SEC release 34-106458 fines OTC Link $575,000 over Reg SCI gaps

The Securities and Exchange Commission’s settled order against OTC Link LLC, Release No. 34-106458 of September 22, 2026, is a $575,000 case about security policies that stayed in draft across several examination cycles. Its real subject is how long a Regulation SCI gap can survive when the only thing chasing it is the examination letter.

On September 22, 2026 the SEC censured OTC Link LLC, the broker-dealer subsidiary of OTC Markets Group, and ordered a $575,000 civil penalty for violating Rules 1001(a)(1), (a)(2) and (a)(3) of Regulation Systems Compliance and Integrity (Regulation SCI), according to the order instituting proceedings (Administrative Proceeding File No. 3-22748). The Relevant Period runs from August 2016 to March 2025, roughly eight years and seven months, and no outage, intrusion or investor loss is alleged. This analysis reads the order clause by clause, sets it against earlier Regulation SCI cases, compares the EU, UK and Singapore approaches, and draws out what other SCI entities should take from it.

• Penalty: $575,000, plus a censure and a cease-and-desist order, payable within 14 days (SEC Release No. 34-106458, Section IV).
• Rules violated: Regulation SCI Rules 1001(a)(1), 1001(a)(2), including (a)(2)(iv), and 1001(a)(3), found “willful” under Exchange Act Section 15(b)(4) (Release No. 34-106458, paragraphs 4 and 13-17).
• Duration: an access-control policy first cited as a draft after a fiscal-year 2016 examination was cited again in 2019 and 2022 and still not established in fiscal year 2023 (Release No. 34-106458, paragraph 16).
• Detection: repeated Division of Examinations reviews, not a self-report or an incident (Release No. 34-106458, paragraphs 3 and 15).
• Proportion: OTC Markets Group reported 2025 gross revenues of $125.3 million and net income of $31.1 million (OTC Markets Group results, March 4, 2026); the penalty is about 0.46% of that revenue.
• Prior action: OTC Link paid $1,190,000 in August 2024 over a failure to file Suspicious Activity Reports between March 2020 and May 2023 (SEC Release No. 34-100692, August 12, 2024).

Methodology and sources for this Regulation SCI analysis

The core source is the six-page order in Release No. 34-106458 and the accompanying SEC press release 2026-91, both dated September 22, 2026. Rule text and history come from the Regulation SCI adopting release, Release No. 34-73639, 79 FR 72252 (December 5, 2014). Financial figures come from OTC Markets Group’s own earnings releases. Non-US comparisons use the EU Digital Operational Resilience Act (DORA), the Financial Conduct Authority’s (FCA) PS21/3 and Monetary Authority of Singapore (MAS) notices. The window is 2014 to September 2026.

Related:SEC innovation exemption caps tokenised stocks at 75 and 250 symbols

What Regulation SCI actually required of OTC Link ATS

The order is narrower than the headline suggests. It charges only Rule 1001(a), the written policies and procedures on capacity, integrity, resiliency, availability and security. It does not charge Rule 1002 (corrective action and Commission notification of SCI events, including the 24-hour written notice), Rule 1003 (material systems changes and the annual SCI review) or Rule 1004 (business continuity and disaster recovery testing). There was no SCI event to report. The case is about whether the rulebook existed.

Under Rule 1001(a)(1), OTC Link lacked system security policies covering “account management and access control, network device security configuration management, and data loss prevention” (paragraph 13). Under Rule 1001(a)(2)(iv), which requires regular reviews and testing of SCI systems and backups for vulnerabilities, it lacked policies on “application vulnerability management, testing, and remediation,” some of which it “kept in ‘draft’ form and failed to finalize” (paragraph 14). Under Rule 1001(a)(3), failing to fix what examiners flagged was a separate violation (paragraph 17).

