Regulation Systems Compliance and Integrity — SEC — US

SECURITIES AND EXCHANGE
COMMISSION
17 CFR Parts 242 and 249
[Release No. 34–97143; File No. S7–07–23] RIN 3235–AN25 Regulation Systems Compliance and Integrity AGENCY: Securities and Exchange Commission. ACTION: Proposed rule. SUMMARY: The Securities and Exchange Commission (‘‘Commission’’ or ‘‘SEC’’) is proposing amendments to Regulation Systems Compliance and Integrity (‘‘Regulation SCI’’) under the Securities Exchange Act of 1934 (‘‘Exchange Act’’). The proposed amendments would expand the definition of ‘‘SCI entity’’ to include a broader range of key market participants in the U.S. securities market infrastructure, and update certain provisions of Regulation SCI to take account of developments in the technology landscape of the markets since the adoption of Regulation SCI in
2014. The proposed expansion would
add the following entities to the definition of ‘‘SCI entity’’: registered security-based swap data repositories (‘‘SBSDRs’’); registered broker-dealers exceeding an asset or transaction activity threshold; and additional clearing agencies exempted from registration. The proposed updates would amend provisions of Regulation SCI relating to systems classification and lifecycle management; third party/ vendor management; cybersecurity; the SCI review; the role of current SCI industry standards; and recordkeeping and related matters. Further, the Commission is requesting comment on whether significant-volume alternative trading systems (ATSs) and/or brokerdealers using electronic or automated systems for trading of corporate debt securities or municipal securities should be subject to Regulation SCI. DATES: Comments should be received on or before June 13, 2023. ADDRESSES: Comments may be submitted by any of the following methods:
Electronic Comments

Use the Commission’s internet
comment form (https://www.sec.gov/ rules/proposed.shtml); or
Send an email to rule-comments@
sec.gov. Please include File Number S7– 07–23 on the subject line. Paper Comments
Send paper comments to, Secretary,
Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549–1090. All submissions should refer to File Number S7–07–23. This file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method of submission. The Commission will post all comments on the Commission’s website (https:// www.sec.gov/rules/proposed.shtml). Comments are also available for website viewing and printing in the Commission’s Public Reference Room, 100 F Street NE, Washington, DC 20549 on official business days between the hours of 10 a.m. and 3 p.m. Operating conditions may limit access to the Commission’s Public Reference Room. All comments received will be posted without change. Persons submitting comments are cautioned that we do not redact or edit personal identifying information from comment submissions. You should submit only information that you wish to make available publicly. Studies, memoranda, or other substantive items may be added by the Commission or staff to the comment file during this rulemaking. A notification of the inclusion in the comment file of any materials will be made available on our website. To ensure direct electronic receipt of such notifications, sign up through the ‘‘Stay Connected’’ option at www.sec.gov to receive notifications by email. FOR FURTHER INFORMATION CONTACT:
Heidi Pilpel, Senior Special Counsel; David Liu, Special Counsel; Sara Hawkins, Special Counsel; Gita Subramaniam, Special Counsel; Josh Nimmo, Special Counsel; An Phan, Special Counsel, at (202) 551–5500, Office of Market Supervision, Division of Trading and Markets, U.S. Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549. SUPPLEMENTARY INFORMATION: The Commission is proposing amendments to the following rules under the Exchange Act and conforming amendments to Form SCI. Commission reference CFR citation (17 CFR) Rule 1000 .................. § 242.1000 Rule 1001 .................. § 242.1001 Rule 1001(a) ............. § 242.1001(a) Rule 1001(a)(2) ......... § 242.1001(a)(2) Rule 1001(a)(2)(v) ..... § 242.1001(a)(2)(v) Rule 1001(a)(2)(vi) .... § 242.1001(a)(2)(vi) Rule 1001(a)(2)(vii) ... § 242.1001(a)(2)(vii) Rule 1001(a)(4) ......... § 242.1001(a)(4) Rule 1002 .................. § 242.1002 Rule 1002(b) ............. § 242.1002(b) Rule 1002(b)(4)(ii)(B) § 242.1002(b)(4)(ii)(B) Commission reference CFR citation (17 CFR) Rule 1002(b)(5) ......... § 242.1002(b)(5) Rule 1002(b)(5)(i) ...... § 242.1002(b)(5)(i) Rule 1002(b)(5)(ii) ..... § 242.1002(b)(5)(ii) Rule 1002(c) ............. § 242.1002(c) Rule 1002(c)(3) ......... § 242.1002(c)(3) Rule 1002(c)(4) ......... § 242.1002(c)(4) Rule 1002(c)(4)(i) ...... § 242.1002(c)(4)(i) Rule 1002(c)(4)(ii) ..... § 242.1002(c)(4)(ii) Rule 1003 .................. § 242.1003 Rule 1003(b) ............. § 242.1003(b) Rule 1003(b)(1) ......... § 242.1003(b)(1) Rule 1003(b)(2) ......... § 242.1003(b)(2) Rule 1003(b)(3) ......... § 242.1003(b)(3) Rule 1004 .................. § 242.1004 Rule 1004(a) ............. § 242.1004(a) Rule 1004(b) ............. § 242.1004(b) Rule 1005 .................. § 242.1005 Rule 1005(c) ............. § 242.1005(c)
I. Introduction
II. Background and Overview
A. History of Regulation SCI B. Current Regulation SCI
1. SCI Entities and SCI Systems
2. Reasonably Designed Policies and
Procedures
3. SCI Events
4. Systems Changes and SCI Review
5. Business Continuity and Disaster
Recovery Testing with Members/ Participants
6. Recordkeeping and Other Provisions
(Rules 1005–1007)
C. Overview of Proposed Amendments to
Regulation SCI
III. Proposed Amendments to Regulation SCI
A. Definition of SCI Entity
1. Evolution: Current and Proposed SCI
Entities
2. New Proposed SCI Entities
3. General Request for Comment on
Proposed Expansion of SCI Entities B. Request for Comment Regarding Significant-Volume Fixed Income ATSs and Broker-Dealers Using Electronic or Automated Systems for Trading of Corporate Debt Securities or Municipal Securities
1. Discussion
2. Request for Comment
C. Strengthening Obligations of SCI
Entities
1. Systems Classification and Lifecycle
Management
2. Third-Party Provider Management
3. Security
4. SCI Review
5. Current SCI Industry Standards
6. Other Changes
D. SCI Entities Subject to the Exchange Act Cybersecurity Proposal and/or Regulation S–P
1. Discussion
2. Request for Comment
IV. Paperwork Reduction Act
A. Summary of Collections of Information B. Proposed Use of Information
1. Rule 1001 of Regulation SCI
2. Rule 1002 of Regulation SCI
3. Rule 1003 of Regulation SCI
4. Rule 1004 of Regulation SCI
5. Rule 1005 and 1007 of Regulation SCI
6. Rule 1006 of Regulation SCI

1See Securities Exchange Act Release No. 73639 (Nov. 19, 2014), 79 FR 72252 (Dec. 5, 2014) (‘‘SCI Adopting Release’’). 2See, e.g., Shane Remolina, Is Remote Trading Leading to a Paradigm Shift on the Trading Desk?, Traders Magazine (May 20, 2020), available at www.tradersmagazine.com/departments/buyside/ is-remote-trading-leading-to-a-paradigm-shift-onthe-trading-desk (observing ‘‘no outages’’ at the stock exchanges in Mar. 2020 in contrast to ‘‘glitches’’ experienced in 2000s); Financial Industry Regulatory Authority, Inc. (‘‘FINRA’’), Market Structure & COVID–19: Handling Increased Volatility and Volumes (Apr. 28, 2020), available at https://www.finra.org/media-center/finraunscripted/market-structure-covid19-coronavirus (observing that market infrastructure and integrity held during the challenges in Mar. 2020, and crediting Regulation SCI, among other regulatory protections). 3See, e.g., Securities Industry and Financial Markets Association (‘‘SIFMA’’), SIFMA Insights:
Electronic Trading Market Structure Primer (Oct. 2019), available at https://www.sifma.org/wpcontent/uploads/2019/10/SIFMA-InsightsElectronic-Trading-Market-Structure-Primer.pdf (summarizing electronic trading history and trends in different markets). See also SEC Staff Report on Algorithmic Trading in U.S. Capital Markets at 16– 19, 37 (Aug. 5, 2020), available at https:// www.sec.gov/files/marketstructure/research/algo_ trading_report_2020.pdf (discussing broker-dealer ATSs and internalizers, and other in-house sources of liquidity, such as single-dealer platforms (‘‘SDPs’’), and central risk books operated by broker-dealers) (‘‘Algorithmic Trading Report’’). Staff reports, Investor Bulletins, and other staff documents (including those cited herein) represent the views of Commission staff and are not a rule, regulation, or statement of the Commission. The Commission has neither approved nor disapproved the content of these staff documents and, like all staff statements, they have no legal force or effect, do not alter or amend applicable law, and create no new or additional obligations for any person. 4See infra section III.A.2.a (discussing registered SBSDRs). 5See FS–ISAC, Navigating Cyber 2021 (Apr. 2021), available at https://www.fsisac.com/ navigatingcyber2021-report. See also Vikki Davis, Combating the cybersecurity risks of working home, Cyber Magazine (Dec. 2, 2021), available at https:// cybermagazine.com/cyber-security/combatingcybersecurity-risks-working-home. 6See, e.g., Angus Loten, Cloud Demand Drives Data Center Market to New Records, Wall St. J. (Feb. 27, 2020); Angus Loten, CIOs Accelerate PrePandemic Cloud Push, Wall St. J. (Apr. 26, 2021). 7See SCI Adopting Release, supra note 1, at 72291, 72351. 8See id. at 72257. 9See generally SCI Adopting Release, supra note 1, at 72299, 72372, 72402, 72404–05.
C. Respondents
D. Total Initial and Annual Reporting Burdens
1. Rule 1001
2. Rule 1002
3. Rule 1003
4. Rule 1004
5. Rule 1005
6. Rule 1006
7. Summary of the Information Collection
Burden
E. Collection of Information Is Mandatory F. Confidentiality of Responses to Collection of Information G. Request for Comment
V. Economic Analysis
A. Introduction
B. Baseline
1. New SCI Entities
2. Existing SCI Entities:
3. Current Market Practice
4. Other Affected Parties
C. Analysis of Benefits and Costs of
Proposed Amendments
1. General Benefits and Costs of Proposed
Amendments
2. Expansion to New SCI Entities
3. Specific Benefits and Costs of Regulation
SCI Requirements for All SCI Entities D. Efficiency, Competition, and Capital Formation Analysis E. Reasonable Alternatives
1. Limiting the Scope of the Regulation SCI
Provisions for New SCI Entities
2. Mandating Compliance with Current SCI
Industry Standards
3. Requiring Diversity of Back-Up Plan
Resources
4. Penetration Testing Frequency
5. Attestation for Critical SCI System
Vendors
6. Transaction Activity Threshold for SCI
Broker-Dealers
7. Limitation on Definition of ‘‘SCI
Systems’’ for SCI Broker-Dealers
VI. Regulatory Flexibility Act Certification
A. ‘‘Small Entity’’ Definitions B. Current SCI Entities
1. SCI SROs
2. The MSRB
3. SCI ATSs
C. Proposed SCI Entities
1. SBSDRs
2. SCI Broker-dealers
3. Exempt Clearing Agencies
D. Certification
Statutory Authority
I. Introduction
The U.S. securities markets are among the largest and most liquid in the world, attracting a wide variety of issuers and broad investor participation, and are essential for capital formation, job creation, and economic growth, both domestically and across the globe. The fair and orderly functioning of the U.S. securities markets is critically important to the U.S. economy. In 2014, recognizing the decades-long transformation of many U.S. securities markets from primarily manual markets to those that had become almost entirely electronic and highly dependent on sophisticated technology, including complex and interconnected trading, clearing, routing, market data, regulatory, surveillance and other technological systems, the Commission adopted 17 CFR 242.1000 through
242.1007 (‘‘Regulation SCI’’) to
supersede and replace the Commission’s voluntary Automation Review Policy Program (‘‘ARP’’) and certain provisions of 17 CFR 242.300 through 242.304 (‘‘Regulation ATS’’).1 Regulation SCI, which applies to ‘‘SCI entities’’ with respect to their ‘‘SCI systems’’ and ‘‘indirect SCI systems,’’ was the Commission’s first formal extensive regulatory framework for oversight of the core technology of the U.S. securities markets. The U.S. securities markets have demonstrated resilience since the adoption of Regulation SCI, with some market observers crediting Regulation SCI in helping to ensure that markets and market participants were prepared for the unprecedented trading volumes and volatility experienced in March 2020 at the onset of the COVID–19 pandemic.2 The U.S. securities markets continue to experience changes and new challenges, however. The growth of electronic trading allows ever-increasing volumes of securities transactions in a broader range of asset classes to take place at increasing speed by competing trading platforms, including those offered by broker-dealers that play multiple roles in the markets.3 In addition, new types of registered entities that are highly dependent on interconnected technology have entered the markets.4 The prevalence of remote workforces, furthered by the COVID–19 pandemic,5 and increased outsourcing to third-party providers, including cloud service providers, continue to drive the markets’ and market participants’ reliance on new and evolving technology.6 While these advances demonstrate the dynamic and adaptable nature of the U.S. securities markets and market participants, the greater dispersal, sophistication, and interconnection of the technology underpinning our markets bring potential new risks. These risks include not only the heightened risk of exposure to cybersecurity events from threat actors intent on doing harm, but also operational systems problems that can and do arise inadvertently. As the Commission has acknowledged, Regulation SCI is not, nor can it be, designed to guarantee that SCI entities have flawless systems.7 Rather, its goals are to strengthen the technology infrastructure of the U.S. securities markets and improve its resilience when technology falls short.8 To help achieve these goals, the regulation requires that SCI entities have policies and procedures reasonably designed to ensure that their systems have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain their operational capability and promote the maintenance of fair and orderly markets, and requires measures that facilitate the Commission’s oversight of securities market technology infrastructure.9 Consistent with the goals of addressing technological vulnerabilities and improving oversight of the core

10These include a proposal to adopt new rules requiring broker-dealers, major security-based swap participants, national securities exchanges, national securities associations, security-based swap data repositories, security-based swap dealers, transfer agents, and the Municipal Securities Rulemaking Board (‘‘MSRB’’) to adopt and implement written cybersecurity policies and procedures reasonably designed to address cybersecurity risks to their ‘‘information systems’’ and notify the Commission and the public of significant cybersecurity incidents affecting their information systems. See Securities Exchange Release No. 97142 (Mar. 15, 2023), 88 FR 20212 (April 5, 2023) (proposing 17 CFR 242.10) (for ease of reference, this proposal is referred to as the ‘‘Exchange Act Cybersecurity Proposal’’). See also Securities Exchange Release No. 97141 (Mar. 15, 2023), 88 FR 20616 (April 6, 2023) (proposing to amend 17 CFR part 248, subpart A (‘‘Regulation S–P’’), to, among other things, require brokerdealers, investment companies, SEC-registered investment advisers, and transfer agents to adopt incident response programs to address unauthorized access to or use of customer records and information, including procedures for providing timely notification to individuals affected by an information security incident designed to help affected individuals respond appropriately) (‘‘Regulation S–P 2023 Proposing Release’’). See infra section III.D (discussing of how SCI entities would be affected if the Exchange Act Cybersecurity Proposal, Regulation S–P 2023 Proposing Release, and this proposal are all adopted as proposed). In addition, the Commission has pending proposals to address cybersecurity risk with respect to investment advisers, investment companies, and public companies. See Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies, Release Nos. 33–11028, 34–94917, IA– 5956, IC–34497 (Feb. 9, 2022), 87 FR 13524 (Mar. 9, 2022) (‘‘IA/IC Cybersecurity Proposing Release’’); Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release Nos. 33–11038, 34–94382, IC–34529 (Mar. 9, 2022), 87 FR 16590 (Mar. 23, 2022). The Commission has reopened the comment period for the IA/IC Cybersecurity Proposing Release to allow interested persons additional time to analyze the issues and prepare their comments in light of other regulatory developments, including the proposed rules and amendments regarding this proposal, the Exchange Act Cybersecurity Proposal and the Regulation S– P 2023 Proposing Release. The Commission encourages commenters to review those proposals to determine whether they might affect their comments on this proposing release. 11See generally SCI Adopting Release, supra note 1. 12See SCI Adopting Release, supra note 1, at 72252–56 (discussing the background of Regulation SCI). 13See Securities Exchange Act Release Nos. 27445 (Nov. 16, 1989), 54 FR 48703 (Nov. 24,
1989), and 29185 (May 9, 1991), 56 FR 22490 (May 15, 1991). 14See Securities Exchange Act Release No. 69077 (Mar. 8, 2013), 78 FR 18083, 18089 (Mar. 25, 2013) (‘‘SCI Proposing Release’’) (citing, among other things, Findings Regarding the Market Events of May 6, 2010, Report of the Staffs of the Commodity Futures Trading Commission (‘‘CFTC’’) and SEC to the Joint Advisory Committee on Emerging Regulatory Issues (Sept. 30, 2010) (‘‘Staff Report’’) and discussing hackers penetrating certain Nasdaq OMX Group, Inc. computer networks in 2011, a ‘‘software bug’’ that hampered the initial public offerings of BATS Global Markets, Inc. in 2012, and issues with Nasdaq’s trading systems delaying the start of trading in the high-profile initial public offering of Facebook, Inc.). 15See Securities Exchange Act Release No. 67802 (Sept. 7, 2012), 77 FR 56697 (Sept. 13, 2012) (File No. 4–652); Technology Roundtable Transcript, available at https://www.sec.gov/news/ otherwebcasts/2012/ttr100212-transcript.pdf. A webcast of the Roundtable is available at www.sec.gov/news/otherwebcasts/2012/ ttr100212.shtml. The Technology Roundtable examined the relationship between the operational stability and integrity of the securities market and the ways in which market participants design, implement, and manage complex and interconnected trading technologies. The Technology Roundtable also highlighted that quality standards, testing, and improved response mechanisms were issues ripe for consideration. See SCI Proposing Release, supra note 14, at 18090–91 (providing for further discussion of the Technology Roundtable). 16See SCI Proposing Release, supra note 14, at
18091. See also SCI Adopting Release, supra note
1, at 72254–72255 (summarizing additional disruptions during the period between publication of the SCI Proposing and Adopting Releases). 17See supra note 13. technology of key U.S. securities market entities, the Commission is proposing amendments to Regulation SCI that would expand its application to additional key market participants and update certain of its provisions to take account of the evolution of technology and trading since the rule’s adoption in
2014. The application of Regulation SCI
to a broader range of entities together with updates to certain provisions— including to account for heightened cybersecurity risks, wider use of cloud service providers, and the increasingly complex and interconnected nature of SCI entities’ systems—should help ensure that the technology infrastructure of the U.S. securities markets remains robust, resilient, and secure. The Commission has issued other proposals related to cybersecurity that would apply to SCI entities as well as other entities under the Commission’s jurisdiction.10 Regulation SCI, currently, and as proposed to be amended, however, differs from these proposals in terms of its purpose and scope. Regulation SCI applies to entities designated as key market participants because they play a significant role in the U.S. securities markets and/or have the potential to impact investors, the overall market, or the trading of individual securities in the event of a systems issue. Regulation SCI requires key market participants to (i) have policies and procedures in place to help ensure the robustness and resiliency of their market technology systems, and (ii) provide certain notices and reports to the Commission, and in some cases, market participants, to facilitate Commission oversight of securities market infrastructure. While Regulation SCI has cybersecurity aspects and certain of the proposed amendments to Regulation SCI would update policies and procedures requirements designed to keep SCI systems and indirect SCI systems secure, the proposed amendments are designed, more broadly, to ensure that SCI entities (current and proposed) have systems technology adequate to maintain operational capability of the systems on which the maintenance of fair and orderly markets depend.
II. Background and Overview
A. History of Regulation SCI The Commission adopted Regulation SCI in 2014 to supersede and replace the Commission’s legacy voluntary ARP Program as well as certain provisions of Regulation ATS.11 In doing so, the Commission sought to strengthen the technology infrastructure of the U.S. securities markets, reduce the occurrence of systems issues in those markets, improve their resiliency when technological issues arise, and establish an updated and formalized regulatory framework, thereby helping to ensure more effective Commission oversight of such systems.12 Several factors contributed to the Commission’s decision to adopt this regulation. Recognizing the growing importance of technology in the securities markets, the Commission issued the ARP I and ARP II Policy Statements in 1989 and 1991, respectively.13 In the decades that followed, key market participants in the securities industry increasingly relied on ever more complex technologies for trading and clearance and settlement of securities. The increased reliance on technology introduced challenges for the securities markets, as evidenced by a variety of market disruptions occurring in a relatively short time period.14 The Commission convened a roundtable entitled ‘‘Technology and Trading: Promoting Stability in Today’s Markets’’ (‘‘Technology Roundtable’’) in
2012.15 Shortly thereafter, following
Superstorm Sandy on the U.S. East Coast, the U.S. national securities exchanges closed for two business days in light of concerns over the physical safety of personnel and the possibility of technical issues.16 These and other developments in U.S. securities markets led the Commission to consider the effectiveness of the 1980s and 90s-era ARP Program. The focus of the ARP Program was to ensure that the selfregulatory organizations (‘‘SROs’’) had adequate capacity, security, and business continuity plans by, among other things, reporting to the Commission staff their planned systems changes 30 days in advance and reporting outages in trading and related systems.17 While the ARP Policy Statements were rooted in Exchange Act

18SCI Proposing Release, supra note 14, at 18089. 19See SCI Proposing Release, supra note 14, at 18085–91 for a further discussion of these considerations. 20As further explained in the SCI Adopting Release, the term ‘‘plan processor’’ means ‘‘any selfregulatory organization or securities information processor acting as an exclusive processor in connection with the development, implementation and/or operation of any facility contemplated by an effective national market system plan.’’ See SCI Adopting Release, supra note 1, at 72270 n. 196. This term refers to the securities information processors that are exclusive processors (and frequently referred to as the ‘‘SIPs’’) that collect and process (for distribution) quotation data and/or transaction reports on behalf of the Consolidated Tape Association System (‘‘CTA Plan’’), Consolidated Quotation System (‘‘CQS Plan’’), Joint Self-Regulatory Organization Plan Governing the Collection, Consolidation, and Dissemination of Quotation and Transaction Information for NasdaqListed Securities Traded on Exchanges on an Unlisted Trading Privileges Basis (‘‘Nasdaq UTP Plan’’), and Options Price Reporting Authority (‘‘OPRA Plan’’). The CTA Plan and Nasdaq UTP Plan (applicable to national market system (‘‘NMS’’) stocks) are each a ‘‘transaction reporting plan’’ as well as a ‘‘national market system plan’’ as defined in 17 CFR 242.600 (‘‘Rule 600’’ of Regulation NMS). The OPRA Plan (applicable to exchange-listed options) is a national market system plan. See infra note 212. See also text accompanying note 212 (discussing these Plans and how transaction reports containing the price and volume associated with a transaction involving the purchase or sale of a security are currently, and anticipated in the future to be, readily available to enable SCI ATSs and SCI broker-dealers to ascertain the total average daily dollar volume traded in NMS stock and exchangelisted options in a calendar month and self-assess if they exceed the proposed transaction activity thresholds discussed below). 21See generally SCI Adopting Release, supra note 1. 22 Id. at 72259. 23 Id. See also supra note 10 and accompanying text (referencing other cybersecurity rules proposed to apply to Commission registrants). 24See Securities Exchange Act Release No. 90610 (Dec. 9, 2020), 86 FR 18596, 18659–18676 (Apr. 9,
2021) (‘‘Market Data Infrastructure Adopting
Release’’) (adopting rules with respect to competing consolidators and defining ‘‘competing consolidator’’ to mean a securities information processor required to be registered pursuant to 17 CFR 242.614 (‘‘Rule 614’’) or a national securities exchange or national securities association that receives information with respect to quotations for and transactions in NMS stocks and generates a consolidated market data product for dissemination to any person). 25An ‘‘SCI competing consolidator’’ is any competing consolidator, which during at least four of the preceding six calendar months, accounted for five percent or more of consolidated market data gross revenue paid to the effective national market system plan or plans required under 17 CFR 242.603(b) (‘‘Rule 603(b)’’) for NMS stocks (1) listed on the New York Stock Exchange, (2) listed on The Nasdaq Stock Market, or (3) listed on national securities exchanges other than the New York Stock Exchange or The Nasdaq Stock Market, as reported by such plan or plans pursuant to the terms thereof. See Rule 1000. An SCI competing consolidator is subject to Regulation SCI, and a competing consolidator for which Regulation SCI does not apply is subject the systems capability requirement in 17 CFR 242.614(d)(9) (‘‘Rule 614(d)(9)’’ of Regulation NMS). See infra note 28 and accompanying text. 26See 17 CFR 242.1000 (defining the term ‘‘SCI entity’’ and terms included therein). 27See SCI Adopting Release, supra note 1, at
72259. Although some commenters had urged that
Regulation SCI apply to fewer entities and only the most systemically important entities, the Commission disagreed, stating, ‘‘[L]imiting the applicability of Regulation SCI to only the most systemically important entities posing the highest risk to the markets is too limited of a category of market participants, as it would exclude certain entities that, in the Commission’s view, have the potential to pose significant risks to the securities markets should an SCI event occur.’’ Id. 28See supra notes 24–25 (stating the definitions of competing consolidator and SCI competing consolidator). SCI competing consolidators are subject to Regulation SCI after a one-year transition period. See Market Data Infrastructure Adopting Release, supra note 24, at 18604. Competing consolidators in the transition period and competing consolidators below the gross revenue threshold are subject to a tailored set of operational capability and resiliency obligations designed to help ensure that the provision of consolidated market data products is prompt, accurate, and reliable. See Market Data Infrastructure Adopting Release, supra note 24, at 18690–97 (providing for a full discussion of systems capability requirements for competing consolidators (that are not subject to Regulation SCI), but instead subject to Rule 614(d)(9)). 29See 17 CFR 242.1000 (defining the term SCI entity to mean ‘‘an SCI self-regulatory organization, SCI alternative trading system, plan processor, exempt clearing agency subject to ARP, or SCI competing consolidator’’ and also separately defining each of these terms). See also SCI Adopting Release, supra note 1, at 72258–72 (discussing the rationale for inclusion of SCI SROs, SCI ATSs, plan processors, and certain exempt clearing agencies in the original adopted definition of SCI entity); infra notes 83–84 and accompanying text (citing the releases explaining the expansion the definition of SCI entity to include SCI competing consolidators, and the recent proposal to further expand the definition of SCI entity to include certain ATSs that trade U.S. Treasury Securities or Agency Securities exceeding specified volume thresholds (‘‘Government Securities ATSs’’)). requirements, as policy statements rather than Commission rules, compliance was voluntary and in many instances the SROs did not fully disclose problems that occurred. In the SCI Proposing Release, the Commission stated that ‘‘the continuing evolution of the securities markets to the current state, where they have become almost entirely electronic and highly dependent on sophisticated trading and other technology (including complex regulatory and surveillance systems, as well as systems relating to the provision of market data, intermarket routing and connectivity, and a variety of other member and issuer services), has posed challenges for the ARP Inspection Program.’’ 18 Informed by its review of recent technology problems in the markets, the discussions at the Technology Roundtable,
and its evaluation of the ARP Program,19 the Commission proposed Regulation SCI in 2013 to help address the technological vulnerabilities, and improve Commission oversight, of the core technology of key U.S. securities markets entities, including national securities exchanges and associations, significant-volume ATSs, clearing agencies, and plan processors.20 After considering the views of a wide variety of commenters, the Commission adopted Regulation SCI in 2014.21 In the SCI Adopting Release, the Commission stated that it was taking a ‘‘measured approach’’ and pursuing an ‘‘incremental expansion from the entities covered under the ARP Inspection Program’’ given the potential costs of compliance with Regulation SCI.22 It added, however, that this approach would allow it ‘‘to monitor and evaluate the implementation of Regulation SCI, the risks posed by the systems of other market participants, and the continued evolution of the securities markets, such that it may consider, in the future, extending the types of requirements in Regulation SCI to additional categories of market participants, such as non-ATS brokerdealers, security-based swap dealers, investment advisers, investment companies, transfer agents, and other key market participants.’’ 23 In 2021, the Commission amended Regulation SCI to add certain ‘‘competing consolidators’’ to the definition of SCI entity.24 Specifically, a competing consolidator that exceeds a five percent consolidated market data gross revenue threshold over a specified time period is an SCI competing consolidator because it is a significant source of consolidated market data for NMS stocks on which market participants rely.25 B. Current Regulation SCI

SCI Entities and SCI Systems
Regulation SCI applies to ‘‘SCI entities.’’ 26 SCI entities are those that the Commission has determined are market participants that play a significant role in the U.S. securities markets and/or have the potential to impact investors, the overall market, or the trading of individual securities in the event of certain types of systems problems.27 Today SCI entities comprise the self-regulatory organizations (excluding securities futures exchanges) (‘‘SCI SROs’’), ATSs meeting certain volume thresholds with respect to NMS stocks and non-NMS stocks (‘‘SCI ATSs’’), exclusive disseminators of consolidated market data (‘‘plan processors’’), certain competing disseminators of consolidated market (‘‘SCI competing consolidators’’ 28), and certain exempt clearing agencies.29 An SCI entity has obligations with respect to its ‘‘SCI systems,’’ ‘‘critical SCI systems,’’ and ‘‘indirect SCI

30See 17 CFR 242.1000 (defining the terms ‘‘SCI systems,’’ ‘‘critical SCI systems,’’ and ‘‘indirect SCI systems’’). 31 Id. (defining SCI systems to mean ‘‘all computer, network, electronic, technical, automated, or similar systems of, or operated by or on behalf of, an SCI entity that, with respect to securities, directly support trading, clearance and settlement, routing, market data, market regulation, or market surveillance’’). 32 Id. (defining critical SCI systems to mean any SCI systems of, or operated by or on behalf of, an SCI entity that: (1) Directly support functionality relating to: (i) Clearance and settlement systems of clearing agencies; (ii) Openings, reopenings, and closings on the primary listing market; (iii) Trading halts; (iv) Initial public offerings; (v) The provision of consolidated market data; or (vi) Exclusively listed securities; or (2) Provide functionality to the securities markets for which the availability of alternatives is significantly limited or nonexistent and without which there would be a material impact on fair and orderly markets). 33As discussed in the SCI Adopting Release, ‘‘critical SCI systems’’ are subject to certain heightened resilience and information dissemination provisions of Regulation SCI on the rationale that, lacking or having limited substitutes, these systems pose the greatest risks to the continuous and orderly function of the markets if they malfunction. See SCI Adopting Release, supra note 1, at 72277–79 (providing additional discussion of critical SCI systems). 34 Id. at 72279. 35See SCI Adopting Release, supra note 1, at 72281 (‘‘[I]f an SCI entity designs and implements security controls so that none of its non-SCI systems would be reasonably likely to pose a security threat to SCI systems, then it will have no indirect SCI systems. If, however, an SCI entity does have indirect SCI systems, then certain provisions of Regulation SCI will apply to those indirect SCI systems.’’). 36The current definition of ‘‘SCI systems,’’ includes the clause, ‘‘with respect to securities,’’ without limitation. SCI systems ‘‘means all computer, network, electronic, technical, automated, or similar systems of, or operated by or on behalf of, an SCI entity that, with respect to securities, directly support trading, clearance and settlement, order routing, market data, market regulation, or market surveillance.’’ See 17 CFR
242.1000 (emphasis added). But see infra section
III.A.2.b.iv (discussing the proposed limitation to the definition of SCI systems for certain SCI brokerdealers). 37The term ‘‘digital asset’’ refers to an asset that is issued and/or transferred using distributed ledger or blockchain technology (‘‘distributed ledger technology’’), including, but not limited to, socalled ‘‘virtual currencies,’’ ‘‘coins,’’ and ‘‘tokens.’’ See Custody of Digital Asset Securities by Special Purpose Broker-Dealers, Securities Exchange Act Release No. 90788 (Dec. 23, 2020), 86 FR 11627, 11627 n.1 (Feb. 26, 2021) (‘‘Crypto Asset Securities Custody Release’’). A digital asset may or may not meet the definition of a ‘‘security’’ under the Federal securities laws. See, e.g., Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: The DAO, Securities Exchange Act Release No. 81207 (July 25,
2017) (‘‘DAO 21(a) Report’’), available at https://
www.sec.gov/litigation/investreport/34-81207.pdf. See also SEC v. W.J. Howey Co., 328 U.S. 293 (1946). To the extent digital assets rely on cryptographic protocols, these types of assets also are commonly referred to as ‘‘crypto assets,’’ and ‘‘digital asset securities’’ can be referred to as ‘‘crypto asset securities.’’ For purposes of this release, the Commission does not distinguish between the terms ‘‘digital asset securities’’ and ‘‘crypto asset securities.’’ 38Today, under the current definition of SCI systems, an SCI entity (current or future) that engages in market functions for any type of securities, including crypto asset securities, is required to assess whether the technological systems of, or operated by or on its behalf, with respect to securities, directly support at least one of six market functions: (i) trading; (ii) clearance and settlement; (iii) order routing; (iv) market data; (v) market regulation; or (vi) market surveillance. As discussed below, however, the Commission is proposing an amendment to the definition of SCI systems that would limit its scope solely for certain proposed SCI broker-dealers. See infra section III.A.2.b.iv. 39See 17 CFR 242.1001(a)(1). 40See 17 CFR 242.1001(a)(2). 41See 17 CFR 242.1001(a)(3). 42See 17 CFR 242.1001(a)(4). systems.’’ 30 ‘‘SCI systems’’ are, broadly, the technology systems of, or operated by or on behalf of, an SCI entity that, with respect to securities, directly support at least one of six market functions: (i) trading; (ii) clearance and settlement; (iii) order routing; (iv) market data; (v) market regulation; or (vi) market surveillance.31 In addition, Regulation SCI defines ‘‘critical SCI systems,’’ which are a subset of SCI systems,32 and designated as such because they represent potential single points of failure in the U.S. securities markets.33 The term ‘‘indirect SCI systems’’ describes systems of, or operated by or on behalf of, an SCI entity that, ‘‘if breached, would be reasonably likely to pose a security threat to SCI systems.’’ 34 The distinction between SCI systems and indirect SCI systems seeks to encourage SCI entities physically and/or logically to separate systems that perform or directly support securities market functions from those that perform other functions (e.g., corporate email; general office systems for member regulation and recordkeeping).35 Currently, the application of Regulation SCI is triggered when an entity meets the definition of SCI entity. If an entity meets the definition of SCI entity, Regulation SCI applies to its SCI systems and indirect SCI systems. The scope of an SCI entity’s technology systems is determined by whether they are operated ‘‘by or on behalf of’’ the SCI entity and whether they directly support any of the six market functions enumerated in the definition. As a result, the SCI systems and indirect SCI systems of an SCI entity are neither limited by the type of security nor by the type of business in which an SCI entity
primarily conducts its securities market activities. Thus, if an SCI entity elects to, or obtains the necessary approvals to, engage in market functions in multiple types of securities, Regulation SCI’s obligations apply to the relevant functional systems relating to all such securities.36 Accordingly, the SCI systems of an SCI entity may include systems pertaining to any type of security, whether those securities are NMS stocks, over-the-counter (OTC) equity securities, listed options, debt securities, security-based swaps (‘‘SBS’’), crypto asset securities,37 or another type of security.38
2. Reasonably Designed Policies and
Procedures
The foundational principles of Regulation SCI are set forth in Rule 1001, which requires each SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain their operational capability and promote the maintenance of fair and orderly markets.39 Rule 1001(a)(2) of Regulation SCI requires that, at a minimum, such policies and procedures include: current and future capacity planning; periodic stress testing; systems development and testing methodology; reviews and testing to identify vulnerabilities; business continuity and disaster recovery planning (inclusive of backup systems that are geographically diverse and designed to meet specified recovery time objectives); standards for market data collection, processing, and dissemination; and monitoring to identify potential systems problems.40 Under 17 CFR 242.1001(a)(3) (‘‘Rule 1001(a)(3)’’ of Regulation SCI), SCI entities must periodically review the effectiveness of these policies and procedures and take prompt action to remedy any deficiencies.41 Rule 1001(a)(4) of Regulation SCI provides that an SCI entity’s policies and procedures will be deemed to be reasonably designed if they are consistent with ‘‘current SCI industry standards,’’ which is defined to be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization; however, Rule 1001(a)(4) of Regulation SCI also makes clear that compliance with such ‘‘current SCI industry standards’’ is not the exclusive means to comply with these requirements.42 Under 17 CFR 242.1001(b)(1) (‘‘Rule 1001(b)(1)’’ of Regulation SCI), each SCI entity is required to establish, maintain,

43See 17 CFR 242.1001(b)(1).
44See 17 CFR 242.1001(b)(2).
45See 17 CFR 242.1001(b)(3).
46See 17 CFR 242.1001(b)(4).
47See 17 CFR 242.1001(c).
48 17 CFR 242.1000.
49 Id.
50See 17 CFR 242.1001(c)(2).
51See 17 CFR 242.1000.
52See 17 CFR 242.1002(a).
53See 17 CFR 242.1002(b)(5) (relating to the exception for de minimis SCI events). 54See 17 CFR 242.1002(b). 55See 17 CFR 242.1002(c). 56See id. The rule also requires that the SCI entity document its reasons for delayed notification. Id. 57See 17 CFR 242.1002(c)(4). 58See 17 CFR 242.1003(a). 59See 17 CFR 242.1003(b). and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Exchange Act and the rules and regulations thereunder and the entity’s rules and governing documents, as applicable, and specifies certain minimum requirements for such policies and procedures.43 In addition, 17 CFR 242.1001(b)(2) (‘‘Rule 1001(b)(2)’’) requires that at a minimum, these policies and procedures must include: testing of all SCI systems and any changes to SCI systems prior to implementation; a system of internal controls over changes to SCI systems; a plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by ‘‘responsible SCI personnel’’ (defined below) and by personnel familiar with applicable provisions of the Exchange Act and the rules and regulations thereunder and the SCI entity’s rules and governing documents; and a plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.44 Under 17 CFR 242.1001(b)(3) (‘‘Rule 1001(b)(3)’’ of Regulation SCI), SCI entities must periodically review the effectiveness of these policies and procedures and take prompt action to remedy any deficiencies.45 Under 17 CFR 242.1001(b)(4) (‘‘Rule 1001(b)(4)’’ of Regulation SCI), individuals are provided with a safe harbor from liability under Rule 1001(b) if certain conditions are met.46 Further, 17 CFR 242.1001(c) (‘‘Rule 1001(c)’’ of Regulation SCI), requires SCI entities to establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.47 Rule 1000 of Regulation SCI defines ‘‘responsible SCI personnel’’ to mean, for a particular SCI system or indirect SCI system impacted by an SCI event, such senior manager(s) of the SCI entity having responsibility for such system, and their designee(s).48 Rule 1000 also defines ‘‘SCI event’’ to mean an event at an SCI entity that constitutes a systems disruption, a systems compliance issue, or a systems intrusion.49 Under 17 CFR 242.1001(c)(2) (‘‘Rule 1001(c)(2)’’ of Regulation SCI), SCI entities are required periodically to review the effectiveness of these policies and procedures and take prompt action to remedy any deficiencies.50
3. SCI Events
Under Rule 1002 of Regulation SCI, SCI entities have certain obligations regarding SCI events. An ‘‘SCI event’’ is defined as: (i) a ‘‘systems disruption,’’ which is an event in an SCI entity’s SCI systems that disrupts, or significantly degrades, the normal operation of an SCI system; and/or (ii) a ‘‘systems intrusion,’’ which is any unauthorized entry into the SCI systems or indirect SCI systems of an SCI entity; and/or (iii) a ‘‘systems compliance issue,’’ which is an event at an SCI entity that has caused any SCI system of such entity to operate in a manner that does not comply with the Exchange Act and the rules and regulations thereunder or the entity’s rules or governing documents, as applicable.51 When any responsible SCI personnel has a reasonable basis to conclude that an SCI event has occurred, the SCI entity must begin to take appropriate corrective action which must include, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable.52 With limited exceptions,53 Rule 1002(b) provides the framework for notifying the Commission of SCI events including, among other things, requirements to: notify the Commission of the event immediately; provide a written notification on Form SCI within 24 hours that includes a description of the SCI event and the system(s) affected, with other information required to the extent available at the time; provide regular updates regarding the SCI event until the event is resolved; and submit a final detailed written report regarding the SCI event.54 Rule 1002(c) of Regulation SCI also requires that SCI entities disseminate information to their members or participants regarding SCI events.55 These information dissemination requirements are scaled based on the nature and severity of an event. SCI entities are required to disseminate certain information about the event to certain of its members or participants (i.e., those that are reasonably estimated to have been affected) promptly after any responsible SCI personnel has a reasonable basis to conclude that an SCI event has occurred. For ‘‘major SCI events,’’ such dissemination must be made to all of its members or participants. In addition, dissemination of information to members or participants is permitted to be delayed for systems intrusions if such dissemination would likely compromise the security of the SCI entity’s systems or an investigation of the intrusion.56 In addition, 17 CFR 242.1002(c)(4) (‘‘Rule 1002(c)(4)’’ of Regulation SCI) provides exceptions to the dissemination requirements under Rule 1002(c) of Regulation SCI for SCI events to the extent they relate to market regulation or market surveillance systems or SCI events that have had, or the SCI entity reasonably estimates would have, either a de minimis or no impact on the SCI entity’s operations or on market participants.57
4. Systems Changes and SCI Review
Under 17 CFR 242.1003(a) (‘‘Rule 1003(a)’’ of Regulation SCI), SCI entities are required to provide reports to the Commission relating to system changes, including a report each quarter describing completed, ongoing, and planned material changes to their SCI systems and the security of indirect SCI systems, during the prior, current, and subsequent calendar quarters, including the dates or expected dates of commencement and completion.58 Rule 1003(b) of Regulation SCI also requires that an SCI entity conduct an ‘‘SCI review’’ not less than once each calendar year.59 ‘‘SCI review’’ is defined in Rule 1000 of Regulation SCI to mean a review, following established procedures and standards, that is performed by objective personnel having appropriate experience to conduct reviews of SCI systems and indirect SCI systems, and which review contains: a risk assessment with respect to such systems of an SCI entity; and an assessment of internal control design and effectiveness of its SCI systems and indirect SCI systems to include logical and physical security controls,

60See 17 CFR 242.1000. Rule 1003(b)(1) of Regulation SCI also states that penetration test reviews of an SCI entity’s network, firewalls, and production systems must be conducted at a frequency of not less than once every three years, and assessments of SCI systems directly supporting market regulation or market surveillance must be conducted at a frequency based upon the risk assessment conducted as part of the SCI review, but in no case less than once every three years. See 17 CFR 242.1003(b)(1)(i) and (ii) (‘‘Rule 1003(b)(1)(i) and (ii)’’). 61See 17 CFR 242.1003(b)(2) and (3). 62See 17 CFR 242.1004. 63See 17 CFR 242.1005. Unlike 17 CFR 242.1005(a) (‘‘Rule 1005(a)’’) of Regulation SCI, which relates to recordkeeping provisions for SCI SROs, 17 CFR 242.1005(b) (‘‘Rule 1005(b)’’) relates to the recordkeeping provision for SCI entities other than SCI SROs. 64See 17 CFR 242.1006. 65See 17 CFR 242.1007. 66See infra section III.A.2.a. through c. (providing a detailed discussion of each of these categories of entities and associated proposed definitions). 67See infra section III.C.1. 68See infra section III.C.2. 69See infra section III.C.3.a. 70See infra section III.C.5.c. 71See infra section III.C.3.c. 72See infra section III.C.3.c. 73See infra sections III.C.3.b and III.C.4. 74See infra section III.C.2.d. 75See infra section III.C.5. 76See infra section III.C.6. 77See supra notes 27–29 and accompanying text; infra note 83 and accompanying text. 78See SCI Proposing Release, supra note 14, at 18097. development processes, and information technology governance, consistent with industry standards.60 Under Rule 1003(b)(2) and (3), SCI entities are also required to submit a report of the SCI review to their senior management, and must also submit the report and any response by senior management to the report, to their board of directors, as well as to the Commission.61
5. Business Continuity and Disaster
Recovery Testing With Members/ Participants Rule 1004 of Regulation SCI sets forth certain requirements for testing an SCI entity’s business continuity and disaster recovery plans with its members or participants. This rule requires that, with respect to an SCI entity’s business continuity and disaster recovery plan, including its backup systems, each SCI entity shall: (a) establish standards for the designation of those members or participants that the SCI entity reasonably determines are, taken as a whole, the minimum necessary for the maintenance of fair and orderly markets in the event of the activation of such plans; (b) designate members or participants pursuant to the standards established and require participation by such designated members or participants in scheduled functional and performance testing of the operation of such plans, in the manner and frequency specified by the SCI entity, provided that such frequency shall not be less than once every 12 months; and (c) coordinate the testing of such plans on an industry- or sector-wide basis with other SCI entities.62
6. Recordkeeping and Other Provisions
(Rules 1005–1007)
SCI entities are required by Rule 1005 of Regulation SCI to make, keep, and preserve certain records related to their compliance with Regulation SCI.63 In addition, 17 CFR 242.1006 (‘‘Rule 1006’’ of Regulation SCI), provides for certain requirements relating to the electronic filing, on Form SCI, of any notification, review, description, analysis, or report to the Commission required to be submitted under Regulation SCI.64 Finally, 17 CFR 242.1007 (‘‘Rule 1007’’ of Regulation SCI) requires a written undertaking when records required to be filed or kept by an SCI entity under Regulation SCI are prepared or maintained by a service bureau or other recordkeeping service on behalf of the SCI entity.65
C. Overview of Proposed Amendments
to Regulation SCI
The Commission is proposing amendments to Regulation SCI that would expand the definition of ‘‘SCI entity’’ to include a broader range of key market participants in the U.S. securities market infrastructure and update certain provisions of Regulation SCI to take account of developments in the technology landscape of the markets and the Commission and its staff’s oversight experience since the adoption of Regulation SCI in 2014. As discussed in section III.A, the Commission is proposing to expand the definition of SCI entity to include registered SBSDRs, registered broker-dealers exceeding a size threshold (‘‘SCI broker-dealers’’), and additional clearing agencies exempt from registration.66 As discussed in
section III.C, the Commission is also
proposing to update several requirements of Regulation SCI to acknowledge certain technology changes in the market, including cybersecurity and third-party provider management challenges since the adoption of Regulation SCI in 2014, and to account for the experience and insights the Commission and its staff have gained with respect to technology issues surrounding SCI entities and their systems. These include:

Amendments to Rule 1001(a) to
require that an SCI entity’s policies and procedures for SCI systems, critical SCI systems, and indirect SCI systems, address with specificity:
Æ Systems classification and life cycle management; 67 Æ Management of third-party providers, including cloud service providers and providers of critical SCI systems; 68 Æ Access controls; 69 and Æ Identification of current SCI industry standards, if any; 70
Expansion of the definition of
‘‘systems intrusion’’ in Rule 1000 to include a wider range of cybersecurity events; 71
Amendments to Rule 1002
regarding notice of systems intrusions to the Commission and affected persons; 72
Amendments to the definition of
‘‘SCI review’’ and Rule 1003(b) to specify in greater detail the contents of the SCI review and associated report, and to require annual penetration testing; 73
Amendments to Rule 1004 to
require that SCI entities designate key third-party providers for participation in annual business continuity/disaster recovery testing; 74
Amendments to Rule 1001(a)(4) to
address how an SCI entity may avail itself of the safe harbor provision; 75
Amendments to Rule 1005 to
address the maintenance of records by a former SCI entity; and
Changes to Form SCI consistent
with the proposed changes.76 The amendments to Regulation SCI are proposed independently of the proposals discussed in the Exchange Act Cybersecurity Proposal and Regulation S–P 2023 Proposing Release. However, the relationship of all three proposals, as each may apply to an SCI entity, is discussed in section III.D.
III. Proposed Amendments to
Regulation SCI
A. Definition of SCI Entity

Evolution: Current and Proposed SCI
Entities
Currently, SCI entities are the SCI SROs, SCI ATSs, plan processors, certain exempt clearing agencies, and, as of 2020, SCI competing consolidators.77 In 2013, the Commission proposed to include other entities: specifically, ATSs trading corporate debt or municipal securities (hereafter, ‘‘Fixed Income ATSs’’) exceeding specified volume thresholds.78 The Commission did not include any Fixed Income ATSs as SCI entities at adoption in 2014, however, based on consideration of comments regarding the risk profile of Fixed

79See SCI Adopting Release, supra note 1, at 72270, 72409 (discussing determination not to apply Regulation SCI to ATSs trading only corporate debt and municipal securities at that time). 80See SCI Proposing Release, supra note 14, at 18133–41. The Commission also solicited comment on the inclusion of security-based swap execution facilities (‘‘SB SEFs’’), which entities are now the subject of another proposal. See Rules Relating to Security-Based Swap Execution and Registration and Regulation of Security-Based Swap Execution Facilities, Release No. 94615 (Apr. 6, 2022), 87 FR 28872 (May 11, 2022) (proposing that SB SEFs be subject to 17 CFR 242.800 through 242.835 (‘‘Regulation SE’’) which includes operational capability requirements closely modeled on a detailed CFTC rule for SEFs (17 CFR 37.1401)). SB SEFs are not further discussed herein. 81See SCI Adopting Release, supra note 1, at 72364–66 (contemplating possible future proposals). 82See SCI Adopting Release, supra note 1, at 72259 (stating that this measured approach would enable the Commission to ‘‘monitor and evaluate the implementation of Regulation SCI, the risks posed by the systems of other market participants, and the continued evolution of the securities markets, such that it may consider, in the future, extending the types of requirements in Regulation SCI to additional categories of [key] market participants . . . .’’). 83See Market Data Infrastructure Adopting Release, supra note 24, at 18659–18676. 84See Securities Exchange Act Release Nos. 90019 (Sept. 28, 2020), 85 FR 87106 (Dec. 31, 2020) (‘‘Government Securities ATS Proposing Release’’); 94062 (Jan. 26, 2022), 87 FR 15496 (Mar. 18, 2022) (‘‘Government Securities ATS Reproposal’’) (among other things, citing operational similarities between Government Securities ATSs and NMS stock ATSs). In the Government Securities ATS Reproposal, the Commission proposed amendments to 17 CFR 240.3b–16(a) (‘‘Rule 3b–16(a)’’ of the Exchange Act), which defines certain terms used in the statutory definition of ‘‘exchange’’ under section 3(a)(1) of the Exchange Act, to include systems that offer the use of non-firm trading interest and provide communication protocols to bring together buyers and sellers of securities. Trading systems that may fall within the criteria of proposed 17 CFR 240.3b– 16 (‘‘Rule 3b–16’’), as proposed to be amended, would likely operate as ATSs, and possibly SCI ATSs. Because the proposed amendments to Rule 3b–16(a) could result in a greater number of ATSs, and the amendments proposed to expand and update SCI could impact newly designated ATSs, commenters are encouraged to review both the Government Securities ATS Reproposal and this proposal to determine whether it might affect their comments on this proposal, as well as their responses to the Commission’s request for comment on application of Regulation SCI to Fixed Income ATS contained herein. 85Currently, Rule 301(b)(6) of Regulation ATS applies to Fixed Income ATSs
exceeding a volume threshold. Under Rule 301(b)(6), an ATS that trades only municipal securities or corporate debt at a threshold of 20% or more of the average daily volume traded in the United States, during at least four of the preceding six calendar months, is required to comply with capacity, integrity, and security requirements with respect to those systems that support order entry, order routing, order execution, transaction reporting, and trade comparison. See 17 CFR 242.301(b)(6). As discussed further below, the amendments proposed in this release do not include amendments to modify the numerical volume thresholds or to otherwise modify Rule 301(b)(6) of Regulation ATS, or move systems requirements for Fixed Income ATSs from Regulation ATS to Regulation SCI. The Commission does, however, request comment on the state of electronic trading and automation in the corporate debt and municipal securities markets, as well as the risks associated with entities with significant activity in these markets. See infra
section III.B.
86See SCI Adopting Release, supra note 1, at
72259. See also supra note 82 and accompanying
text.
87Rule 1000 would define the term registered security-based swap data repository to mean ‘‘a security-based swap data repository, as defined in 15 U.S.C. 78c(a)(75), and that is registered with the Commission pursuant to 15 U.S.C. 78m(n) and § 240.13n–1,’’ with a proviso that compliance with Regulation SCI would not be required until six months after the entity’s registration is effective. See proposed Rule 1000. 88See supra text accompanying note 80. 89SCI Proposing Release, supra note 14, at 18135 (citation omitted). 90 Id. 91SCI Adopting Release, supra note 1, at 72364. Income ATSs at that time.79 In 2013, the Commission also solicited comment on the inclusion of several other types of entities, including SBSDRs and brokerdealers (beyond SCI ATSs).80 At adoption in 2014, comments regarding these and other entities were summarized, with specific proposals deferred for possible future consideration.81 In sum, the Commission stated in 2014 that it was neither limiting the applicability of Regulation SCI to only the most systemically important entities as urged by some commenters, nor taking a broad approach at the outset, but rather that it was taking a ‘‘measured’’ approach in establishing the initial scope of SCI entities.82 Since the initial adoption of Regulation SCI, the Commission has considered expansion of the definition of SCI entity several times: first to propose and adopt certain competing consolidators as SCI entities,83 and more recently to propose and repropose adding ATSs that trade U.S. Treasury Securities or Agency Securities exceeding specified volume thresholds (‘‘Government Securities ATSs’’) as SCI entities.84 The Commission now proposes a further expansion of the definition of SCI entity to include SBSDRs, certain registered broker-dealers (i.e., SCI broker-dealers), and additional clearing agencies exempted from registration. The Commission also solicits comment on whether, in light of technological changes in the fixed income markets in recent years, Fixed Income ATSs should again be proposed to be subject to Regulation SCI, rather than 17 CFR 240.301(b)(6) (‘‘Rule 301(b)(6)’’ of Regulation ATS), and also whether and how broker-dealers trading corporate debt and municipal securities should be considered.85
2. New Proposed SCI Entities
When it adopted Regulation SCI, the Commission acknowledged that there may be other categories of entities not included in the definition of SCI entity that, given their increasing size and importance, could pose risks to the market should an SCI event occur, but decided to include only certain key market participants at that time.86 The Commission proposes to expand the definition of SCI entity to include SBSDRs, certain types of broker-dealers, and additional clearing agencies exempted from registration as additional key market participants that would also have to comply with Regulation SCI because they play a significant role in the U.S. securities markets and/or have the potential to impact investors, the overall market, or the trading of individual securities in the event of a systems issue. If this amendment is adopted, these new SCI entities would become subject to all provisions of Regulation SCI, including the provisions proposed to be amended as discussed in
section III.C of this release.
a. Registered Security-Based Swap Data Repositories (SBSDRs) The Commission proposes to expand the application of Regulation SCI to SBSDRs. As registered securities information processors that disseminate market data and provide price transparency in the SBS market, and centralized trade repositories for SBS data for use by regulators, SBSDRs play a key role in the SBS market.87 As noted, the Commission solicited comment on the inclusion of SBSDRs as SCI entities when it first proposed Regulation SCI in 2013.88 At that time, the Commission anticipated that SBSDRs would ‘‘play an important role in limiting systemic risk and promoting the stability of the SBS market [and] also would serve as information disseminators in a manner similar to plan processors in the equities and options markets.’’ 89 But it also acknowledged that there may be differences between the equities and options markets and the SBS market, ‘‘including differing levels of automation and stages of regulatory development.’’ 90 Comments received on the inclusion of SBSDRs as SCI entities in the SCI Proposing Release were limited. One commenter stated that ‘‘the similarities between certain SCI entities and SB SDRs . . . do not provide a clear justification for a different set of rules.’’ 91 Another commenter stated that SBSDRs should have standards that are consistent with, but not identical to, those of SCI entities because the

