 also defines “SCI event” to mean an event at an SCI entity that constitutes a systems disruption, a systems compliance issue, or a systems intrusion. 49 Under 17 CFR 242.1001(c)(2) (“Rule 1001(c)(2)” of Regulation SCI), SCI entities are required periodically to review the effectiveness of these policies and procedures and take prompt action to remedy any deficiencies. 50 47 See 17 CFR 242.1001(c). 48 17 CFR 242.1000. 49 Id. 50 See 17 CFR 242.1001(c)(2). 3. SCI Events Under Rule 1002 of Regulation SCI, SCI entities have certain obligations regarding SCI events. An “SCI event” is defined as: (i) a “systems disruption,” which is an event in an SCI entity's SCI systems that disrupts, or significantly degrades, the normal operation of an SCI system; and/or (ii) a “systems intrusion,” which is any unauthorized entry into the SCI systems or indirect SCI systems of an SCI entity; and/or (iii) a “systems compliance issue,” which is an event at an SCI entity that has caused any SCI system of such entity to operate in a manner that does not comply with the Exchange Act and the rules and regulations thereunder or the entity's rules or governing documents, as applicable. 51 51 See 17 CFR 242.1000. When any responsible SCI personnel has a reasonable basis to conclude that an SCI event has occurred, the SCI entity must begin to take appropriate corrective action which must include, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable. 52 With limited exceptions, 53 Rule 1002(b) provides the framework for notifying the Commission of SCI events including, among other things, requirements to: notify the Commission of the event immediately; provide a written notification on Form SCI within 24 hours that includes a description of the SCI event and the system(s) affected, with other information required to the extent available at the time; provide regular updates regarding the SCI event until the event is resolved; and submit a final detailed written report regarding the SCI event. 54 52 See 17 CFR 242.1002(a). 53 See 17 CFR 242.1002(b)(5) (relating to the exception for de minimis SCI events). 54 See 17 CFR 242.1002(b). Rule 1002(c) of Regulation SCI also requires that SCI entities disseminate information to their members or participants regarding SCI events. 55 These information dissemination requirements are scaled based on the nature and severity of an event. SCI entities are required to disseminate certain information about the event to certain of its members or participants ( i.e., those that are reasonably estimated to have been affected) promptly after any responsible SCI personnel has a reasonable basis to conclude that an SCI event has occurred. For “major SCI events,” such dissemination must be made to all of its members or participants. In addition, dissemination of information to members or participants is permitted to be delayed for systems intrusions if such dissemination would likely compromise the security of the SCI entity's systems or an investigation of the intrusion. 56 In addition, 17 CFR 242.1002(c)(4) (“Rule 1002(c)(4)” of Regulation SCI) provides exceptions to the dissemination requirements under Rule 1002(c) of Regulation SCI for SCI events to the extent they relate to market regulation or market surveillance systems or SCI events that have had, or the SCI entity reasonably estimates would have, either a de minimis or no impact on the SCI entity's operations or on market participants. 57 55 See 17 CFR 242.1002(c). 56 See id. The rule also requires that the SCI entity document its reasons for delayed notification. Id. 57 See 17 CFR 242.1002(c)(4). 4. Systems Changes and SCI Review Under 17 CFR 242.1003(a) (“Rule 1003(a)” of Regulation SCI), SCI entities are required to provide reports to the Commission relating to system changes, including a report each quarter describing completed, ongoing, and planned material changes to their SCI systems and the security of indirect SCI systems, during the prior, current, and subsequent calendar quarters, including the dates or expected dates of commencement and completion. 58 Rule 1003(b) of Regulation SCI also requires that an SCI entity conduct an “SCI review” not less than once each calendar year. 59 “SCI review” is defined in Rule 1000 of Regulation SCI to mean a review, following established procedures and standards, that is performed by objective personnel having appropriate experience to conduct reviews of SCI systems and indirect SCI systems, and which review contains: a risk assessment with respect to such systems of an SCI entity; and an assessment of internal control design and effectiveness of its SCI systems and indirect SCI systems to include logical and physical security controls, development processes, and information technology governance, consistent with industry standards. 60 Under Rule 1003(b)(2) and (3), SCI entities are also required to submit a report of the SCI review to their senior management, and must also submit the report and any response by senior management to the report, to their board of directors, as well as to the Commission. 61 58 See 17 CFR 242.1003(a). 59 See 17 CFR 242.1003(b). 60 See 17 CFR 242.1000. Rule 1003(b)(1) of Regulation SCI also states that penetration test reviews of an SCI entity's network, firewalls, and production systems must be conducted at a frequency of not less than once every three years, and assessments of SCI systems directly supporting market regulation or market surveillance must be conducted at a frequency based upon the risk assessment conducted as part of the SCI review, but in no case less than once every three years. See 17 CFR 242.1003(b)(1)(i) and (ii) (“Rule 1003(b)(1)(i) and (ii)”). 61 See 17 CFR 242.1003(b)(2) and (3). 5. Business Continuity and Disaster Recovery Testing With Members/Participants Rule 1004 of Regulation SCI sets forth certain requirements for testing an SCI entity's business continuity and disaster recovery plans with its members or participants. This rule requires that, with respect to an SCI entity's business continuity and disaster recovery plan, including its backup systems, each SCI entity shall: (a) establish standards for the designation of those members or participants that the SCI entity reasonably determines are, taken as a whole, the minimum necessary for the maintenance of fair and orderly markets in the event of the activation of such plans; (b) designate members or participants pursuant to the standards established and require participation by such designated members or participants in scheduled functional and performance testing of the operation of such plans, in the manner and frequency specified by the SCI entity, provided that such frequency shall not be less than once every 12 months; and (c) coordinate the testing of such plans on an industry- or sector-wide basis with other SCI entities. 62 62 See 17 CFR 242.1004. 6. Recordkeeping and Other Provisions (Rules 1005-1007) SCI entities are required by Rule 1005 of Regulation SCI to make, keep, and preserve certain records related to their compliance with Regulation SCI. 63 In addition, 17 CFR 242.1006 (“Rule 1006” of Regulation SCI), provides for certain requirements relating to the electronic filing, on Form SCI, of any notification, review, description, analysis, or report to the Commission required to be submitted under Regulation SCI. 64 Finally, 17 CFR 242.1007 (“Rule 1007” of Regulation SCI) requires a written undertaking when records required to be filed or kept by an SCI entity under Regulation SCI are prepared or maintained by a service bureau or other recordkeeping service on behalf of the SCI entity. 65 63 See 17 CFR 242.1005. Unlike 17 CFR 242.1005(a) (“Rule 1005(a)”) of Regulation SCI, which relates to recordkeeping provisions for SCI SROs, 17 CFR 242.1005(b) (“Rule 1005(b)”) relates to the recordkeeping provision for SCI entities other than SCI SROs. 64 See 17 CFR 242.1006. 65 See 17 CFR 242.1007. C. Overview of Proposed Amendments to Regulation SCI The Commission is proposing amendments to Regulation SCI that would expand the definition of “SCI entity” to include a broader range of key market participants in the U.S. securities market infrastructure and update certain provisions of Regulation SCI to take account of developments in the technology landscape of the markets and the Commission and its staff's oversight experience since the adoption of Regulation SCI in 2014. As discussed in section III.A, the Commission is proposing to expand the definition of SCI entity to include registered SBSDRs, registered broker-dealers exceeding a size threshold (“SCI broker-dealers”), and additional clearing agencies exempt from registration. 