Rule 1001(a)(3) is the provision that turns a documentation gap into a supervisory case. It requires every SCI entity to review the effectiveness of its Regulation SCI policies and procedures periodically and to take prompt action to remedy deficiencies. In Release No. 34-106458 of September 22, 2026, the SEC found that OTC Link LLC broke it because deficiencies explicitly identified in Division of Examinations deficiency letters were still open at later examinations. The clearest example is the access-control policy for OTC Link ATS. Examiners found it in draft form in connection with a fiscal-year 2016 examination, cited it again in letters issued in 2019 and 2022, and found that as of fiscal year 2023 it “had still not been formally established” (paragraph 16). The $575,000 penalty therefore rests less on the missing documents than on the years between the first finding and the fix. For compliance teams, Rule 1001(a)(3) means a deficiency letter starts a remediation clock.

The threshold question matters too. Under Rule 1000, an alternative trading system (ATS) trading equities that are not NMS stocks becomes an “SCI ATS” if, in at least four of the preceding six calendar months, it had 5% or more of the average daily dollar volume reported to a self-regulatory organisation (order, paragraph 9). The 2014 adopting release gives a first-time ATS six months to comply, and set a general compliance date of November 3, 2015. The order does not say why the Relevant Period starts in August 2016. OTC Link LLC operates five ATS platforms (paragraph 5) (OTC Link ATS, OTC Link ECN, OTC Link NQB, OTC Overnight and MOON ATS, per OTC Markets), but the order names only OTC Link ATS as the SCI entity.

How four jurisdictions police unfinished resilience policies

Sources: SEC Release No. 34-106458; Regulation (EU) 2022/2554 (DORA); FCA PS21/3; FCA TSB press release; MAS Notice FSM-N13; MAS, May 5, 2023; MAS, November 1, 2023. Last updated: September 26, 2026.

All four regimes require written resilience policies. They diverge on how supervisory findings are enforced. DORA writes the link into the statute. Article 6(5) requires the ICT risk management framework to be reviewed annually and also “following supervisory instructions or conclusions derived from relevant digital operational resilience testing or audit processes.” An EU trading venue that left an inspection finding in draft for years would breach that text directly. Regulation SCI reaches the same place through the more general Rule 1001(a)(3), which is why the OTC Link order needed a separate finding under it.

The UK and Singapore lean on outcomes rather than paper. The FCA, as set out in our comparison of EU, UK and US resilience rules, measures firms against impact tolerances for important business services. MAS uses capital and business restrictions: DBS had to hold about S$1.6 billion in additional regulatory capital and was barred from non-essential IT changes for six months. Both sanctions followed real disruptions. The OTC Link case differs in kind, because the SEC penalised a documentation and remediation failure with no disruption alleged, which leaves a firm’s US SCI entity with the heaviest pure-paperwork exposure of the four.

“OTC Link’s continual failure to remediate deficiencies even after they were repeatedly flagged by Division of Examinations staff reflects a disregard for their findings and the overall examinations process and justifies a meaningful penalty.”

— Laura D’Allaird, Chief, Cyber and Emerging Technologies Unit, SEC Division of Enforcement (SEC press release 2026-91)

Enforcement context: how OTC Link compares with earlier Regulation SCI cases

The SEC’s first charged violation came on March 6, 2018, when the New York Stock Exchange, NYSE American and NYSE Arca agreed to a $14 million penalty across five investigations (press release 2018-31; Release No. 34-82808). Its Reg SCI element was a Rule 1001(a)(2)(v) finding on business continuity and disaster recovery plans, a policies charge like OTC Link’s, though bundled with market-disrupting events. On February 16, 2023 The Options Clearing Corporation paid $17 million over stress-testing and margin failures, including late notice to the SEC under Regulation SCI (press release 2023-31). On May 22, 2024 Intercontinental Exchange paid $10 million because nine subsidiaries, including the NYSE, did not notify the SEC of an April 2021 VPN intrusion (Release No. 34-100206).

Against those, the OTC Link penalty is 4.1% of the NYSE figure and 5.8% of ICE’s. Three features explain the scale: the respondent is one broker-dealer rather than an exchange group, there was no event to price, and OTC Link had already hired consultants in 2024 and adopted the missing policies “since March 2025” (paragraph 18). That is also why the order imposes no undertakings.

