Regulation Systems Compliance and Integrity

AGENCY:

Securities and Exchange Commission.

ACTION:

Proposed rule and form; proposed rule amendment.

SUMMARY:

The Securities and Exchange Commission (“Commission”) is proposing Regulation Systems Compliance and Integrity (“Regulation SCI”) under the Securities Exchange Act of 1934 (“Exchange Act”) and conforming amendments to Regulation ATS under the Exchange Act. Proposed Regulation SCI would apply to certain self-regulatory organizations (including registered clearing agencies), alternative trading systems (“ATSs”), plan processors, and exempt clearing agencies subject to the Commission's Automation Review Policy (collectively, “SCI entities”), and would require these SCI entities to comply with requirements with respect to their automated systems that support the performance of their regulated activities.

DATES:

Comments should be submitted on or before May 24, 2013.

ADDRESSES:

Interested persons should submit comments by any of the following methods:

Electronic Comments

Use the Commission's Internet comment form ( http://www.sec.gov/rules/proposed.shtml ); or

Send an email to rule-comments@sec.gov. Please include File Number S7-01-13 on the subject line; or

Use the Federal eRulemaking Portal ( http://www.regulations.gov ). Follow the instructions for submitting comments.

Paper Comments

Send paper comments in triplicate to Elizabeth M. Murphy, Secretary, Securities and Exchange Commission, 100 F Street NE., Washington, DC 20549-1090.

All comment letters should refer to File No. S7-01-13. This file number should be included on the subject line if email is used. To help us process and review your comments more efficiently, please use only one method. The Commission will post all comments on the Commission's Internet Web site ( http://www.sec.gov/rules/proposed.shtml ). Comments are also available for public inspection and copying in the Commission's Public Reference Room, 100 F Street NE., Washington, DC 20549 on official business days between the hours of 10 a.m. and 3 p.m. All comments received will be posted without change; we do not edit personal information from submissions. You should submit only information that you wish to make publicly available.

FOR FURTHER INFORMATION CONTACT:

Heidi Pilpel, Special Counsel, Office of Market Supervision, at (202) 551-5666, Sara Hawkins, Special Counsel, Office of Market Supervision, at (202) 551-5523, Jonathan Balcom, Special Counsel, Office of Market Supervision, at (202) 551-5737, Yue Ding, Attorney, Office of Market Supervision, at (202) 551-5842, Dhawal Sharma, Attorney, Office of Market Supervision, at (202) 551-5779, Elizabeth C. Badawy, Senior Accountant, Office of Market Supervision, at (202) 551-5612, and Gordon Fuller, Senior Special Counsel, Office of Market Operations, at (202) 551-5686, Division of Trading and Markets, Securities and Exchange Commission, 100 F Street NE., Washington, DC 20549-7010.

SUPPLEMENTARY INFORMATION:

Proposed Regulation SCI would supersede and replace the Commission's current Automation Review Policy (“ARP”), established by the Commission's two policy statements, each titled “Automated Systems of Self-Regulatory Organizations,” issued in 1989 and 1991. Regulation SCI also would supersede and replace aspects of those policy statements codified in Rule 301(b)(6) under the Exchange Act, applicable to significant-volume ATSs. Proposed Regulation SCI would require SCI entities to establish written policies and procedures reasonably designed to ensure that their systems have levels of capacity, integrity, resiliency, availability, and security adequate to maintain their operational capability and promote the maintenance of fair and orderly markets, and that they operate in the manner intended. It would also require SCI entities to mandate participation by designated members or participants in scheduled testing of the operation of their business continuity and disaster recovery plans, including backup systems, and to coordinate such testing on an industry- or sector-wide basis with other SCI entities. In addition, proposed Regulation SCI would require notices and reports to be provided to the Commission on a new proposed Form SCI regarding, among other things, SCI events and material systems changes, and would require SCI entities to take corrective action upon any responsible SCI personnel becoming aware of SCI events. SCI events would be defined to include systems disruptions, systems compliance issues, and systems intrusions. The proposed regulation would further require that information regarding certain types of SCI events be disseminated to members or participants of SCI entities. In addition, proposed Regulation SCI would require SCI entities to conduct a review of their systems by objective personnel at least annually, and would require SCI entities to maintain certain books and records. The Commission also is proposing to modify the volume thresholds in Regulation ATS for significant-volume ATSs, apply them to SCI ATSs (as defined below), and move this standard from Regulation ATS to proposed Regulation SCI.

Table of Contents

I. Background

A. History and Evolution of the Automation Review Policy Inspection Program

B. Evolution of the Markets Since the Inception of the ARP Inspection Program

C. Successes and Limitations of the Current ARP Inspection Program

D. Recent Events

II. Proposed Codification and Enhancement of ARP Inspection Program

III. Proposed Regulation SCI

A. Overview

B. Proposed Rule 1000(a): Definitions Establishing the Scope of Regulation SCI

1. SCI Entities

2. Definition of SCI Systems and SCI Security Systems

3. SCI Events

a. Systems Disruption

b. Systems Compliance Issue

c. Systems Intrusion

d. Dissemination SCI events

4. Material Systems Changes

C. Proposed Rule 1000(b): Obligations of SCI Entities

1. Policies and Procedures to Safeguard Capacity, Integrity, Resiliency, Availability, and Security

a. Proposed Rule 1000(b)(1)(i)

b. Proposed Rule 1000(b)(1)(ii)

2. Systems Compliance

3. SCI Events—Action required; Notification

a. Corrective Action

b. Commission Notification

c. Dissemination of Information to Members or Participants

4. Notification of Material Systems Changes

5. Review of Systems

6. Periodic Reports

7. Proposed Rule 1000(b)(9): SCI Entity Business Continuity and Disaster Recovery Plans Testing Requirements for Members or Participants

D. Proposed Rule 1000(c)-(f): Recordkeeping, Electronic Filing on Form SCI, and Access

1. Recordkeeping Requirements

2. Electronic Submission of Reports, Notifications, and Other Communications on Form SCI

3. Access to the Systems of an SCI Entity

E. New Proposed Form SCI

1. Notice of SCI Events Pursuant to Proposed Rule 1000(b)(4)

2. Notices of Material Changes Pursuant to Proposed Rule 1000(b)(6)

3. Reports Submitted Pursuant to Rule 1000(b)(8)

4. Notifications of Member or Participant Designation Standards and List of Designees Pursuant to Proposed Rule 1000(b)(9)

5. Other Information and Electronic Signature

F. Request for Comment on Applying Proposed Regulation SCI to Security-Based Swap Data Repositories and Security-Based Swap Execution Facilities

G. Solicitation of Comment Regarding Potential Inclusion of Broker-Dealers, Other than SCI ATSs, and Other Types of Entities

IV. Paperwork Reduction Act

V. Economic Analysis

A. Background

B. Economic Baseline

C. Consideration of Costs and Benefits, and the Effect on Efficiency, Competition, and Capital Formation

D. Request for Comment on Economic Analysis

VI. Consideration of Impact on the Economy

VII. Regulatory Flexibility Act Certification

VIII. Statutory Authority and Text of Proposed Amendments

I. Background

A. History and Evolution of the Automation Review Policy Inspection Program

Section 11A(a)(2) of the Exchange Act, enacted as part of the Securities Acts Amendments of 1975 (“1975 Amendments”), directs the Commission, having due regard for the public interest, the protection of investors, and the maintenance of fair and orderly markets, to use its authority under the Exchange Act to facilitate the establishment of a national market system for securities in accordance with the Congressional findings and objectives set forth in Section 11A(a)(1) of the Exchange Act. Among the findings and objectives in Section 11A(a)(1) is that “[n]ew data processing and communications techniques create the opportunity for more efficient and effective market operations” and “[i]t is in the public interest and appropriate for the protection of investors and the maintenance of fair and orderly markets to assure * * * the economically efficient execution of securities transactions.” In addition, Sections 6(b), 15A, and 17A(b)(3) of the Exchange Act impose obligations on national securities exchanges, national securities associations, and clearing agencies, respectively, to be “so organized” and “[have] the capacity to * * * carry out the purposes of [the Exchange Act].”

For over two decades, Commission staff has worked with SROs to assess their automated systems under the Commission's ARP inspection program (“ARP Inspection Program”), a voluntary information technology review program created in response to the October 1987 market break. In 1989, the Commission published ARP I, its first formal policy statement regarding steps that SROs should take in connection with their automated systems. In ARP I, the Commission discussed the development by SROs of automated execution, market information, and trade comparison systems to accommodate increased trading activity from the 1960s through the 1980s. The Commission acknowledged improvements in efficiency during that time period, but noted that the October 1987 market break had exposed that automated systems remained vulnerable to operational problems during extreme high volume periods. The Commission also expressed concern about the potential for systems failures to negatively impact public investors, broker-dealer risk exposure, and market efficiency. The Commission further stated in ARP I that market movements should be “the result of market participants' changing expectations about the direction of the market for a particular security, or group of securities, and not the result of investor confusion or panic resulting from operational failures or delays in SRO automated trading or market information systems.” The Commission issued ARP I as a result of these concerns, and stated that SROs should “establish comprehensive planning and assessment programs to test systems capacity and vulnerability.” In particular, the Commission recommended that each SRO should: (1) Establish current and future capacity estimates for its automated order routing and execution, market information, and trade comparison systems; (2) periodically conduct capacity stress tests to determine the behavior of automated systems under a variety of simulated conditions; and (3) contract with independent reviewers to assess annually whether these systems could perform adequately at their estimated current and future capacity levels and have adequate protection against physical threat. In addition, ARP I called for each SRO to have its automated systems reviewed annually by an “independent reviewer.”

In 1991, the Commission published ARP II. In ARP II, the Commission further articulated its views on how SROs should conduct independent reviews. ARP II stated that such reviews and analysis should: “(1) Cover significant elements of the operations of the automation process, including the capacity planning and testing process, contingency planning, systems development methodology and vulnerability assessment; (2) be performed on a cyclical basis by competent and independent audit personnel following established audit procedures and standards; and (3) result in the presentation of a report to senior SRO management on the recommendations and conclusions of the independent reviewer, which report should be made available to Commission staff for its review and comment.”

In addition, ARP II addressed how SROs should notify the Commission of material systems changes and significant systems problems. Specifically, ARP II stated that SROs should notify Commission staff of significant additions, deletions, or other changes to their automated systems on an annual and an as-needed basis, as well as provide real-time notification of unusual events, such as significant outages involving automated systems. Further, in ARP II, the Commission again suggested development of standards to meet the ARP policy statements, stating that “the SROs, and other interested parties should begin the process of exploring the establishment of (1) standards for determining capacity levels for the SROs' automated trading systems; (2) generally accepted computer security standards that would be effective for SRO automated systems; and (3) additional standards regarding audits of computer systems.”

The current ARP Inspection Program was developed by Commission staff to implement the ARP policy statements, and has garnered participation by all active registered clearing agencies, all registered national securities exchanges, the Financial Industry Regulatory Authority (“FINRA”), the only registered national securities association, one exempt clearing agency, and one ATS. In 1998, the Commission adopted Regulation ATS which, among other things, imposed by rule certain aspects of ARP I and ARP II on significant-volume ATSs. Thereafter, administration of these aspects of Regulation ATS was incorporated into the ARP Inspection Program.

Under the ARP Inspection Program, staff in the Commission's Division of Trading and Markets (“ARP staff”) conduct inspections of ARP entity systems, attend periodic technology briefings presented by ARP entity staff, monitor the progress of planned significant system changes, and respond to reports of system failures, disruptions, and other systems problems of ARP entities. An ARP inspection typically includes ARP staff review of information technology documentation, testing of selected controls, and interviews with information technology staff and management of the ARP entity.

Just as markets have become increasingly automated and information technology programs and practices at ARP entities have changed, ARP inspections also have evolved considerably over the past 20 years. Today, the ARP Inspection Program covers nine general inspection areas, or information technology “domains:” application controls; capacity planning; computer operations and production environment controls; contingency planning; information security and networking; audit; outsourcing; physical security; and systems development methodology. The goal of an ARP inspection is to evaluate whether an ARP entity's controls over its information technology resources in each domain are consistent with ARP and industry guidelines, as identified by ARP staff from a variety of information technology publications that ARP staff believes reflect industry standards for securities market participants.

Most recently, these publications have included, among others, publications issued by the Federal Financial Institutions Examination Council (“FFIEC”) and the National Institute of Standards and Technology (“NIST”). ARP staff has also relied on the 2003 Interagency White Paper on Sound Practices to Strengthen the Resiliency of the U.S. Financial System and the 2003 Policy Statement on Business Continuity Planning for Trading Markets. Since 2003, however, the Commission has not issued formal guidance on which publications establish the most appropriate guidelines for ARP entities. At the conclusion of an ARP inspection, ARP staff typically issues a report to the ARP entity with an assessment of its information technology program with respect to its critical systems, including any recommendations for improvement.

Another significant aspect of the ARP Inspection Program relates to the monitoring of planned significant systems changes and reports of systems problems at ARP entities. As noted above, ARP II stated that SROs should notify Commission staff of significant additions, deletions, or other changes to their automated systems on an annual and an as-needed basis, as well as provide real-time notification of unusual events, such as significant outages involving automated systems. Likewise, Regulation ATS requires significant-volume ATSs to promptly notify the Commission of material systems outages and significant systems changes.

In addition to the Commission's ARP policy statements and Rule 301(b)(6) of Regulation ATS, Commission staff has provided guidance to ARP entities on how the staff believes they should report planned systems changes and systems issues to the Commission. For example, in 2001, Commission staff sent a letter to the SROs and other participants in the ARP Inspection Program to clarify what should be considered a “significant system change” and a “significant system outage” for purposes of reporting systems changes and problems to Commission staff. Further, in 2009, Commission staff sent a letter to the national securities exchanges and FINRA expressing the staff's view that SROs are obligated to ensure that their systems' operations comply with the federal securities laws and rules and the SRO's rules, and that failure to satisfy this obligation could lead to sanctions under Section 19(h)(1) of the Exchange Act. Unlike ARP I, ARP II, and Rule 301(b)(6) of Regulation ATS, the 2001 Staff ARP Interpretive Letter and 2009 Staff Systems Compliance Letter were not issued by the Commission and constitute only staff guidance. Proposed Regulation SCI, if adopted, would consolidate and supersede all such staff guidance, as well as the Commission's ARP policy statements and Rule 301(b)(6) of Regulation ATS.

In addition, OCIE conducts inspections of SROs, as part of the Commission's oversight of them. Unlike ARP inspections, however, which focus on information technology controls, OCIE primarily conducts risk-based examinations of securities exchanges, FINRA, and other SROs to evaluate whether they and their member firms are complying with the Exchange Act and the rules thereunder, as well as SRO rules. Examples of OCIE risk-based examination areas include: governance, regulatory funding, trading regulation, member firm examination programs, disciplinary programs for member firms, and exchange programs for listing compliance. In 2011, OCIE conducted baseline assessments of all of the national securities exchanges then operating. These assessments included these areas, among others, but did not include examinations of the exchanges' systems, as systems inspections are conducted under the ARP Inspection Program. As part of the Commission's oversight of the SROs, OCIE also reviews systems compliance issues reported to Commission staff. The information gained from OCIE's review of reported systems compliance issues helps to inform its examination risk-assessments for SROs.

B. Evolution of the Markets Since the Inception of the ARP Inspection Program

Since the inception of the ARP Inspection Program more than two decades ago, the securities markets have experienced sweeping changes, evolving from a collection of relatively few, mostly manual markets, to a larger number and broader variety of trading centers that are almost completely automated, and dependent upon sophisticated technology and extremely fast and interconnected systems. Regulatory developments, such as Regulation NMS, decimalization, Regulation ATS, and the Order Handling Rules, also have impacted the structure of the markets by, among other things, mandating and providing incentives that encourage automation and speed. Although some markets today retain trading floors and accommodate some degree of manual interaction, these markets also have implemented electronic trading for their products. In stock markets, for example, in almost all cases, the volume of electronic trading dominates any residual manual activity. In addition, in recent years, the new trading systems developed by existing or new exchanges and ATSs rely almost exclusively on fully-electronic, automated technology to execute trades. As a result, the overwhelming majority of securities transactions today are executed on such automated systems. A primary driver and catalyst of this transformation has been the continual evolution of technologies for generating, routing, and executing orders. These technologies have dramatically improved the speed, capacity, and sophistication of the trading functions that are available to market participants. The increased speed and capacity of automated systems in the current market structure has contributed to surging message traffic.

In addition to these changes, there has been an increase in the number of trading venues, particularly for equities. No longer is trading in equities dominated by one or two trading venues. Today, 13 national securities exchanges trade equities, with no single stock exchange having an overall market share of greater than twenty percent of consolidated volume for all NMS stocks, but each with a protected quotation that may not be traded through by other markets. ATSs, including electronic communications networks (“ECNs”) and dark pools, as well as broker-dealer internalizers, also execute substantial volumes of securities transactions. Each of these trading venues is connected with the others through a vast web of linkages, including those that provide connectivity, routing services, and market data. The number of venues trading options has likewise grown, with 11 national securities exchanges currently trading options, up from five as recently as 2004.

The increased number of trading venues, dispersal of trading volume, and the resulting reliance on a variety of automated systems and intermarket linkages have increased competition and thus investor choice, but have also increased the complexity of the markets and the challenges for market participants seeking to manage their information technology programs and to ensure compliance with Commission rules. These changes have also substantially heightened the potential for systems problems originating from any number of sources to broadly affect the market. Given the increased interconnectedness of the markets, a trading venue may not always recognize the true impact and cost of a problem that originates with one of its systems.

C. Successes and Limitations of the Current ARP Inspection Program

While the Commission generally considers the ARP Inspection Program to have been successful in improving the automated systems of the SROs and other entities participating in the program over the past 20 years, the Commission is mindful of its limitations. For example, because the ARP Inspection Program is established pursuant to Commission policy statements, rather than Commission rules, the Commission's ability to assure compliance with ARP standards with certainty or adequate thoroughness is limited. In particular, the Commission may not be able to fully address major or systemic market problems at all entities that would meet the proposed definition of SCI entity. Further, the Government Accountability Office (“GAO”) has identified the voluntary nature of the ARP Inspection Program as a limitation of the program and recommended that the Commission make compliance with ARP guidelines mandatory.

The Commission believes that the continuing evolution of the securities markets to the current state, where they have become almost entirely electronic and highly dependent on sophisticated trading and other technology (including complex regulatory and surveillance systems, as well as systems relating to the provision of market data, intermarket routing and connectivity, and a variety of other member and issuer services), has posed challenges for the ARP Inspection Program. Accordingly, the Commission believes that the guidance in the ARP policy statements should be updated and formalized, and that clarity with respect to a variety of important matters, including regarding appropriate industry practices, notice to the Commission of all SCI events and to members or participants of SCI entities of certain systems problems, Commission access to systems, and procedures designed to better ensure that SRO systems comply with the SRO's own rules, would improve the Commission's oversight capabilities. Furthermore, given the importance of ensuring that an SRO's trading and other systems are operated in accordance with its rules, the Commission believes that improvements in SRO procedures could help to ensure that such systems are operating in compliance with relevant rules, and to promptly identify and address any instances of non-compliance.

D. Recent Events

In the Commission's view, recent events further highlight why rulemaking in this area may be warranted. On May 6, 2010, according to a report by the staffs of the Commission and the Commodity Futures Trading Commission (“CFTC”), the prices of many U.S.-based equity products experienced an extraordinarily rapid decline and recovery, with major equity indices in both the futures and securities markets, each already down over four percent from their prior day close, suddenly plummeting a further five to six percent in a matter of minutes before rebounding almost as quickly. According to the May 6 Staff Report, many individual equity securities and exchange traded funds suffered similar price declines and reversals within a short period of time, falling 5, 10, or even 15 percent before recovering most, if not all, of their losses. The May 6 Staff Report stated that some equities experienced even more severe price moves, both up and down, with over 20,000 trades in more than 300 securities executed at prices more than 60 percent away from their values just moments before.

Among the key findings in the May 6 Staff Report was that the interaction between automated execution programs and algorithmic trading strategies can quickly erode liquidity and result in disorderly markets, and that concerns about data integrity, especially those that involve the publication of trades and quotes to the consolidated tape, can contribute to pauses or halts in many automated trading systems and in turn lead to a reduction in general market liquidity. According to the May 6 Staff Report, the events of May 6, 2010 clearly demonstrate the importance of data in today's world of fully automated trading strategies and systems, and that fair and orderly markets require the maintenance of high standards for robust, accessible, and timely market data.

Both before and after the May 6, 2010 incident, individual markets have also experienced other systems-related issues. In February 2011, NASDAQ OMX Group, Inc. revealed that hackers had penetrated certain of its computer networks, though Nasdaq reported that at no point did this intrusion compromise Nasdaq's trading systems. In October 2011, the Commission sanctioned EDGX and EDGA, two national securities exchanges, and their affiliated broker, Direct Edge ECN LLC, for violations of federal securities laws arising from systems incidents. In the Direct Edge Order, the Commission noted that the “violations occurred against the backdrop of weaknesses in Respondents' systems, processes, and controls.”

More recently, in 2012, systems issues hampered the initial public offerings of BATS Global Markets, Inc. and Facebook, Inc. On March 23, 2012, BATS announced that a “software bug” caused BATS to shut down the IPO of its own stock, BATS Global Markets, Inc. On May 18, 2012, issues with Nasdaq's trading systems delayed the start of trading in the high-profile IPO of Facebook, Inc. and some market participants experienced delays in notifications over whether orders had been filled.

While these are illustrative high-profile examples, they are not the only instances of disruptions and other systems problems experienced by SROs and ATSs. Moreover, the risks associated with cybersecurity, and how to protect against systems intrusions, are increasingly of concern to all types of entities, including public companies.

On October 2, 2012, the Commission conducted a roundtable entitled “Technology and Trading: Promoting Stability in Today's Markets” (“Roundtable”). The Roundtable examined the relationship between the operational stability and integrity of the securities market and the ways in which market participants design, implement, and manage complex and interconnected trading technologies. Panelists offered their views on how market participants could prevent, or at least mitigate, technology errors as well as how error response could be improved.

Although the discussion was wide-ranging, several themes emerged, with panelists generally agreeing that areas of focus across the industry should be on adherence to best practices, improved quality assurance, more robust testing, increased pre-trade and post-trade risk controls, real-time monitoring of systems, and improved communications when systems problems occur. The panelists also discussed whether there should be regulatory or other mandates for quality standards and industry testing, and whether specific mechanisms, such as “kill switches,” would be useful to protect the markets from technology errors and to advance the goal of bolstering investor confidence in the markets. Several panelists also stated that, given the frequency of coding changes in the current market environment, testing of software changes should be far more robust.

In addition to the Roundtable panels, the Commission solicited comment with respect to the Roundtable's topics, and received statements from some of the Roundtable panelists, as well as comment letters from the public. Many comment letters specifically recommended improved testing as a way to aid error prevention. In addition, several commenters expressed support for a “kill-switch” mechanism that would permit exchanges or other market centers to terminate a firm's trading activity if such activity was posing a threat to market integrity.

The Commission believes that the information presented at the Roundtable and received from commenters, as broadly outlined above, highlights that quality standards, testing, and improved error response mechanisms are among the issues needing very thoughtful and focused attention in today's securities markets. In formulating proposed Regulation SCI, the Commission has considered the information and views discussed at the Roundtable and received from commenters.

Most recently, the U.S. national securities exchanges closed for two business days in the wake of Superstorm Sandy, a major storm that hit the East Coast of the United States during October 2012, and which caused significant damage in lower Manhattan, among other places. Press reports stated that, while the markets planned to open on the first day of the storm (with the NYSE planning to operate under its contingency plan as an electronic-only venue), after consultation with market participants, including the Commission and its staff, and in light of concerns over the physical safety of personnel and the possibility of technical issues, the national securities exchanges jointly decided not to open for trading on October 29 and October 30, 2012. The market closures occurred even though the securities industry's annual test of how trading firms, market operators and their utilities could operate through an emergency using backup sites, backup communications, and disaster recovery facilities occurred on October 27, 2012, just two days before the storm. According to press reports, the test did not uncover issues that would preclude markets from opening two days later with backup systems, if they so chose. In addition, NYSE's contingency plan was tested seven months prior to the storm, though press reports indicate that a large number of NYSE members did not participate. The Commission also has considered the impact of Superstorm Sandy on the securities markets, particularly with respect to business continuity planning and testing, in formulating proposed Regulation SCI.

II. Proposed Codification and Enhancement of ARP Inspection Program

In the Commission's view, the convergence of several developments—the evolution of the markets to become significantly more dependent upon sophisticated automated systems, the limitations of the existing ARP Inspection Program, and the lessons of recent events—highlight the need to consider an updated and formalized regulatory framework for ensuring that the U.S. securities trading markets develop and maintain systems with adequate capacity, integrity, resiliency, availability, and security, and reinforce the requirement that such systems operate in compliance with the Exchange Act. The Commission is proposing new Regulation SCI because the Commission preliminarily believes that it would further the goals of the national market system and reinforce Exchange Act obligations to require entities important to the functioning of the U.S. securities markets to carefully design, develop, test, maintain, and surveil systems integral to their operations.

Proposed Regulation SCI would replace the two ARP policy statements. Although proposed Regulation SCI would codify in a Commission rule many of the principles of the ARP policy statements with which SROs and other participants in the ARP Inspection Program are familiar, the proposed rule would apply to more entities than the current ARP Inspection Program and would place obligations not currently included in the ARP policy statements on entities subject to the rule. Specifically, proposed Regulation SCI would apply to “SCI entities,” a term that would include “SCI SROs,” “SCI ATSs,” “plan processors,” and “exempt clearing agencies subject to ARP.”

Further, to help ensure that the proposed rule covers key systems of SCI entities, the proposed rule would define (for purposes of Regulation SCI) the term “SCI systems” to mean those systems of, or operated by or on behalf of, an SCI entity that directly support trading, clearance and settlement, order routing, market data, regulation, or surveillance. In addition, the term “SCI security systems” would include systems that share network resources with SCI systems that, if breached, would be reasonably likely to pose a security threat to such systems. The proposed rule also would define several other terms intended to specify what types of systems changes and problems (“SCI events”) the Commission considers to be most significant and, therefore, preliminarily believes should be covered by the proposed rule's requirements.

In addition, proposed Regulation SCI would specify the obligations SCI entities would have with respect to covered systems and SCI events. Specifically, proposed Regulation SCI would require that each SCI entity: (1) Establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, SCI security systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets; (2) establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in the manner intended; (3) respond to SCI events with appropriate corrective action; (4) report SCI events to the Commission and submit follow-up reports, as applicable; (5) disseminate information regarding certain SCI events to members or participants of the SCI entity; (6) report material systems changes to the Commission; (7) conduct an SCI review of its systems not less than once each calendar year; (8) submit certain periodic reports to the Commission, including a report of the SCI review, together with any response by senior management; (9) mandate participation by designated members or participants in scheduled testing of the operation of the SCI entity's business continuity and disaster recovery plans, including backup systems, and coordinate such testing on an industry- or sector-wide basis with other SCI entities; and (10) make, keep, and preserve records relating to the matters covered by Regulation SCI, and provide them to Commission representatives upon request. The proposal also would require that an SCI entity submit all required written notifications and reports to the Commission electronically using new proposed Form SCI.