66 As discussed in section III.C, the Commission is also proposing to update several requirements of Regulation SCI to acknowledge certain technology changes in the market, including cybersecurity and third-party provider management challenges since the adoption of Regulation SCI in 2014, and to account for the experience and insights the Commission and its staff have gained with respect to technology issues surrounding SCI entities and their systems. These include: 66 See infra section III.A.2.a. through c. (providing a detailed discussion of each of these categories of entities and associated proposed definitions). • Amendments to Rule 1001(a) to require that an SCI entity's policies and procedures for SCI systems, critical SCI systems, and indirect SCI systems, address with specificity: ○ Systems classification and life cycle management; 67 67 See infra section III.C.1. ○ Management of third-party providers, including cloud service providers and providers of critical SCI systems; 68 68 See infra section III.C.2. ○ Access controls; 69 and 69 See infra section III.C.3.a. ○ Identification of current SCI industry standards, if any; 70 70 See infra section III.C.5.c. • Expansion of the definition of “systems intrusion” in Rule 1000 to include a wider range of cybersecurity events; 71 71 See infra section III.C.3.c. • Amendments to Rule 1002 regarding notice of systems intrusions to the Commission and affected persons; 72 72 See infra section III.C.3.c. • Amendments to the definition of “SCI review” and Rule 1003(b) to specify in greater detail the contents of the SCI review and associated report, and to require annual penetration testing; 73 73 See infra sections III.C.3.b and III.C.4. • Amendments to Rule 1004 to require that SCI entities designate key third-party providers for participation in annual business continuity/disaster recovery testing; 74 74 See infra section III.C.2.d. • Amendments to Rule 1001(a)(4) to address how an SCI entity may avail itself of the safe harbor provision; 75 75 See infra section III.C.5. • Amendments to Rule 1005 to address the maintenance of records by a former SCI entity; and • Changes to Form SCI consistent with the proposed changes. 76 76 See infra section III.C.6. The amendments to Regulation SCI are proposed independently of the proposals discussed in the Exchange Act Cybersecurity Proposal and Regulation S-P 2023 Proposing Release. However, the relationship of all three proposals, as each may apply to an SCI entity, is discussed in section III.D. III. Proposed Amendments to Regulation SCI A. Definition of SCI Entity 1. Evolution: Current and Proposed SCI Entities Currently, SCI entities are the SCI SROs, SCI ATSs, plan processors, certain exempt clearing agencies, and, as of 2020, SCI competing consolidators. 77 In 2013, the Commission proposed to include other entities: specifically, ATSs trading corporate debt or municipal securities (hereafter, “Fixed Income ATSs”) exceeding specified volume thresholds. 78 The Commission did not include any Fixed Income ATSs as SCI entities at adoption in 2014, however, based on consideration of comments regarding the risk profile of Fixed Income ATSs at that time. 79 In 2013, the Commission also solicited comment on the inclusion of several other types of entities, including SBSDRs and broker-dealers (beyond SCI ATSs). 80 At adoption in 2014, comments regarding these and other entities were summarized, with specific proposals deferred for possible future consideration. 81 In sum, the Commission stated in 2014 that it was neither limiting the applicability of Regulation SCI to only the most systemically important entities as urged by some commenters, nor taking a broad approach at the outset, but rather that it was taking a “measured” approach in establishing the initial scope of SCI entities. 82 Since the initial adoption of Regulation SCI, the Commission has considered expansion of the definition of SCI entity several times: first to propose and adopt certain competing consolidators as SCI entities, 83 and more recently to propose and repropose adding ATSs that trade U.S. Treasury Securities or Agency Securities exceeding specified volume thresholds (“Government Securities ATSs”) as SCI entities. 84 77 See supra notes 27-29 and accompanying text; infra note 83 and accompanying text. 78 See SCI Proposing Release, supra note 14, at 18097. 79 See SCI Adopting Release, supra note 1, at 72270, 72409 (discussing determination not to apply Regulation SCI to ATSs trading only corporate debt and municipal securities at that time). 80 See SCI Proposing Release, supra note 14, at 18133-41. The Commission also solicited comment on the inclusion of security-based swap execution facilities (“SB SEFs”), which entities are now the subject of another proposal. See Rules Relating to Security-Based Swap Execution and Registration and Regulation of Security-Based Swap Execution Facilities, Release No. 94615 (Apr. 6, 2022), 87 FR 28872 (May 11, 2022) (proposing that SB SEFs be subject to 17 CFR 242.800 through 242.835 (“Regulation SE”) which includes operational capability requirements closely modeled on a detailed CFTC rule for SEFs (17 CFR 37.1401)). SB SEFs are not further discussed herein. 81 See SCI Adopting Release, supra note 1, at 72364-66 (contemplating possible future proposals). 82 See SCI Adopting Release, supra note 1, at 72259 (stating that this measured approach would enable the Commission to “monitor and evaluate the implementation of Regulation SCI, the risks posed by the systems of other market participants, and the continued evolution of the securities markets, such that it may consider, in the future, extending the types of requirements in Regulation SCI to additional categories of [key] market participants . . . .”). 83 See Market Data Infrastructure Adopting Release, supra note 24, at 18659-18676. 84 See Securities Exchange Act Release Nos. 90019 (Sept. 28, 2020), 85 FR 87106 (Dec. 31, 2020) (“Government Securities ATS Proposing Release”); 94062 (Jan. 26, 2022), 87 FR 15496 (Mar. 18, 2022) (“Government Securities ATS Reproposal”) (among other things, citing operational similarities between Government Securities ATSs and NMS stock ATSs). In the Government Securities ATS Reproposal, the Commission proposed amendments to 17 CFR 240.3b-16(a) (“Rule 3b-16(a)” of the Exchange Act), which defines certain terms used in the statutory definition of “exchange” under section 3(a)(1) of the Exchange Act, to include systems that offer the use of non-firm trading interest and provide communication protocols to bring together buyers and sellers of securities. Trading systems that may fall within the criteria of proposed 17 CFR 240.3b-16 (“Rule 3b-16”), as proposed to be amended, would likely operate as ATSs, and possibly SCI ATSs. Because the proposed amendments to Rule 3b-16(a) could result in a greater number of ATSs, and the amendments proposed to expand and update SCI could impact newly designated ATSs, commenters are encouraged to review both the Government Securities ATS Reproposal and this proposal to determine whether it might affect their comments on this proposal, as well as their responses to the Commission's request for comment on application of Regulation SCI to Fixed Income ATS contained herein. The Commission now proposes a further expansion of the definition of SCI entity to include SBSDRs, certain registered broker-dealers ( i.e., SCI broker-dealers), and additional clearing agencies exempted from registration. The Commission also solicits comment on whether, in light of technological changes in the fixed income markets in recent years, Fixed Income ATSs should again be proposed to be subject to Regulation SCI, rather than 17 CFR 240.301(b)(6) (“Rule 301(b)(6)” of Regulation ATS), and also whether and how broker-dealers trading corporate debt and municipal securities should be considered. 85 85 Currently, Rule 301(b)(6) of Regulation ATS applies to Fixed Income ATSs exceeding a volume threshold. Under Rule 301(b)(6), an ATS that trades only municipal securities or corporate debt at a threshold of 20% or more of the average daily volume traded in the United States, during at least four of the preceding six calendar months, is required to comply with capacity, integrity, and security requirements with respect to those systems that support order entry, order routing, order execution, transaction reporting, and trade comparison. See 17 CFR 242.301(b)(6). As discussed further below, the amendments proposed in this release do not include amendments to modify the numerical volume thresholds or to otherwise modify Rule 301(b)(6) of Regulation ATS, or move systems requirements for Fixed Income ATSs from Regulation ATS to Regulation SCI. The Commission does, however, request comment on the state of electronic trading and automation in the corporate debt and municipal securities markets, as well as the risks associated with entities with significant activity in these markets. See infra section III.B. 2. New Proposed SCI Entities When it adopted Regulation SCI, the Commission acknowledged that there may be other categories of entities not included in the definition of SCI entity that, given their increasing size and importance, could pose risks to the market should an SCI event occur, but decided to include only certain key market participants at that time. 86 The Commission proposes to expand the definition of SCI entity to include SBSDRs, certain types of broker-dealers, and additional clearing agencies exempted from registration as additional key market participants that would also have to comply with Regulation SCI because they play a significant role in the U.S. securities markets and/or have the potential to impact investors, the overall market, or the trading of individual securities in the event of a systems issue. If this amendment is adopted, these new SCI entities would become subject to all provisions of Regulation SCI, including the provisions proposed to be amended as discussed in section III.C of this release. 