92See id. 93See id. 94SCI Adopting Release, supra note 1, at 72364; SCI Proposing Release, supra note 14, at 18134. 95Public Law 111–203, section 761(a) (adding Exchange Act section 3(a)(75) (defining SBSDR)) and section 763(i) (adding Exchange Act section 13(n) (establishing a regulatory regime for SBSDRs)). 96See Security-Based Swap Data Repository Registration, Duties, and Core Principles, Securities Exchange Act Release No. 74246 (Feb. 11, 2015), 80 FR 14438, 14441 (Mar. 19, 2015) (‘‘SBSDR Adopting Release’’); Regulation SBSR—Reporting and Dissemination of Security-Based Swap Information, Securities Exchange Act Release No. 74244 (Feb. 11, 2015), 80 FR 14563 (Mar. 19, 2015) (‘‘SBSR Adopting Release’’). 97See 17 CFR 242.909 (‘‘A registered securitybased swap data repository shall also register with the Commission as a securities information processor on Form SDR.’’); see also Form SDR (‘‘With respect to an applicant for registration as a security-based swap data repository, Form SDR also constitutes an application for registration as a securities information processor.’’). 98See, e.g., SBSR Adopting Release, supra note 96, at 14604–05. 99FINRA members are subject to transaction reporting obligations under FINRA Rule 6730, while municipal securities dealers are subject to transaction reporting obligations under MSRB Rule G–14. See FINRA Rule 6730(a)(1) (requiring FINRA members to report transactions in TRACE-Eligible Securities, which FINRA Rule 6710 defines to include a range of fixed-income securities). See also MRSB Rule G–14 (requiring transaction reporting by municipal bond dealers). EMMA, established by the MSRB in 2009, serves as the official repository of municipal securities disclosure providing the public with free access to relevant municipal securities data, and is the central database for information about municipal securities offerings, issuers, and obligors. Additionally, the MSRB’s Real-Time Transaction Reporting System (‘‘RTRS’’), with limited exceptions, requires municipal bond dealers to submit transaction data to the MSRB within 15 minutes of trade execution, and such near real-time post-trade transaction data can be accessed through the MSRB’s EMMA website. 100See Committee on Payment and Settlement Systems and Technical Committee of the International Organization of Securities Commissions, Principles for financial market infrastructures, at 1.14, Box 1 (Apr. 16, 2012) (‘‘PFMI’’), available at https://www.bis.org/publ/ cpss101a.pdf (stating that ‘‘[a] TR [trade repository] may serve a number of stakeholders that depend on having effective access to TR services, both to submit and retrieve data. In addition to relevant authorities and the public, other stakeholders can include exchanges, electronic trading venues, confirmation or matching platforms, and third-party service providers that use TR data to offer complementary services.’’). 101See, e.g., SBSR Adopting Release, supra note 96, at 14604–05. 102See SBSDR Adopting
Release, supra note 96. 103See generally PFMI, supra note 100, at 1.14 (stating that ‘‘[b]y centralising the collection, storage, and dissemination of data, a well-designed TR that operates with effective risk controls can serve an important role in enhancing the transparency of transaction information to relevant authorities and the public, promoting financial stability, and supporting the detection and prevention of market abuse.’’). 104See Security-Based Swap Data Repository Registration, Duties, and Core Principles, Exchange Act Release No. 63347 (Nov. 19, 2010), 75 FR 77306, 77307 (Dec. 10, 2010), corrected at 75 FR 79320 (Dec. 20, 2010) and 76 FR 2287 (Jan. 13,
2011) (‘‘SBSDR Proposing Release’’).
105See SBSDR Adopting Release, supra note 96, at 14440 (stating that ‘‘SDRs are required to collect and maintain accurate SBS transaction data so that relevant authorities can access and analyze the data from secure, central locations, thereby putting them in a better position to monitor for potential market abuse and risks to financial stability.’’). 106See SBSDR Proposing Release, supra note 104, at 77307 (stating that ‘‘[t]he enhanced transparency provided by an SDR is important to help regulators and others monitor the build-up and concentration of risk exposures in the SBS market . . . . In addition, SDRs have the potential to reduce operational risk and enhance operational efficiency in the SBS market.’’). 107See SBSDR Adopting Release, supra note 96 at 14450 (‘‘SDRs themselves are subject to certain operational risks that may impede the ability of SDRs to meet these goals, and the Title VII regulatory framework is intended to address these risks.’’). 108See PFMI, supra note 100, at 3.20.20 (stating that ‘‘A TR should carefully assess the additional operational risks related to its links to ensure the scalability and reliability of IT [information functions that SBSDRs perform are significantly different from those performed by SCI entities.92 Other commenters, however, felt the practical differences between options and equities and derivatives called for some form of harmonization of rules, but not direct application of Regulation SCI to these entities.93 The Commission deferred and stated in the SCI Adopting Release that, ‘‘should [it] decide to propose to apply the requirements of Regulation SCI to SB SDRs [it] would issue a separate release discussing such a proposal.’’ 94 Taking into account the role of SBSDRs in the SBS market, their reliance on technology to perform their functions, and the current state of regulatory development in the SBS market, the Commission is doing so now.
i. Role of SBSDRs and Associated Risks
Title VII of the Dodd-Frank Act, enacted in 2010, provided for a comprehensive, new regulatory framework for swaps and security-based swaps, including regulatory reporting and public dissemination of transactions in security-based swaps.95 In 2015, the Commission established a regulatory framework for SBSDRs to provide improved transparency to regulators and help facilitate price discovery and efficiency in the SBS market.96 Under this framework, SBSDRs are registered securities information processors and disseminators of market data in the SBS market,97 thereby serving Title VII’s goal of having public dissemination of price information for all security-based swaps, to enhance price discovery for market participants.98 Like FINRA’s Trade Reporting and Compliance Engine (‘‘TRACE’’) and the MSRB’s Electronic Municipal Market Access (‘‘EMMA’’),99 SBSDRs serve an important function for market participants because they disseminate market data, thereby providing price transparency in the SBS market.100 Just as TRACE and EMMA provide price transparency to market participants and regulatory information to regulators, SBSDRs are designed to meet two purposes as mandated by Title VII of the Dodd-Frank Act: (1) to provide SBS data and information to regulators to surveil the markets and assess for market risks; and (2) to enhance price discovery to market participants.101 As discussed in detail below, given that SBSDRs rely on automated systems and are designed to limit systemic risk and promote the stability of the markets they serve, the Commission believes that including SBSDRs in the definition of SCI entities would better ensure that SBSDR systems are robust, resilient, and secure. Additionally, this approach is reasonable and consistent as other entities that play a key price transparency role in their respective markets, such as plan processors, SCI competing consolidators, FINRA and the MSRB, are SCI entities, and their systems that directly support market data, among other functions, are currently SCI systems.102 As centralized repositories for SBS data for use by regulators, SBSDRs provide important infrastructure that assists relevant authorities in performing their market oversight.103 Data maintained by SBSDRs may assist regulators in preventing market abuses, performing supervision, and resolving issues and positions if an institution fails.104 SBSDRs are required to collect and maintain accurate SBS transaction data so that relevant authorities can access and analyze the data from secure, central locations, thereby putting the regulators in a better position to monitor for potential market abuse and risks to financial stability.105 SBSDRs also have the potential to reduce operational risk and enhance operational efficiency, such as by maintaining transaction records that would help counterparties to ensure that their records reconcile on all of the key economic details.106 Furthermore, SBSDRs themselves are subject to certain operational
risks that may impede the ability of SBSDRs to meet the goals set out in Title VII of the Dodd-Frank Act and the Commission’s rules.107 For instance, the links established between an SBSDR and other entities, including unaffiliated clearing agencies and other SBSDRs, may expose the SBSDR to vulnerabilities outside of its direct control.108 Without appropriate

technology] and related resources. A TR can establish links with another TR or with another type of FMI. Such links may expose the linked FMIs to additional risks if not properly designed. Besides legal risks, a link to either another TR or to another type of FMI may involve the potential spillover of operational risk. The mitigation of operational risk is particularly important because the information maintained by a TR can support bilateral netting and be used to provide services directly to market participants, service providers (for example, portfolio compression service providers), and other linked FMIs.’’). 109See PFMI, supra note 100, at 1.14, Box 1 (stating that ‘‘[t]he primary public policy benefits of a TR, which stem from the centralisation and quality of the data that a TR maintains, are improved market transparency and the provision of this data to relevant authorities and the public in line with their respective information needs. Timely and reliable access to data stored in a TR has the potential to improve significantly the ability of relevant authorities and the public to identify and evaluate the potential risks posed to the broader financial system.’’). 110See List of Security-Based Swap Dealers and Major Security-Based Swap Participants, Commission (last updated Jan. 4, 2023), available at: https://www.sec.gov/files/list_of_sbsds_msbsps_ 1_4_2023locked_final.xlsx. 111The Commission approved the registration of two SBSDRs in 2021. See Security-Based Swap Data Repositories, DTCC Data Repository (U.S.), LLC, Order Approving Application for Registration as a Security-Based Swap Data Repository, Securities Exchange Act Release No. 91798 (May 7, 2021), 86 FR 26115 (May 12, 2021); Security-Based Swap Data Repositories, ICE Trade Vault, LLC, Order Approving Application for Registration as a Security-Based Swap Data Repository, Securities Exchange Act Release No. 92189 (Jun. 16, 2021), 86 FR 32703 (Jun. 22, 2021). 112See Rules Relating to Security-Based Swap Execution and Registration and Regulation of Security-Based Swap Execution Facilities, Securities Exchange Act Release No. 94615 (Apr. 6, 2022), 87 FR 28872 (May 11, 2022). 113See, e.g., Security-Based Swap Data Repositories, DTCC Data Repository (U.S.), LLC, Notice of Filing of Application for Registration as a Security-Based Swap Data Repository, Securities Exchange Act Release No. 91071 (Feb. 5, 2021), 86 FR 8977 (Feb. 10, 2021) (‘‘[T]he SDR process is an end-to-end straight through process; from the receipt of data, processing and maintenance of data, and dissemination of data, processes are automated and do not require manual intervention.’’). 114See SEC Approves Registration of First Security-Based Swap Data Repository; Sets the First Compliance Date for Regulation SBSR, Press Release, Commission (May 7, 2021), available at:
https://www.sec.gov/news/press-release/2021-80. 115See 17 CFR 240.13n–6. 116See SBSDR Adopting Release, supra note 96, at 14499, 14550 (‘‘[T]he Commission may consider the application of any features of Regulation SCI to SDRs in the future.’’); SCI Adopting Release, supra note 1, at 72364. 117See SBSDR Adopting Release, supra note 96, at 14499 (stating that ‘‘[t]he Commission is not adopting Rule 13n–6 as proposed because, after proposing Rule 13n–6, the Commission considered the need for an updated regulatory framework for certain systems of the U.S. securities trading markets and adopted Regulation Systems Compliance and Integrity (‘Regulation SCI’).’’). Specifically, the Commission stated that the rule as adopted better sets an appropriate core framework for the policies and procedures of SBSDRs with respect to automated systems and that the framework adopted is ‘‘broadly consistent’’ with Regulation SCI. See id. Therefore, the Commission declined to adopt more prescriptive elements of the rule as proposed, including proposed Rule 13n– 6(b), which would have required that every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities: (1) establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, resiliency, and security. These policies and procedures shall, at a minimum: (i) establish reasonable current and future capacity estimates; (ii) conduct periodic capacity stress tests of critical systems to determine such systems’ ability to process transactions in an accurate, timely, and efficient manner; (iii) develop and implement reasonable procedures to review and keep current its system development and testing methodology; (iv) review the vulnerability of its systems and data center computer operations to internal and external threats, physical hazards, and natural disasters; and (v) establish adequate contingency and disaster recovery plans; (2) on an annual basis, submit an objective review to the Commission within thirty calendar days of its completion. Where the objective review is performed by an internal department, an objective, external firm shall assess the internal department’s objectivity, competency, and work performance with respect to the review performed by the internal department. The external firm must issue a report of the objective review, which the security-based swap data repository must submit to the Commission on an annual basis, within 30 calendar days of completion of the review; (3) promptly notify the Commission of material systems outages and any remedial measures that have been implemented or are contemplated (prompt notification includes the following: (i) immediately notify the Commission when a material systems outage is detected; (ii) immediately notify the Commission when remedial measures are selected to address the material systems
outage; (iii) immediately notify the Commission when the material systems outage is addressed; and (iv) submit to the Commission within five business days of the occurrence of the material systems outage a detailed written description and analysis of the outage and any remedial measures that have been implemented or are contemplated); and (4) notify the Commission in writing at least thirty calendar days before implementation of any planned material systems changes. See SBSDR Proposing Release, supra note 104, at 77370. 118The two registered SBSDRs, DTCC Data Repository (U.S.), LLC and ICE Trade Vault, LLC, are affiliated with the registered clearing agencies, Depository Trust Company and ICE Clear Credit LCC, respectively. safeguards in place for the systems of SBSDRs, their vulnerabilities could lead to significant failures, disruptions, delays, and intrusions, which could disrupt price transparency and oversight of the SBS market. For instance, an SBSDR processes and disseminates trade data using electronic systems, and if these systems fail, public access to timely and reliable trade data for the derivatives markets could potentially be compromised.109 Also, if the data stored at an SBSDR is corrupted, the SBSDR would not be able to provide accurate data to relevant regulatory authorities, which could hinder the oversight of the derivatives markets. Moreover, because SBSDRs receive and maintain proprietary and sensitive information (e.g., trading data, non-public personal information), it is essential that their systems be capable of ensuring the security and integrity of this data. Along with the reliance of SBSDRs on automated systems to perform their functions, regulatory development of the SBS market has proceeded significantly since 2015. In particular, security-based swap dealers have registered with the Commission,110 SBSDRs have registered with the Commission,111 security-based swap execution facilities (‘‘SBSEF’’) registration has been proposed,112 and straight-through processing has increased in the market.113 On November 8, 2021, SBS data began being reported to SBSDRs, which in turn began disseminating such data to the Commission and the public.114 In light of the important role of SBSDRs in the markets for security-based swaps, their level of automation, and the regulatory development of the SBS market in recent years, the Commission believes it is timely to propose enhanced requirements for registered SBSDRs with respect to their technology systems that are central to the performance of their regulated activities.
ii. Current Regulation
The Commission believes the current technology regulation framework for SBSDRs should be strengthened. SBSDR technology regulation is currently governed by 17 CFR 240.13n–6 (‘‘Rule 13n–6’’), a broad, principles-based operational risk rule,115 which the Commission adopted in 2015 when regulatory development of the SBS market was still nascent and SBSDRs were not yet registered with the Commission under 17 CFR 240.13n–1 (‘‘Rule 13n–1’’).116 Additionally, Rule 13n–6 was adopted shortly after the adoption of Regulation SCI, with modifications that did not include some of the more detailed proposed requirements.117 As a result, the two currently-registered SBSDRs (which are affiliated with registered clearing agencies that are subject to Regulation SCI) 118 remain subject to the broad principles-based rule, Rule 13n–6, which is the only applicable operational risk requirement for SBSDRs in the Commission’s current regulatory framework. Rule 13n–6 requires that SBSDRs, with respect to those systems that support or are integrally related to the performance of their activities, establish, maintain, and enforce written policies and procedures reasonably designed to ensure that their systems provide adequate levels of capacity, integrity, resiliency, availability, and

119See 17 CFR 240.13n–6.
120See 17 CFR 240.13n–1 through 240.13n–12; See SBSDR Adopting Release, supra note 96, at 14440–42. 121 15 U.S.C. 78m(n). 122When adopting Rule 13n–6, the Commission acknowledged the potential application of Regulation SCI provisions to SBSDRs in the future. See SBSDR Adopting Release, supra note 96, at 14438, 14499 (stating that ‘‘[c]onsistent with this approach and in recognition of the importance of SDRs as the primary repositories of SBS trade information, the Commission may consider the application of any features of Regulation SCI to SDRs in the future.’’). Additionally, as guidance, the Commission stated that, in preparing their policies and procedures to comply with Rule 13n–6, SBSDRs may consider whether to incorporate aspects of Regulation SCI that may be appropriate for their particular implementation of Rule 13n–6. See id., at 14499, n.826 (stating that ‘‘[i]n preparing their policies and procedures, SDRs may consider whether to incorporate aspects of Regulation SCI that may be appropriate for their particular implementation of Rule 13n–6, including where an SDR is related by virtue of its corporate structure to an entity subject to Regulation SCI.’’). 123 In 2014, the SEC’s SBSDR regulatory framework was subject to a Level 2 assessment by the Bank for International Settlements’ Committee on Payments and Market Infrastructures (‘‘CPMI’’) and the International Organization of Securities Commissions (‘‘IOSCO’’), which concluded that ‘‘the U.S. jurisdiction has developed rules or proposed rules that completely and consistently implement the majority of Principles that are applicable to CCPs [central counterparties] [but that] [t]he progress of the U.S. jurisdiction towards completely and consistently implementing the Principles for [trade repositories] has been more limited.’’ See CPMI–IOSCO, Implementation Monitoring of PFMIs: Level 2 assessment report for central counterparties and trade repositories— United States (Feb. 26, 2015), available at https:// www.iosco.org/library/pubdocs/pdf/ IOSCOPD477.pdf. Additionally, CPMI–IOSCO issued guidance for cyber resilience for financial market infrastructures (‘‘FMIs’’), including trade repositories. See CPMI–IOSCO, Guidance on cyber resilience for financial market infrastructures (June 2016), available at https://www.iosco.org/library/ pubdocs/pdf/IOSCOPD535.pdf; see also CPMI– IOSCO, Implementation monitoring of the PFMI:
Level 3 assessment on Financial Market Infrastructures’ Cyber Resilience (Nov. 2022), available at https://www.iosco.org/library/pubdocs/ pdf/IOSCOPD723.pdf (presenting the results of an assessment of the state of cyber resilience (as of Feb.
2021) at 37 FMIs from 29 jurisdictions that
participated in this exercise in 2020 to 2022). 124See supra note 118. security.119 The operational risk principles underlying Rule 13n–6 are an essential part of the rules that comprise the core framework for SBSDRs that the Commission established in 2015 at the opening of its regulatory regime governing SBSDRs. The core framework influences all applicable requirements relevant to SBSDRs that follow. The core framework not only addresses SBSDR operational risk, but also other SBSDR enumerated duties, including registration, market access to services and data, governance arrangements, conflicts of interest, data collection and maintenance, privacy and disclosure requirements, and chief compliance officers,120 thereby implementing the provisions of Exchange Act section 13(n).121 Therefore, the SBSDR core framework, which Rule 13n–6 is a part, is different in focus and broader in scope than proposed Regulation SCI—as it relates to SBSDRs—which is focused on, among things, protecting the security of SBSDR systems. While Rule 13n–6 may not provide the absolute requirements relating to SBSDR operational risk, as the Commission’s regulatory regime continues to evolve, Rule 13n–6 sets forth an enumerated duty for operational risk concerns that registered SBSDRs must address—at the time of registration and throughout its registration with the Commission. Compliance with the core principles and requirements in the SBSDR rules, including Rule 13n–6, is, thus, an important building block for better ensuring the integrity of an SBSDR’s data quality upon which the Commission and the securities markets rely. In this regard, the Commission believes that Rule 13n–6 should be preserved, with the requirements of this proposal, if adopted, working to complement Rule 13n–6.122 Specifically, the proposed requirements of Regulation SCI on SBSDRs would exist and operate in conjunction with Rule 13n–6 and would prescribe certain key features and more detailed functional requirements to help ensure that SBSDR market systems are robust, resilient, and secure.123 Regulation SCI, among other things, defines the scope of systems covered, and requires: the establishment, maintenance, and enforcement of written policies and procedures to ensure that SCI systems have levels of capacity, integrity, resiliency, availability, and security adequate to maintain operational capacity and promote the maintenance of fair and orderly markets, with minimum elements that include, among others, standards designed to facilitate the successful collection, processing, and dissemination of market data and robust business continuity and disaster recovery plans; policies and procedures designed to ensure compliance with the federal securities laws; corrective action and reporting and dissemination of SCI events, quarterly reporting of material systems changes, and an annual SCI review; and participation of key members in SCI entity’s business continuity and disaster recovery plans. The Commission
believes that SBSDRs operate with similar complexity and in a similar fashion as other registered securities information processors that are currently subject to Regulation SCI and that they play an important role in the SBS market and face similar technological vulnerabilities as existing SCI entities, such as FINRA’s TRACE and MSRB’s EMMA. For example, were an SBSDR to experience a systems issue, market participants could be prevented from receiving timely information regarding accurate prices for individual SBSs. Given SBSDRs’ reliance on automated systems and their dual Dodd-Frank mandated role of providing price transparency to market participants and SBS data to regulators to surveil markets to better ensure that systemic risk is limited and market stability is enhanced, the Commission believes it appropriate to include SBSDRs into the scope of the Regulation SCI proposal. Currently, there are two registered SBSDRs that would become subject to Regulation SCI should the Regulation SCI amendments be adopted.124
iii. Request for Comment

The Commission requests comment
generally on the inclusion of SBSDRs as SCI entities. Is their inclusion appropriate? Why or why not? Please be specific and provide examples, if possible, to illustrate your points.
Should all or some aspects of
Regulation SCI apply to SBSDRs? Why or why not? If only a portion, please specify which portion(s) and explain why. If all, explain why.
Are the definitions of SCI systems
and indirect SCI systems appropriate for SBSDRs? Why or why not? Are there any systems of SBSDRs that should be included but would not be covered by these definitions? Please explain. Are there any systems of SBSDRs that should be excluded by these definitions? Please explain. Do SBSDRs have any systems that would or should be covered by the definition of critical SCI systems? Please explain.
Is current Rule 13n–6 sufficient to
govern the technology of SBSDRs? If not, why not? Would the Regulation SCI proposed requirements, together with Rule 13n–6, be sufficient to address operational risk concerns posed by SBSDRs? Why or why not? Should Rule 13n–6 serve as an operational risk requirement for new SBSDR registrants during the first year registered with the Commission, with Regulation SCI proposed requirements imposed after the first year of registration? Why or why not? Please be specific and respond with examples, if possible.
Given the current practices of
SBSDRs, would the proposed Regulation SCI requirements pose unreasonable or unworkable difficulties

125See Form X–17A–5, FOCUS Report, Part II, at 3, available at https://www.sec.gov/files/formx-17a5_2_2.pdf (requiring broker-dealers to report their total assets in Item 940). 126See infra note 127. 127For additional detail on the calculation of total assets of all security broker-dealers, see Z.1:
Financial Accounts of the United States, available at https://www.federalreserve.gov/apps/fof/Guide/ z1_tables_description.pdf; ((i) stating that the term ‘‘security broker-dealers’’ refers to firms that buy and sell securities for a fee, hold an inventory of securities for resale, or do both; and firms that make up this sector are those that submit information to the Commission on one of two reporting forms, either the Financial and Operational Combined Uniform Single Report of Brokers and Dealers (FOCUS) or the Report on Finances and Operations of Government Securities Brokers and Dealers (FOGS); and (ii) describing the major assets of the security brokers and dealers sector). Currently, this information is readily accessible on the Federal Reserve Economic Data (‘‘FRED’’) website. See Board of Governors of the Federal Reserve System (US), Security Brokers and Dealers; Total Assets (Balance Sheet), Level [BOGZ1FL664090663Q], retrieved from FRED, Federal Reserve Bank of St. Louis, available at: https://fred.stlouisfed.org/series/ BOGZ1FL664090663Q (making publicly available the total assets of all security brokers and dealers, as calculated and updated quarterly by the Federal Reserve Board). 128See infra notes 178–180 and accompanying text. 129See infra section III.A.b.iii. 130See infra text accompanying notes 138–142 (summarizing comments on the SCI Proposing Release from commenters urging that application of Regulation SCI to broker-dealers should be limited to those with substantial transaction volume or having a large ‘‘footprint’’). 131This estimate is derived from information on broker-dealer FOCUS Report Form X–17A–5
Schedule II filings as of Dec. 31, 2021, as well as
the third quarter of 2022. See also FINRA, 2022 FINRA Industry Snapshot (Mar. 2022), available at https://www.finra.org/sites/default/files/2022-03/ 2022-industry-snapshot.pdf. Section 15(b)(8) of the Exchange Act prohibits any broker-dealer from effecting transactions in securities unless it is a member of a registered national securities association (i.e., FINRA) or effects securities transactions solely on a national securities exchange of which it is a member. See 15 U.S.C. 78o(b)(8); see also 17 CFR 240.15b9–1 (‘‘Rule 15b9– 1’’) (exempting proprietarily trading dealers from
section 15(b)(8)’s national securities association
membership requirement if they are a member of a national securities exchange and meet certain other requirements). But see Securities Exchange Act Release No. 95388 (July 29, 2022), 87 FR 49930 (Aug. 12, 2022) (proposing amendments to Exchange Act Rule 15b9–1 that would generally require proprietary trading firms that are registered broker-dealers to become a registered member of a national securities association (i.e., FINRA) if they effect securities transactions otherwise than on an exchange of which they are a member). See also Securities Exchange Act Release No. 94524 (Mar. 28, 2022), 87 FR 23054 (Apr. 18, 2022) (‘‘DealerTrader Release’’) (proposing to further define ‘‘dealer’’ and ‘‘government securities dealer’’ to identify certain activities that would constitute a ‘‘regular business’’ requiring a person engaged in those activities to register as a ‘‘dealer’’ or a ‘‘government securities dealer,’’ absent an exception or exemption). Because the proposed amendments to further define the definition of dealer could result in a greater number of dealers and the amendments proposed to expand and update Regulation SCI could impact these newly designated dealers, commenters also are encouraged to review the Dealer-Trader Release to determine whether it might affect their comments on this proposal. 132See SCI Proposing Release, supra note 14, at 18138–42. 133An OTC market maker is a dealer that holds itself out as willing to buy and sell NMS stocks on a continuous basis in amounts of less than block Continued for them, technologically, legally, operationally, or procedurally? Why or why not? Please be specific and respond with examples, if possible.
6. Should Regulation SCI distinguish
among different types of SBSDRs such that some requirements of Regulation SCI might be appropriate for some SBSDRs but not others? Why or why not? If so, what are those distinctions and what are those requirements? For example, should any requirements be based on criteria such as number of transactions or notional volume reported to a SBSDR? If so, what would be an appropriate threshold for any such criteria, and why? Please be specific and provide examples, if possible.
7. Because proposed Regulation SCI
would include SBSDRs as ‘‘SCI entities,’’ SBSDRs that share systems with affiliated clearing agencies could be required to classify those shared systems as SCI systems of the SBSDR and indirect SCI systems of the clearing agency, and vice versa. Is this outcome appropriate? Why or why not? Please be specific and provide examples, if possible.
8. Is Regulation SCI, including as
proposed to be amended, comprehensive and robust enough to address SBSDRs that rely on third-party providers to support core SBSDR operations? Why or why not? Please be specific and provide examples, if possible. b. SCI Broker-Dealers The Commission further proposes to expand the application of Regulation SCI by including certain brokerdealers—to be referred to as ‘‘SCI broker-dealers’’—in the definition of SCI entity. An SCI broker-dealer would be a broker or dealer registered with the Commission pursuant to section 15(b) of the Exchange Act that exceeds one or more size thresholds. An SCI brokerdealer would be a broker-dealer that meets or exceeds: (i) a total assets threshold, or (ii) one or more transaction activity thresholds. The proposed thresholds are designed to identify the largest U.S. brokerdealers by size, as measured in two different ways. The first is analysis of broker-dealer size based on total assets reported on Form X–17A–5 (Financial and Operational Combined Uniform Single (‘‘FOCUS’’) Report Part II, Item 940),125 which reveals the largest firms based on their balance sheets at a point in time, and which is a measure used by the Board of Governors of the Federal Reserve System (‘‘Federal Reserve Board’’) to calculate and provide to the public on a quarterly basis a measure of total assets of all security brokerdealers.126 The second is a measure of broker-dealer size using transaction activity to identify significant firms active in certain enumerated types of securities. As discussed further below, the total assets threshold is expressed in terms of the broker-dealer’s total assets at specified points in time as a percentage of the ‘‘total assets of all security broker-dealers’’ with ‘‘total assets of all security-broker-dealers’’ being calculated and made publicly available by the Federal Reserve Board for the associated preceding calendar quarter, or any subsequent provider of such information.127 The trading activity threshold is expressed in terms of the sum of buy and sell transactions that the broker-dealer transacted during a specified time period as a percentage of reported total average daily dollar volume in one or more enumerated types of securities. The proposed total assets threshold is broadly similar to the approach banking regulators use to assess the appropriate capital and liquidity requirements for banks.128 The proposed transaction activity thresholds are similar to, but distinguishable from, the market share thresholds for SCI ATSs.129 The proposed threshold approaches in the proposed definition of SCI broker-dealer are designed to identify entities that play key roles in the U.S. securities markets due to the magnitude of their activity in these markets.130
i. Background
There are approximately 3,500 brokerdealers registered with the Commission pursuant to section 15(b) of the Exchange Act, and these entities encompass a broad range of sizes, business activities, and business models.131 In 2013, the Commission proposed to include significant volume ATSs in the definition of SCI entity but at that time did not propose to include any other aspects of broker-dealer operations.132 Rather, the Commission solicited comment on whether certain classes of broker-dealers should be covered. In particular, the Commission sought comment on whether Regulation SCI should apply, for example, to OTC market makers 133 (either all or those

size otherwise than on an exchange. See 17 CFR 242.600(b)(64). 134An exchange market maker is any member of a national securities exchange that is registered as a specialist or market maker pursuant to the rules of such exchange. See 17 CFR 242.600(b)(32). 135See SCI Proposing Release, supra note 14, at 18139–40. 136See SCI Proposing Release, supra note 14, at 18138–40 (including questions 194–196 soliciting comment on whether and how to distinguish between and among categories of broker-dealers, such as OTC market makers, order entry firms that handle and route order flow for execution, clearing broker-dealers, and large multi-service brokerdealers that engage in a variety of order handling, trading, and clearing activities). 137See SCI Adopting Release, supra note 1, at 72365. 138See id. (citing letter from the New York Stock Exchange, Inc. (‘‘NYSE’’)). 139See id. (citing letters from Liquidnet, Inc., David Lauer, and R.T. Leuchtkafer). 140See 17 CFR 240.15c3–5. 141See SCI Adopting Release, supra note 1, at 72365 (citing letters from David Lauer and the NYSE). 142See id. (citing letter from BlackRock at 4, in which BlackRock stated that trading systems that ‘‘transact significant volume’’ are ‘‘venues that have a meaningful role and impact on the equity market’’). 143See id. 144SCI Adopting Release, supra note 1, at 72366. 145As noted above, the concurrently issued Exchange Act Cybersecurity Proposal would establish minimum ‘‘cybersecurity rules’’ for all broker-dealers. That proposal does not, however, independently address weaknesses in broker-dealer operational capacity or resiliency not attributable to cybersecurity breaches. 146 17 CFR 240.3a1–1(a)(2) (‘‘Rule 3a1–1(a)(2)’’), exempts from the Exchange Act section 3(a)(1) definition of ‘‘exchange’’ an organization, association, or group of persons that complies with Regulation ATS. All such exempted ATSs must be a registered broker-dealer and become a member of an SRO, which typically is FINRA. Accordingly, FINRA rules applicable to broker-dealers apply to ATSs. A similar discussion of FINRA rules applicable to ATSs appears in the SCI Adopting Release, supra note 1, at 72263. 147See infra notes 148–166 and accompanying text. See also SCI Adopting Release, supra note 1, at 72263 (n. 115 and accompanying text), 72365 (discussing comments received). 148See Securities Exchange Act Release No. 63241 (Nov. 3, 2010), 75 FR 69792 (Nov. 15, 2010) (‘‘Market Access Release’’). Under 17 CFR 240.15c3–5(a)(1) (‘‘Rule 15c3–5(a)(1)’’), ‘‘market access’’ is defined to mean: (i) access to trading in securities on an exchange or ATS as a result of being a member or subscriber of the exchange or ATS, respectively; or (ii) access to trading in securities on an ATS provided by a broker-dealer operator of an ATS to a non-broker-dealer. See 17 CFR 240.15c3–5(a)(1). In adopting Rule 15c3– 5(a)(1), the Commission stated that ‘‘the risks associated with market access . . . are present whenever a broker-dealer trades
as a member of an exchange or subscriber to an ATS, whether for its own proprietary account or as agent for its customers, including traditional agency brokerage and through direct market access or sponsored access arrangements.’’ See Market Access Release at
69798. As such, the Commission stated that ‘‘to
effectively address these risks, Rule 15c3–5 must apply broadly to all access to trading on an Exchange or ATS.’’ Id. that execute a significant volume of orders), exchange market makers 134 (either all or those that trade a significant volume on exchanges), orderentry firms that handle and route order flow for execution (either all or those that handle a significant volume of investor orders), clearing broker-dealers (either all or those that engage in a significant amount of clearing activities), and/or large multi-service broker-dealers that engage in a variety of order handling, trading, and clearing activities.135 Although OTC market makers and clearing broker-dealers were noted specifically as examples of categories of broker-dealers that could pose significant risk to the market if a large portion of the order flow they handle or process were disrupted due to a systems issue, the Commission broadly solicited commenters’ views on the importance of different categories of broker-dealers to the stability of overall securities market infrastructure and the risks posed by their systems.136 As summarized in the SCI Adopting Release, commenters’ views varied.137 One commenter opined that market makers and brokers or dealers that execute orders internally by trading as a principal or crossing orders as an agent and handle market share that exceeds that of certain SCI ATSs should be subject to Regulation SCI.138 Others stated that market makers, high frequency trading firms, or any firm with market access should be included, arguing that these market participants could present systemic risks to the market and had ‘‘a significant footprint in the markets.’’ 139 Others stated that broker-dealers should be SCI entities because 17 CFR 240.15c3–5 (‘‘Rule 15c3–5’’ or ‘‘Market Access Rule’’),140 requiring the implementation of risk management and supervisory controls to limit risk associated with routing orders to exchanges or ATSs, was not sufficient by itself, as it does not address the reliability or integrity of the systems that implement such controls.141 One commenter stated that Regulation SCI should be extended to any trading platforms that transact significant volume, including systems that are not required to register as an ATS because all executions are against the bids and offers of a single dealer.142 In contrast, other commenters argued that brokerdealers should not be subject to Regulation SCI because they must comply with other Exchange Act and FINRA rules and the proposed Regulation SCI requirements would be ‘‘duplicative and unduly burdensome.’’ 143 At adoption, the Commission stated that ‘‘should [it] decide to propose to apply the requirements of Regulation SCI to [broker-dealer operations other than ATSs, it] would issue a separate release discussing such a proposal and would take these comments into account.’’ 144 In considering expansion of Regulation SCI to broker-dealers or broker-dealer operations beyond SCI ATSs, the
Commission has considered the extent to which current Commission and FINRA rules affect how brokerdealers design and review their systems for capacity, integrity, resiliency, availability, and/or security adequate to maintain operational capability and promote the maintenance of fair and orderly markets and compliance with federal securities laws and regulations, and whether additional technology oversight is appropriate for certain broker-dealers based on the magnitude of their activity in the markets today.145 The Commission proposes to apply Regulation SCI to a limited number of the approximately 3,500 broker-dealers registered with the Commission. The proposed thresholds are designed to identify firms that, by virtue of their total assets or level of transaction activity over a period of time and on a consistent basis, play a significant role in the orderly functioning of U.S. securities markets. The thresholds are designed to identify firms that, if adversely affected by a technology event, could disrupt or impede orderly and efficient market operations more broadly.
ii. Current Regulatory Oversight of
Broker-Dealer Systems Technology There are a number of Commission and FINRA rules that affect how brokerdealers design and maintain their technology and promote business continuity and regulatory compliance.146 Although these rules may support the goal of more resilient broker-dealer systems, they are not designed to address the same concerns that Regulation SCI addresses and are not a substitute for Regulation SCI.147 As some commenters on the SCI Proposing Release stated, the Market Access Rule is relevant to certain broker-dealer systems. The Market Access Rule requires broker-dealers with market access to implement, on a market-wide basis, effective financial and regulatory risk management controls and supervisory procedures reasonably designed to limit financial exposure and ensure compliance with applicable regulatory requirements, and thus seeks to address, among other things, certain risks posed to the markets by broker-dealer systems.148 Pursuant to the Market Access Rule, a broker or dealer with market access, or that provides a customer or any other

149See 17 CFR 240.15c3–5(b).
150See 17 CFR 240.15c3–5(c).
151See 17 CFR 240.15c3–5(c)(1).
152See 17 CFR 240.15c3–5(c)(2). See also 17 CFR 240.15c3–5(a)(2) (defining ‘‘regulatory requirements’’ to mean all Federal securities laws, rules and regulations, and rules of self-regulatory organizations, that are applicable in connection with market access). 153See also supra note 141 and accompanying text. 154See 17 CFR 240.15c3–1. 155See 17 CFR 240.15c3–3. 156Similarly, 17 CFR 248.30 (‘‘Rule 30’’ of Regulation S–P), which requires registered brokers and dealers to have written policies and procedures that are reasonably designed to safeguard customer records and information—to insure their security and confidentiality, protect against threats or hazards to their security and integrity and protect against unauthorized access or use that could result in substantial harm or inconvenience to any customer—is not designed to help ensure operational capability of market related systems. In addition, 17 CFR 248.201 (‘‘Regulation S–ID’’) requires financial institutions or creditors (defined to include registered broker-dealers) that have one or more covered accounts, as defined in 17 CFR 248.201(b)(3) (e.g., brokerage account), to develop and implement a written identity theft prevention program to detect, prevent, and mitigate identity theft in connection with covered accounts that includes policies and procedures to identify and incorporate red flags into the program, detect and respond to red flags, and incorporate periodic updates to the program. This rule, however, is also not designed to ensure operational capability of market related systems. 157See 17 CFR 240.17a–3; 17 CFR 240.17a–4. 158See, e.g., Securities Exchange Act Release No. 40162 (July 2, 1998), 63 FR 37668 (July 13, 1998) (stating that computer systems with ‘‘Year 2000 Problems’’ may be deemed not to have accurate and current records and be in violation of Rule 17a–3). 159See 17 CFR 240.17a–11. person with access to a national securities exchange or ATS through use of its market participant identifier or otherwise, must establish, document, and maintain a system of risk management controls and supervisory procedures reasonably designed to manage the financial, regulatory, and other risks of this business activity.149 The Market Access Rule specifies standards for financial and regulatory risk management controls and supervisory procedures.150 It requires that the financial risk management controls and supervisory procedures must be reasonably designed to limit systematically the financial exposure of the broker or dealer that could arise from market access.151 In addition, the Market Access Rule requires that regulatory risk management controls and supervisory procedures be reasonably designed to ensure compliance with all regulatory requirements.152 As such, the focus of the Market Access Rule requires controls to prevent technology and other errors that can create some of the more significant risks to broker-dealers and the markets, namely those that arise when a broker-dealer
enters orders into a national securities exchange or ATS, including when it provides sponsored or direct market access to customers or other persons, where the consequences of such an error can rapidly magnify and spread throughout the markets. Further, the Market Access Rule requires specific controls and procedures around a broker-dealer entering orders on a national securities exchange or ATS that Regulation SCI does not and would not prescribe. In contrast, the policies and procedures required by Regulation SCI apply broadly to technology that supports trading, clearance and settlement, order routing, market data, market regulation, and market surveillance and, among other things, address their overall capacity, integrity, resilience, availability, and security independent of market access. Whereas the Market Access Rule prescribes specific controls and procedures around a broker-dealer entering orders on an exchange or ATS, it is not designed to ensure that the key technology pervasive and important to the functioning of the U.S. securities markets is robust, resilient, and secure.153 Among other requirements, the policies and procedures requirements of Regulation SCI are designed to help ensure that the systems of SCI entities are adequate to maintain operational capability independent of any specific SCI event (i.e., a systems issue such as a systems disruption, systems intrusion, or systems compliance issue). Further, the SCI review requirement obligates an SCI entity to assess the risks of its systems and effectiveness of its technology controls at least annually, identify weaknesses, and ensure compliance with the safeguards of Regulation SCI. The Market Access Rule and Regulation SCI, therefore, have different requirements and would operate in conjunction with each other to help ensure that SCI broker-dealer SCI systems, whether used for access to the national securities exchanges or ATSs or not, are robust, resilient, and secure. Broker-dealers are also subject to the Commission’s financial responsibility rules (17 CFR 240.15c3–1 (‘‘Rule 15c3– 1’’) and 17 CFR 240.15c3–3 (‘‘Rule 15c3–3’’)) under the Exchange Act. Rule 15c3–1 requires broker-dealers to maintain minimum amounts of net capital, ensuring that the broker-dealer at all times has enough liquid assets to promptly satisfy all creditor claims if the broker-dealer were to go out of business.154 Rule 15c3–3 imposes requirements relating to safeguarding customer funds and securities.155 These rules provide protections for brokerdealer counterparties and customers and can help to mitigate the risks to, and impact on, customers and other market participants by protecting them from the consequences of financial failure that may occur because of a systems issue at a broker-dealer, and thus have a different scope and purpose from Regulation SCI.156 Pursuant to 17 CFR 240.17a–3 (‘‘Rule 17a–3’’ under the Exchange Act) and 17 CFR 240.17a–4 (‘‘Rule 17a–4’’ under the Exchange Act),
broker-dealers are required to make and keep current records detailing, among other things, securities transactions, money balances, and securities positions.157 A systems issue at a broker-dealer would not excuse the broker-dealer for noncompliance with these requirements.158 Further, a brokerdealer that fails to make and keep current the records required by Rule 17a–3 must give notice to the Commission of this fact on the same day and, thereafter, within 48 hours transmit a report to the Commission stating what the broker-dealer has done or is doing to correct the situation.159 Regulation SCI, however, more directly addresses mitigating the impact of technology failures with respect to SCI systems and indirect SCI systems (which include systems that are not used to make and keep current the records required by Rule 17a–3). Specifically, it requires notifications to the Commission for a different set of events—systems intrusions, systems compliance issues, and systems disruptions—than the notification requirements of 17 CFR 240.17a–11 (‘‘Rule 17a–11’’), and is therefore not duplicative of Rule 17a–
11. In addition, it requires that, when an
SCI event has occurred, an SCI entity must begin to take appropriate corrective action which must include, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable. FINRA also has several rules that are similar to, but take a different approach from, Regulation SCI. For example, FINRA Rule 4370 requires that each broker-dealer create and maintain a written business continuity plan identifying procedures relating to an emergency or significant business disruption that are reasonably designed to enable them to meet their existing obligations to customers. The procedures must also address the broker-dealer’s existing relationships

160Specifically, FINRA Rule 4370 requires that each plan must, at a minimum, address: data backup and recovery; all mission critical systems; financial and operational assessments; alternate communications between customers and the member; alternate communications between the member and its employees; alternate physical location of employees; critical business constituent, bank, and counter-party impact; regulatory reporting; communications with regulators; and how the member will assure customers’ prompt access to their funds and securities in the event that the member determines that it is unable to continue its business. 161See SCI Adopting Release, supra note 1, at 72263–64. 162 Id. 163See supra note 160. 164See FINRA Rule 4370(e). 165See FINRA, Regulatory Notice 21–29: Vendor Management and Outsourcing (Aug. 13, 2021), available at https://www.finra.org/sites/default/ files/2021-08/Regulatory-Notice-21-29.pdf; FINRA, Notice to Members 05–48: Outsourcing (July 2005), available at https://www.finra.org/sites/default/ files/NoticeDocument/p014735.pdf. 166See Federal Reserve Board, SR 20–24:
Interagency Paper on Sound Practices to Strengthen Operational Resilience (Nov. 2, 2020), (‘‘Banking Interagency Paper’’), available at https:// www.federalreserve.gov/supervisionreg/srletters/ SR2024.htm (‘‘To help large and complex domestic firms address unforeseen challenges to their operational resilience, the sound practices are drawn from existing regulations, guidance, and statements as well as common industry standards that address operational risk management, business continuity management, third-party risk management, cybersecurity risk management, and recovery and resolution planning.’’). The paper applies to national banks, state member banks, state nonmember banks, savings associations, U.S. bank holding companies, and savings and loan holding companies that have average total consolidated assets greater than or equal to (a) $250 billion or (b) $100 billion and have $75 billion or more in average cross-jurisdictional activity, average with other broker-dealers and counterparties. A broker-dealer is required to update its plan in the event of any material change to the member’s operations, structure, business, or location and must conduct an annual review of its business continuity plan to determine whether any modifications are necessary in light of changes to the member’s operations, structure, business, or location. The rule sets forth general minimum elements that a broker-dealer’s business continuity plan must address.160 This rule is akin to Regulation SCI’s Rule 1001(a)(2)(v) requiring policies and procedures for business continuity and disaster recovery plans.161 However, unlike Regulation SCI, the FINRA rule does not include the requirement that the business continuity and disaster recovery plans be reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a widescale disruption, nor does it require the functional and performance testing and coordination of industry or sectortesting of such plans, which are instrumental in achieving the goals of Regulation SCI with respect to SCI entities.162 In addition, FINRA Rule 4370 contains certain provisions that Regulation SCI does not.163 For example, a broker-dealer must disclose to its customers through public disclosure statements how its business continuity plan addresses the possibility of a future significant business disruption and how the member plans to respond to events of varying scope.164 Accordingly, FINRA Rule 4370 and Regulation SCI would operate in conjunction with one another to help ensure that an SCI broker-dealer has business continuity and disaster recovery plans to achieve the goals of each rule. FINRA Rule 3110(b)(1) requires each broker-dealer to establish, maintain, and enforce written procedures to supervise the types of business in which it engages and to supervise the activities of registered representatives, registered principals, and other associated persons that are reasonably
designed to achieve compliance with applicable securities laws and regulations. This supervisory obligation extends to member firms’ outsourcing of certain ‘‘covered activities’’—activities or functions that, if performed directly by a member firm, would be required to be the subject of a supervisory system and written supervisory procedures pursuant to FINRA Rule 3110.165 This rule is broadly similar to Rule 1001(b) of Regulation SCI regarding policies and procedures to ensure systems compliance. However, unlike Rule 1001(b), which focuses on ensuring that an entity’s systems operate in compliance with the Exchange Act, the rules and regulations thereunder, and the entity’s rules and governing documents, this FINRA rule does not specifically address compliance of broker-dealers’ systems. Further, this provision does not cover more broadly policies and procedures akin to those in Rule 1001(a) of Regulation SCI regarding ensuring the SCI entity’s operational capability. FINRA Rule 3110(b)(1) and Regulation SCI would operate in conjunction to help ensure that the SCI systems of SCI broker-dealers, including those operated by third parties, are robust, resilient, and operate as intended. FINRA Rule 3130 requires a brokerdealer’s chief compliance officer to certify annually that the member has in place processes to establish, maintain, review, test, and modify written policies and procedures reasonably designed to achieve compliance with applicable FINRA rules, MSRB rules, and federal securities laws and regulations. This rule is similar to Rule 1001(b) of Regulation SCI regarding policies and procedures to ensure systems compliance; however, like FINRA Rule 3130(b)(1), it does not specifically address compliance of broker-dealers’ systems, and does not require similar policies and procedures to those in Rule 1001(a) of Regulation SCI regarding operational capability of SCI entities. Therefore, FINRA Rule 3130 and Regulation SCI would operate in conjunction with each other to help ensure compliance with applicable law. FINRA Rule 4530 imposes a regime for reporting certain events to FINRA, including, among other things, compliance issues and other events where a broker-dealer has concluded, or should have reasonably concluded, that a violation of securities or other enumerated law, rule, or regulation of any domestic or foreign regulatory body or SRO has occurred. This requirement is similar to Regulation SCI’s reporting requirements under Rule 1002 with respect to systems compliance issues; however, it does not cover reporting of systems disruptions and systems intrusions that did not also involve a violation of a securities law, rule, or regulation. Further, the FINRA reporting rule differs from the Commission notification requirements with respect to the scope, timing, content and required recipient of the reports. FINRA Rule 4530 addressing reporting of certain issues to FINRA is thus not duplicative of Regulation SCI, which, among other things,
was designed to enhance direct Commission oversight of entities designated as key entities because they play a significant role in the U.S. securities markets. Additionally, while regulations and associated guidance applicable to bank holding companies promulgated by the Federal Reserve Board and other bank regulators address operational resilience, their direct application is to bank holding companies rather than broker-dealers registered with the Commission. For example, a 2020 interagency paper issued by the Federal Reserve Board, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation sets forth ‘‘sound practices’’ for the largest, most complex firms, including U.S. bank holding companies, to follow to strengthen their operational resilience. While this publication offers key strategies for covered entities to follow to remain resilient, many of which are similar to what Regulation SCI requires, they are not mandatory for registered broker-dealers.166 Thus,

weighted short-term wholesale funding, average nonbank assets, or average off-balance sheet exposure. As discussed below, the Commission’s proposed approach to identifying SCI brokerdealers similarly takes into account the size of the firm, as measured by a total assets threshold and/ or market activity thresholds. 167For example, see Algorithmic Trading Report, supra note 3 (discussing many uses of computer systems in contemporary markets, particularly with respect to the trading of equity and debt securities). 168Broker-dealers that file Form X–17A–5 on a monthly basis would use their total assets, as reported on Item 940 of Form X–17A–5, for the months ending Mar. 31, June 30, Sept. 30, and Dec.
31. Broker-dealers that file Form X–17A–5 on a
quarterly basis would use their total assets, as reported on Item 940 of Form X–17A–5, for the quarters ending Mar. 31, June 30, Sept. 30, and Dec. 31. 169See definition of SCI broker-dealer in proposed amended Rule 1000. The term ‘‘total assets of all security brokers and dealers’’ would, for purposes of this threshold, mean the total assets calculated and made publicly available by the Board of Governors of the Federal Reserve, or any subsequent provider of such information, for the associated preceding calendar quarter. Id. See supra note 127; infra text accompanying notes 181–185. 170For June 2022, the average daily dollar volume in NMS stocks, as reported by applicable effective transaction reporting plans, was approximately $560 billion, with 10% of that reflecting approximately $56 billion. 171For June 2022, the average daily dollar volume in exchange-listed options contracts, as reported by an applicable effective national market system plan, was approximately $23.8 billion, with 10% of that reflecting approximately $2.4 billion. 172For June 2022, the average daily dollar volume in U.S Treasury Securities, according to FINRA TRACE data, was approximately $634.1 billion, with 10% of that reflecting approximately $63.4 billion. 173Currently, there is one self-regulatory organization to which transactions in U.S Treasury Securities are reported (i.e., FINRA). 174For June 2022, the average daily dollar volume in Agency Securities, according to FINRA TRACE data was approximately $223 billion, with 10% of that reflecting approximately $22.3 billion. 175Currently, there is one self-regulatory organization to which transactions in U.S Treasury Securities are reported (i.e., FINRA) and one organization to which transactions in Agency securities are reported (i.e., FINRA). 176See supra note 82 and accompanying text. 177See Form X–17A–5, FOCUS Report, Part II, at 3, available at https://www.sec.gov/files/formx-17a5_2_2.pdf (requiring broker-dealers to report their total assets in Item 940). 178See Dodd-Frank Act section 113(a)(2), 12 U.S.C. 5323(a)(2). 179See Dodd-Frank Act section 165, 12 U.S.C. 5365(a)(1). See also Federal Reserve Board, Prudential Standards for Large Bank Holding Companies, Savings and Loan Holding Companies, and Foreign Banking Organizations, 84 FR 59032 (Nov. 1, 2019), and Federal Reserve Board, Changes Continued although some Exchange Act and FINRA rules other than Regulation SCI support the goal of robust and resilient broker-dealer systems, the Commission believes that additional protections, reporting of systems problems, and direct Commission oversight of brokerdealer technology is appropriate for the largest broker-dealers.
iii. Proposed Thresholds for an ‘‘SCI
Broker-Dealer’’
Overview
As proposed, Regulation SCI would apply to a limited number of brokerdealers that satisfy: (i) a total assets threshold, or (ii) one or more transaction activity thresholds. The Commission preliminarily believes that a broker-dealer that meets the proposed thresholds for assets or transaction activity, whether operating in multiple markets or predominantly in a single market, that becomes unreliable or unavailable due to a systems issue, risks disrupting fair and orderly market functioning. Current Regulation SCI applies to all national securities exchanges and certain significant-volume ATSs, all of which are highly dependent on sophisticated automated and interconnected systems. As electronic trading has grown, and continues to grow in some asset classes, many broker-dealers are similarly dependent on sophisticated and interconnected automated systems.167 These brokerdealer systems contribute to the orderly functioning of U.S. securities markets, encompassing, for example, systems for trading and quoting, order handling, dissemination and processing of market data, and the process of clearance and settlement. An ‘‘SCI broker-dealer’’ would be a broker or dealer registered with the Commission pursuant to section 15(b) of the Exchange Act which:

In at least two of the four preceding
calendar quarters, ending March 31, June 30, September 30, and December 31, reported to the Commission, on Form X–17A–5 (§ 249.617),168 total assets in an amount that equals five percent (5%) or more of the total assets of all security brokers and dealers; or 169
During at least four of the preceding
six calendar months:
Æ With respect to transactions in NMS stocks, transacted average daily dollar volume in an amount that equals ten percent (10%) or more of the average daily dollar volume 170 reported by or pursuant to applicable effective transaction reporting plans, provided, however, that for purposes of calculating its activity in transactions effected otherwise than on a national securities exchange or on an alternative trading system, the broker-dealer shall exclude transactions for which it was not the executing party; or Æ With respect to transactions in exchange-listed options contracts, transacted average daily dollar volume in an amount that equals ten percent (10%) or more of the average daily dollar volume 171 reported by an applicable effective national market system plan; or Æ With respect to transactions in U.S. Treasury Securities, transacted average daily dollar volume in an amount that equals ten percent (10%) or more of the total average daily dollar volume 172 made available by the self-regulatory organizations 173 to which such transactions are reported; or Æ With respect to transactions in Agency Securities, transacted average daily dollar volume in an amount that equals ten percent (10%) or more of the total average daily dollar volume 174 made available by the self-regulatory organizations 175 to which such transactions are reported. An SCI broker-dealer would be required to comply with the requirements of Regulation SCI six months after the SCI broker-dealer satisfied either threshold for the first time. The proposed thresholds are designed to identify the largest U.S. brokerdealers. To assess which broker-dealers should be subject to Regulation SCI,176 the Commission has taken into account the size of registered broker-dealers based on analyses of: (i) total assets reported on Form X–17A–5 (Financial and Operational Combined Uniform Single (‘‘FOCUS’’) Report Part II, Item 940),177 and (ii) transaction activity in certain asset classes. Proposed Total Assets Threshold A broker-dealer would be an SCI broker-dealer and included in the definition of SCI entity if, in at least two of the four preceding calendar quarters ending March 31, June 30, September 30, and December 31, it reported to the Commission on Form X–17A–5, FOCUS Report Part II, Item 940 total assets in an amount that equals five percent or more of the total assets of all security brokers and dealers. Congress and multiple regulators have used total assets as a factor in assessing whether an entity warrants heightened oversight. For example, under the Dodd-Frank Act, the Financial Stability Oversight Council (‘‘FSOC’’) considers financial assets as one factor to determine whether a U.S. non-bank financial services company is supervised by the Federal Reserve Board and subject to enhanced prudential standards.178 Furthermore, the DoddFrank Act requires the Federal Reserve Board to establish enhanced prudential standards for bank holding companies over a certain threshold of
total assets.179 Additionally, the Federal

to Applicability Thresholds for Regulatory Capital and Liquidity Requirements, 84 FR 59230 (Nov. 1, 2019). See SCI Adopting Release, supra note 1, at 72259, and also definition of ‘‘critical SCI systems’’ in 17 CFR 142.1000. 180See FDIC, Deposit Insurance Fund, Assessment Rates & Methodology (last updated July 20, 2021), available at https://www.fdic.gov/ resources/deposit-insurance/deposit-insurancefund/dif-assessments.html. 181See supra note 127. This figure has been calculated by the Federal Reserve Board and made available on the Federal Reserve Economic Data (FRED) website for many years. As stated above, the total assets figure calculated by the Federal Reserve Board is based on the information reported to the Commission by ‘‘security broker-dealers’’ on either the FOCUS report or the FOGS report. See id. 182 Id. 183Form X–17A–5 must be filed within 17 business days after the end of each calendar quarter, within 17 business days after the end of the fiscal year where that date is not the end of a calendar quarter, and/or monthly, in accordance with 17 CFR 240.17a–5, 240.17a–12, or 240.18a–7, as applicable. See Instructions to Form X–17A–5, FOCUS Report,
Part II, at 2, available at https://www.sec.gov/files/
formx-17a-5_22.pdf.
184See supra note 127. For example, to assess whether it exceeds the threshold for the calendar quarter ending Dec. 31, a broker-dealer would divide its total assets reported Form X–17A–5, FOCUS Report Part II, Item 940 for the quarter ending Dec. 31, and divide that by the total assets of security brokers and dealers for the third quarter (ending Sept. 30) of the same year, as obtained from the Federal Reserve Board. If a broker-dealer reported $350 billion, $385 billion, $359 billion, and $386 billion in total assets on its FOCUS reports for Q4 2022, Q3 2022, Q2 2022, and Q1 2022, respectively, the broker-dealer would divide its total assets for each quarter by 5.07 trillion (for Q3 2022), $5.07 trillion (for Q2 2022), $5.23 trillion (for Q1 2022), and $4.96 trillion (for Q1 2021), respectively. See infra note 185. The broker-dealer’s total assets as a percentage of the total assets of all security broker-dealers would be 6.9% for Q4 2022, 7.6% for Q3 2022. 6.9% for Q2 2022, and 7.8% for Q1 2022. In all four quarters, the broker-dealer would exceed the 5% threshold and therefore meet the definition of SCI broker-dealer. 185See Board of Governors of the Federal Reserve System (US), Security Brokers and Dealers; Total Assets (Balance Sheet), Level [BOGZ1FL664090663Q], retrieved from FRED, Federal Reserve Bank of St. Louis; https:// fred.stlouisfed.org/series/BOGZ1FL664090663Q. The total assets data from the Federal Reserve shows a sharp drop at the time of the financial crisis, from Q3 2008 to Q4 2008. See id. More recent data show total assets for all security-broker dealers for purpose of the proposed denominator in recent quarters in trillion dollars as follows: Q3 2022: 5.07 trillion; Q2 2022: $5.07 trillion; Q1 2022: $5.23 trillion; Q4 2021: $4.96 trillion; Q3 2021: $5.05 trillion; Q2 2021: $4.94 trillion. See id. 186The Federal Reserve Board data includes total assets reported on both FOCUS and FOGS forms. Its use would result in a conservative number of broker-dealers meeting the total assets threshold (i.e., because elimination of FOGS data would reduce the size of the denominator). The Commission solicits comment below on whether another figure would be a more appropriate and useful measure for determining if a broker-dealer is in the top 5% of all broker-dealers in terms of its total assets, and if a percentage threshold is better measure than a dollar measure. 187As a specific example, based on totals retrieved from FRED (see supra note 127) a brokerdealer assessing its total assets in Dec. 2022 would determine if that level exceeded 5% of total assets in two of the preceding four quarters (approximately $253 billion, $253 billion, $261 billion, and $248 billion, for Q3 of 2022, Q2 of 2022, Q1 of 2022, and Q4 of 2021, respectively). See also Banking Interagency Paper, supra note 166 (applicable to banking institutions having in excess of an average of $250 billion in total assets). 188See, e.g., supra notes 166 and 187 (discussing
Banking Interagency Paper). 189For a broad discussion of these roles, see, e.g., Rosenblatt Securities, 2022 US Equity Trading Venue Guide (May 24, 2022) (discussing among other things the features of single-dealer platforms for equity securities that are operated by brokerdealers); Regulation of NMS Stock Alternative Trading Systems, Securities Exchange Act Release No. 83663 (July 18, 2018), 83 FR 38768 at 38770– 72 (Aug. 7, 2018) (discussing among other things the operational complexity of multi-service brokerdealer with significant brokerage and dealing activity apart from operation of one or more ATSs). 190See, e.g., Rosenblatt Securities, Central Risk Books: What the Buy Side Needs to Know (Oct. 18,
2018) (stating that all of the biggest bank-affiliated
broker-dealers have some form of central risk book and that the ‘‘critical mass of order flow or principal activity, spread across asset classes and regions’’ may not justify the operation of these books for smaller more focused firms). See also Algorithmic Trading Report, supra note 3, at 41–42 (describing central risk books as an important source of block liquidity). All of the firms that satisfy the proposed total assets threshold also satisfy at least one of the proposed trading activity thresholds. See infra text accompanying note 219. Deposit Insurance Corporation (‘‘FDIC’’) increases its Deposit Insurance Fund assessment for large and highly complex institutions as compared to small banks.180 Although a broker-dealer’s total assets alone could be used as the proposed rule’s measure of an entity’s size and significance, to ensure that a total assets measure reflects significant activity in relative terms, the Commission proposes to scale each broker-dealer’s total assets (the numerator) to a quarterly measure of ‘‘total assets of all security brokers and dealers,’’ as calculated by the Federal Reserve Board (the denominator).181 The firm’s total assets filed on FOCUS reports (of which each firm has current and direct knowledge) would be divided by the broader measure of total assets for all securities brokers and dealers calculated and made publicly available by the Federal Reserve Board, or any subsequent provider of such information, for the purpose of comparing the size of a broker-dealer to the group of entities tracked by the Federal Reserve Board.182 The Commission understands that the Federal Reserve Board publishes total assets for all security brokers and dealers approximately ten weeks after the end of the quarter (e.g., 2022 third quarter results ((for quarter ending September 30, 2022)) were published on December 13, 2022). Therefore, the information for the preceding quarter should be available prior to the date on which the firm’s FOCUS report is required to be filed with the Commission for the relevant quarter. To enable each firm to calculate whether it exceeds the threshold at the time it files its FOCUS report (which is due 17 days after the end of the quarter/month),183 broker-dealers would compare their total assets to the previous quarter on or before the FOCUS report filing deadline. Accordingly, to assess whether it exceeds the threshold for a relevant calendar quarter, a broker-dealer would divide its total assets reported on Form X–17A–5, FOCUS Report Part II, Item 940 for that quarter by the total assets of all security brokers and dealers for the preceding quarter, as made available by the Federal Reserve.184 Although it is possible that the total assets of all security brokers and dealers could increase or decrease sharply from one quarter to the next, the FRED data shows that this has occurred rarely and that the asset totals in the Federal Reserve Board’s data generally do not change significantly from quarter
to quarter.185 The Commission therefore believes that overall, the data made available by the Federal Reserve Board is an appropriate and consistent figure for use as a denominator in the proposed threshold.186 If a firm meets or exceeds the threshold in two of the four preceding calendar quarters, it would be required to comply with Regulation SCI beginning six months after the end of the quarter in which the SCI brokerdealer satisfied the proposed asset threshold for the first time. Based on data from recent quarters, at the proposed threshold, a broker-dealer registered with the Commission pursuant to section 15(b) of the Exchange Act and having total assets on its balance sheet in excess of approximately $250 billion in two of the preceding four calendar quarters would be an SCI broker-dealer for as long as it continued to satisfy the threshold.187 The Commission believes that the proposed threshold of five percent of total assets is a reasonable approach to identifying the largest broker-dealers. In addition to its broad consistency with the approach taken by banking regulators,188 this approach takes into consideration the multiple roles that the largest broker-dealers play in the U.S. securities markets. Not only do the largest broker-dealers generate liquidity in multiple types of securities, but many also operate multiple types of trading platforms.189 Further, entities with assets at this level also take risk that they seek to hedge, in some cases using ‘‘central risk books’’ for that and other purposes, and engage in routing substantial order flow to other trading venues.190 For these reasons, the