III. Proposed Regulation SCI

A. Overview

The purpose of proposed Regulation SCI is to enhance the Commission's regulatory supervision of SCI entities and thereby further the goals of the national market system by helping to ensure the capacity, integrity, resiliency, availability, and security, and enhance compliance with federal securities laws and regulations, of automated systems relating to the U.S. securities markets through the formalization of standards to which their automated systems would be held, and a regulatory framework for ensuring more effective Commission oversight of these systems. Proposed Rule 1000(a) sets forth several definitions designed to establish the scope of the new rule. Proposed Rule 1000(b) sets forth the obligations that would be imposed on SCI entities with respect to systems and systems issues. Proposed Rules 1000(c)-(f) set forth recordkeeping and electronic filing requirements and address certain other related matters.

B. Proposed Rule 1000(a): Definitions Establishing the Scope of Regulation SCI

A series of definitions set forth in proposed Rule 1000(a) relate to the scope of proposed Regulation SCI. These include the definitions for “SCI entity,” “SCI systems,” “SCI security systems,” “SCI event,” “systems disruption,” “systems compliance issue,” “systems intrusion,” “dissemination SCI event,” and “material systems change.”

1. SCI Entities

Although the ARP policy statements are rooted in Exchange Act requirements, the ARP Inspection Program has developed without the promulgation of Commission rules applicable to SROs or plan processors. Under the ARP Inspection Program, Commission staff conducts inspections of SROs to assess the capacity, integrity, resiliency, availability, and security of their systems. These inspections also have historically included the systems of entities that process and disseminate quotation and transaction data on behalf of the Consolidated Tape Association System (“CTA Plan”), Consolidated Quotation System (“CQS Plan”), Joint Self-Regulatory Organization Plan Governing the Collection, Consolidation, and Dissemination of Quotation and Transaction Information for Nasdaq-Listed Securities Traded on Exchanges on an Unlisted Trading Privileges Basis (“Nasdaq UTP Plan”), and Options Price Reporting Authority (“OPRA Plan”). The ARP Inspection Program has also included one exempt clearing agency. Pursuant to Rule 301(b)(6) of Regulation ATS, certain aspects of the ARP policy statements apply mandatorily to significant-volume ATSs, as they are currently defined under Regulation ATS. However, because no ATSs currently meet the significant-volume thresholds specified in Rule 301(b)(6) of Regulation ATS, compliance with the ARP Inspection Program is not mandatory at this time for any ATS. Proposed Regulation SCI would provide mandatory uniform requirements for “SCI entities.” Proposed Rule 1000(a) would define “SCI entity” as an “SCI self-regulatory organization, SCI alternative trading system, plan processor, or exempt clearing agency subject to ARP.” The proposed rule also would define each of these terms for the purpose of designating specifically the entities that the Commission preliminarily believes should be subject to the rule.

Proposed Rule 1000(a) would define the term “SCI self-regulatory organization.” The definition of “SCI self-regulatory organization,” or “SCI SRO,” would be consistent with the definition of “self-regulatory organization” set forth in Section 3(a)(26) of the Exchange Act, and would cover all national securities exchanges registered under Section 6(b) of the Exchange Act, registered securities associations, registered clearing agencies, and the Municipal Securities Rulemaking Board (“MSRB”). The definition would, however, exclude an exchange that lists or trades security futures products that is notice-registered with the Commission as a national securities exchange pursuant to Section 6(g) of the Exchange Act, as well as any limited purpose national securities association registered with the Commission pursuant to Exchange Act Section 15A(k). Accordingly, the definition of SCI SRO in proposed Rule 1000(a) would mandate that all national securities exchanges registered under Section 6(b) of the Exchange Act, all registered securities associations, all registered clearing agencies, and the MSRB, comply with Regulation SCI.

Proposed Rule 1000(a) would define the term “SCI alternative trading system,” or “SCI ATS,” as an alternative trading system, as defined in § 242.300(a), which during at least four of the preceding six calendar months, had: (1) With respect to NMS stocks—(i) five percent or more in any single NMS stock, and 0.25 percent or more in all NMS stocks, of the average daily dollar volume reported by an effective transaction reporting plan, or (ii) one percent or more, in all NMS stocks, of the average daily dollar volume reported by an effective transaction reporting plan; (2) with respect to equity securities that are not NMS stocks and for which transactions are reported to a self-regulatory organization, five percent or more of the average daily dollar volume as calculated by the self-regulatory organization to which such transactions are reported; or (3) with respect to municipal securities or corporate debt securities, five percent or more of either—(i) the average daily dollar volume traded in the United States, or (ii) the average daily transaction volume traded in the United States.

As proposed, ATSs would be covered if they met the proposed thresholds for at least four of the preceding six months, which the Commission preliminarily believes is an appropriate time period over which to evaluate the trading volume of an ATS. The Commission preliminarily believes that this time period would help ensure that the standards are not so low as to capture ATSs whose volume would still be considered relatively low, but, for example, that may have had an anomalous increase in trading on a given day or small number of days.

The proposed definition would modify the thresholds currently appearing in Rule 301(b)(6) of Regulation ATS that apply to significant-volume ATSs. Specifically, the proposed definition would: Use average daily dollar volume thresholds, instead of an average daily share volume threshold, for ATSs that trade NMS stocks or equity securities that are not NMS stocks (“non-NMS stocks”); use alternative average daily dollar and transaction volume-based tests for ATSs that trade municipal securities or corporate debt securities; lower the volume thresholds applicable to ATSs for each category of asset class; and move the proposed thresholds to Rule 1000(a) of proposed Regulation SCI. In particular, with respect to NMS stocks, the Commission proposes to change the volume threshold from 20 percent of average daily volume in any NMS stock such that an ATS that trades NMS stocks that meets either of the following two alternative threshold tests would be subject to the requirements of proposed Regulation SCI: (i) Five percent or more in any NMS stock, and 0.25 percent or more in all NMS stocks, of the average daily dollar volume reported by an effective transaction reporting plan; or (ii) one percent or more, in all NMS stocks, of the average daily dollar volume reported by an effective transaction reporting plan. This change is designed to ensure that proposed Regulation SCI is applied to an ATS that could have a significant impact on the NMS stock market as a whole, as well as an ATS that could have a significant impact on a single NMS stock and some impact on the NMS stock market as a whole at the same time. Specifically, by imposing both a single NMS stock threshold and an all NMS stocks threshold in (i) above, proposed Regulation SCI would not apply to an ATS that has a large volume in a small NMS stock and little volume in all other NMS stocks. Based on data collected from FINRA's Order Audit Trail System (“OATS data”) for one week of trading in May 2012, the Commission preliminarily believes that approximately 10 ATSs trading NMS stocks would exceed the proposed thresholds and fall within the definition of SCI entity, accounting for approximately 87 percent of the dollar volume market share of all ATSs trading NMS stocks.

The Commission notes that its analysis of the OATS data does not reveal an obvious threshold level above which a particular subset of ATSs may be considered to have a significant impact on individual NMS stocks or the overall market, as compared to another subset of ATSs. The Commission preliminarily believes that inclusion of the proposed dual dollar volume threshold is appropriate to help prevent an ATS from avoiding the requirements of proposed Regulation SCI by circumventing one of the two threshold tests. The Commission also preliminarily believes that a threshold that accounts for 87 percent of the dollar volume market share of all ATSs trading NMS stocks is a reasonable level that would not exclude new entrants to the ATS market. Moreover, the Commission preliminarily believes the proposed thresholds would appropriately include ATSs having NMS stock dollar volume comparable to the NMS stock dollar volume of the equity exchanges that are SCI SROs and therefore covered by proposed Regulation SCI.

Since the time that the Commission originally adopted Regulation ATS, the equity markets have evolved significantly, resulting in an increase in the number of trading centers and a reduction in the concentration of trading activity. As such, even smaller trading centers, such as certain ATSs, now collectively represent a significant source of liquidity for NMS stocks and, by comparison, no single registered securities exchange executes more than 20 percent of volume in NMS stocks. Given these developments in market structure, the Commission preliminarily believes that setting the average daily dollar volume threshold for NMS stocks at five percent in any NMS stock and 0.25 percent in all NMS stocks, or one percent in all NMS stocks, is appropriate to help ensure that entities that have determined to participate (in more than a limited manner) in the national market system as markets that bring buyers and sellers together, are subject to the requirements of proposed Regulation SCI. In addition, the Commission preliminarily believes that it is appropriate to propose average daily dollar volume thresholds for NMS stocks, rather than average daily share volume thresholds, because, by using dollar volume, the price level of a stock will not skew an ATS's inclusion or exclusion from the definition of SCI entity, as may be the case when using share volume, and the use of dollar thresholds may better reflect the economic impact of trading activity.

In sum, the Commission preliminarily believes that the proposed dollar volume thresholds for NMS stocks would further the goals of the national market system by ensuring that ATSs that meet the thresholds are subject to the same baseline standards as other SCI entities for systems capacity, integrity, resiliency, availability, and security.

With respect to non-NMS stocks, municipal securities, and corporate debt securities, the Commission is proposing to lower the current thresholds in Rule 301(b)(6) of Regulation ATS. Specifically, the Commission is proposing to reduce the standard from 20 percent to five percent for these types of securities, the same percentage threshold for such types of securities that triggers the fair access provisions of Rule 301(b)(5) of Regulation ATS. The Commission preliminarily believes that ATSs that trade non-NMS stocks, municipal securities, and corporate debt securities above the proposed thresholds are those that play a significant role in the market for such securities and thus preliminarily believes that the proposed thresholds are appropriately designed.

With respect to non-NMS stocks for which transactions are reported to a self-regulatory organization, the Commission proposes to lower the threshold to five percent or more of the average daily dollar volume as calculated by the self-regulatory organization to which such transactions are reported. Using data from the first six months of 2012, the Commission believes that an ATS executing transactions in non-NMS stocks at a level exceeding five percent of the average daily dollar volume traded in the United States would be executing trades at a level exceeding $31 million daily. Based on data collected from Form ATS-R for the second quarter of 2012, the Commission estimates that two ATSs would exceed this threshold and fall within the definition of SCI entity. The Commission requests comment on the accuracy of these estimates.

With respect to municipal securities and corporate debt securities, the Commission proposes to lower the threshold to five percent or more of either: (i) The average daily dollar volume traded in the United States; or (ii) the average daily transaction volume traded in the United States. The Commission preliminarily believes that this two-pronged threshold is appropriate for the debt market, as it should capture both ATSs that are focused on retail orders and facilitate a relatively greater number of trades with relatively lower dollar values, as well as those ATSs that are focused on institutional orders and facilitate a relatively lower number of trades with relatively greater dollar values. The Commission preliminarily believes that both of these thresholds are important in identifying ATSs that play a significant role in the debt markets for executing both retail- and institutional-sized trades.

Using data from the first six months of 2012, the Commission believes that an ATS executing transactions in municipal securities at a level exceeding five percent of the average daily dollar volume traded in the United States would be executing trades at a level of at least approximately $550 million daily, and that an ATS executing transactions in municipal securities at a level exceeding five percent of the average daily transaction volume traded in the United States would be executing an average of at least approximately 1,900 transactions daily. Based on data collected from Form ATS-R for the second quarter of 2012, the Commission preliminarily believes that currently no ATSs executing transactions in municipal securities would exceed the proposed average daily dollar volume threshold and fall within the definition of SCI entity pursuant to that proposed prong. ATSs are not required to report transaction volume data for municipal securities on Form ATS-R. However, based on discussions with industry sources, the Commission preliminarily believes that three ATSs executing transactions in municipal securities would likely exceed the proposed average daily transaction volume threshold. The Commission requests comment on the accuracy of these estimates.

Using data from the first six months of 2012, the Commission believes that an ATS executing transactions in corporate debt at a level exceeding five percent of the average daily dollar volume traded in the United States would be executing trades at a level of at least approximately $900 million daily, and that an ATS executing transactions in corporate debt at a level exceeding five percent of the average daily transaction volume traded in the United States would be executing an average of at least approximately 2,100 transactions daily. Based on data collected from Form ATS-R for the second quarter of 2012, the Commission preliminarily believes that currently no ATSs executing transactions in corporate debt would exceed the proposed average daily dollar volume threshold and fall within the definition of SCI entity pursuant to that proposed prong. ATSs are not required to report transaction volume data for corporate debt on Form ATS-R. However, based on discussions with industry sources, the Commission preliminarily believes that three ATSs executing transactions in corporate debt would likely exceed the proposed average daily transaction volume threshold. The Commission requests comment on the accuracy of these estimates.

The Commission is proposing these numerical thresholds as a preliminary best estimate of when a market is of sufficient significance to the trading of the relevant asset class (i.e., NMS stocks, non-NMS stocks, municipal securities, and corporate debt securities) as to warrant the protections and obligations of proposed Regulation SCI. As noted above, the numerical thresholds in the definition of SCI ATS have not been derived from econometric or mathematical models. Instead, they reflect a preliminary assessment by the Commission, based on qualitative and some quantitative analysis, of the likely economic consequences of the specific quantitative thresholds proposed to be included in the definition. The Commission recognizes that there may reasonably be differing views as to what the threshold levels for inclusion should be and thus the Commission solicits comment on the appropriateness of the proposed threshold levels.

The Commission recognizes that it is proposing numerically higher thresholds for non-NMS stocks, municipal securities, and corporate debt securities as compared to NMS stocks (five percent, as compared to one percent in all NMS stocks). While the Commission preliminarily believes that similar concerns about the trading of NMS stocks on ATSs apply to the trading of non-NMS stocks and debt securities on ATSs (namely, that markets with significant portions of the volume in particular instruments have adequate systems capacity, integrity, resiliency, availability, and security), the Commission notes that it has traditionally provided special safeguards with regard to NMS stocks in its rulemaking efforts relating to market structure.

Further, in part due to the greater availability of, and reliance on, electronic trading for NMS stocks, the trading of such securities is generally more accessible to a wider range of investors and has resulted in increases in electronic trading volumes relative to 15 years ago, as compared to other markets, such as the debt markets, which still largely rely on manual trading. Because the degree of automation and electronic trading is generally lower in markets that trade non-NMS stocks and debt securities than in the markets that trade NMS stocks, the Commission preliminarily believes that a systems issue at an SCI entity that trades non-NMS stocks or debt securities would not have as significant an impact as readily as a systems issue at an SCI entity that trades NMS stocks. Therefore, the Commission preliminarily believes there is less need in the markets for those securities for more stringent thresholds that would trigger the requirements of proposed Regulation SCI. For example, the most recent widely publicized issues involving systems problems and disruptions in the securities markets have generally all been related to NMS stocks. The Commission also believes that imposition of a threshold that is set too low in markets that lack automation could have the unintended effects of discouraging automation in these markets and discouraging new entrants into these markets. For these reasons, the Commission preliminarily believes that it is appropriate at this time to apply a different threshold to ATSs trading NMS stocks than those ATSs trading non-NMS stocks, municipal securities, and corporate debt securities.

Under Proposed Rule 1000(a), the term “plan processor” would have the meaning set forth in Rule 600(b)(55) of Regulation NMS, which defines “plan processor” as “any self-regulatory organization or securities information processor acting as an exclusive processor in connection with the development, implementation and/or operation of any facility contemplated by an effective national market system plan.” As noted above, the ARP Inspection Program has developed to include the systems of the plan processors of the four current SCI Plans. Any entity selected as the processor of an SCI Plan is responsible for operating and maintaining computer and communications facilities for the receipt, processing, validating, and dissemination of quotation and/or last sale price information generated by the members of such plan. Although an entity selected as the processor of an SCI Plan acts on behalf of a committee of SROs, such entity is not required to be an SRO, nor is it required to be owned or operated by an SRO. The Commission believes, however, that the systems of such entities, because they deal with key market data, form the “heart of the national market system,” and should be subject to the same systems standards as SCI SROs, and proposes to include “plan processors” in the definition of SCI entity.

Pursuant to its terms, each SCI Plan is required to periodically review its selection of its processor, and may in the future select a different processor for the SCI Plan than its current processor. The proposed inclusion of “plan processors” in the definition of SCI entity is designed to ensure that the processor for an SCI Plan, regardless of its identity, is independently subject to the requirements of proposed Regulation SCI. Thus, the proposed definition would cover any entity selected as the processor for a current or future SCI Plan. The Commission preliminarily believes that it is important for such plan processors to be subject to the requirements of proposed Regulation SCI because of the important role they serve in the national market system: Operating and maintaining computer and communications facilities for the receipt, processing, validating, and dissemination of quotation and/or last sale price information generated by the members of the plan.

Under proposed Rule 1000(a), the term “exempt clearing agency subject to ARP” would mean “an entity that has received from the Commission an exemption from registration as a clearing agency under Section 17A of the Act, and whose exemption contains conditions that relate to the Commission's Automation Review Policies, or any Commission regulation that supersedes or replaces such policies.” This proposed definition of “exempt clearing agency subject to ARP” presently would apply to one entity, Global Joint Venture Matching Services—US, LLC (“Omgeo”).

Among the operational conditions required by the Commission in the Omgeo Exemption Order were several that directly related to the ARP policy statements. For the same reasons that it required Omgeo to abide by the conditions relating to the ARP policy statements set forth in the Omgeo Exemption Order, the Commission preliminarily believes it would be appropriate that Omgeo (or any similarly situated exempt clearing agency) should be subject to the requirements of proposed Regulation SCI, and thus is proposing to include any “exempt clearing agency subject to ARP” as explained above, within the definition of SCI entity.

Request for Comment

1. The Commission requests comment generally on the proposed definition of SCI entity and its constituent parts. Do commenters believe that entities of the type that would satisfy the proposed definition of SCI entity play significant roles in the U.S. securities markets such that they should be subject to proposed Regulation SCI? Why or why not?

2. Do commenters believe the scope of the proposed definition of SCI SRO is appropriate? Does the proposed definition of SCI SRO include types of entities that should not be subject to the proposed requirements, or exclude types of entities that should be subject to the proposed requirements? If so, please identify such types of entities and explain why they should or should not be included in the definition of SCI entity or SCI SRO. Should the definition of “SCI self-regulatory organization” include exchanges notice-registered with the Commission pursuant to 15 U.S.C. 78f(g) or a limited purpose national securities association registered with the Commission pursuant to 15 U.S.C. 78 o-3(k)? Do commenters believe that it is appropriate to defer to the CFTC regarding the systems compliance and integrity of such entities? Why or why not?

3. Do commenters believe that the proposed definition of “SCI alternative trading system” is appropriate? Why or why not? Do commenters believe that the proposed volume thresholds for the different asset classes under the proposed definition of SCI ATS are appropriate? Specifically, are the proposed average daily dollar volume thresholds of five percent or more in any NMS stock and 0.25 percent or more in all NMS stocks, or one percent or more in all NMS stocks, appropriate? Would higher or lower daily dollar volume thresholds for NMS stocks be more appropriate? Please explain and provide data in support. Alternatively, would a different threshold measurement be more appropriate (e.g., transaction volume, share volume, etc.)? If so, which and at what threshold level? Please explain and provide data in support.

4. The Commission notes that, unlike the threshold levels applicable to NMS stocks currently in Rule 301(b)(6) of Regulation ATS, the proposed thresholds for NMS stocks are based on average daily dollar volume in an individual NMS stock and/or all NMS stocks. Do commenters believe that these are appropriate standards? Why or why not? If not, what should be the appropriate standard, and why? Do commenters believe the proposed thresholds of five percent or more in any NMS stock and 0.25 percent or more in all NMS stocks would prevent a situation in which an ATS that has a large volume in one NMS stock and little volume in other NMS stocks would be covered by proposed Regulation SCI? How common is it for an ATS to trade illiquid NMS stocks without also trading more liquid NMS stocks? Please provide any data relevant to this question.

5. Should the SCI ATS thresholds be triggered only with respect to certain NMS stocks, for example, only with respect to the most liquid NMS stocks? If so, how should the Commission define the “most liquid” NMS stocks? For example, should the thresholds be triggered only for the 500 most liquid NMS stocks? The 100 most liquid NMS stocks? Another amount? Why or why not? Please describe your reasoning. Further, what would be the appropriate threshold measurement (e.g., average daily share volume, average daily dollar volume, or another measurement)? Please explain.

6. Is the proposed five percent threshold level appropriate for non-NMS stocks, municipal securities (approximately $550 million in daily dollar volume or 1,900 in daily transaction volume based on data from the first six months of 2012), and corporate debt securities (approximately $900 million in daily dollar volume or 2,100 in daily transaction volume based on data from the first six months of 2012)? Why or why not? Please explain and provide data in support. If not, what should be the appropriate thresholds and why?

7. As with NMS stocks, the proposed five percent thresholds for non-NMS stocks are to be calculated by reference to daily dollar volume, though the proposed threshold would only be with reference to all such stocks (as opposed to average daily dollar volume in individual NMS stocks and/or all NMS stocks). Do commenters believe that this is the appropriate standard for non-NMS stocks? Why or why not?

8. Do commenters agree with the Commission's assessment that there is less automation among markets that trade non-NMS stocks, municipal securities, and corporate debt securities as compared to markets that trade NMS stocks? Why or why not? What is the current level of automation in these markets?

9. Do commenters believe that there should be different thresholds for NMS stocks than non-NMS stocks, municipal securities, and corporate debt securities? Why or why not? Do commenters believe that the proposed two-pronged thresholds are appropriate for municipal securities and corporate debt securities? Why or why not? Would the proposed two-pronged approach be relevant or appropriate for securities other than municipal and corporate debt securities? Why or why not?

10. Do commenters believe that the Commission's estimates of the current number of ATSs that would meet the proposed thresholds are accurate? Why or why not? If not, please provide any data or estimates that commenters believe would more accurately reflect the number of ATSs that would meet the proposed thresholds.

11. The Commission is also considering whether it should instead adopt a definition for SCI ATS that is based solely on a single type of threshold measurement (such as average daily dollar volume), which would be simpler and provide consistency across different asset classes, rather than the differing types of threshold tests for NMS stocks, non-NMS stocks, municipal securities, and corporate debt securities currently proposed. In particular, the Commission is considering whether it would be appropriate to solely use a threshold based on a percentage of average daily dollar volume for all asset classes. Would a threshold based on a percentage of average daily dollar volume be an appropriate single measure that the Commission should use for all asset classes (i.e., NMS stocks, non-NMS stocks, municipal securities, and corporate debt securities) within the definition of SCI ATS? Why or why not? If so, would it be appropriate for the Commission to adopt the same dollar volume threshold measurement that applies for all of the asset classes? Why or why not? Please explain. If so, what would be an appropriate threshold measurement? For example, would five percent of the asset class's total average daily dollar volume be appropriate? Should the measurement be higher or lower? Please be specific and explain. Or, rather than a threshold measurement that is based on a percentage of the asset class's total average daily dollar volume, would a fixed average daily dollar volume threshold, such as $500 million, be appropriate? If so, should such a threshold be higher or lower than $500 million? Why or why not? Should such a fixed dollar threshold be different for different asset classes? Why or why not? If so, what should such thresholds be for each asset class? Please be specific. What are the advantages and disadvantages of a percentage-based threshold versus a fixed dollar threshold? Please explain.

12. Would it be appropriate for the Commission to adopt a single dollar volume threshold measurement that applies across all asset classes? For example, if an ATS trades both municipal securities and corporate debt securities, should its trading volume in both asset classes be aggregated to determine whether it exceeded the threshold measurement? Why or why not?

13. The proposed SCI ATS thresholds are to be calculated by reference to executions “during at least four of the preceding six calendar months,” the measurement period and method that is currently used in Regulation ATS. Do commenters believe this is the appropriate time frame and method to be included in Regulation SCI? Why or why not? If not, is there a more appropriate approach? If so, what should it be and why?

14. With respect to calculating the proposed thresholds for securities other than NMS stocks (i.e., non-NMS stocks, municipal securities, and corporate debt securities), would ATSs have available appropriate data with which to determine whether the proposed thresholds have been met? FINRA, through its OTC Reporting Facility and its Trade Reporting and Compliance Engine (“TRACE”) facility, collects data on transactions in non-NMS stocks and corporate debt securities, and the MSRB collects data on transactions in municipal securities. Do commenters believe that FINRA, the MSRB, or another appropriate entity should be required to disseminate data in a format and frequency sufficient to enable ATSs to determine if they have met the proposed thresholds? Is there another mechanism or structure that could provide data in a format and frequency sufficient to enable ATSs to determine whether the proposed thresholds have been met? Please explain.

15. Are there ATSs or types of ATSs that would satisfy the proposed definition of SCI ATS that commenters believe should not be subject to proposed Regulation SCI? If so, please explain. Are there ATSs or types of ATSs that would not satisfy the proposed definition of SCI ATS that commenters believe should be subject to proposed Regulation SCI? If so, please explain. For example, should ATSs that execute transactions in U.S. treasuries and/or repurchase agreements be subject to proposed Regulation SCI? Why or why not? If a parent company owns multiple ATSs for a given asset class (e.g., NMS stocks), should the trading volumes of these ATSs be aggregated for purposes of determining whether the ATSs exceed the proposed thresholds? Why or why not? If so, how should such aggregation work? What are the advantages or disadvantages of such an approach? Please explain.

16. Do commenters believe that, for purposes of Regulation SCI, the proposed definition of plan processor is appropriate? Why or why not? Is it appropriate to limit the definition of plan processor to entities within the meaning of plan processor in Rule 600(b)(55) of Regulation NMS? Why or why not? Do commenters believe the proposed definition is sufficiently clear? Are there any other entities similar to the plan processors of SCI Plans that commenters believe should be made subject to the requirements of proposed Regulation SCI? If so, please describe and explain why.

17. Do commenters believe that the proposed definition of “exempt clearing agency subject to ARP” is appropriate? Why or why not? Are there other exempt clearing agencies that should be included in the proposed definition of SCI entity? Why or why not? Is it appropriate to limit the definition of SCI entity with respect to exempt clearing agencies to those with exemptions that contain conditions that relate to the Commission's Automation Review Policies or any Commission regulation that supersedes or replaces such policies? Why or why not?

18. What are the current practices of the proposed SCI entities with respect to the subject matter covered by the ARP policy statements? How many of them have practices that are consistent with ARP? How do they differ? Please be specific.

2. Definition of SCI Systems and SCI Security Systems

The Commission is proposing that Regulation SCI cover the systems of SCI entities, which would include both SCI systems and, where applicable, SCI security systems. Proposed Rule 1000(a) would define the term “SCI systems” to mean “all computer, network, electronic, technical, automated, or similar systems of, or operated by or on behalf of, an SCI entity, whether in production, development, or testing, that directly support trading, clearance and settlement, order routing, market data, regulation, or surveillance,” and the term “SCI security systems” to mean “any systems that share network resources with SCI systems that, if breached, would be reasonably likely to pose a security threat to SCI systems.”

Thus, for purposes of all of the provisions of proposed Regulation SCI, the proposed definition of SCI systems would cover all systems of an SCI entity that directly support trading, clearance and settlement, order routing, market data, regulation, and surveillance. In addition, the proposed definition of SCI security systems is designed to cover other types of systems if they share network resources with SCI systems and, if breached, would be reasonably likely to pose a security threat to SCI systems. Unlike SCI systems, only certain provisions of proposed Regulation SCI would apply to SCI security systems.

The Commission preliminarily believes that the proposed definition of SCI systems would reach those systems traditionally considered to be core to the functioning of the U.S. securities markets, namely trading, clearance and settlement, order routing, market data, regulation, and surveillance systems. The proposed definition would also apply to, for example, such systems of exchange-affiliated routing brokers that are facilities of national securities exchanges or such systems operated on behalf of national securities exchanges. It would also apply to regulatory systems, including systems for the regulation of the over-the-counter market, systems used to carry out regulatory services agreements, and similar future systems, including the Consolidated Audit Trail repository. In addition, if an SCI entity contracts with a third party to operate its systems (such as those that use execution algorithms) on behalf of the SCI entity, such systems would also be covered by the proposed definition of SCI systems if they directly support trading, clearance and settlement, order routing, market data, regulation, or surveillance. Therefore, systems covered by the proposed definition of SCI systems would not be limited only to those owned by the SCI entity, but also could include those operated by or on behalf of the SCI entity.