86 See SCI Adopting Release, supra note 1, at 72259. See also supra note 82 and accompanying text. a. Registered Security-Based Swap Data Repositories (SBSDRs) The Commission proposes to expand the application of Regulation SCI to SBSDRs. As registered securities information processors that disseminate market data and provide price transparency in the SBS market, and centralized trade repositories for SBS data for use by regulators, SBSDRs play a key role in the SBS market. 87 87 Rule 1000 would define the term registered security-based swap data repository to mean “a security-based swap data repository, as defined in 15 U.S.C. 78c(a)(75), and that is registered with the Commission pursuant to 15 U.S.C. 78m(n) and § 240.13n-1,” with a proviso that compliance with Regulation SCI would not be required until six months after the entity's registration is effective. See proposed Rule 1000. As noted, the Commission solicited comment on the inclusion of SBSDRs as SCI entities when it first proposed Regulation SCI in 2013. 88 At that time, the Commission anticipated that SBSDRs would “play an important role in limiting systemic risk and promoting the stability of the SBS market [and] also would serve as information disseminators in a manner similar to plan processors in the equities and options markets.” 89 But it also acknowledged that there may be differences between the equities and options markets and the SBS market, “including differing levels of automation and stages of regulatory development.” 90 88 See supra text accompanying note 80. 89 SCI Proposing Release, supra note 14, at 18135 (citation omitted). 90 Id. Comments received on the inclusion of SBSDRs as SCI entities in the SCI Proposing Release were limited. One commenter stated that “the similarities between certain SCI entities and SB SDRs . . . do not provide a clear justification for a different set of rules.” 91 Another commenter stated that SBSDRs should have standards that are consistent with, but not identical to, those of SCI entities because the functions that SBSDRs perform are significantly different from those performed by SCI entities. 92 Other commenters, however, felt the practical differences between options and equities and derivatives called for some form of harmonization of rules, but not direct application of Regulation SCI to these entities. 93 The Commission deferred and stated in the SCI Adopting Release that, “should [it] decide to propose to apply the requirements of Regulation SCI to SB SDRs [it] would issue a separate release discussing such a proposal.” 94 Taking into account the role of SBSDRs in the SBS market, their reliance on technology to perform their functions, and the current state of regulatory development in the SBS market, the Commission is doing so now. 91 SCI Adopting Release, supra note 1, at 72364. 92 See id. 93 See id. 94 SCI Adopting Release, supra note 1, at 72364; SCI Proposing Release, supra note 14, at 18134. i. Role of SBSDRs and Associated Risks Title VII of the Dodd-Frank Act, enacted in 2010, provided for a comprehensive, new regulatory framework for swaps and security-based swaps, including regulatory reporting and public dissemination of transactions in security-based swaps. 95 In 2015, the Commission established a regulatory framework for SBSDRs to provide improved transparency to regulators and help facilitate price discovery and efficiency in the SBS market. 96 Under this framework, SBSDRs are registered securities information processors and disseminators of market data in the SBS market, 97 thereby serving Title VII's goal of having public dissemination of price information for all security-based swaps, to enhance price discovery for market participants. 98 Like FINRA's Trade Reporting and Compliance Engine (“TRACE”) and the MSRB's Electronic Municipal Market Access (“EMMA”), 99 SBSDRs serve an important function for market participants because they disseminate market data, thereby providing price transparency in the SBS market. 100 Just as TRACE and EMMA provide price transparency to market participants and regulatory information to regulators, SBSDRs are designed to meet two purposes as mandated by Title VII of the Dodd-Frank Act: (1) to provide SBS data and information to regulators to surveil the markets and assess for market risks; and (2) to enhance price discovery to market participants. 101 As discussed in detail below, given that SBSDRs rely on automated systems and are designed to limit systemic risk and promote the stability of the markets they serve, the Commission believes that including SBSDRs in the definition of SCI entities would better ensure that SBSDR systems are robust, resilient, and secure. Additionally, this approach is reasonable and consistent as other entities that play a key price transparency role in their respective markets, such as plan processors, SCI competing consolidators, FINRA and the MSRB, are SCI entities, and their systems that directly support market data, among other functions, are currently SCI systems. 102 95 Public Law 111-203, section 761(a) (adding Exchange Act section 3(a)(75) (defining SBSDR)) and section 763(i) (adding Exchange Act section 13(n) (establishing a regulatory regime for SBSDRs)). 96 See Security-Based Swap Data Repository Registration, Duties, and Core Principles, Securities Exchange Act Release No. 74246 (Feb. 11, 2015), 80 FR 14438, 14441 (Mar. 19, 2015) (“SBSDR Adopting Release”); Regulation SBSR—Reporting and Dissemination of Security-Based Swap Information, Securities Exchange Act Release No. 74244 (Feb. 11, 2015), 80 FR 14563 (Mar. 19, 2015) (“SBSR Adopting Release”). 97 See 17 CFR 242.909 (“A registered security-based swap data repository shall also register with the Commission as a securities information processor on Form SDR.”); see also Form SDR (“With respect to an applicant for registration as a security-based swap data repository, Form SDR also constitutes an application for registration as a securities information processor.”). 98 See, e.g., SBSR Adopting Release, supra note 96, at 14604-05. 99 FINRA members are subject to transaction reporting obligations under FINRA Rule 6730, while municipal securities dealers are subject to transaction reporting obligations under MSRB Rule G-14. See FINRA Rule 6730(a)(1) (requiring FINRA members to report transactions in TRACE-Eligible Securities, which FINRA Rule 6710 defines to include a range of fixed-income securities). See also MRSB Rule G-14 (requiring transaction reporting by municipal bond dealers). EMMA, established by the MSRB in 2009, serves as the official repository of municipal securities disclosure providing the public with free access to relevant municipal securities data, and is the central database for information about municipal securities offerings, issuers, and obligors. Additionally, the MSRB's Real-Time Transaction Reporting System (“RTRS”), with limited exceptions, requires municipal bond dealers to submit transaction data to the MSRB within 15 minutes of trade execution, and such near real-time post-trade transaction data can be accessed through the MSRB's EMMA website. 100 See Committee on Payment and Settlement Systems and Technical Committee of the International Organization of Securities Commissions, Principles for financial market infrastructures, at 1.14, Box 1 (Apr. 16, 2012) (“PFMI”), available at https://www.bis.org/publ/cpss101a.pdf (stating that “[a] TR [trade repository] may serve a number of stakeholders that depend on having effective access to TR services, both to submit and retrieve data. In addition to relevant authorities and the public, other stakeholders can include exchanges, electronic trading venues, confirmation or matching platforms, and third-party service providers that use TR data to offer complementary services.”). 101 See, e.g., SBSR Adopting Release, supra note 96, at 14604-05. 102 See SBSDR Adopting Release, supra note 96. As centralized repositories for SBS data for use by regulators, SBSDRs provide important infrastructure that assists relevant authorities in performing their market oversight. 103 Data maintained by SBSDRs may assist regulators in preventing market abuses, performing supervision, and resolving issues and positions if an institution fails. 104 SBSDRs are required to collect and maintain accurate SBS transaction data so that relevant authorities can access and analyze the data from secure, central locations, thereby putting the regulators in a better position to monitor for potential market abuse and risks to financial stability. 105 SBSDRs also have the potential to reduce operational risk and enhance operational efficiency, such as by maintaining transaction records that would help counterparties to ensure that their records reconcile on all of the key economic details. 106 103 See generally PFMI, supra note 100, at 1.14 (stating that “[b] y centralising the collection, storage, and dissemination of data, a well-designed TR that operates with effective risk controls can serve an important role in enhancing the transparency of transaction information to relevant authorities and the public, promoting financial stability, and supporting the detection and prevention of market abuse.”). 