191See Rule 1000 (definition of ‘‘SCI ATS’’) (providing a time period measurement of ‘‘at least four of the preceding six calendar months’’). 192As with other entities that are SCI entities because they satisfy a threshold (e.g., SCI ATSs), an SCI broker-dealer would no longer be an SCI brokerdealer, and thus no longer be subject to Regulation SCI, in the quarter when it no longer satisfies the total assets test (i.e., it does not meet the threshold in two of the previous four quarters). This assumes the broker-dealer also does not meet or no longer satisfies the proposed transaction activity threshold. 193For example, in Sept. 2022, one broker-dealer executed a greater proportion of shares in NMS stocks than all but two national securities exchanges. See, e.g., FINRA, OTC Transparency Data, available at https://otctransparency.finra.org/ otctransparency; CBOE, Historical Market Volume Data, available at https://www.cboe.com/us/ equities/market_statistics/historical_market_ volume/. 194As discussed further below in this section, the Commission estimates that six firms would satisfy the 10% options transaction activity threshold. 195As discussed further below in this section, the Commission estimates that four firms would satisfy the 10% U.S. Treasury Security transaction activity threshold, and six firms would satisfy the 10% Agency Security transaction activity threshold. 196As discussed further below, the Commission proposes that average daily dollar volume be the denominator used as the scaling measure for each relevant asset class. See infra notes 211–217 and accompanying text (discussing entities that currently and may in the future receive and make available transaction reports, or aggregated volume statistics in NMS stocks, exchange-listed options, U.S. Treasury Securities, and Agency Securities). 197For example, capacity constraints, whether due to risk management, or operational capability limitations of systems, could limit how much one broker-dealer could handle a sudden increase in order flow from a large broker-dealer. For context, based on analysis of data from the Consolidated Audit Trail, in 2022, two large market makers in NMS stocks engaged in over-the counter transactions (all purchases and all sales effected otherwise than on a national securities exchange or ATS) having a total dollar volume of at least $37 billion on most trading days; with at least a quarter of trading days in 2022 having total dollar volume of $42.3 billion or more, and all trading days having an average total dollar volume of $37.3 billion. Counting volume across all venues (all purchases and all sales effected over-the counter, on a national securities exchange, or on ATS), these figures for the same two firms, respectively, are: at least $82.2 billion, ($67.6 marked as principal/riskless principal) on most trading days; at least $97.1 billion ($83.7 billion marked as principal/riskless principal) on at least a quarter of the trading days; and $83.5
billion ($69.4 billion marked as principal/riskless principal) as the average for all trading days. 198Rule 600 of Regulation NMS defines the term trading center to mean: a national securities Continued Commission believes that systems issues at firms having assets at this level would have the potential to impact investors, the overall market, and the trading of individual securities, and that therefore their market technology should be subject to the requirements and safeguards of Regulation SCI. The threshold is designed to be appropriately high enough to ensure that only the largest broker-dealers are subject to the obligations, and associated burdens and costs, of Regulation SCI. It is also designed to be a relative measure that does not become outdated over time, as the size of the overall market expands or contracts. As noted, the proposed total assets threshold for SCI broker-dealers would include a proposed time period measurement of ‘‘at least two of the four preceding calendar quarters.’’ Requiring that the threshold is met in two out of the four preceding quarters would help mitigate the effect of a steep increase/ decrease in total assets in any individual quarter. Further, this measurement is designed to capture only the broker-dealers that are consistently at or above the proposed five percent threshold, and would not include a broker-dealer that may have had an anomalous quarterly increase, so that a short-term spike in total assets uncharacteristic of the broker-dealer’s overall total asset history would not cause it to become subject to Regulation SCI. Although the Commission is also proposing a time period measurement of ‘‘at least four of the preceding six calendar months’’ for the trading activity thresholds discussed below (consistent with the time period measurement for SCI ATSs),191 using a quarterly measure for the total asset threshold is appropriate because FOCUS reports are required at least quarterly for all broker-dealers and the proposed scaling measure is one that is updated quarterly. Based on its analysis of FOCUS reports during the period from Q4 2021 through Q3 2022, the Commission estimates that five entities would exceed the proposed threshold (with the fifth-ranked firm in each quarter reporting total assets in excess of $300 billion, and all firms ranging from approximately seven to 14 percent of the total assets reported by the Federal Reserve Board for the previous quarter), and further anticipates that this threshold would result in little, if any, variation in which firms exceed the threshold over the course of four calendar quarters.192 Proposed Transaction Activity Threshold In the Commission’s view, a brokerdealer’s transaction activity is another reasonable measure for estimating the significance of a broker-dealer’s role in contributing to fair and orderly markets. In several asset classes, the transaction activity of each of a relatively small number of broker-dealers constitutes a share of
trading that could, if affected by a systems issue, negatively impact fair and orderly markets. For example, in NMS stocks, some broker-dealers constitute significant concentrations of on-exchange trading, and some brokerdealers execute off-exchange transactions at levels that rival or exceed the volume of trading on current SCI entities.193 For listed options, which are required to execute on a national securities exchange, a small number of firms participate in a high proportion of trades.194 Similarly, transaction reporting data for U.S. Treasury Securities and Agency Securities reveal that a handful of broker-dealers each represent a significant percentage of the average weekly (for U.S. Treasury Securities) or daily (for Agency Securities) dollar volume reported by FINRA (currently the only SRO to which such transactions are reported).195 Accordingly, the Commission is proposing to include as an SCI entity any registered broker-dealer that, irrespective of the size of its balance sheet, consistently engages in transaction activity at a substantially high level in certain enumerated asset classes, scaled as a percentage of total average daily dollar volume over a specified time period.196 If a significant systems issue at a broker-dealer that meets the proposed thresholds were to occur, the concern is that its effect would have widespread impact, for example, by impeding the ability of other market participants to trade securities in one or more of the identified asset classes, interrupting the price discovery process, or contributing to capacity issues at other brokerdealers. Further, if executions were delayed by a systems disruption in an SCI broker-dealer’s trading, order routing, clearance and settlement, or market data system, due to the magnitude of the proposed covered transaction activity in which these firms consistently engage, the delay could have cascading effects disruptive to the broader market.197 The proposed transaction thresholds are broadly similar across different types of securities. However, because of differences in market structure, there are notable differences in the application of the thresholds across types of securities. Regulation SCI currently applies to, among other entities, national securities exchanges for both listed equities and listed options, and to ATSs trading significant volume in NMS stocks. A national securities exchange and an ATS are a type of ‘‘trading center,’’ as that term is defined in 17 CFR 242.600 through 242.614 (‘‘Regulation NMS’’).198 For purposes of counting

exchange or national securities association that operates an SRO trading facility, an alternative trading system, an exchange market maker, an OTC market maker, or any other broker or dealer that executes orders internally by trading as principal or crossing orders as agent. 17 CFR 242.600(b)(95). 199See 17 CFR 242.600(a)(95), defining ‘‘trading center’’ to include, among other entities, ‘‘an OTC market maker, or any other broker or dealer that executes orders internally by trading as principal or crossing orders as agent.’’ 200 In some cases, matching of orders for exchange-listed options occur on an ATS, with matches then routed to one or more national securities exchange for execution. 201See Government Securities ATS Reproposal, supra note 84. 202The proposed definition of SCI broker-dealer does not include a transaction activity threshold for equity securities that are not NMS stocks and for which transactions are reported to an SRO as a category in the proposed transaction activity threshold. The size of this market, as currently measured, is substantially smaller than the other asset classes enumerated. Based on its analysis of data from the Consolidated Audit Trail, between Oct. 2021 and Sept. 2022, for example, the average daily dollar volume for this market segment was approximately $2.6 billion. Nor do the proposed amendments to Regulation SCI include Fixed Income ATSs or broker-dealers that exceed a transaction activity threshold in corporate debt or municipal securities. But see infra section III.A.3 (requesting comment on the matter). 203The Commission believes that the terms NMS stock and exchange-listed options are currently well understood. See Rule 600 of Regulation NMS (defining the terms NMS stock and NMS security and distinguishing NMS stocks from listed options on the basis of how transaction reports are made available). 204See FINRA Rules 6710(l) and 6710(p). FINRA Rule 6710 also establishes which securities are eligible for transaction reporting to the ‘‘Trade Reporting and Compliance Engine’’ (TRACE), which is the automated system developed by FINRA that, among other things, accommodates reporting and dissemination of transaction reports where applicable. 205See Rule 1000 (definition of ‘‘SCI ATS’’). 206As described further above and below, the proposed threshold for NMS stocks would operate slightly differently. 207The volume for that trade, as reported through an effective transaction reporting plan, would still be included in the overall calculation of market volume used as the denominator in threshold calculations. transaction activity in NMS stocks, the proposed thresholds are anchored to broker-dealer activity conducted on or as a trading center. Therefore, the Commission is proposing, with respect to the transaction thresholds for NMS stocks, to include broker-dealer activity on national securities exchanges and NMS Stock ATSs, as well as brokerdealer activity as a trading center. Broker-dealer activity ‘‘as a
trading center’’ refers in this context to trading activity in NMS stocks not effected on a national securities exchange or on an ATS, but by the broker-dealer, where the broker-dealer is the executing party, either as principal or as agent.199 A similar distinction is not made for exchange-listed options contracts because those transactions are executed on a national securities exchange.200 The ‘‘trading center’’ term in Regulation NMS applies only to NMS securities; however, there exist today electronic venues for fixed income securities that perform similar functions as trading centers and that are equally important to investors to execute trades in fixed income securities. Such electronic trading venues, particularly for U.S. Treasury Securities and Agency Securities (where electronic trading is prevalent 201), have developed from a market structure in which electronic bilateral trading was and continues to be important. For this reason, the Commission is proposing to include under the SCI broker-dealer threshold all trades for U.S. Treasury Securities and Agency Securities in which a broker-dealer may participate. As proposed, an ‘‘SCI broker-dealer’’ would include a broker-dealer that, during at least four of the preceding six calendar months: (i) with respect to transactions in NMS stocks, transacted average daily dollar volume in an amount that equals ten percent (10%) or more of the average daily dollar volume reported by or pursuant to applicable effective transaction reporting plans, provided, however, that for purposes of calculating its activity in transactions effected otherwise than on a national securities exchange or on an alternative trading system, the broker-dealer shall exclude transactions for which it was not the executing party; (ii) with respect to transactions in exchange-listed options contracts, transacted average daily dollar volume in an amount that equals ten percent (10%) or more of the average daily dollar volume reported by an applicable effective national market system plan; (iii) with respect to transactions in U.S. Treasury Securities, transacted average daily dollar volume in an amount that equals ten percent (10%) or more of the total average daily dollar volume made available by the self-regulatory organizations to which such transactions are reported; or (iv) with respect to transactions in Agency securities, transacted average daily dollar volume in an amount that equals ten percent (10%) or more of the total average daily dollar volume made available by the self-regulatory organizations to which such transactions are reported.202 The Commission proposes to add a definition of ‘‘U.S. Treasury Security’’ and ‘‘Agency Security’’ to clarify how the transaction activity threshold for these asset classes would operate.203 A ‘‘U.S. Treasury Security’’ would mean a security issued by the U.S. Department of the Treasury. ‘‘Agency Security’’ would mean a debt security issued or guaranteed by a U.S. executive
agency, as defined in 5 U.S.C. 105, or government-sponsored enterprise, as defined in 2 U.S.C. 622(8). These definitions are designed to provide the scope of securities an SCI broker-dealer must include when assessing whether it has satisfied the proposed transaction activity threshold. The proposed definitions are similar to and consistent with those in FINRA’s rules,204 to avoid confusion and facilitate the comparison between data used to create the numerator and denominator when assessing whether a broker-dealer surpassed the U.S. Treasury Security or Agency Security transaction thresholds. As is the case currently for the thresholds applicable to SCI ATSs,205 the proposed thresholds for SCI brokerdealers would include a proposed time period measurement of ‘‘at least four of the preceding six calendar months.’’ Specifically, the proposed time measurement period is designed to capture broker-dealers that consistently meet the proposed thresholds and not capture broker-dealers with relatively low transaction activity that may have had an anomalous increase in trading on a given day or few days. In other words, a short-term spike in transaction activity uncharacteristic of a broker-dealer’s overall activity should not cause it to become subject to Regulation SCI; using the proposed time period of at least four of the preceding six calendar months would help ensure this. The proposed thresholds would generally take into account all of a broker-dealer’s transactions.206 The thresholds proposed are designed to identify firms whose transaction activity is of such a magnitude that a systems issue negatively impacting that activity could contribute to a disruption in fair and orderly markets, and for which the application of Regulation SCI is therefore appropriate. With respect to NMS stocks, only transactions which the broker-dealer (i) trades on a national securities exchange or an ATS, or (ii) executes off of a national securities exchange or an ATS would be counted. When a brokerdealer is the non-executing counterparty to an off-exchange, non-ATS transaction that transaction would not be counted for that broker-dealer.207 The purpose of this approach is to count towards the threshold for NMS stocks broker-dealer activity on or as a trading center. To assess whether it satisfies the proposed thresholds, a broker-dealer would need to determine its average daily dollar volume in an enumerated asset class each calendar month, and

208For NMS stocks, this would exclude those purchases or sales off-exchange and not effected through an ATS, in which the broker-dealer was not the executing party. As specific examples, when broker-dealer A routes a customer order to brokerdealer B for routing and execution, and brokerdealer B executes the customer order as principal or crosses it against another order it is holding, the volume for that order would contribute towards the threshold for broker-dealer B but not for brokerdealer A. Similarly, if broker-dealer A sends an order to the single-dealer platform operated by broker-dealer B, and broker-dealer B executes a trade against that order, the volume would contribute towards the threshold for broker-dealer B but not for broker-dealer A. For any asset class, the proposed definition of SCI broker-dealer would not exclude from a broker-dealer operator’s transaction tally transactions executed on its own ATS. For example, if the broker-dealer operator trades as a participant on its ATS, or where a broker-dealer operator acts as a counterparty to every trade on its own ATS, its volume would be counted as trading activity of the broker-dealer. 209See 17 CFR 240.17a–3(a)(6) (requiring a broker-dealer to keep a memorandum of each brokerage order given or received for the purchase or sale of a security, to include the price at which the order executed); 17 CFR 240.17a–3(a)(7) (requiring a memorandum of purchases and sales of a security for its own account, to include the price). 210See supra note 20 and infra note 211. See also infra note 262 (stating that an ATS that trades NMS stocks is subject to Regulation SCI if its trading volume reaches: (i) 5% or more in any single NMS stock and 0.25% or more in all NMS stocks of the average daily dollar volume reported by applicable transaction reporting plans; or (ii) 1% or more in all NMS stocks of the average daily dollar volume reported by applicable transaction reporting plans). 211With respect to NMS stocks, Rule 601 of Regulation NMS (17 CFR 242.601) requires national securities exchanges and national securities associations to report transactions and last sale data pursuant to an effective transaction reporting plan filed with the Commission in accordance with 17 CFR 242.608 (‘‘Rule 608’’ of Regulation NMS). See 17 CFR 242.601. The national securities exchanges and FINRA comply with Rule 601 by satisfying the requirements of Rule 603(b) of Regulation NMS (which requires the national securities exchanges and FINRA to act jointly pursuant to one or more effective national market system plans, to disseminate consolidated information, including transactions, in NMS stocks). Currently, transaction information is consolidated by the (exclusive) plan processor of each effective national market system plan (i.e., the CTA/CQ Plan and Nasdaq UTP Plan for NMS stocks). See CTA Plan, available at https:// www.ctaplan.com; Nasdaq UTP Plan, available at https://www.utpplan.com. After the implementation
of the Market Data Infrastructure rules (see Market Data Infrastructure Adopting Release, supra note24) national securities exchanges and FINRA will be required to provide transaction reports to competing consolidators and/ or self-aggregators pursuant to new effective national market system plans that satisfy the requirements of Rule 603(b). Pursuant to 17 CFR 242.600(a)(14) (Rule 600(a)(14) of Regulation NMS) the term ‘‘competing consolidator’’ means a securities information processor required to be registered pursuant to Rule 614 of Regulation NMS or a national securities exchange or national securities association that receives information with respect to quotations for and transactions in NMS stocks and generates a consolidated market data product for dissemination to any person. Pursuant to 17 CFR 242.600(a)(83) (Rule 600(a)(83) of Regulation NMS) the term ‘‘self-aggregator’’ means a broker, dealer, national securities exchange, national securities association, or investment adviser registered with the Commission that receives information with respect to quotations for and transactions in NMS stocks, including all data necessary to generate consolidated market data, and generates consolidated market data solely for internal use (with a proviso that a self-aggregator may make consolidated market data available to its affiliates that are registered with the Commission for their internal use). See Market Data Infrastructure Adopting Release, supra note 24 (providing a full discussion of these terms). Following implementation of the Market Data Infrastructure rules, a broker-dealer may obtain consolidated average daily dollar volume from its chosen competing consolidator, or independently calculate that figure itself, as a ‘‘self-aggregator.’’ 212See OPRA Plan, available at https:// www.opraplan.com. 213However, should a national securities exchange (an SRO) trade U.S. Treasury or Agency Securities in the future, if transaction reports are made available by that SRO, they would be relevant to determining consolidated average daily dollar volume. 214See FINRA, Trade Reporting and Compliance Engine (TRACE), available at https://www.finra.org/ filing-reporting/trace. FINRA Rule 6730(a)(1) requires FINRA members to report transactions in TRACE-Eligible Securities, which FINRA Rule 6710 defines to include U.S. Treasury Securities and Agency Securities. For each transaction in U.S. Treasury Securities and Agency Securities, a FINRA member would be required to report the CUSIP number or similar numeric identifier or FINRA symbol; size (volume) of the transaction; price of the transaction (or elements necessary to calculate price); symbol indicating whether transaction is a buy or sell; date of trade execution (‘‘as/of’’ trades only); contra-party’s identifier; capacity (principal or agent); time of execution; reporting side executing broker as ‘‘give-up’’ (if any); contra side introducing broker (in case of ‘‘give-up’’ trade); the commission (total
dollar amount), if applicable; date of settlement; if the member is reporting a transaction that occurred on an ATS pursuant to FINRA Rule 6732, the ATS’s separate Market Participant Identifier (‘‘MPID’’); and trade modifiers as required. For when-issued transactions in U.S. Treasury Securities, a FINRA member would be required to report the yield in lieu of price. See FINRA Rule 6730(c). 215See FINRA Rule 6750(a). 216See Securities Exchange Act Release No. 95438 (Aug. 5, 2022), 87 FR 49626 (Aug. 11, 2022) (Order Approving a Proposed Rule Change to Amend FINRA Rule 6750 Regarding the Publication of Aggregated Transaction Information on U.S. Treasury Securities). The implementation date for these TRACE enhancements for U.S. Treasury Securities was Feb. 13, 2023, at which point the weekly data reports were replaced with daily and monthly reports. Using daily reports of U.S. Treasury Security data, broker-dealers should have the information necessary to complete the calculations needed to assess if they satisfy the proposed threshold. divide that figure by the total reported average daily dollar volume for that month. More specifically, its numerator would be the average daily dollar volume during the calendar month, taking into account all relevant purchase and sale transactions 208 in which the broker-dealer engaged during that calendar month, as determined by the broker-dealer from information in its books and records, as required to be kept pursuant to Exchange Act Rule 17a–3.209 The denominator would be the total average daily dollar volume for each calendar month, as that total is determined from one or more sources that receive and make available transaction reports, or, as the case may be, aggregated price and volume statistics. With respect to NMS stocks, information necessary to calculate the denominator currently is available from the plan processors (i.e., the SIPs) of the CTA/CQ Plans and Nasdaq UTP Plan. These Plans are effective transaction reporting plans, and effective national market systems plans.210 Following implementation of the Market Data Infrastructure rules, the information necessary to calculate the denominator would be available from a competing consolidator or may be self-determined by a self-aggregator that obtains the information pursuant to effective transaction reporting plans, as required by 17 CFR 242.601 (‘‘Rule 601’’ of Regulation NMS) and 17 CFR 242.603(b) (‘‘Rule 603(b)’’ of Regulation NMS).211 For listed options, total average daily dollar volume may be determined from consolidated information made available by the plan processor of the OPRA Plan.212 With respect to U.S. Treasury Securities and Agency Securities, total average daily dollar volume may be determined from information made available by SROs to which transactions in U.S. Treasury Securities and Agency Securities are reported. Currently there is only one SRO to which this information is reported: FINRA.213 In connection with its TRACE system, FINRA
is currently the most complete source of aggregate volume in U.S. Treasury Securities and Agency Securities.214 Specifically, FINRA Rule 6750(a) requires FINRA to disseminate information on Agency Securities, immediately upon receipt of the transaction report.215 With respect to U.S. Treasury Securities, information in TRACE regarding individual transactions is for regulatory purposes only and is not disseminated publicly. However, pursuant to FINRA Rule 6750, on March 10, 2020, FINRA began posting on its website weekly, aggregate data on the trading volume of U.S. Treasury Securities reported to TRACE, and the Commission recently approved website posting of aggregate data more frequently (i.e., daily).216 Notwithstanding the transparency provided by FINRA/TRACE, aggregate trading volume in U.S. Treasury and Agency securities does not purport to reflect the whole of these markets, as aggregate volume statistics are limited to volume reported by TRACE reporters, including ATSs, registered-broker dealers that are members of FINRA, and

217See Federal Reserve Board, Agency Information Collection Activities: Announcement of Board Approval Under Delegated Authority and Submission to OMB (Oct. 21, 2021) 86 FR 59716 (Oct. 28, 2021). 218Transaction reporting systems generally report volume for trades, rather than volume for purchase and sales separately. Consequently, adding up the total purchase and sale activity for all brokerdealers will not equal the total volume reported through these systems. For example, a trade for 100 shares of an NMS stock between two broker-dealers on a national securities exchange would be reported by the effective transaction reporting plan as 100 shares, even though one broker-dealer bought 100 shares and another sold 100 shares. Similarly, because broker-dealers often trade with customers, doubling the transaction volume reported through these systems does not provide an accurate measure of total broker-dealer purchase and sale activity. After the implementation of the Market Data Infrastructure rules (see Market Data Infrastructure Adopting Release, supra note 24) national securities exchanges on which NMS stocks are traded and FINRA, each of which is required by Rule 601 of Regulation NMS to file a transaction reporting plan in accordance with Rule 608 of Regulation NMS, will be further required, pursuant to Rule 603(b) of Regulation NMS, to make available to all competing consolidators and self-aggregators its information with respect to quotations for and transactions in NMS stocks, including all data necessary to generate consolidated market data. Following implementation of the Market Data Infrastructure rules, a broker-dealer may determine average daily dollar volume from information provided by its chosen competing consolidator, or independently calculate that figure itself, as a ‘‘self-aggregator.’’ 219See supra text accompanying notes 189–190. 220See supra notes 37–38 and 36 and accompanying text (discussing the scope of the current definition of ‘‘SCI systems’’). depository institutions meeting transaction volume thresholds in U.S. Treasury Securities, agency-issued debt and mortgage-backed securities.217 Counting all relevant purchases and sales from all broker-dealers may result in counting a transaction more than once across the market, and would sum to total volume across broker-dealers that exceeds what is reported pursuant to the relevant plans or SRO. Similarly, summing the percentages that result from dividing the total activity of each broker-dealer by the total volume reported by the relevant plans or SRO would result in a value greater than 100 percent.218 Accordingly, the proposed ten percent (10%) transaction activity thresholds for measuring a brokerdealer’s significance in the markets are not market share thresholds analogous to the current SCI ATS volume thresholds. However, because the types of transactions proposed to be counted are a measure of a broker-dealer’s size and significance, it is particularly useful if that
measure continues to reflect significant activity as the size of the overall market expands or contracts and remains stable relative to a recognizable measure so that it does not become outdated over time. Therefore, the Commission proposes as a denominator a measure that would scale each brokerdealer’s average daily dollar transaction volume to consolidated average daily dollar transaction volume, the latter being determinable from information reported by, or made available by or pursuant to, applicable effective transaction reporting or national market system plans or self-regulatory organizations, as described above. Any broker-dealer that transacts, as proposed, ten percent (10%) or more of the average daily dollar volume in an enumerated asset class, during at least four of the preceding six calendar months would be an SCI broker-dealer. The proposed trading activity thresholds are designed to measure the size of a broker-dealer’s footprint in the market in terms that provide a method for assessing the size of its footprint as the market grows (or shrinks). In this way, the proposed thresholds identify broker-dealers by their transaction activity as compared to a consistent measure of market volume, and give a sense of the size and significance of a broker-dealer activity in the markets in a manner that should not become outdated over time. The Commission also believes that a threshold of ten percent (10%) or more in the identified asset classes is appropriately high enough to apply Regulation SCI only to the large brokerdealers on which the maintenance of fair and orderly markets depend. The Commission estimates that 17 entities would satisfy one or more of the proposed transaction activity thresholds (the same five entities identified by the total assets threshold plus 12 additional entities).219 In sum, the Commission believes that the proposed total assets threshold and transaction activity thresholds are appropriate measures for identifying broker-dealers that would pose a substantial risk to the maintenance of fair and orderly markets in the event of a systems issue. SCI broker-dealers would not have to comply with the requirements of Regulation SCI until six months after the end of the quarter in which the SCI broker-dealer satisfied the proposed asset threshold for the first time, or six months after the end of the month in which the SCI broker-dealer satisfied one of the proposed activity thresholds for the first time. The Commission believes this is an appropriate amount of time for firms to come into compliance with Regulation SCI.
iv. Proposed Revision to Definition of
‘‘SCI Systems’’ for Certain SCI BrokerDealers; SCI Entities Trading Multiple Asset Classes, Which May Include Crypto Asset Securities In conjunction with the proposed inclusion of SCI broker-dealers as SCI entities, the Commission proposes to limit the definition of ‘‘SCI systems’’ for an SCI broker-dealer that qualifies as an SCI entity only because it satisfies a transaction activity threshold. Specifically, the Commission is proposing to revise the definition of ‘‘SCI systems’’ to add a limitation that states, ‘‘provided, however, that with respect to an SCI broker-dealer that satisfies only the requirements of paragraph (2) of the definition of ‘SCI broker-dealer,’ such systems shall include only those systems with respect to the type of securities for which an SCI broker-dealer satisfies the requirements of paragraph (2) of the definition.’’ The current definition of ‘‘SCI systems’’ does not contain the limitation that is proposed for SCI broker-dealers. For example, an SCI ATS that exceeds the average daily dollar volume threshold for NMS stocks is subject to Regulation SCI requirements for all of its SCI systems (i.e., that meet the definition of SCI systems discussed in
section II.B.1 above) and indirect SCI
systems. Thus, to the extent that the SCI systems and indirect SCI systems of an SCI ATS (or any other SCI entity) relate to equity securities that are non-NMS stocks, exchange-listed options, debt securities, security-based swaps, or any other securities, including crypto asset securities, such systems are subject to the Regulation SCI requirements.220 As it considers the expansion of Regulation SCI to broker-dealers, many of which operate multiple business lines and transact in different types of securities, the Commission preliminarily believes that an SCI broker-dealer that qualifies as an SCI entity based only on a transaction activity threshold for a particular type of security should have its obligations limited to systems with respect to that type of security. If a broker-dealer meets only the transaction activity threshold for NMS stocks, for example, its systems that directly support trading, clearance and settlement, order routing, market data, market regulation, or market surveillance for NMS stocks are those that raise the concerns Regulation SCI is meant to address. If the broker-dealer’s activity with respect to other classes of securities is nominal, it is unlikely to pose risk to the maintenance of fair and orderly markets if the systems with respect to those types of securities were unavailable (assuming the systems for the distinct asset class are separate). If a system of the broker-dealer is used for

221For example, if a broker-dealer operator of an SCI ATS uses an SCI system to trade both a type of security that triggered the SCI threshold and a type of security that did not trigger the threshold, that system will be an SCI system for both types of securities. A broker-dealer operator of such SCI ATS could wish to use the SCI system only for trading the type of security that triggered the SCI threshold and create a separate system only to trade the type of security that did not trigger the SCI threshold. 222See, e.g., Fin. Stability Oversight Council, Report on Digital Asset Financial Stability Risks and Regulation 119 (2022) (‘‘FSOC Report’’), available at https://home.treasury.gov/system/files/ 261/FSOC-Digital-Assets-Report-2022.pdf (‘‘The crypto-asset ecosystem is characterized by opacity that creates challenges for the assessment of financial stability risks.’’); U.S. Dep’t of the Treasury, Crypto-Assets: Implications for Consumers, Investors, and Businesses 12 (Sept.
2022) (‘‘Crypto-Assets Treasury Report’’), available
at https://home.treasury.gov/system/files/136/ CryptoAsset_EO5.pdf (finding that data pertaining to ‘‘off-chain activity’’ is limited and subject to voluntary disclosure by trading platforms and protocols, with protocols either not complying with or not subject to obligations ‘‘to report accurate trade information periodically to regulators or to ensure the quality, consistency, and reliability of their public trade data’’); Fin. Stability Bd., Assessment of Risks to Financial Stability from Crypto-assets 18–19 (Feb. 16, 2022) (‘‘FSB Report’’), available at https://www.fsb.org/wp-content/ uploads/P160222.pdf (finding that the difficulty in aggregating and analyzing available data in the crypto asset space ‘‘limits the amount of insight that can be gained with regard to the [crypto asset] market structure and functioning,’’ including who the market participants are and where the market’s holdings are concentrated, which, among other things, limits regulators’ ability to inform policy and supervision); Raphael Auer et al., Banking in the Shadow of Bitcoin? The Institutional Adoption of Cryptocurrencies 4, 9 (Bank for Int’l Settlements, Working Paper No. 1013, May 2022), available at https://www.bis.org/publ/work1013.pdf (stating that data gaps, which can be caused by limited disclosure requirements, risk undermining the ability for holistic oversight and regulation of cryptocurrencies); Int’l Monetary Fund, The Crypto Ecosystem and Financial Stability Challenges, in Global Financial Stability Report 41, 47 (Oct. 2021), available at https://www.imf.org/-/media/Files/ Publications/GFSR/2021/October/English/ch2.ashx (finding that crypto asset service providers provide limited, fragmented, and, in some cases, unreliable data, as the information is provided voluntarily without standardization and, in some cases, with an incentive to manipulate the data provided). 223For background on Rule 15c3–3 as it relates to digital asset securities, see Commission, Joint Staff Statement on Broker-Dealer Custody of Digital Asset Securities (July 8, 2019), available at https:// www.sec.gov/news/public-statement/joint-staffstatement-broker-dealer-custody-digital-assetsecurities; FINRA, SEC Staff No-Action Letter, ATS Role in the Settlement of Digital Asset Security Trades (Sept. 25, 2020), available at https:// www.sec.gov/divisions/marketreg/mr-noaction/ 2020/finra-ats-role-in-settlement-of-digital-assetsecurity-trades-09252020.pdf. To date, five offerings of crypto asset securities have been registered or qualified under the Securities Act of 1933, and five classes of crypto asset securities have been registered under the Exchange Act. The Commission issued a statement describing its position that, for a period of five years, special purpose broker-dealers operating under the circumstances set forth in the statement will not be subject to a Commission enforcement action on the basis that the broker-dealer deems itself to have obtained and maintained physical
possession or control of customer fully paid and excess margin digital asset securities for purposes of 17 CFR 240.15c3–3(b)(1) (‘‘Rule 15c3–3(b)(1)’’ under the Exchange Act). See Crypto Asset Securities Custody Release, supra note 37. To date, no such special purpose broker-dealer registration applications have been granted by FINRA. 224ATSs that do not trade NMS stocks file with the Commission a Form ATS notice, which the Commission does not approve. Form ATS requires, among other things, that ATSs provide information about: classes of subscribers and differences in access to the services offered by the ATS to different groups or classes of subscribers; securities the ATS expects to trade; any entity other than the ATS involved in its operations; the manner in which the system operates; how subscribers access the trading system; procedures governing entry of trading interest and execution; and trade reporting, clearance, and settlement of trades on the ATS. In addition, all ATSs must file quarterly reports on Form ATS–R with the Commission. Form ATS–R requires, among other things, volume information for specified categories of securities, a list of all securities traded in the ATS during the quarter, and a list of all subscribers that were participants. To the extent that an ATS trades crypto asset securities, the ATS must disclose information regarding its crypto asset securities activities as required by Form ATS and Form ATS–R. Form ATS and Form ATS–R are deemed confidential when filed with the Commission. Based on information provided on these forms, a limited number of ATSs have noticed on Form ATS their intention to trade certain crypto asset securities and a subset of those ATSs have reported transactions in crypto asset securities on their Form ATS–R. See also supra note 223, referencing, Commission, Joint Staff Statement on Broker-Dealer Custody of Digital Asset Securities (July 8, 2019), available at https://www.sec.gov/ news/public-statement/joint-staff-statement-brokerdealer-custody-digital-asset-securities; FINRA, SEC Staff No-Action Letter, ATS Role in the Settlement of Digital Asset Security Trades (Sept. 25, 2020), available at https://www.sec.gov/divisions/ marketreg/mr-noaction/2020/finra-ats-role-insettlement-of-digital-asset-security-trades09252020.pdf. 225See also FSOC Report, supra note 222, at 5, 87, 94, 97 (emphasizing the importance of the existing financial regulatory structure while stating that certain digital asset platforms may be listing securities while not in compliance with exchange, broker-dealer, or other registration requirements, which may impose additional risk on banks and investors and result in ‘‘serious consumer and investor protection issues’’); Crypto-Assets Treasury Report, supra note 222, at 26, 29, 39, 40 (stating that issuers and platforms in the digital asset ecosystem may be acting in non-compliance with statutes and regulations governing traditional capital markets, with market participants
that actively dispute the application of existing laws and regulations, creating risks to investors from non-compliance with, in particular, extensive disclosure requirements and market conduct standards); FSB Report, supra note 222, at 4, 8, 18 (stating that some trading activity in crypto assets may be failing to comply with applicable laws and regulations, while failing to provide basic investor protections due to their operation outside of or in non-compliance with regulatory frameworks, thereby failing to provide the ‘‘market integrity, investor protection or transparency seen in appropriately regulated and supervised financial markets’’). 226But see supra section II.B.1 (discussing how current SCI entities that trade crypto asset securities must assess whether their systems for trading crypto asset securities are SCI systems). As a specific example, if an SCI SRO were to obtain Commission approval to add a crypto asset security trading facility, that facility would be part of an SCI SRO that is subject to Regulation SCI. more than one type of securities (i.e., an asset class that triggered the threshold and an asset class that did not or is not subject to SCI thresholds), such system would still meet the definition of ‘‘SCI system.’’ 221 Current SCI entities are and will continue to be, and proposed SCI entities other than SCI broker-dealers that satisfy a transaction activity threshold would be, required to assess whether the technology systems of, or operated by or on their behalf, with respect to any type of security (including crypto asset securities, discussed further below) are SCI systems covered by Regulation SCI because they directly support: (i) trading; (ii) clearance and settlement; (iii) order routing; (iv) market data; (v) market regulation; or (vi) market surveillance.
v. Crypto Asset Securities
Public information about the size and characteristics of the crypto asset securities market is limited.222 However, the Commission, currently understands that only a small portion of crypto asset security trading activity is occurring within Commission registered entities, and particularly, registered broker-dealers. This may be due in part to the fact that there are currently no special purpose broker-dealers authorized to maintain custody of crypto asset securities.223 Without the ability to custody a customer’s cryptoasset securities, a broker-dealer is limited in the amount of agency business in crypto-asset securities that it could do. Similarly, today, only a limited amount of crypto asset security volume occurs on ATSs operating pursuant to the Regulation ATS exemption.224 This may be due in part to the significant trading activity in crypto asset securities that may be in non-compliance with the federal securities laws.225 Nonetheless, if an SCI entity (current or proposed) trades crypto asset securities, the systems used for trading crypto asset securities may currently and in the future be subject to the requirements of Regulation SCI.226 SCI Broker-Dealer Activity in Crypto Asset Securities As discussed above, the Commission is proposing to include as SCI entities large broker-dealers: those that satisfy a total assets threshold or a transaction activity threshold. The total assets threshold applies to broker-dealers irrespective of asset classes in which they conduct significant transaction activity. In contrast, the proposed transaction activity threshold specifies four enumerated asset classes: NMS stocks, exchange-listed options, U.S.

227Likewise, an ATS currently is an SCI ATS if it satisfies a trading volume threshold for NMS stocks or equity securities that are not NMS stocks. For purposes of assessing whether it meets an SCI ATS trading volume threshold, an ATS needs to consider if it trades crypto asset securities that are equity securities; and if it does trade such securities, those transactions need to be included in its transaction tally as (i) NMS stocks or (ii) equity securities that are not NMS stocks, as they case may be, in order to calculate the volume threshold. Additionally, the definition of SCI systems and indirect SCI systems do not contain an asset class limitation with respect to SCI SROs (or any other current SCI entity). See supra note 36 and accompanying text. Treasury Securities, and Agency Securities. The proposal would affect an SCI broker-dealer that engages in crypto asset security activity as follows: for purposes of assessing whether it meets a transaction activity threshold, a broker-dealer would need to consider if it trades crypto asset securities that are NMS stocks, exchange-listed options, U.S. Treasury Securities, or Agency securities, and if so, include those transactions in its transaction tally of NMS stocks, exchange-listed options, U.S. Treasury Securities, or Agency securities, to assess if it satisfies one or more of the proposed thresholds. In addition, as proposed, the SCI systems and indirect SCI systems pertaining to crypto asset securities that are NMS stocks, exchange-listed options, U.S. Treasury Securities, or Agency securities would be subject to Regulation SCI, including as it is proposed to be amended, as discussed in section III.C, with respect to the asset class for which the SCI broker-dealer satisfies the transaction activity threshold. Furthermore, as proposed, an SCI broker-dealer that meets the proposed total assets threshold would need consider its crypto asset security activities and assess whether any systems pertaining to crypto asset securities meet the current definition of SCI systems or indirect SCI systems. Any such systems would be subject to Regulation SCI, including as it is proposed to be amended, as discussed in section III.C.227
vi. Request for Comment
9. Should Regulation SCI apply to
broker-dealers? If not, why not? If so, should Regulation SCI apply to all broker-dealers, or just a subset? Please explain. At what size or level of a broker-dealer’s activity would market integrity or the protection of investors be affected if the broker-dealer were no longer able to operate due to a systems disruption, systems compliance issue, or a systems intrusion? Are brokerdealers subject to more market discipline than current SCI entities? Please explain. Conversely, does a lack of transparency regarding events like SCI events limit this market discipline? Why or why not?
10. Would it be more appropriate to
define an SCI broker-dealer using an approach that identifies a broker-dealer by category, rather than by size? For example, what are commenters’ views on the impact to overall market integrity or the protection of investors if an OTC market maker was no longer able to operate due to a systems disruption, systems compliance issue, or a systems intrusion? Or an exchange market maker? Or a clearing broker-dealer? What are commenters’ views on the importance of different categories of broker-dealers to the stability of the overall U.S. securities market infrastructure, in the context of requiring them to comply with Regulation SCI? What risks do the systems of broker-dealers pose to the U.S. securities markets?
11. If the Commission were to identify
an SCI broker-dealer by category, rather than by size, which categories should be covered and how should they be defined? For example, if commenters believe that Regulation SCI should apply to significant ‘‘OTC market makers,’’ how should they be defined? Is it sufficiently clear which entities are ‘‘OTC market makers,’’ as that term is defined under the Exchange Act? If not, why not? If so, should a threshold be used to identify those that are the most significant? What should that threshold be and how should it be calculated?
12. Is the current broker-dealer
regulatory regime, including the Market Access Rule and other Commission and FINRA rules, sufficient to reasonably ensure the operational capability of the technological systems of the proposed SCI broker-dealers?
13. As discussed above, an SCI
broker-dealer would be a broker-dealer registered with the Commission pursuant to section 15(b) of the Exchange Act, which: (1) in at least two of the four preceding calendar quarters, ending March 31, June 30, September 30, and December 31, reported to the Commission on Form X–17A–5 total assets in an amount that equals five percent (5%) or more of the quarterly total assets level of all security brokers and dealers; or (2) during at least four of the preceding six calendar months: (i) with respect to transactions in NMS stocks, transacted average daily dollar volume in an amount that equals ten percent (10%) or more of the average daily dollar volume reported by or pursuant to applicable effective transaction reporting plans, provided, however, that for purposes of calculating its activity in transactions effected otherwise than on a national securities exchange or on an ATS, the broker-dealer shall exclude transactions for which it was not the executing party; (ii) with respect to transactions in exchange-listed options contracts, transacted average daily dollar volume reported by an applicable effective national market system plan; (iii) with respect to transactions in U.S. Treasury Securities, transacted average daily dollar volume in an amount that equals ten percent (10%) or more of the total average daily dollar volume made available by the self-regulatory organization to which such transactions are reported; or (iv) with respect to transactions in Agency Securities, transacted average daily dollar volume in an amount that equals ten percent (10%) or more of the total average daily dollar volume made available by the self-regulatory organization to which such transactions are reported. The Commission solicits comment with respect to all aspects of the proposed definition, including those aspects identified in the succeeding questions.
14. Is the proposed total assets
threshold an appropriate way to identify broker-dealers that would pose a substantial risk to the maintenance of fair and orderly markets in the event of a systems issue?
15. Should the proposed total assets
threshold be scaled using the proposed sources as the denominator? Why or why not? Is use of data made available by the Federal Reserve Board appropriate as the denominator for the measure of all security broker-dealer total assets? If not, what metric, if any, would be appropriate for the Commission to use as the denominator? Should the denominator be different in the event that such data is no longer made available by the Federal Reserve Board? Recognizing that the proposed numeric thresholds ultimately represent a matter of judgment by the Commission as it proposes to apply Regulation SCI to the largest broker-dealers, the Commission solicits comment on the proposed thresholds levels. Is the proposed five percent numeric threshold appropriate? Why or why not? Is the proposed two of the preceding four quarter methodology, with lookback to the previous quarter for the denominator appropriate? Why or why not?
16. Are the proposed transaction
activity thresholds an appropriate way to identify broker-dealers that would pose a substantial risk to the maintenance of fair and orderly markets in the event of a systems issue?

With respect to the proposed
transaction activity thresholds, are the asset classes identified appropriate? Are there asset classes that are included that should be excluded, or asset classes that are excluded that should be included? Which ones and why? For example, should U.S. Treasury Securities and Agency Securities be included? Why or why not? Should OTC equity securities be included? Or security-based swaps? Is the size of the market in each asset class relevant? Why or why not?
With respect to the proposed
transaction activity thresholds, recognizing that the proposed numeric thresholds ultimately represent a matter of judgment by the Commission as it proposes to apply Regulation SCI to the largest broker-dealers, the Commission solicits comment on the proposed threshold levels. Are the 10 percent transaction activity threshold levels proposed appropriate? Would higher or lower thresholds be appropriate? Should thresholds vary based on asset class? Is there a different approach that would be more appropriate?
For purposes of the numerator in
each transaction activity threshold, is use of average daily dollar volume of all purchase and sale transactions, as proposed appropriate? If not, why not? Is there an alternative measure of market activity that could be consistently determined by broker-dealers, as well as the Commission, and that would identify large broker-dealer activity that, if disrupted, could disrupt market functioning more broadly? Would share volume be more appropriate for any of the proposed asset classes?
Is it clear what average daily
dollar volume, as made available by or pursuant to applicable effective transaction reporting plans, would be following implementation of the Market Data Infrastructure rules? Why or why not?
Should the transaction activity
thresholds denominator have a minimum, so that if the market for a particular product shrinks significantly, entities that have a significant portion of that small market would not be scoped into the test? For example, should an options trading activity threshold specify that the threshold is exceeded if average daily dollar volume equals the greater of ten percent (10%) or more of the average daily dollar volume reported by or pursuant to an applicable effective transaction reporting plan, applicable national market system plan, applicable SRO, or $x billion? Why or why not? What would be an appropriate minimum dollar threshold and why? Please be specific.
Is the four out of the preceding
six-month measurement period an appropriate timeframe for the transaction activity thresholds? Why or why not? Is there a different timeframe or approach that would be more appropriate? Please explain.
Do commenters believe that six
months after the end of the quarter in which the broker-dealer satisfies the total assets threshold and six months after the end of the month in which the broker-dealer satisfies the transaction activity threshold constitute an appropriate amount of time to allow them to come into compliance with the requirements of Regulation SCI? Why or why not? Is there a different time period that would be more appropriate? Please explain.
What are the differences between
the current practices of broker-dealers and the practices that would be necessary if the proposed changes to Regulation SCI are adopted? Please describe and be specific.
Should all of the current or newly
proposed requirements set forth in Regulation SCI apply to SCI brokerdealers? If only a portion, please specify which portion(s) and explain why. If all, explain why.
Is it appropriate to limit the
application of the definition of ‘‘SCI systems’’ for SCI broker-dealers that meet the definition of an SCI brokerdealer only because of a transaction activity threshold only to those systems related to the types of securities for which the entity has triggered the threshold, as the Commission is proposing? Why or why not?
Should the definition of SCI
systems as it applies to SCI brokerdealers be modified further than as proposed? Is the limitation of the definition of SCI systems as proposed to apply to SCI broker-dealers (and not applicable to broker-dealers that satisfy the total assets threshold) appropriate? Should the Commission instead provide a unique definition of SCI systems and indirect SCI systems for broker-dealers? If so, what should it be and why? For example, in the context of brokerdealers, would systems that ‘‘directly support trading’’ be a category of systems that is overbroad, or too narrow? Why or why not? Please explain. Are there any types of systems of broker-dealers to which Regulation SCI would apply that should not be covered? Which ones and why? Are there any types of systems of brokerdealers that would not be covered by the definitions of SCI systems and indirect SCI systems as proposed that should be covered? Which types and why? Please be specific.
Is it clear how Regulation SCI
would apply to proposed new SCI entities that trade crypto asset securities? Why or why not? Please be specific.
Are any of the proposed
amendments to Regulation SCI (as discussed in section III.C below) inappropriate for broker-dealers? If so, which ones? As discussed in section III.C.6 below, the Commission proposes to add language to Rule 1002(c) of Regulation SCI regarding dissemination of information about SCI events by an SCI broker-dealer to its ‘‘customers,’’ as a broker-dealer does not have ‘‘members and participants.’’ Should the Commission require an SCI brokerdealer to notify its customers of an SCI event in the same manner as other SCI entities? Why or why not? Should the term ‘‘customers’’ be defined? If so, how? Should Rule 1002(c) be specifically tailored to SCI brokerdealers in a way that differs from the current rule? If so, how? Please be specific. Is the proposed requirement that, pursuant to Rule 1002(b)(4)(ii)(B), notices to the Commission include a copy of the information disseminated to customers appropriate? Why or why not?
Do commenters believe that
different or unique requirements should apply to an SCI broker-dealer or systems of broker-dealers? What should they be, and why?
What effect, if any, would there be
of having the largest broker-dealers subject to Regulation SCI, while others are not? Should the Commission include additional broker-dealers as SCI entities, based on size or function? Why or why not? For example, should the largest carrying broker-dealers, based on a size threshold, be subject to Regulation SCI? If so, should the size threshold be based on total assets or number of customer accounts, or some other metric? If application of all of Regulation SCI is not appropriate for these entities, should they be required to adopt and implement reasonably designed policies and procedures to address their ability to continue to process customer and account transactions in a timely manner during reasonably anticipated surges in demand?
Should the proposed thresholds
take into account whether a brokerdealer is affiliated with another brokerdealer? For example, should the Commission aggregate the transaction activity of affiliated broker-dealers for purposes of determining whether the transaction activity threshold test has been satisfied and, if it has, apply Regulation SCI to each broker-dealer?

228See Rule 1000; SCI Adopting Release, supra note 1, at 72271 (an ‘‘exempt clearing agency subject to ARP’’ is an entity that has received from the Commission an exemption from registration as a clearing agency under section 17A of the Exchange Act, and whose exemption contains conditions that relate to the Commission’s Automation Review Policies, or any Commission regulation that supersedes or replaces such policies (such as Regulation SCI)). 229 17 CFR 240.17Ad–22 (‘‘Rule 17Ad–22’’ under the Exchange Act) provides for two categories of registered clearing agencies and contains a set of rules that apply to each category. The first category is covered clearing agencies, which are subject to 17 CFR 240.17Ad–22(e) (Rule 17Ad–22(e)), which includes requirements intended to address the activity and risks that their size, operation, and importance pose to the U.S. securities markets, the risks inherent in the products they clear, and the goals of both the Exchange Act and the Dodd-Frank Act. See Securities Exchange Act Release No. 78961 (Sept. 28, 2016), 81 FR 70786, 70793 (Oct. 13, 2016) (‘‘CCA Standards Adopting Release’’). Covered clearing agencies are registered clearing agencies that provide central counterparty (‘‘CCP’’) or central securities depository (‘‘CSD’’) services. See 17 CFR 240.17Ad–22(a)(5). A CCP is a type of registered clearing agency that acts as the buyer to every seller and the seller to every buyer, providing a trade guaranty with respect to transactions submitted for clearing by the CCP’s participants. See 17 CFR 240.17Ad–22(a)(2); Securities Exchange Act Release No. 88616 (Apr. 9, 2020), 85 FR 28853, 28855 (May 14, 2020) (‘‘CCA Definition Adopting Release’’). A CCP may perform a variety of risk management functions to manage the market, credit, and liquidity risks associated with transactions submitted for clearing. If a CCP is unable to perform its risk management functions effectively, however, it can transmit risk throughout the financial system. A CSD is a type of registered clearing agency that acts as a depository for handling securities, whereby all securities of a particular class or series of any issuer deposited within the system are treated as fungible. Through use of a CSD, securities may be transferred, loaned, or pledged by bookkeeping entry without the physical delivery of certificates. A CSD also may permit or facilitate the settlement of securities transactions more generally. See 15 U.S.C. 78c(a)(23)(A); 17 CFR 240.17Ad– 22(a)(3); CCA Definition Adopting Release, at
28856. If a CSD is unable to perform these
functions, market participants may be unable to settle their transactions, transmitting risk through the financial system. Currently, all clearing agencies registered with the Commission that are actively providing clearance and settlement services are covered clearing agencies. They are The Depository Trust Company (‘‘DTC’’), FICC, NSCC, ICE Clear Credit (‘‘ICC’’), ICE Clear Europe (‘‘ICEEU’’), The Options Clearing Corporation (‘‘OCC’’), and LCH SA. 230The second category includes registered clearing agencies other than covered clearing agencies; such clearing agencies must comply with 17 CFR 240.17Ad–22(d) (‘‘Rule 17Ad–22(d)’’). See 17 CFR 240.17Ad–22(d). Rule 17Ad–22(d) establishes a regulatory regime to govern registered clearing agencies that do not provide CCP or CSD services. See CCA Standards Adopting Release, at
70793. Although subject to Rule 17Ad–22(d), the
Boston Stock Exchange Clearing Corporation (‘‘BSECC’’) and Stock Clearing Corporation of Philadelphia (‘‘SCCP’’) are currently registered with the Commission as clearing agencies but conduct no clearance or settlement operations. See Securities Exchange Act Release No. 63629 (Jan. 3, 2011), 76 FR 1473, 1474 (Jan. 10, 2011) (‘‘BSECC Notice’’); Securities Exchange Act Release No. 63268 (Nov. 8, 2010), 75 FR 69730, 69731 (Nov. 15, 2010) (‘‘SCCP Notice’’). 231See, e.g., Release No. 79577 (Dec. 16, 2016), 81 FR 93994 (Dec. 22, 2016) (‘‘Euroclear Exemption’’); Release No. 38328 (Feb. 24, 1997), 62 FR 9225 (Feb. 28, 1997) (‘‘Clearstream Exemption’’). To manage the potential risks associated with these functions, the Commission’s exemptions impose volume limits on the amount of transactions in U.S. Government securities for which each entity may perform clearance and settlement. 232See, e.g., Euroclear Exemption, supra note 231 (adding services for collateral management); Release No. 44188 (Apr. 17, 2001), 66 FR 20494 (Apr. 23,
2001) (granting an exemption to provide a central
matching service to Global Joint Venture Matching Services US LLC, now known as DTCC ITP Matching US LLC, to facilitate the settlement of transactions between broker-dealers and their institutional customers) (‘‘ITPM Exemption’’). 233See Securities Exchange Act Release No. 76514 (Nov. 25, 2015), 80 FR 75387, 75401 (Dec. 1, 2015) (granting an exemption to provide matching services to each of Bloomberg STP LLC and SS&C Technologies, Inc. and stating that ‘‘[o]n balance, the Commission believes that the redundancy created by more interfaces and linkages within the settlement infrastructure increases resiliency’’); SEC Division of Trading and Markets and Office of Compliance Inspections and Examinations, Staff Report on the Regulation of Clearing Agencies (Oct. 1, 2020) (‘‘Staff Report on Clearing Agencies’’), available at https:// www.sec.gov/files/regulation-clearing-agencies100120.pdf (staff stating that ‘‘consolidation among providers of clearance and settlement services concentrates clearing activity in fewer providers and has increased the potential for providers to become single points of failure.’’). 234For example, in 2016 the Commission approved modifications to the Euroclear Exemption that included, among other things, a new set of conditions for the reporting of service outages. See Euroclear Exemption, supra note 231, at 94003 (setting forth eight ‘‘Operational Risk Conditions Applicable to the Clearing Agency Activities’’). Why or why not? Should it aggregate total assets of affiliated broker-dealers? Why or why not?
33. Is the proposed six-month period
during which a broker-dealer that meets the threshold to become an SCI brokerdealer does not have to comply with Regulation SCI appropriate? Should the Commission adopt a different time period? If so, how long should the period be and why?
34. Are there characteristics specific
to SCI broker-dealers that would make applying Regulation SCI, either broadly or by specific existing/proposed provision(s), unduly burdensome or inappropriate for SCI broker-dealers? How much time would an SCI brokerdealer reasonably need to come into compliance with Regulation as proposed?
c. Exempt Clearing Agencies (Deletion
of ‘‘Subject to ARP’’)
The Commission proposes to include all ‘‘exempt clearing agencies’’ as SCI entities. This proposed approach would expand the scope of exempt clearing agencies covered by Regulation SCI, which currently covers certain exempt clearing agencies—those that are ‘‘subject to ARP.’’ 228 The technology systems that underpin operations of both registered clearing agencies and exempt clearing agencies are critical systems that drive the global financial markets. Further, the activities of exempt clearing agencies subject to ARP and those not subject to ARP are similar. For example, for covered clearing agencies in particular,229 such systems include those that set and calculate margin obligations and other charges, perform netting and calculate payment obligations, facilitate the movement of funds and securities, or effectuate endof-day settlement. Increasingly, the technology behind these systems are subject to both rapid innovation and interconnectedness.230 For the exempt clearing agencies not subject to ARP, they also provide CSD functions for transactions in U.S. securities between U.S. and non-U.S. persons, using similar technologies.231 More generally, all exempt clearing agencies offer services that centralize a variety of technology functions, increasing access to services that help improve the efficiency of the clearance and settlement process by, for example, standardizing and automating functions necessary to complete clearance and settlement.232 Over time, the increasing availability of, and access to, such technologies has also increased the dependence that market participants have on such services, raising the potential that such services could become single points of failure for U.S. market participants.233 Further, as the services that exempt clearing agencies provide have evolved over time, they have become increasingly reliant on the provision of new technologies to market participants, and so the Commission has increasingly focused its oversight of exempt clearing agencies on the ways that such services might introduce operational risk to U.S. market participants.234 Therefore, the Commission proposes to expand the scope of SCI entities to cover all exempt clearing agencies. As a result, there would no longer be a difference in how exempt clearing agencies are addressed by Regulation SCI.
i. Current Regulatory Framework for
Exempt Clearing Agencies
The registration and supervisory framework for clearing agencies under the Exchange Act provides the Commission with broad authority to provide exemptive relief from certain of the Commission’s regulatory requirements under the Exchange Act. Specifically, section 17A(b)(1) of the Exchange Act provides the Commission with authority to exempt a clearing agency or any class of clearing agencies from any provision of section 17A or the