Based on Commission staff's experience with the ARP Inspection Program, the Commission believes that some SCI systems of SCI entities may in some cases be highly interconnected with SCI security systems because the SCI systems and SCI security systems share network resources. As a result, the Commission is concerned that a security issue or systems intrusion with respect to SCI security systems would be reasonably likely to cause an SCI event with respect to SCI systems. Because certain SCI security systems of an SCI entity may present likely vulnerable entry points to an SCI entity's network, the Commission preliminarily believes that it is important that the provisions of proposed Regulation SCI relating to security standards and systems intrusions apply to SCI security systems.

The proposed definition of SCI security systems does not identify the types of systems that would be covered, but rather describes them in terms of their connectivity and potential ability to undermine the integrity of SCI systems. However, examples of SCI security systems that could be highly interconnected with SCI systems and therefore be reasonably likely to pose a threat to SCI systems may include systems pertaining to corporate operations (e.g., systems that support web-based services, administrative services, electronic filing, email capability and intranet sites, as well as financial and accounting systems) that are typically accessed by an array of users (e.g., employees or executives of the SCI entity) authorized to view non-public information. In certain cases, such systems would likely offer insight into the vulnerabilities of an SCI entity if they were, for example, accessed by a hacker. The Commission is concerned that the breach of such systems would likely lead to disruption of an SCI entity's general operations and, ultimately, its market-related activities. Similarly, systems by which an SCI entity provides a service to issuers, participants, or clients (e.g., transaction services, infrastructure services, and data services) may be accessed by employees or other representatives of the issuer, participant, or client organization, and may, in some instances, provide a point of access (and thus share network resources) to an SCI entity's SCI systems. Accordingly, the Commission is proposing that the term SCI security systems include any systems that share network resources with SCI systems that, if breached, would be reasonably likely to pose a security threat to SCI systems, but only for the limited provisions of proposed Regulation SCI noted above.

In light of the above concerns, the proposed definitions of SCI systems and SCI security systems together are intended to reach all of the systems that would be reasonably likely to impact an SCI entity's operational capability and the maintenance of fair and orderly markets, rather than reaching solely SCI systems. Because of the dependence of today's securities markets on highly sophisticated electronic trading and other technology, including complex regulatory and surveillance systems, as well as systems relating to clearance and settlement, the provision of market data, and order routing, the Commission preliminarily believes that the proposed definitions of SCI systems and SCI security systems are appropriate to help ensure the capacity, integrity, resiliency, availability, and security of an SCI entity's systems.

Request for Comment

19. The Commission requests comment generally on the proposed definitions of SCI systems and SCI security systems.

20. Do commenters believe that the proposed definitions appropriately capture the scope of systems of SCI entities that would be reasonably likely to impact the protection of investors and the maintenance of fair and orderly markets? Specifically, do the proposed definitions of SCI systems and SCI security systems capture the components of the critical systems infrastructure of SCI entities in a comprehensive manner? Are the proposed definitions sufficiently clear?

21. Are there any systems of SCI entities that should be included but would not be captured by the proposed definitions? Please explain. Are there any systems of SCI entities that should be excluded from the proposed definitions? Please explain.

22. By including in the proposed definition of “SCI systems” those systems operated “on behalf of” an SCI entity, systems operated by a third party under contract from an SCI entity and systems operated by affiliates of an SCI entity that are utilized by such SCI entity would also be included in the proposed definition of SCI systems. Do commenters agree that such systems should be included? Please explain. Should the requirements under proposed Regulation SCI apply differently to systems that are operated on behalf of an SCI entity? Why or why not? Please explain.

23. Do commenters agree with the proposal to distinguish between SCI systems and SCI security systems for purposes of triggering the various provisions of proposed Regulation SCI? For example, are the requirements that would apply to SCI security systems appropriate? Why or why not? If not, which requirements of proposed Regulation SCI should apply to SCI security systems and why? Should the requirements under proposed Regulation SCI apply differently to different types of systems, as proposed? Or, should SCI security systems be subject to all of the requirements of proposed Regulation SCI? Why or why not?

24. Alternatively, should SCI security systems be excluded entirely from the application of proposed Regulation SCI? Why or why not? The Commission is proposing its approach to distinguish between SCI systems and SCI security systems because it preliminarily believes that the interconnected nature of technology infrastructure today creates the potential for systems other than SCI systems to expose vulnerable points of entry that could lead to a security breach or intrusion into SCI systems. In light of this potential, the Commission is proposing, as discussed further below, that the following provisions of proposed Regulation SCI apply to the SCI security systems of an SCI entity: (1) For purposes only of the policies and procedures relating to systems security, proposed Rule 1000(b)(1) would apply to its SCI security systems; (2) proposed Rules 1000(b)(3)-(5) (relating to SCI events and taking corrective action, Commission notification, and dissemination of information to members or participants, respectively) would apply to SCI security systems only with respect to systems intrusions; and (3) proposed Rule 1000(b)(6) would require an SCI entity to report a material systems change in a SCI security system only to the extent that it materially affects the security of such system.

25. The goal of this proposed approach is to ensure that SCI systems, as the core systems of an SCI entity, are adequately secure and protected from systems intrusions. However, the Commission recognizes that there may be alternative ways to achieve this goal, including those that do not extend the scope of the proposed rule beyond the core systems that are defined as “SCI systems,” and that focus the Commission's oversight on those systems. For example, one alternative would be to limit the scope of the proposed rule to SCI systems, but clarify that policies and procedures reasonably designed to ensure that SCI systems have adequate levels of security necessarily would require an assessment of security vulnerabilities created by other systems that share network resources with SCI systems, and appropriate steps to address those vulnerabilities. Specifically, under such an alternative, the defined term “SCI security systems,” and all references to them and any associated obligations, would be eliminated from the proposed rule text described herein, and clarifying guidance would be provided with respect to the security of SCI systems as noted above. With such an alternative, consideration also would need to be given to whether or not an SCI entity should notify the Commission (and potentially its members or participants) of a systems intrusion with respect to these non-SCI systems, or a systems change that materially impacts the security of such systems. Accordingly, the Commission solicits commenters' views on this or any other potential alternative approaches that would not include a definition of SCI security systems within the scope of the proposed rule.

26. If the Commission were to determine to eliminate the proposed definition of SCI security systems from proposed Regulation SCI, what would be the likely effect of such elimination on the ability of proposed Regulation SCI to ensure that SCI systems are adequately secure and protected from systems intrusions? Please explain. Specifically, if the Commission eliminated the proposed definition of SCI security systems from proposed Regulation SCI, and its direct oversight of systems that share network resources with SCI systems, would the Commission's ability to assure adequate security for SCI systems be materially weakened? Why or why not? Would such an alternative reduce compliance burdens for SCI entities, and improve the efficiency of Commission oversight without materially undermining its effectiveness?

27. If the Commission were to determine to eliminate the proposed definition of SCI security systems from proposed Regulation SCI, would it be appropriate, for example, for the Commission to interpret the requirement of proposed Rule 1000(b)(1) that would require an SCI entity to have “policies and procedures reasonably designed to ensure that its SCI systems have levels of * * * security * * * adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets” to require that an SCI entity's SCI systems be protected from security threats by other systems with which they share network resources? Why or why not? Please explain.

28. If the Commission were to determine to eliminate the proposed definition of SCI security systems from proposed Regulation SCI, should the Commission still require an SCI entity to report to the Commission an intrusion into any system (and not just SCI systems) of an SCI entity? Why or why not? If the Commission were to determine to eliminate the proposed definition of SCI security systems from proposed Regulation SCI, should the Commission require an SCI entity to notify members and participants of an intrusion into any system of an SCI entity? Why or why not? If the Commission were to determine to eliminate the proposed definition of SCI security systems from proposed Regulation SCI, are there any other changes to the rule that would be appropriate? What are they, and why would they be appropriate? Please describe in detail.

3. SCI Events

Pursuant to the current ARP policy statements and Regulation ATS, a key element of the ARP Inspection Program has been to encourage ARP participants to notify Commission staff of significant systems disruptions so that the staff can work with the affected entity to help ensure that the disruption is addressed promptly and effectively, and that appropriate steps are taken to reduce the likelihood of future problems. Commission staff has previously sought to provide guidance and clarification on what should be considered a “significant system outage” for purposes of reports to Commission staff. Specifically, in the 2001 Staff ARP Interpretive Letter, Commission staff provided examples of situations for which an outage is deemed significant and thus should be reported. The examples listed in that letter included: (1) Outages resulting in a failure to maintain any service level agreements or constraints; (2) disruptions of normal operations, e.g., switchover to back-up equipment with zero hope of near-term recovery of primary hardware; (3) the loss of use of any system; (4) the loss of transactions; (5) outages resulting in excessive back-ups or delays in processing; (6) the loss of ability to disseminate vital information; (7) outage situations communicated to other external entities; (8) events that are (or will be) reported or referred to the entity's board of directors or senior management; (9) events that threaten systems operations even though systems operations are not disrupted; for example, events that cause the entity to implement a contingency plan; and (10) the queuing of data between system components or queuing of messages to or from customers of such duration that a customer's usual and customary service delivery is affected.

The Commission believes that guidance in the 2001 Staff ARP Interpretive Letter regarding what constitutes a significant systems outage has been useful over the years to the entities that received the 2001 Staff ARP Interpretive Letter, but understands that Commission action in this area would help SROs and other entities by providing definitive guidance through a formal rulemaking process that includes notice and comment. Furthermore, the Commission believes the term “significant systems outage” in plain usage denotes a category of systems problems that is considerably narrower than those the Commission believes could pose risks to the securities markets and market participants. Therefore, the Commission proposes to specify the types of events that would be required to be reported to the Commission and the types of systems problems that would trigger notice requirements on the part of an SCI entity. Specifically, the Commission is proposing to define the term “SCI event” in Rule 1000(a) as “an event at an SCI entity that constitutes: (1) A systems disruption; (2) a systems compliance issue; or (3) a systems intrusion.” As discussed in detail below, the proposed rule would define each of these terms used in the proposed definition of SCI event.

a. Systems Disruption

The Commission proposes that the term “systems disruption” be defined to mean “an event in an SCI entity's SCI systems that results in: (1) A failure to maintain service level agreements or constraints; (2) a disruption of normal operations, including switchover to back-up equipment with near-term recovery of primary hardware unlikely; (3) a loss of use of any such system; (4) a loss of transaction or clearance and settlement data; (5) significant back-ups or delays in processing; (6) a significant diminution of ability to disseminate timely and accurate market data; or (7) a queuing of data between system components or queuing of messages to or from customers of such duration that normal service delivery is affected.” The proposed definition is similar, but not identical, to the definition of “significant systems outage” in the 2001 Staff ARP Interpretive Letter.

As proposed, a systems disruption would be an event in an SCI entity's SCI systems that manifests itself as a problem measured by reference to one or more of seven elements. The first proposed element, a failure to maintain service level agreements or constraints, is unchanged from the 2001 Staff ARP Interpretive Letter. This would include, for example, a failure or inability of the SCI entity to honor its contractual obligations to provide a specified level or speed of service to users of its SCI systems. A trading market could, for example, contract to maintain its trading system without delays over a specific threshold, e.g., 100 milliseconds, and its failure to honor that obligation would thus be a systems disruption.

The second proposed element, “a disruption of normal operations, including switchover to back-up equipment with near-term recovery of primary hardware unlikely” differs from the element in the 2001 Staff ARP Interpretive Letter (disruption of normal operations, e.g., switchover to back-up equipment with zero hope of near-term recovery of primary hardware). This modification is intended to convey that the Commission preliminarily believes that an SCI entity should be required to notify Commission staff of a SCI systems problem that involves a switchover to backup equipment, even if a determination that no recovery is possible has not been made because the probability that such switchover may continue indefinitely is significant. The Commission also intends that this proposed element, a “disruption of normal operations,” would capture problems with SCI systems such as programming errors, testing errors, systems failures, or if a system release is backed out after it is implemented in production.

The third proposed element, “a loss of use of any such system,” is unchanged from the 2001 Staff ARP Interpretive Letter and would cover situations in which an SCI system is broken, offline, or otherwise out of commission. For example, the Commission intends that a failure of primary trading or clearance and settlement systems, even if immediately replaced by backup systems without any disruption to normal operations, would be covered under this third proposed element. The Commission preliminarily believes the language of the fourth proposed element, “a loss of transaction or clearance and settlement data,” is more precise than the language in the 2001 Staff ARP Interpretive Letter, which lists “loss of transactions” as an example of a systems outage.

Similarly, the language of the fifth and sixth proposed elements is intended to be more precise than the comparable language in the fifth and sixth examples enumerated in the 2001 Staff ARP Interpretive Letter. The Commission is not at this time proposing to quantify what would constitute a “significant back-up or delay in processing” or a “significant diminution of ability to disseminate timely and accurate market data” because it preliminarily believes that the varying circumstances that could give rise to such events, and the range of SCI systems potentially impacted, make precise quantification impractical. These proposed elements are intended to include, for example, circumstances in which a problem with an SCI system results in a slowdown or disruption of operations that would adversely affect customers, impair quotation or price transparency, or impair accurate and timely regulatory reporting. Instances in which message traffic is throttled (i.e., slowed) by an SCI entity for any market participant, without a corresponding provision in the SCI entity's rules, user agreements, or governing documents, as applicable, would also be covered here. Further, the Commission preliminarily believes that if customers or systems users, for example, have complained or inquired about a slowdown or disruption of operations, including, for example, a slowdown or disruption in their receipt of market data, then such circumstance would be indicative of a problem at an SCI entity that results in “significant back-ups or delays in processing” or a “significant diminution of ability to disseminate timely and accurate market data,” that should be considered a “systems disruption.” The fifth and sixth elements of the proposed definition of systems disruption are also intended to cover the entry, processing, or transmission of erroneous or inaccurate orders, trades, price-reports, other information in the securities markets or clearance and settlement systems, or any other significant deterioration in the transmission of market data in an accurate, timely, and efficient manner. For example, it is possible that an SCI system of an SCI entity that disseminates market data could, as a result of a programming or testing error in another system of the SCI entity, be overwhelmed with erroneous market data to such an extent that the SCI entity's SCI systems are no longer able to disseminate market data in a timely and accurate manner.

Finally, the seventh proposed element, “a queuing of data between system components or queuing of messages to or from customers of such duration that normal service delivery is affected,” is proposed to be included because the Commission preliminarily believes that queuing of data between system components of SCI systems is often a warning signal of significant disruption of normal system operations.

Although the 2001 Staff ARP Interpretive Letter lists “a report or referral of an event to the entity's board of directors or senior management” and “an outage situation communicated to other external entities” as examples of a significant systems outage, the Commission is not proposing to include such reports or communications in the definition of systems disruption because it preliminarily believes these examples are more likely to be indicia of whether information about a systems disruption or other systems problem warrants dissemination to the SCI entity's members or participants. Further, although the 2001 Staff ARP Interpretive Letter lists “a serious threat to systems operations even though systems operations are not disrupted” as an example of a significant systems outage, the Commission has not included that example as an element in the proposed definition of systems disruption because it preliminarily believes that such a threat would more likely be indicative of a systems intrusion or systems compliance issue.

Request for Comment

29. The Commission requests comment generally on the proposed definition of “systems disruption.” Do commenters believe that it is appropriate to limit the proposed definition of “systems disruption” to SCI systems? Why or why not? Do commenters believe the proposed definition of “systems disruption” is too broad? Why or why not? Please explain.

30. Do commenters believe that there should be minimum thresholds associated with the circumstances specified in any elements of the proposed definition of systems disruption—e.g., quantitative criteria describing when an event fitting the description of one of the elements of the proposed definition would meet the definition of SCI event? If so, what should such minimum thresholds be and to which elements of the definition of “systems disruption” should such minimum thresholds apply? Please explain. Should systems disruptions affecting different types of SCI systems be treated differently? For example, should trading systems have a different quantitative criteria than systems dedicated to surveillance? Please be specific with respect to which categories of SCI systems might deserve different treatment, and what such quantitative criteria might be and why.

31. Do commenters believe the term “transaction or clearance and settlement data,” as used in paragraph (4) of the proposed definition of “systems disruption,” is appropriate? Why or why not? Should other types of data be included, in addition to transaction and clearance and settlement data? For example, should customer account data, regulatory data, and/or audit trail data be included? Why or why not?

32. Do commenters believe that there should be exceptions to the proposed definition of systems disruption? If so, what should such exceptions be and why? For example, should the proposed definition of systems disruption include a de minimis exception? If so, what types of systems problems should be considered de minimis and what criteria should be used to determine whether a systems problem is de minimis? Should the proposed definition of systems disruption include a materiality threshold? If so, what types of systems problems should be considered material and what criteria should be used to determine whether a systems problem is material? Should the definition of systems disruption exclude regular planned outages occurring during the normal course of business?

33. Should the proposed definition be expanded, narrowed, or otherwise modified in any way? For example, should the proposed definition include quantitative criteria that establish a minimum deviation from normal performance levels, such as a tenfold increase or greater in latency for queuing of data, for an event to be considered an SCI event? Would a minimum deviation of 100 milliseconds from normal system performance levels be an appropriate indication of system degradation? Or, would a larger or smaller deviation be more appropriate? Why or why not? For example, would the choice of a specific threshold help to balance the tradeoff between the costs of over-reporting systems disruptions and the costs of failing to report systems disruptions that could lead to significant negative consequences? Should different quantitative criteria be used across different SCI systems? For example, a limited pause in the operations of a clearing system may not raise the same issues as a similar pause in the operation of a market data feed. If commenters believe that different criteria should be maintained, please be specific and provide examples of what the appropriate minimum deviations should be for such systems.

34. Are there other types of circumstances that should be included that are not part of the proposed definition? If so, please describe and explain. For example, if an SCI SRO or SCI ATS suspects a technology error originating from a third party (such as an SCI SRO's member firm or an SCI ATS's subscriber) that has the potential to disrupt the market, should that type of discovery be included in the definition of systems disruption? Why or why not? Is there additional guidance that commenters would find helpful to determine whether an event would meet the proposed definition of systems disruption?

35. How often do SCI entities currently experience systems disruptions?

b. Systems Compliance Issue

The Commission proposes that the term “systems compliance issue” be defined as “an event at an SCI entity that has caused any SCI system of such entity to operate in a manner that does not comply with the federal securities laws and rules and regulations thereunder or the entity's rules or governing documents, as applicable.” Circumstances covered by the proposed definition would include, for example, situations in which a lack of communication between an SCI SRO's information technology staff and its legal or regulatory staff regarding SCI systems design or requisite regulatory approvals resulted in one or more SCI systems operating in a manner not in compliance with the SCI SRO's rules and, thus, in a manner other than how the users of the SCI SRO's SCI systems, as well as market participants generally, have been informed that such systems would operate. Another example of a systems compliance issue could arise when a change to an SCI system is made by information technology staff that results in the system operating in a manner that fails to comply with the federal securities laws and rules thereunder.

The phrase “operate in a manner that does not comply with * * * the entity's rules or governing documents” would mean that an SCI entity is operating in a manner that does not comply with the entity's applicable rules and other documents, whether or not filed with the Commission. Generally, such rules or other documents are made available to the public and/or to members, clients, users, and/or participants in the SCI entity. Specifically, for an SCI SRO, this phrase would include operating in a manner that does not comply with the SCI SRO's rules as defined in the Exchange Act and the rules thereunder. For a plan processor, this phrase would include operating in a manner that does not comply with an applicable effective national market system plan. For an SCI ATS or exempt clearing agency subject to ARP, this phrase would include operating in a manner that does not comply with documents such as subscriber agreements and any rules provided to subscribers and users and, for ATSs, described in their Form ATS filings with the Commission.

Request for Comment

36. The Commission requests comment generally on the proposed definition of “systems compliance issue.” Do commenters believe it would be appropriate to define “systems compliance issue” to mean any instance in which an SCI system operates in a manner that does not comply with the federal securities laws and rules and regulations thereunder, or the entity's rules or governing documents, as applicable? Why or why not? If the proposed definition is not appropriate, what would be an appropriate definition? Do commenters believe that it is appropriate to limit the proposed definition of “systems compliance issue” to SCI systems? Why or why not? Please explain.

37. Do commenters believe that there should be exceptions to the proposed definition of systems compliance issue? If so, what should such exceptions be and why? For example, should the proposed definition of systems compliance issue include a de minimis exception? If so, what types of systems compliance issues should be considered de minimis and what criteria should be used to determine whether a systems compliance issue is de minimis? Should the proposed definition of systems compliance issue include a materiality threshold? If so, what types of systems compliance issues should be considered material and what criteria should be used to determine whether a systems compliance issue is material?

38. Do commenters believe other types of documents or agreements should be included in the definition? If so, please specify the types of documents or agreements and explain why.

39. How often do SCI entities currently experience systems compliance issues?

c. Systems Intrusion

The Commission proposes that “systems intrusion” be defined as “any unauthorized entry into the SCI systems or SCI security systems of an SCI entity.” The proposed definition is intended to cover all unauthorized entry into SCI systems or SCI security systems by outsiders, employees, or agents of the SCI entity, regardless of whether the intrusions were part of a cyber attack, potential criminal activity, or other unauthorized attempt to retrieve, manipulate or destroy data, or access or disrupt systems of SCI entities. The proposed definition of systems intrusion would cover the introduction of malware or other attempts to disrupt SCI systems or SCI security systems of SCI entities provided that such systems were actually breached. In addition, the proposed definition is intended to cover unauthorized access, whether intentional or inadvertent, by employees or agents of the SCI entity that result from weaknesses in the SCI entity's access controls and/or procedures. The proposed definition would not, however, cover unsuccessful attempts at unauthorized entry. An unsuccessful systems intrusion by definition is much less likely than a successful intrusion to disrupt the systems of an SCI entity. Moreover, because it is impossible to prevent attempted intrusions, the Commission preliminarily believes at this time that the focus of this aspect of proposed Regulation SCI should be on successful unauthorized entry.

Request for Comment

40. The Commission requests comment generally on the proposed definition of “systems intrusion.” Is the proposed definition sufficiently clear? If not, why not? Do commenters believe that it is appropriate to apply the proposed definition of “systems intrusion” to both SCI systems and SCI security systems? Why or why not? Please explain.

41. Do commenters believe it is appropriate to exclude from the proposed definition of systems intrusion an attempted intrusion that did not breach systems or networks? Why or why not? Should significant, sophisticated, repeated, and/or attempted intrusions, even if unsuccessful, be included? Why or why not? If yes, please explain what categories of attempted intrusions should be covered by the proposed rule and why.

42. Should the proposed definition of systems intrusion be expanded to include the unauthorized use or unintended release of information or data, for example, by an employee or agent of an SCI entity? Why or why not? If so, should the definition be limited to the unauthorized use of non-public or confidential information or should it apply to any unauthorized use of information or data? The Commission recognizes that including in the definition all instances of unauthorized use or unintended release of information or data may be broad and solicits comment generally on how the definition might be more narrowly defined to encompass those types of events that commenters believe would be appropriate to be included in proposed Regulation SCI.

43. How often do SCI entities currently experience known systems intrusions or known attempted systems intrusions?

d. Dissemination SCI events

The Commission proposes that the term “dissemination SCI event” be defined as “an SCI event that is a: (1) Systems compliance issue; (2) systems intrusion; or (3) systems disruption that results, or the SCI entity reasonably estimates would result, in significant harm or loss to market participants.”

As discussed below in Section III.C.3, proposed Rule 1000(b)(5) includes requirements for disseminating information regarding certain SCI events to members or participants. Specifically, only information relating to dissemination SCI events would be required to be disseminated to members or participants pursuant to proposed Rule 1000(b)(5). The Commission recognizes that public disclosure of each and every systems issue (such as very brief outages or minor disruptions of normal systems operations where the effects on trading, market data, and clearance and settlement are immaterial) could be counterproductive, potentially overwhelming the public with information, masking significant issues that might arise, and thus preliminarily believes that requiring the dissemination of information about dissemination SCI events to members or participants would promote dissemination of information to persons who are most directly affected by such events and who would most naturally need, want, and be able to act on the information, without creating a separate regulatory standard governing when broader public disclosure should be made.

In the case of a dissemination SCI event, the Commission preliminarily believes that dissemination to members or participants of the nature of the event and the steps being taken to remedy it would be necessary to help ensure that potentially impacted market participants, and others that might be evaluating whether to use the affected systems, have basic information about the event so that they might be able to better assess what, if any, next steps they might deem prudent to take in light of the event.

Proposed Rule 1000(a) specifies three categories of SCI events that would constitute a dissemination SCI event. First, any SCI event that is a systems compliance issue would be a dissemination SCI event. The Commission preliminarily believes that, if an SCI entity's SCI systems were operating in a manner not in compliance with the federal securities laws and rules and regulations thereunder, or the entity's rules or governing documents, as applicable, the SCI entity should be required to disseminate that information to all members or participants, i.e., the users of its SCI systems. In addition, because SCI entities that are SCI SROs or plan processors are required by the Exchange Act to comply with their rules, proposing to require dissemination of information about systems compliance issues to members or participants should help to reinforce this statutory obligation.

Second, any SCI event that is a systems intrusion would also be a dissemination SCI event. The Commission preliminarily believes that a systems intrusion may represent a significant weakness in the security of an SCI entity's systems and thus warrant dissemination of information to an SCI entity's members or participants. However, because detailed information about a systems intrusion may expose an SCI entity's systems to further probing and attack, an SCI entity would only be required to provide a summary description of the systems intrusion, including a description of the corrective action taken by the SCI entity and when the systems intrusion has been or is expected to be resolved. In addition, because immediate dissemination of information about a systems intrusion may in some cases further compromise the security of the SCI entity's SCI systems or SCI security systems, or an investigation of the systems intrusion, an SCI entity in some cases may be permitted to delay the dissemination of information about such systems intrusion.

Finally, the Commission is proposing that any systems disruption that results, or the SCI entity reasonably estimates would result, in significant harm or loss to market participants would also be a dissemination SCI event. Some systems disruptions may have an immediate, obvious, and detrimental impact on market participants, hampering the ability of an SCI entity's members or participants to utilize the SCI entity's SCI systems and, in some cases, making such systems unusable. At the same time, the Commission recognizes that disseminating information relating to a single systems disruption that results in harm or loss to one or a small number of market participants that is not significant may not warrant the cost of such dissemination. Furthermore, the Commission preliminarily believes that the proposed standard is appropriate in that it does not set a specific threshold or definition of “significant harm or loss to market participants,” and provides an SCI entity with reasonable discretion in estimating whether a given systems disruption has resulted, or would result, in significant harm or loss to market participants. Although the particular facts and circumstances will differ for each systems disruption, some systems disruptions would clearly result in significant harm or loss to market participants and warrant dissemination of information regarding such systems disruption to the SCI entity's members or participants, even if the harm or loss, or the potential harm or loss, is difficult to quantify. For example, if a market experiences a problem with a trading system such that order processing and execution in certain securities is halted and members are not able to confirm transactions in such securities, the Commission preliminarily believes that such a systems disruption would be a dissemination SCI event. In contrast, if a trading market or a clearing agency experienced a momentary power disruption causing a fail over to the backup data center with no customer, member, or participant impact, such SCI event would be a systems disruption requiring written notice to the Commission, but would not be a dissemination SCI event.