104 See Security-Based Swap Data Repository Registration, Duties, and Core Principles, Exchange Act Release No. 63347 (Nov. 19, 2010), 75 FR 77306, 77307 (Dec. 10, 2010), corrected at 75 FR 79320 (Dec. 20, 2010) and 76 FR 2287 (Jan. 13, 2011) (“SBSDR Proposing Release”). 105 See SBSDR Adopting Release, supra note 96, at 14440 (stating that “SDRs are required to collect and maintain accurate SBS transaction data so that relevant authorities can access and analyze the data from secure, central locations, thereby putting them in a better position to monitor for potential market abuse and risks to financial stability.”). 106 See SBSDR Proposing Release, supra note 104, at 77307 (stating that “[t]he enhanced transparency provided by an SDR is important to help regulators and others monitor the build-up and concentration of risk exposures in the SBS market . . . . In addition, SDRs have the potential to reduce operational risk and enhance operational efficiency in the SBS market.”). Furthermore, SBSDRs themselves are subject to certain operational risks that may impede the ability of SBSDRs to meet the goals set out in Title VII of the Dodd-Frank Act and the Commission's rules. 107 For instance, the links established between an SBSDR and other entities, including unaffiliated clearing agencies and other SBSDRs, may expose the SBSDR to vulnerabilities outside of its direct control. 108 Without appropriate safeguards in place for the systems of SBSDRs, their vulnerabilities could lead to significant failures, disruptions, delays, and intrusions, which could disrupt price transparency and oversight of the SBS market. For instance, an SBSDR processes and disseminates trade data using electronic systems, and if these systems fail, public access to timely and reliable trade data for the derivatives markets could potentially be compromised. 109 Also, if the data stored at an SBSDR is corrupted, the SBSDR would not be able to provide accurate data to relevant regulatory authorities, which could hinder the oversight of the derivatives markets. Moreover, because SBSDRs receive and maintain proprietary and sensitive information ( e.g., trading data, non-public personal information), it is essential that their systems be capable of ensuring the security and integrity of this data. 107 See SBSDR Adopting Release, supra note 96 at 14450 (“SDRs themselves are subject to certain operational risks that may impede the ability of SDRs to meet these goals, and the Title VII regulatory framework is intended to address these risks.”). 108 See PFMI, supra note 100, at 3.20.20 (stating that “A TR should carefully assess the additional operational risks related to its links to ensure the scalability and reliability of IT [information technology] and related resources. A TR can establish links with another TR or with another type of FMI. Such links may expose the linked FMIs to additional risks if not properly designed. Besides legal risks, a link to either another TR or to another type of FMI may involve the potential spillover of operational risk. The mitigation of operational risk is particularly important because the information maintained by a TR can support bilateral netting and be used to provide services directly to market participants, service providers (for example, portfolio compression service providers), and other linked FMIs.”). 109 See PFMI, supra note 100, at 1.14, Box 1 (stating that “[t]he primary public policy benefits of a TR, which stem from the centralisation and quality of the data that a TR maintains, are improved market transparency and the provision of this data to relevant authorities and the public in line with their respective information needs. Timely and reliable access to data stored in a TR has the potential to improve significantly the ability of relevant authorities and the public to identify and evaluate the potential risks posed to the broader financial system.”). Along with the reliance of SBSDRs on automated systems to perform their functions, regulatory development of the SBS market has proceeded significantly since 2015. In particular, security-based swap dealers have registered with the Commission, 110 SBSDRs have registered with the Commission, 111 security-based swap execution facilities (“SBSEF”) registration has been proposed, 112 and straight-through processing has increased in the market. 113 On November 8, 2021, SBS data began being reported to SBSDRs, which in turn began disseminating such data to the Commission and the public. 114 In light of the important role of SBSDRs in the markets for security-based swaps, their level of automation, and the regulatory development of the SBS market in recent years, the Commission believes it is timely to propose enhanced requirements for registered SBSDRs with respect to their technology systems that are central to the performance of their regulated activities. 110 See List of Security-Based Swap Dealers and Major Security-Based Swap Participants, Commission (last updated Jan. 4, 2023), available at: https://www.sec.gov/files/list_of_sbsds_msbsps_1_4_2023locked_final.xlsx . 111 The Commission approved the registration of two SBSDRs in 2021. See Security-Based Swap Data Repositories, DTCC Data Repository (U.S.), LLC, Order Approving Application for Registration as a Security-Based Swap Data Repository, Securities Exchange Act Release No. 91798 (May 7, 2021), 86 FR 26115 (May 12, 2021); Security-Based Swap Data Repositories, ICE Trade Vault, LLC, Order Approving Application for Registration as a Security-Based Swap Data Repository, Securities Exchange Act Release No. 92189 (Jun. 16, 2021), 86 FR 32703 (Jun. 22, 2021). 112 See Rules Relating to Security-Based Swap Execution and Registration and Regulation of Security-Based Swap Execution Facilities, Securities Exchange Act Release No. 94615 (Apr. 6, 2022), 87 FR 28872 (May 11, 2022). 113 See, e.g., Security-Based Swap Data Repositories, DTCC Data Repository (U.S.), LLC, Notice of Filing of Application for Registration as a Security-Based Swap Data Repository, Securities Exchange Act Release No. 91071 (Feb. 5, 2021), 86 FR 8977 (Feb. 10, 2021) (“[T]he SDR process is an end-to-end straight through process; from the receipt of data, processing and maintenance of data, and dissemination of data, processes are automated and do not require manual intervention.”). 114 See SEC Approves Registration of First Security-Based Swap Data Repository; Sets the First Compliance Date for Regulation SBSR, Press Release, Commission (May 7, 2021), available at: https://www.sec.gov/news/press-release/2021-80 . ii. Current Regulation The Commission believes the current technology regulation framework for SBSDRs should be strengthened. SBSDR technology regulation is currently governed by 17 CFR 240.13n-6 (“Rule 13n-6”), a broad, principles-based operational risk rule, 115 which the Commission adopted in 2015 when regulatory development of the SBS market was still nascent and SBSDRs were not yet registered with the Commission under 17 CFR 240.13n-1 (“Rule 13n-1”). 116 Additionally, Rule 13n-6 was adopted shortly after the adoption of Regulation SCI, with modifications that did not include some of the more detailed proposed requirements. 117 As a result, the two currently-registered SBSDRs (which are affiliated with registered clearing agencies that are subject to Regulation SCI) 118 remain subject to the broad principles-based rule, Rule 13n-6, which is the only applicable operational risk requirement for SBSDRs in the Commission's current regulatory framework. 115 See 17 CFR 240.13n-6. 116 See SBSDR Adopting Release, supra note 96, at 14499, 14550 (“[T]he Commission may consider the application of any features of Regulation SCI to SDRs in the future.”); SCI Adopting Release, supra note 1, at 72364. 117 See SBSDR Adopting Release, supra note 96, at 14499 (stating that “[t]he Commission is not adopting Rule 13n-6 as proposed because, after proposing Rule 13n-6, the Commission considered the need for an updated regulatory framework for certain systems of the U.S. securities trading markets and adopted Regulation Systems Compliance and Integrity (`Regulation SCI').”). Specifically, the Commission stated that the rule as adopted better sets an appropriate core framework for the policies and procedures of SBSDRs with respect to automated systems and that the framework adopted is “broadly consistent” with Regulation SCI. See id. Therefore, the Commission declined to adopt more prescriptive elements of the rule as proposed, including proposed Rule 13n-6(b), which would have required that every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities: (1) establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, resiliency, and security. These policies and procedures shall, at a minimum: (i) establish reasonable current and future capacity estimates; (ii) conduct periodic capacity stress tests of critical systems to determine such systems' ability to process transactions in an accurate, timely, and efficient manner; (iii) develop and implement reasonable procedures to review and keep current its system development and testing methodology; (iv) review the vulnerability of its systems and data center computer