235The Commission has also provided temporary relief from registration to certain clearing agencies under section 36 of the Exchange Act. On July 1, 2011, the Commission published a conditional, temporary exemption from clearing agency registration for entities that perform certain posttrade processing services for security-based swap transactions. See, e.g., Release No. 64796 (July 1, 2011), 76 FR 39963 (July 7, 2011) (providing an exemption from registration under section 17A(b) of the Exchange Act, and stating that ‘‘[t]he Commission is using its authority under section 36 of the Exchange Act to provide a conditional temporary exemption [from clearing agency registration], until the compliance date for the final rules relating to registration of clearing agencies that clear security-based swaps pursuant to sections 17A(i) and (j) of the Exchange Act, from the registration requirement in section 17A(b)(1) of the Exchange Act to any clearing agency that may be required to register with the Commission solely as a result of providing Collateral Management Services, Trade Matching Services, Tear Up and Compression Services, and/or substantially similar services for security-based swaps’’). The order facilitated the Commission’s identification of entities that operate in that area and that accordingly may fall within the clearing agency definition. Recently, the Commission indicated that the 2011 Temporary Exemption may no longer be necessary. See Securities Exchange Act Release No. 94615 (Apr. 6, 2022), 87 FR 28872, 28934 (May 11,
2022) (stating that the ‘‘Commission preliminarily
believes that, if it adopts a framework for the registration of [security-based swap execution facilities (‘‘SBSEFs’’)], the 2011 Temporary Exemption would no longer be necessary because entities carrying out the functions of SBSEFs would be able to register with the Commission as such, thereby falling within the exemption from the definition of ‘clearing agency’ in existing [17 CFR 240.17Ad–24 (Rule 17Ad–24)]’’). 236See 15 U.S.C. 78q–1(b)(1). 237See exemption, supra note 233 (granting an exemption to provide matching services to each of BSTP and SS&C). 238See Euroclear Exemption, supra note 231. 239See Clearstream Exemption, supra note 231. 240See supra note 228. Pursuant to the Commission’s statement on CCPs in the European Union (‘‘EU’’) authorized under the European Markets Infrastructure Regulation (‘‘EMIR’’), an EU CCP may request an exemption from the Commission where it has determined that the application of SEC requirements would impose unnecessary, duplicative, or inconsistent requirements in light of EMIR requirements to which it is subject. See Statement on Central Counterparties Authorized under the European Markets Infrastructure Regulation Seeking to Register as a Clearing Agency or to Request Exemptions from Certain Requirements Under the Securities Exchange Act of 1934, Securities Exchange Act Release No. 90492 (Nov. 23, 2020), 85 FR 76635, 76639 (Nov. 30, 2020), available at https://www.govinfo.gov/content/pkg/FR-2020-11- 30/pdf/FR-2020-11-30.pdf (stating that in seeking an exemption, an EU CCP could provide ‘‘a selfassessment. . . [to] explain how the EU CCP’s compliance with EMIR corresponds to the requirements in the Exchange Act and applicable SEC rules thereunder, such as Rule 17Ad–22 and Regulation SCI’’). 241See ITPM Exemption, supra note 231; Euroclear Exemption, supra note 231; Clearstream Exemption, supra note 231. rules or regulations thereunder.235 Such an exemption may be effected by rule or order, upon the Commission’s own motion or upon application, either conditionally or unconditionally. The Commission’s exercise of authority to grant exemptive relief must be consistent with the public interest, the protection of investors, and the purposes of section 17A, including the prompt and accurate clearance and settlement of securities transactions and the safeguarding of securities and funds.236 The Commission has granted exemptions from clearing agency registration to three entities that provide matching services. These exempt clearing agencies are DTCC ITP Matching US, LCC (successor in name to Omgeo and Global Joint Venture Matching Services US, LLC), Bloomberg STP LLC (‘‘BSTP’’), and SS&C Technologies, Inc. (‘‘SS&C’’).237 In certain instances, non-U.S. clearing agencies also have received exemptions from registration as a clearing agency. These exempt clearing agencies include Euroclear Bank SA/NV (successor in name to Morgan Guaranty Trust Company of NY) 238 and Clearstream Banking, S.A. (successor in name to
Cedel Bank, socie´te´ anonyme, Luxembourg).239 Each has an exemption to provide clearance and settlement for U.S. Government and agency securities for U.S. participants, subject to limitations on the volume of transactions set forth in their exemptions. The Euroclear Exemption also provides an exemption from registration to provide collateral management services for transactions in U.S. equity securities between U.S. persons and non-U.S. persons. As previously discussed, each of these exempt clearing agencies makes available to market participants an increasingly wide array of technology services that help centralize and automate the clearance and settlement of securities transactions for market participants. This increasing reliance on new technologies has focused the Commission’s attention on the potential for such services to introduce operational risk or introduce single points of failure into the national system for clearance and settlement. Given this important role of exempt clearing agencies in helping to ensure the functioning, resilience, and stability of U.S. securities markets, and their growing technological innovations and interconnectedness, the Commission proposes to expand the scope of ‘‘SCI entity’’ to cover all exempt clearing agencies, rather than only those ‘‘subject to ARP’’ to help ensure that the risks associated with the greater dispersal, sophistication, and interconnection of such technologies are appropriately mitigated.240 In this regard, pursuant to the terms and conditions of the clearing agency exemptive orders, the Commission may modify by order the terms, scope, or conditions if the Commission determines that such modification is necessary or appropriate in the public interest, for the protection of investors, or otherwise in furtherance of the purposes of the Exchange Act.241
ii. Request for Comment
35. Is expanding the scope of ‘‘SCI
entity’’ to cover all exempt clearing agencies, not just those exempt clearing agencies subject to ARP, appropriate? Why or why not? Please be specific and provide examples, if possible, to illustrate your points.
36. Should all or some aspects of
Regulation SCI apply to all exempt clearing agencies? Why or why not? If only a portion, please specify which portion(s) and explain why. If all, explain why.
37. Would the Regulation SCI
proposed requirements, together with the conditions under which the exempt clearing agency is subject in the Commission exemptive order, be sufficient to address operational risk concerns posed by exempt clearing agencies? Why or why not? Please be specific and respond with examples, if possible.
38. Given the proposed new
requirements of Regulation SCI, should exempt clearing agencies be subject to a revised Commission exemptive order? Why or why not?
39. In support of the public interest
and the protection of investors, the Commission is proposing to amend the clearing agency exemptive orders to replace all operational risk conditions with a condition that each exempt clearing agency must comply with Regulation SCI requirements. Should the ordering language provide that the exempt clearing agency must comply with all requirements in Regulation SCI? If so, explain why. If not, explain why not.
40. Should proposed Regulation SCI
distinguish among different types of exempt clearing agencies such that some requirements of Regulation SCI might be appropriate for some exempt clearing agencies, but not others? Why or why not? If so, what are those distinctions and what are those requirements? Please be specific and provide examples, if possible.
41. To what extent do exempt clearing
agencies rely on third-party providers to provide systems that support their clearance and settlement functions? Do such third-party providers introduce operational or other risks that would be subject to the requirements of Regulation SCI? Are there any

242See supra text accompanying note 79. 243For purposes of this release, the term Fixed Income ATSs refers only to ATSs trading corporate debt and municipal securities and excludes Government Securities ATSs, which are the subject of a separate proposal. See supra notes 84–85 and accompanying text. 244See 17 CFR 242.301(b)(6). Until Regulation SCI was adopted, Rule 301(b)(6) applied to an ATS trading NMS stocks, equity securities that are not NMS stocks, corporate debt securities, or municipal securities exceeding a 20% volume threshold. Since the adoption of Regulation SCI, Rule 301(b)(6) has applied only to ATSs trading corporate debt securities or municipal securities exceeding a 20% volume threshold. Rule 301(b)(6) currently does not specify whether the thresholds refer to share, dollar, or transaction volume. In the Government Securities ATS Reproposal, the Commission has proposed to specify that these thresholds refer to ‘‘average daily dollar volume.’’ See Government Securities ATS Reproposal, supra note 84, at 15572. 245More specifically, with regard to systems that support order entry, order routing, order execution, transaction reporting, and trade comparison, Rule 301(b)(6)(ii) of Regulation ATS requires significantvolume ATSs to: establish reasonable current and future capacity estimates; conduct periodic capacity stress tests of critical systems to determine their ability to accurately, timely and efficiently process transactions; develop and implement reasonable procedures to review and keep current system development and testing methodology; review system and data center vulnerability to threats; establish adequate contingency and disaster recovery plans; perform annual independent reviews of systems to ensure compliance with the above listed requirements and perform review by senior management of reports containing the recommendations and conclusions of the independent review; and promptly notify the Commission of material systems outages and significant systems changes. See 17 CFR 242.301(b)(6)(ii). As discussed in the SCI Adopting Release, the application of Rule 301(b)(6) to Fixed Income ATSs is in addition to various Exchange Act and FINRA rules applicable to broker-dealers operating ATSs. See SCI Adopting Release, supra note 1, at 72263. See also supra notes 146–166 and accompanying text (providing an updated discussion of various Exchange Act, FINRA, and certain other regulations applicable to brokerdealers, including those operating ATSs). 246See Securities Exchange Act Release No. 40760 (Dec. 8, 1998), 63 FR 70844, (Dec. 22, 1998) (‘‘Regulation ATS Adopting Release’’). 247See SCI Adopting Release, supra note 1, at 72264. 248As discussed further below, the Commission is now proposing updates to Regulation SCI that are designed to take account of new and emerging technology challenges. If adopted, these changes to Regulation SCI will render Rule 301(b)(6) even more outdated by comparison. Below the Commission solicits
comment on whether, in lieu of applying Regulation SCI to these entities, Rule 301(b)(6) should be updated instead. 249See SCI Proposing Release, supra note 14, at 18094–96. 250See SCI Proposing Release, supra note 14, at 18093, 18095. At adoption, the Commission included only ATSs that trade NMS stocks and equity securities that are not NMS stocks exceeding a specified volume threshold. Rule 1000 of Regulation SCI defines SCI ATS to mean an ATS, which, during at least four of the preceding six calendar months, had: (1) With respect to NMS stocks: (i) 5% or more in any single NMS stock, and 0.25% or more in all NMS stocks, of the average daily dollar volume reported by an effective transaction reporting plan, or (ii) 1% or more, in all NMS stocks, of the average daily dollar volume reported by an effective transaction reporting plan; or (2) with respect to equity securities that are not NMS stocks and for which transactions are reported to an SRO, 5% or more of the average daily dollar volume as calculated by the SRO to which such transactions are reported. See 17 CFR 242.1000. Rule 1000 also states that an ATS that meets one of these thresholds is not required to comply with Regulation SCI until six months after satisfying the threshold for the first time. See id. circumstances in which the use of a third-party provider would prevent compliance with Regulation SCI? Why or why not? Please be specific and provide examples, if possible.
42. For EU CCPs authorized under
EMIR, the Commission stated that exemptive relief may be considered under section 17A(b)(1) of the Exchange Act in scenarios where SEC requirements are unnecessary, duplicative, or inconsistent relative to EMIR requirements. The Commission recognizes that the EU and other jurisdictions may have requirements similar those being proposed in Regulation SCI. Should the Commission provide foreign CCPs with exemptive relief from newly proposed Regulation SCI? Why or why not? In the context of exemptive requests for newly proposed Regulation SCI, what factors should the Commission take into account in assessing whether SEC requirements may be ‘‘unnecessary, duplicative, or inconsistent’’ relative to home jurisdiction requirements for foreign CCPs, including EU CCPs authorized under EMIR? Please be specific and provide examples, if possible.
3. General Request for Comment on
Proposed Expansion of SCI Entities
43. The Commission requests
comment generally on the proposed expansion of the definition of SCI entity. Are there are other entities that should be included as SCI entities? If so, which entities and why? Further, are there any entities, which if included as SCI entities, would have critical SCI systems? Please explain. B. Request for Comment Regarding Significant-Volume Fixed Income ATSs and Broker-Dealers Using Electronic or Automated Systems for Trading of Corporate Debt Securities or Municipal Securities

Discussion
As stated above, the Commission did not include Fixed Income ATSs as SCI entities when it adopted Regulation SCI based on consideration of comments regarding the risk profile of these ATSs at that time.242 In light of the evolution of technology since then, and specifically, the technology for trading corporate debt and municipal securities, the Commission requests comment on whether significant-volume ATSs and/ or broker-dealers with significant transaction activity in corporate debt or municipal securities should be subject to Regulation SCI.243 Currently, an ATS is subject to Rule 301(b)(6) of Regulation ATS if its trading volume reaches ‘‘20 percent or more of the average daily volume traded in the United States’’ in either corporate debt or municipal securities.244 Among other things, Rule 301(b)(6) requires such a significant-volume Fixed Income ATS to notify the Commission staff of material systems outages and significant systems changes and to establish adequate contingency and disaster recovery plans.245 The requirements of Rule 301(b)(6) applicable to significantvolume Fixed Income ATSs, which date to 1998 and have not been updated since that time, are less rigorous than the requirements of Regulation SCI.246 The Commission explained in the SCI Adopting Release that it adopted Regulation SCI to expand upon, update, and modernize the requirements of Rule 301(b)(6) for those ATSs trading NMS stocks and equity securities that are not NMS stocks that it had identified as playing a significant role in the U.S. securities markets.247 Regulation SCI did this by, for example, moving from the Commission’s 1980s and 90s-era technology precepts to a framework that speaks to a broader set of systems that are subject to an overarching standard:
that they be subject to policies and procedures reasonably designed to maintain operational capability and promote the maintenance of fair and orderly markets. Regulation SCI also requires tested business continuity and disaster recovery plans that include geographic diversity to achieve specified recovery time objectives. In addition, Regulation SCI requires notice and dissemination of information regarding a wider range of systems problems (i.e., SCI events) to the Commission and affected market participants, and also requires that corrective action be taken with respect to such problems.248 When proposing Regulation SCI in 2013, the Commission sought to include as SCI entities those ATSs that are reliant on automated systems and represent a significant pool of liquidity in certain asset classes.249 Regarding Fixed Income ATSs, the Commission proposed to include those exceeding five percent or more of either average daily dollar volume or average daily transaction volume traded in the United States, but it did not adopt that proposal.250 Instead, for ATSs trading corporate debt or municipal securities

251See SCI Adopting Release, supra note 1, at 72270. 252See id. The Commission also acknowledged comments stating that lowering the 20% threshold in Rule 301(b)(6) could have the unintended effect of discouraging technology evolution in these markets. Id. 253See SCI Adopting Release, supra note 1, at 72409 (stating, ‘‘[A]s the Commission monitors the evolution of automation in this market, the Commission may reconsider the benefits and costs of extending the requirements of Regulation SCI to fixed-income ATSs in the future.’’). 254See Government Securities ATS Proposing Release, supra note 84, at 87152–54. See also Government Securities ATS Reproposal, supra note 84, at 15527–29. Specifically, in the Government Securities ATS Reproposal, the Commission discussed how advances in technology have resulted in the increased use of systems that use protocols and non-firm trading interest to bring together buyers and sellers of securities and how these systems functioned as market places similar to market places provided by registered exchanges and ATSs. See Government Securities ATS Reproposal, supra note 84, at 15497–98. 255See Government Securities ATS Reproposal, supra note 84, at 15526. 256See Government Securities ATS Reproposal, supra note 84, at 15528 at n. 389, 15606, and 15609. See also SIFMA Insights: Electronic Trading Market Structure Primer, supra note 3 (outlining and comparing electronification trends in different markets); SIFMA, SIFMA Insights: US Fixed Income Market Structure Primer (July 2018), available at https://www.sifma.org/wp-content/uploads/2018/ 07/SIFMA-Insights-FIMS-Primer_FINAL.pdf (discussing several different types of fixed-income markets, noting that the historically quote-driven voice broker market structure has moved to accommodate limit order book protocols in the intradealer markets and request-for-quote (‘‘RFQ’’) protocols in the dealer-to-client markets; and assessing that ‘‘Current growth [in the dealer-toclient markets] is enabling the total growth in overall electronification percentages: UST 70%, Agency 50%, Repos 50%, IG Corporates 40% and HY Corporates 25%’’). 257See Annabel Smith, Pandemic sees electronic fixed income trading skyrocket in 2021, the Trade (Mar. 3, 2021), available at https:// www.thetradenews.com/pandemic-sees-electronicfixed-income-trading-skyrocket-in-2021/; Municipal Securities Rulemaking Board, Characteristics of Municipal Securities Trading on Alternative Trading Systems and Broker’s Broker Platforms (Aug. 2021), available at https://msrb.org/ MarketTopics/-/media/27E4F111D18246C6B9 DA849082230CD0.ashx (discussing volume on ATSs and broker’s broker platforms from 2016– 2021). 258See Government Securities ATS Reproposal, supra note 84, at 15606–07. Market observers also note increased use of electronic trading in the growth of all-to-all trading and portfolio trading. See Greenwich Associates, All-to-All Trading Takes Hold in Corporate Bonds (Q2 2021), available at
https://content.marketaxess.com/sites/default/files/ 2021-04/All-to-All-Trading-Takes-Hold-inCorporate-Bonds.pdf#:∼:text=In%20all-%20toall%20markets%2C%20where %20asset%20managers%20provide, of%20the%20corporate%20bond%20market %E2%80%99s%20growth%20and%20evolution (stating that all-to-all trading, which allows asset managers to provide liquidity to dealers and each other and for dealers to trade with one another electronically, has increased from 8% of investment grade volume in 2019 to 12% of investment grade volume in 2020); see also Li Renn Tsai, Understanding Portfolio Trading, Tradeweb (Sept. 6, 2022), available at https://www.tradeweb.com/ newsroom/media-center/in-the-news/ understanding-portfolio-trading/#:∼:
text=Portfolio%20Trading%20 is%20a%20solution%20that%20gives%20asset, savings%2C%20mitigate%20operational%20risk %2C%20and%20reduce%20market%20slippage (discussing that portfolio trading, a process similar to program trading for equities which allows asset managers to buy/sell a basket of bonds to trade together as a single package, increased from 2% of total corporate bond trades in Jan. 2020 to 5% in Sept. 2021); Kate Marino, Algorithms have arrived in the bond market, Axios (Sept. 3, 2021), available at https://www.axios.com/2021/09/03/bond-markettrading-algorithms (discussing the increase in portfolio trading in the bond market). 259See Jack Pitcher, Record E-Trading Brings More Liquidity to Corporate Bond Market, Bloomberg (Oct. 31, 2022), available at https:// www.bloomberg.com/news/articles/2022-10-31/ electronic-credit-trading-surges-to-record-boostingliquidity (citing a Sept. 2022 Coalition Greenwich report stating that ‘‘Investment-grade electronic trading accounted for 42% of volume in September, up 9 percentage points from the same month last year, and high yield was 34%, up 10 percentage points’’ and about one third of trading volume on junk bonds was through online trading in Sept. 2022, up from about a quarter of trading volume in the same period last year); but see Maureen O’Hara and Xing Alex Zhou, The electronic evolution of corporate bond dealers, Journal of Financial Economics (Jan. 5, 2021), available at https:// www.sciencedirect.com/science/article/pii/ S0304405X21000015 (discussing that any eventual domination of electronic bond trading may ultimately be limited because of the particular nature of bond trading, which includes bond illiquidity, the inability for larger trades to be broken into smaller trade sizes that can trade electronically, dealer unwillingness to trade more information-sensitive high-yield bonds electronically, and the lack of new dealers in bond market structure). 260See Simon Z. Wu, Characteristics of Municipal Securities Trading on Alternative Trading Systems and Broker’s Broker Platforms, Municipal Securities Rulemaking Board (Aug. 2021), available at https:// www.msrb.org/sites/default/files/MSRB-Trading-onAlternative-Trading-Systems.pdf. See also Government Securities ATS Reproposal, supra note 84, at 15609 (discussing use of electronic trading protocols in the municipal securities markets, and noting that ‘‘one MSRB report found that technological advancements in this market and the movement away from voice trading and towards electronic trading have helped reduce transaction costs for dealer-customer trades by 51 percent between 2005 and 2018’’). exceeding a 20 percent ‘‘average daily volume’’ threshold, it left in place the older, more limited technology regulations in Rule 301(b)(6) of Regulation ATS.251 In support of that determination, the Commission distinguished the equity markets from the corporate debt and municipal securities markets, stating that the latter markets generally relied
much less on automation and electronic trading than markets that trade NMS stocks or equity securities that are not NMS stocks, and also tended to be less liquid than the equity markets, with slower execution times and less complex routing strategies.252 Due to changes in the market and updates to technology, the Commission again requests comment on applying Regulation SCI to significant-volume Fixed Income ATSs, and further requests comment regarding brokerdealers trading significant volume in corporate debt or municipal securities.253 In particular, the Commission is soliciting comment on whether the distinctions drawn by the Commission in its original adoption of Regulation SCI, between equities markets on the one hand, and the corporate debt and municipal securities markets on the other, based on differences in their reliance on automation and electronic trading strategies have diminished such that Fixed Income ATSs or broker-dealers with significant activity in corporate debt and municipal securities should be subject to increased technology oversight pursuant to Regulation SCI. As noted above, the Commission proposed and then recently re-proposed to extend Regulation SCI to ATSs that trade U.S. Treasury Securities or Agency Securities (i.e., Government Securities ATSs) exceeding a five percent dollar volume threshold in at least four out of the preceding six months, citing the increased reliance on technology in the government securities markets in recent years and the resulting operational similarities and technological vulnerabilities and risks of such ATSs to existing SCI entities.254 In the Government Securities ATS Reproposal, the Commission discussed ways in which the government securities markets have become increasingly dependent on electronic trading in recent years.255 The Commission solicits comment on whether trading in corporate debt securities or municipal securities by ATSs and/or brokerdealers has evolved similarly. The growth in electronic trading in the corporate debt and municipal securities markets in recent years appears to be substantial,256 and accelerating.257 Although traditional methods of bilateral corporate bond trading conducted through either dealerto-dealer or dealer-to-customer negotiations (often using telephone calls) remain important (with an estimated 71.4 percent of trading in corporate bonds facilitated via bilateral voice trading during the first half of 2021),258 more recent data suggest that dependencies on electronic protocols have increased in the last year alone.259 In the municipal securities markets, a majority (56.4%) of all inter-dealer trades and 26% of inter-dealer par value traded were executed on ATSs during the period from August 2016 through April 2021.’’ 260 Moreover, as recently reported by the MSRB, the number of transactions with a dealer on an ATS

261See John Bagley and Marcelo Vieira, Customer Trading with Alternative Trading Systems, Municipal Securities Rulemaking Board (Aug. 2022), available at https://www.msrb.org/sites/ default/files/2022-08/MSRB-Customer-Tradingwith-Alternative-Trading-Systems.pdf. 262An ATS that trades NMS stocks is subject to Regulation SCI if its trading volume reaches: (i) 5% or more in any single NMS stock and 0.25% or more in all NMS stocks of the average daily dollar volume reported by applicable transaction reporting plans; or (ii) 1% or more in all NMS stocks of the average daily dollar volume reported by applicable transaction reporting plans. An ATS that trades equity securities that are not NMS stocks is subject to Regulation SCI if its trading volume is 5% or more of the average daily dollar volume (across all equity securities that are not NMS stocks) as calculated by the SRO to which such transactions are reported. As stated in the SCI Adopting Release, the higher threshold for equity securities that are not NMS stocks versus NMS stocks was selected taking into account the lower degree of automation, electronic trading, and interconnectedness in the market for equity securities that are not NMS stocks and assessment that those ATSs would present lower risk to the market in the event of a systems issue, but not necessarily no risk. See SCI Adopting Release, supra note 1, at 72269. As stated above, a 5% average daily dollar volume threshold is proposed for Government Securities ATSs (i.e., ATSs that that trade Agency Securities and/or U.S. Treasury Securities), where electronic trading is prevalent. 263The Commission notes that ATSs may also trade crypto asset securities. See section II.A.3.b.v. (discussing obligations of ATSs trading crypto asset securities). more than tripled from 2015 to 2021; the average daily number of municipal securities trades increased more than 550% from 2015 to 2022 and also increased more than 75% in 2022; and the average daily par amount traded increased more than 400% since 2015 and more than doubled in 2022 compared to 2021.261 While technological developments provide many benefits to the U.S. securities markets and investors, they also increase the risk of operational problems that have the potential to cause a widespread impact on the securities markets and market participants. The trend in electronic trading in these markets and recent data on the volume of Fixed Income ATSs suggest that there is likely to be one or more Fixed Income ATSs (or brokerdealers) that both rely on electronic trading technology and represent or generate significant sources of liquidity in these asset classes. In light of these developments, the Commission believes that it is appropriate to request comment on whether ATSs and brokerdealers that trade significant volume in corporate debt securities or municipal securities should also be subject to some or all of the requirements of Regulation SCI, and if so, what an appropriate threshold
would be.262
2. Request for Comment
The Commission is requesting comment on whether to apply Regulation SCI to Fixed Income ATSs on the basis of volume, or to brokerdealers that trade corporate debt or municipal securities on or above a trading activity threshold. Specifically:
44. Should significant volume ATSs
and/or broker-dealers with significant transaction activity in corporate debt or municipal securities be subject, in whole or in part, to Regulation SCI? 263
45. Do commenters agree that the
corporate debt and municipal securities markets have become increasingly electronic in recent years? Why or why not? Please provide data to support your views. If electronic trading in the corporate debt and municipal securities markets has increased, are these markets sufficiently different or unique to warrant an approach to technology oversight that differs from the approach taken in Regulation SCI? Why or why not?
46. What are the risks associated with
systems issues at Fixed Income ATSs or broker-dealers that trade corporate debt or municipal securities today? What impact would a systems issue at a Fixed Income ATS or such broker-dealer have on the trading of corporate debt or municipal securities and the maintenance of fair and orderly markets?
47. Do electronic systems used to
trade corporate debt or municipal securities markets today have linkages to any trading venues, including to U.S. Treasury markets? Are these linkages developing or likely to develop? If not, are there interconnections with thirdparty or other types of systems? How do any interconnections impact the risk of an SCI event at a Fixed Income ATS or broker-dealer that trades corporate debt or municipal securities on the market and/or market participants?
48. If commenters believe that
Regulation SCI should apply, in whole or in part, to Fixed Income ATSs or broker-dealers that trade corporate debt or municipal securities, should there be a volume threshold? For example, should the definition of SCI ATS include those ATSs which, during at least four of the preceding six calendar months had: (1) with respect to municipal securities, five percent or more of the average daily dollar volume traded in the United States, as provided by the self-regulatory organization to which such transactions are reported; or (2) with respect to corporate debt securities, five percent or more of the average daily dollar volume traded in the United States as provided by the self-regulatory organization to which such transactions are reported? Similarly, should the definition of SCIbroker-dealer include a similar threshold to that proposed for registered broker-dealers trading Treasury or Agency securities (during at least four of the preceding six calendar months reported to the self-regulatory organization(s) to which such transactions are reported, average daily dollar volume in an amount that equals ten percent (10%) or more of the total average daily dollar volume as made available by the self-regulatory organization to which such transactions are reported)?
49. Is basing a threshold on a
percentage of average daily dollar volume appropriate? Should there be an alternative threshold based on average daily share volume? Or par value? Or transaction volume?
50. Would commenters have a
different view on what an appropriate threshold would be for Fixed Income ATSs if additional entities become Fixed Income ATSs as a result of adoption of the amendments to Rule 3b– 16(a) that the Commission has proposed in the Government Securities ATS Reproposal?
51. If the Commission proposes to
apply Regulation SCI to Fixed Income ATSs, should it propose a similar approach for broker-dealers that trade corporate debt or municipal securities? Why or why not?
52. Would four out of the preceding
six months be an appropriate period to measure the volume thresholds for corporate debt and municipal securities for purposes of Regulation SCI? Why or why not? Would Fixed Income ATSs or broker-dealers that trade corporate debt or municipal securities have available appropriate data with which to determine whether a proposed threshold has been met? If not, what data or information is missing? Does the answer depend on whether the Government Securities ATS Reproposal (proposing to expand the definition of exchange in Rule 3b–16(a)) is adopted as proposed?
53. Should any or all Fixed Income
ATSs that meet a volume threshold be subject to Rule 301(b)(6) of Regulation ATS instead of Regulation SCI (i.e., should Rule 301(b)(6) be retained)? Why or why not? Alternatively, should any or all Fixed Income ATSs or broker-dealers that trade corporate debt or municipal securities be subject to only certain provisions of Regulation SCI? Which ones and why? Please explain. Alternatively, should Rule 301(b)(6) of Regulation ATS be updated to be more similar to Regulation SCI in certain respects? If so, how?

264See 17 CFR 242.1001(a)(1).
265 Id.
266See supra section III.A.2.b.iv (discussing the proposed limitation to the definition of SCI systems for certain SCI broker-dealers).
54. If commenters believe Rule
301(b)(6) should continue to apply to Fixed Income ATSs, is the 20 percent average daily volume threshold an appropriate threshold? Should it be amended to specify what the 20 percent average daily volume refers to (e.g., share? dollar? par? transaction?)? Should the Commission amend Rule 301(b)(6) to subject all Fixed Income ATSs, or certain Fixed Income ATSs, to the requirements of the rule if the Fixed Income ATS reaches a 5 percent, 10 percent, 15 percent or another volume threshold? If so, please explain why such a threshold would be appropriate. Alternatively, should Rule 301(b)(6) be superseded and replaced by Regulation SCI?
55. Are there characteristics specific
to the corporate debt and municipal securities markets that would make applying Regulation SCI broadly or any specific provision of Regulation SCI to Fixed Income ATSs or broker-dealers that trade corporate debt or municipal securities unduly burdensome or inappropriate? Please explain. For example, if an ATS that fits the description of a Communication Protocol System (as described in the Government Securities ATS Proposal) were to be become an SCI ATS, would there be certain features or functions of that system that would not meet the definition of SCI systems, but that should be subject to Regulation SCI as SCI systems? Would there be any features or functions of that system that would meet the definition of SCI systems, but that should not be subject to Regulation SCI? Commenters that recommend that the Commission propose that ATSs and/or broker-dealers with significant transaction activity in corporate debt or municipal securities be subject to Regulation SCI are requested to specifically address the expected benefits and costs of their recommendations, above the current baseline of Rule 301(b)(6) of Regulation ATS, and the expected effects of their recommendations on efficiency, competition, and capital formation.
C. Strengthening Obligations of SCI
Entities
In adopting Regulation SCI, the Commission recognized that technology, standards, and threats would continue to evolve and that the regulation would need to be flexible so as to develop alongside such changes. Thus, 17 CFR 242.1001(a)(1) (‘‘Rule 1001(a)(1)’’ of Regulation SCI) requires that each SCI entity have ‘‘written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity’s operational capability and promote the maintenance of fair and orderly markets.’’ 264 While Rule 1001(a)(2) itemizes certain minimum requirements such policies and procedures must include, they are generally broad areas that must be covered (e.g., requiring capacity planning estimates, stress tests, systems development and testing programs, reviews and testing for threats, business continuity and disaster recovery plans, standards with respect to market data, and monitoring for potential SCI events), Rule 1001(a) does not prescribe in detail how they should be addressed.265 Since the adoption and implementation of Regulation SCI, technology and the ways SCI entities employ such technology have continued to evolve, as have the potential vulnerabilities of, and threats posed to, SCI entities. In addition, the Commission and its staff have gained valuable experience and insights with respect to technology issues surrounding SCI entities and their systems. Given the important role SCI entities play in our markets, it is appropriate to strengthen the requirements Regulation SCI imposes on SCI entities to help ensure that their SCI systems and indirect SCI systems continue to remain robust, resilient, and secure.

Systems Classification and Lifecycle
Management a. Discussion
The terms ‘‘SCI systems,’’ ‘‘indirect SCI systems,’’ and ‘‘critical SCI systems’’ are foundational definitions within Regulation SCI. These terms map out the scope of Regulation SCI’s applicability to an SCI entity. If an SCI entity does not classify its systems pursuant to these defined terms, it cannot fully understand how it should apply Regulation SCI’s requirements and where its obligations under the regulation start and end. Specifically, ‘‘SCI systems’’ is defined to mean ‘‘all computer, network, electronic, technical, automated, or similar systems of, or operated by or on behalf of, an SCI entity that, with respect to securities, directly support trading, clearance and settlement, order routing, market data, market regulation, or market surveillance.’’ The definition of ‘‘SCI systems’’ does not scope in every system of an SCI entity; rather, it is limited to those functions the Commission believed were of particular significance for the purposes of Regulation SCI, namely systems that, with respect to securities, directly support trading, clearance and settlement, order routing, market data, market regulation, or market surveillance. ‘‘Indirect SCI systems’’ come into play with respect to security standards and systems intrusions and include ‘‘any systems of, or operated by or on behalf of, an SCI entity that, if breached, would be reasonably likely to pose a security threat to SCI systems.’’ Importantly, both definitions include systems operated by an SCI entity as well as systems operated by third parties on behalf of a given SCI entity. Except as discussed above,266 the proposed rule amendments would not change the definition of SCI systems, indirect SCI systems, or critical SCI systems. However, the Commission is proposing to modify certain existing, and add a number of additional, requirements to the policies and procedures required of SCI entities with respect to their SCI systems (and indirect SCI systems or critical SCI systems, as the case may be), under Rule 1001(a), as discussed in further detail below. One of the first steps many SCI entities take to comply with Regulation SCI is developing a classification of their systems in accordance with these definitions; i.e., a documented inventory of the specific systems of the SCI entity that fall within each type of systems (i.e., SCI system, indirect SCI system, and critical SCI system). However, not all SCI entities maintain such a list. A foundational and essential step for an SCI entity to be able to meet its obligations under Regulation SCI is to be able to identify clearly the systems that are subject to obligations under Regulation SCI. Therefore, the Commission is proposing a new provision to ensure that SCI entities develop and maintain a written inventory of their systems and classification. Specifically, new paragraph (a)(2)(viii) in Rule 1001 would require each SCI entity to include in their policies and procedures the maintenance of a written inventory and classification
of all of its SCI systems, critical SCI systems, and indirect SCI systems. In addition, 17 CFR 242.1001(a)(2)(viii) (‘‘proposed Rule 1001(a)(2)(viii)’’) would require that the

267For example, such policies generally should not simply require mere disposal of end-of-life SCI systems but should ensure their effective disposal such that sensitive information (including software, configuration info, middleware, etc.) that could compromise the security of an SCI entity’s data and network is not inadvertently revealed. 268Emphasis added. 269See SCI Adopting Release, supra note 1, at 72276. 270 Id. 271See SCI Adopting Release, supra note 1, at 72276. 272See infra sections III.C.2.b. through d (discussing the proposed rule changes with respect to third-party management programs, third-party providers for critical SCI systems, and third-party provider participation in BC/DR testing). 273See, e.g., Angus Loten, CIOs Accelerate PrePandemic Cloud Push Wall St. J. (Apr. 26, 2021). SCI entity’s policies and procedures include a program with respect to the lifecycle management of such systems, including the acquisition, integration, support, refresh, and disposal of such systems, as applicable. This provision would require SCI entities to consider how a system subject to Regulation SCI moves through its lifecycle, from initial acquisition to eventual disposal. The purpose of this provision is to help ensure that an SCI entity is able to identify risks an SCI system may face during its various lifecycle phases. Importantly, SCI entities would need to address the refresh of such systems in their lifecycle management program. Generally, systems that are properly refreshed and updated include up-todate software and security patches. In addition, the lifecycle management program required in their policies and procedures must address disposal of such systems. Disposal generally should include sanitization of end-of-life systems to help ensure that systems that are no longer intended as SCI systems or indirect SCI systems do not contain sensitive information (e.g., relating to the operations or security of the SCI entity or its systems architecture) that might be unintentionally revealed if such end-of-life systems fall into the wrong hands.267 Thus, this generally would require SCI entities to pinpoint precisely when a given system ‘‘becomes’’ an SCI system (or an indirect SCI system), as well as the point at which it is officially ‘‘no longer’’ an SCI system (or an indirect SCI system). b. Request for Comment
56. Do commenters agree with the
proposed requirement in proposed Rule 1001(a)(2)(viii) to require SCI entities to include in their policies and procedures the maintenance of a written inventory and classification of all of its SCI systems, critical SCI systems, and indirect SCI systems? Why or why not?
57. Do commenters believe that
Regulation SCI should require that SCI entities have a program with respect to the lifecycle management of such systems, including the acquisition, integration, support, refresh, and disposal of such systems, as applicable? Why or why not? Do SCI entities currently maintain such lifecycle management programs? Are there other aspects of lifecycle management that commenters believe should be included in the proposed requirement? If so, please describe.
2. Third-Party Provider Management
a. Third-Party Provider Management Issues When it adopted Regulation SCI, the Commission recognized that an SCI entity may choose to use third parties to assist it in running its SCI systems and indirect SCI systems. The Commission took into account such scenarios by including the phrase ‘‘or operated by or on behalf of ’’ 268 in key definitions such as ‘‘SCI systems,’’ ‘‘critical SCI systems,’’ and ‘‘indirect SCI systems.’’ The inclusion of the phrase ‘‘or on behalf of’’ was intended to make clear that outsourced systems are not excluded and that any such systems were within the scope of Regulation SCI, even when operated not by the SCI entity itself but rather by a third party. In the SCI Adopting Release, the Commission made clear that it was the responsibility of the SCI entity to manage its relationships with such third parties through due diligence, contract terms, and monitoring of third-party performance.269 In addition, as the Commission stated when adopting Regulation SCI, ‘‘[i]f an SCI entity is uncertain of its ability to manage a third-party relationship . . . to satisfy the requirements of Regulation SCI, then it would need to reassess its decision to outsource the applicable system to such third party. (footnotes omitted)’’ 270 An SCI entity may decide to outsource certain functionality to, or utilize the support or services of, a third-party provider (which would include both affiliated providers as well as vendors unaffiliated with the SCI entity) for a variety of reasons. In selecting a third-party provider to operate an SCI system on its behalf, an SCI entity may be attracted to the potential benefits that it may believe the third-party provider would bring, which could range from cost efficiencies and increased automation to particular expertise the vendor may provide in areas such as security and data latency. Third-party providers may also provide services that an SCI entity may not currently have in-house, such as a particular type of software required to run or monitor a given SCI system, or a data or pricing feed. The Commission believes that the use of third-party providers by SCI entities can be appropriate and even advantageous and preferable in certain instances, given the benefits they may provide when employed appropriately. However, as the Commission discussed in the SCI Adopting Release, when utilizing a third-party provider, an SCI entity is ‘‘responsible for having in place processes and requirements to ensure that it is able to satisfy the requirements of Regulation SCI for systems operated on behalf the SCI entity by a third party.’’ 271 Thus, an SCI entity generally should be aware of the potential costs and risks posed by this choice including, for example:
cybersecurity risks (e.g., a compromise in a third-party provider’s systems impacting the systems of the SCI entity); operational risks (e.g., a disruption or shutdown of a third-party provider’s service, or a bankruptcy or cessation of operation of a third-party provider, negatively impacting or disrupting the operation of an SCI system); reputational risks (e.g., a faulty or incorrect input from a third-party provider causing an SCI entity’s output to be incorrect); and legal and regulatory risks (e.g., a third-party provider’s lack of responsiveness or unwillingness to provide the SCI entity necessary information or detail results in an SCI entity missing a reporting or compliance deadline, such as a deadline for reporting an SCI event or taking corrective action on an SCI event). With the continued and increasing use of third-party providers by SCI entities and, in some cases, with third-party providers playing increasingly important and even critical roles in ensuring the reliable, resilient, and secure operation of SCI systems and indirect SCI systems, the Commission believes that it is appropriate to strengthen Regulation SCI’s requirements with respect to SCI entities’ use of third-party providers and the management of such relationships, as described in detail below.272 In recent years, many types of businesses have turned to cloud service providers (‘‘CSPs’’) to take advantage of their services.273 Today, CSPs can provide a range of support to a wide variety of businesses, with deployment models ranging from public cloud, private cloud, hybrid cloud, and multicloud, and service models including Infrastructure as a Service (‘‘IaaS’’), Platform as a Service (‘‘PaaS’’), and

274Additional information relating to the services provided by CSPs is widely available online from CSPs as well as firms that provide consulting services for potential clients of CSPs. FINRA, Cloud Computing in the Securities Industry 3–4 (Aug. 2021), available at https://www.finra.org/sites/ default/files/2021-08/2021-cloud-computing-in-thesecurities-industry.pdf (providing a summary description of these services). For a discussion of considerations and risks relevant to the use of cloud service providers by entities in the financial services sector, see the Financial Services Sector’s Adoption of Cloud Services, U.S. Dept. of the Treasury (issued February 8, 2023), available at:
https://home.treasury.gov/system/files/136/ Treasury-Cloud-Report.pdf. 275See, e.g., FINRA, Podcast: How the Cloud has Revolutionized FINRA Technology (July 30, 2018), available at www.finra.org/media-center/finraunscripted/how-cloud-has-revolutionized-finratechnology; Securities Exchange Act Release No. 93433 (Oct. 27, 2021), 86 FR 60503 (Nov. 2, 2021) (SR–OCC–2021–802) (Notice of Filing and Extension of Review Period of Advance Notice Relating to OCC’s Adoption of Cloud Infrastructure for New Clearing, Risk Management, and Data Management Applications). See also, Huw Jones, Microsoft invests $2 billion in London Stock Exchange, Reuters (Dec. 12, 2022). 276See, e.g., Nasdaq, Press Release: Nasdaq and AWS Partner to Transform Capital Markets (Nov. 30, 2021), available at www.nasdaq.com/pressrelease/nasdaq-and-aws-partner-to-transformcapital-markets-2021-12-01; Nasdaq, Press Release:
Nasdaq Completes Migration of the First U.S. Options Market to AWS (Dec. 5, 2022), available at https://www.nasdaq.com/press-release/nasdaqcompletes-migration-of-the-first-u.s.-optionsmarket-to-aws-2022-12-05. 277 In using the term ‘‘on-premises,’’ the Commission means that the data center’s hardware (e.g., the servers, switches, and other physical machines) is generally under the control of and operated by the SCI entity, even if the data center is physically located in a facility operated by a third party and for which such third party provides or arranges for certain services including, but not limited to, power, water, and physical security. 278See SCI Adopting Release, supra note 1, at 72275–76. In this section, the Commission discusses many issues that may be relevant for SCI entities to consider in relation to their use of thirdparty vendors generally, and with respect to cloud service providers specifically. These issues include those that the Commission and its staff have encountered with respect to SCI entities since the adoption and implementation of Regulation SCI; however, this is not meant to be a comprehensive list of all potential issues and considerations, and the Commission welcomes comment on other applicable issues and considerations that commenters believe are relevant for SCI entities with respect to third-party providers. 279See SCI Adopting Release, supra note 1, at 72276. 280See SCI Adopting Release, supra note 1, at
72295. See also infra section III.C.2.c, including
notes 292–294 and accompanying text (discussing the proposed modifications to Rule 1001(a)(2)(v)). 281While CSPs may use slightly different nomenclature, typically, a CSP’s region contains multiple availability zones, and an availability zone contains multiple data centers. Software as a Service (‘‘SaaS’’).274 SCI entities are also engaging with CSPs to assist in operating their SCI systems and some utilize, or have announced their intention to utilize, CSPs for all or nearly all of their applicable systems,275 others have begun moving towards employing CSPs at a more deliberate pace,276 and others continue to explore and consider whether or not to use such services. A decision to move their systems from an ‘‘on-premises,’’ 277 internally run data center to ‘‘the cloud’’ is a significant one, often with potential benefits that may include cost efficiencies, automation, increased security, and resiliency, and entities may also take advantage of such an opportunity to reengineer or otherwise update their systems and applications to run even more efficiently than before. In deciding whether to utilize a CSP, an SCI entity generally should take into account the various factors it would as with any other third-party providers.278 However, given the degree to which CSP services may be integral to the operation of SCI systems, SCI entities generally should examine closely any potential relationship and utilization of CSP services. Importantly, regardless of the CSP and service model an SCI entity may be considering, it is the SCI entity’s responsibility to ensure that it can and does comply with Regulation SCI. For example, in describing the services they provide, CSP marketing materials typically describe their service models as ‘‘shared responsibilities’’ between the CSP and client. With respect to an SCI entity’s obligations under Regulation SCI, however, the SCI entity bears responsibility for compliance with the requirements of Regulation SCI, including for SCI systems operated on its behalf by third-party providers. As with other third-party providers that operate SCI systems on behalf of an SCI entity, if an SCI entity is uncertain of its ability to manage a CSP relationship (whether through appropriate due diligence, contract terms, monitoring, or other methods) to satisfy the requirements of Regulation SCI, the SCI entity would need to reassess its decision to outsource the applicable system to such CSP. As with any thirdparty provider, the SCI entity generally should not rely solely on the reputation of or attestations from a given CSP. In addition, an SCI entity that utilizes a CSP should not view the usage of a CSP from the perspective of being able to turn over its Regulation SCI-related responsibilities to the CSP; instead, an SCI entity generally should ensure that its own personnel have the requisite skills to properly manage and oversee such a relationship, and understand the issues—including technical ones—that may arise from the
utilization of a CSP and are relevant to ensure its compliance with Regulation SCI.279 Rule 1001(a)(2)(v) of Regulation SCI requires that an SCI entity’s policies and procedures include business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption.280 When the Commission adopted this provision it did not specifically discuss its application to CSPs. Whereas ‘‘on-premises’’ systems are installed and run at a site under the control of an SCI entity, the systems of an SCI entity that reside ‘‘in the public cloud’’ may not be tied to any specific geographic location. However, SCI entities must ensure that their SCI systems, whether ‘‘on-premises’’ or ‘‘in the public cloud,’’ comply with the requirement in Regulation SCI to have backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a widescale disruption. These provisions of Regulation SCI exist to help limit the downtime caused by wide-scale disruptions. Thus, for example, in determining whether any SCI-related systems ‘‘in the public cloud’’ can meet this requirement, SCI entities generally should understand where its systems will reside (i.e., the locations of the CSP data center site(s) that may be used), and should consider whether those sites provide sufficient geographical diversity and operational resiliency to achieve the resumption requirements of Rule 1001(a)(2)(v).281 As discussed in section III.C.2.b.2 below, the Commission’s proposal includes a requirement that every SCI entity undertake a risk-based assessment of the criticality of each of its thirdparty providers, including analyses of third-party provider concentration, of key dependencies if the third-party provider’s functionality, support, or service were to become unavailable or materially impaired, and of any potential security, including cybersecurity, risks posed. This thirdparty provider assessment may be particularly relevant with respect to CSPs utilized by SCI entities, and an SCI entity may want to take into consideration the degree to which it may be ‘‘locked-in’’ to any given CSP it is considering engaging. As with any third-party provider, it could consider its exit strategies with respect to any potential CSP it might choose and may consider architectural decisions that would enable a quick re-deployment to another CSP if needed. Even when tools,

282Containerization allows developers to deploy applications more quickly by bundling an application with its required frameworks, configuration files, and libraries such that it may be run in different computing environments. Container orchestrators allow for automated deployment of identical applications across different environments, and simplify the process for management, scaling, and networking of containers. 283See, e.g., Rule 1002 (relating to an SCI entity’s obligations with respect to SCI events). See also Rule 1001(c) (which include requirements that an SCI entity’s policies and procedures include escalation procedures to quickly inform responsible SCI personnel of potential SCI events). 284See 17 CFR 242.1001(a)(2)(iv) (‘‘Rule 1001(a)(2)(iv)’’) (relating to, among other things, vulnerabilities pertaining to internal threats) and Rule 1005 (relating to recordkeeping requirements related to compliance with Regulation SCI). See also infra section III.C.3.a (discussing newly proposed 17 CFR 242.1001(a)(2)(x) (‘‘proposed Rule 1001(a)(2)(x)’’), relating to unauthorized access to systems and information). 285One example of this are the services of shadow infrastructure providers, such as edge cloud computing, content delivery networks, and DNS providers. 286See supra notes 268–270 and accompanying text (discussing ‘‘on behalf of’’). 287See SCI Adopting Release, supra note 1, at
72302. See also Staff Guidance on Current SCI
Industry Standards 5, 8 (Nov. 19, 2014), available at https://www.sec.gov/rules/final/2014/staffguidance-current-sci-industry-standards.pdf. 288The Commission proposed the Clearing Agency Governance rules in Aug. 2022, which contains, among other proposed requirements, proposed new 17 CFR 240.17Ad–25(i) (‘‘Rule 17Ad–25(i)’’). See Clearing Agency Governance and Conflicts of Interest, Securities Exchange Act Release No. 95431 (Aug. 8, 2022), 87 FR 51812 (Aug. 23, 2022) (proposing policy and procedure requirements for clearing agency board of directors to oversee relationships with service providers for critical services to, among other things, confirm and document that risks related to relationships with service providers for critical services are managed in a manner consistent with its risk management framework, and review senior management’s monitoring of relationships with service providers for critical services, and to review and approve plans for entering into third-party relationships where the engagement entails being a service provider for critical services to the registered clearing agency). Registered clearing agencies that would be subject to proposed Rule 17Ad–25(i), if adopted, would also be subject to Regulation SCI, as proposed to be amended. However, the scope of proposed Rule 17Ad–25(i) is meant to address not only service providers providing technology or systems-based services, but also service providers that would include the clearing agency’s parent company under contract to staff the registered clearing agency, as well as service providers that are investment advisers under contract to help facilitate the closing out of a defaulting participant’s portfolio. See id. at 51836. Commenters are encouraged to review the Clearing Agency Governance proposed rules to determine whether they might affect their comments on this proposal. such as containerization,282 exist that are designed to automate and simplify the deployment of systems to CSPs, and which appear at first glance to allow for greater portability among CSPs, SCI entities may want to consider any lockin effects that utilizing CSP-specific tools might have. In addition, it may be useful for SCI entities to consider the relative benefits and costs of potential alternatives that could reduce dependence on any single CSP. In cases where the use of CSPs is being considered for both primary and backup systems, an SCI entity, taking into account the nature of its systems, may want to consider whether it is appropriate to utilize different CSPs, for such systems, as well as whether an ‘‘on-premises’’ backup may be appropriate. Similarly, SCI entities should generally engage their CSPs to ensure that they can meet the business continuity and disaster recovery requirements of Regulation SCI, which may not apply to the vast majority of a CSP’s other clients. More broadly, an SCI entity should ensure that it is able to meet its regulatory obligations under Regulation SCI, including
the notice and dissemination requirements of Rule
1002. When there is a systems issue
(including, for example, an outage or a cybersecurity event) at a CSP, a wide swath of CSP clients may be affected. SCI entities have regulatory requirements under Regulation SCI that other CSP clients may not have, and an SCI entity must have information regarding such issues within the time requirements of Regulation SCI to comply with its notice and dissemination requirements.283 An SCI entity should also be cognizant of its data security and recordkeeping obligations under Regulation SCI,284 and generally should consider how the CSP and its employees or contractors would secure confidential information, how and where it would retain information (including all records required to be kept under Regulation SCI), how the information would be accessed by the personnel of the SCI entity, or others, such as those conducting SCI reviews and Commission staff, as well as ensure that such information access will be provided in a manner that provides for its compliance with the requirements of Regulation SCI. While the discussion above is focused on CSPs, they are only one of many types of third-party providers an SCI entity may utilize. The discussion above is not an exhaustive list of issues SCI entities generally should consider with respect to utilizing CSPs; in addition, while the discussion provides some illustrative examples of areas of potential concern in an SCI entity’s relationship with a CSP, similar issues may be applicable to the relationships between SCI entities and other types of third parties. In addition, some thirdparty providers may provide key functionality that may not have been widely utilized by SCI entities when Regulation SCI was adopted,285 and the Commission anticipates that third-party providers will likely arise to provide other types of functionality, service, or support to SCI entities that are not contemplated yet today. All the same, the Commission believes that any thirdparty provider that an SCI entity uses with respect to its SCI systems and indirect SCI systems should be managed appropriately by the SCI entity to help ensure that such utilization of the thirdparty provider is consistent with the SCI entity’s obligations under Regulation SCI. As discussed above, when the Commission adopted Regulation SCI in 2014, it had accounted for the possibility that an SCI entity might utilize third-party providers to operate its SCI systems or indirect SCI systems by incorporating the phrase ‘‘on behalf of’’ in certain key definitions of Regulation SCI.286 In addition, ‘‘outsourcing’’ is one of the ‘‘domains’’ identified by the Commission and its staff.287 Based on the experience of Commission staff, all SCI entities that utilize third-party providers have some level of third-party provider oversight in place. However, given the growing role they are playing with respect to SCI systems and indirect SCI systems, and because the myriad of issues that may arise with respect to third-party providers (including, but not limited
to oversight, access, speed of information flow, security and unauthorized access, loss of expertise internally, and lock-in) may become even more amplified when taking into account the regulatory obligations of SCI entities, the Commission believes that it is appropriate to delineate more clearly requirements with respect to the oversight and management of thirdparty providers, and thus is proposing to revise Regulation SCI to include additional requirements relating to third-party providers.288 b. Third-Party Provider Management Program The Commission is proposing new 17 CFR 242.1001(a)(2)(ix) (‘‘proposed Rule 1001(a)(2)(ix)’’) regarding third-party provider management. While some SCI entities may already have a formal vendor management program, the Commission is proposing to require that SCI entities have a third-party provider management program that includes certain elements. Specifically, proposed Rule 1001(a)(2)(ix) would require each SCI entity to include in its policies and procedures required under Rule 1001(a)(1) a program to manage and

289See supra section III.C.2.a.
290See SCI Adopting Release, supra note 1, at 72276. 291See id. oversee third-party providers that provide functionality, support or service, directly or indirectly, for its SCI systems and, for purposes of security standards, indirect SCI systems. The Commission is proposing this new provision to help ensure that an SCI entity that elects to utilize a third-party provider will be able to meet its obligations under Regulation SCI.
i. Third-Party Provider Contract Review
First, the program would be required to include initial and periodic review of contracts with such third-party providers for consistency with the SCI entity’s obligations under Regulation SCI. The Commission believes that it is critical that each SCI entity carefully analyze and understand the impact any third-party providers it chooses to utilize may have on its ability to satisfy its obligations under Regulation SCI. As discussed above,289 the Commission recognizes that many SCI entities may seek to and, in practice, do outsource certain of its SCI-related functionality, support, or service to third parties. As key entities in our securities markets, SCI entities have regulatory obligations that are not placed upon non-SCI entities, and third-party providers SCI entities may utilize may not be familiar with the requirements of Regulation SCI. As the Commission stated in adopting Regulation SCI, if an SCI entity determines to utilize a third party for an applicable system, ‘‘it is responsible for having in place processes and requirements to ensure that it is able to satisfy the applicable requirements of Regulation SCI for such system.’’ 290 And, if an SCI entity is uncertain of its ability to manage a third-party relationship (including through contract terms, among other methods) to satisfy the requirements of Regulation SCI, ‘‘then it would need to reassess its decision to outsource the applicable system to such third party.’’ 291 Thus, it is incumbent on SCI entities to review their relationships with such third-party providers to ensure that the SCI entities are able to satisfy their obligations under Regulation SCI. In addition, consistent with the current requirement that an SCI entity periodically review the effectiveness of its policies and procedures, this provision would require an SCI entity to review contracts with such third-party providers periodically for consistency with the SCI entity’s obligations under Regulation SCI. A foundational part of this review is to ensure that any contracts that the SCI entity has with such third-party providers are consistent with the requirements of Regulation SCI. These documents govern the obligations and expectations as between an SCI entity and a third-party provider it utilizes, and the SCI entity is responsible for assessing if these agreements allow it to comply with the requirements of Regulation SCI. For example, an SCI entity generally should consider whether or not it is appropriate to rely on a third-party provider’s standard contract or standard service level agreement (‘‘SLA’’), particularly if such contract or SLA has not been drafted with Regulation SCI’s requirements in mind. For example, regardless of whether an SCI entity is negotiating with the dominant provider in the field, has made its best efforts in negotiating contract or SLA terms, or has extracted what it believes to be ‘‘the best terms’’ it (or any client of the third party) could get, if the SCI entity determines
that any term in such agreements are inconsistent with such SCI entity’s obligations under Regulation SCI, the SCI entity should reassess whether such outsourcing arrangement is appropriate and will allow it to meet its obligations under Regulation SCI. In addition, in some cases, particularly where the third-party provider would play a significant role in the operation of an SCI entity’s SCI systems or indirect SCI systems, or provide functionality, support, or service to such systems without which there would be a meaningful impact, an SCI entity and its third-party provider may find it useful to negotiate an addendum to any standard contract to separate and highlight the contractual understanding of the parties with respect to SCI-related obligations. While each contract’s specific terms and circumstances will likely differ, there are several considerations that SCI entities generally should take into consideration when entering into such a contract. For example, SCI entities generally should consider whether a contract raises doubt on its consistency with the SCI entity’s obligations under Regulation SCI (e.g., the contract terms are vague regarding the third-party provider’s obligations to the SCI entity to enable the SCI entity to meets its SCI obligations). Generally, contractual terms should not be silent or lack substance on key aspects of Regulation SCI that would need the third-party provider’s cooperation (e.g., SCI event notifications and information dissemination, and business continuity and disaster recovery for an SCI entity seeking to move its SCI systems to a cloud service provider). Nor should they undermine the ability of the SCI entity to oversee and manage the third party (e.g., by limiting the SCI entity’s personnel ability to assess whether systems operated by a third-party provider on behalf of the SCI entity satisfy the requirements of Regulation SCI). The SCI entity may want to consider and, if appropriate, negotiate provisions that provide priority to the SCI entity’s systems, such as for failover and/or business continuity and disaster recovery (‘‘BC/DR’’) scenarios, if needed to meet the SCI entity’s obligations under Regulation SCI. In addition, an SCI entity generally should review the contract for provisions that, by their terms, are inconsistent with Regulation SCI or would otherwise fail to satisfy the requirements of Regulation SCI (e.g., restricting information flow to the SCI entity and/or Commission and its staff pursuant to a non-disclosure agreement in a manner inconsistent with the requirements of Regulation SCI; specifying response times that are inconsistent with (i.e., slower than) those required by Regulation SCI with respect to notifications regarding SCI events under Rule 1002). The Commission also believes that, to the extent possible, SCI entities may want to avoid defining terms in a contract with a third-party provider differently from how they are used in Regulation SCI, as this may introduce
confusion as to the scope and applicability of Regulation SCI. In addition, although it is a term that may be common in many commercial contracts, provisions that provide the third-party provider with the contractual right to be able to make decisions that would negatively impact an SCI entity’s obligations in its ‘‘commercially reasonable discretion’’ should be carefully considered, as what may be considered ‘‘commercially reasonable’’ for many entities that are not subject to Regulation SCI may not be appropriate for an SCI entity and its SCI systems and indirect SCI systems when taking into consideration the regulatory obligations of Regulation SCI.
ii. Risk-Based Assessment of ThirdParty Providers
The Commission is also proposing in proposed Rule 1001(a)(2)(ix) to require each SCI entity to undertake a riskbased assessment of each third-party provider’s criticality to the SCI entity, including analyses of third-party provider concentration, of key dependencies if the third-party provider’s functionality, support, or