Request for Comment

44. Do commenters believe the proposed definition of “dissemination SCI event” is appropriate? Why or why not?

45. Do commenters believe that a “systems compliance issue” should constitute a dissemination SCI event? Why or why not? Please explain.

46. Do commenters believe that a “systems intrusion” should constitute a dissemination SCI event? Why or why not? Please explain.

47. Do commenters believe that systems disruptions that meet the “significant harm or loss to market participants” standard should be included as dissemination SCI events? Why or why not? If not, what would be an appropriate threshold, and how should it be measured? Should the term “significant harm or loss to market participants” be further clarified or defined in the rule? Why or why not? If so, what should such clarification or definition be and why?

48. Would an alternative measurement, or group of alternative measurements, for systems disruptions, such as a 50 millisecond pause in service or some other nonmonetary measure (for example, out of memory situations, memory overloads, data loss due to an SCI system exceeding capacity limitations, excessive queuing or throttling), also be an appropriate and effective means to measure certain events about which an SCI entity should disseminate information to its members or participants? If so, what are they and why? Should any such measurements vary based on the type of SCI system involved? If so, how? Please be specific.

49. Are there any other types of systems disruptions that should be required to be disseminated to members or participants? If so, please explain why. Should, for example, information relating to a systems disruptions be required to be disseminated to members or participants if it affects a certain number of market participants? If so, how should such a level (number of market participants) be determined?

4. Material Systems Changes

Rule 1000(a) of proposed Regulation SCI would define “material systems change” as “a change to one or more: (1) SCI systems of an SCI entity that: (i) Materially affects the existing capacity, integrity, resiliency, availability, or security of such systems; (ii) relies upon materially new or different technology; (iii) provides a new material service or material function; or (iv) otherwise materially affects the operations of the SCI entity; or (2) SCI security systems of an SCI entity that materially affects the existing security of such systems.” This proposed definition of “material systems change” is substantively similar to the definition of “significant system change” discussed in the ARP II Release.

Item (1)(i) of the proposed definition of material systems change differs from item (1) in the definition in the ARP II Release of “significant system change,” as proposed item (1)(i) refers to changes to an SCI entity's SCI systems that affect not only capacity and security, but also integrity, resiliency, and availability. Items (1)(ii) and (1)(iii) in the proposed definition of material systems change are intended to be substantively identical to items (3) and (4) of the definition of significant system change in the 2001 Staff ARP Interpretive Letter, generally covering changes to an SCI entity's SCI systems designed to advance systems development. Proposed item (1)(iv), covering a change to an SCI entity's SCI systems that “otherwise materially affects the operations of the SCI entity,” is intended to require notification of major systems changes to SCI systems that are not captured by other elements of paragraph (1) of the proposed definition. Proposed item (2), covering a change to an SCI entity's SCI security systems that “materially affects the existing security of such systems,” is intended to ensure that significant changes that would affect the security of an SCI entity's SCI security systems (i.e., systems that share network resources with SCI systems that, if breached, would be reasonably likely to pose a security threat to SCI systems) are reported to the Commission.

Examples that the Commission preliminarily believes could be included within the proposed definition of material systems change are: Major systems architecture changes; reconfigurations of systems that would cause a variance greater than five percent in throughput or storage; the introduction of new business functions or services; changes to external interfaces; changes that could increase susceptibility to major outages; changes that could increase risks to data security; changes that were, or would be, reported to or referred to the entity's board of directors, a body performing a function similar to the board of directors, or senior management; and changes that could require allocation or use of significant resources. These examples are cited in the 2001 Staff ARP Interpretive Letter. Based on Commission staff's experience working with SROs that have relied on the guidance provided in the 2001 Staff ARP Interpretive Letter, the Commission preliminarily believes that such examples could continue to be relevant guidance to SCI SROs as well as to other SCI entities. In addition, the Commission preliminarily believes that any systems change occurring as a result of the discovery of an actual or potential systems compliance issue, as that term would be defined in proposed Rule 1000(a), would be material.

Based on its experience with SROs and other entities reporting significant systems changes in the context of the ARP Inspection Program, the Commission preliminarily believes that the proposed definition of material systems change is appropriate for all SCI entities. The Commission preliminarily believes that proposed items (1)(i)-(iv) and (2), which would cover changes affecting capacity estimates, security measures, the use of new technology and new functionality, could also highlight the need for SCI entities that are SROs, when applicable, to file a proposed rule change with the Commission under Section 19(b) of the Exchange Act and SCI entities that are SROs to file proposed amendments for SCI Plans under Rule 608 of Regulation NMS. As the Commission noted in ARP II, the purpose of urging SROs to notify Commission staff of significant system changes was not to supplant or provide an alternative means for SROs to satisfy their obligations to file proposed rule changes as required by the Exchange Act. Rather, under ARP II, the Commission was primarily concerned with fulfilling its oversight responsibilities and was also interested in obtaining a full view and understanding of systems development at SROs. Likewise, the proposal to require an SCI entity to notify the Commission of material systems changes would not relieve an SCI SRO of any obligation it may have to file a proposed rule change, the participants of an SCI Plan to file a proposed amendment to such SCI Plan, or any other obligation any SCI entity may have under the Exchange Act or rules thereunder.

Request for Comment

50. The Commission requests comment generally on the proposed definition of “material systems change.” Is the proposed definition of material systems change clear? Should the Commission provide additional guidance on, or further define what would constitute a “material systems change?” Are there other factors that should be included? Please be specific and give examples of types of system changes that should be included in the proposed definition but currently are not.

51. The Commission sets forth above examples of systems changes that it preliminarily believes could be included within the proposed definition of material systems change (i.e., major systems architecture changes; reconfigurations of systems that would cause a variance greater than five percent in throughput or storage; the introduction of new business functions or services; changes to external interfaces; changes that could increase susceptibility to major outages; changes that could increase risks to data security; changes that were, or would be, reported to or referred to the entity's board of directors, a body performing a function similar to the board of directors, or senior management; and changes that could require allocation or use of significant resources). Do commenters agree each of these examples could constitute material systems changes? Why or why not?

52. Should any of the proposed factors be eliminated or refined? If so, please explain. Should material systems changes be defined to include cumulative systems changes over a specified period that might not otherwise qualify individually as a material systems change? For example, if systems changes (such as reconfigurations of systems that would cause a variance greater than five percent in throughput or storage) occurred that, on their own, each would not constitute a material systems change but, if grouped together with other similar or even identical changes (or, alternatively, that occurred repeatedly over a certain period of time such as a week or a month) could represent a material system change, should such changes together be considered a material systems change? If so, what would be the appropriate number of similar or identical systems changes that should be considered and/or what would be an appropriate time period to consider? Should all non-material systems changes count towards this threshold or should only non-material systems changes of the same or similar type count? Would cumulative changes over a week be an appropriate measurement period? Would a 30-day measurement period be appropriate? Should the period be longer or shorter? Please explain.

53. Do commenters believe that a change to the SCI systems of an SCI entity that “materially affects the existing capacity, integrity, resiliency, availability, or security of such systems” should constitute a material systems change as proposed? Why or why not? Should a change with respect to any of the proposed characteristics of such systems (i.e., capacity, integrity, resiliency, availability, or security) be eliminated or modified? Should any be added? Please explain.

54. Should a change to the SCI systems of an SCI entity that “relies upon materially new or different technology” constitute a material systems change as proposed? Why or why not? Is the phrase “materially new or different” sufficiently clear? If not, please explain.

55. Should a change to an SCI entity's SCI systems that “provides a new material service or material function” constitute a material systems change as proposed? Why or why not? Is the phrase “a new material service or material function” sufficiently clear? If not, please explain.

56. Do commenters believe it is appropriate to include a change to an SCI entity's SCI systems that “otherwise materially affects the operations of the SCI entity” as proposed? Why or why not? Please explain.

57. Do commenters believe that a change to the SCI security systems of an SCI entity that “materially affects the existing security of such systems” should constitute a material systems change as proposed? Why or why not? Please explain.

58. Do commenters believe the rule should include quantitative criteria or other minimum thresholds for the effect of a change to an SCI entity's SCI systems or SCI security systems beyond which the Commission must be notified of the change? Why or why not? If so, what should such quantitative criteria or other minimum thresholds be and why?

59. How often do SCI entities currently make material systems changes? How often do SCI SROs make material systems changes and what percentage of the time are such changes filed with the Commission as proposed rule changes under Section 19 of the Exchange Act?

C. Proposed Rule 1000(b): Obligations of SCI Entities

Paragraph (b) of proposed Rule 1000 would set forth requirements that would apply to SCI entities relating to written policies and procedures, obligations with regard to corrective actions, reporting of SCI events to the Commission, dissemination of information relating to certain SCI events to members or participants, reporting of material systems changes, SCI reviews, and the participation of designated members or participants of SCI entities in testing the business continuity and disaster recovery plans of SCI entities.

1. Policies and Procedures To Safeguard Capacity, Integrity, Resiliency, Availability, and Security

Proposed Rule 1000(b)(1) would require each SCI entity to establish, maintain, and enforce written policies and procedures, reasonably designed to ensure that its SCI systems and, for purposes of security standards, SCI security systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets. Proposed Rule 1000(b)(1)(i) would further provide that such policies and procedures include, at a minimum: “(A) The establishment of reasonable current and future capacity planning estimates; (B) periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner; (C) a program to review and keep current systems development and testing methodology for such systems; (D) regular reviews and testing of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters; (E) business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse to ensure next business day resumption of trading and two-hour resumption of clearance and settlement services following a wide-scale disruption; and (F) standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data.” Proposed Rule 1000(b)(1)(ii) would deem an SCI entity's policies and procedures required by proposed Rule 1000(b)(1) to be reasonably designed if they are consistent with SCI industry standards. In particular, for purposes of complying with proposed Rule 1000(b)(1), if an SCI entity has policies and procedures that are consistent with such SCI industry standards, as discussed further in Section III.C.1.b below, such policies and procedures would be deemed to be reasonably designed and thus the SCI entity would be in compliance with proposed Rule 1000(b)(1). In addition, under proposed Rule 1000(b)(1)(ii), compliance with the identified SCI industry standards would not be the exclusive means to comply with the requirements of proposed Rule 1000(b)(1).

a. Proposed Rule 1000(b)(1)(i)

Proposed Rule 1000(b)(1) would require that an SCI entity have policies and procedures that address items (i)(A)-(F) for its SCI systems and, for purposes of security standards, SCI security systems. Items (A)-(C) enumerated in proposed Rule 1000(b)(1)(i) are substantively the same as the requirements of Rule 301(b)(6)(ii)(A)-(C) of Regulation ATS, applicable to significant-volume alternative trading systems, and trace their origin to the ARP I Release. With respect to SCI systems and, as applicable, SCI security systems, proposed item (A), which would require an SCI entity to establish, maintain, and enforce policies and procedures for the establishment of reasonable current and future capacity planning estimates, and proposed item (B), which would require an SCI entity to establish, maintain, and enforce policies and procedures for periodic capacity stress tests of such systems, would help an SCI entity determine its systems' ability to process transactions in an accurate, timely, and efficient manner, and thereby help ensure market integrity. Proposed item (C), which would require an SCI entity to establish, maintain, and enforce policies and procedures that include a program to review and keep current systems development and testing methodology for such systems, would help ensure that the SCI entity continues to monitor and maintain systems capacity and availability.

Proposed item (D), which would require an SCI entity to establish, maintain, and enforce policies and procedures to review and test regularly such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters, would likewise assist an SCI entity in ascertaining whether its SCI systems and SCI security systems are and remain sufficiently secure and resilient. Unlike Rule 301(b)(6)(ii)(D) of Regulation ATS, proposed item (D) includes “manmade disasters” in the list of vulnerabilities an SCI entity would be required to consider and protect against. The Commission proposes to add “manmade disasters” to be clear that acts of terrorism and sabotage—threats that some SCI entities have faced in recent history —are threats that an SCI entity must prepare for in reviewing and testing its systems and operations.

Proposed items (B), (C), and (D) would each require, among other things, the establishment of policies and procedures relating to various aspects of systems testing, including capacity stress tests, testing methodology, and tests for systems vulnerabilities to internal and external threats, physical hazards, and natural or manmade disasters, respectively. The Commission preliminarily believes that, to help ensure an effective testing regime, such policies and procedures would need to address when testing with members, participants, and other market participants would be appropriate.

Proposed item (E), which would require SCI entities to establish, maintain, and enforce policies and procedures for business continuity and disaster recovery plans, is substantially similar to a requirement in Rule 301(b)(6)(ii) of Regulation ATS and ARP I. However, proposed item (E) would further require SCI entities to have plans for maintaining backup and recovery capabilities sufficiently resilient and geographically diverse to ensure next business day resumption of trading and two-hour resumption of clearance and settlement services following a wide-scale disruption. The proposed resiliency and geographic diversity requirement is designed particularly to help ensure that an SCI entity would be able to continue operations from the backup site during a wide-scale disruption resulting from natural disasters, terrorist activity, or other significant events. For example, the Commission preliminarily believes that backup sites should not rely on the same infrastructure components (e.g., transportation, telecommunications, water supply, and electric power) used by the primary site. The proposed next business day trading resumption standard reflects the Commission's preliminary view that an SCI entity, being part of the critical infrastructure of the U.S. securities markets, should have plans to limit downtime caused by a wide-scale disruption to less than one business day. Likewise, the proposed two-hour resumption standard for clearance and settlement services, which traces its origin to the 2003 Interagency White Paper, reflects the Commission's preliminary view that an SCI entity that is a registered clearing agency or an “exempt clearing agency subject to ARP” should have contingency plans to avoid a scenario in which failure to settle transactions by the end of the day could present systemic risk to the markets.

Proposed item (F) would require SCI entities to have standards that result in systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data. As the Commission previously noted, when Congress mandated a national market system in 1975, it emphasized that the systems for collecting and distributing consolidated market data would “form the heart of the national market system.” As a result of consolidated market data, the public has ready access to a comprehensive, accurate, and reliable source of information for the prices and volume of any NMS stock at any time during the trading day. This information helps to ensure that the public is aware of the best displayed prices for a stock, no matter where they may arise in the national market system. It also enables investors to monitor the prices at which their orders are executed and assess whether their orders received best execution. Further, as noted above, one of the findings of the May 6 Staff Report is that “fair and orderly markets require that the standards for robust, accessible, and timely market data be set quite high.” The Commission believes that the accurate, timely and efficient processing of data is similarly important to the proper functioning of the securities markets. For example, if a clearing agency were not able to process data accurately, settlements could potentially be impacted. Similarly, if an exchange does not process trades accurately, erroneous executions could occur.

Consistent with these goals and Congress's statement, proposed item (F) would be a new requirement that has no precedent in either Rule 301(b)(6) of Regulation ATS or the ARP policy statements and would require SCI entities to have “standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data.” The Commission preliminarily believes that proposed item (F) would assist an SCI entity in ensuring that its market data systems are designed to maintain market integrity.

b. Proposed Rule 1000(b)(1)(ii)

Proposed Rule 1000(b)(1) would generally require that each SCI entity's policies and procedures be reasonably designed to ensure that its SCI systems and, for purposes of security standards, SCI security systems, “have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.” As discussed above, proposed Rule 1000(b)(1)(i) would also require that an SCI entity have policies and procedures that address items (A)-(F). The Commission notes that SCI entities that are ARP participants have been applying the ARP I principles underlying proposed Rule 1000(b)(1)(i)(A)-(F) for many years. However, while the items enumerated in proposed Rule 1000(b)(1)(i)(A)-(F) identify the areas that would be required to be addressed by an SCI entity's policies and procedures, the Commission is not proposing to prescribe the specific policies and procedures an SCI entity must follow to comply with the requirements of proposed Rule 1000(b)(1). Instead, the Commission intends to, and preliminarily believes that the proposed requirements as written would, provide SCI entities sufficient flexibility, based on the nature, size, technology, business model, and other aspects of their business, to identify appropriate policies and procedures that would meet the articulated standard, namely that they be reasonably designed to ensure that their systems have levels of capacity, integrity, resiliency, availability, and security adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets. However, the Commission also preliminarily believes that it would be helpful to SCI entities to provide additional guidance about one way in which they might elect to satisfy this general standard in proposed Rule 1000(b)(1). Therefore, the Commission is proposing Rule 1000(b)(1)(ii), which would provide that, for purposes of complying with proposed Rule 1000(b)(1), an SCI entity's policies and procedures would be deemed to be reasonably designed, and thus satisfy the requirements of proposed Rule 1000(b)(1), if they are consistent with current SCI industry standards. Proposed Rule 1000(b)(1)(ii) further states that such SCI industry standards shall be: (A) comprised of information technology practices that are widely available for free to information technology professionals in the financial sector; and (B) issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Proposed Rule 1000(b)(1)(ii) would additionally provide that compliance with the SCI industry standards identified in the proposal would not be the exclusive means to comply with the requirements of paragraph (b)(1). As noted above, the Commission intends to, and preliminarily believes that the proposed requirements as written would, provide SCI entities sufficient flexibility, based on the nature, size, technology, business model, and other aspects of their business, to identify appropriate policies and procedures to comply with proposed Rule 1000(b)(1).

The Commission is proposing this approach because it preliminarily believes that providing additional guidance on the types of industry standards that would satisfy the requirements of proposed Rule 1000(b)(1) could assist an SCI entity in determining how to best allocate resources to maintain its systems' operational capability, and promote the maintenance of fair and orderly markets. The Commission acknowledges that current industry standards applicable to SCI entities have been developed in a number of areas to help ensure that systems have adequate capacity, integrity, resiliency, availability, and security. Accordingly, the current SCI industry standards that would be deemed to be reasonably designed for purposes of proposed Rule 1000(b)(1) are not limited to the SCI industry standards discussed and contained in the publications identified in Table A below, but rather may be found in a variety of publications, issued by a range of sources. The Commission acknowledges that an SCI entity's choice of a current SCI industry standard in a given domain or subcategory thereof may be different than those contained in the publications identified in Table A. Further, some of the identified standards may be more relevant for some SCI entities than others, based on the nature and amount of their respective activities. Thus, the Commission's proposed approach is designed to provide a non-exclusive method of compliance.

The Commission preliminarily believes that the publications set forth in Table A below contain examples of SCI industry standards that an SCI entity may elect to look to in establishing its policies and procedures under proposed Rule 1000(b)(1). However, as proposed Rule 1000(b)(1)(ii) makes clear, compliance with such current SCI industry standards would not be the exclusive means to comply with the requirements of proposed Rule 1000(b)(1). Thus, as proposed, written policies and procedures that are consistent with the relevant examples of SCI industry standards contained in the publications identified in Table A, would be deemed to be “reasonably designed” for purposes of proposed Rule 1000(b)(1). The publications identified in Table A cover nine inspection areas, or “domains,” that have evolved over the past 20 years of the ARP Inspection Program and that are relevant to SCI entities' systems capacity, integrity, resiliency, availability, and security, namely: Application controls; capacity planning; computer operations and production environment controls; contingency planning; information security and networking; audit; outsourcing; physical security; and systems development methodology.

The publications included in Table A set forth industry standards that the Commission understands are currently used by information technology and audit professionals in the financial and government sectors. These industry standards have been issued primarily by NIST and FFIEC. NIST, an agency within the U.S. Department of Commerce, has issued special publications regarding information technology systems. The FFIEC is a U.S. intergovernmental body that prescribes uniform principles and practices for the examination of certain financial institutions by U.S. regulators, and has issued publications on numerous topics, including development and acquisition of applications, computer operations, outsourcing technology, business continuity planning, information security, and internal audits. In addition to these standards issued by FFIEC and NIST, financial regulatory agencies, including the Commission, provided guidance on business continuity and disaster recovery plans in the 2003 Interagency White Paper and the 2003 Policy Statement on Business Continuity Planning for Trading Markets.

Also included in Table A is a publication issued by the Institute of Internal Auditors (“IIA”). The IIA is an international professional association that has developed and published guidance setting forth industry best practices in internal auditing for internal audit professionals. It has more than 175,000 members in 165 countries and territories around the world. IIA is also a credentialing organization, awarding the Certified Internal Auditor (CIA), Certified Government Auditing Professional (CGAP), Certified Financial Services Auditor (CFSA), Certification in Control Self-Assessment (CCSA), and Certification in Risk Management Assurance (CRMA) certifications to those who meet the requirements. The Commission preliminarily believes these factors support identification of IIA as an authoritative body that is a widely recognized organization.

In addition, one of the publications identified in Table A is issued by the Security Benchmarks division of the Center for Internet Security (“CIS”). The CIS is a not-for-profit organization focused on enhancing the cybersecurity readiness and response of public and private sector entities. The CIS Security Benchmarks division facilitates the development of industry best practices for security configuration, tools for measuring information security status, and resources to assist entities in making security investment decisions. Its members include commercial organizations, academic organizations, government agencies, and security service, consulting, and software organizations. According to the CIS, its benchmarks are regularly referred to by U.S. government agencies for compliance with information security rules and regulations. The Commission preliminarily believes these factors support a determination that CIS is an authoritative body that is a widely recognized organization.

Table A lists the publication(s) that the Commission has preliminarily identified as SCI industry standard(s) in each domain that an SCI entity, taking into account its nature, size, technology, business model, and other aspects of its business, could, but is not required to, use to establish, maintain, and enforce reasonably designed policies and procedures that satisfy the requirements of proposed Rule 1000(b)(1). Thus, the Commission is proposing that the industry standards contained in the publications identified in Table A be one example of “current SCI industry standards” for purposes of proposed Rule 1000(b)(1), and requests commenters' views on the appropriateness of each publication identified in Table A as a “current SCI industry standard.” Each listed publication is identified with specificity, and includes the particular publication's date, volume number, and/or publication number, as the case may be. Thus, to the extent an SCI entity seeks to rely on SCI industry standards for purposes of complying with proposed Rule 1000(b)(1)(ii), the Commission intends SCI entities that establish policies and procedures based on the SCI industry standards contained in the publications set forth in Table A to enforce written policies and procedures, taking into account their nature, size, technology, business model, and other aspects of their business, consistent with relevant standards, even if the issuing organization were to subsequently update a given industry practice, until such time as the list of SCI industry standards were to be updated, as discussed below. Of course, SCI entities could elect to use standards contained in the publications other than those identified on Table A to satisfy the requirements of proposed Rule 1000(b)(1) .

As noted above, each of the publications listed in Table A is intended to identify information technology practices that are widely available for free to information technology professionals in the financial sector and are issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization.

Although the industry standards contained in the publications identified in Table A above are intended as an appropriate initial set of industry standards under proposed Regulation SCI, the Commission does not seek to foreclose the development, whether by the Commission or otherwise, of a set of industry standards that is more focused on the specific businesses and systems of SCI entities. In such a case, the Commission preliminarily believes that it would be appropriate to use the industry standards contained in the publications listed in Table A as a starting point for such development.

Further, the Commission recognizes that systems and technologies are continually evolving. As such, the standards identified in this proposal would likely be updated from time to time by the organizations issuing them. However, the Commission also preliminarily believes that, following its initial identification of one set of SCI industry standards, it may be appropriate to update the identified set of standards from time to time through the periodic issuance of Commission staff guidance. Accordingly, the Commission preliminarily believes it would be appropriate for Commission staff, from time to time, to issue notices to update the list of previously identified set of SCI industry standards after receiving appropriate input from interested persons. The Commission preliminarily believes that this approach would provide the public, including SCI entities and other market participants, an opportunity to comment on newly proposed SCI industry standards. However, until such time as Commission staff were to update the identified set of SCI industry standards, the then-current set of SCI industry standards would be the standards referred to in proposed Rule 1000(b)(1)(ii) of Regulation SCI.

As noted above, proposed Rule 1000(b)(1)(ii) would require that any SCI industry standards be: (i) Comprised of information technology practices that are widely available for free to information technology professionals in the financial sector; and (ii) issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or a widely recognized organization.

Request for Comment

60. The Commission requests comment generally on proposed Rule 1000(b)(1). Do commenters believe the proposed scope of required policies and procedures is appropriate? Why or why not? Please explain.

61. Do commenters believe that it is appropriate to apply the requirements of proposed Rule 1000(b)(1) to SCI systems and, for purposes of security standards, to SCI security systems? Why or why not? Please explain.

62. Do commenters believe the enumeration of the items in proposed Rule 1000(b)(1)(i)(A)-(F) that are to be addressed in the required policies and procedures is appropriate? Why or why not? Specifically, is the proposal to require that such policies and procedures include the establishment of reasonable current and future capacity planning estimates, as provided in proposed Rule 1000(b)(1)(i)(A), appropriate? Why or why not?

63. Should the Commission specify the interval (e.g., monthly or quarterly) at which SCI entities would be required to conduct periodic capacity stress tests of relevant systems, as provided in proposed Rule 1000(b)(1)(i)(B)? Should such periodic tests be limited to a subset of systems? If so, for which systems should such tests be required and why would that limitation be appropriate?

64. Should the Commission require SCI entities to have a program to review and keep current systems development and testing methodology, as proposed to be required in proposed Rule 1000(b)(1)(i)(C)? Why or why not?

65. Should the Commission specify the interval at which SCI entities would be required to conduct reviews and tests of SCI systems and SCI security systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters, as provided in proposed Rule 1000(b)(1)(i)(D)? Why or why not? And, if so, what would be appropriate intervals and why?

66. The Commission notes that items (i)(B), (C), and (D) would each require the establishment of policies and procedures for: Testing of capacity, testing methodology, and testing for vulnerabilities, respectively. The Commission also notes that the need for improved testing was a recurring theme during the Roundtable and discussed in several comment letters. The Commission requests comment on whether the testing policies and procedures requirements in proposed Rule 1000(b)(1)(i)(B), (C), and (D) would be sufficiently comprehensive to foster development of the types of testing that Roundtable panelists and commenters recommended. Why or why not? Please be specific. Should the Commission require certain types of testing by SCI entities? Why or why not? Please be specific. If so, what specific types of testing should the Commission require in proposed Regulation SCI? Please describe in detail.

67. Should the Commission require SCI entities to have, and make available to their members or participants, certain infrastructure or mechanisms that would aid industry-wide testing or direct testing with an SCI entity, such as test facilities or test symbols? Why or why not? If so, please specify what types of infrastructures or mechanisms should be required.

68. Should the Commission require industry-wide testing for certain types of anticipated technology deployments? Why or why not? If so, what should be the criteria for identifying anticipated technology deployments that warrant mandatory industry-wide testing and which market participants should be required to participate? Please explain in detail.

69. Should the Commission require SCI entities to mandate that their members or participants participate in direct testing with such SCI entities for certain types of anticipated technology deployments by the members or participants? Why or why not? If so, what should be the criteria for identifying anticipated technology deployments that warrant mandatory testing with an SCI entity? Should the Commission identify such criteria, or should SCI entities identify such criteria? Please explain.

70. Similarly, would proposed item (i)(E), regarding policies and procedures for business continuity and disaster recovery plans, be sufficiently comprehensive to foster the establishment of the types of contingency plans discussed by Roundtable panelists and Roundtable commenters, such as predetermined communication plans, escalation procedures, and/or kill switches? Why or why not? Should proposed Regulation SCI expressly require that an SCI entity's contingency plans include such details? Why or why not? Please explain. Should SCI entities' contingency plans and the testing of such plans be required to account for specific types of disaster or threat scenarios, such as an extreme volume surge, the failure of a major market participant, and/or a terrorist or cyber attack? Why or why not? Please explain. If so, what other types of scenarios should such plans take into account? Please be specific.