operations to internal and external threats, physical hazards, and natural disasters; and (v) establish adequate contingency and disaster recovery plans; (2) on an annual basis, submit an objective review to the Commission within thirty calendar days of its completion. Where the objective review is performed by an internal department, an objective, external firm shall assess the internal department's objectivity, competency, and work performance with respect to the review performed by the internal department. The external firm must issue a report of the objective review, which the security-based swap data repository must submit to the Commission on an annual basis, within 30 calendar days of completion of the review; (3) promptly notify the Commission of material systems outages and any remedial measures that have been implemented or are contemplated (prompt notification includes the following: (i) immediately notify the Commission when a material systems outage is detected; (ii) immediately notify the Commission when remedial measures are selected to address the material systems outage; (iii) immediately notify the Commission when the material systems outage is addressed; and (iv) submit to the Commission within five business days of the occurrence of the material systems outage a detailed written description and analysis of the outage and any remedial measures that have been implemented or are contemplated); and (4) notify the Commission in writing at least thirty calendar days before implementation of any planned material systems changes. See SBSDR Proposing Release, supra note 104, at 77370. 118 The two registered SBSDRs, DTCC Data Repository (U.S.), LLC and ICE Trade Vault, LLC, are affiliated with the registered clearing agencies, Depository Trust Company and ICE Clear Credit LCC, respectively. Rule 13n-6 requires that SBSDRs, with respect to those systems that support or are integrally related to the performance of their activities, establish, maintain, and enforce written policies and procedures reasonably designed to ensure that their systems provide adequate levels of capacity, integrity, resiliency, availability, and security. 119 The operational risk principles underlying Rule 13n-6 are an essential part of the rules that comprise the core framework for SBSDRs that the Commission established in 2015 at the opening of its regulatory regime governing SBSDRs. The core framework influences all applicable requirements relevant to SBSDRs that follow. The core framework not only addresses SBSDR operational risk, but also other SBSDR enumerated duties, including registration, market access to services and data, governance arrangements, conflicts of interest, data collection and maintenance, privacy and disclosure requirements, and chief compliance officers, 120 thereby implementing the provisions of Exchange Act section 13(n). 121 Therefore, the SBSDR core framework, which Rule 13n-6 is a part, is different in focus and broader in scope than proposed Regulation SCI—as it relates to SBSDRs—which is focused on, among things, protecting the security of SBSDR systems. While Rule 13n-6 may not provide the absolute requirements relating to SBSDR operational risk, as the Commission's regulatory regime continues to evolve, Rule 13n-6 sets forth an enumerated duty for operational risk concerns that registered SBSDRs must address—at the time of registration and throughout its registration with the Commission. Compliance with the core principles and requirements in the SBSDR rules, including Rule 13n-6, is, thus, an important building block for better ensuring the integrity of an SBSDR's data quality upon which the Commission and the securities markets rely. In this regard, the Commission believes that Rule 13n-6 should be preserved, with the requirements of this proposal, if adopted, working to complement Rule 13n-6. 122 Specifically, the proposed requirements of Regulation SCI on SBSDRs would exist and operate in conjunction with Rule 13n-6 and would prescribe certain key features and more detailed functional requirements to help ensure that SBSDR market systems are robust, resilient, and secure. 123 119 See 17 CFR 240.13n-6. 120 See 17 CFR 240.13n-1 through 240.13n-12; See SBSDR Adopting Release, supra note 96, at 14440-42. 121 15 U.S.C. 78m(n). 122 When adopting Rule 13n-6, the Commission acknowledged the potential application of Regulation SCI provisions to SBSDRs in the future. See SBSDR Adopting Release, supra note 96, at 14438, 14499 (stating that “[c]onsistent with this approach and in recognition of the importance of SDRs as the primary repositories of SBS trade information, the Commission may consider the application of any features of Regulation SCI to SDRs in the future.”). Additionally, as guidance, the Commission stated that, in preparing their policies and procedures to comply with Rule 13n-6, SBSDRs may consider whether to incorporate aspects of Regulation SCI that may be appropriate for their particular implementation of Rule 13n-6. See id., at 14499, n.826 (stating that “[i]n preparing their policies and procedures, SDRs may consider whether to incorporate aspects of Regulation SCI that may be appropriate for their particular implementation of Rule 13n-6, including where an SDR is related by virtue of its corporate structure to an entity subject to Regulation SCI.”). 123 In 2014, the SEC's SBSDR regulatory framework was subject to a Level 2 assessment by the Bank for International Settlements' Committee on Payments and Market Infrastructures (“CPMI”) and the International Organization of Securities Commissions (“IOSCO”), which concluded that “the U.S. jurisdiction has developed rules or proposed rules that completely and consistently implement the majority of Principles that are applicable to CCPs [central counterparties] [but that] [t]he progress of the U.S. jurisdiction towards completely and consistently implementing the Principles for [trade repositories] has been more limited.” See CPMI-IOSCO, Implementation Monitoring of PFMIs: Level 2 assessment report for central counterparties and trade repositories—United States (Feb. 26, 2015), available at https://www.iosco.org/library/pubdocs/pdf/IOSCOPD477.pdf . Additionally, CPMI-IOSCO issued guidance for cyber resilience for financial market infrastructures (“FMIs”), including trade repositories. See CPMI-IOSCO, Guidance on cyber resilience for financial market infrastructures (June 2016), available at https://www.iosco.org/library/pubdocs/pdf/IOSCOPD535.pdf ; see also CPMI-IOSCO, Implementation monitoring of the PFMI: Level 3 assessment on Financial Market Infrastructures' Cyber Resilience (Nov. 2022), available at https://www.iosco.org/library/pubdocs/pdf/IOSCOPD723.pdf (presenting the results of an assessment of the state of cyber resilience (as of Feb. 2021) at 37 FMIs from 29 jurisdictions that participated in this exercise in 2020 to 2022). Regulation SCI, among other things, defines the scope of systems covered, and requires: the establishment, maintenance, and enforcement of written policies and procedures to ensure that SCI systems have levels of capacity, integrity, resiliency, availability, and security adequate to maintain operational capacity and promote the maintenance of fair and orderly markets, with minimum elements that include, among others, standards designed to facilitate the successful collection, processing, and dissemination of market data and robust business continuity and disaster recovery plans; policies and procedures designed to ensure compliance with the federal securities laws; corrective action and reporting and dissemination of SCI events, quarterly reporting of material systems changes, and an annual SCI review; and participation of key members in SCI entity's business continuity and disaster recovery plans. The Commission believes that SBSDRs operate with similar complexity and in a similar fashion as other registered securities information processors that are currently subject to Regulation SCI and that they play an important role in the SBS market and face similar technological vulnerabilities as existing SCI entities, such as FINRA's TRACE and MSRB's EMMA. For example, were an SBSDR to experience a systems issue, market participants could be prevented from receiving timely information regarding accurate prices for individual SBSs. Given SBSDRs' reliance on automated systems and their dual Dodd-Frank mandated role of providing price transparency to market participants and SBS data to regulators to surveil markets to better ensure that systemic risk is limited and market stability is enhanced, the Commission believes it appropriate to include SBSDRs into the scope of the Regulation SCI proposal. Currently, there are two registered SBSDRs that would become subject to Regulation SCI should the Regulation SCI amendments be adopted. 124 124 See supra note 118. iii. Request for Comment 1. The Commission requests comment generally on the inclusion of SBSDRs as SCI entities. Is their inclusion appropriate? Why or why not? Please be specific and provide examples, if possible, to illustrate your points. 