292Critical SCI systems include systems that directly support functionality relating to: (i) clearance and settlement systems of clearing agencies; (ii) openings, reopenings, and closings on the primary listing market; (iii) trading halts; (iv) initial public offerings; (v) the provision of market data by a plan processor; or (vi) exclusively listed securities. In addition, the definition of critical SCI systems includes a catchall provision for systems that provide functionality to the securities markets for which the availability of alternatives is significantly limited or nonexistent and without which there would be a material impact on fair and orderly markets. 293See SCI Adopting Release, supra note 1, at 72277. 294While such scenarios may appear to be improbable, given the criticality of the critical SCI systems to the SCI entity and U.S. securities markets, SCI entities should have plans in place to account for such scenarios, however remote. 295See 17 CFR 242.1004. See also SCI Adopting Release, supra note 1, at 72347–55 (providing a more detailed discussion of the BC/DR testing requirements under Rule 1004). service were to become unavailable or materially impaired, and of any potential security, including cybersecurity, risks posed. The Commission believes that specifically requiring each SCI entity to undertake a risk-based assessment of each of its third-party providers’ criticality to the SCI entity will help them more fully understand the risks and vulnerabilities of utilizing each third-party provider, and provide the opportunity for the SCI entity to better prepare in advance for contingencies should the provider’s functionality, support, or service become unavailable or materially impaired. In performing this risk-based assessment, SCI entities would be required to consider third-party provider concentration, which would help ensure that they properly account and prepare contingencies or alternatives for an overreliance on a given third-party provider by the SCI entity or by its industry. In addition, each SCI entity would be required to assess any potential security, including cybersecurity, risks posed by its thirdparty provider, to help ensure that the SCI entity does not only take into consideration the benefits it believes a third-party provider can provide it, but the security risks involved in utilizing a given provider as well.
c. Third-Party Providers for Critical SCI
Systems
The newly proposed provisions of proposed Rule 1001(a)(2)(ix) discussed above would apply to all SCI entities for all of their SCI systems. However, given the essential nature of critical SCI systems,292 the Commission believes that it is appropriate to require SCI entities to have even more robust policies and procedures with respect to any third-party provider that supports such systems. In adopting Regulation SCI, the Commission stated that critical SCI systems are those SCI systems ‘‘whose functions are critical to the operation of the markets, including those systems that represent potential single points of failure in the securities markets [and] . . . are those that, if they were to experience systems issues, the Commission believes would be most likely to have a widespread and significant impact on the securities market.’’ 293 Therefore, the Commission is proposing to revise Rule 1001(a)(2)(v), which relates to the business continuity and disaster recovery plans of SCI entities. Currently, Rule 1001(a)(2)(v) requires their policies and procedures to include business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a widescale disruption. To help ensure that SCI entities are appropriately prepared for any contingency relating to a thirdparty provider with respect to critical SCI systems, the Commission is proposing to revise Rule 1001(a)(2)(v) to also require the BC/DR plans of SCI entities to be reasonably designed to address the unavailability of any thirdparty provider that provides functionality, support, or service to the SCI entity without which there would be a material impact on any of its critical SCI systems. As discussed above, the Commission is proposing under proposed Rule 1001(a)(2)(ix) to require each SCI entity to conduct a risk-based assessment of the criticality of each of its third-party providers to the SCI entity. With respect to an SCI entity’s critical SCI systems, the Commission believes the revised provisions of Rule 1001(a)(2)(v) are appropriate to ensure that an SCI entity has considered and addressed in its BC/ DR plans how it would deal with a situation in which a third-party provider that provides any functionality, support, or service for any of its critical SCI systems has an issue that would materially impact any such system. For example, such BC/DR plans generally should not only take into account and address temporary losses of functionality, support, or service—such as a momentary outage that causes a feed to be interrupted or extended cybersecurity event on the third-party provider—but also consider more extended outage scenarios, including if the third-party provider goes into bankruptcy or dissolves, or if it breaches its contract and decides to suddenly,
unilaterally, and/or permanently cease to provide the SCI entity’s critical SCI systems with functionality, support, or service.294 In determining how to satisfy the requirement that policies and procedures be reasonably designed to address the unavailability of any thirdparty provider that provides functionality, support, or service to the SCI entity without which there would be a material impact on any of its critical SCI systems, an SCI entity could consider if use of a CSP for its critical SCI systems also warrants maintaining an ‘‘on-premises’’ backup data center or other contingency plan which could be employed in the event of the scenarios noted above. d. Third-Party Provider Participation in BC/DR Testing With respect to an SCI entity’s business continuity and disaster recovery plans, including its backup systems, Rule 1004 of Regulation SCI requires SCI entities to: (a) establish standards for the designation of those members or participants that the SCI entity reasonably determines are, taken as a whole, the minimum necessary for the maintenance of fair and orderly markets in the event of the activation of such plans; (b) designate members or participants pursuant to such standards and require participation by such designated members or participants in scheduled functional and performance testing of the operation of such plans, in the manner and frequency specified by the SCI entity, provided that such frequency shall not be less than once every 12 months; and (c) coordinate the testing of such plans on an industry- or sector-wide basis with other SCI entities.295 Because the Commission believes that some third-party providers may be of such importance to the operations of an SCI entity, the Commission is proposing to include certain third-party providers in the BC/DR testing requirements of Rule 1004. In the same way SCI entities currently are required to establish standards for and require participation by their members or participants in the annual industry-wide testing required of all SCI entities, the Commission is adding third-party providers as another category of entities. Thus, pursuant to revised paragraph (a) of Rule 1004, an SCI entity would be required also to establish standards for the designation of third-party providers (in addition to members or participants) that it determines are, taken as a whole, the minimum necessary for the

296Contractual arrangements with applicable third-party providers that require such providers to engage in BC/DR testing could help ensure implementation of this requirement. See also SCI Adopting Release, supra note 1, at 72350 (discussing how contractual arrangements by SCI entities that are not SROs would enable such SCI entities to implement the BC/DR testing requirement for their members or participants). 297See 12 U.S.C. 5462(6). The definition of ‘‘financial market utility’’ in section 803(6) of the Clearing Supervision Act contains a number of exclusions that include, but are not limited to, certain designated contract markets, registered futures associations, swap data repositories, swap execution facilities, national securities exchanges, national securities associations, alternative trading systems, security-based swap data repositories, security-based swap execution facilities, brokers, dealers, transfer agents, investment companies, and futures commission merchants. See 12 U.S.C. 5462(6)(B). 298See 12 U.S.C. 5463. An FMU is systemically important if the failure of or a disruption to the functioning of such FMU could create or increase the risk of significant liquidity or credit problems spreading among financial institutions or markets and thereby threaten the stability of the U.S. financial system. See 12 U.S.C. 5462(9). On July 18, 2012, the FSOC designated as systemically important the following then-registered clearing agencies: CME Group (‘‘CME’’), DTC, FICC, ICC, NSCC, and OCC. The Commission is the supervisory agency for DTC, FICC, NSCC, and OCC, and the CFTC is the supervisory agency for CME and ICE. The Commission jointly regulates ICC and OCC with the CFTC. The Commission also jointly regulates ICE Clear Europe (‘‘ICEEU’’), which has not been designated as systemically important by FSOC, with the CFTC and Bank of England. The Commission also jointly regulated CME with the CFTC until 2015, when the Commission published an order approving CME’s request to withdraw from registration as a clearing agency. See Securities Exchange Act Release No. 76678 (Dec. 17, 2015), 80 FR 79983 (Dec. 23, 2015). 299The objectives and principles for the risk management standards prescribed under the Clearing Supervision Act shall be to (i) promote robust risk management; (ii) promote safety and soundness; (iii) reduce systemic risks; and (iv) support the stability of the broader financial system. Further, the Clearing Supervision Act states that the standards may address areas such as risk management policies and procedures; margin and collateral requirements; participant or counterparty default policies and procedures; the ability to complete timely clearing and settlement of financial transactions; capital and financial resources requirements for designated FMUs; and other areas that are necessary to achieve the objectives and principles described above. See 12 U.S.C. 5464(b), (c). 300See 12 U.S.C. 5462(6). 301See 12 U.S.C. 5466. 302See 12
U.S.C. 5472; see also Federal Reserve Board, et al., Risk Management Supervision of Designated Clearing Entities (July 2011), available at https://www.federalreserve.gov/publications/ other-reports/files/risk-management-supervisionreport-201107.pdf (describing the joint supervisory framework of the Commission, CFTC, and Federal Reserve Board). 303 12 U.S.C. 5466. maintenance of fair and orderly markets in the event of the activation of the SCI entity’s BC/DR plans. In addition, paragraph (b) of Rule 1004 would require each SCI entity to designate such third-party providers (in addition to members or participants) pursuant to such standards and require their participation in the scheduled functional and performance testing of the operation of such BC/DR plans, which would occur not less than once every 12 months and which would be coordinated with other SCI entities on an industry- or sector-wide basis. As discussed above, SCI entities often employ a wide array of third-party providers which perform a multitude of different functions, support, or services for them. While many of these thirdparty providers may provide relatively minor functions, support, or services for an SCI entity, there may be one or more third-party providers of such significance to the operations of an SCI entity that, without the functions, support, or services of such provider(s), the maintenance of fair and orderly markets in the event of the activation of the SCI entity’s BC/DR plans would not be possible. For example, the Commission believes it likely that, for an SCI entity that utilizes a cloud service provider for all, or nearly all, of its operations, such CSP would be of such importance to the operations of the SCI entity and the maintenance of fair and orderly markets in the event of the activation of the SCI entity’s BC/DR plans that it would be required to participate in the BC/DR testing required by Rule 1004.296 e. Third-Party Providers of Certain Registered Clearing Agencies The Commission may examine the provision of services by third-party providers of certain registered clearing agencies. The Financial Stability Oversight Council (‘‘FSOC’’) has designated certain financial market utilities (‘‘FMUs’’) 297 as systemically important or likely to become systemically important financial market utilities (‘‘SIFMUs’’).298 The Payment, Clearing, and Settlement Supervision Act of 2010 (‘‘Clearing Supervision Act’’), enacted in Title VIII of the DoddFrank Wall Street Reform and Consumer Protection Act of 2010 (‘‘Dodd-Frank Act’’), provides for the enhanced regulation of certain FMUs.299 FMUs include clearing agencies that manage or operate a multilateral system for the purpose of transferring, clearing, or settling payments, securities, or other financial transactions among financial institutions or between financial institutions and the FMU.300 For SIFMUs, the Clearing Supervision Act provides for enhanced coordination between the Commission and Federal Reserve
Board by allowing for regular on-site examinations and information sharing,301 and further provides that the Commission and CFTC shall coordinate with the Federal Reserve Board to develop risk management supervision programs for SIFMUs jointly.302 In addition, section 807 of the Clearing Supervision Act provides that ‘‘[w]henever a service integral to the operation of a designated financial market utility is performed for the designated financial market utility by another entity, whether an affiliate or non-affiliate and whether on or off the premises of the designated financial market utility, the Supervisory Agency may examine whether the provision of that service is in compliance with applicable law, rules, orders, and standards to the same extent as if the designated financial market utility were performing the service on its own premises.’’ 303 Given the importance of the provision of services by SIFMUs to the U.S. financial system and global financial stability, SIFMU third-party providers may be integral to the operation of the SIFMU and thus be examined by the Commission. f. Request for Comment
58. Do SCI entities employ third-party
providers to operate SCI systems or indirect SCI systems on their behalf? If so, what types of systems are most frequently operated by third parties?
59. Please describe SCI entities’ use of
third-party providers generally, even if they do not operate SCI systems or indirect SCI systems on behalf of an SCI entity. What types of functionality, support, or service do such entities provide to SCI entities? Please describe.
60. The Commission requests
commenters’ views on significant issues that they believe SCI entities should take into account with respect to their use of third-party providers and the requirements of Regulation SCI. Are there common or important issues that commenters believe the Commission should focus on in addition to those discussed above? If so, please describe.
61. Do commenters believe it is
appropriate to require, as in proposed Rule 1001(a)(2)(ix), that each SCI entity have a program to manage and oversee third-party providers that provide functionality, support or service, directly or indirectly, for its SCI systems and, for purposes of security standards, indirect SCI systems? Do commenters believe that such a program should require an initial and periodic review of contracts with such providers for consistency with the SCI entity’s obligations under Regulation SCI? Why or why not?
62. Do commenters believe that it is
appropriate to require each SCI entity to

304See 17 CFR 242.1001(a)(2)(iv).
305See 17 CFR 242.1003(b)(1)(i).
306See 17 CFR 242.1000.
307See SCI Adopting Release, supra note 1, at 72287–89 (discussing systems intrusions). 308A ‘‘systems intrusion’’ is defined as ‘‘any unauthorized entry into the SCI systems or indirect SCI systems of an SCI entity.’’ See 17 CFR 242.1000. 309See 17 CFR 242.1002. 310Cybersecurity events can span a wide variety of types of threats. For example, FINRA summarized common cybersecurity threats faced by broker-dealers to include phishing, imposter websites, malware, ransomware, distributed denialof-service attacks, and vendor breaches, among others. See FINRA, Common Cybersecurity Threats, available at www.finra.org/rules-guidance/ guidance/common-cybersecurity-threats. 311See, e.g., Financial Services Information Sharing and Analysis Center, Navigating Cyber 2022 (Mar. 2022), available at www.fsisac.com/ navigatingcyber2022-report (detailing cyber threats that emerged in 2021 and predictions for 2022); Bree Fowler, Number and cost of cyberattacks continue to grow, new survey says, CNET (Jan. 21, 2022), available at https://www.cnet.com/news/ privacy/cyberattacks-continue-to-increase-newsurvey-says (citing, among other things, Anomali’s poll of cybersecurity decision makers that 87% of their companies had experienced a cyberattack in the past three years that resulted in damage, disruption, or data breach); Accenture, Triple digit increase in cyberattacks: What next? (Aug. 4, 2021), available at www.accenture.com/us-en/blogs/ security/triple-digit-increase-cyberattacks; Chris Morris, Cyberattacks and ransomware hit a new record in 2021, says report, Fast Company (Jan. 25, 2022), available at https://www.fastcompany.com/ 90715622/cyberattacks-ransomware-data-breachnew-record-2021 (citing report by Identity Theft Resource Center stating that the number of security compromises was up more than 68% in 2021). 312See, e.g., Stephen Deere, Cost of City of Atlanta’s cyber attack: $2.7 million—and rising, The Atlanta Journal-Constitution (Apr. 12, 2018), available at https://www.ajc.com/news/cost-cityatlanta-cyber-attack-million-and-rising/ nABZ3K1AXQYvY0vxqfO1FI/ (describing the costs relating to a five-day ransomware attack on the City of Atlanta in Mar. 2018). 313See, e.g., Clare Duffy, Colonial Pipeline attack:
A ‘wake up call’ about the threat of ransomware, CNN Business (May 16, 2021), available at https:// www.cnn.com/2021/05/16/tech/colonialransomware-darkside-what-to-know/index.html (describing the ransomware attack on a pipeline and concerns regarding the potential for similar attacks on critical US infrastructure). 314See, e.g., David Uberti, et al., The Log4j Vulnerability: Millions of Attempts Made Per Hour to Exploit Software Flaw, Wall Street Journal (Dec. 21, 2021), available at https://www.wsj.com/ articles/what-is-the-log4j-vulnerability11639446180 (discussing the Log4j hack). 315See, e.g., Kim Zetter, That Insane, $81M Bangladesh Bank Heist? Here’s What We Know, WIRED (May 17, 2016), available at https:// www.wired.com/2016/05/insane-81m-bangladeshbank-heist-heres-know/. include a risk-based assessment of each third-party provider’s criticality to the SCI entity, including analyses of thirdparty provider concentration, of key dependencies if the third-party provider’s functionality, support, or service were to become unavailable or materially impaired, and of any potential security, including cybersecurity, risks posed? Why or why not?
63. Are there any third-party
providers, or types of third-party providers, that commenters believe an SCI entity or SCI entities rely on in a manner that creates, from the commenters’ point of view, undue concentration risk? If so, please describe.
64. Are there other aspects of thirdparty provider management that
commenters believe should be included in the proposed rule provision? If so, please describe.
65. Do commenters agree with the
proposed revisions to Rule 1001(a)(2)(v) to require the BC/DR plans of SCI entities to be reasonably designed to address the unavailability of any thirdparty provider that provides functionality, support, or service to the SCI entity without which there would be a material impact on any of its critical SCI systems? Why or why not? Do commenters believe that any such providers exist today for the critical SCI systems of SCI entities? If so, please describe. Should the Commission require third-party provider diversity for critical systems of an SCI entity, for example, requiring an SCI entity that utilizes a third-party provider for its critical SCI systems to use a different party (i.e., another third-party provider or operate the critical SCI system itself) for its backup for such systems? Why or why not?
66. Do commenters agree with the
proposed revisions to Rule 1004 to require that SCI entities establish standards and designate third-party providers that must participate in BC/ DR testing in the annual industry-wide BC/DR testing required by Rule 1004? Why or why not?
3. Security
The Commission recognized the importance of security for the technology systems of SCI entities and included various requirements and provisions in Regulation SCI relating to the security of an SCI entity’s SCI systems. For example, the rules provide that minimum policies and procedures must provide for, among other things, regular reviews and testing of systems, including backup systems, to identify vulnerabilities from internal and external threats.304 In addition, penetration testing is required as part of the SCI review.305 Recognizing that SCI systems may be vulnerable if other types of systems are not physically or logically separated (or ‘‘walled off’’), Regulation SCI also specifies that ‘‘indirect systems’’—defined as systems that if breached, are reasonably likely to pose a security threat to SCI systems— are also subject to the provisions of Regulation SCI relating to security standards and systems intrusions.306 Thus, the application of Regulation SCI to indirect SCI systems could encourage SCI entities to establish effective controls that result in the core SCI systems being logically or physically separated from other systems that could provide vulnerable entry points into SCI systems, thereby removing these nonSCI systems from the scope of indirect SCI systems.307 Regulation SCI also includes ‘‘systems intrusions’’ 308 as one of three types of SCI events for which SCI entities are required to take corrective action, provide notification to the Commission, and disseminate information to their members and participants.309 Since the adoption of Regulation SCI in 2014, cybersecurity has continued to be a significant concern for SCI entities and non-SCI entities alike. Various studies and surveys have noted significant increases in cybersecurity events 310 across all types of companies in recent years.311 Among these are targeted ransomware attacks that lock access to a victim’s data unless a ransom is paid, and have included certain high-profile incidents involving the local government of a major U.S. city 312 as well as one of the largest oil pipelines in the United States.313 Cybersecurity events have also included hacks that have had widespread impacts across many industries and types of entities.314 Financial sector entities have been vulnerable to cybersecurity events as well, including the Society for Worldwide Interbank Financial Telecommunication (‘‘SWIFT’’), an international cooperative of financial institutions that provides safe and secure financial transactions for its members, which was the target of a series of cybersecurity events in 2015 and 2016, including one incident in which $81 million was stolen.315 Given the continued and increasing risks associated with cybersecurity for SCI entities, the Commission believes it is appropriate to enhance the cybersecurity provisions of Regulation SCI to help ensure that SCI systems and indirect SCI systems of the most important entities in our securities markets remain secure.
a. Unauthorized Access to Systems and Information While Rule 1001(a)(1) already requires an SCI entity to have policies and procedures reasonably designed to ensure that its SCI systems and indirect SCI systems have levels of security adequate to maintain operational capabilities and promote the

316See Exchange Act Cybersecurity Proposal, supra note 10. 317See Exchange Act Cybersecurity Proposal, supra note 10 (similarly discussing examples of access controls). 318See Rule 1001(a)(4) of Regulation SCI (defining current SCI industry standards), which is discussed further in infra section III.C.5. 319Specifically, paragraph (b)(1) of Rule 1003 currently requires that ‘‘[p]enetration test reviews of the network, firewalls, and production systems shall be conducted at a frequency of not less than once every three years . . .’’. Rule 1003(b)(1). 320See SCI Adopting Release, supra note 1, at 72344. 321See, e.g., Fortra, 2022 Penetration Testing Report 14 (July 7, 2022), available at https:// static.fortra.com/core-security/pdfs/guides/cs-2022- pen-testing-report.pdf (stating that 42% of respondents conducted penetration testing one or two times a year, and 45% of respondents conducted penetration testing at a more frequent pace); PCI Security Standards Council, Information Supplement: Penetration Testing Guidance 6 (Sept. 2017), available at https://listings.pcisecurity standards.org/documents/Penetration-TestingGuidance-v1_1.pdf (‘‘at least annually and upon significant changes’’). 322As discussed further below, as part of the proposed revisions to the SCI review requirement, the Commission is also moving rule provisions relating to the substantive requirements of the SCI review to Rule 1000 under the definition of ‘‘SCI review,’’ while timing requirements relating to the SCI review and the report of the SCI review would be contained in Rule 1003(b). Thus, although currently the requirement relating to penetration test reviews is in Rule 1003, it is now proposed to be in Rule 1000. maintenance of fair and orderly markets, and Rule 1001(a)(4) specifies that policies and procedures will be deemed reasonable if consistent with current SCI industry standards, Rule 1001(a)(2) is not specific in terms of the need for an SCI entity to have access controls designed to protect both the security of the systems and the information residing therein. Limiting access to SCI systems and indirect SCI systems and the information residing therein to authorized purposes and users is particularly important given that these systems include the core technology of key U.S. securities markets entities, and would help ensure that such systems and information remain safeguarded and protected from unauthorized uses. Proposed Rule 1001(a)(2)(x) would specify that the Rule 1001(a)(1) policies and procedures of SCI entities include a program to prevent the unauthorized access to such systems and information residing therein. An SCI entity’s policies and procedures generally should specify appropriate access controls to ensure that its applicable systems and information is protected. Such policies and controls generally should be designed to prevent both unauthorized external intruders as well as unauthorized internal personnel from access to these systems and
information. For example, this would also include personnel that may be inappropriately accessing certain systems and/or information residing on such systems, though they may have authorized access to other systems, portions of systems, or certain information residing in such systems at the SCI entity. Thus, for example, the procedures and access controls at the SCI entity generally should provide for an appropriate patch management cycle for systems software, to ensure that known software vulnerabilities are identified and patches are deployed and validated in a timely manner. The procedures and access controls generally should also be calibrated sufficiently to account for such different levels of access for each person granted access to any part of the SCI entity’s systems or information. In addition, this requirement would make clear that an SCI entity’s policies and procedures are required to address not only protection of its technology systems, but also of the information residing on such systems. In developing and implementing such policies and procedures, SCI entities generally should develop a clear understanding of the need for access to systems and data, including identifying which users should have access to sensitive systems or data. In general, such policies and procedures should include: requiring standards of behavior for individuals authorized to access SCI systems and indirect SCI systems and information residing therein, such as an acceptable use policy; identifying and authenticating individual users; establishing procedures for timing distribution, replacement, and revocation of passwords or methods of authentication; restricting access to specific SCI systems or components thereof or information residing therein only to individuals requiring access to such systems or information as is necessary for them to perform their responsibilities or functions for the SCI entity; and securing remote access technologies used to interface with SCI systems.316 Access to systems and data can be controlled through a variety of means, including but not limited to the issuance of user credentials, digital rights management with respect to proprietary hardware and copyrighted software, authentication methods including multifactor authentication as appropriate, tiered access to sensitive information and network resources, and security and access measures that are regularly monitored not only to provide access to authorized users, but also to remove access for users that are no longer authorized (e.g., due to termination of employment).317 As with other policies and procedures required under Rule 1001, SCI entities may, if they choose, look to SCI industry standards in developing their policies and procedures to prevent unauthorized access to information and systems.318 b. Penetration Testing Penetration tests can help entities understand how effective their security policies and controls are in the face of attempted and successful systems
intrusions, and assist in revealing the potential threats and vulnerabilities to the entity’s network and controls that might be exploited by malicious attackers to disrupt the operation of their systems, result in stolen confidential information, and damage their reputations. When the Commission adopted Regulation SCI in 2014, it required that SCI entities conduct penetration testing as part of its SCI review 319 but, because of the costs associated with penetration testing at the time, only required that such tests be conducted once every three years.320 In the time since the adoption of Regulation SCI, cybersecurity has become an even greater and more pervasive concern for all types of businesses, including SCI entities. At the same time, best practices of businesses with respect to penetration testing have evolved such that such tests occur on a much more frequent basis, as businesses confront the threat of cybersecurity events on a wider scale.321 Given this, the Commission is proposing to increase the frequency of penetration testing by SCI entities such that they are conducted at least annually, rather than once every three years. The Commission believes that such tests are a critical component of ensuring the cybersecurity health of an SCI entity’s technology systems and that such a frequency would help to ensure that robust measures are in place to protect an SCI entity’s systems from cybersecurity events. In addition, the proposed annual frequency would only be a minimum frequency and SCI entities may choose to adopt even more frequent penetration tests if they feel it appropriate to do so.322 In addition, the Commission is proposing to require that the conduct of such penetration testing include testing by the SCI entity of any vulnerabilities of its SCI entity’s SCI systems and indirect SCI systems identified pursuant to § 242.1001(a)(2)(iv). Currently, the requirement in Rule 1003 with respect to penetration testing does not include this phrase. However, Rule 1001(a)(2)(iv) requires an SCI entity’s policies and procedures to include,

323See 17 CFR 242.1002(a).
324See 17 CFR 242.1002(b) (setting forth the notification and follow-up reporting that is required for a systems intrusion that is not de minimis). 325See 17 CFR 242.1002(c). 326See SCI Adopting Release, supra note 1, at 72288. 327See SCI Adopting Release, supra note 1, at 72887–89 (providing a more detailed discussion of the current definition of systems intrusions). 328See id. (providing a more detailed discussion of the current definition of systems intrusions). 329See supra note 314 and accompanying text (discussing the Log4j hack). among other things, ‘‘regular reviews and testing . . . to identify vulnerabilities pertaining to internal and external threats . . .’’ The new language with respect to penetration testing (which is proposed to be located in the definition of SCI review in Rule
1000) would require SCI entities to
include testing of the vulnerabilities identified pursuant to its regular review and testing requirement in designing its penetration testing. Thus, rather than, for example, running a static annual test against a portion of its SCI systems, this proposed language would require an SCI entity’s penetration testing program to include any identified relevant threats and then conduct penetration testing accordingly, which should help ensure the security and resiliency of SCI systems.
c. Systems Intrusions
Rule 1000 of Regulation SCI defines a ‘‘systems intrusion’’ as any unauthorized entry into the SCI systems or indirect SCI systems of an SCI entity. Systems intrusions are one of three types of SCI events that each SCI entity must monitor for and, when they occur, subject to certain exceptions, an SCI entity must: take corrective action; 323 immediately notify the Commission and maintain certain records with respect to the event; 324 and promptly disseminate information about the event to applicable members and participants of each SCI entity.325 As discussed in the SCI Adopting Release,326 the definition of systems intrusion has several important characteristics to it, two of which are relevant to the changes proposed. First, because the term ‘‘entry’’ is used in the current definition, the term systems intrusions only applies to ‘‘successful’’ intrusions, thus excluding attempted (i.e., unsuccessful) intrusions. In addition, the term ‘‘entry into’’ implies that the intrusion is limited to events that result in an intruder entering into the SCI entity’s SCI systems or indirect SCI systems, and thus does not include any types of attacks on systems outside of the SCI entity’s SCI systems or indirect SCI systems that nonetheless impacts such systems. As discussed above, cybersecurity has become ever more increasingly important for all types of entities, and the same is true for SCI entities. The Commission believes that it is appropriate to expand the definition of systems intrusion to include two additional types of cybersecurity events. The first additional type of systems intrusion would include certain types of incidents that are currently considered to be cybersecurity events that are not included in the current definition, as discussed below. In addition, the revised definition would ensure that the Commission and its staff are made aware when an SCI entity is the subject of a significant cybersecurity threat, including those that may be ultimately unsuccessful, which would provide important information regarding threats that may be posed to other entities in the securities markets, including other SCI entities. By requiring SCI entities to submit SCI filings for these new types of systems intrusions, the Commission believes that the revised definition of systems intrusion would provide the Commission and its staff more complete information to assess the security status of the SCI entity, and also assess the impact or potential impact that unauthorized activity could have on the security of the SCI entity’s affected systems as well on other SCI entities and market participants. The proposed definition would have three prongs, the first of which would contain the current requirement that defines any ‘‘unauthorized entry into the SCI systems or indirect SCI systems of an SCI entity’’ as a systems intrusion, and would continue to include a wide range of cybersecurity events. As stated in the SCI Adopting Release, the current definition describes
‘‘any unauthorized’’ entry or ‘‘breach’’ into SCI systems or indirect SCI systems, and includes unauthorized access, whether intentional or inadvertent, by employees or agents of the SCI entity that resulted from weaknesses in the SCI entity’s access controls and/or procedures.327 For example, data breaches are included under the first prong, as are instances in which an employee of an SCI entity accessed an SCI system without proper authorization. It also includes instances in which an employee, such as a systems administrator, was authorized to access a system, but where the employee improperly accessed confidential information within such system. Similarly, an instance in which members of an SCI entity were properly accessing a system but were inadvertently exposed to the confidential information of other members would also likewise fall within this prong.328 The new second prong would expand the definition of systems intrusion to include any cybersecurity event that disrupts, or significantly degrades, the normal operation of an SCI system. This prong is intended to include cybersecurity events on the SCI entity’s SCI systems or indirect SCI systems that cause disruption to such systems, regardless of whether the event resulted in an entry into or access to them. For example, in distributed denial-of-service attacks, the attacker, often using malware-infected machines, typically seeks to overwhelm or drain the resources of the target with illegitimate requests to prevent the target’s systems from providing services to those seeking to access or use them. Unlike cybersecurity events that would qualify under the current definition of systems intrusions (i.e., the first prong of the proposed definition), the objective of these attacks is often simply to disrupt or disable the target’s operations, rendering them unable to run efficiently, or run at all. For example, given the essential role hypervisors play in supporting cloud computing, an attack on a CSP’s hypervisor, which enables the sharing of physical compute and memory resources across multiple virtual machines, could also significantly disrupt or even disable, albeit indirectly, the SCI systems of an SCI entity that is utilizing such CSP, and thus constitute a systems intrusion under the proposed second prong. Likewise, these systems intrusions could include certain command and control attacks where a malicious actor is able to infiltrate a system to install malware to enable it to send commands to infected devices remotely. Similarly, supply chain attacks that enter a SCI entity’s systems through an apparently authorized means, such as through regular maintenance software updates that—unbeknownst to the software provider and the recipient—contain malicious code and could also be systems intrusions under this proposal.329 Because such cybersecurity events can cause serious harm and disruption to an SCI entity’s operations, the Commission believes that the definition of systems intrusion
should be broadened to include cybersecurity events that may not entail actually entering or accessing the SCI entity’s SCI systems or indirect SCI systems, but still cause disruption or significant

330The Commission believes that the term ‘‘cybersecurity event,’’ as used here, would generally be understood to mean ‘‘an unauthorized activity that disrupts or significantly degrades the normal operation of an SCI system.’’ 331See SCI Adopting Release, supra note 1, at 72284 (‘‘SCI entities would likely find it helpful to establish parameters that can aid them and their staff in determining what constitutes the ‘normal operation’ of each of its SCI systems and when such ‘normal operation’ has been disrupted or significantly degraded because those parameters have been exceeded.’’ (footnotes omitted)). 332Such events may, in some cases, first appear to an SCI entity to be a ‘‘systems disruption’’ but, upon further investigation and understanding of the true cause of the SCI event, may turn out to be both a ‘‘systems intrusion’’ as well as a ‘‘systems disruption.’’ In such cases, the applicable SCI entity should mark the SCI event as both types on its submissions to the Commission on Form SCI. 333Under 17 CFR 242.1003(a)(1) (‘‘Rule 1003(a)(1)’’), each SCI entity is similarly required to establish reasonable written criteria for identifying a material change to its SCI systems for quarterly reporting to the Commission. See also SCI Adopting Release, supra note 1, at 72341–42 (discussing the definition of material systems change). 334A wide variety of entities engage in web scanning, which may be in a targeted manner (e.g., looking at certain IP address ranges) or broadly across the internet. Often, such scanning may be for non-malicious purposes such as, for example, indexing website content (for search engines) or mapping networks. Others may engage in such scanning to identify vulnerable systems or websites, which could be to inform vulnerability management identification and remediation efforts or identify opportunities for exploitation. Because of the wide range of possible uses of scanning and the nature of scanning tools’ interactions with systems, such scanning activity alone is not necessarily indicative of malicious intent or even a vulnerable system capable of being exploited. However, evidence of further, follow-on activity indicative of a precursor to unauthorized entry may be a factor that an SCI entity should consider in weighing whether a significant attempted unauthorized entry has occurred. 335Rule 1002(b)(5). 336 Id. 337To conform to the proposed elimination of de minimis systems intrusions from the quarterly report, Rule 1002(b)(5)(i) would be amended by replacing the phrase ‘‘all such SCI events’’ with the phrase ‘‘all such systems disruptions or systems compliance issues,’’ and Rule 1002(b)(5)(ii) would be amended to no longer include references to systems intrusions and instead read: ‘‘Submit to the Commission a report, within 30 calendar days after the end of each calendar quarter, containing a summary description of such systems disruptions, including the SCI systems affected by such systems disruptions during the applicable
calendar quarter.’’ degradation. For this second prong, the Commission believes it is appropriate to utilize language similar to that used in the definition of systems disruption (i.e., ‘‘disrupts, or significantly degrades, the normal operation of an SCI system’’).330 Similar to a systems disruption that occurs within the SCI systems or indirect SCI systems, if a cybersecurity event disrupts, or significantly degrades, an SCI entity’s normal operations,331 it would constitute a systems intrusion under the proposed revised definition, and the obligations and reporting requirements of Rule 1002 would apply.332 The third prong would include any significant attempted unauthorized entry into the SCI systems or indirect SCI systems of an SCI entity, as determined by the SCI entity pursuant to established reasonable written criteria. In contrast to the types of systems intrusions that are part of the first prong of the proposed definition, the third prong is intended to capture unsuccessful, but significant, attempts to enter an SCI entity’s SCI systems or indirect SCI systems. The Commission recognizes that it would be inefficient, inappropriate, and undesirable (for both SCI entities as well as the Commission and its staff) to require that all attempted entries be considered systems intrusions. Rather, the Commission is seeking to include only attempts that an SCI entity believes to be significant attempts to its systems, even if successfully prevented. The term ‘‘significant attempted unauthorized entry’’ would not be defined in the rule. Rather, the proposed rule would require each SCI entity to establish reasonable written criteria for it to use to determine whether a significant attempted unauthorized entry has occurred, because the Commission believes that each SCI entity should be granted some degree of discretion and flexibility in determining what constitutes a significant attempted unauthorized entry for its purposes, given that SCI entities differ in nature, size, technology, business model, and other aspects of their businesses.333 However, the Commission believes that certain characteristics of attempted unauthorized entries would generally weigh in favor of such attempted unauthorized entries being considered significant and constituting systems intrusions that should be considered SCI events subject to the requirements of Regulation SCI, including: when an SCI entity becomes aware of reconnaissance that may be leveraged by a threat actor; a targeted campaign that is customized to the SCI entity’s system; 334 an attempted cybersecurity event that required the SCI entity’s personnel to triage, even if it was ultimately determined to have no impact; an attempted attack from a known sophisticated advanced threat actor; the depth of the breach in terms of proximity to SCI systems and critical SCI systems; and a cybersecurity event that, if successful, had meaningful potential to result in widespread damage and/or loss of confidential data or
information. As with all SCI events, SCI entities would be required under 17 CFR 242.1002(a) (‘‘Rule 1002(a)’’) to take corrective action with respect to any events that were determined to be systems intrusions under the proposed revised definition. In addition, the Commission is proposing to make a revision to the Commission reporting requirements relating to systems intrusions under Rule 1002(b) such that all systems intrusions would be required to be immediately reported to the Commission pursuant to the requirements of Rule 1002(b). Currently, paragraph (b)(5) of Rule 1002 states that the Commission notification requirements under paragraphs (b)(1) through (4) do not apply to any SCI event that has had, or the SCI entity reasonably estimates would have, no or a de minimis impact on the SCI entity’s operations or on market participants (‘‘de minimis SCI events’’).335 Instead, SCI entities are currently required to make, keep and preserve records relating to all such SCI events, and provide a quarterly report of de minimis systems intrusions and systems disruptions pursuant to Rule 1002(b)(5).336 The Commission is proposing to eliminate the de minimis exception’s applicability to systems intrusions, thus requiring all systems intrusions, whether de minimis or nonde minimis, to be reported pursuant to the requirements of 17 CFR 242.1002(b)(1) through (4) (‘‘Rule 1002(b)(1) through (4)’’).337 By their very nature, systems intrusions may be difficult to identify, and assessing the impact of any systems intrusion is often complex and could potentially require a lengthy investigation before any conclusions may be reached with any degree of certainty. Because of this, the Commission recognizes that it may be difficult for SCI entities to make a clear determination in a timely manner of whether a systems intrusion is de minimis. At the same time, the Commission believes that it is important for the Commission and its staff to receive notification of systems intrusions to be aware of potential and actual security threats to individual SCI entities, particularly given that such threats may extend to other market participants in the securities markets, including other SCI entities. Thus, the Commission believes it is appropriate to eliminate systems intrusions from the types of SCI events that may make use of the exception for de minimis SCI events and be quarterly reported, and instead require that each systems intrusion be reported under the

338The Commission notes that systems intrusions, as currently defined in Rule 1000 of Regulation SCI, have been relatively infrequent as compared to other types of SCI events, and thus the burden of this proposed change in reporting for systems intrusions under the current definition (which is the first prong of the proposed revised definition of systems intrusions) should be relatively low for SCI entities. For example, in the three-year period from 2019 to 2021, systems intrusions only accounted for 27 of the 10,501 SCI events in total (including both de minimis and nonde minimis SCI events). The Commission requests comment below regarding the frequency of systems intrusions as defined by the second and third prongs of the proposed revised definition of systems intrusion. 339The information dissemination requirements described here for systems intrusions differ from the analogous requirements for the other two types of SCI events (systems disruptions and systems compliance issues), which require SCI entities to also, among other things, further provide a more detailed description of such SCI events when known. See 17 CFR 242.1002(c)(1). 340See 17 CFR 242.1002(c)(2) (‘‘Rule 1002(c)(2)’’). framework in Rule 1002(b)(1) through (4).338 Rule 1002(c) sets forth the requirements with respect to disseminating information regarding SCI events to applicable members or participants of SCI entities, and the Commission believes that it would be appropriate that information about systems intrusions under the proposed second prong of the systems intrusion definition (a ‘‘cybersecurity event that disrupts, or significantly degrades, the normal operation of an SCI system’’) be disseminated pursuant to Rule 1002(c)’s requirements. However, importantly, in contrast to the more detailed information dissemination requirements for SCI entities in paragraph (c)(1) of Rule 1002 for systems disruptions and systems compliance issues, in recognition of the more sensitive nature of systems intrusions (disclosure of which may alert threat actors of an existing or potential weakness in an SCI entity’s systems, or alert them of an ongoing investigation of a systems intrusion), the Commission’s information dissemination requirements for systems intrusions contained in paragraph (c)(2) of Rule 1002 only requires SCI entities to provide a ‘‘summary description’’ for such events.339 In addition, paragraph (c)(2) also permits an SCI entity to delay disclosure of a systems intrusion in cases where the SCI entity ‘‘determines that dissemination of such information would likely compromise the security of the SCI entity’s SCI systems or indirect SCI systems, or an investigation of the systems intrusion, and documents the reasons for such determination.’’ 340 With respect to information dissemination to an SCI entity’s members or participants, however, the Commission believes that information regarding significant attempted unauthorized entries should not be required to be
disseminated to an SCI entity’s members or participants, as any benefits associated with disseminating information about unsuccessful attempted unauthorized entries to members or participants of an SCI entity would likely not be justified due to distractions that such information would bring, particularly since the SCI entity’s security controls were able, in fact, to repel the cybersecurity event. In addition, disseminating information regarding unsuccessful intrusions could result in the threat actors being unnecessarily alerted that they have been detected, which could make it more difficult to identify the attackers and halt their efforts on an ongoing, more permanent basis. Thus, the Commission is proposing to new 17 CFR 242.1002(c)(4)(iii) (‘‘proposed Rule 1002(c)(4)(iii)’’) which would exclude systems intrusions that are significant attempted unauthorized entries into the SCI systems or indirect SCI systems of an SCI entity from the information dissemination requirements of 17 CFR 242.1002(c)(1) through (3) (‘‘Rule 1002(c)(1) through (3)’’). d. Request for Comment
67. Do commenters agree that
cybersecurity is an area that the Commission should enhance as part of Regulation SCI? Is it necessary to help ensure that SCI entities maintain a robust technology infrastructure for the SCI systems and indirect SCI systems? Why or why not?
68. Do commenters agree with the
proposed addition of Rule 1001(a)(2)(x), to enumerate that the policies and procedures of SCI entities shall include a program to prevent the unauthorized access to SCI systems and, for purposes of security standards, indirect SCI systems, and information residing therein? Why or why not?
69. Do commenters agree that SCI
entities should be required to have an increased frequency of penetration test reviews? Why or why not? Do commenters feel that the requirement to have such tests at least annually is appropriate? How frequently do SCI entities conduct penetration testing today? Do commenters agree with the proposed requirement that the penetration testing include testing of any identified vulnerabilities? Why or why not?
70. Do commenters believe that it is
appropriate to modify the definition of systems intrusion as proposed in Rule 1000? Do commenters believe that it would be useful (for example, for SCI entities and the Commission and its staff) to include other types of scenarios in the definition of systems intrusion? If so, which scenarios should be included and why? If not, why not?
71. Do commenters agree with the
proposed revisions to the definition of systems intrusions to include the second prong, (i.e., for any cybersecurity event that disrupts, or significantly degrades, the normal operation of an SCI system)? Why or why not? Could such events put the security or operational capability of an SCI system at risk? How frequently do commenters believe systems intrusions, as defined by the proposed second prong, occur at SCI entities? The Commission does not define the term ‘‘cybersecurity event’’ in the proposed rule text but, as noted, believes it would generally be understood to mean ‘‘an unauthorized activity that disrupts or significantly degrades the normal operation of an SCI system.’’ Do commenters agree? Do commenters believe it is necessary to provide a definition of the term ‘‘cybersecurity event’’ in the proposed rule text? If so, do commenters agree with the meaning above? If not, how should it be defined? Please be specific.
72. Do commenters believe that
significant attempted unauthorized entries into the SCI systems or indirect SCI systems of an SCI entity should be included in the definition of systems intrusions, as under the proposed third prong? Why or why not? Do commenters believe that the Commission should define the term ‘‘significant attempted unauthorized entry,’’ or do commenters believe it is appropriate to require an SCI entity to establish reasonable written criteria to make such determinations to provide SCI entities some degree of discretion and flexibility in determining what constitutes a significant attempted unauthorized entry for its purposes, given differences as between SCI? What types of criteria or scenarios do commenters believe should constitute a significant attempted unauthorized entry? Please describe and be specific. How frequently do commenters believe systems intrusions, as defined by the proposed third prong, occur at SCI entities?
73. Do commenters agree with the
proposed removal of systems intrusions from the types of de minimis SCI events permitted to be reported quarterly under Rule 1002(b)(5)? Why or why not? Should there be a requirement that SCI events that are systems intrusions, as proposed to be defined, be reported to senior management of an SCI entity? Why or why not?
74. Do commenters agree with
proposed addition of Rule

341See SCI Adopting Release, supra note 1, at
72343. The Commission continues to believe that
persons who were not involved in the process for development, testing, and implementation of the systems being reviewed would generally be in a better position to identify weaknesses and deficiencies that were not identified in the development, testing, and implementation stages. Thus, any personnel with conflicts of interest that have not been adequately mitigated to allow for objectivity should be excluded from serving in this role, and a person or persons conducting an SCI review should not have a conflict of interest that interferes with their ability to exercise judgment, express opinions, and present recommendations with impartiality. See id. 342Rule 1000 (definition of SCI review) and Rule 1003(b) both currently contain requirements relating to SCI reviews. As described in this section, the Commission is proposing to focus the definition of SCI review in Rule 1000 on requirements relating to the SCI review itself, whereas Rule 1003(b)’s proposed language would be focused on the required contents of the report of the SCI review, as well as the timelines for when the SCI review is required to be conducted and when the report of the SCI review is required to be provided to senior management and the Commission. 343See supra section III.C.3.b (discussing the frequency of required penetration test reviews). 1002(c)(4)(iii), which would exclude systems intrusions that are significant attempted unauthorized entries from the information dissemination requirements of Rule 1002(c)(1) through (3)? Why or why not?
4. SCI Review
a. Discussion
Rule 1000 currently defines the SCI review to be a review, following established procedures and standards, that is performed by objective personnel having appropriate experience to conduct reviews of SCI systems and indirect SCI systems, and which review contains: (a) a risk assessment with respect to such systems of an SCI entity; and (b) an assessment of internal control design and effectiveness of its SCI systems and indirect SCI systems to include logical and physical security controls, development processes, and information technology governance, consistent with industry standards. Paragraph (b)(1) of Rule 1003 requires each SCI entity to conduct an SCI review of the SCI entity’s compliance with Regulation SCI not less than once each calendar year; however, penetration test reviews of the network, firewalls, and production systems may be conducted at a frequency of not less than once every three years, and assessments of SCI systems directly supporting market regulation or market surveillance may be conducted at a frequency based upon the risk assessment conducted as part of the SCI review, but in no case less than once every three years. Paragraph (b)(2) of Rule 1003 requires SCI entities to submit a report of the SCI review to senior management of the SCI entity for review no more than 30 calendar days after completion of such SCI review, and paragraph (b)(3) requires SCI entities to submit to the Commission, and to the board of directors of the SCI entity or the equivalent of such board, a report of the SCI review, together with any response by senior management, within 60 calendar days after its submission to senior management of the SCI entity. The SCI review is an important part of Regulation SCI because it is a periodic evaluation by objective personnel of an SCI entity’s compliance with SCI and helps the SCI entity to identify weaknesses and vulnerabilities in its systems and controls. In addition, because of Rule 1003(b)’s reporting requirements, the SCI review and the report of the SCI review helps to ensure that the senior management and board of the SCI entity are involved in and aware of the SCI entity’s compliance with the regulation. Finally, the report provides the Commission and its staff insight into the SCI entity’s compliance with Regulation SCI as well and assists the staff in determining how to follow up with the SCI entity in reviewing and addressing any identified weaknesses and vulnerabilities. The SCI review is currently required to be conducted by ‘‘objective personnel,’’ and the Commission believes that this requirement continues to be appropriate. Thus, as the Commission discussed in the SCI Adopting Release, SCI reviews may be performed by personnel of the SCI entity (such as internal audit function) or an external firm, provided that such personnel are, in fact, objective and, as required by rule, have the appropriate experience to conduct reviews of SCI systems and indirect SCI systems.341 As described below,
the Commission is proposing a number of revisions to the requirements relating to SCI reviews and for the reports SCI entities submit (both to their board of directors as well as to the Commission).342 The definition of SCI review in Rule 1000 is proposed to be amended to contain the substantive requirements for an SCI review, which would be required to be ‘‘a review, following established and documented procedures and standards, that is performed by objective personnel having appropriate experience to conduct reviews of SCI systems and indirect SCI systems . . .’’ The revised definition of SCI review in Rule 1000 would go on to detail what an SCI review would be required to include and would require the use of appropriate risk management methodology. Specifically, paragraph (1) of the definition would require, with respect to each SCI system and indirect SCI system of the SCI entity, three assessments to be performed by objective personnel conducting the SCI review. The first required assessment would be of the risks related to the capacity, integrity, resiliency, availability, and security. The second assessment would be of internal control design and operating effectiveness to include logical and physical security controls, development processes, systems capacity and availability, information technology service continuity, and information technology governance, consistent with industry standards. The third assessment would be of third-party provider management risks and controls. As discussed above, the Commission is also proposing to update the requirement for penetration testing, from the current requirement of at least once every three years to at least annually.343 Finally, the definition of SCI review in Rule 1000 would provide that assessments of SCI systems directly supporting market regulation or market surveillance would be required to be conducted at a frequency based upon the risk assessment conducted as part of the SCI review, but in no case less than once every three years. It has been the experience of the Commission and its staff that the SCI reviews and their reports of such SCI reviews vary among SCI entities in content and detail. To help ensure that every SCI review and report of such reviews contain the assessments and related information the Commission and its staff believes is necessary for an SCI entity to be able to assess its compliance with Regulation SCI, the Commission proposes adding certain additional requirements and details with respect to each SCI review and the report of the SCI review that are submitted to the SCI entity’s board and to the Commission. In the lead-in provision for the definition, the words ‘‘and documented’’ are proposed to be added to ensure that SCI entities and the objective personnel conducting SCI reviews document the work that is done during the SCI review. Documentation is necessary as evidence that the requirements relating to the SCI review are being complied with, and would help
ensure that policies and procedures are followed. Documentation is also critical to any follow-on reviews of the work that may be required, such as follow-up on the work of the SCI review by SCI entity personnel (including by its senior management or board of directors) or by the Commission or its staff. In addition,

344See supra note 341 and accompanying text (discussing ‘‘objective personnel’’). 345See, e.g., Sunil Bakshi, Tips for Effective Control Design, ISACA (Feb. 9, 2022), available at https://www.isaca.org/resources/news-and-trends/ newsletters/atisaca/2022/volume-6/tips-foreffective-control-design; PCAOB, AS2201: An Audit of Internal Controls Over Financial Reporting That is Integrated with An Audit of Financial Statements, available at https://pcaobus.org/ oversight/standards/auditing-standards/details/ AS2201; and AICPA, AU–C Section 94), An Audit of Internal Controls Over Financial Reporting That is Integrated With an Audit of Financial Statements, available at https://us.aicpa.org/content/dam/ aicpa/research/standards/auditattest/downloadable documents/au-c-00940.pdf. 346See supra note 39 and accompanying text. 347See supra section III.C.2. such documentation would facilitate follow-up required to address deficiencies and weaknesses that may be identified during the SCI review, such as through mitigation and remediation plans. The proposed definition of SCI review would also require that the SCI review use ‘‘appropriate risk management methodology.’’ The objective personnel conducting the SCI review would be required to establish, document, and utilize a given risk methodology in conducting the SCI review that is appropriate for the SCI entity being reviewed. The Commission is not specifying a particular methodology that a given SCI entity and its objective personnel must use, but rather is providing the flexibility to such objective personnel to determine the risk management methodology that should be utilized, so long as it is appropriate given the SCI entity’s characteristics and risks. The requirements of the SCI review would apply to each individual SCI system and indirect SCI system, and would require that the SCI review include three specific assessments to be performed by objective personnel. This language is intended to require that each of these assessments be performed by objective personnel—either by those conducting the SCI review or others that those conducting the SCI review engage for such purposes—rather than utilizing, for example, enterprise or IT risk assessments as the basis for the SCI review after deeming them ‘‘reasonable.’’ The proposed requirement would not specify a particular control framework to be applied for such assessments, but rather would provide flexibility to those conducting the SCI review to choose the methodology they believe to be most appropriate given the particular characteristics and risks of the SCI entity’s systems being assessed, and undertake the assessments themselves, or oversee and direct other objective personnel on how the assessments should be performed. The Commission considers the SCI reviews to be an important window into the strength of the technological infrastructure of SCI entities, and whether the controls implemented by the SCI entity are appropriate and employed properly. In
addition, the Commission requires that objective personnel be used to help ensure the impartiality of the review and that the reviewers examine what they believe to be most appropriate for such a review.344 The Commission believes that, by requiring that these assessments be performed by objective personnel, these assessments and tests will be able to provide the SCI entity, its senior management, its board of directors, and the Commission, an appropriately impartial and accurate assessment of the risks associated with the SCI entity’s SCI systems and indirect SCI systems. In the definition of SCI review in Rule 1000, the phrase ‘‘a risk assessment with respect to such systems of an SCI entity’’ would be replaced with an assessment of ‘‘the risks related to the capacity, integrity, resiliency, availability, and security’’ of each such system. The Commission believes that the additional detail in the proposed language would tie the required risk assessment more closely with the key principles of Regulation SCI (found in Rule 1001(a)(1)) relating to the ‘‘capacity, integrity, resiliency, availability and security’’ of each SCI entity’s systems, while maintaining the focus of the assessment on the overall risks associated with such systems. Further, in the definition of SCI review he phrase ‘‘internal control design and effectiveness’’ would be revised to read ‘‘internal control design and operating effectiveness’’ to clarify that the associated assessment must examine how well the internal controls performed in actual operations, i.e., in practice. Thus, this assessment would look not only at how the controls worked in theory (i.e., as designed), but also in practice (i.e., in operations).345 In addition, the definition of SCI review in Rule 1000 would expand on the list of controls to be assessed, adding ‘‘systems capacity and availability’’ and ‘‘information technology service continuity’’ to the current list of ‘‘logical and physical security controls, development processes, and information technology governance.’’ The Commission believes that systems capacity and availability and information technology service continuity are important areas for SCI entities to consider when conducting their SCI reviews, and is proposing to include them on the list of controls reviewed by objective personnel performing the SCI reviews to ensure that these additional areas of controls are assessed during each SCI review. As stated above, the foundational principles of Regulation SCI are set forth in Rule 1001 and require in part that each SCI entity establish, maintain, and enforce written policies and procedures reasonably designed to ensure that their SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain their operational capability and promote the maintenance of fair and orderly markets.346 The proposed addition of ‘‘systems capacity and
availability’’ relates to this requirement with respect to ‘‘capacity’’ and ‘‘availability,’’ and ‘‘information technology service continuity’’ relates to this requirement with respect to ‘‘resiliency’’ and ‘‘availability,’’ and would require that objective personnel consider whether an SCI entity’s internal controls have been designed and implemented in a manner to achieve these objectives of Regulation SCI, rather than only those currently enumerated regarding security, development processes, and governance. New paragraph (1)(C) of the definition of SCI review in Rule 1000 would require an assessment of third-party provider management risks and controls with respect to each of its SCI systems and indirect SCI systems. As discussed in detail above,347 third-party provider management is an important part of managing the risks posed when an SCI entity uses a third-party for functionality, support, or services. Importantly, the proposed amended definition of SCI review under Rule 1000 uses the phrase ‘‘with respect to each’’ when referencing SCI systems and indirect SCI systems. This wording clarifies that the associated assessments are required to be made for each applicable system for each SCI review (i.e., every year). Thus, the Commission believes it to be appropriate to conduct these assessments for each and every SCI system or, as applicable, indirect SCI system annually, rather than, for example, rotating control testing across several years such that not all systems and/or relevant controls are tested each year. However, in adopting Regulation SCI, the Commission determined to allow assessments of SCI systems directly supporting market regulation or market surveillance to be conducted, based upon a risk-assessment, at least

348See 17 CFR 242.1003(b)(1)(ii).
349See supra section III.C.3.b. and proposed paragraph (2) of the definition of SCI review in Rule 1000, (relating to cybersecurity revisions, including penetration testing). Of course, while SCI entities would be required to conduct penetration test reviews at least annually as part of the SCI review, nothing in the proposed rule would prevent them from conducting penetration testing more frequently if warranted. 350As noted above, while the substance of the provision relating to the frequency of assessments of SCI systems directly supporting market regulation or market surveillance would remain unchanged, the provision would be moved from current Rule 1003(b)(1)(ii) to proposed paragraph (3) of the definition of SCI review in Rule 1000. 351See proposed Rule 1003(b)(1). 352See proposed Rule 1003(b)(2). 353See proposed Rule 1003(b)(3). 354The Commission notes that the proposed requirement under item (vi) would specify that a summary of each penetration test review be included but does not call for the penetration test review itself be included. The Commission believes that a summary that includes the scope of testing and action plan of the penetration test would provide Commission staff with sufficient initial information to obtain a broad understanding of what was tested and any vulnerabilities it identified and that Commission staff could, in any case, if it believed it appropriate, request that the SCI entity provide it with a copy of the penetration test review. once every three years, rather than annually, and the Commission is not amending this provision.348 Proposed paragraph (2) would contain the requirement that penetration test reviews be performed by objective personnel, conducted at least once each year. As discussed above, the revised requirements relating to SCI reviews would change the frequency of required penetration testing provision (currently located in Rule 1003(b)(1) but proposed to be relocated to the definition of ‘‘SCI review’’ in Rule 1000) from ‘‘not less than once every three years’’ to at least annually with each SCI review, and require that they include testing of any identified vulnerabilities of its SCI systems and indirect SCI systems.349 In addition, the language relating to the frequency of assessments of SCI systems directly supporting market regulation or market surveillance, proposed to be in paragraph (3), would remain unchanged.350 Proposed Rule 1003(b) would continue to include requirements relating to the timeframes for conducting the SCI review (unchanged at ‘‘not less than once each calendar year’’) 351 and submitting reports of the SCI review to senior management (unchanged at ‘‘no more than 30 calendar days after completion of such SCI review’’) 352 and the Commission (unchanged at ‘‘within 60 calendar days after its submission to senior management’’).353 However, proposed Rule 1003(b)(1) would add the phrase ‘‘for each calendar year during which it was an SCI entity for any part of such calendar
year’’ to clarify that, if an SCI entity is an SCI entity for any part of the calendar year, it must conduct the SCI review and submit the associated report of the SCI review to the SCI entity’s senior management and board, as well as to the Commission. Thus, an SCI review would be required for a new SCI entity, even in its first year as an SCI entity and even if its starting date as an SCI entity were not until late in the year. Similarly, if an SCI entity ceased to be an SCI entity during the middle of a calendar year (e.g., an SCI ATS that falls out of the SCI ATS thresholds in July of a given year), it would still be required to submit an SCI review for that portion of the calendar year during which it was an SCI entity. The Commission believes this is appropriate, as the SCI review and the report of the SCI review contain, among other things, assessments of the SCI entity’s compliance with the requirements of Regulation SCI which help to confirm, through objective personnel, that the capacity, integrity, resiliency, availability and security requirements of Regulation SCI have been met by the entity for the period during which it was an SCI entity. Rule 1003(b) would also add additional detail on what the report of the SCI review is required to contain. Currently, the rule does not provide any specific requirements with respect to the contents of the report of the SCI review. In the experience of Commission staff, this has resulted in a wide range in the types and quality of SCI reports the Commission receives from SCI entities. In reviewing the reports, the Commission staff has found certain information particularly important in assessing the SCI review, and as a result the Commission is now revising the rule to require this information to be included in all reports on SCI reviews. Rule 1003(b)(2) would be revised to require the report of the SCI review to include: (i) the dates the SCI review was conducted and the date of completion; (ii) the entity or business unit of the SCI entity performing the review; (iii) a list of the controls reviewed and a description of each such control; (iv) the findings of the SCI review with respect to each SCI system and indirect SCI system, which must include, at a minimum, assessments of:
the risks related to the capacity, integrity, resiliency, availability, and security; internal control design and operating effectiveness; and vendor management risks and controls; (v) a summary, including the scope of testing and resulting action plan, of each penetration test review conducted as
part of the SCI review; and (vi) a
description of each deficiency and weakness identified by the SCI review. Items (i) and (ii) contain basic administrative information (relating to dates and the entity/unit conducting the SCI review) about the SCI review to identify the period over which the SCI review was conducted and the entity/ unit responsible for such review that Commission staff may contact for any questions regarding the SCI review or the report of the SCI review. Item (iii), relating to controls reviewed as part of the SCI review, would assist Commission staff in understanding the scope of the review and, if applicable, also allow staff to identify and request additional information regarding any of the controls listed or any controls it believed to be missing. Item (iv) would contain the substantive findings of the SCI review and relate to the three assessments that are required to be part of the SCI review under paragraph (1) of the definition of SCI review in Rule
1000. Similarly, item (v) relates to
paragraph (2) of the definition of SCI review relating to penetration test reviews and would require an SCI entity to provide a summary of each penetration test review conducted as
part of the SCI review.354 Item (v) also
would require that the summary include the scope of testing and the resulting action plan. Item (vi) would require a description of each deficiency and weakness identified during the SCI review, including through the assessments and any testing conducted as part of the SCI review. This information is proposed to be included in the report of the SCI review to provide the senior management and board of the SCI entity, as well as the Commission and its staff, with information on the SCI review, including any deficiencies and weaknesses identified by the objective personnel that conducted the SCI review. The Commission believes that requiring this minimum set of requirements for the report of the SCI review, as described above, would help ensure that SCI entities and the objective personnel that conduct the SCI review include in the report of the SCI review the key pieces of information relating to the SCI review (i.e., information relating to the controls reviewed; substantive findings from the assessments conducted as part of the SCI review; summaries of penetration test reviews; and descriptions of each deficiency and weakness identified) that go towards ensuring that the SCI