71. There was considerable discussion at the Roundtable about kill switches, with several panelists advocating the kill switch proposal outlined in the Industry Working Group comment letter, while others expressed concerns. The Commission is not proposing at this time any requirements related to kill switches. However, do commenters believe that the implementation of kill switches, as outlined in the Industry Working Group comment letter, would assist SCI entities in maintaining the integrity of their systems? Why or why not? If so, how, if at all, should the Commission foster the development of coordinated contingency plans among SCI SROs and SCI ATSs that would include such a kill switch mechanism?

72. Should the Commission include the criteria of geographic diversity in the requirement relating to business continuity and disaster recovery plans in proposed Rule 1000(b)(1)(i)(E)? Why or why not? Please explain. Should the Commission specify minimum standards for “geographically diverse” in proposed Rule 1000(b)(1)(i)(E)? Why or why not? If so, what would be an appropriate standard?

73. Is the next business day resumption of trading following a wide-scale disruption requirement in proposed Rule 1000(b)(1)(i)(E) appropriate? Why or why not? Is the two-hour resumption of clearance and settlement services following a wide-scale disruption an appropriate requirement for an SCI entity that is a registered clearing agency or “exempt clearing agency subject to ARP?” Why or why not?

74. As discussed above, the U.S. national securities exchanges closed for two business days in October 2012 in the wake of Superstorm Sandy, even though the securities industry's annual test of how trading firms, market operators, and their utilities could operate through an emergency using backup sites, backup communications, and disaster recovery facilities occurred without significant incident on October 27, 2012, just two days before the storm. As discussed in greater detail below, proposed Rule 1000(b)(9) would require SCI entities to mandate participation by designated members or participants in scheduled testing of the operation of their business continuity and disaster recovery plans, including backup systems, and to coordinate such testing with other SCI entities. Are there other industry practices related to proposed Regulation SCI that should be considered further in light of the two-day closure of the U.S. securities markets during the storm? If so, what are they? For example, for SCI entities that are trading markets, should the Commission limit the extent to which an SCI entity's business continuity and disaster recovery plans may involve changing how trading may be conducted? For example, the NYSE, pursuant to its rules, initially proposed to conduct trading only electronically on October 29, 2012, using NYSE Arca systems, rather than conduct trading both electronically as well as on a physical trading floor, as it normally does. Should an SCI entity that is experiencing a wide-scale disruption be permitted to offer its members or participants an alternative that significantly differs from its usual method of operation? Please explain. What are the costs and benefits associated with each type of approach?

75. Should business continuity and disaster recovery plans involving backup data centers be required to be tested in a live “production” environment on a periodic basis (e.g., annually, or at some other frequency)? Why or why not? Please explain.

76. The Commission understands that certain entities that would be defined as SCI entities (such as registered clearing agencies) are already effectively operating under business resumption requirements of less than one business day. Should the Commission consider revising the proposed next business day resumption requirement for trading to a shorter or longer period, for example, a specific number of hours less or more than one business day or within the business day for certain entities that play a significant role within the securities markets? Why or why not? Similarly, should the proposed two-hour resumption standard for clearance and settlement services be shortened or lengthened? Why or why not?

77. Following a systems disruption (including, for example, activation of an SCI entity's business continuity plan), should the Commission require user testing and certification prior to resuming operation of the affected systems? Why or why not? If so, what should the testing requirements be? Should they vary depending on the type of system(s) affected? To whom should an SCI entity certify that an affected system or group of systems is ready to resume operation?

78. Is the requirement in proposed Rule 1000(b)(1)(i)(F) for “standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data” appropriate? Are there other factors that the Commission should consider in determining whether standards to process data are adequate? Or, should some of the proposed standards be eliminated or modified? If so, please explain how and why.

79. Do commenters believe there are specific internal controls or other mechanisms that would reinforce the effectiveness of an SCI entity's reasonably designed policies and procedures under proposed Rule 1000(b)(1)? Why or why not? Please explain. How do SCI entities presently use specific internal controls or other mechanisms to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets? How do commenters generally view the advantages and disadvantages of specific internal controls or other mechanisms? The Commission is not proposing to prescribe specific internal controls under proposed Rule 1000(b)(1). Should the Commission propose that any particular internal controls or other mechanisms be required (for example, that a senior officer be designated to be responsible for the SCI entity's compliance with proposed Regulation SCI, or that personnel of the SCI entity certify that the SCI entity's policies and procedures are reasonably designed)?

80. Would any of the Commission's proposed requirements under proposed Rule 1000(b)(1) create inappropriate barriers to entry for new entities seeking to register with the Commission as an SRO, ATS, or plan processor? Would any of the proposed requirements inappropriately limit the growth or expansion of entities currently registered with the Commission as an SRO, ATS, or plan processor? Why or why not?

81. As noted above, the Commission proposes that policies and procedures would be deemed to be reasonably designed for purposes of proposed Rule 1000(b)(1) if they are consistent with current SCI industry standards. Do commenters agree with this approach? Why or why not? What are the advantages or disadvantages of such an approach?

82. Do commenters believe that the publications listed in Table A represent publications that are suitable for purposes of proposed Rule 1000(b)(1)(ii) and that should be the “current SCI industry standards” for purposes of proposed Rule 1000(b)(1)(ii)? Why or why not? If not, what publications would be appropriate? Do commenters believe that SCI entities currently follow the industry standards contained in the publications listed in Table A?

83. Are there areas within one of the nine identified domains that these publications do not cover? For example, should the Commission identify additional publications that provide industry standards for specific areas such as personnel security or information security risk management? If so, please identify any such publications that would be appropriate for the Commission to apply to SCI entities. Are there other areas that commenters believe are not covered at all by the publications listed in Table A that should be included? If so, what publications would be appropriate for such areas? Are there any areas within one of the nine identified domains that commenters believe should not be included? If so, why not?

84. Should any of the publications listed in Table A be eliminated? If so, which ones and why? Are there any publications that should be added? If so, which ones and why? Are there industry practices that apply to, or are developed by, entities related to the securities markets that should be considered? If so, what are they and why? Are there any types of SCI entities for which the proposed publications would not be appropriate? If so, which types of entities and why? How should any such possible concerns be addressed? The Commission notes that many of the publications in Table A have been issued by either NIST or FFIEC. Do commenters believe that SCI entities generally currently follow the industry standards issued by one of these organizations more frequently than the other? If so, which one and why? Is one organization's publications more appropriate or preferable for SCI entities? If so, please explain. What are the advantages and/or disadvantages of the publications issued by each organization?

85. The Commission seeks comment on whether commenters believe that the identified publications, and the industry standards within, are adequate in terms of the detail, specificity and scope. Are there areas in which the industry standards listed in the publications in Table A should be modified to provide adequate guidance to SCI entities? If so, please explain in detail. For example, the Commission understands that many businesses, including SCI entities, now utilize cloud computing as part of their operations, and the Commission has identified industry standards with respect to cloud computing among the publications listed in Table A. However, do commenters believe that these industry standards provide an adequate level of specificity to allow an SCI entity to ascertain how to comply with such standards? Further, do the industry standards contained in the publications in Table A cover all of the relevant areas related to a particular subject area (such as cloud computing)? Similarly, the Commission notes that it has identified publications with respect to capacity planning, but that the industry standards in such publications focus primarily on continuity of operations. As such, the Commission seeks comment on whether commenters believe that the identified publications with respect to capacity planning are adequate in terms of the detail, specificity, and scope? Specifically, do these publications provide an adequate level of specificity to allow an SCI entity to ascertain how to comply with such standards, and do the industry standards cover all of the necessary areas related to a particular subject area such as capacity planning? Why or why not? As noted above, compliance with the industry standards contained in the publications on Table A would not be the exclusive means to comply with the requirements of proposed Rule 1000(b)(1).

86. Do commenters agree with the Commission's proposed policies and procedures approach to the requirements of proposed Rule 1000(b)(1)? Why or why not? If not, is there another approach that is more appropriate? If so, please describe and explain. Do commenters agree with the Commission's proposed approach to deem an SCI entity's policies and procedures to be reasonably designed if they are consistent with current SCI industry standards, as provided for in proposed Rule 1000(b)(1)(ii)? Why or why not? How do commenters believe the actions of SCI entities might differ if such a provision were not available? What are the costs and benefits of the Commission's approach ? What would be the costs and benefits of other approaches? Please explain.

87. Do commenters agree or disagree with the Commission's proposed criteria to evaluate publications suitable for inclusion on Table A as an SCI industry standard and to update such list? Do commenters agree with the proposed criteria that identified publications should be: (i) Comprised of information technology practices that are widely available for free to information technology professionals in the financial sector; and (ii) issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization? Why or why not? Are there other criteria that would be more appropriate? Should the proposed criteria allow for a publication that may be available for an incidental charge rather than being required to be available for free? Why or why not? How frequently should such list of publications be updated and revised and what should the process be to update and/or revise them?

88. Are there SCI entities for which the proposed requirements in Rule 1000(b)(1) would be inappropriate (e.g., not cost effective)? If so, please identify such type of entity or entities, or the characteristics of such entity or entities, and explain which proposed requirements would be inappropriate and why. Would cost burden be an appropriate reason to omit an SCI entity or proposed requirement generally? Alternatively, would cost burden be an appropriate reason to omit an SCI entity or proposed requirement, on a case-by-case basis, as the Commission determined to be consistent with Exchange Act requirements?

89. When the Commission adopts new rules, or when SCI SROs implement rule changes, SCI SROs and their members often need to make changes to their systems to comply with such new rules. Would the requirements of proposed Rule 1000(b)(1) add additional time to this process and would the requirements increase the amount of time SCI entities would need to adjust their systems for Commission or SCI SRO rule changes? If so, how much additional time would SCI SROs need to adjust their systems? If not, should proposed Regulation SCI or another Commission rule require SCI SROs to provide minimum advance notice to their members of anticipated technology deployments prior to the implementation of any associated new rule or rule change by the SCI SRO? Why or why not? If so, how much advance notice should be required (e.g., a few days, a week, 30 days, 60 days, some other period)? Along with any such advance notice, should SCI SROs be required to offer to its members the opportunity to test such change with the SCI SRO prior to deployment of the new technology and implementation of any associated new rule or rule change? Why or why not? Should there be a similar requirement for other types of SCI entities? Why or why not? If so, what types of entities and what sorts of requirements should be included?

90. Do commenters believe the potential additional time SCI SROs allocate to this process would result in fewer SCI events by helping to ensure that SCI SROs properly implement systems changes? Why or why not? How would the benefits and costs of such potential additional time compare? Please be as specific as possible.

91. The Commission generally solicits comments on its proposed process for updating current SCI industry standards. Do commenters believe that it would be appropriate that Commission staff, from time to time, issue notices to update the list of previously identified publications containing SCI industry standards after receiving appropriate input from interested persons? Is there a more appropriate method? If so, what would it be? If not, why not?

92. Would such a process in allow for Commission staff to receive sufficient input from the public, including experts, SCI entities, and other market participants regarding the appropriate standards it should update, and how to do so? Why or why not?

93. Would it be useful, for example, to provide notice to the public that it was focusing on a given domain or standard and seek comment on a domain-by-domain, or standard-by-standard, basis? Would it be useful for the Commission to set up a committee to advise Commission staff on such standards? If so, which groups or types of market participants should be represented on such a committee and why? Is there any other process that the Commission or its staff should use to help it obtain useful input? Would it be appropriate to instead require SROs, for example, to submit an NMS plan under Rule 608 of Regulation NMS that contained standards? Why or why not?

94. If the Commission, its staff, or another entity seeks to develop a set of standards that is more focused on the specific businesses and systems of SCI entities, do commenters agree that the industry standards contained in the publications listed in Table A would be appropriate to be used as a starting point for this effort? Why or why not? If not, what publication(s) should be used as a starting point? Please describe in detail and explain.

95. Do commenters believe it would be feasible to establish industry standards through means other than identification through Table A? For example, should SCI entities take the lead in developing such standards? Why or why not? If so, how should the process be organized and what parameters should be put in place to facilitate the process? For example, should SCI entities jointly develop industry standards that apply to all SCI entities or should the various types of SCI entities (e.g., national securities exchanges, ATSs, plan processors, clearing agencies) work separately to develop their own standards? Should one or more industry organizations take the lead in developing such standards? If so, which ones, and why? Should any such standards identified by the SCI entities and/or industry organizations be formally approved or disapproved by the Commission as part of any such process?

2. Systems Compliance

Proposed Rule 1000(b)(2)(i) would require each SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in the manner intended, including in a manner that complies with the federal securities laws and rules and regulations thereunder and the entity's rules and governing documents, as applicable. Whereas proposed Rule 1000(b)(1) concerns the robustness of the SCI entity's SCI systems and SCI security systems—i.e., such systems' capacity and resiliency against failures and security threats—proposed Rule 1000(b)(2) concerns the SCI entity's establishment of policies and procedures reasonably designed to ensure the operational compliance of an SCI entity's SCI systems with applicable laws, rules, and the SCI entity's governing documents. Diligent discharge of this proposed obligation to establish, maintain, and enforce written policies and procedures would establish the organizational framework for an SCI entity to meet its other obligations under proposed Regulation SCI. In particular, with respect to SCI SROs, compliance with proposed Rule 1000(b)(2)(i) should help to ensure that SCI SROs comply with Section 19(b)(1) of the Exchange Act, which requires each SRO to file with the Commission copies of any proposed rule or any proposed change in, addition to, or deletion from the rules of the SRO. Therefore, compliance with this proposed requirement may help ensure not only that SCI SROs operate in compliance with the Exchange Act, but also help reinforce existing processes for filing SRO rule changes in order to better assist market participants and the public in understanding how the SCI systems of SCI SROs are intended to operate.

Because of the complexity of SCI systems and the breadth of the federal securities laws and rules and regulations thereunder and the SCI entities' rules and governing documents, the Commission preliminarily believes that it would be appropriate to provide an explicit safe harbor for SCI entities and their employees in order to provide greater clarity as to how they can ensure that their conduct will comply with this provision. Therefore, the Commission is proposing Rules 1000(b)(2)(ii) and (iii), which would provide a safe harbor from liability under proposed Rule 1000(b)(2)(i) for SCI entities and persons employed by SCI entities, respectively, as further described below.

Specifically, proposed Rule 1000(b)(2)(ii) would provide that an SCI entity would be deemed not to have violated proposed Rule 1000(b)(2)(i) if: (A) the SCI entity has established and maintained policies and procedures reasonably designed to provide for: (1) Testing of all SCI systems and any changes to such systems prior to implementation; (2) periodic testing of all such systems and any changes to such systems after their implementation; (3) a system of internal controls over changes to such systems; (4) ongoing monitoring of the functionality of such systems to detect whether they are operating in the manner intended; (5) assessments of SCI systems compliance performed by personnel familiar with applicable federal securities laws and rules and regulations thereunder and the SCI entity's rules and governing documents, as applicable; and (6) review by regulatory personnel of SCI systems design, changes, testing, and controls to prevent, detect, and address actions that do not comply with applicable federal securities laws and rules and regulations thereunder and the SCI entity's rules and governing documents, as applicable; (B) the SCI entity has established and maintained a system for applying such policies and procedures which would reasonably be expected to prevent and detect, insofar as practicable, any violations of such policies and procedures by the SCI entity or any person employed by the SCI entity; and (C) the SCI entity: (1) has reasonably discharged the duties and obligations incumbent upon the SCI entity by such policies and procedures, and (2) was without reasonable cause to believe that such policies and procedures were not being complied with in any material respect.

The Commission preliminarily believes that, if an SCI entity establishes and maintains policies and procedures reasonably designed to provide for the items in proposed Rule 1000(b)(2)(ii)(A)(1)-(6), such policies and procedures would meet the requirement articulated in proposed Rule 1000(b)(2)(i). Specifically, the Commission preliminarily believes that items (1) and (2), which, for purposes of qualifying for the safe harbor, would require SCI entities to have policies and procedures requiring the testing of SCI systems and changes to such systems before they are put into production and periodically thereafter, should help SCI entities to identify potential problems before such problems have the ability to impact markets and investors. Items (3) and (4), which, for purposes of qualifying for the safe harbor, would require a system of internal controls over changes to SCI systems and ongoing monitoring of the functionality of such systems, would provide a framework for SCI entities seeking to bring newer, faster, and more innovative SCI systems online. In conjunction with ongoing monitoring, the Commission preliminary believes the policies and procedures proposed to be required in items (3) and (4) for purposes of qualifying for the safe harbor, would help prevent SCI systems becoming noncompliant resulting from, for example, inattention or failure to review compliance with established written policies and procedures.

Further, the Commission preliminarily believes that item (5) (which, for purposes of qualifying for the safe harbor, would require that an SCI entity establish, maintain, and enforce written policies and procedures for assessments of SCI systems compliance by personnel familiar with applicable federal securities laws, rules and regulations thereunder, and the SCI entity's rules and governing documents), in conjunction with item (6) (which, for purposes of qualifying for the safe harbor, would require policies and procedures directing that regulatory personnel review SCI systems design, changes, testing, and controls), would help foster coordination between the information technology and regulatory staff of an SCI entity so that SCI events and other issues related to an SCI entity's SCI systems would be more likely to be addressed by a team of staff in possession of the requisite range of knowledge and skills to help ensure compliance with the SCI entity's obligations under proposed Regulation SCI.

Insofar as an SCI entity follows them to qualify for the safe harbor, proposed items (5) and (6) also are intended to help to ensure that an SCI entity's business interests do not undermine regulatory, surveillance, and compliance functions and, more broadly, the requirements of the federal securities laws, during the development, testing, implementation, and operation processes for SCI systems. Thus, proposed items (1)-(6) together, insofar as SCI entities follow them to qualify for the safe harbor, are meant to promote the development and implementation of policies and procedures consistent with the functioning of SCI systems of SCI entities as planned and as described by the SCI entity's rules and governing documents, as well as in compliance with applicable federal securities laws and rules.

In addition to establishing and maintaining the policies and procedures described in proposed Rule 1000(b)(2)(ii)(A)(1)-(6), to qualify for the safe harbor, an SCI entity would also be required to satisfy two additional requirements. First, under proposed Rule 1000(b)(2)(ii)(B), it would be required to have established and maintained a system for applying such policies and procedures which would reasonably be expected to prevent and detect, insofar as practicable, any violations of such policies and procedures by the SCI entity or any person employed by the SCI entity. In addition, under proposed Rule 1000(b)(2)(ii)(C), the SCI entity would be required to: (1) Have reasonably discharged the duties and obligations incumbent upon it by such policies and procedures; and (2) have been without reasonable cause to believe that such policies and procedures were not being complied with in any material respect. To the extent an SCI entity seeks to qualify for the safe harbor, the elements of proposed Rules 1000(b)(2)(ii)(B) and (C) would require not only that its policies and procedures are reasonably designed to achieve SCI systems compliance, as described in items (A)(1)-(6) above, but also that, as part of such policies and procedures, the SCI entity establishes and maintains a system for applying those policies and procedures, and enforces its policies and procedures, in a manner that would reasonably allow it to prevent and detect violations of the policies and procedures. Proposed Rules 1000(b)(2)(ii)(B) and (C) are also designed to ensure that the SCI entity reasonably discharges duties and obligations incumbent upon it by such policies and procedures and is without reasonable cause to believe that such policies and procedures were not being complied with in any material respect.

In addition, proposed Rule 1000(b)(2)(iii) would provide a safe harbor from liability for individuals. Specifically, proposed Rule 1000(b)(2)(iii) would provide that a person employed by an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by any other person of proposed Rule 1000(b)(2)(i) if the person employed by the SCI entity has reasonably discharged the duties and obligations incumbent upon such person by such policies and procedures, and was without reasonable cause to believe that such policies and procedures were not being complied with in any material respect. The Commission preliminarily believes that the safe harbor for individuals under proposed Rule 1000(b)(2)(iii) would appropriately provide protection from liability under Rule 1000(b)(2) to employees of SCI entities who reasonably conduct their assigned responsibilities under the SCI entity's policies and procedures and do not have reasonable cause to believe the policies and procedures were not being complied with in any material respect.

In this regard, an SCI entity would not be deemed to violate proposed Rule 1000(b)(2)(i) merely because it experienced a systems compliance issue, and could take advantage of the safe harbor for SCI entities if it satisfied the elements enumerated in proposed Rule 1000(b)(2)(ii). Likewise, an employee of an SCI entity, including an employee involved in the design or implementation of policies and procedures under the rule, would not be deemed to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by any other person of proposed Rule 1000(b)(2)(i) merely because the SCI entity at which he or she worked experienced a systems compliance issue, whether or not the employee was able to take advantage of the safe harbor for individuals under proposed Rule 1000(b)(2)(iii).

Request for Comment

96. The Commission requests comment generally on all aspects of proposed Rule 1000(b)(2). Do commenters believe that it is appropriate to limit the application of the requirements of proposed Rule 1000(b)(2)(i) to SCI systems? Why or why not? Please explain. Do commenters agree with the requirements of the proposed safe harbor for SCI entities? Why or why not? Specifically, with respect to proposed Rule 1000(b)(2)(ii)(A)(1), which would include in the safe harbor a requirement that each SCI entity establish and maintain written policies and procedures that provide for testing of all SCI systems and any changes to such systems prior to implementation, should certain types of SCI systems be excluded from the proposed requirement? If so, please specify which types and explain.

97. Should the Commission specify the interval at which SCI entities would be required to conduct the periodic testing of all SCI systems contemplated by the safe harbor under proposed Rule 1000(b)(2)(ii)(A)(2)? Why or why not? And if so, what would be an appropriate interval? Should certain types of SCI systems be tested on a more or less frequent basis? If so, please specify which types and explain.

98. With respect to proposed Rule 1000(b)(2)(ii)(A)(3), which would include in the safe harbor a requirement that an SCI entity establish and maintain written policies and procedures that provide for a system of internal controls over changes to SCI systems, should the Commission specify minimum standards for internal controls? If so, please explain why, as well as what such standards should be.

99. With respect to proposed Rule 1000(b)(2)(ii)(A)(4), which would include in the safe harbor a requirement that an SCI entity establish and maintain written policies and procedures that provide for ongoing monitoring of the functionality of SCI systems to detect whether they are operating in the manner intended, should the Commission specify the frequency with which the monitoring of such systems' functionality should occur? If so, please explain. Should the Commission require different monitoring frequencies depending on the type of SCI system? Why or why not? If so, what should they be? Please explain.

100. For purposes of the safe harbor and proposed Rule 1000(b)(2)(ii)(A)(5), do commenters believe the Commission should require that the assessments of SCI systems compliance be performed by persons having specified qualifications? Why or why not? If so, what would be appropriate and/or necessary qualifications for such personnel?

101. Proposed Rule 1000(b)(2)(ii)(A)(6) would include in the safe harbor a requirement that each SCI entity establish and maintain policies and procedures that provide for review by regulatory personnel of SCI systems design, changes, testing, and controls to prevent, detect, and address actions that are not in compliance with applicable federal securities laws and rules and regulations thereunder and the SCI entity's rules and governing documents, as applicable. Do commenters believe, for purposes of qualifying for the safe harbor, the roles and allocations of responsibility for personnel in proposed Rules 1000(b)(2)(ii)(A)(5) and (6) are appropriate? Why or why not?

102. Do commenters agree that in order for an SCI entity to qualify for the safe harbor from liability under proposed Rule 1000(b)(2)(i), it should, in addition to establishing and maintaining the policies and procedures described in proposed Rule 1000(b)(2)(ii)(A)(1)-(6), be required to establish and maintain a system for applying such policies and procedures which would reasonably be expected to prevent and detect, insofar as practicable, any violations of such policies and procedures by the SCI entity or any person employed by the SCI entity? Why or why not? To qualify for the safe harbor from liability under proposed Rule 1000(b)(2)(i), should an SCI entity be further required to: have reasonably discharged the duties and obligations incumbent upon the SCI entity by such policies and procedures; and be without reasonable cause to believe that such policies and procedures were not being complied with in any material respect? Why or why not? Please explain.

103. Do commenters agree with the requirements for the proposed safe harbor for individuals in proposed Rule 1000(b)(2)(iii), which would provide that a person employed by an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by any other person of proposed Rule 1000(b)(2)(i) if the person employed by the SCI entity: has reasonably discharged the duties and obligations incumbent upon such person by such policies and procedures; and was without reasonable cause to believe that such policies and procedures were not being complied with in any material respect? Why or why not? Should a similar safe harbor be available to individuals other than persons employed by SCI entities? Why or why not? Please explain.

104. Do commenters agree with the Commission's proposed policies and procedures approach to the requirements of proposed Rule 1000(b)(2)? Why or why not? If not, is there another approach that is more appropriate? If so, please describe and explain. As discussed above, the Commission is proposing to include safe harbor provisions in proposed Rule 1000(b)(2) for SCI entities and employees of SCI entities. The Commission preliminarily believes that, in the context of proposed Regulation SCI, this approach may be appropriate to provide clarity and guidance to SCI entities and SCI entity employees on one method to comply with the proposed general standard in proposed Rule 1000(b)(2)(i). The Commission solicits commenters' views on the Commission's proposed approach. Specifically, do commenters agree with the Commission's proposed approach to provide safe harbors for SCI entities and employees of SCI entities from liability under proposed Rule 1000(b)(2)(i)? Why or why not? How do commenters believe the actions of SCI entities or behavior of employees of SCI entities might differ if the safe harbors under proposed Rule 1000(b)(2) were not available? What are the costs and benefits of the Commission's approach to provide safe harbors? What would be the costs and benefits of other approaches? Please explain.

105. Do commenters believe there are specific internal controls or other mechanisms that would reinforce the effectiveness of an SCI entity's reasonably designed policies and procedures under proposed Rule 1000(b)(2)? Why or why not? Please explain. How do SCI entities presently use specific internal controls or other mechanisms to ensure that their systems operate in a manner that complies with the federal securities laws and rules and regulations thereunder and their rules and governing documents, as applicable? How do commenters generally view the advantages and disadvantages of specific internal controls or other mechanisms? The Commission is not proposing to prescribe specific internal controls related to compliance with proposed Rule 1000(b)(2). Should the Commission propose that any particular internal controls or other mechanisms be required (for example, that a senior officer be designated to be responsible for the SCI entity's compliance with proposed Regulation SCI, or that personnel of the SCI entity certify that the SCI entity's policies and procedures are reasonably designed)?

3. SCI Events—Action Required; Notification

Proposed Rule 1000(b)(3)-(5) would govern the actions an SCI entity must take upon any responsible SCI personnel becoming aware of an SCI event, whether it be a systems disruption, systems compliance issue, or systems intrusion.

a. Corrective Action

Proposed Rule 1000(b)(3) would require an SCI entity, upon any responsible SCI personnel becoming aware of an SCI event, to begin to take appropriate corrective action including, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable. The Commission is proposing this requirement to make clear that, upon learning of an SCI event, an SCI entity would be required to take the steps necessary to remedy the problem or problems causing the SCI event and mitigate the effects of the SCI event, if any, on customers, market participants and the securities markets.

