SEC fines OTC Link $575,000 over Reg SCI gaps flagged in repeated exams

The Securities and Exchange Commission has censured OTC Link LLC and ordered it to pay a $575,000 civil penalty. OTC Link is the New York broker-dealer that runs the OTC Link ATS for over-the-counter securities. The SEC found long-running breaches of Regulation Systems Compliance and Integrity (Reg SCI).

The settled order was announced on 22 September. It covers the period from August 2016 to March 2025. In that time, the SEC said, the firm failed to establish, maintain and enforce written policies and procedures that Reg SCI requires for the ATS. The gaps covered system security, access control, and application vulnerability management, testing and remediation.

Flagged, not fixed

The case turns on what happened after examiners found the problems. Staff in the SEC’s Division of Examinations examined OTC Link ATS several times during the period. Each time they flagged required policies that the firm either had not written or had left in draft without finalising or enforcing. According to the order, the firm “repeatedly failed to promptly remediate such deficiencies”.

“OTC Link’s continual failure to remediate deficiencies even after they were repeatedly flagged by Division of Examinations staff reflects a disregard for their findings and the overall examinations process and justifies a meaningful penalty,” said Laura D’Allaird, chief of the Enforcement Division’s Cyber and Emerging Technologies Unit. She added that “all SCI entities are expected to take their regulatory responsibilities seriously and promptly fix issues when they’re identified.”

The order finds violations of three Reg SCI rules:

• Rule 1001(a)(1): the firm lacked policies reasonably designed to give its SCI systems, and its indirect SCI systems for security purposes, adequate capacity, integrity, resiliency, availability and security.
• Rule 1001(a)(2): it did not have the required minimum policies and procedures.
• Rule 1001(a)(3): it did not periodically review their effectiveness or act promptly to fix deficiencies.

OTC Link did not admit or deny the findings. It agreed to a cease-and-desist order, a censure and the penalty.

Context

Reg SCI applies to exchanges, clearing agencies, plan processors and ATSs that cross certain volume thresholds. It requires them to keep core trading and market-data systems resilient and to report systems events. Public enforcement under the rule has been infrequent. Most past cases involved outages or reporting failures. This one is about paperwork and governance with no headline disruption, which makes it a useful marker of how examiners will treat open findings.

The timing also matters. Across the market, SCI entities are adding capacity for overnight sessions, new venues and tokenised-asset projects, all of which bring new systems into Reg SCI scope.

Why it matters

For venue operators, and for ATS operators near the SCI thresholds, the message is about follow-up. A deficiency letter that sits in draft remediation for years can become an enforcement case, even with no outage. Compliance teams should check that exam findings on access control and vulnerability management have owners, deadlines and evidence of closure.

For brokers routing to OTC venues, the order says nothing about any market disruption. Still, operational due diligence on venues usually asks about the status of regulatory exams, and this order gives a public answer for one widely used OTC quotation platform.

Sources

• SEC press release 2026-91, “SEC Censures OTC Link LLC for Repeated Compliance Failures Related to Regulation SCI”, 22 September 2026 — https://www.sec.gov/newsroom/press-releases/2026-91-sec-censures-otc-link-llc-repeated-compliance-failures-related-regulation-sci