355The NIST Framework is available at https:// www.nist.gov/cyberframework/framework. systems of SCI entities remain robust with respect to their capacity, integrity, resiliency, availability, and security, and are in compliance with the requirements of Regulation SCI. Finally, the Commission is proposing several revisions to paragraph (b)(3) of Rule 1003, which relates to submission of the report of the SCI review to the Commission and to the board of directors (or its equivalent) of the SCI entity. First, because Rule 1003(b)(2) now contains details relating to the required contents of the report of the SCI review, the Commission is proposing to update the internal crossreference in paragraph (b)(3) from ‘‘paragraph (b)(1)’’ to ‘‘paragraph (b)(2).’’ The proposed revisions would also require that, when the report is submitted to the board of directors of the SCI entity and the Commission, it must also include the date the report was submitted to senior management. In addition, the revisions would make mandatory that a response from senior management to the report is included when it is submitted to the Commission and board, whereas previously the language appeared permissive. The Commission believes that mandating a response from senior management will help ensure that both the SCI entity’s senior management and board are informed of the findings in the report of the SCI review and that the SCI entity’s policies and procedures are reasonably designed, as required by the rule, and as informed by the issues identified in the report. b. Request for Comment
75. Do commenters agree with the
proposed revisions to the definition of ‘‘SCI review’’ in Rule 1000? Why or why not? Do commenters agree with the proposed addition of ‘‘and documented’’ to require that the work relating to the SCI review be documented? Why or why not? Do commenters agree with the proposed addition that the objective personnel conducting the SCI review use ‘‘appropriate risk management methodology?’’ Why or why not? What risk management methodologies do commenters believe would be appropriate for use by SCI entities? Please describe. Does the requirement that SCI reviews be performed by ‘‘objective personnel’’ remain appropriate? For example, should the term ‘‘objective personnel’’ be defined? Why or why not? Should there be a requirement that the SCI review be performed by an independent third party? Why or why not? Should there be a requirement that senior management certify that the SCI review was performed by objective personnel? Why or why not?
76. What are commenters’ views on
not specifying a particular control framework to be applied for the internal control assessments? What are the costs and benefits to SCI entities if the Commission required the application of, for example, a suitable, recognized control framework that is established by a body or group that has followed dueprocess procedures, including the broad distribution of the framework for public comment?
77. With respect to the three
assessments proposed to be required by paragraph (1) of the definition of SCI review, do commenters agree that these assessments should be overseen by the objective personnel responsible for the SCI review, rather than utilizing, for example, enterprise or IT risk assessments as the basis for the SCI review after deeming them ‘‘reasonable’’? Why or why not? What is the current practice among objective personnel conducting assessments for SCI reviews? Please describe. What do commenters believe would be the advantages and disadvantages for this proposed requirement?
78. Do commenters believe that it is
appropriate that the SCI review include an assessment of ‘‘the risks related to the capacity, integrity, resiliency, availability, and security,’’ as proposed to be required in paragraph (1)(A) of the definition of SCI review under Rule 1000? Why or why not?
79. Do commenters believe that the
revisions to the second assessment proposed to be required in paragraph (1)(A) of the definition of SCI review in Rule 1000 (replacing the phrase ‘‘internal control design and effectiveness’’ with ‘‘internal control design and operating effectiveness,’’ and adding ‘‘systems capacity and availability’’ and ‘‘information technology service continuity’’ to the current list of controls to be assessed) are appropriate as part of the SCI review?’’ Why or why not?
80. Do commenters agree that the
third assessment proposed to be required as part of the SCI review, relating to third-party provider management risks and controls, is appropriate? Why or why not?
81. Do commenters agree with the
revision that the three assessments in paragraph (1) of the definition of SCI review be made ‘‘with respect to each’’ SCI system and indirect SCI system, thereby requiring that these assessments be made for each applicable system for each SCI review every year? Why or why not?
82. Do commenters agree that the SCI
review and report of the SCI review should be conducted by an SCI entity ‘‘for each calendar year during which it was an SCI entity for any part of such calendar year,’’ as proposed to be added to Rule 1003(b)(1)? Why or why not?
83. Do commenters believe that the
requirements in proposed Rule 1003(b)(2) are appropriate for the report of the SCI review? Why or why not? Do commenters believe additional requirements should be added or that any proposed requirements should be modified or not included? Why or why not? Please describe.
5. Current SCI Industry Standards
a. Overview of Current Rule 1001(a)(4) Rule 1001(a)(4) of Regulation SCI states that, for purposes of paragraph (a) of Rule 1001, an SCI entity’s policies and procedures will be deemed to be reasonably designed if they are consistent with ‘‘current SCI industry standards.’’ The provision defines ‘‘current SCI industry standards’’ to be ‘‘comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization.’’ In addition, Rule 1001(a)(4) also states that compliance with such current SCI industry standards shall not be the exclusive means to comply with the requirements of paragraph (a). Thus, Rule 1001(a)(4) provides a safe harbor for SCI entities to comply with Rule 1001(a) (i.e., they will be deemed to comply if they have policies and procedures that are consistent with current SCI industry standards), while at the same time stating that following such current SCI industry standards is not the sole means of achieving compliance with the rule. b. Rule 1001(a)(4) Safe Harbor The Commission believes that utilizing current SCI industry standards is an appropriate way for SCI entities to develop their Rule 1001(a) policies and procedures. It has been the experience of the Commission and its staff that some SCI entities look to publications issued by the federal government’s National Institute of Standards and Technology (‘‘NIST’’) Framework for Improving Critical Infrastructure Cybersecurity (‘‘NIST Framework’’),355

356 ISO is an independent, non-governmental international organization whose members include national standards bodies that develops and publishes international standards. See International Organization for Standardization, available at https://www.iso.org. 357COBIT is a leading framework for the enterprise governance of information and technology and is issued by ISACA, an international professional associated focused on information technology governance. See ISACA, available at https://www.isaca.org. 358We note that concurrent with the Commission’s adoption of Regulation SCI in 2014, Commission staff stated its views regarding ‘‘current SCI industry standards,’’ including a listing of examples of publications describing processes, guidelines, frameworks, or standards for each inspection area, or domain, an SCI entity could look to in developing its reasonably designed policies and procedures. See Commission, Staff Guidance on Current SCI Industry Standards (Nov. 19, 2014), available at https://www.sec.gov/rules/ final/2014/staff-guidance-current-sci-industrystandards.pdf. Commission staff is reviewing staff statements with respect to Regulation SCI to determine whether any such statements, or portion thereof, should be revised or withdrawn in connection with any adoption of this proposal. These statements include the Staff Guidance on Current SCI Industry Standards, as well as the Responses to Frequently Asked Questions Concerning Regulation SCI, Sept. 2, 2015 (Updated Aug. 21, 2019), available at https://www.sec.gov/ divisions/marketreg/regulation-sci-faq.shtml. 359Specifically, the second sentence of Rule 1001(a)(4) would be revised to read: ‘‘Compliance with such current SCI industry standards as a safe harbor, however, shall not be the exclusive means to comply with the requirements of paragraph (a) of this section.’’ 360For SCI entities that do not seek to avail themselves of the safe harbor of Rule 1001(a)(4), the requirements of proposed Rule 1001(a)(2)(xi) would not apply. 361See 17 CFR 242.1002(c). 362 Id. See also supra section II.B.3 (discussing current Rule 1002(c)). 363See SCI Adopting Release, supra note 1 at 72334. governmental bodies such as the International Organization for Standardization (‘‘ISO’’) 356 or the Control Objectives for Information and Related Technologies (‘‘COBIT’’),357 and some SCI entities may not point to any specific industry standards at all. In addition, among those SCI entities that utilize industry standards, some may look to a single industry standard for most or all of their policies and procedures, while others may ‘‘mix and match’’ standards for different policies and procedures. And, in some cases, an SCI entity may utilize multiple industry standards for a single set of their policies and procedures. The Commission believes that use of industry standards continues to be an appropriate framework for SCI entities to model their policies and procedures.358 To make clear that Rule 1001(a)(4)’s
reference to and definition of ‘‘current SCI industry standards’’ provides a safe harbor for SCI entities with respect to their Rule 1001(a) policies and procedures, the Commission proposes to add the words ‘‘safe harbor’’ in Rule 1001(a)(4).359
c. Identification of Current SCI Industry
Standards Used
In the experience of Commission staff, many SCI entities align their Rule 1001(a) policies and procedures, in part or whole, with current SCI industry standards, often referencing such standards in communications with Commission staff during inspections or examinations. However, some SCI entities do not reference any industry standard(s) for their Rule 1001(a) policies and procedures. In conjunction with the proposed revision to Rule 1001(a)(4), the Commission is proposing to add a new requirement in Rule 1001(a)(2), which lays out certain minimum requirements for an SCI entity’s Rule 1001(a) policies and procedures. Specifically, proposed new 17 CFR 242.1001(a)(2)(xi) (‘‘proposed Rule 1001(a)(2)(xi)’’) would require that an SCI entity’s policies and procedures include ‘‘[a]n identification of the current SCI industry standard(s) with which each such policy and procedure is consistent, if any.’’ SCI entities are not required to avail themselves of the safe harbor of Rule 1001(a)(4) by aligning their policies and procedures required by Rule 1001(a) with current SCI industry standards,360 but for SCI entities that choose to do so, this proposed provision would require SCI entities to provide a list of the specific current SCI industry standard(s) with which each of its policies and procedures is consistent. Thus, for example, such SCI entities would be required to identify the standard(s) used for their business continuity and disaster recovery policies and procedures, and separately identify the standard(s) used for its vendor management policies and procedures. In addition, the Commission recognizes that there may be cases in which an SCI entity may draw from multiple current SCI industry standards in developing a given policy and procedure, and proposed Rule 1001(a)(2)(xi) recognizes this may be the case (‘‘. . . the current SCI industry standard (s). . .’’). In such cases, an SCI entity may simply list multiple standards with which the given policy and procedure is consistent. d. Request for Comment
84. Do commenters agree with the
proposed revisions to Rule 1001(a)(4) relating to current SCI industry standards? Why or why not?
85. Do SCI entities seek to make use
of the safe harbor contained in Rule 1001(a)(4) for compliance with Rule 1001(a) of Regulation SCI? Why or why not? With what current SCI industry standard(s) do SCI entities seek to make their policies and procedures consistent?
86. For an SCI entity that seeks to
avail itself of the safe harbor, do commenters agree that an SCI entity should identify the current SCI industry standard(s) with which each of its policies and procedures is consistent? Why or why not?
6. Other Changes
Rule 1002(c) of Regulation SCI requires that SCI entities disseminate information to their members or participants regarding SCI events.361 These information dissemination requirements are scaled based on the nature and severity of an event, with SCI entities required to disseminate certain information about the event to members or participants that the SCI entity reasonably estimated to have been affected by the SCI event, and, in the case of a major SCI event, to all members or participants.362 In connection with the proposal to include SCI broker-dealers as SCI entities, the Commission proposes that an SCI broker-dealer be required to disseminate information about an SCI event it is experiencing, in accordance with the requirements of Rule 1002(c), to its ‘‘customers.’’ As discussed above, the Commission proposes to include SCI broker-dealers as SCI entities because it believes that a systems issue at an SCI broker-dealer could, for example, impede the ability of other market participants to trade securities in a fair and orderly manner. As explained in the SCI Adopting Release, information about an SCI event is likely to be of greatest value to those market participants affected by it, who can use such information to evaluate the event’s impact on their trading and other activities and develop an appropriate response.363 To the extent that an SCI event at a broker-dealer affects its customers (i.e., those with whom it trades or for whom it facilitates trades as an agent), the Commission believes that the SCI broker-dealer should inform them, and do so in the same manner and as required for other SCI entities, pursuant to Rule 1002(c). Similarly, and consistent with the current requirement of Rule 1002(b)(4)(ii)(B), an SCI brokerdealer would be required to include in its notices to the Commission a copy of any information it disseminated to its

364 Id. See also supra section II.B.3 (discussing current Rule 1002(b)(4). 365See supra section III.A.2.b. 366See 17 CFR 242.1005. Rule 1005(a) of Regulation SCI relates to recordkeeping provisions for SCI SROs, whereas Rule 1005(b) relates to the recordkeeping provision for SCI entities other than SCI SROs. 367See supra section III.C.3.c (discussing proposed changes to Rule 1002(b)(5)(ii)). 368See supra section III.C.4 (discussing proposed changes to Rule 1003(b)(3)). 369See Exchange Act Cybersecurity Proposal, supra note 10. 370See Regulation S–P 2023 Proposing Release supra note 10. 371See proposed 17 CFR 242.10 of the Exchange Act Cybersecurity Proposal Rule (‘‘Rule 10’’); 17 CFR 248.1 through 248.30 (Regulation S–P). See also section III.D.1.b. of this release (discussing the types of SCI Entities that are or would be subject to the Exchange Act Cybersecurity Proposal and/or Regulation S–P). 372See infra section III.D.1.c (discussing the proposed requirements of the Exchange Act Cybersecurity Proposal and the existing and proposed requirements of Regulation S–P to have policies and procedures that address certain cybersecurity risks). 373See infra section III.D.1.d (discussing the proposed Commission notification requirements of the Exchange Act Cybersecurity Proposal). 374The Exchange Act Cybersecurity Proposal defines a ‘‘significant cybersecurity incident’’ to be a cybersecurity incident, or a group of related cybersecurity incidents, that: (i) Significantly disrupts or degrades the ability of the market entity to maintain critical operations; or (ii) Leads to the unauthorized access or use of the information or information systems of the market entity, where the unauthorized access or use of such information or information systems results in or is reasonably likely to result in: (A) Substantial harm to the market entity; or (B) Substantial harm to a customer, counterparty, member, registrant, or user of the market entity, or to any other market participant that interacts with the market entity. See proposed § 242.10(a) of the Exchange Act Cybersecurity Proposal. 375See current and proposed Rule 1000 of Regulation SCI (defining the term ‘‘systems intrusion’’). 376See infra section III.D.1.e (discussing the proposed disclosure requirements of the Exchange Act Cybersecurity Proposal and the existing and proposed disclosure requirements of Regulation S– P). customers.364 The Commission requests comment on the proposed amendments to Rule 1002(b)(4)(ii)(B) and Rule 1002(c) in section III.A.2.b above, which discusses the proposed definition of an SCI broker-dealer.365 Rule 1005 of Regulation SCI requires SCI entities to make, keep, and preserve certain records related to their compliance with Regulation SCI.366 Rule 1005(c) specifies that the recordkeeping period survives even if an SCI entity ceases to do business or ceases to be registered under the Exchange Act. The Commission proposes to add that this survival provision applies to an SCI
entity ‘‘otherwise ceasing to be an SCI entity.’’ This addition accounts for circumstances not expressly covered; specifically, those in which an SCI entity continues to do business or remains a registered entity, but may cease to qualify as an SCI entity, such as an SCI ATS that no longer satisfies a volume threshold. Such entities would not be excepted from complying with the recordkeeping provisions of Rule 1005 and would be required to make, keep, and preserve their records related to their compliance with Regulation SCI related to the period during which they were an SCI entity. In addition, Form SCI is proposed to be modified to conform the text of the General Instructions and description of the attached Exhibits to the other changes proposed herein. Specifically, the operational aspects of Form SCI filing are unchanged, except to reflect that quarterly reports of SCI events with no or a de minimis impact would pertain only to systems disruptions, and not to systems intrusions.367 Furthermore, the instructions to Exhibit 5 of Form SCI is proposed to be modified to reflect the requirement that an SCI entity’s senior management respond to the report of the SCI review.368 In addition, the Commission proposes to update section I of the General Instructions for Form SCI:
Explanation of Terms to reflect the proposed changes in the definitions in Rule 1000, by revising the definitions of SCI entity, SCI review, SCI systems, and Systems Intrusion. D. SCI Entities Subject to the Exchange Act Cybersecurity Proposal and/or Regulation S–P

Discussion
a. Introduction
The Commission separately is proposing the Exchange Act Cybersecurity Proposal,369 and separately is also proposing to amend Regulation S–P.370 As discussed in more detail below, certain types of SCI entities also are or would be subject to the Exchange Act Cybersecurity Proposal and/or Regulation S–P (currently and as it would be amended).371 The Exchange Act Cybersecurity Proposal and Regulation S–P (currently and as it would be amended) have or would have provisions requiring policies and procedures that address certain types of cybersecurity risks.372 The Exchange Act Cybersecurity Proposal also requires certain reporting to the Commission on Form SCIR of certain types of cybersecurity incidents.373 These notification and subsequent reporting requirements of the Exchange Act Cybersecurity Proposal are triggered by a ‘‘significant cybersecurity incident,’’ 374 which could also be an SCI event such as a ‘‘systems intrusion’’ as that term would be defined in current and proposed Rule 1000 of Regulation SCI.375 Finally, the Exchange Act Cybersecurity Proposal and Regulation S–P (currently and as it would be amended) have or would have provisions requiring disclosures of certain cybersecurity incidents.376 Consequently, if the proposed amendments to Regulation SCI and the other proposals are all adopted as proposed, SCI entities could be subject to requirements of that rule that relate to certain proposed requirements of the Exchange Act Cybersecurity Proposal and certain existing and proposed requirements of Regulation S–P. In the Commission’s view, this would be appropriate because, while the current and proposed cybersecurity requirements of Regulation SCI may impose some broadly similar obligations, it has a different scope and purpose than the Exchange Act Cybersecurity Proposal and Regulation S–P. Moreover, in many instances, compliance with the current and proposed cybersecurity requirements of Regulation SCI that relate to the proposed requirements of the Exchange Act Cybersecurity Proposal and the existing or proposed requirements Regulation S–P can be accomplished through similar efforts. The specific instances in which the cybersecurity requirements of current and proposed Regulation SCI would relate to the proposed requirements of the Exchange Act Cybersecurity Proposal and the existing or proposed requirements of Regulation S–P are discussed briefly below. The Commission encourages interested persons to provide comments on the discussion below, as well as on the potential application of Regulation SCI, the Exchange Act Cybersecurity Proposal, and Regulation S–P. More specifically, the Commission encourages commenters: (1) to identify any areas where they believe the relation between requirements of the existing or proposed requirements of Regulation SCI and the proposed requirements of the Exchange Act Cybersecurity Proposal and the existing or proposed requirements of Regulation S–P would be particularly costly or create practical
implementation difficulties; (2) to provide details on why these instances would be particularly costly or create practical implementation difficulties; and (3) to make recommendations on

377See infra section III.D.2. 378The requirements of the Exchange Act Cybersecurity Proposal would apply to brokerdealers, clearing agencies, major security-based swap participants, the MSRB, national securities associations, national securities exchanges, security-based swap data repositories, securitybased swap dealers, and transfer agents. See proposed 17 CFR 240.10(a). The Commission believes that a broker-dealer that exceeds one or more of the transaction activity thresholds under the proposed amendments to Regulation SCI (i.e., an SCI broker-dealer) likely would meet one of the broker-dealer definitions of ‘‘covered entity’’ in proposed Rule 10 of the Exchange Act Cybersecurity Proposal given their size and activities. For example, it would either be a carrying broker-dealer, have regulatory capital equal to or exceeding $50 million, have total assets equal to or exceeding $1 billion, or operate as a market maker. See paragraphs (a)(1)(i)(A), (C), (D), and (E) of proposed Rule 10. The Commission is seeking comment in the Exchange Act Cybersecurity Proposal as to whether a broker-dealer that is an SCI entity should be defined specifically as a ‘‘covered entity’’ under proposed Rule 10. See section II.A.10 of the Exchange Act Cybersecurity Proposal. In addition, the Commission requests comment in the Exchange Act Cybersecurity Proposal as to whether plan processors and SCI competing consolidators should be subject to its requirements. See id. The discussion in this section III.D focuses on the requirements of the Exchange Act Cybersecurity Proposal only as they would apply to current and proposed SCI entities. 379Regulation S–P applies to additional types of market participants that are not or would not be subject to Regulation SCI. See 17 CFR 248.3. For example, with regard to the proposed inclusion of broker-dealers, Regulation SCI would only be applicable to an estimated 17 broker-dealers under the proposed definition of SCI broker-dealer. The discussion in this section III.D focuses on the current and proposed requirements of Regulation S–P only as they would apply to current and proposed SCI entities. 380See 17 CFR 242.1000 (defining ‘‘SCI systems’’). See also supra section II.B.1. 381See 17 CFR 242.1000 (defining ‘‘indirect SCI systems’’). See also supra section II.B.1. 382See 17 CFR 248.30(a). 383See 17 CFR 248.3(j). 384See 17 CFR 248.3(g)(1). 385See 17 CFR 248.30(b)(2). 386See 17 CFR 248.30(b)(1)(ii). 387See Regulation S–P 2023 Proposing Release. 388Additionally, Regulation S–P (currently and as it would be amended) implicates cybersecurity to the extent that customer records or information or consumer report information is stored on an information system (e.g., on a computer). If this information is stored in paper form (e.g., in a file cabinet), the requirements of Regulation S–P apply but the policies and procedures required under the rule would need to address risks that are different than cybersecurity risks—for example, the
physical security risk that individuals could gain unauthorized access to the room or file cabinet where the paper records are stored as compared to the cybersecurity risk that individuals could gain unauthorized access to the information system on which the records are stored electronically. how to minimize these potential impacts, while also achieving the goal of this proposal to address, among other things, the cybersecurity risks faced by SCI entities. To assist this effort, the Commission is seeking specific comment below on these topics.377 b. SCI Entities That Are or Would Be Subject to the Exchange Act Cybersecurity Proposal and/or Regulation S–P Various SCI entities under this proposal are or would be subject to the Exchange Act Cybersecurity Proposal and/or Regulation S–P (currently and as it would be amended). In particular, most SCI entities under Regulation SCI (currently and as it would be amended) would be subject to the requirements of Exchange Act Cybersecurity Proposal. Specifically, all SCI entities other than plan processors and SCI competing consolidators that are or would be subject to Regulation SCI also would be subject to the Exchange Act Cybersecurity Proposal as ‘‘covered entities’’ 378 of that proposal. Therefore, if the proposed amendments to Regulation SCI and the Exchange Act Cybersecurity Proposal are all adopted as proposed, these SCI entities would be subject to the requirements of Regulation SCI in addition to the requirements of the Exchange Act Cybersecurity Proposal. In addition, broker-dealers that would be subject to Regulation SCI and those that operate certain ATSs currently subject to Regulation ATS (i.e., as SCI ATSs or SCI broker-dealers) also are or would be subject to Regulation S–P (currently and as it would be amended).379 Therefore, if the proposed amendments to Regulation SCI and Regulation S–P are all adopted as proposed, broker-dealers could be subject to Regulation SCI in addition to the requirements of Regulation S–P (currently and as it would be amended).
c. Policies and Procedures To Address
Cybersecurity Risks
As discussed below, Regulation S–P currently has certain cybersecurityrelated provisions. The Exchange Act Cybersecurity Proposal and the proposed amendments to Regulation S– P would add to these requirements. These existing and proposed requirements would relate to certain of the requirements of Regulation SCI (currently and as it would be amended). The Commission believes this result would be appropriate because the policies and procedures requirements of Regulation SCI (currently and as it would be amended) differ in scope and purpose from those of the Exchange Act Cybersecurity Proposal and Regulation S–P, and because the policies and procedures required under Regulation SCI that relate to cybersecurity (currently and as it would be amended) are generally consistent with the proposed requirements of the Exchange Act Cybersecurity Proposal and the existing and proposed requirements of Regulation S–P that pertain to cybersecurity.
i. Different Scope of the Policies and
Procedures Requirements
As discussed above in sections II.B and III.C, Regulation SCI (currently and as it would be amended) limits its requirements to SCI systems, which are certain systems of the SCI entity that support specified securities market related functions,380 and indirect SCI systems.381 Therefore, the policies and procedures requirements of Regulation SCI (currently and as it would be amended) that pertain to cybersecurity apply to SCI systems and indirect SCI systems. They do not and would not apply to other systems maintained by an SCI entity. Regulation S–P’s safeguards provisions currently apply to customer records and information.382 Regulation S–P defines ‘‘customer’’ to mean a consumer who has a customer relationship with the broker-dealer.383 Regulation S–P further defines the term ‘‘consumer’’ to mean an individual who obtains or has obtained a financial product or service from the brokerdealer that is to be used primarily for personal, family, or household purposes, or that individual’s legal representative.384 Regulation S–P’s disposal provisions apply to consumer report information maintained for a business purpose.385 Regulation S–P currently defines ‘‘consumer report information’’ to mean any record about an individual, whether in paper, electronic or other form, that is a consumer report or is derived from a consumer report and also a compilation of such records.386 The Commission is separately proposing to amend the scope of information covered under both the Regulation S–P safeguards provisions and the Regulation S–P disposal provisions.387 The amendments, however, would not fundamentally broaden the scope of these provisions. Therefore, the existing and proposed policies and procedures requirements of the Regulation S–P safeguards and disposal provisions that pertain to cybersecurity would apply to customer and consumer-related information. They do not and would not apply to other types of information stored on the information systems of the broker-dealer.388 Regulation SCI (currently and as it would be amended), the Exchange Act Cybersecurity Proposal, and Regulation S–P (currently and as it would be amended) would, therefore, differ in scope. The Exchange Act Cybersecurity

389See paragraphs (b) and (e) of proposed Rule 10 (setting forth the requirements of covered entities, among others, to have policies and procedures to address their cybersecurity risks). 390See 17 CFR 242.1001(a)(1). 391See 17 CFR 248.30(a). 392See 17 CFR 248.30(b)(2). Regulation S–P currently defines the term ‘‘disposal’’ to mean: (1) the discarding or abandonment of consumer report information; or (2) the sale, donation, or transfer of any medium, including computer equipment, on which consumer report information is stored. See 17 CFR 248.30(b)(1)(iii). 393The CAT System is a facility of each of the Participants and an SCI system. See also Joint Industry Plan; Order Approving the National Market System Plan Governing the Consolidated Audit Trail, Securities Exchange Act Release No. 79318 (Nov. 15, 2016), 81 FR 84696, 84758 (Nov. 23, 2016) (‘‘CAT NMS Plan Approval Order’’). It would also qualify as an ‘‘information system’’ of each national securities exchange and each national securities association under the Exchange Act Cybersecurity Proposal. The CAT NMS Plan requires the CAT’s Plan Processor to follow certain security protocols and industry standards, including the NIST Cyber Security Framework, subject to Participant oversight. See, e.g., CAT NMS Plan at Appendix D, Section 4.2. For the reasons discussed above and below with respect to SCI systems, the policies and procedures requirements of Regulation SCI are not intended to be inconsistent with the security protocols set forth in the CAT NMS Plan. Moreover, to the extent the CAT NMS Plan requires security protocols beyond those that would be required under Regulation SCI, those additional security protocols should generally fit within and be consistent with the policies and procedures required under the Exchange Act Cybersecurity Proposal to address all cybersecurity risks. 394See Regulation S–P 2023 Proposing Release. Proposal would require covered entities to establish, maintain, and enforce written policies and procedures that are reasonably designed to address their cybersecurity risks.389 Therefore, the Exchange Act Cybersecurity Proposal does not limit its application to certain systems or information residing on those systems based on the functions and operations performed by the covered entity through the system or the use of the information residing on the system unlike Regulation SCI (currently and as it would be amended). In addition, the Exchange Act Cybersecurity Proposal does not limit its application to a specific type of information residing on an information system unlike Regulation S–P (currently and as it would be amended).
ii. Consistency of the Policies and
Procedures Requirements
The Commission also believes that it would be appropriate to apply Regulation SCI to SCI entities even if they also are subject to the requirements of the Exchange Act Cybersecurity Proposal and/or Regulation S–P (currently and as it would be amended) because an SCI entity could use one comprehensive set of policies and procedures to satisfy the requirements of the current and proposed cybersecurity-related policies and procedures requirements of Regulation SCI, the Exchange Act Cybersecurity Proposal, and Regulation S–P. As explained below, the more focused current and proposed policies and procedures requirements of Regulation SCI and Regulation S–P addressing certain cybersecurity risks would logically fit within and be consistent with the broader policies and procedures required under the Exchange Act Cybersecurity Proposal to address all cybersecurity risks (including those outside of SCI systems and indirect SCI systems). SCI entities that would be covered entities under the proposed requirements of the Exchange Act Cybersecurity Proposal would be subject the proposed policies and procedures requirements of the Exchange Act Cybersecurity Proposal. In addition, broker-dealers that would be subject to Regulation SCI and those that operate certain ATSs currently subject to Regulation ATS (i.e., as SCI ATSs or SCI broker-dealers) are subject to the requirements of Regulation S–P (currently and as it would be amended). General Cybersecurity Policies and Procedures Requirements. Regulation SCI, Regulation S–P, and the Exchange Act Cybersecurity Proposal all include requirements that address certain cybersecurity-related risks. Regulation SCI requires an SCI entity to have reasonably designed policies and procedures to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity’s operational capability and promote the maintenance of fair and orderly markets.390 Regulation S–P’s safeguards provisions require broker-dealers to adopt written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information.391 Additionally, Regulation S–P’s disposal provisions require broker-dealers that maintain or otherwise possess consumer report information for a business purpose to properly dispose of the information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.392 Rule 10 of the Exchange Act Cybersecurity Proposal would require a covered entity to establish, maintain, and enforce written policies and procedures that are reasonably designed to address the covered entity’s cybersecurity risks. These requirements are designed to position covered entities to be better prepared to protect themselves against cybersecurity risks, to mitigate cybersecurity threats and
vulnerabilities, and to recover from cybersecurity incidents. They are also designed to help ensure that covered entities focus their efforts and resources on the cybersecurity risks associated with their operations and business practices. A covered entity that implements reasonably designed policies and procedures in compliance with the requirements of the Exchange Act Cybersecurity Proposal that cover its SCI systems and indirect SCI systems should generally satisfy the current and proposed general policies and procedures requirements of Regulation SCI that pertain to cybersecurity.393 Similarly, policies and procedures implemented by a broker-dealer that is an SCI entity that are reasonably designed in compliance with the current and proposed cybersecurity requirements of Regulation SCI should generally satisfy the existing general policies and procedures requirements of Regulation S–P safeguards and disposal provisions discussed above that pertain to cybersecurity. Requirements to Oversee Service Providers. Under the amendments to Regulation SCI, the policies and procedures required of SCI entities would need to include a program to manage and oversee third-party providers that provide functionality, support or service, directly or indirectly, for SCI systems and indirect SCI systems, and are discussed above in more detail in section III.C.2. In addition, proposed amendments to Regulation S–P’s safeguards provisions would require broker-dealers to include written policies and procedures within their response programs that require their service providers, pursuant to a written contract, to take appropriate measures that are designed to protect against unauthorized access to or use of customer information, including notification to the broker-dealer in the event of any breach in security resulting in unauthorized access to a customer information maintained by the service provider to enable the broker-dealer to implement its response program.394 Proposed Rule 10 of the Exchange Act Cybersecurity Proposal would have several policies and procedures requirements that are designed to address similar cybersecurity-related

395See paragraph (b)(1)(i)(A) of proposed Rule 10; see also section II.B.1.a of the Exchange Act Cybersecurity Proposal (discussing this requirement in more detail). 396See paragraph (b)(1)(i)(A)(2) of proposed Rule 10. 397See paragraphs (b)(1)(iii)(B) of proposed Rule 10; see also section II.B.1.c. of this release (discussing this requirement in more detail). 398See Regulation S–P 2023 Proposing Release. As discussed above, the general policies and procedures requirements of Regulation S–P’s safeguards provisions require the policies and procedures—among other things—to protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer. See 17 CFR 248.30(a)(3). 399See Regulation S–P 2023 Proposing Release. 400See paragraphs (b)(1)(ii)(A) through (E) of proposed Rule 10; see also section II.B.1.b of the Exchange Act Cybersecurity Proposal (discussing these requirements in more detail). 401See paragraph (b)(1)(iii)(A) of proposed Rule 10; see also section II.B.1.c. of the Exchange Act Cybersecurity Proposal (discussing these requirements in more detail). 402See paragraphs (b)(1)(iii)(A)(1) through (5) of proposed Rule 10. risks to these proposed amendments to Regulation SCI and Regulation S–P. First, a covered entity’s policies and procedures under proposed Rule 10 would need to require periodic assessments of cybersecurity risks associated with the covered entity’s information systems and information residing on those systems.395 This element of the policies and procedures would need to include requirements that the covered entity identify its service providers that receive, maintain, or process information, or are otherwise permitted to access its information systems and any of its information residing on those systems, and assess the cybersecurity risks associated with its use of these service providers.396 Second, under proposed Rule 10, a covered entity’s policies and procedures would need to require oversight of service providers that receive, maintain, or process its information, or are otherwise permitted to access its information systems and the information residing on those systems, pursuant to a written contract between the covered entity and the service provider, and through that written contract the service providers would need to be required to implement and maintain appropriate measures that are designed to protect the covered entity’s information systems and information residing on those systems.397 A covered entity that implements these requirements of proposed Rule 10 of the Exchange Act Cybersecurity Proposal with respect to its SCI systems and indirect SCI systems should generally satisfy the proposed requirements of Regulation SCI that the SCI entity’s policies and procedures include a program to manage and oversee third-party providers that provide functionality, support or service, directly or indirectly, for SCI systems and indirect SCI
systems. Similarly, a broker-dealer that is an SCI entity that implements these requirements of Regulation SCI should generally comply with the proposed requirements of Regulation S–P’s safeguards provisions relating to the oversight of service providers. Unauthorized Access Requirements. Under the proposed amendments to Regulation SCI, SCI entities would be required to have a program to prevent the unauthorized access to their SCI systems and indirect SCI systems, and information residing therein, and are discussed above in more detail in
section III.C.3.a. The proposed
amendments to Regulation S–P’s disposal provisions would require broker-dealers that maintain or otherwise possess consumer information or customer information for a business purpose to properly dispose of this information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.398 The broker-dealer would be required to adopt and implement written policies and procedures that address the proper disposal of consumer information and customer information in accordance with this standard.399 Proposed Rule 10 of the Exchange Act Cybersecurity Proposal would have several policies and procedures requirements that are designed to address similar cybersecurity-related risks to these proposed requirements of Regulation SCI and the proposed disposal provisions of Regulation S–P. First, a covered entity’s policies and procedures under proposed Rule 10 would need controls: (1) requiring standards of behavior for individuals authorized to access the covered entity’s information systems and the information residing on those systems, such as an acceptable use policy; (2) identifying and authenticating individual users, including but not limited to implementing authentication measures that require users to present a combination of two or more credentials for access verification; (3) establishing procedures for the timely distribution, replacement, and revocation of passwords or methods of authentication; (4) restricting access to specific information systems of the covered entity or components thereof and the information residing on those systems solely to individuals requiring access to the systems and information as is necessary for them to perform their responsibilities and functions on behalf of the covered entity; and (5) securing remote access technologies.400 Second, under proposed Rule 10, a covered entity’s policies and procedures would need to include measures designed to protect the covered entity’s information systems and protect the information residing on those systems from unauthorized access or use, based on a periodic assessment of the covered entity’s information systems and the information that resides on the systems.401 The periodic assessment would need to take into account: (1) the sensitivity level and importance of the information to the covered entity’s business operations; (2) whether any of the information is personal information; (3) where and how the information is accessed, stored and transmitted, including the monitoring of information in transmission; (4) the information systems’ access controls and malware protection; and (5) the potential effect a cybersecurity incident involving the information could have on the covered entity and its customers, counterparties, members, registrants, or users, including the potential to cause a significant cybersecurity incident.402 A covered entity that implements these requirements of proposed Rule 10 of the Exchange Act
Cybersecurity Proposal with respect to its SCI systems and indirect SCI systems should generally satisfy the proposed requirements of Regulation SCI that the SCI entity’s policies and procedures include a program to prevent the unauthorized access to their SCI systems and indirect SCI systems, and information residing therein. Similarly, a broker-dealer that is an SCI entity that implements these proposed requirements of Regulation SCI should generally satisfy the proposed requirements of Regulation S–P’s disposal provisions to adopt and implement written policies and procedures that address the proper disposal of consumer information and customer information. Review Requirements. The current and proposed provisions of Regulation SCI prescribe certain elements that must be included in each SCI entity’s policies and procedures relating to regular reviews and testing, penetration testing, and the SCI review, and are discussed above in more detail in sections II.B.2, II.B.4, III.C.3.b, and III.C.4. Proposed Rule 10 of the Exchange Act Cybersecurity Proposal would have several policies and procedures requirements that are designed to

403See paragraph (b)(1)(i)(A) of proposed Rule 10; see also section II.B.1.a of the Exchange Act Cybersecurity Proposal (discussing this requirement in more detail). 404See paragraph (b)(1)(i)(A)(1) of proposed Rule 10. 405See paragraph (b)(1)(iv) of proposed Rule 10; see also section II.B.1.d of the Exchange Act Cybersecurity Proposal (discussing this requirement in more detail). 406See paragraph (b)(1)(iii)(A) of proposed Rule 10. 407See also section II.B.1.c of the Exchange Act Cybersecurity Proposal. 408See paragraphs (a)(2)(vii) and (c)(1) of Rule 1001 of Regulation SCI, respectively. See also Rule 1002(a) of Regulation SCI and supra sections II.B.3 and III.C.3.c (discussing Regulation SCI’s current and proposed requirements with respect to taking corrective action for SCI events, including systems intrusions). 409See Regulation S–P 2023 Proposing Release. The response program also would need to have procedures to notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization unless the covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. See id. 410See paragraph (b)(1)(iv) of proposed Rule 10; see also section II.B.1.d of the Exchange Act Cybersecurity Proposal (discussing this requirement in more detail). 411See paragraph (b)(1)(v) of proposed Rule 10; see also section II.B.1.e of the Exchange Act Cybersecurity Proposal (discussing this requirement in more detail). 412See 17 CFR 242.1002(b); supra sections II.B.2 and III.C.3.c (discussing Regulation SCI’s current and proposed requirements relating to SCI events, which include systems intrusions, and Commission notification for SCI events). address similar cybersecurity-related risks to these existing and proposed requirements of Regulation SCI. First, a covered entity’s policies and procedures under proposed Rule 10 would need to require periodic assessments of cybersecurity risks associated with the covered entity’s information systems and information residing on those systems.403 Moreover, this element of the policies and procedures would need to include requirements that the covered entity categorize and prioritize cybersecurity risks based on an inventory of the components of the covered entity’s information systems and information residing on those systems and the potential effect of a cybersecurity incident on the covered entity.404 Second, under proposed Rule 10, a covered entity’s policies and procedures would need to require measures designed to detect, mitigate, and remediate any cybersecurity threats and vulnerabilities with respect to the covered entity’s information systems and the information residing on
those systems.405 A covered entity that implements these requirements of proposed Rule 10 with respect to its SCI systems and indirect SCI systems should generally satisfy the current requirements of Regulation SCI that the SCI entity’s policies and procedures require regular reviews and testing of SCI systems and indirect SCI systems, including backup systems, to identify vulnerabilities from internal and external threats. Further, while proposed Rule 10 does not require penetration testing, the proposed rule requires measures designed to protect the covered entity’s information systems and protect the information residing on those systems from unauthorized access or use, based on a periodic assessment of the covered entity’s information systems and the information that resides on the systems 406 and penetration testing could be part of these measures.407 Therefore, the existing and proposed requirements of Regulation SCI requiring penetration testing could be incorporated into and should logically fit within a covered entity’s policies and procedures to address cybersecurity risks under proposed Rule 10 of the Exchange Act Cybersecurity Proposal. Response Program. Regulation SCI requires SCI entities to have policies and procedures to monitor its SCI systems and indirect SCI systems for SCI events, which include systems intrusions for unauthorized access, and also requires them to have policies and procedures that include escalation procedures to quickly inform responsible SCI personnel of potential SCI events, which are discussed above in more detail in section II.B.2.408 The amendments to Regulation S–P’s safeguards provisions would require the policies and procedures to include a response program for unauthorized access to or use of customer information. Further, the response program would need to be reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including procedures, among others: (1) to assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization; and (2) to take appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information.409 Proposed Rule 10 of the Exchange Act Cybersecurity Proposal would have several policies and procedures requirements that are designed to address similar cybersecurity-related risks to these proposed requirements of Regulation SCI and the proposed requirements of the safeguards provisions of Regulation S–P. First, under proposed Rule 10, a covered entity’s policies and procedures would need to have measures designed to detect, mitigate, and remediate any cybersecurity threats and vulnerabilities with respect to the covered entity’s information systems and the information residing on those systems.410
Second, under proposed Rule 10, a covered entity’s policies and procedures would need to have measures designed to detect, respond to, and recover from a cybersecurity incident, including policies and procedures that are reasonably designed to ensure (among other things): (1) the continued operations of the covered entity; (2) the protection of the covered entity’s information systems and the information residing on those systems; and (3) external and internal cybersecurity incident information sharing and communications.411 A covered entity that implements reasonably designed policies and procedures in compliance with these requirements of proposed Rule 10 of the Exchange Act Cybersecurity Proposal should generally satisfy the current and proposed requirements of Regulation SCI and Regulation S–P’s safeguards provisions relating to response programs for unauthorized access. d. Commission Notification As discussed above in sections II.B.3 and III.C.3.c, Regulation SCI (currently and as it would be amended) provides the framework for notifying the Commission of SCI events including, among other things, requirements to:
notify the Commission of the event immediately; provide a written notification on Form SCI within 24 hours that includes a description of the SCI event and the system(s) affected, with other information required to the extent available at the time; provide regular updates regarding the SCI event until the event is resolved; and submit a final detailed written report regarding the SCI event.412 If proposed Rule 10 of the Exchange Act Cybersecurity Proposal is adopted as proposed, it would establish a framework for covered entities to provide the Commission (and other regulators, if applicable) with immediate written electronic notice of a significant cybersecurity incident affecting the covered entity and, thereafter, report and update information about the

413See paragraphs (c)(1) and (2) of proposed Rule 10 (requiring covered entities to provide immediate written notice and subsequent reporting on Part I of proposed Form SCIR of significant cybersecurity incidents); and sections II.B.2. and II.B.4. of the Exchange Act Cybersecurity Proposal (discussing the requirements of paragraphs (c)(1) and (2) of proposed Rule 10 and Part I of Form SCIR in more detail). 414See section II.F.1.b of the Exchange Act Cybersecurity Proposal. 415See paragraphs (a)(1)(i)(A) and (F) of proposed Rule 10 (defining the categories of broker-dealers that would be covered entities); see also supra note 378. 416See section II.B.2.a of the Exchange Act Cybersecurity Proposal. 417See section II.B.2.b of the Exchange Act Cybersecurity Proposal. 418FSOC has found that ‘‘[s]haring timely and actionable cybersecurity information can reduce the risk that cybersecurity incidents occur and can mitigate the impacts of those that do occur.’’ FSOC, Annual Report (2021), available at https:// home.treasury.gov/system/files/261/FSOC2021 AnnualReport.pdf (‘‘FSOC 2021 Annual Report’’). 419See 17 CFR 242.1000 (defining the term ‘‘SCI event’’); see also supra sections II.B.3 and III.C.3.c (discussion the current and proposed requirements relating to SCI events, including systems intrusions). 420See 17 CFR 242.1000 (defining the term ‘‘system disruption’’ and including that term in the definition of ‘‘SCI event’’). significant cybersecurity incident by filing Part I of proposed Form SCIR with the Commission (and other regulators, if applicable).413 Part I of proposed of Form SCIR would elicit information about the significant cybersecurity incident and the covered entity’s efforts to respond to, and recover from, the incident. Consequently, an SCI entity that is also a covered entity under the Exchange Act Cybersecurity Proposal that experiences a systems intrusion under Regulation SCI that also is a significant cybersecurity incident under proposed Rule 10 would be required to make two filings for the single incident:
one on Form SCI and the other on Part I of proposed Form SCIR. The SCI entity also would be required to make additional filings on Forms SCI and SCIR pertaining to the systems intrusion (i.e., to provide updates and final reports). The Commission believes the approach of having two separate notification and reporting programs— one under Regulation SCI and the other under proposed Rule 10 of the Exchange Act Cybersecurity Proposal—would be appropriate for the following reasons. As discussed earlier, most brokerdealers would not be SCI entities under the current and proposed requirements of Regulation SCI.414 Certain of the broker-dealers that are not SCI entities (currently and as it would be amended) would be covered entities under the Exchange Act Cybersecurity Proposal, as would other types of entities.415 In addition, the current and proposed reporting requirements of Regulation SCI are or would be triggered by events impacting SCI systems and indirect SCI systems. In addition to SCI systems and indirect SCI systems, covered entities that are or would be SCI entities use and rely on information systems that are not SCI systems or indirect SCI systems under the current and proposed amendments to Regulation SCI. For these reasons, covered entities under the Exchange Act Cybersecurity Proposal could be impacted by significant cybersecurity incidents that do not trigger the current and proposed notification requirements of Regulation SCI either because they do not meet the current or proposed definitions of ‘‘SCI entity’’ or because the significant cybersecurity incident does not meet the current or proposed definitions of ‘‘SCI event.’’ The objective of notification and reporting requirements of proposed Rule 10 of the Exchange Act Cybersecurity Proposal is to improve the Commission’s ability to monitor and respond to significant cybersecurity incidents and use the information reported about them to better understand how they can be avoided or mitigated.416 For this reason, Part I of proposed Form SCIR is tailored to elicit information relating specifically to cybersecurity, such as information relating to the threat actor, and the impact of the incident on any data or personal information that may have been accessed.417 The Commission and its staff could use the information reported on Part I of Form SCIR to monitor the U.S. securities markets and the covered entities that support those markets broadly from a cybersecurity perspective, including identifying cybersecurity threats and trends from a market-wide view. By requiring all covered entities to report information about a significant cybersecurity incident on a common form, the information obtained from these filings over time would create a comprehensive set of data of all significant cybersecurity incidents impacting covered entities that is based on these entities responding to the same check boxes and questions on the form. This would facilitate analysis of the data, including analysis
across different covered entities and significant cybersecurity incidents. Eventually, this set of data and the ability to analyze it by searching and sorting how different covered entities responded to the same questions on the form could be used to spot common trending risks and vulnerabilities as well as best practices employed by covered entities to respond to and recover from significant cybersecurity incidents.418 The current and proposed definitions of ‘‘SCI event’’ include not only cybersecurity events, but also events that are not related to significant cybersecurity incidents under the Exchange Act Cybersecurity Proposal.419 For example, under the current and proposed requirements of Regulation SCI, the definition of ‘‘SCI event’’ includes ‘‘systems disruptions,’’ which are events in an SCI entity’s SCI systems that disrupts, or significantly degrades, the normal operation of an SCI system.420 Therefore, the definitions are not limited to events in an SCI entity’s SCI systems that disrupt, or significantly degrade, the normal operation of an SCI system caused by a significant cybersecurity incident. The information elicited in Form SCI reflects the broader scope of the reporting requirements of Regulation SCI (as compared to the narrower focus of proposed Rule 10 on reporting about significant cybersecurity incidents). For example, Form SCI requires the SCI entity to identify the type of SCI event:
systems compliance issue, systems disruption, and/or systems intrusion. In addition, Form SCI is tailored to elicit information specifically about SCI systems. For example, the form requires the SCI entity to indicate whether the type of SCI system impacted by the SCI event directly supports: (1) trading; (2) clearance and settlement; (3) order routing; (4) market data; (5) market regulation; and/or (6) market surveillance. If the impacted system is a critical SCI system, the SCI entity must indicate whether it directly supports functionality relating to: (1) clearance and settlement systems of clearing agencies; (2) openings, reopenings, and closings on the primary listing market; (3) trading halts; (4) initial public offerings; (5) the provision of consolidated market data; and/or (6) exclusively listed securities. The form also requires the SCI entity to indicate if the systems that provide functionality to the securities markets for which the availability of alternatives is significantly limited or nonexistent and without which there would be a material impact on fair and orderly markets. e. Information Dissemination and Disclosure As discussed above in sections II.B.3 and III.C.3.c, Regulation SCI (currently and as it would be amended) would require that SCI entities disseminate information to their members,

421See 17 CFR 242.1002(c).
422However, disclosure under proposed Regulation S–P would not be required if ‘‘a covered institution has determined, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.’’ See Regulation S–P 2023 Proposing Release. The proposed amendments to Regulation S–P would define ‘‘sensitive customer information’’ to mean any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information. Id. The proposed amendments would provide example of sensitive customer information. Id. 423See paragraph (d)(1) of proposed Rule 10. 424See section II.B.3.b (discussing these proposed requirements in more detail). 425 Information regarding major SCI events would be required to be disseminated by an SCI entity to all of its members, participants, or customers (as applicable). See current and proposed Rule 1002(c)(3) of Regulation SCI. 426A carrying broker-dealer would be required to make the disclosures to its customers as well through the means by which they receive account statements. 427Under the Regulation SCI and Regulation S– P proposals, there could be circumstances in which a compromise involving sensitive customer information at a broker-dealer that is an SCI entity could result in two forms of notification being provided to customers for the same incident. In addition, under the Exchange Act Cybersecurity Proposal, the broker-dealer also may need to publicly disclose a summary description of the incident via EDGAR and the entity’s business internet website, and, in the case of an introducing or carrying broker-dealer, send a copy of the disclosure to its customers. participants, or customers (as applicable) regarding SCI events, including systems intrusions.421 The proposed amendments to Regulation S– P would require broker-dealers to notify affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.422 Proposed Rule 10 of the Exchange Act Cybersecurity Proposal would require a covered entity to make two types of public disclosures relating to cybersecurity on Part II of proposed Form SCIR.423 Covered entities would be required to make the disclosures by filing Part II of proposed Form SCIR on the Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system and posting a copy of the filing on their business websites.424 In addition, a covered entity that is either a carrying or introducing broker-dealer would be required to provide a copy of the most recently filed Part II of Form SCIR to a customer as part of the account opening process. Thereafter, the
carrying or introducing broker-dealer would need to provide the customer with the most recently filed form annually. The copies of the form would need to be provided to the customer using the same means that the customer elects to receive account statements (e.g., by email or through the postal service). Finally, a covered entity would be required to make updated disclosures promptly through each of the methods described above (as applicable) if the information required to be disclosed about cybersecurity risk or significant cybersecurity incidents materially changes, including, in the case of the disclosure about significant cybersecurity incidents, after the occurrence of a new significant cybersecurity incident or when information about a previously disclosed significant cybersecurity incident materially changes. Consequently, a covered entity would, if it experiences a ‘‘significant cybersecurity incident,’’ be required to make updated disclosures under proposed Rule 10 by filing Part II of proposed Form SCIR on EDGAR, posting a copy of the form on its business website, and, in the case of a carrying or introducing broker-dealer, by sending the disclosure to its customers using the same means that the customer elects to receive account statements. Thus, if an SCI entity is a covered entity under the Exchange Act Cybersecurity Proposal and if the SCI event would be a significant cybersecurity incident under the Exchange Act Cybersecurity Proposal, the SCI entity also could be required to disseminate certain information about the SCI event to certain of its members, participants, or customers (as applicable). Further, if the SCI entity is a broker-dealer and, therefore, subject to Regulation S–P (as it is proposed to be amended), the broker-dealer also could be required to notify individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. However, the Commission believes that this result would be appropriate. First, as discussed above, Regulation SCI (currently and as it would be amended), proposed Rule 10, and Regulation S–P (as proposed to be amended) require different types of information to be disclosed. Second, as discussed above, the disclosures, for the most part, would be made to different persons: (1) affected members,425 participants, or customers (as applicable) of the SCI entity in the case of Regulation SCI; (2) the public at large in the case of proposed Rule 10 of the Exchange Act Cybersecurity Proposal; 426 and (3) affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization or, in some cases, all individuals whose information resides in the customer information system that was accessed or used without authorization in the case of Regulation S–P (as proposed to be amended).427 For these reasons, the Commission believes it would be appropriate to apply these current and proposed
requirements of Regulation SCI to SCI entities even if they would be subject to the disclosure requirements of proposed Rule 10 of the Exchange Act Cybersecurity Proposal and/or Regulation S–P (as proposed to be amended).
2. Request for Comment
The Commission requests comment on the relation between the requirements of Regulation SCI (as it currently exists and as it is proposed to be amended), proposed Rule 10, and Regulation S–P (as it currently exists and as it is proposed to be amended). In addition, the Commission is requesting comment on the following matters:
87. Should the policies and
procedures requirements of current and proposed Regulation SCI regarding cybersecurity be modified to address SCI entities that also would be subject to proposed Rule 10 of the Exchange Act Cybersecurity Proposal and/or the existing and proposed requirements of Regulation S–P? For example, would it be particularly costly or create practical implementation difficulties to apply the requirements of current and proposed Regulation SCI to have policies and procedures to address cybersecurity risks to SCI entities even if they also would be subject to requirements to have policies and procedures under proposed Rule 10 (if it is adopted) and/ or Regulation S–P that address certain cybersecurity risks (currently and it they would be amended)? If so, explain why. If not, explain why not. Are there ways the policies and procedures requirements of current or proposed Regulation SCI regarding could be modified to minimize these potential impacts while achieving the separate goals of this proposal? If so, explain how and suggest specific modifications.
88. Should the Commission
notification and reporting requirements of current and proposed Regulation SCI be modified to address SCI entities that also would be subject to the proposed requirements of Rule 10 of the Exchange Act Cybersecurity Proposal? For example, would it be particularly costly or create practical implementation difficulties to apply the Commission notification and reporting requirements

428See 44 U.S.C. 3501 et seq.
429See 44 U.S.C. 3507; 5 CFR 1320.11. 430See 5 CFR 1320.11(l). 431See infra section IV.C (Respondents) for more information on Current SCI Entities and New SCI Entities. 432Unless otherwise described, none of the existing information collections are being revised with new requirements. of current and proposed Regulation SCI and Form SCI to SCI entities even if they also would be subject to immediate notification and subsequent reporting requirements under proposed Rule 10 of the Exchange Act Cybersecurity Proposal and Part I of proposed Form SCIR (if they are adopted)? If so, explain why. If not, explain why not. Are there ways the Commission notification and reporting requirements of current or proposed Regulation SCI and Form SCI could be modified to minimize these potential impacts while achieving the separate goals of this proposal? If so, explain how and suggest specific modifications. For example, should Form SCI be modified to include a
section that incorporates the check
boxes and questions of Part I of Form SCIR so that a single form could be filed to meet the reporting requirements of Regulation SCI and proposed Rule 10? If so, explain why. If not, explain why not. Should the Commission modify the proposed Commission notification framework for systems intrusions that are also significant cybersecurity incidents under Rule 10? For example, should such systems intrusions be initially reported (i.e., immediately and for the 24-hour notification) on Form SCI, with subsequent reports exempted from Rule 1002(b)’s requirements if they are reported to the Commission on Form SCIR pursuant to the proposed requirements of Rule 10? Why or why not? Are there other ways Form SCI could be modified to combine the elements of Part I of Form SCIR? If so, explain how.
89. Should the disclosure
requirements of proposed and current Regulation SCI be modified to address SCI entities that also would be subject to the proposed requirements of the Exchange Act Cybersecurity Proposal and the existing and proposed requirements of Regulation S–P? For example, would it be particularly costly or create practical implementation difficulties to apply the disclosure requirements of current and proposed Regulation SCI to SCI entities even if they also would be subject to the proposed Rule 10 and Part II of proposed form SCIR (if they are adopted) the current and proposed requirements of Regulation S–P? If so, explain why. If not, explain why not. Are there ways the disclosure requirements of Regulation SCI could be modified to minimize these potential impacts while achieving the separate goals of this proposal? If so, explain how and suggest specific modifications.
90. Would the addition of the
requirements in the Exchange Act Cybersecurity Proposal—together with the current broker-dealer regulatory regime, including the Market Access Rule and other Commission and FINRA rules—be sufficient to reasonably ensure the operational capability of the technological systems of the proposed SCI broker-dealers? Why or why not? For example, are there any provisions of Regulation SCI that, if added to the Exchange Act Cybersecurity Proposal as it applies to broker-dealers, would help ensure the operational capability of the technological systems of the proposed SCI broker-dealers? Which provisions?
IV. Paperwork Reduction Act
Certain provisions of the proposal would contain a new ‘‘collection of information’’ within the meaning of the Paperwork Reduction Act of 1995 (‘‘PRA’’).428 The Commission is submitting the proposed rule amendments to the Office of Management and Budget (‘‘OMB’’) for review and approval in accordance with the PRA and its implementing regulations.429 An agency may not conduct or sponsor, and a person is not required to respond to a collection of information unless it displays a currently valid OMB control number.430 The Commission is proposing to alter the 31 existing collections of information and apply such collections of information to new categories of respondents. The title for the collections of information is: Regulation Systems Compliance and Integrity (OMB control number 3235–0703). The burden estimates contained in this section do not include any other possible costs or economic effects beyond the burdens required to be calculated for PRA purposes. A. Summary of Collections of Information The proposed amendments to Regulation SCI create paperwork burdens under the PRA by (1) adding new categories of respondents to the 31 existing collections of information (across 7 rules) noted above and (2) modifying the requirements of 16 of those collections, as noted below. For entities that are already required to comply with Regulation SCI (‘‘Current SCI Entities’’), the proposed amendments would result in the modification of certain collections of information. Entities that would become subject to Regulation SCI as a result of the proposed amendments (‘‘New SCI Entities’’) would be newly subject to the 31 existing collections of information, including the modifications.431 The collections of information and applicable categories of new respondents are summarized (by rule) in the following table.432 Collection of information Rule Burden description Respondent categories Rule 1001 of Regulation SCI Rule 1001(a) ...................... Rule Description: Requirement to establish, maintain, and enforce written policies and procedures related to capacity, integrity, resiliency, availability, and security. Current SCI Entities and New SCI Entities. Revised burden: ensure policies and procedures include a program to manage and oversee third-party providers that provide functionality, support or service for the SCI entity’s SCI systems; inventory all SCI systems, include a program to prevent unauthorized access to SCI system access and the information residing therein, identify the SCI industry standard with which such policy and procedure is consistent, if any.