The sharper comparison is internal. In August 2024 the same firm paid $1,190,000 after the SEC found it filed no Suspicious Activity Reports between March 2020 and May 2023. That makes two settled SEC cases in just over two years, both about compliance programmes that did not work as written. Procedurally, the 2024 order recites a settlement “without admitting or denying” the findings, while the 2026 order says only “without admitting the findings herein,” following the SEC’s May 18, 2026 rescission of its no-deny policy, a move that mirrors the CFTC’s own no-deny reversal. The SEC’s release carries no statement from the company.

Why the eight-year Regulation SCI gap is the real finding

The OTC Link case shows that the Regulation SCI supervision model depends on the Division of Examinations deficiency letter, and that the letter alone did not produce a fix. Under Regulation SCI, examiners review an SCI entity’s policies and send a letter listing apparent violations of Rules 1001(a)(1) and (a)(2); enforcement is a separate step. According to Release No. 34-106458, OTC Link received such letters after “several” examinations between August 2016 and March 2025, including letters in 2019 and 2022 that repeated a fiscal-year 2016 finding on access control. The policy was still unfinished in fiscal year 2023. Remediation came only after OTC Link hired outside consultants in 2024, with the new policies adopted from March 2025, close to nine years after the Relevant Period began. The practical lesson is that an examination finding can stay open across several cycles without escalation, and the $575,000 penalty in September 2026 is that escalation arriving about a decade after the first finding.

The timeline shows a firm ignoring its supervisor, but also leaves open why repeat letters ran for years before the file reached enforcement. The 2014 adopting release said the “significant number of recent systems issues at various trading venues” necessitated “as prompt an implementation of the requirements of Regulation SCI by SCI entities as possible.” It followed the May 6, 2010 Flash Crash and the 2012 Facebook IPO, after which, the release notes, Nasdaq implemented a $62 million accommodation programme. An open access-control gap across three examinations sits awkwardly with that urgency.

What this means for SCI entities and compliance teams

For ATS operators near the Rule 1000 thresholds: designation is automatic once volume crosses the line, and the six-month on-ramp is short. OTC Markets reported about 95,000 average daily trades on OTC Link ECN and OTC Link NQB in the second quarter of 2026, up from about 63,000 a year earlier (OTC Markets Group, August 5, 2026). Fast-growing venues need a Reg SCI policy set ready before the trigger.

For exchanges, clearing agencies and other SCI entities: “draft” is not a compliance status. Paragraph 14 treats draft policies as policies not established. Each of the seven Rule 1001(a)(2) topics needs an adopted policy with an owner and a last-review date.

For legal and compliance teams: a deficiency letter needs a dated remediation plan, senior sign-off and evidence of closure before the next examination, because a repeat finding is exactly the fact pattern behind the Rule 1001(a)(3) charge here. The “willful” finding only requires that the firm knew what it was doing, not that it knew it was breaking a rule (order, footnote 2).

“Imposing outsized penalties for minor violations risks creating a counter-productive dynamic between the Commission and regulated entities.”

— Hester M. Peirce and Mark T. Uyeda, SEC Commissioners, on the $10 million ICE Regulation SCI settlement (SEC statement, May 22, 2024)

That is the clearest record of the view that Reg SCI sanctions should track real-world harm. The OTC Link figure fits that logic: no harm, a smaller penalty, but still a penalty for ignoring examiners.

What’s next for Regulation SCI

On June 12, 2025 the SEC formally withdrew its April 14, 2023 proposal (88 FR 23146) to widen the “SCI entity” definition, saying any future action would need a new proposal.