Proposed Rule 1000(a) would define “responsible SCI personnel” to mean, for a particular SCI system or SCI security system impacted by an SCI event, any personnel, whether an employee or agent, of an SCI entity having responsibility for such system. The proposed definition is intended to include any personnel used by the SCI entity that has responsibility for the specific system(s) impacted by a given SCI event. Thus, such personnel would include, for example, any technology, business, or operations staff with responsibility for such systems. With respect to systems compliance issues, such personnel would also include regulatory, legal, or compliance personnel with legal or compliance responsibility for such systems. In addition, such “responsible SCI personnel” would not be limited to managerial or senior-level employees of the SCI entity. For example, the proposed definition is intended to include a junior systems analyst responsible for monitoring the operations or testing of an SCI system or SCI security system. The proposed definition would also include not only applicable employees of the SCI entity, but applicable agents of the SCI entity as well. Thus, for example, if an SCI entity were to contract the monitoring of the operations of a given SCI system to an external firm, the proposed definition of “responsible SCI personnel” would include the personnel of such firm that were responsible for the monitoring. The proposed definition, however, is not intended to include all personnel of an SCI entity. For example, personnel of the SCI entity who have no responsibility for any SCI system or SCI security system of an SCI entity are not intended to be included in the proposed definition.

b. Commission Notification

Proposed Rule 1000(b)(4) would address the obligation of an SCI entity to notify the Commission upon any responsible SCI personnel becoming aware of an SCI event. Proposed Rule 1000(b)(4)(i) would require an SCI entity, upon any responsible SCI personnel becoming aware of a systems disruption that the SCI entity reasonably estimates would have a material impact on its operations or on market participants, any systems compliance issue, or any systems intrusion (“immediate notification SCI event”), to notify the Commission of such SCI event, which may be done orally or in writing (e.g., by email). Proposed Rule 1000(b)(4)(ii) would require an SCI entity to submit a written notification pertaining to any SCI event to the Commission within 24 hours of any responsible SCI personnel becoming aware of the SCI event. Proposed Rule 1000(b)(4)(iii) would require an SCI entity to submit to the Commission continuing written updates on a regular basis, or at such frequency as reasonably requested by a representative of the Commission, until such time as the SCI event is resolved.

Proposed Rule 1000(b)(4) also would require that any written notification to the Commission made pursuant to proposed Rules 1000(b)(4)(ii) or 1000(b)(4)(iii) be made electronically on new proposed Form SCI (§ 249.1900), and include all information as prescribed in Form SCI and the instructions thereto. To help ensure that the Commission and its staff receive all information known by the SCI entity relevant to aiding the Commission's understanding of an SCI event, proposed Rule 1000(b)(4)(iv) would provide that a written notification under proposed Rule 1000(b)(4)(ii) must include all pertinent information known about an SCI event, including: (1) A detailed description of the SCI event; (2) the SCI entity's current assessment of the types and number of market participants potentially affected by the SCI event; (3) the potential impact of the SCI event on the market; and (4) the SCI entity's current assessment of the SCI event, including a discussion of the SCI entity's determination regarding whether the SCI event is a dissemination SCI event or not. In addition, to the extent available as of the time of the initial notification, Exhibit 1 would require inclusion of the following information: (1) A description of the steps the SCI entity is taking, or plans to take, with respect to the SCI event; (2) the time the SCI event was resolved or timeframe within which the SCI event is expected to be resolved; (3) a description of the SCI entity's rule(s) and/or governing documents, as applicable, that relate to the SCI event; and (4) an analysis of the parties that may have experienced a loss, whether monetary or otherwise, due to the SCI event, the number of such parties, and an estimate of the aggregate amount of such loss.

Proposed Rule 1000(b)(4)(iv)(B) would require an SCI entity to update any of the pertinent information contained in previous written notifications, including any information required by proposed Rule 1000(b)(4)(iv)(A)(2) that was not available at the time of initial submission. Subsequent notifications would be required to update any of the pertinent information previously provided until the SCI event is resolved.

Proposed Rule 1000(b)(4)(iv)(C) would further require an SCI entity to provide a copy of any information disseminated to date regarding the SCI event to its members or participants or on the SCI entity's publicly available Web site.

The Commission preliminarily believes an SCI entity's obligation to notify the Commission of significant SCI events should begin upon any responsible SCI personnel becoming aware of an SCI event. Thus, for all immediate notification SCI events, an SCI entity would be required to notify the Commission of the SCI event. Such notification could be made orally (e.g., by telephone) or in a written form (e.g., by email). The Commission preliminarily believes that, by not prescribing the precise method of communication for an initial notification of an immediate notification SCI event under proposed Rule 1000(b)(4)(i), SCI entities would have the needed flexibility to determine the most appropriate method. Further, if the responsible SCI personnel became aware of such an SCI event outside of normal business hours, the SCI entity would still be required to notify the Commission at that time rather than, for example, the start of the next business day. For all SCI events, including immediate notification SCI events, an SCI entity would be required to submit a written notification pertaining to such SCI event to the Commission on Form SCI, and follow up with regular written updates until the SCI event is resolved. Even if an SCI entity had notified the Commission of an immediate notification SCI event in writing as would be permitted under proposed Rule 1000(b)(4)(i), the SCI entity would still be required to submit a separate written notification on Form SCI pursuant to proposed Rule 1000(b)(4)(ii).

The Commission preliminarily believes that the proposed notification requirement for immediate notification SCI events, the proposed 24-hour time frame for submission of written notices, and the proposed continuing update requirement, are appropriately tailored to help the Commission and its staff quickly assess the nature and scope of an SCI event, and help the SCI entity identify the appropriate response to the SCI event, including ways to mitigate the impact of the SCI event on investors and promote the maintenance of fair and orderly markets. These requirements would help to ensure not only that the Commission and its staff are kept apprised of such SCI events, including their causes and their effect on the markets, but also that the Commission is aware of the steps and resources necessary to correct such SCI events, mitigate their effects on other SCI entities and the market, and prevent recurrence to the extent possible. The Commission also preliminarily believes that the proposal to require an SCI entity to update the Commission regularly regarding an SCI event, or at such frequency as reasonably requested by a representative of the Commission, until the SCI event is resolved, provides appropriate flexibility to the Commission to request additional information as necessary, depending on the facts and circumstances of the SCI event and the SCI entity's progress in resolving it. At the same time, the Commission recognizes that the information required to be provided to it by an SCI entity about an immediate notification SCI event under proposed Rule 1000(b)(4)(i) would represent the SCI entity's initial assessment of the SCI event, and that even the written notification on Form SCI required under proposed Rule 1000(b)(4)(ii) may, in some cases, be a preliminary assessment of the SCI event for which the SCI entity may still be in the process of analyzing and assessing the precise facts and circumstances related to the SCI event. Thus, the Commission is proposing to only require that SCI entities provide certain key information for the written notification required under proposed Rule 1000(b)(4)(ii), and only provide certain additional details “to the extent available as of the time of the notification.” In addition, the Commission's proposal allows for the SCI entity to subsequently “update any information previously provided regarding the SCI event, including any information required by paragraph (b)(4)(iv)(A)(2) which was not available at the time of the notification made pursuant to paragraph (b)(4)(ii).”

Comprehensive reporting of all SCI events would facilitate the Commission's regulatory oversight of the national securities markets. The proposed reporting requirements should provide the Commission with an aggregate and comprehensive set of data on SCI events, a significant improvement over the current state of administration, whereby SCI entities report events through multiple methods and with varying consistency. The aggregated data that would result from the reporting of SCI events would also permit the Commission to analyze such data, e.g., to examine the most common types of events and the types of systems most often affected. This ability to more efficiently analyze a comprehensive set of data would help the Commission to carry out its oversight responsibilities because it would help the Commission identify more effectively, for example, areas of persistent or recurring problems across the systems of all SCI entities.

As discussed in greater detail below, the Commission also preliminarily believes that submission of required notifications by SCI entities by filing Form SCI in an electronic format would be less burdensome and a more efficient filing process for SCI entities and the Commission than the submission of such notices in non-standardized ad hoc formats, as they are currently provided under the ARP Program.

c. Dissemination of Information to Members or Participants

Proposed Rule 1000(b)(5) would require information relating to dissemination SCI events to be disseminated to members or participants, and specify the nature and timing of such disseminations, with a limited delay permitted for certain systems intrusions, as discussed further below. Proposed Rule 1000(b)(5)(i)(A) would require that an SCI entity, promptly after any responsible SCI personnel becomes aware of a dissemination SCI event other than a systems intrusion, disseminate to its members or participants the following information about such SCI event: (1) The systems affected by the SCI event; and (2) a summary description of the SCI event. In addition, proposed Rule 1000(b)(5)(i)(B) would require an SCI entity to further disseminate to its members or participants, when known: (1) A detailed description of the SCI event; (2) the SCI entity's current assessment of the types and number of market participants potentially affected by the SCI event; and (3) a description of the progress of its corrective action for the SCI event and when the SCI event has been or is expected to be resolved. Proposed Rule 1000(b)(5)(i)(C) would further require an SCI entity to provide regular updates to members or participants on any of the information required to be disseminated under proposed Rules 1000(b)(5)(i)(A) and (i)(B).

For the disseminations of information to members or participants to be meaningful, the Commission preliminarily believes it would be necessary for an SCI entity to describe the SCI event in sufficient detail to enable a member or participant to determine whether and how it was affected by the SCI event and make appropriate decisions based on that determination. For example, the Commission preliminarily believes that a general statement that a systems disruption occurred that impacted trading for a certain period of time would not be sufficient. The dissemination of information should, for example, specify with particularity such information as necessary to provide readers meaningful context with regard to the issue, which may include but is not limited to, details relating to, if applicable: the magnitude of the issue (such as estimates with respect to the number of shares affected, numbers of stocks affected, and total dollar volumes of the affected trades); the specific system(s) or part of the system(s) that caused the issue; the Commission and SCI entity rule(s) that relate most directly to the issue; the specific time periods in which the issue occurred, including whether the issue may be ongoing; and the specific names of the securities affected. The Commission preliminarily believes these proposed items, which concern the timing, nature, and foreseeable possible consequences of a systems problem, comprise the appropriate minimum detail that a member or participant would need to assess whether an SCI event affected or would potentially affect that member or participant, and would assist members and participants in making investment or business decisions based on disclosed facts rather than on speculation regarding, for example, the cause of a market disruption.

The Commission preliminarily believes that it is appropriate to require that the information specified by proposed Rule 1000(b)(5)(i)(A) be disseminated by the SCI entity to its members or participants promptly after any responsible SCI personnel becomes aware of an applicable dissemination SCI event. The Commission also preliminarily believes that it is appropriate to require the further dissemination of information specified by proposed Rule 1000(b)(5)(i)(B) “when known” by the SCI entity. These requirements reflect the Commission's preliminary view that, given the sensitivities of such dissemination of information, it is important that, before information is shared with the SCI entity's members or participants, the SCI entity be given a reasonable amount of time to gather, confirm, and preliminarily analyze facts regarding a dissemination SCI event. The Commission preliminarily believes that the value of dissemination of information to an SCI entity's members or participants in these circumstances is enhanced when the SCI entity has taken an appropriate amount of time to ensure that the information it is sharing with its members or participants is accurate, such that incorrect information does not cause or exacerbate market confusion. At the same time, the Commission preliminarily believes that it is important that basic information about dissemination SCI events, such as those items required by proposed Rule 1000(b)(5)(i)(A), be made available to members or participants promptly.

The proposed requirement relating to dissemination of information to members or participants of dissemination SCI events, other than systems intrusions as specified in proposed Rule 1000(b)(5)(i), is intended to aid members or participants of SCI entities in determining whether their trading activity has been or might be impacted by the occurrence of an SCI event at an SCI entity, so that they could consider that information in making trading decisions, seeking corrective action or pursuing remedies, or taking other responsive action. Further, the requirement to disseminate information regarding dissemination SCI events could provide an incentive for SCI entities to devote more resources and attention to improving the integrity and compliance of their systems and preventing the occurrence of SCI events.

Proposed Rule 1000(b)(5)(ii) would provide a limited exception to the proposed requirement of prompt dissemination of information to members or participants for certain systems intrusions. Proposed Rule 1000(b)(5)(ii) would require an SCI entity, promptly after any responsible SCI personnel becomes aware of a systems intrusion, to disseminate to its members or participants a summary description of the systems intrusion, including a description of the corrective action taken by the SCI entity and when the systems intrusion was resolved or an estimate of when the systems intrusion is expected to be resolved, unless the SCI entity determines that dissemination of such information would likely compromise the security of the SCI entity's SCI systems or SCI security systems, or an investigation of the systems intrusion, and documents the reasons for such determination. The Commission preliminarily believes that information relating to all dissemination SCI events, including systems intrusions, should be disseminated to members or participants, but that there may be circumstances in which such dissemination of information relating to a systems intrusion should be delayed, for example, to avoid compromising the investigation or resolution of a systems intrusion. If an SCI entity determines to delay the dissemination of information to members or participants relating to a systems intrusion, it would be required to make an affirmative determination and document the reasons for such determination that such dissemination would likely compromise the security of its SCI systems or SCI security systems, or an investigation of the systems intrusion. If it cannot make such a determination, or at whatever point in time such a determination no longer applies, information relating to the systems intrusion would be required to be disseminated to the SCI entity's members or participants.

The information required to be disseminated to members or participants for systems intrusions by proposed Rule 1000(b)(5)(ii) is not as extensive as that required to be disseminated to members or participants for other types of dissemination SCI events. The Commission is sensitive to the fact that dissemination of too much detailed information regarding a systems intrusion may provide hackers or others seeking unauthorized entry into the systems of an SCI entity with insights into the potential vulnerabilities of the SCI entity's systems. At the same time, the occurrence of a systems intrusion may reveal a weakness in the SCI systems or SCI security systems of the SCI entity that warrants dissemination of information about such event to the SCI entity's members or participants. Proposed Rule 1000(b)(5)(ii) is therefore intended to strike an appropriate balance by requiring dissemination to members or participants, which may be delayed when necessary, of key summary information about a given systems intrusion.

Request for Comment

106. The Commission requests comment on all aspects of proposed Rules 1000(b)(3), (4), and (5).

107. Do commenters believe the proposed definition of “responsible SCI personnel” in proposed Rule 1000(a) is appropriate? Why or why not? Please explain. Is the proposed definition sufficiently clear? If not, why not? Should the proposed definition only apply to personnel of a given seniority, such as managerial personnel or officers of an SCI entity? Why or why not? Should the proposed definition include both employees and agents of an SCI entity? Why or why?

108. As proposed to be required by Rule 1000(b)(3), do commenters believe the Commission should require an SCI entity, upon any responsible SCI personnel becoming aware of an SCI event, to begin to take appropriate corrective action including, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable? If not, why not? Should the proposed requirement that an SCI entity take corrective action be triggered by something other than awareness of an SCI event? If so, what would be an appropriate trigger, and why?

109. In addition to requiring an SCI entity to take appropriate corrective action, should the Commission also require an SCI entity to have written policies and procedures regarding how it should respond to SCI events, such as an incident response plan that, for example, would lay out in advance of any SCI event the courses of action, responsibilities of personnel, chains of command, or similar information regarding how the SCI entity and its personnel should respond to various SCI event scenarios? Why or why not? Would such a requirement be useful? What would be the potential costs and benefits of such a requirement? Would SCI entities be able to meet the requirements of proposed Rule 1000(b)(3) without developing such response plans? Why or why not? Do SCI entities have such plans in place today? If so, please describe.

110. With respect to proposed Rule 1000(b)(4), do commenters believe the proposal to require an SCI entity to report all SCI events to the Commission is appropriate?

111. Are there SCI events that should not be required to be reported to the Commission? If so, what are they, and why should reporting of such SCI events not be required? Or, as an alternative, would it be appropriate for the Commission to require SCI entities to keep and preserve the documentation relating to certain types of SCI events without sending that documentation to the Commission? Why or why not? If so, how would commenters recommend the Commission distinguish between SCI events that should be reported to the Commission and those that should only be subject to a recordkeeping requirement? What do commenters believe might be the advantages or disadvantages of such an alternative approach? Do commenters believe proposed Rule 1000(b)(4) may require the reporting of types of issues or types of information that may not be critical to the goals of proposed Regulation SCI? Please be specific and describe such situations.

112. What criteria do ARP participants currently use for reporting ARP events? How many SCI events would an SCI entity expect to report each year?

113. For immediate notification SCI events, is the initial notification requirement in proposed Rule 1000(b)(4)(i) to the Commission appropriate? Why or why not? If so, should this requirement apply to such SCI events that occur outside normal business hours as well? If not, what should be the requirement? Should the Commission require a different notification procedure for immediate notifications that might occur outside normal business hours? What are the advantages and disadvantages of different methods of immediate notifications? Please describe. Do commenters agree that those systems disruptions that the SCI entity reasonably estimates would have a material impact on its operations or on market participants should be subject to the immediate notification requirement? Why or why not? Please explain. Do commenters agree that all systems compliance issues should be subject to the immediate notification requirement? Why or why not? Do commenters agree that all systems intrusions should be subject to the immediate notification requirement? Why or why not? Should additional types of SCI events be subject to the immediate notification requirement? If so, which types of SCI events? Please be specific.

114. Do commenters agree with the proposed 24-hour written notification requirement for all SCI events?

115. Do commenters believe it is appropriate to require that written updates be submitted regularly until an SCI event is resolved, or at such frequency as reasonably requested by a representative of the Commission?

116. Do commenters believe the proposed required dissemination of information to an SCI entity's members or participants regarding dissemination SCI events set forth in proposed Rule 1000(b)(5) are appropriate? If not, why not? Do commenters believe that requiring the dissemination of information about dissemination SCI events to members or participants would promote dissemination of information to persons who are most directly affected by such events? Why or why not? With respect to proposed Rule 1000(b)(5), should any of the proposed requirements relating to dissemination of information to members or participants be eliminated or modified? Please explain. What other information, if any, should be required to be disseminated to members or participants? Please explain. Could these proposed requirements have any negative or unintended impact on the market or market participants? If so, please explain.

117. Do commenters agree with the timing requirements contained in proposed Rule 1000(b)(5)? Do commenters agree that the initial dissemination of information to members or participants should be required promptly after an SCI entity's responsible SCI personnel becomes aware of a dissemination SCI event, as would be required by proposed Rule 1000(b)(5)(i)(A)? Do commenters believe that more specific timing requirements would be more appropriate? If so, what should such requirements be? Should there be a specific time period requirement with respect to subsequent updates on the status of the dissemination SCI event? Why or why not? For example, should there be a requirement that an SCI entity provide updates daily or weekly? If so, what additional specificity should be included?

118. Do commenters believe it is appropriate to permit an SCI entity to delay the dissemination of information to members or participants for certain systems intrusions as proposed in Rule 1000(b)(5)(ii)? Should an SCI entity be required to immediately disseminate information to members or participants regarding a systems intrusion, with delays permitted only when the Commission specifically authorizes the delay? Why or why not? Should the proposed rule impose a maximum period of time that an SCI entity may delay its dissemination of information to members or participants for certain systems intrusions? Why or why not? If so, what should such a maximum period of time be and should the rule set forth a specific maximum time period applicable to all instances? Please explain.

119. Are there types of dissemination SCI events that should not be required to be disseminated to members or participants? If so, what are they, and why should it not be required?

120. Should dissemination of information to members or participants of any types of dissemination SCI events, other than those that are systems intrusions, be delayed? If so, please describe the types of SCI events and explain why. In addition, please describe the time period within which commenters believe such types of dissemination SCI events should be disseminated and why such time period would be appropriate.

121. For any types of dissemination SCI events for which commenters believe information should either not be required to be disseminated to members or participants or be permitted to have a delay in dissemination in certain circumstances (such as for systems intrusions), what might be the impact of such non-dissemination or delay in dissemination with respect to different types of market participants?

122. Are there SCI entities for which the proposed requirements in Rules 1000(b)(3), (b)(4), and (b)(5) would not be appropriate (e.g., not cost-effective)? If so, please identify such entity or entities, or the characteristics of such entity or entities, and explain which proposed requirements would be inappropriate and why. Is the fact that they might not be cost-effective an appropriate reason to omit them generally for those SCI entities, or on a case-by-case basis, as the Commission determined to be consistent with Exchange Act requirements?

123. What are the current practices of SCI entities with respect to the dissemination of information about systems issues to members or participants? What type of information do SCI entities currently disseminate? Please describe.

4. Notification of Material Systems Changes

Proposed Rule 1000(b)(6) addresses notification to the Commission regarding planned material systems changes, which the Commission believes is important to help ensure it has information about important changes at an SCI entity that may affect the SCI entity's ability to effectively oversee the operations of its systems. Proposed Rule 1000(b)(6) would require an SCI entity, absent exigent circumstances, to notify the Commission in writing at least 30 calendar days before implementation of any planned material systems changes including a description of the planned material systems changes as well as the expected dates of commencement and completion of implementation of such changes. A written notification to the Commission made pursuant to paragraph (b)(6) would be required to be made electronically on Form SCI and include all information as prescribed in Form SCI and the instructions thereto.

The Commission preliminarily believes that the proposed 30 calendar day requirement regarding pre-implementation written notification to the Commission of planned material systems changes would be an appropriate time period. The Commission has found through its experience with the current ARP Inspection Program that this amount of advance notice typically is needed to allow Commission staff to effectively monitor technology developments associated with a planned material systems change. A shorter timeframe might not provide sufficient time for Commission staff to understand the impact of the systems change; a longer time frame might unnecessarily interfere with SCI entities' flexibility in planning and implementing systems changes.

If exigent circumstances existed, or if the information previously provided to the Commission regarding any planned material systems change has become materially inaccurate, the SCI entity would be required to notify the Commission, either orally or in writing, with any oral notification to be memorialized within 24 hours after such oral notification by a written notification, as early as reasonably practicable. The existence of exigent circumstances would be determined by the SCI entity and might exist where, for example, a systems compliance issue or systems intrusion were discovered that requires immediate corrective action to ensure compliance with the Exchange Act and the rules and regulations thereunder, and/or the SCI entity's own rules and procedures. In such cases, it would not be prudent or desirable to delay corrective action simply to permit the 30 calendar days' advance notice required in non-exigent circumstances. In addition, there may be circumstances where the information previously provided to the Commission regarding a material systems change has become materially inaccurate. For example, if a material systems change's expected implementation completion date were to be substantially delayed because of an inability to procure systems components, or due to difficulties in systems programming, an update to reflect this development would enable the Commission to make further inquiry (as appropriate) in order to understand the potential consequences of the delay. Similarly, an update would be required if the SCI entity were to decide to significantly alter the scope of its planned material systems change.

The Commission notes further that, in such cases, an SCI entity might separately be obligated to notify the Commission or its members or participants pursuant to proposed Rules 1000(b)(4) and (5), as discussed above.

Request for Comment

124. The Commission requests comment generally on proposed Rule 1000(b)(6). Is the proposed requirement to notify the Commission in advance of implementation of material systems changes appropriate?

125. Should the Commission provide additional guidance on, or define, what constitutes “exigent circumstances” that would obviate the need for advance notification? If so, what information, clarification, or definition would be helpful, and why?

126. Do commenters believes that an SCI entity should be required to provide updated information to the Commission regarding a planned material systems change if the information previously provided to the Commission regarding such change were to become materially inaccurate? Why or why not?

127. Do commenters believe that the proposed notification requirements would discourage an SCI entity from making necessary systems changes? Why or why not?

128. Is the proposed requirement that an SCI entity report all material systems changes too broad or too narrow? Why or why not? Should all material systems changes be reported to the Commission? If not, which systems changes should be excluded? Do commenters believe the proposed rule should specify quantitative criteria or other minimum thresholds for the effect of a change to an SCI entity's systems on the entity's capacity, security, and operations, beyond which the SCI entity would be required to notify the Commission of the change?

129. Do commenters believe it is appropriate for the Commission to require a standardized format for disclosing planned material systems changes on new proposed Form SCI? If not, why not? What would be a better approach?

130. Are there SCI entities for which the proposed requirements in Rule 1000(b)(6) would not be appropriate (e.g., cost-effective)? If so, please identify such entity or entities, or the characteristics of such entity or entities, and explain which proposed requirements would be inappropriate and why. If they are not cost-effective, would that be an appropriate reason to omit them generally for those SCI entities, or on a case-by-case basis, as the Commission determined to be consistent with Exchange Act requirements?

131. How often do SCI entities make material systems changes?

5. Review of Systems

Proposed Rule 1000(b)(7) would require an SCI entity to conduct an SCI review of the SCI entity's compliance with Regulation SCI not less than once each calendar year, and submit a report of the SCI review to senior management of the SCI entity no more than 30 calendar days after completion of such SCI review. Proposed Rule 1000(a) would define the term “SCI review” to mean a review, following established procedures and standards, that is performed by objective personnel having appropriate experience in conducting reviews of SCI systems and SCI security systems, and which review contains: (1) A risk assessment with respect to such systems of the SCI entity; and (2) an assessment of internal control design and effectiveness to include logical and physical security controls, development processes, and information technology governance, consistent with industry standards. In addition, such review would be required to include penetration test reviews of the SCI entity's network, firewalls, development, testing and production systems at a frequency of not less than once every three years. The proposed requirement for an annual SCI review would formalize a practice in place under the current ARP Inspection Program in which SROs conduct annual systems reviews following established audit procedures and standards that result in the presentation of a report to senior SRO management on the recommendations and conclusions of the review.

The risk assessment with respect to SCI entity's systems and assessment of internal control design and effectiveness should help an SCI entity assess the effectiveness of its information technology practices and determine where to best devote resources, including identifying instances in which the SCI entity was not in compliance with the policies and procedures required by proposed Rules 1000(b)(1) and (2). The penetration test reviews of the SCI entity's network, firewalls, and development, testing and production systems should help an SCI entity evaluate the system's security and resiliency in the face of attempted and successful systems intrusions. In requiring a frequency of not less than once every three years for penetration test reviews, the Commission seeks to balance the frequency of such tests with the costs associated with performing the tests.

For such assessments and reviews to be effective, the Commission preliminarily believes that it is important that they be conducted by objective personnel having appropriate experience performing such types of reviews. The Commission is not proposing a definition of the term “objective,” but preliminarily believes that to satisfy the criterion that an SCI review be conducted by “objective personnel,” it should be performed by persons who have not been involved in the development, testing, or implementation of the systems being reviewed. The Commission preliminarily believes that persons who were not involved in the process for development, testing, or implementation of such systems would likely be in a better position to identify weaknesses and deficiencies that were not identified in the development, testing, and implementation stages. As proposed, the SCI review could be performed by personnel of the SCI entity (e.g., an SCI entity's internal audit department) or an external firm with objective personnel.

In addition, proposed Rule 1000(b)(7) would require an SCI entity to submit a report of the SCI review to senior management of the SCI entity no more than 30 calendar days after completion of such SCI review. The proposed 30-day time frame is based on the Commission's experience with the current ARP Inspection Program that an entity is able within 30 calendar days to consider the review and prepare a report for senior management consideration prior to submission to the Commission.

Request for Comment

132. The Commission requests comment on all aspects of proposed Rule 1000(b)(7). Is the proposed definition of “SCI review” appropriate? Why or why not? And, if not, what would be an appropriate definition?

133. Is the proposed scope of the SCI review appropriate? Why or why not? Is it sufficiently clear? Why or why not? Should the SCI review include, as proposed in Rule 1000(a), an assessment of internal control design and effectiveness to include logical and physical security controls, development processes, and information technology governance, consistent with industry standards? Why or why not? Should it include, as proposed in Rule 1000(a), penetration test reviews of the SCI entity's network, firewalls, development, testing and production systems? Is the proposed frequency of such penetration test reviews (i.e., not less than once every three years) appropriate? Why or why not? Should it be more or less frequent? Why or why not?

134. Do commenters agree with the proposed requirement that the review be performed by persons with appropriate experience conducting reviews of SCI systems and SCI security systems? Should the Commission define how it would evaluate whether a person or persons performing the review would satisfy the proposed requirement that they have appropriate systems review experience? Are there any credentials or specific qualifications that the Commission should require or specify as meeting the requirement? For example, should the Commission specify that a review be conducted by a Certified Information System Auditor (CISA) or GIAC Systems and Network Auditor (GSNA) certification?