Collection of information Rule Burden description Respondent categories Rule 1001(b) ...................... Rule Description: Requirement to establish, maintain, and enforce policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Exchange Act, rules and regulations thereunder, and the entity’s rules and governing documents. New SCI Entities. Rule 1001(c) ...................... Rule Description: Establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to inform responsible SCI personnel of potential SCI events. New SCI Entities. Rule 1002 of Regulation SCI Rule 1002(a) ...................... Rule Description: Each SCI entity is required to take appropriate corrective action upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred. New SCI Entities. Rule 1002(b) ...................... Rule Description: Rules 1002(b)(1) through (4): Requirement that each SCI entity, upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, notify the Commission immediately of such SCI event and submit a written notification within 24 hours of responsible SCI personnel having a reasonable basis to conclude there was an SCI event. Periodic updates are required pertaining to the SCI event on either a regular basis or at such frequency requested by representatives of the Commission. An interim written notification is required if the SCI event is not closed within 30 days of its occurrence. A final notification is required to be submitted within five days of the resolution and closure of the SCI event. Current SCI Entities and New SCI Entities. Rule 1002(b)(5): For events that the SCI entity reasonably estimates would have no, or a de minimis impact on the SCI entity’s operations or on market participants, submit a report within 30 days after the end of each calendar quarter containing a summary description of such systems disruptions and systems intrusions. Revised burden: add (1) cybersecurity events that disrupt, or significantly degrade the normal operation of an SCI system, and (2) significant attempted unauthorized entries into SCI systems or indirect SCI systems, as determined by the SCI entity pursuant to established reasonable written criteria, to the definition of systems intrusions in Rule 1000, thus requiring that SCI entities provide notifications under Rule 1002(b)(1) through (4); eliminate the de minimis exception’s applicability to systems intrusions, thus requiring all systems intrusions to be reported pursuant to Rule 1002(b)(1) through (4); require interim written notification to the Commission to include a copy of any information disseminated pursuant to Rule 1002(c) regarding the SCI event by
SCI broker-dealers to their customers. Rule 1002(c) ...................... Rule Description: Requirements to disseminate certain information to members and participants concerning SCI events promptly after any responsible SCI personnel has a reasonable basis to conclude that an SCI event has occurred. For major SCI events, information must be disseminated to all members and participants, and for SCI events that are not major, the information must be disseminated to members or participants that any responsible SCI personnel has reasonably estimated may have been affected by the SCI event. Current SCI Entities and New SCI Entities.

433See 17 CFR 242.1001(a)(1).
Collection of information Rule Burden description Respondent categories Revised burden: add cybersecurity events to the definition of systems intrusions in Rule 1000, thus making them SCI events and requiring that SCI entities provide notifications under Rule 1002(c)(2) for those additional SCI events; exclude systems intrusions that are significant attempted unauthorized entries into the SCI systems or indirect SCI systems of an SCI entity from information dissemination requirements; add that SCI broker-dealers would notify their customers (rather than members or participants). Rule 1003 of Regulation SCI Rule 1003(a) ...................... Rule Description: Submit quarterly report describing completed, ongoing, and planned material changes to SCI systems and the security of indirect SCI systems; establish reasonable written criteria to identify changes to SCI systems and the security of indirect SCI systems as material and report such changes in accordance with such criteria. Promptly submit a supplemental report notifying the Commission of a material error in or material omission from a previously submitted report. New SCI Entities. Rule 1003(b) ...................... Rule Description: Requirement to conduct an SCI review of the SCI entity’s compliance with Regulation SCI not less than once each calendar year; conduct penetration test reviews not less than once every three years. Current SCI Entities and New SCI Entities. Revised burden: include certain additional requirements and information in SCI reviews, require the SCI review to be performed annually, and require a response by senior management be reported to the Commission. Rule 1004 of Regulation SCI Rule 1004 .......................... Rule Description: Establish standards to designate members and participants that are the minimum necessary for the maintenance of fair and orderly markets, designate members or participants and require their participation in testing of the BC/DR plans pursuant to such standards, and coordinate testing on an industry or sector-wide basis with other SCI entities. Current SCI Entities and New SCI Entities. Revised burden: require SCI entities to establish standards for designating certain third-party providers that are the minimum necessary for the maintenance of fair and orderly markets, and designate third-party providers for BC/DR testing pursuant to those standards. Rule 1005 of Regulation SCI Rule 1005 .......................... Rule Description: Requirement to make, keep, and preserve all documents relating to compliance with Regulation SCI. Current SCI Entities and New SCI Entities. Revised burden: Entities that ‘‘otherwise [cease] to be an SCI entity’’ are required to comply with the recordkeeping requirements in this section. Rule 1006 ............................ Rule 1006 .......................... Rule Description: Require submissions to the Commission pursuant to Regulation SCI to be made electronically on Form SCI. New SCI
Entities. Rule 1007 ............................ Rule 1007 .......................... Rule Description: Requirement that SCI entities make available records required to be filed or kept under Regulation SCI that are prepared or maintained by a service bureau or other recordkeeping service on behalf of the SCI entity. New SCI Entities. B. Proposed Use of Information The existing information collections and the proposed amendments are used as described below:

Rule 1001 of Regulation SCI
Rule 1001(a)(1) of Regulation SCI requires each SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that their SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain their operational capability and promote the maintenance of fair and orderly markets.433 Rule 1001(a)(2) of Regulation SCI requires that, at a minimum, such policies and procedures include: current and future capacity planning; periodic stress testing; systems development and testing methodology; reviews and testing to identify vulnerabilities; business continuity and disaster recovery planning (inclusive of backup systems that are geographically diverse and designed to meet specified recovery

434See 17 CFR 242.1001(a)(2).
435See 17 CFR 242.1001(a)(3).
436See 17 CFR 242.1001(a)(4).
437See 17 CFR 242.1001(b).
438See 17 CFR 242.1001(c).
439See 17 CFR 242.1002(a).
440See 17 CFR 242.1002(b)(1).
441See 17 CFR 242.1002(b)(2).
442See 17 CFR 242.1002(b)(3).
443See 17 CFR 242.1002(b)(4).
444See 17 CFR 242.1002(b)(5).
445See 17 CFR 242.1002(c). time objectives); standards for market data collection, processing, and dissemination; and monitoring to identify potential SCI events.434 Rule 1001(a)(3) of Regulation SCI requires that SCI entities periodically review the effectiveness of these policies and procedures and take prompt action to remedy any deficiencies.435 Rule 1001(a)(4) of Regulation SCI provides that an SCI entity’s policies and procedures will be deemed to be reasonably designed if they are consistent with current SCI industry standards, which is defined to be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization; 436 however, Rule 1001(a)(4) of Regulation SCI also makes clear that compliance with such ‘‘current SCI industry standards’’ is not the exclusive means to comply with these requirements. Rule 1001(b) of Regulation SCI requires each SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Exchange Act and the rules and regulations thereunder and the entity’s rules and governing documents, as applicable, and specifies certain minimum requirements for such policies and procedures.437 Rule 1001(c) of Regulation SCI requires SCI entities to establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.438 The Commission is proposing revisions to Rule 1001(a)(2) and (4) of Regulation SCI to include four additional elements in the policies and procedures: (1) the maintenance of a written inventory of all SCI systems, critical SCI systems, and indirect SCI systems, including a lifecycle management program with respect to such systems; (2) a program to manage and oversee third-party providers that includes an initial and periodic review of contracts with third-party providers and a risk-based assessment of each third-party provider’s criticality to the SCI entity; (3) a program to prevent unauthorized SCI system access; and (4) identification of the SCI industry standard with which such policies and procedures are consistent, if any. The Commission also proposes to amend the existing requirements in Rule 1001(a)(2)(v) for the BC/DR plan to include the requirement to maintain backup and recovery capabilities that are reasonably designed to address the unavailability of any third-party provider without which there would be a material impact on any of its critical SCI systems. The requirement to have a third-party provider management program
would help ensure that any third-party provider an SCI entity selects is able to support the SCI entity’s compliance with Regulation SCI’s requirements. Additionally, the proposed revisions would ensure SCI entities are creating an inventory of their SCI systems, critical SCI systems, and indirect SCI systems and have a lifecycle management program for such systems, which would ensure that SCI entities are able to identify when a system becomes an SCI system or indirect SCI system and when it ceases to be one. Next, the revisions would require SCI entities to have in place a program to prevent unauthorized SCI system access. The existing collections of information, which would be extended to new SCI entities would advance the goals of promoting the maintenance of fair an orderly markets and improving Commission review and oversight of U.S. securities market infrastructure. The proposed additional collections of information would advance these same goals.
2. Rule 1002 of Regulation SCI
Under Rule 1002 of Regulation SCI, SCI entities have certain obligations regarding SCI events. Rule 1002(a) requires an SCI entity to begin to take appropriate corrective action when any responsible SCI personnel has a reasonable basis to conclude that an SCI event has occurred. The corrective action must include, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable.439 Rule 1002(b)(1) requires each SCI entity to immediately notify the Commission of an SCI event.440 Under 17 CFR 242.1002(b)(2) (‘‘Rule 1002(b)(2)’’), each SCI entity is required, within 24 hours of any responsible SCI personnel having a reasonable basis to conclude that the SCI event has occurred, to submit a written notification to the Commission pertaining to the SCI event that includes a description of the SCI event and the system(s) affected, with other information required to the extent available at the time.441 Under 17 CFR 242.1002(b)(3) (‘‘Rule 1002(b)(3)’’), each SCI entity is required to provide regular updates regarding the SCI event until the event is resolved.442 Under 17 CFR 242.1002(b)(4)(i) (‘‘Rule 1002(b)(4)(i)’’), each SCI entity is required to submit written interim reports, as necessary, and a written final report regarding an SCI event to the Commission.443 Under 17 CFR 242.1002(b)(4)(ii) (‘‘Rule 1002(b)(4)(ii)’’), the information that is required to be included in the interim and final written reports is set forth, including the SCI entity’s assessment of the types and number of market participants affected by the SCI event and the impact of the SCI event on the market, and a copy of any information disseminated pursuant to Rule 1002(c) regarding the SCI event to the SCI entity’s members or participants. For any SCI event that ‘‘has had, or the SCI entity reasonably estimates would have, no or a de minimis impact on the SCI entity’s operations or on market participants,’’ Rule 1002(b)(5) provides an exception to the general Commission notification requirements under Rule 1002(b) Instead, an SCI entity must make, keep, and preserve records relating to all such SCI events, and submit a quarterly report to the Commission regarding any such events that are systems disruptions or systems intrusions. SCI events that are reported immediately and later determined to have a de minimis impact may be reclassified as de minimis.444 Rule 1002(c) of Regulation SCI requires that SCI entities disseminate information to their members or participants regarding SCI events.445 Under 17 CFR 242.1002(c)(1)(i) (‘‘Rule 1002(c)(1)(i)’’), each SCI entity is required, promptly after any responsible SCI personnel has a reasonable basis to conclude that an SCI event (other than a systems intrusion) has occurred, to disseminate certain information to its members or participants. Under 17 CFR 242.1002(c)(1)(ii) (‘‘Rule 1002(c)(1)(ii)’’), each SCI entity
is required, when

446See 17 CFR 242.1002(c)(3).
447See 17 CFR 242.1002(c)(2).
448See 17 CFR 242.1002(c)(4).
449See proposed amended Rule 1002(c)(4). 450See 17 CFR 242.1003(a). 451See 17 CFR 242.1003(b). 452See 17 CFR 242.1003(b)(2). 453See 17 CFR 242.1003(b)(1)(i) and (ii). known, to disseminate additional information about an SCI event (other than a systems intrusion) to its members or participants promptly. Under 17 CFR 242.1002(c)(1)(iii) (‘‘Rule 1002(c)(1)(iii)’’), each SCI entity is required to provide to its members or participants regular updates of any information required to be disseminated under Rule 1002(c)(1)(i) and (ii) until the SCI event is resolved. Rule 1002(c)(2) requires each SCI entity to disseminate certain information regarding a systems intrusion to its members or participants. For ‘‘major SCI events,’’ these disseminations must be made to all of its members or participants. For SCI events that are not ‘‘major SCI events,’’ SCI entities must disseminate such information to those SCI entity members and participants reasonably estimated to have been affected by the event.446 In addition, dissemination of information to members or participants is permitted to be delayed for systems intrusions if such dissemination would likely compromise the security of the SCI entity’s systems or an investigation of the intrusion and documents the reasons for such determination.447 Rule 1002(c)(4) of Regulation SCI provides exceptions to the dissemination requirements under Rule 1002(c) of Regulation SCI for SCI events to the extent they relate to market regulation or market surveillance systems and SCI events that have had, or the SCI entity reasonably estimates would have, no or a de minimis impact on the SCI entity’s operations or on market participants.448 Rule 1000 sets out the definition of systems intrusion, which means any unauthorized entry into the SCI systems or indirect SCI systems of an SCI entity. The Commission proposes to amend the definition of systems intrusion in Rule 1000 to include cybersecurity events that disrupt, or significantly degrade, the normal operation of an SCI system and significant attempted unauthorized entries into the SCI systems or indirect SCI systems of an SCI entity, as determined by the SCI entity pursuant to established reasonable written criteria. SCI entities would be required to report information concerning these systems intrusions pursuant to Rule 1002(b). The Commission believes that it is appropriate to expand the definition of systems intrusion to include two additional types of cybersecurity events that are currently not part of the current definition as described above. The additional notifications that would result from the proposed revised definition of systems intrusion would provide the Commission and its staff more complete information to assess the security status of the SCI entity, and also assess the impact or potential impact that unauthorized activity could have on the security of the SCI entity’s affected systems as well on other SCI entities and market participants. The proposed
revisions to Rule 1002(b) would eliminate the de minimis exception’s applicability to systems intrusions, thus requiring all systems intrusions, whether de minimis or nonde minimis, to be reported pursuant to Rule 1002(b)(1) through (4). The Commission would also amend the information required under Rule 1002(b)(4)(ii) to be included in the interim and final written notifications to include a copy of any information disseminated pursuant to Rule 1002(c) by an SCI broker-dealer to its customers. The Commission would use this information to be aware of potential and actual security threats to SCI entities, including threats that may extend to other market participants in the securities markets, including other SCI entities. As a result of the amendment to the definition of systems intrusions, SCI entities would be required to disseminate information to members and participants pursuant to Rule 1002(c)(2) concerning cybersecurity events not currently covered by the rule. This would have the effect of increasing the number of SCI events that would be required to be disseminated. Further, in connection with expansion of Regulation SCI to SCI broker-dealers, amended Rule 1002(c)(3) would require that SCI broker-dealers promptly disseminate information about major SCI events to all of its customers and, for SCI events that are not major SCI events, to customers that any responsible SCI personnel subsequently reasonably estimates may have been affected by the SCI event. Such information would be used by the SCI entity’s members and participants, and in the case of an SCI broker-dealer, its customers, to understand better the threats faced by the SCI entity, evaluate the event’s impact on their trading or other business with the SCI entity and formulate a response, thereby advance the Commission’s goal of promoting fair and orderly markets and investor protection. The proposed revisions to Rule 1002(c), however, would exclude systems intrusions that are significant attempted unauthorized entries into the SCI systems or indirect SCI systems of an SCI entity from the information dissemination requirements of Rule 1002(c)(1) through (3).449
3. Rule 1003 of Regulation SCI
Rule 1003(a) establishes reporting burdens for all SCI entities. Rule 1003(a)(1) requires each SCI entity to submit to the Commission quarterly reports describing completed, ongoing, and planned material changes to its SCI systems and security of indirect SCI systems during the prior, current, and subsequent calendar quarters, including the dates or expected dates of commencement and completion.450 Under 17 CFR 242.1003(a)(2) (‘‘Rule 1003(a)(2)’’), each SCI entity is required to promptly submit a supplemental report notifying the Commission of a material error in or material omission from a report previously submitted under Rule 1003(a)(1). Rule 1003(b) of Regulation SCI also requires that an SCI entity conduct an ‘‘SCI review’’ not less than once each calendar year.451 ‘‘SCI review’’ is defined in Rule 1000 of Regulation SCI to mean a review, following established procedures and standards, that is performed by objective personnel having appropriate experience to conduct reviews of SCI systems and indirect SCI systems, and which review contains: (1) a risk assessment with respect to such systems of an SCI entity; and (2) an assessment of internal control design and effectiveness of its SCI systems and indirect SCI systems to include logical and physical security controls, development processes, and information technology governance, consistent with industry standards Rule 1003(b)(2) requires each SCI entity to submit a report of the SCI review to senior management no more than 30 calendar days after completion of the review.452 Rule 1003(b) requires that penetration test reviews of the network, firewalls, and production systems shall be conducted at a frequency of not less than once every three years and that assessments of SCI systems directly supporting market regulation or market surveillance shall be conducted at a frequency based upon the risk assessment conducted as part of the SCI review, but in no case less than once every three years.453 Rule 1003(b)(2) requires that the submission of a report of the SCI review to senior management of the SCI entity for review no more than 30 calendar days after completion

454See 17 CFR 242.1003(b)(2).
455See 17 CFR 242.1003(b)(3).
456See 17 CFR 242.1000.
457See id.
458See id.
459See 17 CFR 242.1003(b)(2) and (3). 460See 17 CFR 242.1003(b)(2). 461See 17 CFR 242.1003(b)(3). 462See 17 CFR 242.1003(b)(4). 463See id. of such SCI review.454 Rule 1003(b)(3) requires each SCI entity to submit the report of the SCI review to the Commission and to its board of directors or the equivalent of such board, together with any response by senior management, within 60 calendar days after its submission to senior management.455 The Commission is proposing revisions to Rule 1003(b) and the definition of SCI review. The Commission is proposing to increase the frequency of penetration testing by SCI entities such that they are conducted at least annually, rather than once every three years, and that the penetration tests include any of the vulnerabilities of its SCI systems and indirect SCI systems identified pursuant to Rule 1001(a)(2)(iv).456 The Commission would use this more frequent information to have more up-to-date information regarding an SCI entity’s systems vulnerabilities and help the Commission with its oversight of U.S. securities market technology infrastructure. In addition, the Commission is proposing a number of revisions to the requirements relating to SCI reviews and for the reports SCI entities submit (both to their board of directors as well as to the Commission). The definition of SCI review in Rule 1000 is proposed to contain the substantive requirements for an SCI review, which would be required to be ‘‘a review, following established and documented procedures and standards, that is performed by objective personnel having appropriate experience to conduct reviews of SCI systems and indirect SCI systems . . .’’ 457 The Commission proposes to amend the definition of SCI review in Rule 1000 to require that the SCI review:
(1) use appropriate risk management methodology, (2) include third-party provider management risks and controls, (3) include the risks related to the capacity, integrity, resiliency, availability, and security, and (4) include systems capacity and availability and information technology service continuity within the review of internal control design and operating effectiveness.458 The Commission also proposes to amend Rule 1003(b)(2) to require that the SCI review be conducted in each calendar year during which the entity was an SCI entity for any part of that calendar year and that the SCI entity submit the associated report of the SCI review to the SCI entity’s senior management and board, as well as to the Commission.459 The Commission proposes amend Rule 1003(b)(2) to specify that certain elements be included in the report of the SCI review, namely: (1) the dates the SCI review was conducted and the date of completion; (2) the entity or business unit of the SCI entity performing the review; (3) a list of the controls reviewed and a description of each such control; (4) the findings of the SCI review with respect to each SCI system and indirect SCI system, which shall include, at a minimum, assessments of: the risks related to the capacity, integrity, resiliency, availability, and security; internal control design and operating effectiveness; and an assessment of third-party provider management risks and controls; (5) a summary, including the scope of testing and resulting action plan, of each penetration test review conducted as part of the SCI review; and (6) a description of each deficiency and weakness identified by the SCI review.460 The Commission also proposes to amend Rule 1003(b)(3) to require a response to the report of the SCI review from senior management and to require that the date the report was submitted to senior management be submitted to the Commission and the board of directors, and that the response from senior management include a response for each deficiency and weakness identified by the SCI review, and the associated mitigation and remediation plan and associated dates for each.461 The additional requirements and details are designed to ensure SCI reviews contain certain baseline information and are based on the appropriate risk management methodology. The enhanced SCI review and corresponding report would provide the Commission and its staff greater insight into the SCI entity’s compliance with Regulation SCI and would more thoroughly assist the staff in determining how to follow up with the SCI entity in reviewing and addressing any identified weaknesses and vulnerabilities. The Commission would use this additional reporting and information to improve the Commission’s oversight of the technology infrastructure of SCI entities further.
4. Rule 1004 of Regulation SCI
Rule 1004 of Regulation SCI requires SCI entities to, with respect to an SCI entity’s business continuity and disaster recovery plans, including its backup systems: (a) establish standards for the designation of those members or participants that the SCI entity reasonably determines are, taken as a whole, the minimum necessary for the maintenance of fair and orderly markets in the event of the activation of such plans; (b) designate members or participants pursuant to such standards and require participation by such designated members or participants in scheduled functional and performance testing of the operation of such plans, in the manner and frequency specified by the SCI entity, provided that such frequency shall not be less than once every 12 months; and (c) coordinate the testing of such plans on an industry- or sector-wide basis with other SCI entities.462 The Commission is proposing to include certain third-party providers in the BC/DR testing requirements of Rule
1004. Specifically, an SCI entity would
be required to establish standards for the designation of third-party providers (in addition to members or participants) that it determines are, taken as a whole, the minimum necessary for the maintenance of fair and orderly markets in the event of the activation of the SCI entity’s BC/DR plans. In addition, Rule 1004 would require each SCI entity to designate such third-party providers (in addition to members or participants) pursuant to such standards and require their participation in the scheduled functional and performance testing of the operation of such BC/DR plans.463 The Commission believes that the requirement that SCI entities establish standards that require designated thirdparty providers to participate in the testing of their business continuity and disaster recovery plans will help reduce the risks associated with an SCI entity’s decision to activate its BC/DR plans and help to ensure that such plans operate as intended, if activated. The testing participation requirement should help an SCI entity to ensure that its efforts to develop effective BC/DR plans are not undermined by a lack of participation by third-party providers that the SCI entity believes are necessary to the successful activation of such plans. This requirement should also assist the Commission in maintaining fair and orderly markets in a BC/DR scenario following a wide-scale disruption.

464See 17 CFR 242.1005. Rule 1005(a) of Regulation SCI relates to recordkeeping provisions for SCI SROs, whereas Rule 1005(b) relates to the recordkeeping provision for SCI entities other than SCI SROs. 465See 17 CFR 242.1007. 466See 17 CFR 242.1005(c). 467See id. 468See 17 CFR 242.1003(b)(6). 469 In 2020, the Commission amended Regulation SCI to add as SCI entities SCI competing consolidators, defined as competing consolidators that exceed a five percent consolidated market data gross revenue threshold over a specified time period. See Market Data Infrastructure Adopting Release, supra note 24. The Commission estimated that seven persons would meet the definition of SCI competing consolidator and be subject to Regulation SCI, two of which would be Current SCI Entities (as plan processors) and five of which would be new SCI competing consolidators, if they registered as competing consolidators and exceeded the threshold. See Extension Without Change of a Currently Approved Collection: Regulation SCI and Form SCI; ICR Reference No. 202111–3235–005; OMB Control No. 3235–0703 (Mar. 3, 2022), available at https://www.reginfo.gov/public/do/ PRAViewDocument?ref_nbr=202111-3235-005 (‘‘2022 PRA Supporting Statement’’). Currently, no competing consolidators have registered with the Commission. As a result, no competing consolidators (in addition to the two current plan processors that are Current SCI Entities) are included as Current SCI Entities. To the extent that a competing consolidator registers with the Commission and qualifies as an SCI competing consolidator it would be subject to the same additional burdens as Current SCI Entities as a result of the proposed amendments to Regulation SCI. The additional burdens for Current SCI Entities are set forth in section IV.D. 470Proposed Collection; Comment Request; Extension: Regulation SCI, Form SCI; SEC File No. 270–653, OMB Control No. 3235–0703, 87 FR 3132.
5. Rule 1005 and 1007 of Regulation SCI
Rule 1005 of Regulation SCI requires SCI entities to make, keep, and preserve certain records related to their compliance with Regulation SCI.464 Rule 1007 sets forth requirements for a SCI entity whose Regulation SCI records are prepared or maintained by a service bureau or other recordkeeping service on behalf of the SCI entity.465 Rule 1005(c) specifies that the requirement that records required to be made, kept, and preserved by Rule 1005 be accessible to the Commission and its representatives for the period required by Rule 1005, in cases where an SCI entity ceases to do business or ceases to be registered under the Exchange Act.466 The Commission proposes to add that this survival provision similarly applies to an SCI entity that ‘‘otherwise [ceases] to be an SCI entity.’’ 467 This addition accounts for circumstances not expressly covered; specifically, the circumstance in which an SCI entity continues to do business or remains a registered entity, but may cease to qualify as an SCI entity (e.g., an SCI ATS that no longer satisfies a volume threshold). Such entities would not be excepted from complying with the recordkeeping provisions of Rule 1005. The Commission believes the records of entities that ceased being SCI entities are important for assisting the Commission and its staff in understanding whether such an SCI entity met its obligations under Regulation SCI, assessing whether such an SCI entity had appropriate policies and procedures with respect to its technology systems, helping to identify the causes and consequences of an SCI event, and understanding the types of material systems changes that occurred at such an SCI entity. The Commission expects this revision to facilitate the Commission’s inspections and examinations of SCI entities that have ceased to be SCI entities and assist it in evaluating such SCI entity’s previous compliance with Regulation SCI. Furthermore, having an SCI entity’s records available even after it has ceased to be an SCI entity should provide an additional tool to help the Commission to reconstruct important market events and better understand the impact of such events. There are no amendments to Rule 1007, which sets forth requirements for a SCI entity whose Regulation SCI records are prepared or maintained by a service bureau or other recordkeeping service on behalf of the SCI entity.
6. Rule 1006 of Regulation SCI
Rule 1006 requires each SCI entity, with a few exceptions, to file any notification, review, description, analysis, or report to the Commission required under Regulation SCI electronically on Form SCI.468 There are no amendments to this section. The Commission staff would use the collection of information in its examination and oversight program in identifying patterns and trends across registrants.
C. Respondents
The collection of information requirements contained in Regulation SCI apply to SCI entities. As of 2021, there were an estimated 47 Current SCI Entities (i.e., entities that met the definition of SCI entity) 469 that were subject to the requirements of Regulation SCI.470 The Commission preliminarily estimates that as a result of the proposed amendments to Rule 1000, there would be a total of 23 New SCI Entities (i.e., meet the amended definition of SCI entity) that would become subject to the requirements of Regulation SCI. Thus, the Commission preliminarily estimates that a total of 70 entities would be subject to the requirements of Regulation SCI. The Commission preliminarily believes that the remaining amendments would not add any additional respondents but would result in additional reporting burdens, which are discussed in section IV.D (Total Initial and Annual Reporting Burdens). The following table summarizes the estimated number of Current SCI Entities and New SCI Entities:
Type of SCI entity Number
Current SCI Entities ............................................................................................................................................................................. 47
New SCI Entities:
SBSDR 1 ....................................................................................................................................................................................... 3
SCI broker-dealers 2 ..................................................................................................................................................................... 17
Exempt Clearing Agencies 3 ......................................................................................................................................................... 3
Total New SCI Entities .......................................................................................................................................................... 23
Total SCI Entities .................................................................................................................................................................. 70
1See supra notes 118, 124 and accompanying text. As noted earlier, two SBSDRs are currently registered with the Commission. The Commission estimates for purposes of the PRA that one additional entity may seek to register as an SBSDR in the next three years, and so for purposes of this proposal the Commission has assumed three SBSDR respondents. 2See supra note 219 and accompanying text. 3See supra notes 240 and accompanying text. As noted earlier, the Commission proposes to expand the scope of ‘‘SCI entity’’ to cover two additional exempt clearing agencies that are not subject to ARP, which are Euroclear Bank SA/NV and Clearstream Banking, S.A. The Commission estimates for purposes of the PRA that one additional entity may receive an exemption from registration as a clearing agency in the next three years, and so for purposes of this proposal the Commission has assumed three exempt clearing agency respondents.

471The Commission’s currently approved baseline for average compliance burden per SCI entity to develop and draft the policies and procedures required by Rule 1001(a) (except for 17 CFR 242.1001(a)(2)(vi) (‘‘Rule 1001(a)(2)(vi)’’)) is 534 hours. See Extension Without Change of a Currently Approved Collection: Regulation SCI and Form SCI; ICR Reference No. 202111–3235–005; OMB Control No. 3235–0703 (Mar. 3, 2022), available at https://www.reginfo.gov/public/do/ PRAViewDocument?ref_nbr=202111-3235-005 (‘‘2022 PRA Supporting Statement’’). Rule 1001(a)(2) currently requires six elements (excluding Rule 1001(a)(2)(vi)) to be included in the policies and procedures required by Rule 1001(a)(1). The burden hours for each element would be 89 hours per policy element (534 hours/ 6 policy elements). 472The Commission’s currently approved baseline for average compliance burden per SCI entity to review and update the policies and procedures required by Rule 1001(a) (except for Rule 1001(a)(2)(vi)) is 87 hours. See 2022 PRA Supporting Statement, supra note 471. The burden hours for each element would be 14.5 hours per policy element (87 hours/6 policy elements). 473The Commission estimates that at the additional burden would be the result of the additions to Rule 1001(a)(2), specifically the proposed requirement in the BC/DR plan and the four proposed additional policy elements. The Commission does not anticipate that Current SCI Entities or New SCI Entities would incur any additional burden from the amendment to Rule 1001(a)(4) above and beyond the burden hours estimated for the policies and procedures in this release. 474 89 hours × 4 additional policy elements = 356 hours. The Commission estimates a one-time burden of 30 hours (one-third of 89 hours per policy element) for SCI entities to address the unavailability of third-party providers in their BC/ DR plans. 356 hours + 30 hours = 386 hours. The burden hours include 139 Compliance Manager hours, 139 Attorney hours, 43 Senior System Analyst hours, 43 Operations Specialist hours, 15 Chief Compliance Officer hours, and 7 Director of Compliance hours. 475 534 baseline burden hours + 356 additional burden hours = 890 hours. The burden hours include 320 Compliance Manager hours, 320 Attorney hours, 100 Senior System Analyst hours, 100 Operations Specialist hours, 33 Chief Compliance Officer hours, and 17 Director of Compliance hours. 476 14.5 hours × 4 additional policy elements = 58 hours. The burden hours include 19 Compliance Manager hours, 19 Attorney hours, 5 Senior System Analyst hours, 5 Operations Specialist hours, 7 Chief Compliance Officer hours, and 3 Director of Compliance hours. 477 87 baseline burden hours + 58 additional burden hours = 145 hours. The burden hours include 47 Compliance Manager hours, 47 Attorney hours, 13 Senior System Analyst hours, 13 Operations Specialist hours, 17 Chief Compliance Officer hours, and 8 Director of Compliance hours. 478The Commission recognizes that the some
of the Regulation SCI requirements and certain proposed requirements in the Exchange Act Cybersecurity Proposal rule may appear duplicative. The Commission believes that although the requirements are related, they are ultimately separate obligations. Thus, the Commission has not considered the requirements of the Exchange Act Cybersecurity Proposal rule in formulating its estimates. D. Total Initial and Annual Reporting Burdens As stated above, each requirement to disclose information, offer to provide information, or adopt policies and procedures constitutes a collection of information requirement under the PRA. We discuss below the collection of information burdens associated with the proposed rules and rule amendments.

Rule 1001
The rules under Regulation SCI that would require an SCI entity to establish policies and procedures are discussed more fully in sections II.B, and the proposed amendments are discussed more fully in sections III.A and III.C above. a. Rule 1001(a) Current SCI Entities are already required to establish, maintain, and enforce policies and procedures pursuant to Rule 1001(a) and therefore already incur baseline initial 471 and ongoing burden 472 for complying with Rule 1001(a), so the amendments should only impose a burden required to comply with the additional requirements.473 Presently, none of the New SCI Entities are required to comply with the policies and procedures requirement of Rule 1001(a), but the proposed amendments will newly impose the baseline burden to develop and draft written policies and procedures and review and update annually such policies and procedures, as well as the additional burden to include the proposed requirements in the policies and procedures. The Commission estimates an initial compliance burden of 386 additional hours 474 for Current SCI Entities and 890 hours 475 for New SCI Entities. The Commission estimates an annual compliance burden of 58 hours 476 for Current SCI Entities and 145 hours 477 for New SCI Entities.478 The table below summarizes the initial and ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Burden hours per entity (hours) Estimated burden hours for all entities (estimated respondents × burden hours per entity) Current SCI Entities ........................................................ Initial ................................... 47 386 18,142 Annual ................................ 47 58 2,726 New SCI Entities ............................................................. Initial ................................... 23 890 20,470 Annual ................................ 23 145 3,335 The table below summarizes the Commission’s estimates for the average internal cost of compliance for Current SCI Entities and New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Current SCI Entities .............................................. Initial ............................. 47 1 $144,787 $6,804,989 Annual ........................... 47 2 23,403 1,099,941 New SCI Entities .................................................. Initial ............................. 23 3 333,371 7,667,533

479Current SCI Entities would incur no additional burden as they are already required to include the required standards in their policies and procedures. 480These estimates are consistent with the Commission-approved baseline initial and ongoing average compliance burdens per SCI entity. See 2022 PRA Supporting Statement, supra note 471. The 160 hour initial burden includes 100 Compliance Manager hours, 20 Chief Compliance Officer hours, 10 Director of Compliance hours, and 30 Compliance Attorney hours. The 145 annual burden hours includes 100 Compliance Manager hours, 10 Chief Compliance Officer hours, 5 Director of Compliance hours, and 30 Compliance Attorney hours. Respondent type Burden type Estimated respondents (entities) Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Annual ........................... 23 4 58,315 1,341,245 1 (139 Compliance Manager hours × $344) + (139 Attorney hours × $462) + (43 Senior Systems Analyst hours × $316) + (43 Operations Specialist hours × $152) + (15 Chief Compliance Officer hours × $589) + (7 Director of Compliance hours × $542) = $144,787. The Commission derived this estimate based on per hour figures from SIFMA’s Management & Professional Earnings in the Securities Industry 2013, modified by Commission staff to account for an 1,800-hour work-year and inflation, and multiplied by 5.35 to account for bonuses, firm size, employee benefits, and overhead. 2 (19 Compliance Manager hours × $344) + (19 Attorney hours × $462) + (5 Senior Systems Analyst hours × $316) + (5 Operations Specialist hours × $152) + (7 Chief Compliance Officer hours × $589) + (3 Director of Compliance hours × $542) = $23,403. 3 (320 Compliance Manager hours × $344) + (320 Attorney hours × $462) + (100 Senior Systems Analyst hours × $316) + (100 Operations Specialist hours × $152) + (33 Chief Compliance Officer hours × $589) + (17 Director of Compliance hours × $542) = $333,371. 4 (47 Compliance Manager hours × $344) + (47 Attorney hours × $462) + (13 Senior Systems Analyst hours × $316) + (13 Operations Specialist hours × $152) + (17 Chief Compliance Officer hours × $589) + (8 Director of Compliance hours × $542) = $58,315. The proposed amendments would newly impose a burden on New SCI Entities to comply with Rule 1001(a)(2)(vi), which requires the policies and procedures required by Rule 1001(a) to include standards that result in systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data.479 The Commission estimates that New SCI Entities would incur an initial burden of 160 hours and an ongoing burden of 145 hours to annually review and update the policies and procedures.480 The table below summarizes the initial and ongoing annual burden estimates for New SCI Entities to comply with Rule 1001(a)(2)(vi):
Respondent type Burden type Estimated respondents (entities) Burden hours per entity Estimated burden hours for all entities (estimated respondents × burden hours per entity) New SCI Entities ............................................................. Initial ................................... 23 160 3,680 Annual ................................ 23 145 3,335 The table below summarizes the Commission’s estimates for the average internal cost of compliance for New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) New SCI Entities ..................................................... Initial ............................... 23 1 $60,980 $1,402,540 Annual ............................ 23 2 52,380 1,204,740 1 (100 Senior Systems Analyst hours × $316) + (20 Chief Compliance Officer hours × $589) + (10 Director of Compliance hours × $542) + (30 Compliance Attorney hours × $406) = $60,980. 2 (100 Senior Systems Analyst hours × $316) + (10 Chief Compliance Officer hours × $589) + (5 Director of Compliance hours × $542) + (30 Compliance Attorney hours × $406) = $52,380.

481The Commission’s currently approved baseline for annualized recordkeeping cost per SCI entity to consult outside legal and/or consulting services in the initial preparation policies and procedures required by Rule 1001(a) is $47,000. See 2022 PRA Supporting Statement, supra note 471. Rule 1001(a)(2) currently requires seven elements (including Rule 1001(a)(2)(vi)) to be included in the policies and procedures required by Rule 1001(a)(1). The cost per element would be approximately $6,700 per policy element ($47,000 hours/7 policy elements = $6,714). As noted earlier, the Commission proposes to add four additional elements to the policies and procedures. $6,700 per policy element × 4 additional policy elements = $26,800. The Commission also estimates a one-time burden of approximately $2,250 per SCI entity (onethird of $6,700 per policy element) to address the unavailability of third-party providers in their BC/ DR plans. $26,800 + $2,250 = $29,050. 482 $47,000 + $26,800 = $73,800. 483The Commission estimates that the burden for New SCI Entities is consistent with the Commission’s current approved baselines for the initial and ongoing burdens. For the initial recordkeeping burden, this baseline is 270 hours (40 Compliance Attorney hours + 200 Senior System Analyst hours + 20 Chief Compliance Officer hours + 10 Director of Compliance hours). The Commission estimated separate baselines for the ongoing recordkeeping burden for SCI SROs and entities that were not SROs. Since none of the entities that would potentially be subject to Regulation SCI as a result of the proposed amendments are SROs, the Commission is basing its estimates on the baseline for non-SROs. The Commission’s current approved baseline for the ongoing recordkeeping burden for entities that are not SROs is 95 hours (14 Compliance Attorney hours + 66 Senior System Analyst hours + 10 Chief Compliance Officer hours + 5 Director of Compliance hours). See 2022 PRA Supporting Statement, supra note 471. 484The Commission estimates that the cost for outside legal and/or consulting services for New SCI Entities is consistent with the Commission’s current approved baselines, which is $27,000 per new SCI entity. See 2022 PRA Supporting Statement, supra note 471. $27,000 for the first year × 23 New SCI Entities = 621,000. The Commission estimates that on average, Current SCI Entities would seek outside legal and/or consulting services to initially update their policies and procedures for the proposed additional requirements at a cost of $29,050 per SCI entity,481 while New SCI Entities would seek such services in the initial preparation of the policies and procedures (including the proposed requirements) at a cost of $73,800 per SCI entity.482 Respondent type Estimated respondents (entities) Average external cost per entity Total internal cost of compliance (estimated respondents × average external cost per entity) Current SCI Entities
............................................................................................. 47 $29,050 $1,365,350 New SCI Entities .................................................................................................. 23 73,800 1,697,400 b. Rule 1001(b) New SCI Entities would be required to meet the requirements of Rule 1001(b), which requires each SCI entity to establish, maintain, and enforce systems compliance policies. The Commission estimates a compliance burden of 270 hours initially to design the systems compliance policies and procedures and 95 hours annually to review and update such policies and procedures.483 The
table below summarizes the initial and
ongoing annual burden estimates for New SCI Entities to comply with Rule 1001(b):
Respondent type Burden type Estimated respondents Burden hours per entity Estimated burden hours for all entities (estimated respondents × burden hours per entity) New SCI Entities ..................................................... Initial ............................... 23 270 6,210 Annual ............................ 23 95 2,185 The table below summarizes the Commission’s estimates for the average internal cost of compliance for New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) New SCI Entities ..................................................... Initial ............................... 23 1 $96,640 $2,222,720 Annual ............................ 23 2 35,140 808,220 1 (200 Senior Systems Analyst hours × $316) + (20 Chief Compliance Officer hours × $589) + (10 Director of Compliance hours × $542) + (40 Compliance Attorney hours × $406) = $96,640. 2 (66 Senior Systems Analyst hours × $316) + (10 Chief Compliance Officer hours × $589) + (5 Director of Compliance hours × $542) + (14 Compliance Attorney hours × $406) = $35,140. In establishing, maintaining, and enforcing the policies and procedures required by Rule 1001(b), the Commission believes that each new SCI entity will seek outside legal and/or consulting services in the initial preparation of such policies and procedures. The total annualized cost of seeking outside legal and/or consulting services will be $621,000.484
c. Rule 1001(c)
The proposed amendments would newly impose a burden on New SCI Entities to develop and maintain policies with Rule 1001(c), relating to

485The Commission’s current approved baseline 114 hours for the initial burden to establish the criteria for identifying responsible SCI personnel and the escalation procedures (32 Compliance Manager hours + 32 Attorney hours × $412 + 10 Senior Systems Analyst hours × $282 + 10 Operations Specialist hours × $135 + 20 Chief Compliance Officer hours × $526 + 10 Director of Compliance). The Commission’s approved baseline is 39 hours for the ongoing burden to annually review and update the criteria and the escalation procedures (9.5 Compliance Manager hours + 9.5 Attorney hours + 2.5 Senior Systems Analyst hours

2.5 Operations Specialist hours + 10 Chief
Compliance Officer hours + 5 Director of Compliance hours). See 2022 PRA Supporting Statement, supra note 471. 486See 2022 PRA Supporting Statement, supra note 471. 487The Commission’s estimate includes the amendments to the definition of systems intrusions adding (1) cybersecurity events that disrupt, or significantly degrade, the normal operation of an SCI system and (2) significant attempted unauthorized entries into the SCI systems or indirect SCI systems of an SCI entity. It does not include the systems intrusions that would previously have been classified as de minimis events because Current SCI Entities are already required to take corrective action to resolve such SCI events. 488See 2022 PRA Supporting Statement, supra note 471. 489The Commission’s currently approved baseline for average compliance burden per respondent to develop a process for corrective action is 114 hours (32 Compliance Manager hours
32 Attorney hours + 10 Senior Systems Analyst
hours + 10 Operations Specialist hours + 20 Chief Compliance Officer hours + 10 Director of Compliance hours). See 2022 PRA Supporting Statement, supra note 471. 490The average compliance burden for each SCI entity to review their process is 39 hours (9 Compliance Manager hours + 9 Attorney hours + 3 Senior Systems Analyst hours + 3 Operations Specialist hours + 10 Chief Compliance Officer hours + 5 Director of Compliance hours. See 2022 PRA Supporting Statement, supra note 471. 491The Commission also proposes to remove the option for SCI entities to classify systems intrusions as de minimis and potentially report them pursuant to Rule 1002(b)(5) on the quarterly SCI reports as de minimis events. SCI entities would instead report these systems intrusions pursuant to Rule 1002(b)(1) through (4). The Commission believes that the burden for developing a corrective action plan for these systems intrusions is already incorporated in the baseline burden estimates. See supra notes 489–490. the policies for designation of responsible SCI personnel. The Commission estimates a compliance burden of 114 hours initially to design the systems compliance policies and procedures and 39 hours annually to review and update such policies and procedures.485 The table below summarizes the initial and ongoing annual burden estimates for New SCI Entities to comply with Rule 1001(b):
Respondent type Burden type Estimated respondents Burden hours per entity Estimated burden hours for all entities (estimated respondents × burden hours per entity) New SCI Entities ............................................................. Initial ................................... 23 114 2,622 Annual ................................ 23 39 897 The table below summarizes the Commission’s estimates for the average internal cost of compliance for New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) New SCI Entities ..................................................... Initial ............................... 23 1 $47,672 $1,096,456 Annual ............................ 23 2 17,427 400,821 1 (32 Compliance Manager hours × 344) + (32 Attorney hours × $462) + (10 Senior Systems Analyst hours × $316) + (10 Operations Specialist hours × $152) + (20 Chief Compliance Officer hours × $589) + (10 Director of Compliance hours × $542) = $47,672. 2 (9.5 Compliance Manager hours × $344) + (9.5 Attorney hours × $462) + (2.5 Senior Systems Analyst hours × $316) + (2.5 Operations Specialist hours × $152) + (10 Chief Compliance Officer hours × $589) + (5 Director of Compliance hours × $542) = $17,427. The Commission does not expect SCI entities to incur any external PRA costs in connection with the policies and procedures required under Rule 1001(c).

Rule 1002
The rules under Regulation SCI that would require an SCI entity to take corrective action, provide certain notifications and reports, and disseminate certain information regarding SCI events are discussed more fully in sections II.B, and the proposed amendments are discussed more fully in sections III.A and III.C above. a. Rule 1002(a) As noted above, Rule 1002(a) requires each SCI entity, upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, to begin to take appropriate corrective action. The Commission has previously expressed the view that Rule 1002(a) would likely result in SCI entities developing and revising their processes for corrective action.486 The Commission believes that the requirement to take corrective action for these additional systems intrusions would likely result in SCI entities updating their processes for corrective action.487 The Commission continues to believe that Rule 1002(a) will likely result in SCI entities developing and revising their processes for corrective action as well as review them annually.488 Current SCI Entities are already required to take corrective action pursuant to Rule 1002(a) and therefore already incur the initial 489 and ongoing 490 baseline burdens for developing and revising their corrective action process, so the amendments should only impose a onetime burden required to update the procedures to account for the additional types of systems intrusions.491 The Commission estimates that the one-time burden for each SCI entity to include in its corrective action process the proposed systems intrusions would be 20% of the 114 hours baseline

492 114 hours × 0.20 = 23 hours. The burden hours include 7 Compliance Manager hours, 6 Attorney hours, 2 Senior Systems Analyst hours, 2 Operations Specialist hours, 4 Chief Compliance Officer hours, and 2 Director of Compliance hours. 493 114 baseline burden hours + 23 burden hours for additional systems intrusions = 137 hours. The burden hours include 39 Compliance Manager hours, 38 Attorney hours, 12 Senior Systems Analyst hours, 12 Operations Specialist hours, 24 Chief Compliance Officer hours, and 12 Director of Compliance hours. 494The Commission estimates that the ongoing recordkeeping burden for each New SCI Entity to review its corrective action process would be the same as the baseline ongoing recordkeeping burden of 39 hours. See supra note 490. 495The Commission’s currently approved baseline for the number of SCI events is five events per year that are not de minimis. See 2022 PRA Supporting Statement, supra note 471. The Commission estimates that as a result of the additional systems intrusions that SCI entities would be required to report, the number of SCI events would increase by three events per year that are not de minimis. 496The Commission estimates that each New SCI Entity would experience the baseline burden of five SCI events and three additional SCI events, for a total of eight SCI events that are not de minimis. 497The Commission’s currently approved baseline for the number of notifications submitted by an SCI entity pursuant to Rule 1002(b)(1) is five notifications per year, with one-fourth of the five notifications submitted in writing (i.e., approximately one event per year for each SCI entity), and approximately three-fourths provided orally (i.e., approximately four events per year for each SCI entity). See 2022 PRA Supporting Statement, supra note 471. The Commission estimates that the proposed systems intrusions will result in each SCI entity submitting three additional notifications, one for each of the three estimated additional SCI events. burden.492 Presently, the New SCI Entities are not required to comply with requirement in Rule 1002(a) to take corrective action, but the proposed amendments will newly impose these burdens, including the burden for incorporating the additional systems intrusions into the corrective action process. For Current SCI Entities, the Commission estimates a one-time compliance burden of 23 hours. For New SCI Entities, the Commission estimates an initial burden of 137 hours 493 and an annual compliance burden of 39 hours 494 for New SCI Entities. The table below summarizes the initial and ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type Burden type Estimated respondents Burden hours per SCI entity Burden hours for all respondents (estimated respondents × burden hours per SCI entity) Current SCI Entities ........................................................ One-time Burden ................ 47 23 1,081 New SCI Entities ............................................................. Initial ................................... 23 137 3,151 Ongoing .............................. 39 897 The table below summarizes the Commission’s estimates for the cost of compliance for Current SCI Entities and New SCI Entities:
Respondent type Burden type Estimated respondents Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Current SCI Entities ................................................ One-time Burden ............ 47 1 $9,556 $449,132 New SCI Entities ..................................................... Initial ............................... 23 2 57,228 1,316,244 Ongoing .......................... 3 17,258 396,934 1 (7 Compliance Manager hours × 344) + (6 Attorney hours × $462) + (2 Senior Systems Analyst hours × $316) + (2 Operations Specialist hours × $152) + (4 Chief Compliance Officer hours × $589) + (2 Director of Compliance hours × $542) = $9,556. 2 (39 Compliance Manager hours × 344) + (38 Attorney hours × $462) + (12 Senior Systems Analyst hours × $316) + (12 Operations Specialist hours × $152) + (24 Chief Compliance Officer hours × $589) + (12 Director of Compliance hours × $542) = $57,228. 3 (9 Compliance Manager hours × 344) + (9 Attorney hours × $462) + (3 Senior Systems Analyst hours × $316) + (3 Operations Specialist hours × $152) + (10 Chief Compliance Officer hours × $589) + (5 Director of Compliance hours × $542) = $17,258. The Commission does not expect SCI entities to incur any external PRA costs in connection with the requirement to take corrective actions under Rule 1002(a). b. Rule 1002(b)(1) Through (4) As noted earlier, SCI entities have certain reporting obligations regarding SCI events. Current SCI Entities are already required to submit the notifications, updates, and reports required by Rule 1002(b)(1) through (4) and therefore already incur a baseline burden. As a result of the additional systems intrusions, including the amendments to the definition of systems intrusions and the exclusion of systems intrusions from de minimis SCI events required to be reported to the Commission, Current SCI Entities could potentially incur new burdens pursuant to Rule 1002(b)(1) through (4) reporting additional SCI events for which they currently either do not report or which they currently report quarterly as de minimis. As proposed, New SCI Entities would for the first time be required to provide the submissions required by Rule 1002(b)(1) through (4) and would bear the existing burden for compliance with Rule 1002(b)(1) through (4) and the additional burden to report the proposed systems intrusions. The Commission estimates that on average each Current SCI Entity will experience an additional three SCI events each year that are not de minimis SCI events 495 and New SCI Entities will experience an average of eight SCI events each year that are not de minimis SCI events.496 As a result, pursuant to Rule 1002(b)(1), which requires immediate notification of SCI events, the Commission estimates that each Current SCI Entity will submit, on average, an additional three notifications per year beyond the current baseline,497 and each New SCI Entity
will submit eight

498The Commission estimates that each New SCI Entity will submit both the current baseline of five notifications and the additional three notifications, for a total of eight notifications. See supra note 497 (discussing the 3 additional notifications). 499 8 SCI events ÷ 4 = 2 SCI events reported in writing. The Commission estimates that each Current SCI Entities already reports one SCI event per year in writing. See 2022 PRA Supporting Statement, supra note 471. The Commission therefore estimates that they would report one additional SCI event in writing. New SCI Entities would report two SCI events in writing. 500 3 SCI events¥1 SCI event reported in writing = 2 SCI events reported orally. 501 8 SCI events¥2 SCI events reported in writing = 6 SCI events reported orally. 502The Commission-approved baseline for the burden hours for each notification are 2 hours for written communications (0.5 Compliance Manager hours + 0.5 Attorney hours + 0.5 Senior Systems Analyst hours + 0.5 Senior Business Analyst hours) and 1.5 hours for oral communications (0.25 Compliance Manager hours + 0.25 Attorney hours

0.5 Senior Systems Analyst hours + (0.5 Senior
Business Analyst hours). See 2022 PRA Supporting Statement, supra note 471. The Commission does not believe that reporting the proposed systems intrusions would change the estimated burden hours. 503 1 written notification each year * 2 hours per notification + 2 oral notifications each year * 1.5 hours per notification = 5 hours. 504 2 written notification each year * 2 hours per notification + 6 oral notifications each year * 1.5 hours per notification = 13 hours. 505The Commission-approved baseline for the burden hours for each written notification is 24 hours (5 Compliance Manager hours + 5 Attorney hours + 6 Senior Systems Analyst hours + 1 Assistant General Counsel hour + 1 Chief Compliance Officer hour + 6 Senior Business Analyst hours) for each SCI entity. See 2022 PRA Supporting Statement, supra note 471. 506 3 additional notifications × 24 hours per notification = 72 hours. See supra note 497 (discussing the three additional notifications for each Current SCI Entity). 507 8 notifications × 24 hours per notification = 192 hours. See supra note 498 (discussing the eight notifications for each New SCI Entity). notifications per year.498 These notifications can be made orally or in writing, and the Commission estimates that approximately one-fourth of these notifications will be submitted in writing (i.e., approximately one event per year for each Current SCI Entity and two events per year for each New SCI Entity 499), and approximately threefourths will be provided orally (i.e., approximately two events per year for each Current SCI Entity 500 and six events per year for each New SCI Entity 501). The Commission estimates that each written notification will require two hours and each oral notification will require 1.5 hours.502 The Commission estimates a burden of 5 hours 503 for each Current SCI Entities and 13 hours 504 for New SCI Entities. The table below summarizes the initial and ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Burden hours per SCI entity Burden hours for all respondents (estimated respondents × burden hours per SCI entity) Current SCI Entities ......................................................................................................... 47 5 235 New SCI Entities .............................................................................................................. 23 13 299 The table below summarizes the Commission’s estimates for the average internal cost of compliance associated with the ongoing reporting burden for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Average internal cost of compliance per SCI entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Current SCI Entities ............................................................................................. 47 1 $1,737.50 $81,663 New SCI Entities .................................................................................................. 23 2 4,499 103,477 1The average internal cost of compliance for each Current SCI entity to submit an additional written notification per year is $713.50 (0.5 Compliance Manager hours × $344) + (0.5 Attorney hours × $462) + (0.5 Senior Systems Analyst hours × $316) + (0.5 Senior Business Analyst hours × $305) = $713.50 per written notification. $713.50 × 1 written notification each year = $713.50. (0.25 Compliance Manager hours × $344) + (0.25 Attorney hours × $462) + (0.5 Senior Systems Analyst hours × $316) + (0.5 Senior Business Analyst hours × $305) = $512 per oral notification. $512 × 2 = $1,024. $713.50 + $1,024 = $1,737.50. 2 $713.50 per written notification × 2 written notifications + $512 per written notification × 6 oral notifications = $4,499. The Commission estimates that each notification submitted pursuant to Rule 1002(b)(2) will require 24 hours per SCI entity.505 The Commission estimates an average of 72 hours 506 for each Current SCI Entity and 192 hours 507 for each New SCI Entity to submit the 24 hour written notifications required by Rule 1002(b)(2). The table below summarizes the initial and ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Burden hours per SCI entity Burden hours for all respondents (estimated respondents × burden hours per SCI entity) Current SCI Entities ......................................................................................................... 47 72 3,384 New SCI Entities .............................................................................................................. 23 192 4,416

508The Commission’s currently approved baseline for the number of updates submitted by an SCI entity pursuant to Rule 1002(b)(3) is one written update and one oral update each year, for a total of two updates per a year. See 2022 PRA Supporting Statement, supra note 471. The Commission estimates that as a result of the three additional SCI events resulting from the additional systems intrusions each SCI entity is potentially required to be report, the total number of updates would increase to two written updates and two oral updates each year, for a total of four updates per a year. 509The Commission-approved baseline for the burden hours for each update are 6 hours for the written update (1.5 Compliance Manager hours +
1.5 Attorney hours + 1.5 Senior Systems Analyst
hours + 1.5 Senior Business Analyst hours) and 4.5 hours for the oral update (0.75 Compliance Manager hours + 0.75 Attorney hours + 1.5 Senior Systems Analyst hours + 1.5 Senior Business Analyst hours). See 2022 PRA Supporting Statement, supra note
471. The Commission does not propose to change
the estimated burden hours at this time and notes that the estimated hours for the Senior Systems Analyst and Senior Business Analyst regarding the oral update reflect a correction to a typographical error in the 2022 PRA Supporting Statement. 510 1 written notification × 6 hours per written notification + 1 oral notification × 4.5 hours per oral notification = 10.5 hours. 511 2 written notifications × 6 hours per written notification + 2 oral notifications × 4.5 hours per oral notification = 21 hours. The table below summarizes the Commission’s estimates for the cost of compliance associated with the ongoing reporting burden for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Average internal cost of compliance per SCI entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity Current SCI Entities ............................................................................................. 47 1 $26,589 $1,249,683 New SCI Entities .................................................................................................. 23 2 70,904 1,630,792 1The average internal cost of compliance for each Current SCI entity to submit an additional written notification per year is $8,863 per notification ((5 Compliance Manager hours × $344) + (5 Attorney hours × $462) + (6 Senior Systems Analyst hours × $316) + (1 Assistant General Counsel × $518) + (6 Senior Business Analyst hours × $305) + (1 Chief Compliance Officer hour × $589)). $8,863 per notification × 3 notifications each year = $26,589. 2 $8,863 per notification × 8 notifications each year = $70,904. As for Rule 1002(b)(3), the Commission estimates that, based on past experience, each Current SCI entity will submit 1 additional written update and 1 additional oral update each year and each New SCI Entity will submit 2 written updates (on Form SCI) and 2 oral updates.508 The Commission estimates that each written update will require 6 hours and each oral update will require 4.5 hours.509 The Commission estimates a total burden of
10.5 hours 510 for Current SCI Entities
and 21 hours 511 for New SCI Entities. The table below summarizes the initial and ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Burden hours per SCI entity Burden hours for all respondents (estimated respondents × burden hours per SCI entity) Current SCI Entities ......................................................................................................... 47 10.5 493.5 New SCI Entities .............................................................................................................. 23 21 483 The table below summarizes the Commission’s estimates for the cost of compliance associated with the ongoing reporting burden for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Average internal cost of compliance per SCI entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Current SCI entities ............................................................................................. 47 1 $3,677 $172,819 New SCI Entities .................................................................................................. 23 2 7,354 169,142 1The average internal cost of compliance for each SCI entity to submit an additional written update is $2,141 per notification ((1.5 Compliance Manager hours × $344) + (1.5 Attorney hours × $462) + (1.5 Senior Systems Analyst hours × $316) + (1.5 Senior Business Analyst hours × $305)). The average internal cost of compliance for each SCI entity to submit an additional oral update is $1,536 ((0.75 Compliance Manager hours × $344) + (0.75 Attorney hours × $462) + (1.5 Senior Systems Analyst hours × $316) + (1.5 Senior Business Analyst hours × $305)). $2,141 + $1,536 = $3,677 for each Current SCI Entity to submit two additional updates (one written update and one oral update). 2 $2,141 per written update × 2 written updates per year + $1,536 per oral update × 2 oral updates per year = $7,354 for each New SCI Entity to submit updates in compliance with Rule 1002(b)(3).

