SEC Censures OTC Link LLC for Repeated Compliance Failures Related to Regulation SCI

The Securities and Exchange Commission announced a settled enforcement action against OTC Link LLC, censuring the New York-based broker-dealer and imposing a $575,000 civil penalty for violations of Regulation SCI. According to the SEC’s order, the firm repeatedly failed to establish, maintain, and enforce required written policies and procedures for its OTC Link ATS, an alternative trading system for over-the-counter securities. The order states the deficiencies spanned system security, access control, and application vulnerability management, testing, and remediation. SEC staff from the Division of Examinations reviewed OTC Link ATS multiple times during the relevant period and identified missing or draft policies that the firm did not finalize or enforce. The SEC found that OTC Link repeatedly failed to promptly remediate those deficiencies after they were flagged. Regulation SCI requires entities to maintain written policies and procedures reasonably designed to ensure adequate capacity, integrity, resiliency, availability, and security of SCI systems and related indirect SCI systems. The SEC’s order concluded OTC Link LLC violated Rule 1001(a)(1) by lacking such policies and also breached Rules 1001(a)(2) and 1001(a)(3) by failing to periodically review policy effectiveness and to take prompt corrective action. Without admitting the findings, OTC Link agreed to the SEC’s cease-and-desist order, censure, and the $575,000 penalty. SEC enforcement officials emphasized that the firm’s repeated failures to address examination findings warranted a meaningful sanction and stressed that SCI entities are expected to remediate identified issues promptly.