135. Should the term “objective personnel” be defined or further clarified? If so, what should be such definition?

136. Are there other elements that should be included in the scope of the SCI review? If so, which ones? For example, should the review include an assessment of the systems' compliance with the federal securities laws and rules and regulations thereunder or the entity's rules or governing documents as applicable? Why or why not?

137. Under what circumstances do SCI entities presently use outside consultants or other third parties to review their systems and controls? When such outside reviews are conducted, what is the scope and the stated purpose? How do outside reviews compare to internal reviews by audit or other staff in terms of scope or other factors? What are the considerations used by SCI entities in determining whether and when to engage outside consultants? How do commenters generally view the advantages and disadvantages of internal v. external reviews? The Commission is not proposing at this time any requirements related to third party reviews. Should the Commission propose to require that SCI review be conducted by third parties?

138. What are the current practices of SCI entities with respect to reviews of their SCI systems and SCI security systems? How often are such reviews conducted? Who conducts such reviews? What do such reviews entail? What types of assessments or tests are included in such reviews? Do such reviews include penetration test reviews? Please describe.

139. Do commenters agree with the proposal to require an SCI entity to submit a report of the SCI review to senior management of the SCI entity no more than 30 calendar days after completion of such SCI review? Why or why not? Is the 30-day time frame reasonable? Would a shorter or longer time period be more appropriate, such as 20, 45, or 60 days? If so, what should such a time period be and why? Please explain.

6. Periodic Reports

Proposed Rule 1000(b)(8)(i) would require an SCI entity to submit to the Commission a report of the SCI review required by paragraph (b)(7), together with any response by senior management, within 60 calendar days after its submission to senior management of the SCI entity.

The proposed requirement to submit a report of the SCI review required by paragraph (b)(7), together with any response by senior management, within 60 calendar days after its submission to senior management of the SCI entity, is designed to ensure that the senior management of the SCI entity is aware of any issues with its systems and promptly establishes plans for resolving such issues. The Commission preliminarily believes that the report would also help ensure that the Commission and its staff receive the report and any management response in a timely manner, would help to ensure that the Commission is aware of areas that may warrant more focused attention during its inspections (i.e., which SCI entities would already have identified for itself through its SCI review), and would allow the Commission to review the SCI entity's progress in resolving any systems issues. Further, the proposed requirement to submit the annual report within 60 calendar days after its submission to senior management is based on the Commission's experience with the current ARP Inspection Program that 60 calendar days after completion of an annual review or report is a sufficient period of time to enable senior management to consider such review or report before submitting it to the Commission.

In addition, proposed Rule 1000(b)(8)(ii) would require each SCI entity to submit a report within 30 calendar days after the end of June and December of each year containing a summary description of the progress of any material systems change during the six-month period ending on June 30 or December 31, as the case may be, and the date, or expected date, of completion of implementation of such changes. The proposed requirement to submit these semi-annual reports within 30 calendar days of the end of each semi-annual period is designed to ensure that the Commission would have regularly updated information with respect to the status of ongoing material systems changes that were originally reported pursuant to proposed Rule 1000(b)(6). This proposed requirement would formalize a practice in place under the current ARP Inspection Program in which senior information technology, audit, and compliance staff of certain SROs prepare such reports in advance of meeting with Commission staff periodically throughout the year to present and discuss recently completed systems projects and proposed systems projects. Further, the proposed requirement to submit the semi-annual report within 30 calendar days after the end of the applicable semi-annual period is based on the Commission's experience with the current ARP Inspection Program that 30 calendar days after completion of a report is a sufficient time period to enable senior management to consider such report before submitting it to the Commission. The Commission is proposing to require these reports to be submitted to the Commission on a semi-annual basis because the proposal would separately require information relating to planned material systems changes to be submitted (absent exigent circumstances or when information regarding any planned material systems change becomes materially inaccurate) at least 30 calendar days before their implementation and thus requiring an ongoing summary report more frequently would not, in the Commission's preliminary view, be necessary. On the other hand, the Commission is concerned that a longer period of time (such as on an annual basis) would permit significant updates and milestones relating to systems changes to occur without notice to the Commission.

Pursuant to proposed Rule 1000(b)(8)(iii), the reports required to be submitted to the Commission by proposed Rule 1000(b)(8) would be required to be submitted electronically as prescribed in Form SCI and the instructions thereto.

Request for Comment

140. Do commenters believe it would be appropriate to require SCI entities to submit a report of an SCI review to the Commission within 60 calendar days of its submission to senior management of the SCI entity? Should the Commission lengthen or shorten the time period for submission? Why or why not? If so, what is an appropriate period?

141. Is the proposed requirement to submit semi-annual reports on material systems changes necessary or appropriate? Do commenters believe it would be appropriate to require each SCI entity to submit a semi-annual report within 30 calendar days after the end of each semi-annual period containing a description of the progress of any material systems change during the applicable semi-annual period and the date, or expected date, of completion of implementation? Should the Commission lengthen or shorten the 30-day period for submission? Is the semi-annual submission requirement appropriate or should these reports be required to be submitted more or less frequently? If so, please state what such frequency should be and why.

142. Are there any other reports the Commission should require of SCI entities? If so, please explain.

143. Are there SCI entities for which the proposed requirements in Rule 1000(b)(8) would not be cost-effective? If so, please identify such entity or entities, or the characteristics of such entity or entities. For proposed requirements that commenters believe would not be cost-effective, would that be an appropriate reason to omit them generally for those SCI entities, or on a case-by-case basis, as the Commission determines to be consistent with Exchange Act requirements?

7. Proposed Rule 1000(b)(9): SCI Entity Business Continuity and Disaster Recovery Plans Testing Requirements for Members or Participants

The Commission is proposing Rule 1000(b)(9), which would address testing of SCI entity business continuity and disaster recovery plans, including backup systems, by SCI entity members or participants. Specifically, proposed Rule 1000(b)(9)(i) would require an SCI entity, with respect to its business continuity and disaster recovery plans, including its backup systems, to require participation by designated members or participants in scheduled functional and performance testing of the operation of such plans, in the manner and frequency as specified by the SCI entity, at least once every 12 months. Proposed Rule 1000(b)(9)(ii) would further require an SCI entity to coordinate such testing on an industry- or sector-wide basis with other SCI entities. Proposed Rule 1000(b)(9)(iii) would require each SCI entity to designate those members or participants it deems necessary, for the maintenance of fair and orderly markets in the event of the activation of its business continuity and disaster recovery plans, to participate in the testing of such plans. Proposed Rule 1000(b)(9)(iii) would also require each SCI entity to notify the Commission of such designations and its standards for designation on Form SCI and promptly update such notification after any changes to its designations or standards.

The Commission preliminarily believes that the testing participation requirement in proposed Rule 1000(b)(9) would help an SCI entity to ensure that its efforts to develop effective business continuity and disaster recovery plans are not undermined by a lack of participation by its members or participants that the SCI entity believes would be necessary to the success of such plans if they were to be put into effect. The Commission further preliminarily believes that the appropriate standard for measuring whether a business continuity and disaster recovery plans can be activated successfully is whether such activation would likely result in the maintenance of fair and orderly markets, a goal Congress found important in adopting Section 11A of the Exchange Act.

The 2003 Interagency White Paper, which underlies the requirement in proposed Rule 1000(b)(1)(i)(E) pertaining to business continuity and disaster recovery plans, identifies three important business continuity objectives that would apply to SCI entities: (1) Rapid recovery and timely resumption of critical operations following a wide-scale disruption; (2) rapid recovery and timely resumption of critical operations following the loss or inaccessibility of staff in at least one major operating location; and (3) a high level of confidence, through ongoing use or robust testing, that critical internal and external continuity arrangements are effective and compatible. The 2003 Interagency White Paper also states that it is a “sound practice” for organizations to “routinely use or test recovery and resumption arrangements.” Further, the Commission's 2003 Policy Statement on Business Continuity Planning for Trading Markets states, among other things, that market centers, including SROs, are to: (1) Have in place a business continuity plan that anticipates the resumption of trading in the securities traded by that market no later than the next business day following a wide-scale disruption; (2) maintain appropriate geographic diversity between primary and back-up sites in order to assure resumption of trading activities by the next business day; and (3) confirm the effectiveness of the backup arrangements through testing. SCI entities that currently participate in the ARP Inspection Program are familiar with the standards identified in the 2003 Interagency White Paper and the Commission's 2003 Policy Statement on Business Continuity Planning for Trading Markets.

As noted above, the experience of the equities and options markets in the wake of Superstorm Sandy demonstrates the importance of not only an SCI entity itself being able to operate following an event that triggers its business continuity and disaster recovery plans, but also that the members or participants of the SCI entity be able to conduct business with such SCI entity when its business continuity and disaster recovery plans have been activated. The Commission preliminarily believes that, even if an SCI entity is able to operate following an event that triggers its business continuity and disaster recovery plans, unless there is effective participation by certain of its members or participants in the testing of such plans, the objective of ensuring resilient and available markets in general, and the maintenance of fair and orderly markets in particular, would not be achieved. Accordingly, the Commission preliminarily believes that it is appropriate to require SCI entities to designate members or participants they believe are necessary to the successful activation of their business continuity and disaster recovery plans, including backup systems, and require them to participate in the testing of such plans.

Under the proposed rule, each SCI entity would need to schedule, and require their designated members or participants to participate in, scheduled “functional and performance testing” of the entity's business continuity and disaster recovery plans. Such functional and performance testing should include not only testing of connectivity, but also testing of an SCI entity's systems, such as order entry, execution, clearance and settlement, order routing, and the transmission and/or receipt of market data, as applicable, to determine if they can operate as contemplated by its business continuity and disaster recovery plans.

Proposed Rule 1000(b)(9)(i) would require that testing of an SCI entity's business continuity and disaster recovery plans occur at least once every 12 months. This proposed requirement reflects the Commission's preliminary view that the testing of business continuity and disaster recovery plans, including backup systems, must occur regularly if such plans are to be effective when an actual disaster or disruption occurs. The Commission preliminarily believes that its proposed required testing frequency of at least once every 12 months is the minimum frequency that would be consistent with seeking to ensure that testing is meaningful and effective. However, the proposed rule would not prevent an SCI entity from conducting testing and requiring participation by members or participants in such testing more frequently than once every 12 months, if the SCI entity believes it is necessary or if, for example, it materially modifies its business continuity and disaster recovery plans.

Proposed Rule 1000(b)(9)(i) would also provide an SCI entity with discretion to determine the precise manner and content of the testing. Thus, for example, the SCI entity would have discretion to determine, for example, the duration of the testing, the sample size of transactions tested, the scenarios tested, and the scope of the test. The Commission preliminarily believes that SCI entities are in the best position to structure the details of the test in a way that would maximize its utility.

Although proposed Rule 1000(b)(9)(i) would give SCI entities discretion to determine the precise manner and content of the testing, the Commission is also proposing Rule 1000(b)(9)(ii), which would require an SCI entity to coordinate its testing on an industry- or sector-wide basis with other SCI entities. The proposed coordination requirement is designed to enhance the value of testing by requiring SCI entities to work together to schedule and conduct the testing in as efficient and effective a manner as possible. Given that trading in the U.S. securities markets today is dispersed among a wide variety of exchanges, ATSs, and other trading venues, and is often conducted through sophisticated algorithmic trading strategies that access many trading platforms simultaneously, the Commission preliminarily believes that requiring SCI entities to coordinate testing is necessary to ensure the goal of achieving robust and effective business continuity and disaster recovery plans, because it would result in testing under more realistic market conditions. In addition, the Commission is cognizant that situations that trigger implementation of an SCI entity's business continuity and disaster recovery plans are often not limited in scope to a single SCI entity, but may affect multiple, or even all, SCI entities at the same time. Thus, proposed Rule 1000(b)(9)(ii)'s requirement is designed to foster better coordination and cooperation across the securities industry such that the markets, investors, and all market participants may benefit from more efficient and meaningful testing. Further, the Commission preliminarily believes that it would be more cost-effective for market participants to participate in the testing of the business continuity and disaster recovery plans of SCI entities on an industry- or sector-wide basis because such coordination would likely reduce duplicative testing efforts.

While proposed Rule 1000(b)(9)(ii) would require SCI entities to coordinate testing on an industry- or sector-wide basis, it would provide discretion to SCI entities to determine how to best meet this requirement because the Commission preliminarily believes that SCI entities currently are best suited to find the most efficient and effective way to test. Of course, as noted above, each SCI entity may require its members or participants to participate in additional testing beyond the industry- or sector-wide testing under proposed Rule 1000(b)(9)(ii).

Proposed Rule 1000(b)(9)(iii) would require each SCI entity to designate those members or participants it deems necessary, for the maintenance of fair and orderly markets in the event of the activation of its business continuity and disaster recovery plans, to participate in the testing of such plans. In addition, proposed Rule 1000(b)(9)(iii) would require each SCI entity to provide to the Commission on Form SCI its standards for determining which members or participants are necessary for the maintenance of fair and orderly markets in the event of the activation of its business continuity and disaster recovery plans and promptly update such notification following any changes to such standards. The Commission believes that the viability of an SCI entity's business continuity and disaster recovery plans, and the usefulness of its backup systems, depend upon the ability of such members or participants to be ready, able, and willing to use such systems during an actual disaster or disruption. The proposed requirement that designated members or participants be required to test such plans in advance reflects the Commission's preliminary view that the proposed testing would enhance the value of SCI entities' business continuity and disaster recovery plans, and thereby advance the goal of achieving resilient and available markets.

For SCI SROs, proposed Rule 1000(b)(9)(iii) would require SRO rules pursuant to Section 19(b) of the Exchange Act, setting forth the standards for designation. For an SCI ATS or an exempt clearing agency subject to ARP, the requirement in proposed Rule 1000(b)(9)(iii) would be satisfied by setting forth such standards in its internal procedures, as well as any subscriber or similar agreement, as applicable. For an SCI entity that is a plan processor, proposed Rule 1000(b)(9)(iii) would require an amendment to the applicable SCI Plan pursuant to Rule 608 of Regulation NMS, setting forth such standards. Further, proposed Rule 1000(b)(9)(iii) would require each SCI entity to provide to the Commission on Form SCI the list of designated members or participants and promptly update such notification following any changes to the designations.

Request for Comment

144. The Commission requests comment generally on proposed Rule 1000(b)(9).

145. Do commenters believe the proposal to require an SCI entity, with respect to its business continuity and disaster recovery plans, including its backup systems, to require participation by designated members or participants in scheduled functional and performance testing of the operation of such plans, in the manner and frequency as specified by the SCI entity, is appropriate? Why or why not? Is the proposed requirement that SCI entities require participation in “functional and performance testing” appropriate? Why or why not? Is the term “functional and performance testing” clear? If not, why not and what would be a better description of the nature of the proposed required testing?

146. Do commenters believe it is appropriate to require that such testing occur at least once every 12 months? Why or why not? Would another minimum interval for such testing, such as bi-annually, semi-annually, or quarterly, be more appropriate? Please explain. Would it be appropriate to also require such testing to occur following a material change to the SCI entity's business continuity and disaster recovery plans? Why or why not? If yes, would it be appropriate to require such testing within 90 days of the material change? Why or why not? Would another time period be more appropriate? If so, what should such time period be?

147. Should the Commission give SCI entities discretion in designating the members or participants that must participate in the testing of the business continuity and disaster recovery plans? Why or why not? Should the Commission instead specify standards for such designation? If so, what should the standards be based on? For example, should the standards be based on the size, volume traded or cleared, and/or geographic proximity of a member or participant to the SCI entity's backup systems? Why or why not? Should only members or participants that execute or clear transactions above a certain volume threshold and/or that account for a certain percentage of trading volume on the SCI entity be required to participate? Why or why not? If so, what should be such threshold or thresholds (e.g., 0.5 percent, 1 percent, 5 percent)? Should an SCI entity be required to mandate participation in testing by some other subset of members or participants? For example, should such subset comprise members or participants that account for a certain percentage of trading in each or all of the equities, options, or fixed-income markets traded through the SCI entity? Why or why not? If so, what should be such threshold (e.g., 0.5 percent, 1 percent, 5 percent)? Or, should testing be mandated only for certain types of market participants (e.g., market makers, clearing broker-dealers, retail broker-dealers)? If so, for which types of market participants should testing be mandatory and why? Please explain. Alternatively, should all members or participants of an SCI entity (or certain types of SCI entities, e.g., plan processors) be required to participate in the testing of its business continuity and disaster recovery plans? Why or why not?

148. Do commenters believe those members or participants that would likely be designated by SCI entities under proposed Rule 1000(b)(9)(iii) currently have the ability, including the infrastructure, to participate in the required testing? Do commenters believe all members or participants of SCI entities currently have the ability, including the infrastructure, to participate in such testing? What would be the costs and benefits to a member or participant of an SCI entity to participate in such testing, including for such member or participant to establish and maintain connectivity to an SCI entity's backup systems? What would be the economic effect of this proposed rule, particularly with regard to a member or participant? Please describe in detail and provide data to support your views if possible.

149. Should an SCI entity be required to notify the Commission on Form SCI of its standards for designating members or participants for testing and its list of designated members or participants? Why or why not? Should an SCI entity be required to promptly update such Commission notification if its standards for designation or list of designated members or participants change? Why or why not? Is there a more appropriate time period for updating Commission notifications (e.g., 7 days following a change, 30 days following a change, quarterly)? Please explain.

150. Proposed Rule 1000(b)(9)(i) would require each SCI entity to mandate participation by designated members or participants in “functional and performance testing” of its business continuity and disaster recovery plans, including its backup systems, but would leave to the discretion of the SCI entity the details regarding the manner of testing. Should the Commission be more prescriptive with respect to such testing? For example, should the Commission require that SCI entities periodically operate from their backup facilities during regular trading hours? Why or why not? Please explain. Are there other details that the Commission should prescribe in relation to the proposed rule? If so, please explain.

151. Proposed Rule 1000(b)(9)(ii) would require SCI entities to coordinate testing on an industry- or sector-wide basis, but would not specify how or the parameters. Do commenters believe it is appropriate to leave such discretion to SCI entities? Why or why not? Are the terms “industry-wide” and “sector-wide” clear? Should the Commission define these terms? If so, what would be appropriate definitions? Would such an approach foster the creation of meaningful, efficient testing of business continuity and disaster recovery plans across SCI entities and their members or participants? Why or why not? If not, what would be a more appropriate approach? Should the Commission require a minimum number of SCI entities needed to satisfy the coordination requirement of proposed Rule 1000(b)(9)(ii)? Or should that requirement only be satisfied if all SCI entities (or all SCI entities within a sector of the industry) participate? Why or why not? Should the Commission mandate a minimum list of actions that SCI entities must take to satisfy the requirement of proposed Rule 1000(b)(9)(ii)? If so, what actions should be required and why? If not, why not?

152. Should the Commission require SCI entities to submit reports on the results of their testing of business continuity and disaster recovery plans or reports of any systems testing that was not successful? If not, why not? If so, should such reports be required to be submitted within a specified time frame or in a specified manner or format? Please explain. In addition, should the Commission require SCI entities to submit reports on systems testing opportunities required of or made available to members or subscribers and the extent to which such members or subscribers participate in such opportunities?

153. Would proposed Rule 1000(b)(9) enhance investor confidence in the integrity of the U.S. securities markets? Why or why not? Please explain. What would be the costs associated with proposed Rule 1000(b)(9)? What would be the benefits? Please be specific. What would be the potential competitive impacts of proposed Rule 1000(b)(9), including impacts on small members or small participants? To the extent possible, please provide data to support your views.

154. To help ensure that the goals of an SCI entity's business continuity and disaster recovery plans are achieved, should the Commission impose other requirements (in addition to the mandatory testing participation requirement in proposed Rule 1000(b)(9)) on the members or participants of SCI entities? For example, proposed Rule 1000(b)(1)(i)(E) would require that an SCI entity's business continuity and disaster recovery plans allow for “maintaining backup and recovery capabilities sufficiently resilient and geographically diverse to ensure next business day resumption of trading.” Should the Commission require SCI entities to mandate that some or all of their members or participants be able to meet the next business day resumption of trading standards for SCI entities in proposed Rule 1000(b)(1)(i)(E)? Why or why not? If not all, which members or participants should be required to meet such resumption of trading standards? For example, should an SCI entity require members or participants that execute transactions above a certain volume threshold and/or that account for a certain percentage of trading on the SCI entity to meet such resumption of trading standards? Why or why not? If so, what should be such threshold or thresholds?

155. Are there other requirements that SCI entities should mandate for their members or participants to help SCI entities meet their obligations under proposed Regulation SCI? If so, what are they? Please describe. For example, should the Commission also require each SCI entity to mandate that its members or participants maintain continuous connectivity with the SCI entity's backup data centers? Why or why not? If not all, which members or participants should be required to maintain continuous connectivity with the SCI entity's backup data centers? For example, should an SCI entity require members or participants designated under proposed Rule 1000(b)(9)(iii), or that execute transactions above a certain volume threshold and/or that account for a certain percentage of trading on the SCI entity, to maintain such connectivity? Why or why not? If so, what should be such threshold or thresholds?

D. Proposed Rule 1000(c)-(f): Recordkeeping, Electronic Filing on Form SCI, and Access

1. Recordkeeping Requirements

The Commission notes that many SCI entities are already subject to recordkeeping requirements, but that records relating to systems review and testing may not be specifically addressed in certain current recordkeeping rules. Accordingly, the Commission is proposing Rule 1000(c) to specifically address recordkeeping requirements for SCI entities with respect to records relating to Regulation SCI compliance.

Proposed Rule 1000(c)(1) would require each SCI SRO to make, keep, and preserve all documents relating to its compliance with Regulation SCI, as prescribed by Rule 17a-1 under the Exchange Act. Rule 17a-1(a) under the Exchange Act requires every national securities exchange, national securities association, registered clearing agency, and the MSRB to keep and preserve at least one copy of all documents, including all correspondence, memoranda, papers, books, notices, accounts, and other such records as shall be made and received by it in the course of its business as such and in the conduct of its self-regulatory activity. In addition, Rule 17a-1(b) requires these entities to keep all such documents for a period of not less than five years, the first two years in an easily accessible place, subject to the destruction and disposition provisions of Rule 17a-6. Rule 17a-1(c) requires these entities, upon request of any representative of the Commission, to promptly furnish to the possession of Commission representatives copies of any documents required to be kept and preserved by it pursuant to Rule 17a-1(a) and (b). The Commission believes that the breadth of Rule 17a-1 under the Exchange Act is such that it would require SCI SROs to make, keep, and preserve records relating to their compliance with proposed Regulation SCI should the Commission adopt Regulation SCI. Thus, the Commission proposes to cross-reference Rule 17a-1 in proposed Regulation SCI to be clear that it intends all SCI entities to be subject to the same recordkeeping requirements regarding compliance with proposed Regulation SCI.

For SCI entities that are not SCI SROs (i.e., SCI ATSs, plan processors, and exempt clearing agencies subject to ARP), the Commission is proposing broad recordkeeping requirements relating to compliance with proposed Regulation SCI that are consistent with those applicable to SROs under Rule 17a-1 under the Exchange Act. Thus, the Commission is proposing Rule 1000(c)(2), which would require SCI entities other than SCI SROs to: (i) Make, keep, and preserve at least one copy of all documents, including correspondence, memoranda, papers, books, notices, accounts, and other such records, relating to its compliance with Regulation SCI, including, but not limited to, records relating to any changes to its SCI systems and SCI security systems; (ii) keep all such documents for a period of not less than five years, the first two years in a place that is readily accessible to the Commission or its representatives for inspection and examination; and (iii) upon request of any representative of the Commission, promptly furnish to the possession of such representative copies of any documents required to be kept and preserved by it pursuant to (i) and (ii) above.

Proposed Rule 1000(c)(3), applicable to all SCI entities, would require each SCI entity, upon or immediately prior to ceasing to do business or ceasing to be registered under the Exchange Act, to take all necessary action to ensure that records required to be made, kept, and preserved by proposed Rule 1000(c) would be accessible to the Commission or its representatives for the remainder of the period required by proposed Rule 1000(c). For example, an SCI entity could fulfill its obligations under proposed Rule 1000(c)(3) by delivering such records, immediately prior to deregistration, to a repository or other similar entity and by making all necessary arrangements for such records to be readily accessible to the Commission or its representative, for inspection and examination for the duration of the requirement under proposed Rule 1000(c)(3).

The Commission preliminarily believes that its ability to examine for and enforce compliance with proposed Regulation SCI could be hampered if an SCI entity were not required to adequately provide accessibility for the full proposed retention period. In addition, while many SCI events may occur, be discovered, and be resolved in a short time frame, there may be other SCI events that may not be discovered until months or years after their occurrences, or may take significant periods of time to fully resolve. In such cases, having an SCI entity's records available even after it has ceased to do business or be registered under the Exchange Act would be beneficial. Because SCI events have the potential to negatively impact investor decisions, risk exposure, and market efficiency, the Commission also preliminarily believes that its ability to oversee the securities markets could be undermined if it is unable to review records to determine the causes and consequences of one or more SCI events experienced by an SCI entity that deregisters or ceases to do business. This information would provide an additional tool to help the Commission reconstruct important market events and better understand how such events impacted investor decisions, risk exposure, and market efficiency.

Proposed Rule 1000(e) would provide that, if the records required to be made or kept by an SCI entity under proposed Regulation SCI were prepared or maintained by a service bureau or other recordkeeping service on behalf of the SCI entity, the SCI entity would be required to ensure that the records are available for review by the Commission and its representatives by submitting a written undertaking, in a form acceptable to the Commission, by such service bureau or other recordkeeping service, signed by a duly authorized person at such service bureau or other recordkeeping service. The written undertaking would be required to include an agreement by the service bureau designed to permit the Commission and its representatives to examine such records at any time or from time to time during business hours, and to promptly furnish to the Commission and its representatives true, correct, and current electronic files in a form acceptable to the Commission or its representatives or hard copies of any, all, or any part of such records, upon request, periodically, or continuously and, in any case, within the same time periods as would apply to the SCI entity for such records. The preparation or maintenance of records by a service bureau or other recordkeeping service would not relieve an SCI entity from its obligation to prepare, maintain, and provide the Commission and its representatives with access to such records. Proposed Rule 1000(e) is substantively the same as the requirement applicable to broker-dealers under Rule 17a-4(i) of the Exchange Act.

The Commission is proposing this requirement for SCI entities to prevent the inability of the Commission to obtain required SCI entity records because they are held by a third party that may not otherwise have an obligation to make such records available to the Commission. In addition, the requirement that SCI entities obtain from such third parties a written undertaking would help ensure that such service bureau or other recordkeeping service is aware of this obligation with respect to records relating to proposed Regulation SCI. The Commission preliminarily believes that it is appropriate to include this requirement in proposed Regulation SCI to help ensure that the Commission would have prompt and efficient access to all required records, including those housed at a service bureau or any other recordkeeping service.

Request for Comment

156. The Commission requests comment on all aspects of proposed Rule 1000(c). Specifically, do SCI entities currently make, keep, and preserve the types of records that would be required to be made, kept, and preserved by proposed Rule 1000(c)? Are there any records that could be important to make, keep, and preserve that would not be captured under proposed Rule 1000(c) or the existing recordkeeping requirements for SROs under Rule 17a-1? If so, please explain and identify the records. Should any of the records subject to proposed Rule 1000(c) not be required? If so, please explain and identify the records. Should the Commission require SCI entities to furnish records to Commission representatives electronically in a tagged data format (e.g., XML, XBRL, or similar structured data formats which may be tagged)? The Commission notes that a tagged data format would have the benefit of permitting records to be organized and searched more easily, and thereby enable more efficient analyses, but that there would also be costs associated with implementing a tagged data format requirement. Do commenters believe the benefits of using a tagged data format would justify the costs? Why or why not? Please explain. If so, should any particular electronic format be mandated? If so, please describe.