512The Commission’s currently approved baseline for the number of reports submitted by an SCI entity pursuant to Rule 1002(b)(4) is five reports per year. See 2022 PRA Supporting Statement, supra note 471. The Commission estimates that as a result of the increase in the estimated number of SCI events from five events to eight events, SCI entities would potentially be required to submit an additional three reports per year. 513As noted earlier, the Commission estimates that New SCI Entities would submit both the baseline estimate of five reports and the additional three reports, for a total of eight reports. 514The Commission’s currently approved baseline for burden hours each SCI entity would incur to comply with Rule 1002(b)(4) for each SCI event would be 35 hours (8 Compliance Manager hours + 8 Attorney hours + 7 Senior Systems Analyst hours + 2 Assistant General Counsel hours

1 General Counsel hour + 2 Chief Compliance
Officer hours + 7 Senior Business Analyst hours). See 2022 PRA Supporting Statement, supra note

The Commission does not propose to change
the estimated burden hours at this time. 515 3 notifications each year × 35 hours per notification = 105 hours. 516 8 notifications each year × 35 hours per notification = 280 hours. 517 (8 Compliance Manager hours × $344) + (8 Attorney hours × $462) + (7 Senior Systems Analyst hours × $316) + (2 Assistant General Counsel hours × $518) + (1 General Counsel hour × $663) + (2 Chief Compliance Officer hours × $589) + (7 Senior Business Analyst hours × $305) = $13,672. 518Systems intrusions, whether de minimis or non-de minimis, would be reported pursuant to Rules 1002(b)(1) through (4), as discussed earlier. See section III.C.3. The burdens for reporting all systems intrusions as non-de minimis events is discussed above. See supra notes 495–517 and accompanying text. 519The Commission’s currently approved baseline for the initial and ongoing reporting burden to comply with the quarterly report requirement is 40 hours. See 2022 PRA Supporting Statement, supra note 471. 40 hours × 10% = 36 hours. This estimate includes 7 hours for a Compliance Manager, 7 hours for an Attorney, 9 hours for a Senior Systems Analyst, 1 hours for an Assistant General Counsel, 9 hours for a Senior Business Analyst, 1 hours for a General Counsel, and 2 hours for a Chief Compliance Officer. 520 40 hours (baseline estimate)¥36 hours (revised estimate) = 4 hours per quarterly report. This estimate includes 0.75 hours for a Compliance Manager, 0.75 hours for an Attorney, 1 hour for a Senior Systems Analyst, 0.2 hours for an Assistant General Counsel, 1 hours for a Senior Business Analyst, 0.1 hours for a General Counsel, and 0.2 hours for a Chief Compliance Officer. 521 4 quarterly submissions per year × 4 hours per submission = 16 hours decrease per SCI entity. 522 4 quarterly submissions per year × 36 hours per submission = 144 hours per SCI entity. As for Rule 1002(b)(4), the Commission estimates that Current SCI Entities will submit an additional 3 reports per year above and beyond the current baseline 512 and New SCI Entities will submit 8 reports per year.513 The Commission estimates that compliance with Rule 1002(b)(4) for a particular SCI event will require 35 hours.514 The Commission estimates that each Current SCI Entity will incur 105 hours 515 and each New SCI Entity will incur 280 hours 516 to meet the requirements of Rule 1002(b)(4). The
table below summarizes the initial and
ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Burden hours per SCI entity Burden hours for all respondents (estimated respondents × burden hours per SCI entity) Current SCI Entities ......................................................................................................... 47 105 4,935 New SCI Entities .............................................................................................................. 23 280 6,440 The Commission estimates that the average internal cost of compliance per notification is $13,672.517 The table below summarizes the Commission’s estimates for the cost of compliance associated with the ongoing reporting burden for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Average internal cost of compliance per SCI entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity Current SCI Entities ............................................................................................. 47 1 $41,016 $1,927,752 New SCI Entities .................................................................................................. 23 2 109,376 2,515,648 1 $13,672 per notification × 3 notifications each year = $41,016. 2 $13,672 per notification × 8 notifications per year = $109,376 average internal cost of compliance for each New SCI Entity.
c. Rule 1002(b)(5)
The Commission estimates that eliminating systems intrusions from the SCI events reported as de minimis events 518 on the quarterly reports reduces the burden for each SCI entity to submit the quarterly report by 10% less compared to the current baseline, or 36 hours.519 Each Current SCI Entity would experience a decrease in its reporting burden of 4 hours per quarterly report,520 for a total decrease of 16 hours per SCI entity.521 As New SCI Entities are not currently required to meet this burden, they would newly incur a burden of 36 hours per report, for a total burden per SCI entity of 144 hours.522 The table below summarizes the initial and ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Number of reports
Hours per report
Burden hours per SCI entity (number of reports × hours per report) Burden hours for all respondents (estimated respondents × burden hours per SCI entity) Current SCI Entities ..................................... 47 4 (4) (16) (752)

523The Commission-approved baseline for the annual reporting cost of seeking outside legal advice is $5,800 per SCI entity. See 2022 PRA Supporting Statement, supra note 471. 524The Commission-approved baseline for the number of reporting requirements required by Rule 1002(b) is 21 requirements for each SCI entity. See 2022 PRA Supporting Statement, supra note 471. The proposed amendments add an additional 11 reporting requirements (3 immediate notifications + 3 24-hour notifications + 2 updates pertaining to an SCI event + 3 interim/final notifications). 21 + 11 = 32 reporting requirements. 525 $5,800 per SCI entity/32 reporting requirements = $181.25 per reporting requirement. 526Current SCI Entities are already required to comply with Rule 1002(c)(1). The burdens for compliance are summarized in the most recent PRA Supporting Statement. See 2022 PRA Supporting Statement, supra note 471. The proposed amendments impose no additional burden related to this section. The Commission does not anticipate that New SCI Entities would incur burdens beyond what is estimated in the 2022 PRA Supporting Statement. Respondent type Estimated respondents (entities) Number of reports Hours per report Burden hours per SCI entity (number of reports × hours per report) Burden hours for all respondents (estimated respondents × burden hours per SCI entity) New SCI Entities .......................................... 23 4 36 144 3,312 The table below summarizes the Commission’s estimates for the average internal cost of compliance associated with the ongoing reporting burden for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Number of reports
Internal cost of compliance per report Average internal cost of compliance per SCI entity (number of reports × internal cost of compliance per report) Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity Current SCI entities ................................. 47 4 1 $(1,513) 2 $(6,052) $(284,444) New SCI entities ...................................... 23 4 3 13,619 4 54,476 1,252,948 1 (0.75 Compliance Manager hours × $344) + (0.75 Attorney hours × $462) + (1 Senior Systems Analyst hours × $316) + (0.2 Assistant General Counsel hours × $518) + (0.1 General Counsel hour × $663) + (0.2 Chief Compliance Officer hours × $589) + (1 Senior Business Analyst hours × $305) = $1,513. 2 $1,513 per notification × 4 notifications each year = $6,052 per Current SCI Entity. 3 (6.75 Compliance Manager hours × $344) + (6.75 Attorney hours × $462) + (9 Senior Systems Analyst hours × $316) + (1.8 Assistant General Counsel hours × $518) + (0.9 General Counsel hour × $663) + (1.8 Chief Compliance Officer hours × $589) + (9 Senior Business Analyst hours × $305) = $13,619. 4 $13,619 per notification × 4 notifications each year = $54,476 per New SCI Entity. The Commission estimates that while SCI entities will handle internally most of the work associated with Rule 1002(b), SCI entities will seek outside legal advice in the preparation of certain Commission notifications. The Commission estimates that the total annual reporting cost of seeing outside legal advice is $5,800 per SCI entity.523 Because Rule 1002(b) will impose approximately 32 reporting requirements 524 per SCI entity per year and each required notification will be require an average of $181.25.525 The total annual reporting costs for Current SCI Entities and New SCI Entities is summarized below:
Rule Type of respondent Number of respondents Number of reporting requirements Cost per reporting requirement Cost per SCI entity (number of reporting requirements × cost per reporting requirement) Total cost burdens (cost per SCI entity × number of respondents) Rule 1002(b)(1) .............................. Current SCI Entities .... 47 3 $181.25 $544 $25,556 New SCI Entities ......... 23 8 181.25 1,450 33,350 Rule 1002(b)(2) .............................. Current SCI Entities .... 47 3 181.25 544 25,556 New SCI Entities ......... 23 8 181.25 1,450 33,350 Rule 1002(b)(3) .............................. Current SCI Entities .... 47 2 181.25 363 17,038 New SCI Entities ......... 23 4 181.25 725 16,675 Rule 1002(b)(4) .............................. Current SCI Entities .... 47 3 181.25 544 25,556 New SCI Entities ......... 23 8 181.25 1,450 33,350 Rule 1002(b)(5) .............................. Current SCI Entities .... 47 0 181.25 0 0 New SCI Entities ......... 23 4 181.25 725 16,675 d. Rule 1002(c) The Commission anticipates that the proposed amendment will newly impose the information dissemination requirements of Rule 1002(c)(1) on New SCI Entities, and New SCI Entities will incur the same burdens that Current SCI Entities already incur to comply with these requirements.526 The table below summarizes the burden that would be newly imposed on New SCI Entities:

527The Commission’s currently approved baseline for the number of each SCI entity’s information disseminations per year under Rule 1002(c)(2) is that each SCI entity will disseminate information about one systems intrusion each year. See 2022 PRA Supporting Statement, supra note
471. As discussed above, the Commission estimates
an additional three SCI events (i.e., three additional systems intrusions) as a result of the additional types of systems intrusions added to the definition systems intrusions in Rule 1000 and the elimination of systems intrusions from the de minimis SCI events reported quarterly in Rule 1002(b)(5). The Commission estimates that each SCI entity would disseminate information related to four systems intrusions each year. Each Current SCI Entity would disseminate information for three systems intrusions beyond the baseline estimate of one systems intrusion. As New SCI Entities will newly incur this burden, and as a result will report four systems intrusions. 528The Commission’s currently approved baseline is that each dissemination under Rule 1002(c)(2) will require 10 hours. See 2022 PRA Supporting Statement, supra note 471. 529 (1.5 Compliance Manager hours × $344) + (3.67 Attorney hours × $462) + (1.5 Senior Systems Analyst hours × $316) + (0.75 General Counsel hour × $633) + (0.75 Director of Compliance hours × $542) + (0.75 Chief Compliance Officer hours × $589) + (0.75 Corporate Communications Manager hours × $378) + (0.33 Webmasters hours × $276) = $4,406 per notification. Rule Respondent type Estimated respondents Number of dissemination Hours per dissemination Burden hours per SCI Entity (number of reports × hours per report) Burden hours for all respondents (estimated respondents × burden hours per SCI entity) Rule 1002(c)(1)(i) .............................. New SCI Entities ........... 23 3 information disseminations 1. 2 7 21 483 Rule 1002(c)(1)(ii) and (iii) ................ 9 updates 3 ............. 4 13 117 2,691 1The Commission’s currently approved baseline for the number of each SCI entity’s information disseminations per year under Rule 1002(c)(1)(i) is three information disseminations. See 2022 PRA Supporting Statement, supra note 471. 2The Commission’s currently approved baseline is that each information dissemination under Rule 1002(c)(1)(i) would require 7 hours. This includes 1 Compliance Manager hour, 2.67 Attorney hours, 1 Senior System Analyst hour, 0.5 General Counsel hours, 0.5 Director of Compliance hours, 0.5 Chief Compliance Officer hours,
0.5 Corporate Communications Manager hours, and 0.33 Webmasters hours. See 2022 PRA Supporting Statement, supra note 471. 3The Commission’s currently approved baseline for Rule 1002(c)(1)(ii) and (iii) is that each SCI entity will disseminate three updates for each SCI event. 3 updates
per SCI Event × 3 SCI events = 9 updates each year. 4The Commission’s currently approved baseline is that each information dissemination under Rule 1002(c)(1)(ii) and (iii) would require 13 hours. This includes 2 Compliance Manager hours, 4.67 Attorney hours, 2 Senior System Analyst hour, 1 General Counsel hours, 1 Director of Compliance hours, 1 Chief Compliance Officer hours, 1 Corporate Communications Manager hours, and 0.33 Webmasters hours. See 2022 PRA Supporting Statement, supra note 471, at 25–26. The table below summarizes the Commission’s estimates for the average internal cost of compliance associated with the ongoing reporting burden for Current SCI Entities and New SCI Entities:
Rule Respondent type
Estimated respondents
(entities)
Average internal cost of compliance per SCI entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Rule 1002(c)(1)(i) ................................ New SCI Entities ................................ 23 1 $9,212 $211,876 Rule 1002(c)(1)(ii) and (iii) .................. 2 51,666 1,188,318 1 (1 Compliance Manager hours × $344) + (2.67 Attorney hours × $462) + (1 Senior Systems Analyst hours × $316) + (0.5 General Counsel hour × $663) + (0.5 Chief Compliance Officer hours × $589) + (0.5 Director of Compliance hours × $542) + (0.5 Corporate Communications Manager hours × $378) + (0.33 Webmaster hours × $276) = $3,071. $3,071 per notification × 3 notifications each year = $9,212. 2 (2 Compliance Manager hours × $344) + (4.67 Attorney hours × $462) + (2 Senior Systems Analyst hours × $316) + (1 General Counsel hour × $663) + (1 Chief Compliance Officer hours × $589) + (1 Director of Compliance hours × $542) + (1 Corporate Communications Manager hours × $378) + (0.33 Webmaster hours × $276) = $5,741. $5,741 per notification × 9 notifications each year = $51,666. With respect to the Rule 1002(c)(2) requirement to disseminate information regarding systems intrusions, the Commission estimates that each Current SCI Entity will disseminate information regarding 3 systems intrusions each year and each New SCI Entity will disseminate information regarding 4 systems intrusions each year.527 The Commission estimates that each dissemination under Rule 1002(c)(2) will require 10 hours.528 The table below summarizes the initial and ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Burden hours per SCI entity Burden hours for all respondents (estimated respondents × burden hours per SCI entity) Current SCI Entities ......................................................................................................... 47 1 30 1,410 New SCI Entities .............................................................................................................. 23 2 40 920 1 3 information disseminations × 10 hours per dissemination = 30 hours. 2 4 information disseminations × 10 hours per dissemination = 40 hours. The Commission estimates that the average internal cost of compliance per notification is $4,406.529 The table below summarizes the Commission’s estimates for the cost of compliance associated with the ongoing reporting burden for Current SCI Entities and New SCI Entities:

530The Commission-approved baseline for the annual reporting cost of seeking outside legal advice is $3,320 per SCI entity. See 2022 PRA Supporting Statement, supra note 471. 531The Commission-approved baseline for the number of disclosure requirements required by Rule 1002(c) is 13 requirements for each SCI entity. See 2022 PRA Supporting Statement, supra note 471. The proposed amendments add an additional 3 reporting requirements (3 additional information disseminations related to 3 additional systems intrusions). 13 + 3 = 16 disclosure requirements. 532 $3,320 per SCI entity/16 reporting requirements = $207.50 per reporting requirement. 533Current SCI Entities are already required to comply with Rule 1003(a). The burdens for compliance are summarized in the most recent PRA Supporting Statement. See 2022 PRA Supporting Statement, supra note 471. The proposed amendments impose no additional burden related to this section. 534These estimates reflect the Commissionapproved baseline. See 2022 PRA Supporting Statement, supra note 471. The Commission does not anticipate that New SCI Entities would incur burdens beyond what is estimated in the 2022 PRA Supporting Statement. Respondent type Estimated respondents (entities) Average internal cost of compliance per SCI entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Current SCI Entities ............................................................................................. 47 1 $13,218 $621,246 New SCI Entities .................................................................................................. 23 2 17,624 405,352 1 $4,406 per notification × 3 information disseminations each year = $13,218. 2 $4,406 per notification × 4 information disseminations per year = $17,624. The Commission believes SCI entities will seek outside legal advice in the preparation of the information dissemination under Rule 1002(c). The Commission estimates that the total annual reporting cost of seeing outside legal advice is $3,320 per SCI entity.530 Because Rule 1002(c) will impose approximately 16 third-party disclosure requirements 531 per SCI entity per year and each required disclosure will be require an average of $207.50.532 The total annual reporting costs for Current SCI Entities and New SCI Entities are summarized below:
Rule Respondent type Number of respondents Number of disclosures Cost per disclosure Cost per SCI entity (number of disclosures × cost per disclosure) Total cost burdens (cost per SCI entity × number of respondents) Rule 1002(c)(1)(i) ....................................... New SCI Entities ..... 23 3 $207.50 $622.50 $14,317.50 Rule 1002(c)(1)(ii) and (iii) ......................... New SCI Entities ..... 23 9 207.50 1,867.50 42,952.50 Rule 1002(c)(2) .......................................... Current SCI Entities 47 3 207.50 622.50 29,257.50 New SCI Entities ..... 23 4 207.50 830 19,090 As noted above, Regulation SCI requires SCI entities to identify certain types of events and systems. The Commission believes that the identification of critical SCI systems, major SCI events, and de minimis SCI events will impose an initial one-time implementation burden on new SCI entities in developing processes to quickly and correctly identify the nature of a system or event. The identification of these systems and events may also impose periodic burdens on SCI entities in reviewing and updating the processes. The Commission anticipates that the because the proposed amendment will newly impose the requirements of Rule 1002(b) on New SCI Entities, New SCI Entities will incur the burden to develop processes to comply with these requirements.533 The Commission estimates that each New SCI entity will initially require 198 hours to establish criteria for identifying material systems changes and 39 hours to annually to review and update the criteria.534 The table below summarizes the burden that would be newly imposed on New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Burden hours per entity Estimated burden hours for all entities (estimated respondents × burden hours per entity) New SCI Entities ............................................................. Initial ................................... 23 198 4,554 Annual ................................ 23 39 897 The table below summarizes the Commission’s estimates for the average internal cost of compliance for New SCI Entities:

535This estimate is based on the Commission’s burden estimate for Rule 1001(a), because Rule 1001(a) requires policies and procedures. See supra notes 474–475 and accompanying text. Rule 1001(a) (excluding Rule 1001(a)(2)(vi)) requires a total of ten policy elements at a minimum, consisting of six currently required policy elements and four proposed policy elements. See supra notes 471 and
474. Because the proposed amendment to the
definition of systems intrusion in Rule 1000 requires only one set of written criteria, the Commission estimates that the initial staff burden to draft the criteria required to identify significant attempted unauthorized systems intrusions is onetenth of the initial staff burden to draft the policies and procedures required by Rule 1001(a) (excluding Rule 1001(a)(2)(vi)). 890 hours/10 policy elements = 89 burden hours per policy element. The 89 burden hours includes 25 hours for a Compliance Manager, 25 hours for an Attorney, 8 hours for a Senior Systems Analyst, and 8 hours for an Operations Specialist. The Commission also estimates that a Chief Compliance Officer will spend 15 hours and a Director of Compliance and a Director of Compliance will spend 8 hours reviewing the policies and procedures. 536This estimate is based on the Commission’s burden estimate for Rule 1001(a), because Rule 1001(a) requires policies and procedures. See supra notes 475–476 and accompanying text. Rule 1001(a) (excluding Rule 1001(a)(2)(vi)) requires a total of ten policy elements at a minimum, consisting of six currently required policy elements and four proposed policy elements. See supra notes 472 and
475. Because the proposed amendment to the
definition of systems intrusion in Rule 1000 requires only one set of written criteria, the Commission estimates that the ongoing staff burden to review and update the criteria required to identify significant attempted unauthorized systems intrusions is one-tenth of the ongoing staff burden to review and update the policies and procedures required by Rule 1001(a) (excluding Rule 1001(a)(2)(vi)). 145 hours/10 policy elements = 14.5 burden hours per policy element. The 14.5 burden hours includes 2 hours for a Compliance Manager, 2 hours for an Attorney, 1 hours for a Senior Systems Analyst, and 1 hours for an Operations Specialist. The Commission also estimates that a Chief Compliance Officer will spend 5.5 hours and a Director of Compliance and a Director of Compliance will spend 3 hours reviewing the policies and procedures. Respondent type Burden type Estimated respondents (entities) Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) New SCI Entities ..................................................... Initial ............................... 23 1 $78,144 $1,797,312 Annual ............................ 23 2 17,258 396,934 1 (64 Compliance Manager hours × $344) + (64 Attorney hours × $462) + (20 Senior Systems Analyst hours × $316) + (20 Operations Specialist hours × $152) + (20 Chief Compliance Officer hours × $589) + (10 Director of Compliance hours × $542) = $78,144. 2 (9 Compliance Manager hours × $344) + (9 Attorney hours × $462) + (3 Senior Systems Analyst hours × $316) + (3 Operations Specialist hours × $152) + (10 Chief Compliance Officer hours × $589) + (5 Director of Compliance hours × $542) = $17,258. As discussed above in section III.C.3.c, the proposed amendments to the definition of systems intrusion would require SCI entities to establish reasonable written criteria to identify significant attempted unauthorized entries into the SCI systems or indirect SCI systems of an SCI entity. As this is a new burden for both Current SCI Entities and New SCI Entities, the Commission estimates an average burden across all SCI entities of 89 hours 535 initially to establish the criteria for identifying material systems changes and 14.5 hours 536 annually to review and update the criteria. The table below summarizes the initial and ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Burden hours per entity Estimated burden hours for all entities (estimated respondents × burden hours per entity) Current SCI Entities ........................................................ Initial ................................... 47 89 4,183 Annual ................................ 47 14.5 681.5 New SCI Entities ............................................................. Initial ................................... 23 89 2,047 ..................................................................................... Annual ................................ 23 14.5 333.5 The table below summarizes the Commission’s estimates for the average internal cost of compliance for New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Current SCI Entities ................................................ Initial ............................... 47 1 $37,065 $1,742,055 Annual ............................ 47 2 6,946 326,462 New SCI Entities ..................................................... Initial ............................... 23 3 37,065 852,495 Annual ............................ 23 4 6,946 159,758 1 (25 Compliance Manager hours × $344) + (25 Attorney hours × $462) + (8 Senior Systems Analyst hours × $316) + (8 Operations Specialist hours × $152) + (15 Chief Compliance Officer hours × $589) + (8 Director of Compliance hours × $542) = $37,065. 2 (2 Compliance Manager hours × $344) + (2 Attorney hours × $462) + (1 Senior Systems Analyst hours × $316) + (1 Operations Specialist hours × $152) + (5.5 Chief Compliance Officer hours × $589) + (3 Director of Compliance hours × $542) = $6,946. 3See supra note 1 of this table. 4See supra note 2 of this table.

537Current SCI Entities are already required to comply with Rule 1003(a). The burdens for compliance are summarized in the most recent PRA Supporting Statement. See 2022 PRA Supporting Statement, supra note 471. The proposed amendments impose no additional burden related to this section. The Commission does not anticipate that New SCI Entities would incur burdens beyond what is estimated in the 2022 PRA Supporting Statement. 538Current SCI Entities are already required to comply with Rule 1003(a). The burdens for compliance are summarized in the most recent PRA Supporting Statement. See 2022 PRA Supporting Statement, supra note 471. The proposed amendments impose no additional burden related to this section. 539These estimates reflect the Commissionapproved baseline. See 2022 PRA Supporting Statement, supra note 471. The Commission does not anticipate that New SCI Entities would incur burdens beyond what is estimated in the 2022 PRA Supporting Statement.
3. Rule 1003
The Commission anticipates that the proposed amendment will newly impose the Rule 1003(a) requirements to report material system changes on New SCI Entities, and New SCI Entities will incur the same burdens that Current SCI Entities already incur to comply with these requirements.537 The table below summarizes the burden that would be newly imposed on New SCI Entities:
Rule Respondent type
Estimated respondents
(entities)
Number of reports Hours per report Burden hours per SCI entity (number of reports × hours per report) Burden hours for all respondents (estimated respondents × burden hours per SCI entity) Rule 1003(a)(1) ................................. New SCI Entities ........... 23 4 reports (1 per quarter). 1 125 500 11,500 Rule 1003(a)(2) ................................. 2 1 supplemental report. 3 15 15 345 1The Commission’s currently approved baseline is that each quarterly report under Rule 1003(a)(1) would require 125 hours. This includes 7.5 Compliance Manager hours, 7.5 Attorney hours, 5 Chief Compliance Officer hours, 75 Senior System Analyst hours, and 30 Senior Business Analyst hours. See 2022 PRA Supporting Statement, supra note 471. 2The Commission’s currently approved baseline for Rules 1002(c)(1)(ii) and (iii) is that each SCI entity will submit one supplemental report each year. See 2022 PRA Supporting Statement, supra note 471. 3The Commission’s currently approved baseline is that the supplemental report under Rule 1003(a)(1) would require 15 hours. This includes 2 Compliance Manager hours, 2 Attorney hours, 1 Chief Compliance Officer hours, 7 Senior System Analyst hours, and 3 Senior Business Analyst hours. See 2022 PRA Supporting Statement, supra note 471. The table below summarizes the average internal cost of compliance that would be newly imposed on New SCI Entities:
Rule Respondent type
Estimated respondents
(entities)
Number of reports
Cost of compliance per report Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Rule 1003(a)(1) ............................. New SCI Entities ........ 23 4 reports (1 per quarter). 1 $41,480 2 $167,360 $3,849,280 Rule 1003(a)(2) ............................. 1 supplemental report. 3 5,328 5,328 122,544 1 (7.5 Compliance Manager hours × $344) + (7.5 Attorney hours × $462) + (5 Chief Compliance Officer hours × $589) + (75 Senior Systems Analyst hours × $316)

(30 Senior Business Analyst hours × $305) = $41,840. 2 $41,480 per report × 4 reports each year = $167,360. 3 (2 Compliance Manager hours × $344) + (2 Attorney hours × $462) + (1 Chief Compliance Officer hours × $589) + (7 Senior Systems Analyst hours × $316) + (3
Senior Business Analyst hours × $305) = $5,328. Rule 1003(a)(1) requires each SCI entity to establish reasonable written criteria for identifying a change to its SCI systems and the security of indirect SCI systems as material. The Commission anticipates that the proposed amendment will newly impose these requirements on New SCI Entities, and New SCI Entities will incur the same burdens that Current SCI Entities already incur to comply with these requirements.538 The Commission estimates that each New SCI entity will initially require 114 hours to establish criteria for identifying material systems changes and 27 hours to annually to review and update the criteria.539 The
table below summarizes the burden that
would be newly imposed on New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Burden hours per entity Estimated burden hours for all entities (estimated respondents × burden hours per entity) New SCI Entities ............................................................. Initial ................................... 23 114 2,622 Annual ................................ 23 27 621 The table below summarizes the Commission’s estimates for the cost of compliance for New SCI Entities:

540The Commission’s currently approved baseline for the annual recordkeeping burden of conducting an SCI review and submitting the SCI review to senior management of the SCI entity for review is 690 hours (35 Compliance Manager hours

80 Attorney hours + 375 Senior Systems Analyst
hours + 5 General Counsel hours + 5 Director of Compliance hours + 20 Chief Compliance Officer hours +170 Internal Audit Manager hours). See 2022 PRA Supporting Statement, supra note 471. 541 690 hours (baseline burden) × 0.5 = 345 hours. This estimate includes 17.5 hours for a Compliance Manager, 40 hours for an Attorney, 187.5 hours for a Senior Systems Analyst, 2.5 hours for General Counsel, 10 hours for a Chief Compliance Officer,
2.5 hours for a Director of Compliance, and 85
hours for an Internal Audit Manager.
542 690 baseline burden hours + 345 additional burden hours = 1,035 hours. This estimate includes
52.5 hours for a Compliance Manager, 120 hours for
an Attorney, 562.5 hours for a Senior Systems Analyst, 7.5 hours for General Counsel, 30 hours for a Chief Compliance Officer, 7.5 hours for a Director of Compliance, and 255 hours for an Internal Audit Manager. 543The Commission’s currently approved baseline to submit the report for the SCI review to the board of directors is 1 hour (1 Attorney hour). See 2022 PRA Supporting Statement, supra note

The Commission estimates an increase to 25
hours as a result of the proposed requirement that senior management provide a response to the SCI review. Respondent type Estimated respondents (entities) Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) New SCI Entities .................................................................................................. 23 1 $47,672 $1,096,456 2 12,929 297,367 1 (32 Compliance Manager hours × $344) + (32 Attorney hours × $462) + (10 Senior Systems Analyst hours × $316) + (10 Operations Specialist hours × $152) + (20 Chief Compliance Officer hours × $589) + (10 Director of Compliance hours × $542) = $47,672. 2 (4.5 Compliance Manager hours × $344) + (4.5 Attorney hours × $462) + (1.5 Senior Systems Analyst hours × $316) + (1.5 Operations Specialist hours × $152) + (10 Chief Compliance Officer hours × $589) + (5 Director of Compliance hours × $542) = $12,929. The Commission does not expect SCI entities to incur any external PRA costs in connection with the reports required under Rule 1003(a). As for Rule 1003(b), each Current SCI Entity is already required to perform an SCI review and therefore already incurs a baseline burden 540 for compliance, so the amendments should only impose a burden required to comply with the additional requirements. Presently, none of the New SCI Entities are required to comply with the requirements of Rule 1003(b), but the proposed amendments will newly impose both the baseline burden to conduct the SCI review and the additional burden to meet the proposed requirements for the SCI review. The Commission estimates that the proposed additional requirements for conducting the SCI review will increase the burden of conducting the SCI review and submitting the report by 50%. With respect to Rule 1003(b)(1) and (2), the Commission estimates an additional burden for Current SCI Entities of 345 hours 541 and 1,035 hours 542 for New SCI Entities. The table below summarizes the initial and ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type Estimated respondents Burden hours per entity Estimated burden hours for all entities (estimated respondents × burden hours per entity) Current SCI Entities ......................................................................................................... 47 345 16,215 New SCI Entities .............................................................................................................. 23 1,035 23,805 The table below summarizes the Commission’s estimates for the average internal cost of compliance for Current SCI Entities and New SCI Entities:
Respondent type Estimated respondents Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity Current SCI Entities ............................................................................................. 47 1 $123,848 $5,820,856 New SCI Entities .................................................................................................. 23 2 371,543 $8,545,489 1 (17.5 Compliance Manager hours × $344) + (40 Attorney hours × $462) + (187.5 Senior Systems Analyst hours × $316) + (2.5 General Counsel hours × $663) + (2.5 Director of Compliance hours × $542) + (10 Chief Compliance Officer hours × $589) + (85 Internal Audit Manager hours × $367) = $123,848. 2 (52.5 Compliance Manager hours × $344) + (120 Attorney hours × $462) + (562.5 Senior Systems Analyst hours × $316) + (7.5 General Counsel hours × $663) + (7.5 Director of Compliance hours × $542) + (30 Chief Compliance Officer hours × $589) + (255 Internal Audit Manager hours × $367) = $371,543. With respect to Rule 1003(b)(3), the Commission estimates that the burden for SCI entities would increase to 25 hours from the current baseline estimate.543 Thus, the Commission estimates an additional burden for

544 25 hours (revised estimate) ¥ 1 hour (baseline estimate) = 24 hours. This estimate includes 1 hours for a Compliance Manager, 3 hours for an Attorney, 13 hours for a Senior Systems Analyst, 1 hours for a Chief Compliance Officer, and 6 hours for an Internal Audit Manager. 545This estimate includes 1 hours for a Compliance Manager, 3 hours for an Attorney, 14 hours for a Senior Systems Analyst, 1 hours for a Chief Compliance Officer, and 6 hours for an Internal Audit Manager. 546The Commission-approved baseline for the annual recordkeeping cost per SCI entity of outsourcing is $50,000. See 2022 PRA Supporting Statement, supra note 471. 547The Commission’s currently approved baseline for average initial compliance burden per respondent with 17 CFR 242.1004(a) (‘‘Rule 1004(a)’’) (i.e., establishment of standards for the designation of members and participants) and (c) (i.e., the coordination of testing on an industry- or sector-wide basis) is 360 hours (40 Compliance Manager hours + 60 Attorney hours + 20 Assistant General Counsel hours + 60 Senior Operations Manager hours + 140 Operations Specialist hours + 26 Chief Compliance Officer hours + 14 Director of Compliance hours). See 2022 PRA Supporting Statement, supra note 471. The estimate of 360 hours includes the burden for designating members or participants for testing, as required by 17 CFR 242.1004(b) (‘‘Rule 1004(b)’’). Id. at 18 n.50. 548The average annual compliance burden for each SCI entity to review and update the policies and procedures is 135 hours for each entity that is not a plan processor. See 2022 PRA Supporting Statement, supra note 471. None of the New SCI Entities are plan processors, so the Commission is applying the 135 hour estimate to the New SCI Entities. Current SCI Entities of 24 hours 544 and a new burden of 25 hours 545 for New SCI Entities. The table below summarizes the initial and ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Burden hours per entity
Estimated burden hours for all entities (estimated respondents × burden hours per entity) Current SCI Entities ......................................................................................................... 47 24 1,128 New SCI Entities .............................................................................................................. 23 25 575 The table below summarizes the Commission’s estimates for the average internal cost of compliance for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Current SCI Entities ............................................................................................. 47 1 $8,629 $405,563 New SCI Entities .................................................................................................. 23 2 8,945 205,735 1 (1 Compliance Manager hours × $344) + (3 Attorney hours × $462) + (13 Senior Systems Analyst hours × $316) + (1 Chief Compliance Officer hours × $589) + (6 Internal Audit Manager hours × $367) = $8,629. 2 (1 Compliance Manager hours × $344) + (3 Attorney hours × $462) + (14 Senior Systems Analyst hours × $316) + (1 Chief Compliance Officer hours × $589) + (6 Internal Audit Manager hours × $367) = $8,945. Rule 1003(b) imposes recordkeeping costs for SCI entities. The Commission estimates that while SCI entities will handle internally some or most of the work associated with compliance with Rule 1003(b), SCI entities will outsource some of the work associated with an SCI review. The Commission estimates that the proposed amendments to the SCI review would increase the annual recordkeeping cost by 50% beyond the current baseline.546 The table below summarizes the Commission’s estimates for the cost of outsourcing for Current SCI Entities and New SCI Entities:
Respondent type
Estimated respondents
(entities)
Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Current SCI Entities ............................................................................................. 47 1 $25,000 $1,175,000 New SCI Entities .................................................................................................. 23 2 75,000 1,725,000 1 50,000 (baseline estimate) × 0.5 = $25,000. 2 50,000 (baseline estimate) × 1.5 = $75,000.
4. Rule 1004
The rules under Regulation SCI that would require an SCI entity to mandate member or participant participation in business continuity and disaster recovery plan testing are discussed more fully in sections II.B, and the proposed amendments including third-party providers in the requirement are discussed more fully in III.C.2 above. Current SCI Entities are already required to establish standards and designate members or participants for testing pursuant to Rule 1004 and therefore already incur baseline initial 547 and ongoing burdens 548 for complying with Rule 1004, so the amendments should only impose a burden required to comply with the additional requirements. Presently, none of the New SCI Entities are required to comply with the requirements of Rule 1004, but the proposed amendments will newly

549The Commission estimates that the additional burden to establish standards for the designation of third-party providers for BC/DR testing and coordinate testing would be 25% of the 360 hour baseline burden hours. 360 hours × 0.25 = 90 hours. The burden hours include 10 Compliance Manager hours, 15 Attorney hours, 5 Assistant General Counsel hours, 35 Operations Specialist hours, 6 Chief Compliance Officer hours, 4 Director of Compliance hours, and 15 Senior Operations Manager hours. 550 360 baseline burden hours + 90 additional burden hours = 450 hours. 551The Commission estimates that the additional annual burden would be 25% of the 135 hour baseline burden hours, or 34 hours (135 hours × 0.25). The burden hours include 3 Compliance Manager hours, 3 Attorney hours, 1 Assistant General Counsel hours, 18 Operations Specialist hours, 3 Chief Compliance Officer hours, 1 Director of Compliance hours, and 5 Senior Operations Manager hours. 552 135 baseline burden hours + 34 additional burden hours = 169 hours. 553Current SCI Entities are already required to comply with Rules 1005 and 1007. The burdens for compliance are summarized in the most recent PRA Supporting Statement. See 2022 PRA Supporting Statement, supra note 471. The proposed amendments impose no additional burden related to this section. The Commission does not anticipate that New SCI Entities would incur burdens beyond what is estimated in the 2022 PRA Supporting Statement. impose both the baseline burden to establish standards for the designation of members and participants for BC/DR testing and coordinate industry or sector-wide basis testing and additional burden to establish standards for the designation of third-party providers for BC/DR testing and coordinate industry or sector-wide basis testing for thirdparty providers. The Commission estimates an initial compliance burden of 90 hours 549 for Current SCI Entities and 450 hours 550 for New SCI Entities. The Commission estimates an annual compliance burden of 34 hours 551 for Current SCI Entities and 169 hours 552 for New SCI Entities. The table below summarizes the initial and ongoing annual burden estimates for Current SCI Entities and New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Burden hours per entity Estimated burden hours for all entities (estimated respondents × burden hours per entity) Current SCI Entities ........................................................ Initial ................................... 47 90 4,230 Annual ................................ 47 34 1,598 New SCI Entities ............................................................. Initial ................................... 23 450 10,350 Annual ................................ 23 169 3,887 The table below summarizes the Commission’s estimates for the cost of compliance for Current SCI Entities and New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) Current SCI Entities ................................................ Initial ............................... 47 1 $30,072 $1,413,384 Annual ............................ 47 2 10,011 470,517 New SCI Entities ..................................................... Initial ............................... 23 3 150,478 3,460,994 Annual ............................ 23 4 50,331 1,157,613 1 (10 Compliance Manager hours × $344) + (15 Attorney hours × $462) + (5 Assistant General Counsel hours × $518) + (35 Operations Specialist hours × $152) + (6 Chief Compliance Officer hours × $589) + (4 Director of Compliance hours × $542) + (15 Senior Operations Manager hours × $406) = $30,072. 2 (3 Compliance Manager hours × $344) + (3 Attorney hours × $462) + (1 Assistant General Counsel hours × $518) + (18 Operations Specialist hours × $152) + (3 Chief Compliance Officer hours × $589) + (1 Director of Compliance hours × $542) + (5 Senior Operations Manager hours × $406) = $10,011. 3 (50 Compliance Manager hours × $344) + (75 Attorney hours × $462) + (25 Assistant General Counsel hours × $518) + (175 Operations Specialist hours × $152) + (32.5 Chief Compliance Officer hours × $589) + (17.5 Director of Compliance hours × $542) + (75 Senior Operations Manager hours × $406) = $150,478. 4 (13 Compliance Manager hours × $344) + (18 Attorney hours × $462) + (6 Assistant General Counsel hours × $518) + (88 Operations Specialist hours × $152) + (13 Chief Compliance Officer hours × $589) + (6 Director of Compliance hours × $542) + (25 Senior Operations Manager hours × $406) = $50,331. The Commission continues to believe that SCI entities (other than plan processors) would handle internally the work associated with the requirements of Rule 1004.
5. Rule 1005
Rules 1005 and 1007 impose on SCI entities recordkeeping requirements related to their compliance with Regulation SCI. These requirements would be newly imposed on New SCI Entities as a result of the proposed amendment. The table below summarizes the Commission’s estimates as to the burden that each New SCI Entity would incur to meet the requirements of Rules 1005 and 1007: 553

554 $900 per SCI entity × 21 SCI entities = $18,900. 555Current SCI Entities would already have incurred these burdens, which are summarized in the most recent PRA Supporting Statement. See 2022 PRA Supporting Statement, supra note 471. The proposed amendments impose no additional burden related to this section. The Commission does not anticipate that New SCI Entities would incur burdens beyond what is estimated in the 2022 PRA Supporting Statement. Respondent type Burden type Estimated respondents (entities) Burden hours per SCI entity Burden hours for all respondents (estimated respondents × burden hours per SCI entity) New SCI Entities ............................................................. Initial ................................... 23 1 170 3,910 Annual ................................ 2 25 575 1The Commission approved baseline estimate for each new non-SRO SCI entity to set up or modify a recordkeeping system is 170 hours. See 2022 PRA Supporting Statement, supra note 471. 2The Commission approved baseline estimate for each new non-SRO SCI entity to make, keep, and preserve records relating to compliance with Regulation SCI, as required by Rule 1005(b), is 25 hours. See 2022 PRA Supporting Statement, supra note 471. The table below summarizes the average internal cost of compliance that would be newly imposed on New SCI Entities:
Respondent type Burden type Estimated respondents (entities) Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) New SCI Entities ..................................................... Initial ............................... 23 1 $13,260 $304,980 Annual ............................ 2 1,950 44,850 1 170 Compliance Clerk hours × $78 per hour = $13,260. 2 25 Compliance Clerk hours × $78 per hour = $1,950. The recordkeeping requirements impose recordkeeping costs for SCI entities other than SCI SROs. The Commission estimates that a New SCI Entity other than an SCI SRO will incur a one-time cost of $900 for information technology costs for purchasing recordkeeping software, for a total of $20,700.554
6. Rule 1006
SCI entities submit Form SCI through the Electronic Form Filing System (‘‘EFFS’’), which is also used by SCI SROs to file Form 19b–4 filings. Access to EFFS establishes reporting burdens for all SCI entities. An SCI entity will submit to the Commission an External Application User Authentication Form (‘‘EAUF’’) to register each individual at the SCI entity who will access the EFFS system on behalf of the SCI entity. The Commission is including in its burden estimates the reporting burden for completing the EAUF for each individual at a New SCI Entity that will request access to EFFS.555 The table below summarizes the initial and ongoing burdens that would be New SCI Entities would incur to establish access to EFFS:
Respondent type Type of burden Estimated respondents (entities) Number of individuals requesting access Time to complete EAUF Burden hours per SCI entity (number of individuals requesting access × time to complete EAUF) Burden hours for all respondents (estimated respondents × burden hours per SCI entity) New SCI Entities ................ Initial ............ 23 1 2 2 0.15 0.3 6.9 Annual ......... 3 1 0.15 3.5 1The Commission approved baseline estimate for the number of individuals per SCI entity who will request access to EFFS initially through the EAUF is two individuals. See 2022 PRA Supporting Statement, supra note 471. 2The Commission approved baseline estimate to complete the EAUF is 0.15 hours. See 2022 PRA Supporting Statement, supra note 471. 3The Commission approved baseline estimate for the number of individuals per SCI entity who will request access to EFFS annually through the EAUF is one individual. See 2022 PRA Supporting Statement, supra note 471. The table below summarizes the average internal cost of compliance that would be newly imposed on New SCI Entities:

Respondent type Burden type Estimated respondents (entities) Average internal cost of compliance per entity Total internal cost of compliance (estimated respondents × average internal cost of compliance per entity) New SCI Entities ..................................................... Initial ............................... 23 1 $139 $3,197 Annual ............................ 2 69 1,587 1 0.3 Attorney hours × $462 = $139. 2 0.15 Attorney hours × $462 = $69. Obtaining the ability for an individual to electronically sign a Form SCI imposes reporting costs for SCI entities. The table below summarizes the cost for individuals at each New SCI Entity to obtain digital IDs to sign Form SCI:
Respondent type
Estimated respondents
(entities)
Number of individuals to sign form SCI Cost to obtain digital ID Cost per SCI entity (number of individuals requesting access × time to complete EAUF) Cost for all respondents (estimated respondents × burden hours per SCI entity) New SCI Entities .......................................... 23 1 2 2 $25 $50 $1,150 1The Commission approved baseline estimate for the number of individuals per SCI entity who will sign Form SCI each year is two individuals. See 2022 PRA Supporting Statement, supra note 471. 2The Commission approved baseline estimate to obtain a digital ID is $50. See 2022 PRA Supporting Statement, supra note 471.
7. Summary of the Information
Collection Burden
The table below summarizes the Commission’s estimate of the total hourly burden, total internal costs of compliance, and external cost estimates for SCI entities under Regulation SCI. Rule Respondent type Burden hours Costs of compliance Initial Annual Initial Annual Policies and procedures required by Rule 1001(a) (except Rule 1001(a)(2)(vi)) (Recordkeeping).
Current SCI Entities .....
New SCI Entities ..........
18,142
20,470
2,726
3,335
$6,804,989
7,667,533
$1,099,941
1,341,245
Policies and procedures required by Rule 1001(a)(2)(vi) (Recordkeeping). New SCI Entities .......... 3,680 3,335 1,402,540 1,204,740 Costs for outside legal/consulting services in initial preparation of policies and procedures required by Rule 1001(a) (Recordkeeping).
Current SCI Entities .....
New SCI Entities ..........
N/A
1,365,350
1,697,400
N/A
N/A
Policies and procedures required by Rule 1001(a) Total.
Current SCI Entities .....
New SCI Entities ..........
18,142
24,150
2,726
6,670
8,170,339
10,767,473
1,099,941
2,545,985
Policies and procedures required by Rule 1001(b) (Recordkeeping). New SCI Entities .......... 6,210 2,185 2,222,720 808,220 Costs for outside legal/consulting services in initial preparation of policies and procedures required by Rule 1001(b) (recordkeeping). New SCI Entities .......... N/A N/A 621,000 0 Policies and procedures required by Rule 1001(b) Total. New SCI Entities .......... 6,210 2,185 2,843,720 808,220 Policies and procedures required by Rule 1001(c) (Recordkeeping). New SCI Entities .......... 2,622 897 1,096,456 400,821 Mandate participation in certain testing required by Rule 1004 (Recordkeeping).
Current SCI Entities .....
New SCI Entities ..........
4,230
10,350
1,598
3,887
1,413,384
3,460,994
470,517
1,157,613
SCI Event Notice Required By Rule 1002(b)(1) (Reporting).
Current SCI Entities .....
New SCI Entities ..........
235
299
235
299
81,663
103,477
81,663
103,477
External Legal Costs for Rule 1001(b)(1) (Reporting).
Current SCI Entities .....
New SCI Entities ..........
N/A
25,556
33,350
25,556
33,350
SCI Event Notice Required By Rule 1002(b)(1) Total.
Current SCI Entities .....
New SCI Entities ..........
235
299
235
299
107,219
136,827
107,219
136,827
SCI Event Notice Required By Rule 1002(b)(2) (Reporting).
Current SCI Entities .....
New SCI Entities ..........
3,384
4,416
3,384
4,416
1,249,683
1,630,792
1,249,683
1,630,792
External Legal Costs for Rule 1001(b)(2) (Reporting).
Current SCI Entities .....
New SCI Entities ..........
N/A
25,556
33,350
25,556
33,350
SCI Event Notice Required By Rule 1002(b)(2) Total.
Current SCI Entities .....
New SCI Entities ..........
3,384
4,416
3,384
4,416
1,275,239
1,664,142
1,275,239
1,664,142
SCI Event Notice Required By Rule 1002(b)(3) (Reporting).
Current SCI Entities .....
New SCI Entities ..........
493.5
483
493.5
483
172,819
169,142
172,819
169,142
External Legal Costs for Rule 1002(b)(3) (Reporting).
Current SCI Entities .....
New SCI Entities ..........
N/A
17,038
16,675
17,038
16,675

Rule Respondent type
Burden hours Costs of compliance Initial Annual Initial Annual SCI Event Notice Required By Rule 1002(b)(3) Total.
Current SCI Entities .....
New SCI Entities ..........
493.5
483
493.5
483
189,857
185,817
189,857
185,817
SCI Event Notice Required By Rule 1002(b)(4) (Reporting).
Current SCI Entities .....
New SCI Entities ..........
4,935
6,440
4,935
6,440
1,927,752
2,515,648
1,927,752
2,515,648
External Legal Costs for 1001(b)(4) (Reporting) .. Current SCI Entities .....
New SCI Entities ..........
N/A
25,556
33,350
25,556
33,350
SCI Event Notice Required By Rule 1002(b)(4) Total.
Current SCI Entities .....
New SCI Entities ..........
4,935
6,440
4,935
6,440
1,953,308
2,548,998
1,953,308
2,548,998
SCI Event Notice Required By Rule 1002(b)(5) (Reporting).
Current SCI Entities .....
New SCI Entities ..........
(752)
3,312
(752)
3,312
(284,444)
1,252,948
(284,444)
1,252,948
External Legal Costs for Rule 1002(b)(5) (Reporting).
Current SCI Entities .....
New SCI Entities ..........
N/A
0
16,675
0
16,675
SCI Event Notice Required By Rule 1002(b)(5) Total.
Current SCI Entities .....
New SCI Entities ..........
(752)
3,312
(752)
3,312
(284,444)
1,269,623
(284,444)
1,269,623
Dissemination of information required by Rule 1002(c)(1) (Third-Party Disclosure). New SCI Entities .......... 3,174 3,174 1,400,194 1,400,194 External Legal Costs for Rule 1002(c)(1) (ThirdParty Disclosure). New SCI Entities .......... N/A N/A 57,270 57,270 Dissemination of information required by Rule 1002(c)(1) Total. New SCI Entities .......... 3,174 3,174 1,457,464 1,457,464 Dissemination of information required by Rule 1002(c)(2) (Third-Party Disclosure).
Current SCI Entities .....
New SCI Entities ..........
1,410
920
1,410
920
621,246
405,352
621,246
405,352
External Legal Costs for Rule 1002(c)(2) (ThirdParty Disclosure).
Current SCI Entities .....
New SCI Entities ..........
N/A
29,257.50
19,090
29,257.50
19,090
Dissemination of information required by Rule 1002(c)(2) Total.
Current SCI Entities .....
New SCI Entities ..........
1,410
920
1,410
920
650,503.5
424,442
650,503.5
424,442
Burden to develop processes to identify the nature of a system or event. New SCI Entities .......... 4,554 897 1,797,312 396,934 Establish reasonable written criteria for identifying a significant attempted unauthorized systems intrusion.
Current SCI Entities .....
New SCI Entities ..........
4,183
2,047
681.5
333.5
1,742,055
852,495
326,462
159,758
Material systems change notice required by Rule 1003(a)(1) and (2) (Reporting). New SCI Entities .......... 11,845 11,845 3,971,824 3,971,824 Establish reasonable written criteria for identifying a material change to its SCI systems and the security of indirect SCI systems. New SCI Entities .......... 2,622 621 1,096,456 297,367 SCI review required by Rule 1003(b)(1) and (2) (Recordkeeping).
Current SCI Entities .....
New SCI Entities ..........
16,215
23,805
16,215
23,805
5,820,856
8,545,489
5,820,856
8,545,489
SCI review required by Rule 1003(b)(3) (Reporting).
Current SCI Entities .....
New SCI Entities ..........
1,128
575
1,128
575
405,563
205,735
405,563
205,735
External Legal Costs for Rule 1003(b) (Recordkeeping).
Current SCI Entities .....
New SCI Entities ..........
N/A
1,175,000
1,725,000
1,175,000
1,725,000
SCI Review Costs (Rule 1003(b)) Total ............... Current SCI Entities .....
New SCI Entities ..........
17,343
24,380
17,343
24,380
7,401,419
10,476,224
7,401,419
10,476,224
Corrective action required by Rule 1002(a) (Recordkeeping).
Current SCI Entities .....
New SCI Entities ..........
1,081
3,151
N/A
897
449,132
1,316,244
N/A
396,934
Recordkeeping required by Rules 1005/1007 (Recordkeeping). New SCI Entities .......... 3,910 575 304,980 44,850 One-time cost to purchase recordkeeping software Rules 1005/1007 (Recordkeeping). New SCI Entities .......... N/A N/A 20,700 N/A Total recordkeeping costs required by Rules 1005/1007. New SCI Entities .......... 3,910 575 325,680 44,850 Request access to EFFS (Rule 1006) (Reporting) New SCI Entities .......... 6.9 3.5 3,197 1,587 Rule 1006—obtain digital IDs (Reporting) ............ New SCI Entities .......... N/A N/A 1,150 1,150 Total Costs to comply with Rule 1006 ................. New SCI Entities .......... 6.9 3.5 4,347 2,737
Total ...................................................................... Overall Total .................
Current SCI Entities .....
New SCI Entities ..........
169,576
54,685
112,845
104,289
32,054
72,235
68,764,549
23,068,011
45,696,538
41,536,601
13,190,021
28,346,580
Per Entity Hourly Burden/Cost ............................. Current SCI Entities 1 ...
New SCI Entities ..........
1,163
4,995
682
3,141
490,808.75
1,986,806
280,639.75
1,232,460
1As noted earlier, currently no SCI competing consolidators have registered with the Commission. See supra note 469. To the extent that a competing consolidator registers with the Commission, its initial and ongoing burdens as a result of the proposed amendments would be the same as the initial and ongoing burden per entity calculated for Current SCI Entities.

556See, e.g., 15 U.S.C. 78x (governing the public availability of information obtained by the Commission); 5 U.S.C. 552 et seq. 557See, e.g., 15 U.S.C. 78x (governing the public availability of information obtained by the Commission); 5 U.S.C. 552 et seq. See also Form SCI section IV (including a provision stating ‘‘Confidential treatment is requested pursuant to 17 CFR 240.24b–2(g) (‘‘Rule 24b–(g)’’)). 558See, e.g., FINRA, Cloud Computing in the Securities Industry (Aug. 16, 2021), available at https://www.finra.org/rules-guidance/key-topics/ fintech/report/cloud-computing; see also Franklin Allen et al., A Survey of Fintech Research and Policy Discussion, 1 Rev. Corp. Fin. 259, 259 (2021) (‘‘Cloud storage and cloud computing have also played increasing roles in payment systems, financial services, and the financial system overall’’). See also Financial Stability Board, Regulatory and Supervisory Issues Relating to Outsourcing and Third-Party Relationships, (discussion paper Nov. 9, 2020), available at https://www.fsb.org/wp-content/uploads/ P091120.pdf. In summary, the estimated paperwork related compliance burdens for SCI entities as a result of the amendments are approximately 170,000 hours and $69 million initially and approximately 104,000 hours and $41 million annually. E. Collection of Information Is Mandatory The collections of information pursuant to Regulation SCI is mandatory as to all entities subject to the rule. F. Confidentiality of Responses to Collection of Information The Commission expects that the written policies and procedures, processes, criteria, standards, or other written documents developed or revised by SCI entities pursuant to Regulation SCI will be retained by SCI entities in accordance with, and for the periods specified in 17 CFR 240.17a–1 (‘‘Rule 17a–1’’ of the Exchange Act) and Rule 1005, as applicable. Should such documents be made available for examination or inspection by the Commission and its representatives, they would be kept confidential subject to the provisions of applicable law.556 In addition, the information submitted to the Commission pursuant to Regulation SCI that is filed on Form SCI, as required by Rule 1006, will be treated as confidential, subject to applicable law, including amended 17 CFR 240.24b–2 (‘‘Rule 24b–2’’).557 The information disseminated by SCI entities pursuant to Rule 1002(c) under Regulation SCI to their members or participants will not be confidential. G. Request for Comment Pursuant to 44 U.S.C. 3506(c)(2)(B), the Commission solicits comment on the proposed collections of information in order to:
91. Evaluate whether the proposed
collections of information are necessary for the proper performance of the functions of the Commission, including whether the information would have practical utility;
92. Evaluate the accuracy of the
Commission’s estimates of the burden of the proposed collections of information;
93. Determine whether there are ways
to enhance the quality, utility, and clarity of the information to be collected; and
94. Evaluate whether there are ways
to minimize the burden of the collection of information on those who respond, including through the use of automated collection techniques or other forms of information technology. Persons submitting comments on the collection of information requirements should direct them to the Office of Management and Budget, Attention:
Desk Officer for the Securities and Exchange Commission, Office of Information and Regulatory Affairs, Washington, DC 20503, and should also send a copy of their comments to Vanessa A. Countryman, Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549–1090, with reference to File Number S7–07–23. Requests for materials submitted to OMB by the Commission with regard to this collection of information should be in writing, with reference to File Number S7–07–23 and be submitted to the Securities and Exchange Commission, Office of FOIA/PA Services, 100 F Street NE, Washington, DC 20549–2736. As OMB is required to make a decision concerning the collections of information between 30 and 60 days after publication, a comment to OMB is best assured of having its full effect if OMB receives it within 30 days of publication.
V. Economic Analysis
A. Introduction
The Commission is sensitive to the economic effects, including the costs and benefits, of its rules. When engaging in rulemaking pursuant to the Exchange Act that requires the Commission to consider or determine whether an action is necessary or appropriate in the public interest, section 3(f) of the Exchange Act requires the Commission to consider, in addition to the protection of investors, whether the action would promote efficiency, competition, and capital formation. In addition, section 23(a)(2) of the Exchange Act requires the Commission in making rules pursuant to the Exchange Act to consider the impact any such rule would have on competition. The Exchange Act prohibits the Commission from adopting any rule that would impose a burden on competition not necessary or appropriate in furtherance of the purposes of the Exchange Act. As explained above, the Commission believes that developments in the U.S. securities markets since the adoption of Regulation SCI in 2014 warrant expanding the scope of Regulation SCI as well as strengthening the obligations of SCI entities. These developments include the growth of electronic trading, which allows greater volumes of securities transactions to take place across a multitude of trading systems in our markets. In addition, large institutional and other professional market participants today employ sophisticated methods to trade electronically on multiple venues simultaneously in ever-increasing volumes with increasing speed. In recent years, financial institutions have increasingly used and relied on third parties that provide information and communications technology systems.558 Together, these developments have resulted in greater dispersal, sophistication, and interconnection of the systems underpinning our U.S. securities markets, thereby bringing potential new risks. The proposed amendments to Regulation SCI would expand the definition of ‘‘SCI entity’’ to include a broader range of entities that perform key functions in U.S. securities market infrastructure, and update certain other definitions and provisions to take account of technological market developments, including cybersecurity and vendor management, since the adoption of Regulation SCI in 2014. The proposed expansion would add to the definition of ‘‘SCI entity’’ registered security-based swap data repositories, and registered broker-dealers exceeding certain asset and transaction activity thresholds, and the proposal would expand the category of exempt clearing agencies subject to Regulation SCI to include all clearing agencies exempted from registration. Additional proposed amendments to Regulation SCI are designed to update the requirements of Regulation SCI relating to: (i) systems classification and lifecycle management; (ii) vendor management; (iii) cybersecurity; (iv) SCI review; (v) current SCI industry standards; and (vi) other matters. The Commission is sensitive to the economic effects of the proposed expansion and
strengthening of Regulation SCI, including its costs and benefits. As discussed further below, the Commission requests comment on all