Two pressures will test it. OTC Markets chief executive R. Cromwell Coulson said in the second-quarter 2026 results that as tokenised-securities rules develop, “OTC Link ATS, our Qualified Interdealer Quotation System, will support trading by our FINRA member broker-dealers.” That places the same SCI system inside a product the SEC is shaping through its innovation exemption for tokenised NMS stock. Separately, the SEC has announced a roundtable on preparations for 24-hour trading, and overnight venues such as OTC Overnight, covered in our report on OTC Markets’ overnight data feeds, shrink the maintenance windows Reg SCI testing policies assume.

The SEC has trimmed broker-dealer burdens elsewhere this month, including Release No. 34-106339 on Inline XBRL for broker-dealer audits. The OTC Link order shows that deregulation has not extended to ignored examination findings. Other SCI ATSs will read $575,000 as the reference price for a policies-only case.

TL;DR

In Release No. 34-106458 of September 22, 2026, the SEC censured OTC Link LLC and fined it $575,000 for violating Regulation SCI Rules 1001(a)(1), (a)(2) and (a)(3) at OTC Link ATS between August 2016 and March 2025. There was no outage or intrusion. The firm lacked finished policies on access control, network device configuration, data loss prevention and application vulnerability testing, and kept some in draft. Examiners flagged the gaps repeatedly, including letters in 2019 and 2022 that repeated a fiscal-year 2016 finding. The penalty equals about 0.46% of OTC Markets Group’s $125.3 million 2025 gross revenue, according to the company’s March 4, 2026 results. For SCI entities, a deficiency letter creates a remediation duty, and an unresolved repeat finding is itself a violation.

FAQ

What did the SEC find against OTC Link LLC?

In Release No. 34-106458, dated September 22, 2026, the SEC found that OTC Link LLC failed to establish, maintain and enforce required Regulation SCI written policies for OTC Link ATS from August 2016 to March 2025. The gaps covered access control, network device configuration, data loss prevention and application vulnerability testing. OTC Link was censured, ordered to cease and desist and fined $575,000, settling without admitting the findings.

Was there a system outage or cyber attack?

No. The order alleges no SCI event, market disruption, intrusion or investor loss, and it does not charge the notification duties in Rule 1002, the systems-change and SCI review duties in Rule 1003 or the testing duties in Rule 1004. The case concerns written policies under Rule 1001(a) and unremediated examination findings. The SEC’s own press release describes the violations as “longstanding” rather than linking them to any incident.

How was the violation detected?

Through routine examinations. Division of Examinations staff examined OTC Link ATS several times during the Relevant Period and issued deficiency letters after each one. The access-control policy was first cited as a draft after a fiscal-year 2016 examination, cited again in 2019 and 2022, and still not established in fiscal year 2023. The Division of Enforcement’s Cyber and Emerging Technologies Unit brought the case, and its chief said the record reflected “a disregard” for examiners’ findings.

Why is OTC Link ATS an SCI entity?

Rule 1000 of Regulation SCI treats an ATS trading non-NMS equity securities as an “SCI ATS” if, in at least four of the preceding six calendar months, it had 5% or more of the average daily dollar volume reported to a self-regulatory organisation. OTC Link LLC runs five ATS platforms, but the September 22, 2026 order names only OTC Link ATS as the SCI entity.

Is $575,000 a large Regulation SCI penalty?

Not by comparison. NYSE entities paid $14 million in 2018, The Options Clearing Corporation $17 million in 2023 and Intercontinental Exchange $10 million in 2024, each in cases that included Reg SCI charges. OTC Link’s own 2024 Suspicious Activity Report case cost $1.19 million. Against OTC Markets Group’s 2025 net income of $31.1 million, the new penalty is about 1.8%.

Did OTC Link have to accept undertakings?

No undertakings appear in the order. OTC Link had already retained third-party compliance consultants in 2024 and, since March 2025, has adopted the policies it previously lacked on application vulnerability management, access control and network device configuration. That remediation explains the absence of an independent consultant requirement. The sanctions are limited to a cease-and-desist order, a censure and the $575,000 penalty.

Featured image: Facade of the U.S. Securities and Exchange Commission headquarters, Washington, D.C. Photo: David (dbking) / Wikimedia Commons, CC BY 2.0.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.