2. Should all or some aspects of Regulation SCI apply to SBSDRs? Why or why not? If only a portion, please specify which portion(s) and explain why. If all, explain why. 3. Are the definitions of SCI systems and indirect SCI systems appropriate for SBSDRs? Why or why not? Are there any systems of SBSDRs that should be included but would not be covered by these definitions? Please explain. Are there any systems of SBSDRs that should be excluded by these definitions? Please explain. Do SBSDRs have any systems that would or should be covered by the definition of critical SCI systems? Please explain. 4. Is current Rule 13n-6 sufficient to govern the technology of SBSDRs? If not, why not? Would the Regulation SCI proposed requirements, together with Rule 13n-6, be sufficient to address operational risk concerns posed by SBSDRs? Why or why not? Should Rule 13n-6 serve as an operational risk requirement for new SBSDR registrants during the first year registered with the Commission, with Regulation SCI proposed requirements imposed after the first year of registration? Why or why not? Please be specific and respond with examples, if possible. 5. Given the current practices of SBSDRs, would the proposed Regulation SCI requirements pose unreasonable or unworkable difficulties for them, technologically, legally, operationally, or procedurally? Why or why not? Please be specific and respond with examples, if possible. 6. Should Regulation SCI distinguish among different types of SBSDRs such that some requirements of Regulation SCI might be appropriate for some SBSDRs but not others? Why or why not? If so, what are those distinctions and what are those requirements? For example, should any requirements be based on criteria such as number of transactions or notional volume reported to a SBSDR? If so, what would be an appropriate threshold for any such criteria, and why? Please be specific and provide examples, if possible. 7. Because proposed Regulation SCI would include SBSDRs as “SCI entities,” SBSDRs that share systems with affiliated clearing agencies could be required to classify those shared systems as SCI systems of the SBSDR and indirect SCI systems of the clearing agency, and vice versa. Is this outcome appropriate? Why or why not? Please be specific and provide examples, if possible. 8. Is Regulation SCI, including as proposed to be amended, comprehensive and robust enough to address SBSDRs that rely on third-party providers to support core SBSDR operations? Why or why not? Please be specific and provide examples, if possible. b. SCI Broker-Dealers The Commission further proposes to expand the application of Regulation SCI by including certain broker-dealers—to be referred to as “SCI broker-dealers”—in the definition of SCI entity. An SCI broker-dealer would be a broker or dealer registered with the Commission pursuant to section 15(b) of the Exchange Act that exceeds one or more size thresholds. An SCI broker-dealer would be a broker-dealer that meets or exceeds: (i) a total assets threshold, or (ii) one or more transaction activity thresholds. The proposed thresholds are designed to identify the largest U.S. broker-dealers by size, as measured in two different ways. The first is analysis of broker-dealer size based on total assets reported on Form X-17A-5 (Financial and Operational Combined Uniform Single (“FOCUS”) Report Part II, Item 940), 125 which reveals the largest firms based on their balance sheets at a point in time, and which is a measure used by the Board of Governors of the Federal Reserve System (“Federal Reserve Board”) to calculate and provide to the public on a quarterly basis a measure of total assets of all security broker-dealers. 126 The second is a measure of broker-dealer size using transaction activity to identify significant firms active in certain enumerated types of securities. As discussed further below, the total assets threshold is expressed in terms of the broker-dealer's total assets at specified points in time as a percentage of the “total assets of all security broker-dealers” with “total assets of all security-broker-dealers” being calculated and made publicly available by the Federal Reserve Board for the associated preceding calendar quarter, or any subsequent provider of such information. 127 The trading activity threshold is expressed in terms of the sum of buy and sell transactions that the broker-dealer transacted during a specified time period as a percentage of reported total average daily dollar volume in one or more enumerated types of securities. The proposed total assets threshold is broadly similar to the approach banking regulators use to assess the appropriate capital and liquidity requirements for banks. 128 The proposed transaction activity thresholds are similar to, but distinguishable from, the market share thresholds for SCI ATSs. 129 The proposed threshold approaches in the proposed definition of SCI broker-dealer are designed to identify entities that play key roles in the U.S. securities markets due to the magnitude of their activity in these markets. 130 125 See Form X-17A-5, FOCUS Report, Part II, at 3, available at https://www.sec.gov/files/formx-17a-5_2_2.pdf (requiring broker-dealers to report their total assets in Item 940). 126 See infra note 127. 127 For additional detail on the calculation of total assets of all security broker-dealers, see Z.1: Financial Accounts of the United States, available at https://www.federalreserve.gov/apps/fof/Guide/z1_tables_description.pdf; ((i) stating that the term “security broker-dealers” refers to firms that buy and sell securities for a fee, hold an inventory of securities for resale, or do both; and firms that make up this sector are those that submit information to the Commission on one of two reporting forms, either the Financial and Operational Combined Uniform Single Report of Brokers and Dealers (FOCUS) or the Report on Finances and Operations of Government Securities Brokers and Dealers (FOGS); and (ii) describing the major assets of the security brokers and dealers sector). Currently, this information is readily accessible on the Federal Reserve Economic Data (“FRED”) website. See Board of Governors of the Federal Reserve System (US), Security Brokers and Dealers; Total Assets (Balance Sheet), Level [BOGZ1FL664090663Q], retrieved from FRED, Federal Reserve Bank of St. Louis, available at: https://fred.stlouisfed.org/series/BOGZ1FL664090663Q (making publicly available the total assets of all security brokers and dealers, as calculated and updated quarterly by the Federal Reserve Board). 128 See infra notes 178-180 and accompanying text. 129 See infra section III.A.b.iii. 130 See infra text accompanying notes 138-142 (summarizing comments on the SCI Proposing Release from commenters urging that application of Regulation SCI to broker-dealers should be limited to those with substantial transaction volume or having a large “footprint”). i. Background There are approximately 3,500 broker-dealers registered with the Commission pursuant to section 15(b) of the Exchange Act, and these entities encompass a broad range of sizes, business activities, and business models. 131 In 2013, the Commission proposed to include significant volume ATSs in the definition of SCI entity but at that time did not propose to include any other aspects of broker-dealer operations. 132 Rather, the Commission solicited comment on whether certain classes of broker-dealers should be covered. In particular, the Commission sought comment on whether Regulation SCI should apply, for example, to OTC market makers 133 (either all or those that execute a significant volume of orders), exchange market makers 134 (either all or those that trade a significant volume on exchanges), order-entry firms that handle and route order flow for execution (either all or those that handle a significant volume of investor orders), clearing broker-dealers (either all or those that engage in a significant amount of clearing activities), and/or large multi-service broker-dealers that engage in a variety of order handling, trading, and clearing activities. 135 Although OTC market makers and clearing broker-dealers were noted specifically as examples of categories of broker-dealers that could pose significant risk to the market if a large portion of the order flow they handle or process were disrupted due to a systems issue, the Commission broadly solicited commenters' views on the importance of different categories of broker-dealers to the stability of overall securities market infrastructure and the risks posed by their systems. 