In short
- OTC Link LLC failed to establish and enforce required written policies and procedures for its OTC Link ATS system between August 2016 and March 2025.
- Despite multiple examinations and flagged deficiencies, the firm did not promptly remediate issues related to system security, access control, and vulnerability management.
What happened
The SEC censured OTC Link LLC, a New York-based broker dealer, and ordered it to pay a $575,000 civil penalty for longstanding violations of Regulation SCI, specifically for failing to establish, maintain, and enforce required written policies and procedures for its OTC Link ATS system from August 2016 to March 2025.
Despite several examinations by the SEC’s Division of Examinations that repeatedly flagged deficiencies, OTC Link LLC did not promptly address issues related to system security, access control, and application vulnerability management, leading to violations of Rules 1001(a)(1), 1001(a)(2), and 1001(a)(3) of Regulation SCI.
OTC Link’s continual failure to remediate deficiencies even after they were repeatedly flagged by Division of Examinations staff reflects a disregard for their findings and the overall examinations process and justifies a meaningful penalty,
In numbers
- $575,000 civil penalty imposed
Named in this item
Organization, regulator US Regulation SCI —
What compliance teams should check
- Review and update written policies and procedures for SCI systems as required by Regulation SCI, referencing the deficiencies identified in the SEC Order.
- Ensure periodic reviews of the effectiveness of policies and procedures for OTC Link ATS, as mandated by Rules 1001(a)(2) and 1001(a)(3).
- Promptly remediate any deficiencies flagged during SEC Division of Examinations reviews, especially those related to system security, access control, and vulnerability management.
Why it matters
This enforcement action highlights the SEC’s expectation that all SCI entities must maintain robust, up-to-date written policies and procedures to ensure the security, integrity, and resiliency of critical trading systems. Repeated failures to address deficiencies, even after regulatory examinations, can result in significant penalties and reputational harm. Compliance officers must prioritize prompt remediation of flagged issues and ensure ongoing adherence to Regulation SCI requirements to avoid similar enforcement actions and maintain fair and orderly markets.
Catch stories like these on your own customers.
complead screens your customers against adverse media, sanctions and PEP lists, and re-checks them every day. When a name you hold turns up in the news, it lands in your case queue with the evidence attached.