136 131 This estimate is derived from information on broker-dealer FOCUS Report Form X-17A-5 Schedule II filings as of Dec. 31, 2021, as well as the third quarter of 2022. See also FINRA, 2022 FINRA Industry Snapshot (Mar. 2022), available at https://www.finra.org/sites/default/files/2022-03/2022-industry-snapshot.pdf . Section 15(b)(8) of the Exchange Act prohibits any broker-dealer from effecting transactions in securities unless it is a member of a registered national securities association ( i.e., FINRA) or effects securities transactions solely on a national securities exchange of which it is a member. See 15 U.S.C. 78 o (b)(8); see also 17 CFR 240.15b9-1 (“Rule 15b9-1”) (exempting proprietarily trading dealers from section 15(b)(8)'s national securities association membership requirement if they are a member of a national securities exchange and meet certain other requirements). But see Securities Exchange Act Release No. 95388 (July 29, 2022), 87 FR 49930 (Aug. 12, 2022) (proposing amendments to Exchange Act Rule 15b9-1 that would generally require proprietary trading firms that are registered broker-dealers to become a registered member of a national securities association ( i.e., FINRA) if they effect securities transactions otherwise than on an exchange of which they are a member). See also Securities Exchange Act Release No. 94524 (Mar. 28, 2022), 87 FR 23054 (Apr. 18, 2022) (“Dealer-Trader Release”) (proposing to further define “dealer” and “government securities dealer” to identify certain activities that would constitute a “regular business” requiring a person engaged in those activities to register as a “dealer” or a “government securities dealer,” absent an exception or exemption). Because the proposed amendments to further define the definition of dealer could result in a greater number of dealers and the amendments proposed to expand and update Regulation SCI could impact these newly designated dealers, commenters also are encouraged to review the Dealer-Trader Release to determine whether it might affect their comments on this proposal. 132 See SCI Proposing Release, supra note 14, at 18138-42. 133 An OTC market maker is a dealer that holds itself out as willing to buy and sell NMS stocks on a continuous basis in amounts of less than block size otherwise than on an exchange. See 17 CFR 242.600(b)(64). 134 An exchange market maker is any member of a national securities exchange that is registered as a specialist or market maker pursuant to the rules of such exchange. See 17 CFR 242.600(b)(32). 135 See SCI Proposing Release, supra note 14, at 18139-40. 136 See SCI Proposing Release, supra note 14, at 18138-40 (including questions 194-196 soliciting comment on whether and how to distinguish between and among categories of broker-dealers, such as OTC market makers, order entry firms that handle and route order flow for execution, clearing broker-dealers, and large multi-service broker-dealers that engage in a variety of order handling, trading, and clearing activities). As summarized in the SCI Adopting Release, commenters' views varied. 137 One commenter opined that market makers and brokers or dealers that execute orders internally by trading as a principal or crossing orders as an agent and handle market share that exceeds that of certain SCI ATSs should be subject to Regulation SCI. 138 Others stated that market makers, high frequency trading firms, or any firm with market access should be included, arguing that these market participants could present systemic risks to the market and had “a significant footprint in the markets.” 139 Others stated that broker-dealers should be SCI entities because 17 CFR 240.15c3-5 (“Rule 15c3-5” or “Market Access Rule”), 140 requiring the implementation of risk management and supervisory controls to limit risk associated with routing orders to exchanges or ATSs, was not sufficient by itself, as it does not address the reliability or integrity of the systems that implement such controls. 141 One commenter stated that Regulation SCI should be extended to any trading platforms that transact significant volume, including systems that are not required to register as an ATS because all executions are against the bids and offers of a single dealer. 142 In contrast, other commenters argued that broker-dealers should not be subject to Regulation SCI because they must comply with other Exchange Act and FINRA rules and the proposed Regulation SCI requirements would be “duplicative and unduly burdensome.” 143 At adoption, the Commission stated that “should [it] decide to propose to apply the requirements of Regulation SCI to [broker-dealer operations other than ATSs, it] would issue a separate release discussing such a proposal and would take these comments into account.” 144 137 See SCI Adopting Release, supra note 1, at 72365. 138 See id. (citing letter from the New York Stock Exchange, Inc. (“NYSE”)). 139 See id. (citing letters from Liquidnet, Inc., David Lauer, and R.T. Leuchtkafer). 140 See 17 CFR 240.15c3-5. 141 See SCI Adopting Release, supra note 1, at 72365 (citing letters from David Lauer and the NYSE). 142 See id. (citing letter from BlackRock at 4, in which BlackRock stated that trading systems that “transact significant volume” are “venues that have a meaningful role and impact on the equity market”). 143 See id. 144 SCI Adopting Release, supra note 1, at 72366. In considering expansion of Regulation SCI to broker-dealers or broker-dealer operations beyond SCI ATSs, the Commission has considered the extent to which current Commission and FINRA rules affect how broker-dealers design and review their systems for capacity, integrity, resiliency, availability, and/or security adequate to maintain operational capability and promote the maintenance of fair and orderly markets and compliance with federal securities laws and regulations, and whether additional technology oversight is appropriate for certain broker-dealers based on the magnitude of their activity in the markets today. 145 The Commission proposes to apply Regulation SCI to a limited number of the approximately 3,500 broker-dealers registered with the Commission. The proposed thresholds are designed to identify firms that, by virtue of their total assets or level of transaction activity over a period of time and on a consistent basis, play a significant role in the orderly functioning of U.S. securities markets. The thresholds are designed to identify firms that, if adversely affected by a technology event, could disrupt or impede orderly and efficient market operations more broadly. 145 As noted above, the concurrently issued Exchange Act Cybersecurity Proposal would establish minimum “cybersecurity rules” for all broker-dealers. That proposal does not, however, independently address weaknesses in broker-dealer operational capacity or resiliency not attributable to cybersecurity breaches. ii. Current Regulatory Oversight of Broker-Dealer Systems Technology There are a number of Commission and FINRA rules that affect how broker-dealers design and maintain their technology and promote business continuity and regulatory compliance. 146 Although these rules may support the goal of more resilient broker-dealer systems, they are not designed to address the same concerns that Regulation SCI addresses and are not a substitute for Regulation SCI. 147 146 17 CFR 240.3a1-1(a)(2) (“Rule 3a1-1(a)(2)”), exempts from the Exchange Act section 3(a)(1) definition of “exchange” an organization, association, or group of persons that complies with Regulation ATS. All such exempted ATSs must be a registered broker-dealer and become a member of an SRO, which typically is FINRA. Accordingly, FINRA rules applicable to broker-dealers apply to ATSs. A similar discussion of FINRA rules applicable to ATSs appears in the SCI Adopting Release, supra note 1, at 72263. 147 See infra notes 148-166 and accompanying text. See also SCI Adopting Release, supra note 1, at 72263 (n. 115 and accompanying text), 72365 (discussing comments received). As some commenters on the SCI Proposing Release stated, the Market Access Rule is relevant to certain broker-dealer systems. The Market Access Rule requires broker-dealers with market access to implement, on a market-wide basis, effective financial and regulatory risk management controls and supervisory procedures reasonably designed to limit financial exposure and ensure compliance with applicable regulatory requirements, and thus seeks to address, among other things, certain risks posed to the markets by broker-dealer systems. 148 Pursuant to the Market Access Rule, a broker or dealer with market access, or that provides a customer or any other person with access to a national securities exchange or ATS through use of its market participant identifier or otherwise, must establish, document, and maintain a system of risk management controls and supervisory procedures reasonably designed to manage the financial, regulatory, and other risks of this business activity. 149 The Market Access Rule specifies standards for financial and regulatory risk management controls and supervisory procedures. 150 It requires that the financial risk management controls and supervisory procedures must be reasonably designed to limit systematically the financial exposure of the broker or dealer that could arise from market access. 151 In addition, the Market Access Rule requires that regulatory risk management controls and supervisory procedures be reasonably designed to ensure compliance with all regulatory requirements. 152 As such, the focus of the Market Access Rule requires controls to prevent technology and other errors that can create some of the more significant risks to broker-dealers and the markets, namely those that arise when a broker-dealer enters orders into a national securities exchange or ATS, including when it provides sponsored or direct market access to customers or other persons, where the consequences of such an error can rapidly magnify and spread throughout the markets. Further, the Market Access Rule requires specific controls and procedures around a broker-dealer entering orders on a national securities exchange or ATS that Regulation SCI does not and would not prescribe. 148 See Securities Exchange Act Release No. 63241 (Nov. 3, 2010), 75 FR 69792 (Nov. 15, 2010) (“Market Access Release”). Under 17 CFR 240.15c3-5(a)(1) (“Rule 15c3-5(a)(1)”), “market access” is defined to mean: (i) access to trading in securities on an exchange or ATS as a result of being a member or subscriber of the exchange or ATS, respectively; or (ii) access to trading in securities on an ATS provided by a broker-dealer operator of an ATS to a non-broker-dealer. See 17 CFR 240.15c3-5(a)(1). In adopting Rule 15c3-5(a)(1), the Commission stated that “the risks associated with market access . . . are present whenever a broker-dealer trades as a member of an exchange or subscriber to an ATS, whether for its own proprietary account or as agent for its customers, including traditional agency brokerage and through direct market access or sponsored access arrangements.” See Market Access Release at 69798. As such, the Commission stated that “to effectively address these risks, Rule 15c3-5 must apply broadly to all access to trading on an Exchange or ATS.” Id. 149 See 17 CFR 240.15c3-5(b). 150 See 17 CFR 240.15c3-5(c). 151 See 17 CFR 240.15c3-5(c)(1). 152 See 17 CFR 240.15c3-5(c)(2). See also 17 CFR 240.15c3-5(a)(2) (defining “regulatory requirements” to mean all Federal securities laws, rules and regulations, and rules of self-regulatory organizations, that are applicable in connection with market access). In contrast, the policies and procedures required by Regulation SCI apply broadly to technology that supports trading, clearance and settlement, order routing, market data, market regulation, and market surveillance and, among other things, address their overall capacity, integrity, resilience, availability, and security independent of market access. Whereas the Market Access Rule prescribes specific controls and procedures around a broker-dealer entering orders on an exchange or ATS, it is not designed to ensure that the key technology pervasive and important to the functioning of the U.S. securities markets is robust, resilient, and secure. 153 Among other requirements, the policies and procedures requirements of Regulation SCI are designed to help ensure that the systems of SCI entities are adequate to maintain operational capability independent of any specific SCI event ( i.e., a systems issue such as a systems disruption, systems intrusion, or systems compliance issue). Further, the SCI review requirement obligates an SCI entity to assess the risks of its systems and effectiveness of its technology controls at least annually, identify weaknesses, and ensure compliance with the safeguards of Regulation SCI. The Market Access Rule and Regulation SCI, therefore, have different requirements and would operate in conjunction with each other to help ensure that SCI broker-dealer SCI systems, whether used for access to the national securities exchanges or ATSs or not, are robust, resilient, and secure. 153 See also supra note 141 and accompanying text. Broker-dealers are also subject to the Commission's financial responsibility rules (17 CFR 240.15c3-1 (“Rule 15c3-1”) and 17 CFR 240.15c3-3 (“Rule 15c3-3”)) under the Exchange Act. Rule 15c3-1 requires broker-dealers to maintain minimum amounts of net capital, ensuring that the broker-dealer at all times has enough liquid assets to promptly satisfy all creditor claims if the broker-dealer were to go out of business. 154 Rule 15c3-3 imposes requirements relating to safeguarding customer funds and securities. 155 These rules provide protections for broker-dealer counterparties and customers and can help to mitigate the risks to, and impact on, customers and other market participants by protecting them from the consequences of financial failure that may occur because of a systems issue at a broker-dealer, and thus have a different scope and purpose from Regulation SCI. 156 154 See 17 CFR 240.15c3-1. 155 See 17 CFR 240.15c3-3. 156 Similarly, 17 CFR 248.30 (“Rule 30” of Regulation S-P), which requires registered brokers and dealers to have written policies and procedures that are reasonably designed to safeguard customer records and information—to insure their security and confidentiality, protect against threats or hazards to their security and integrity and protect against unauthorized access or use that could result in substantial harm or inconvenience to any customer—is not designed to help ensure operational capability of market related systems. In addition, 17 CFR 248.201 (“Regulation S-ID”) requires financial institutions or creditors (defined to include registered broker-dealers) that have one or more covered accounts, as defined in 17 CFR 248.201(b)(3) ( e.g., brokerage account), to develop and implement a written identity theft prevention program to detect, prevent, and mitigate identity theft in connection with covered accounts that includes policies and procedures to identify and incorporate red flags into the program, detect and respond to red flags, and incorporate periodic updates to the program. This rule, however, is also not designed to ensure operational capability of market related systems. Pursuant to 17 CFR 240.17a-3 (“Rule 17a-3” under the Exchange Act) and 17 CFR 240.17a-4 (“Rule 17a-4” under the Exchange Act), broker-dealers are required to make and keep current records detailing, among other things, securities transactions, money balances, and securities positions. 157 A systems issue at a broker-dealer would not excuse the broker-dealer for noncompliance with these requirements. 158 Further, a broker-dealer that fails to make and keep current the records required by Rule 17a-3 must give notice to the Commission of this fact on the same day and, thereafter, within 48 hours transmit a report to the Commission stating what the broker-dealer has done or is doing to correct the situation. 159 Regulation SCI, however, more directly addresses mitigating the impact of technology failures with respect to SCI systems and indirect SCI systems (which include systems that are not used to make and keep current the records required by Rule 17a-3). Specifically, it requires notifications to the Commission for a different set of events—systems intrusions, systems compliance issues, and systems disruptions—than the notification requirements of 17 CFR 240.17a-11 (“Rule 17a-11”), and is therefore not duplicative of Rule 17a-11. In addition, it requires that, when an SCI event has occurred, an SCI entity must begin to take appropriate corrective action which must include, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable. 157 See 17 CFR 240.17a-3; 17 CFR 240.17a-4. 158 See, e.g., Securities Exchange Act Release No. 40162 (July 2, 1998), 63 FR 37668 (July 13, 1998) (stating that computer systems with “Year 2000 Problems” may be deemed not to have accurate and current records and be in violation of Rule 17a-3). 159 See 17 CFR 240.17a-11. FINRA also has several rules that are similar to, but take a different approach from, Regulation SCI. For example, FINRA Rule 4370 requires that each broker-dealer create and maintain a written business continuity plan identifying procedures relating to an emergency or significant business disruption that are reasonably designed to enable them to meet their existing obligations to customers. The procedures must also address the broker-dealer's existing relationships with other broker-dealers and counterparties. A broker-dealer is required to update its plan in the event of any material change to the member's operations, structure, business, or location and must conduct an annual review of its business continuity plan to determine whether any modifications are necessary in light of changes to the member's operations, structure, business, or location. The rule sets forth general minimum elements that a broker-dealer's business continuity plan must address. 160 160 Specifically, FINRA Rule 4370 requires that each plan must, at a minimum, address: data back-up and recovery; all mission critical systems; financial and operational assessments; alternate communications between customers and the member; alternate communications between the member and its employees; alternate physical location of employees; critical business constituent, bank, and counter-party impact; regulatory reporting; communications with regulators; and how the member will assure customers' prompt access to their funds and securities in the event that the member determines that it is unable to continue its business. This rule is akin to Regulation SCI's Rule 1001(a)(2)(v) requiring policies and procedures for business continuity and disaster recovery plans. 161 However, unlike Regulation SCI, the FINRA rule does not include the requirement that the business continuity and disaster recovery plans be reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption, nor does it require the functional and performance testing and coordination of industry or sector-testing of such plans, which are instrumental in achieving the goals of Regulation SCI with respect to SCI entities. 162 In addition, FINRA Ru [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2023-05775. Public record. Not legal advice.