157. Should the Commission lengthen or shorten the proposed periods for SCI entities to keep and preserve records? If so, by how much and why? Is it appropriate for an SCI entity, prior to ceasing to do business or ceasing to be regulated under the Exchange Act, to be required to ensure that its records are accessible in some way to the Commission and its representatives? Why or why not? What practical steps do commenters envision an SCI entity taking to comply with this proposed requirement?

158. The Commission requests comment on all aspects of proposed Rule 1000(e). Specifically, would the written undertaking required by proposed Rule 1000(e) be sufficient to help ensure that the Commission and its representatives would be able to obtain and examine true, correct, and current records of SCI entities? Why or why not? Are the provisions of proposed Rule 1000(e) an appropriate means of addressing any potential problems with access to books and records at service bureaus? Why or why not? Are there alternatives that the Commission should consider with respect to recordkeeping requirements for SCI entities? If so, please explain your reasoning.

2. Electronic Submission of Reports, Notifications, and Other Communications on Form SCI

Proposed Rule 1000(d) provides that, except with respect to notifications to the Commission under proposed Rule 1000(b)(4)(i) (Commission notification of certain SCI events), and oral notifications to the Commission under proposed Rule 1000(b)(6)(ii) (Commission notification of certain material systems changes), any notification, review, description, analysis, or report required to be submitted to the Commission under proposed Regulation SCI must be submitted electronically and contain an electronic signature. This proposed requirement is intended to provide a uniform manner in which the Commission would receive—and SCI entities would provide—written notifications, reviews, descriptions, analyses, or reports made pursuant to proposed Regulation SCI. The Commission preliminarily believes that such standardization would guide SCI entities in completing such submissions and make it easier and more efficient for them to draft and submit such required reports. Additionally, the standardization would make it easier and more efficient for the Commission to promptly review, analyze, and respond, as necessary, to the information proposed to be provided. The electronic signature requirement is consistent with the intention of the Commission to receive documents that can be readily accessed and processed electronically.

Proposed Rule 1000(d) also would require that submissions by SCI entities be filed electronically on new proposed Form SCI, in accordance with the instructions contained in Form SCI. The Commission's proposal contemplates the use of an online filing system, similar to the electronic form filing system (“EFFS”) currently used by SCI SROs to submit Form 19b-4 filings, through which an SCI entity would be able to file a completed Form SCI. Based on the widespread use and availability of the Internet, the Commission preliminarily believes that filing Form SCI in an electronic format would be less burdensome and a more efficient filing process for SCI entities and the Commission, as it is likely to be less expensive and cumbersome than mailing and filing paper forms to the Commission.

Request for Comment

159. The Commission requests comment on all aspects of proposed Rule 1000(d). Do commenters believe that the electronic submission requirement of proposed Rule 1000(d) is appropriate? Alternatively, would the submission of a required notification, review, description, analysis, or report via electronic mail to one or more Commission email addresses be a more appropriate way for the Commission to implement the proposed requirement? Are there other alternative methods that would be preferable? If so, please describe. Should there be any additional security requirements for such communications (e.g., password protection or encryption)? If so, please describe. Should the submissions be made in a tagged data format, e.g., XML, XBRL, or similar structured data formats which may be tagged? The Commission notes that a tagged data format would have the benefit of permitting records to be organized and searched more easily, and thereby enable more efficient analyses, but that there would also be costs associated with implementing a tagged data format requirement. Do commenters believe the benefits of using a tagged data format would justify the costs? Why or why not? Please explain. If so, should any particular electronic format be mandated? If so, please describe.

3. Access to the Systems of an SCI Entity

Proposed Rule 1000(f) would require SCI entities to provide Commission representatives reasonable access to their SCI systems and SCI security systems. Thus, the proposed rule would facilitate the access of representatives of the Commission to such systems of an SCI entity either remotely or on site. Proposed Rule 1000(f) is intended to be consistent with the Commission's current authority with respect to access to records generally and help ensure that Commission representatives have ready access to the SCI systems and SCI security systems of SCI entities in order to evaluate an SCI entity's practices with regard to the requirements of proposed Regulation SCI.

Request for Comment

160. The Commission requests comment generally on proposed Rule 1000(f). Are there restrictions that should be placed on the proposed access that would still allow the Commission and its representatives to be able to evaluate an SCI entity's practices with regard to the requirements of proposed Regulation SCI? If so, what should such restrictions be and why? Please describe.

E. New Proposed Form SCI

The Commission is proposing that the notices, reports, and other information required to be provided to the Commission pursuant to proposed Rules 1000(b)(4), (6), (8), and (10) of Regulation SCI be submitted electronically on new proposed Form SCI. Proposed Form SCI would solicit information through a series of questions designed to elicit short-form answers and also would require SCI entities to provide information and/or reports in narrative form by attaching specified exhibits. All filings on proposed Form SCI would require that an SCI entity identify itself and indicate the basis for submitting Form SCI, whether a: notification or update notification regarding an SCI event pursuant to proposed Rule 1000(b)(4); notice of a planned material systems change pursuant to proposed Rule 1000(b)(6); submission of a required report pursuant to proposed Rule 1000(b)(8); or notification of an SCI entity's standards for designation of members or participants to participate in required testing and the identity of such designated members or participants pursuant to proposed Rule 1000(b)(9). A filing on Form SCI required by proposed Rules 1000(b)(4), (6), (8), or (9) would require that an SCI entity provide additional information on attached exhibits, as discussed below.

1. Notice of SCI Events Pursuant to Proposed Rule 1000(b)(4)

As discussed above, proposed Rule 1000(b)(4)(i) would require an SCI entity, upon any responsible SCI personnel becoming aware of a systems disruption that the SCI entity reasonably estimates would have a material impact on its operations or on market participants, any systems compliance issue, or any systems intrusion, to notify the Commission of such SCI event. Proposed Rule 1000(b)(4)(ii) would require an SCI entity, upon any responsible SCI personnel becoming aware of any SCI event, to notify the Commission of the SCI event in writing within 24 hours. Proposed Rule 1000(b)(4)(iii) would require continuing written updates on a regular basis, or at such frequency as reasonably requested by a representative of the Commission, until such time as the SCI event is resolved. Proposed Rule 1000(b)(4)(iv) would direct an SCI entity to submit the required notifications on Form SCI. Further, proposed Rule 1000(b)(4)(iv) and new proposed Form SCI would specify the particular information an SCI entity would be required to provide to the Commission to comply with the Commission notification requirements of proposed Rules 1000(b)(4)(ii) and 1000(b)(4)(iii). As such, proposed Rule 1000(b)(4) would specify when and how notices would be required to be filed, and it and new proposed Form SCI would address the content of required notices.

For a written notification to the Commission of an SCI event under proposed Rule 1000(b)(4)(ii), new proposed Form SCI would require that an SCI entity indicate that the filing is being made pursuant to proposed Rule 1000(b)(4)(ii) and provide the following information in a short, standardized format: (i) Whether the filing is a Rule 1000(b)(4)(ii) notification or Rule 1000(b)(4)(iii) update of an SCI event; (ii) the SCI event type(s) (i.e., systems compliance issue, systems intrusion, and/or systems disruption); (iii) whether the event is a systems disruption that the SCI entity reasonably estimates would have a material impact on its operations or on market participants; (iv) if so, whether the Commission has been notified of the SCI event; (v) whether the SCI event has been resolved; (vi) the date/time the SCI event started; (vii) the duration of the SCI event; (viii) the date and time when responsible SCI personnel became aware of the SCI event; (ix) the estimated number of market participants impacted by the SCI event; (x) the type(s) of systems impacted; and (xi) if applicable, the type of systems disruption. In addition, proposed Form SCI would require attachment of Exhibit 1, providing a narrative description of the SCI event, including: (1) A detailed description of the SCI event; (2) the SCI entity's current assessment of the types and number of market participants potentially affected by the SCI event; (3) the potential impact of the SCI event on the market; and (4) the SCI entity's current assessment of the SCI event, including a discussion of the SCI entity's determination regarding whether the SCI event is a dissemination SCI event or not. In addition, to the extent available as of the time of the initial notification, Exhibit 1 would require inclusion of the following information: (1) A description of the steps the SCI entity is taking, or plans to take, with respect to the SCI event; (2) the time the SCI event was resolved or timeframe within which the SCI event is expected to be resolved; (3) a description of the SCI entity's rule(s) and/or governing documents, as applicable, that relate to the SCI event; and (4) an analysis of the parties that may have experienced a loss, whether monetary or otherwise, due to the SCI event, the number of such parties, and an estimate of the aggregate amount of such loss.

Proposed Rule 1000(b)(4)(iii) would require an SCI entity to provide continuing written updates regularly for each SCI event, or at such frequency as reasonably requested by a representative of the Commission, until such time as the SCI event is resolved. Proposed Form SCI would require that an SCI entity indicate that it is providing such written update pursuant to Rule 1000(b)(4)(iii) and attach such update as Exhibit 2 to Form SCI.

If any of the foregoing information is not available for inclusion on Exhibit 1 as of the date of the initial notification, the SCI entity would be required to provide such information when it becomes available on Exhibit 2. The information proposed to be required in narrative format in Exhibit 1, and if applicable, Exhibit 2, is intended to elicit a fuller description of the SCI event, and would require an SCI entity to provide detail and context not easily conveyed in short-form responses.

Proposed Form SCI would further require attachment of Exhibit 3, providing a copy in pdf or html format of any information disseminated to date regarding the SCI event to its members or participants or on the SCI entity's publicly available Web site.

The Commission preliminarily believes that the proposed items of information required to be disclosed by an SCI entity on Exhibit 1 within 24 hours of any of its responsible SCI personnel becoming aware of an SCI event, or when available, on Exhibit 2, would help the Commission and its staff quickly assess the nature and scope of an SCI event, and help the SCI entity identify the appropriate response to the SCI event, including ways to mitigate the impact of the SCI event on investors and promote the maintenance of fair and orderly markets.

2. Notices of Material Changes Pursuant to Proposed Rule 1000(b)(6)

Proposed Rule 1000(b)(6) would require an SCI entity to notify the Commission of planned material systems changes on proposed Form SCI 30 calendar days in advance of such change, unless exigent circumstances exist or information previously provided regarding a material systems change has become materially inaccurate, necessitating notice regarding a material systems change with less than 30 calendar days' notice. To implement this requirement, proposed Form SCI would require an SCI entity to indicate on Form SCI that it is filing a planned material systems change notification, provide the date of the planned material systems change, indicate whether exigent circumstances exist or if the information previously provided to the Commission regarding any planned material systems change has become materially inaccurate, and, if so, whether the Commission has been notified orally, and attach as Exhibit 4 a description of the planned material systems change as well as the expected dates of commencement and completion of implementation of such changes, or, if applicable, a material systems change that has already been made due to exigent circumstances.

3. Reports Submitted Pursuant to Rule 1000(b)(8)

Proposed Rule 1000(b)(8) would require an SCI entity to submit to the Commission: (i) A report of the SCI review required by proposed Rule 1000(b)(7), together with any response by senior management, within 60 calendar days after submission of the SCI review to senior management; and (ii) a report within 30 calendar days after the end of June and December of each year containing a summary description of the progress of any material systems change during the six-month period ending on June 30 or December 31, as the case may be, and the date, or expected date, of completion of implementation of such changes. For filings of the reports of SCI reviews, proposed Form SCI would require an SCI entity to indicate on Form SCI that it is filing a report of SCI review, indicate the date of completion of the SCI review, and date of submission of the SCI review to senior management of the SCI entity. The report of the SCI review required by proposed Rule 1000(b)(7), together with any response by senior management, would be required to be submitted as Exhibit 5 to proposed Form SCI. For filings of the semi-annual reports of material systems changes, proposed Form SCI would require an SCI entity to indicate on Form SCI that it is filing a semi-annual report of material systems changes, and attach the semi-annual report as Exhibit 6 to proposed Form SCI.

4. Notifications of Member or Participant Designation Standards and List of Designees Pursuant to Proposed Rule 1000(b)(9)

Proposed Rule 1000(b)(9) would require an SCI entity to notify the Commission of its standards for designating members or participants it deems necessary, for the maintenance of fair and orderly markets in the event of the activation of the SCI entity's business continuity and disaster recovery plans, to participate in the testing of such plans as well as a list of members or participants designated in accordance with such standards, and prompt updates following any changes to such standards and designations. Form SCI would require such information to be submitted as Exhibit 7 to Form SCI. Thus, an SCI SRO would be required to attach any relevant provisions of its rules, an SCI ATS or exempt clearing agency subject to ARP would be required to attach its relevant internal processes or other documents, and a plan processor would be required to attach the relevant provisions of its SCI Plan.

The Commission preliminarily believes that the proposed mechanism of submitting the reports, notices, and other information required by proposed Rules 1000(b)(4), (6), (8), and (10) by attaching them as exhibits to Form SCI would be an efficient manner for providing such information to the Commission and its staff, and that it would be more cost-effective for SCI entities as well as the Commission than requiring the submission in a paper format or using an electronic method that differs from that proposed.

5. Other Information and Electronic Signature

In addition to the foregoing, proposed Form SCI would require an SCI entity to provide Commission staff with point of contact information for systems personnel and regulatory personnel responsible for addressing an SCI event, including the name, title, telephone number and email address of such persons. Proposed Form SCI would also require the SCI entity to designate on the form contact information for a senior officer of the SCI entity responsible for matters concerning the submission of such Form SCI. Finally, proposed Form SCI would require an electronic signature to help ensure the authenticity of the Form SCI submission. The Commission preliminarily believes these proposed requirements would expedite communications between Commission staff and an SCI entity and help to ensure that only personnel authorized by the SCI entity are submitting required filings and working with Commission staff to address an SCI event or systems issue promptly and efficiently.

To the extent that the Commission receives confidential information pursuant to these reports and submissions, such information would be kept confidential, subject to the provisions of applicable law.

Request for Comment

161. The Commission requests comment on all aspects of proposed Form SCI. Do commenters believe proposed Form SCI would capture the information necessary to assist the Commission in obtaining relevant information about SCI events to mitigate the effects of such events on investors and the public? Specifically, do commenters believe that the proposal to elicit the following information on Form SCI within 24 hours of any responsible SCI personnel becoming aware of an SCI event is appropriate: (i) Whether the filing is a Rule 1000(b)(4)(ii) notification or Rule 1000(b)(4)(iii) update of an SCI event; (ii) the SCI event type(s) (i.e., systems compliance issue, systems intrusion, and/or systems disruption); (iii) whether the event is a systems disruption that the SCI entity reasonably estimates would have a material impact on its operations or on market participants; (iv) if so, whether the Commission has been notified of the SCI event; (v) whether the SCI event has been resolved; (vi) the date/time the SCI event started; (vii) the duration of the SCI event (viii) the date and time when responsible SCI personnel became aware of the SCI event; (ix) the estimated number of market participants impacted by the SCI event; (x) the type(s) of systems impacted; and (xi) if applicable, the type of systems disruption.

162. Do commenters believe that all relevant information relating to a systems disruption, systems compliance issue, or systems intrusion would be captured on proposed Form SCI? If not, what additional information should be included on proposed Form SCI? For example, should proposed Form SCI require that an SCI entity specifically identify market participants that may have been affected by the SCI event? Why or why not?

163. Do commenters believe the proposed information required to be provided to the Commission regarding SCI events in the 24-hour notification on Exhibit 1 is appropriate? Do commenters believe that the proposal to require an update notification on Exhibit 2, and the information required to be provided for such updates, are appropriate? Why or why not?

164. Commenters that believe the information proposed to be required on Form SCI, whether in short form or in narrative form on proposed Exhibits 1 and 2, is not appropriate should explain their reasoning and suggest alternatives, as appropriate. Should any information proposed to be required be eliminated? Should any other information be required? Please describe and explain.

165. Do commenters believe the required contents of proposed Exhibit 3 are appropriate (i.e., a copy in pdf or html format of any information disseminated to an SCI entity's members or participants or on the SCI entity's publicly available Web site)? If not, why not?

166. Do commenters believe submission of proposed Form SCI and attachment of Exhibits 4, 5, 6, and 7 regarding material systems changes, SCI reviews, and notifications of standards for designations and designees for the testing of an SCI entity's business continuity and disaster recovery plans, is an appropriate method for SCI entities to provide this information to the Commission? If not, why not? Should any information proposed to be required be eliminated? Should any other information be required? Please explain.

167. Is the proposal to require contact information for systems, regulatory, and senior officer appropriate? Should any information proposed to be required be eliminated? Is there any other type of information that proposed Form SCI should require? Is the proposal to require an electronic signature appropriate? If not, why not?

168. Would proposed Form SCI contain enough information so that the Commission and its staff would be able to accurately analyze SCI events, material changes to systems, and all other required filings?

169. Upon receiving information submitted as part of an SCI entity's electronic filing, it is the Commission's objective that such information be easily analyzed, searched, and manipulated. The Commission has designed proposed Form SCI with this objective in mind, particularly with the uniform requirements on the front of the form. The Commission, however, is cognizant that certain information, particularly with respect to the information required on the various exhibits to the proposed form, may not be as easily analyzed, searched, or manipulated. The Commission seeks comment as to whether it should mandate that proposed Form SCI as a whole, including the proposed exhibits, employ a particular structured data format that would allow the Commission and its staff to analyze, search, and manipulate the form's information. At the same time, the Commission recognizes that employing a particular tagged data format may potentially reduce the flexibility afforded to such entities to collect and report data in a manner that is more efficient and cost effective for them. The Commission requests comments as to whether there may be tagged data formats that are sufficiently flexible and that are accepted and used throughout the industry, such as XML, XBRL, or another structured data format that could be used for proposed Form SCI. Are there different standard data formats currently in use depending on the type of SCI entity that would enable the Commission to achieve its goals? If so, what are they? Should the SCI entity have the flexibility to specify the acceptable data format for submitting information? Why or why not? Do commenters have concerns with proposed Regulation SCI requiring the use of a tagged data format, such as XML, XBRL, or some other structured data format that may be tagged, to report data? If so, what are they? Are there any licensing fees or other costs associated with the use of tagged data formats, such as XML, XBRL, or similar structured data formats that may be tagged? If so, what action should the Commission take, if any, to help ensure wide availability of a common data format by all participants?

F. Request for Comment on Applying Proposed Regulation SCI to Security-Based Swap Data Repositories and Security-Based Swap Execution Facilities

On July 21, 2010, the President signed the Dodd-Frank Act into law. The Dodd-Frank Act was enacted, among other things, to promote the financial stability of the United States by improving accountability and transparency of the nation's financial system. Title VII of the Dodd-Frank Act provides the Commission and the CFTC with the authority to regulate over-the-counter (“OTC”) derivatives.

1. Proposed System Safeguard Rules for SB SDRs and SB SEFs

Section 763 of the Dodd-Frank Act amends the Exchange Act by adding various new statutory provisions to govern the regulation of various entities, including security-based swap data repositories and security-based swap execution facilities. Under the authority of Section 13(n) of the Exchange Act, applicable to SB SDRs, and Section 3D(d) of the Exchange Act, applicable to SB SEFs, the Commission recently proposed rules for these entities with regard to their automated systems' capacity, resiliency, and security. Specifically, in the SB SDR Proposing Release and the SB SEF Proposing Release, respectively, the Commission proposed Rule 13n-6 and Rule 822 under the Exchange Act, which would set forth the requirements for these entities with regard to their automated systems' capacity, resiliency, and security. In each release, the Commission stated that it was proposing standards comparable to the standards applicable to SROs, including exchanges and clearing agencies, and other registrants, pursuant to the Commission's ARP standards.

Proposed Rules 13n-6 and 822, applicable to SB SDRs and SB SEFs, respectively, would require these entities, “with respect to those systems that support or are integrally related to the performance of its activities” to “establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, resiliency, and security.” Under proposed Rules 13n-6 and 822, such policies and procedures, at a minimum, would require these SB SDRs and SB SEFs to: (i) Establish reasonable current and future capacity estimates; (ii) conduct periodic capacity stress tests of critical systems to determine such systems' ability to process transactions in an accurate, timely, and efficient manner; (iii) develop and implement reasonable procedures to review and keep current their system development and testing methodologies; (iv) review the vulnerability of their systems and data center computer operations to internal and external threats, physical hazards, and natural disasters; and (v) establish adequate contingency and disaster recovery plans. Proposed Rules 13n-6 and 822 would further require SB SDRs and SB SEFs to submit, on an annual basis, an “objective review” of their systems to the Commission within 30 calendar days of its completion; notify the Commission in writing of material systems outages; and notify the Commission in writing at least 30 calendar days before implementation of any planned material systems changes.

To date, the Commission has received two comment letters from one commenter in response to proposed Rule 13n-6 and four comment letters in response to proposed Rule 822. Both comment letters on proposed Rule 13n-6 expressed support for the proposed rule. Two commenters on proposed Rule 822 expressed support for the proposed rule. Two other commenters on proposed Rule 822 suggested modifications, including that the Commission (1) require SB SEFs to establish policies and procedures reasonably designed to prevent any provision in a valid swap transaction from being invalidated or modified through the utilization of, or execution on, a SB SEF; and (2) provide for the implementation of the system safeguards requirements on a staged basis.

2. Proposed System Safeguard Rules for SB SDRs and SB SEFs as Compared to Proposed Regulation SCI

As noted above, proposed Regulation SCI is intended to build upon and update the Commission's ARP standards, which were the basis for proposed Rules 13n-6 and 822 for SB SDRs and SB SEFs, respectively. Although proposed Rules 13n-6 and 822 have much in common with proposed Regulation SCI, they differ in scope and detail from proposed Regulation SCI in a number of ways. Among the differences are certain provisions in proposed Regulation SCI that proposed Rules 13n-6 and 822 do not include. Specifically, as discussed above, proposed Regulation SCI would: (i) Define the terms “SCI systems” and “SCI security systems;” (ii) specifically require the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to ensure that SCI systems and, for purposes of security standards, SCI security standards, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain an SCI entity's operational capability and promote the maintenance of fair and orderly markets; (iii) require SCI entities to establish policies and procedures regarding standards that result in systems designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; (iv) require SCI entities to establish, maintain, and enforce reasonably designed written policies and procedures to ensure that SCI systems operate in the manner intended, including in a manner that complies with the federal securities laws and rules and regulations thereunder and, as applicable, the entity's rules and governing documents; (v) require SCI entities to take corrective action, including devoting adequate resources, to remedy an SCI event as soon as reasonably practicable; (vi) require SCI entities to have backup and recovery capabilities sufficiently resilient and geographically diverse to ensure next business day resumption of trading following a wide scale disruption; (vii) require an annual SCI review of the SCI entity's compliance with proposed Regulation SCI and the reporting of such review to the Commission; (viii) require an SCI entity, with respect to its business continuity and disaster recovery plans, including its backup systems, to require participation by designated members or participants in scheduled functional and performance testing of the operation of such plans at specified intervals, and to coordinate such required testing with other SCI entities; (ix) require all SCI events to be reported to the Commission, and certain types of SCI events to be disseminated to an SCI entity's members or participants; and (x) establish semi-annual reporting obligations for planned material systems changes. In addition, proposed Regulation SCI would establish a system for submitting required notices, reports, and other information to the Commission on proposed new Form SCI. Each of these proposed requirements goes beyond the explicit requirements in proposed Rules 13n-6 and 822.

3. Consideration of Applying the Requirements of Proposed Regulation SCI to SB SDRs and/or SB SEFs

If the Commission were to adopt Rules 13n-6 and 822 as proposed in the SBS Releases and also adopt Regulation SCI as proposed herein, there would be differences, as noted above, between the obligations imposed on SB SDRs and SB SEFs with respect to system safeguards on the one hand and the obligations imposed on SCI entities on the other. Therefore, the Commission solicits comment on whether it should propose to apply the requirements of proposed Regulation SCI, in whole or in part, to SB SDRs and/or SB SEFs. In providing views on whether the Commission should propose to apply proposed Regulation SCI to SB SDRs and/or SB SEFs, commenters are encouraged to consider the discussion regarding each provision of proposed Regulation SCI that is set forth in Sections III.B through III.E above. Should the Commission to decide to propose to apply the requirements of proposed Regulation SCI to such entities, the Commission would issue a separate release discussing such a proposal.

In enacting Title VII of the Dodd-Frank Act, Congress judged it important to increase the transparency and oversight of the OTC derivatives market. In addition, in proposing Regulation SB SEF, the Commission noted that SB SEFs are intended to “lead to a more robust, transparent, and competitive environment for the market for security-based swaps (“SBS” or “SB swaps”).” Similarly, in proposing rules for SB SDRs, the Commission noted that “SDRs may be especially critical during times of market turmoil, both by giving relevant authorities information to help limit systemic risk and by promoting stability through enhanced transparency” and that, “[b]y enhancing stability in the SBS market, SDRs may also indirectly enhance stability across markets, including equities and bond markets.”

The Commission notes that it may or may not be appropriate to apply the requirements of proposed Regulation SCI to SB SDRs and SB SEFs. In particular, SB SDRs will play an important role in limiting systemic risk and promoting the stability of the SBS market. SB SDRs also would serve as information disseminators in a manner similar to plan processors in the equities and options markets that, under this proposal, would be subject to the requirements of proposed Regulation SCI. SB SEFs would function as trading markets, and in that respect could be viewed as analogous to national securities exchanges and SCI ATSs, both of which function as trading markets and are included in the proposed definition of SCI entity. The Commission preliminarily believes that the same types of concerns and issues that have resulted in the Commission previously publishing its ARP policy statements, developing its ARP Inspection Program, adopting certain aspects of the ARP policy statements under Regulation ATS, and, ultimately, proposing Regulation SCI, may similarly apply to SB SDRs and SB SEFs. In proposing Rule 13n-6, the Commission noted that systems failures can limit access to data, call into question the integrity of data, and prevent market participants from being able to report transaction data, and thereby have a large impact on market confidence, risk exposure, and market efficiency. Similarly, in proposing Rule 822, the Commission noted that the proposed system safeguard requirements for SB SEFs are designed to prevent and minimize the impact of systems failures that might negatively impact the stability of the SB swaps market. At the same time, because the Commission recognizes that there may be differences between the markets for the types of securities that would be covered by proposed Regulation SCI and the SBS market, including differing levels of automation and stages of regulatory development, the Commission requests comment on whether it would be appropriate to propose to apply the requirements of proposed Regulation SCI to SB SDRs and/or SB SEFs. As discussed further below, the Commission also requests comment on whether, if commenters believe proposed Regulation SCI should apply to SB SDRs and/or SB SEFs, the system safeguard rules currently proposed for SB SDRs and SB SEFs in the SBS Releases should, if adopted, be replaced, at some point in the future, by the requirements proposed in this release and, if so, how.

170. Are the SBS markets sufficiently similar to the markets within which the proposed SCI entities operate such that it would be appropriate to apply the same system safeguard requirements to SB SDRs and/or SB SEFs that would be applicable to SCI entities? Why or why not? Do commenters believe that there are characteristics of the SBS markets that the Commission should consider to support its applying different system safeguard rules to SB SDRs and/or SB SEFs than to SCI entities? If so, what are those characteristics, and why should different rules apply to SB SDRs and/or SB SEFs? If not, why not?

171. If the Commission were to propose to apply some or all of the provisions of proposed Regulation SCI to SB SDRs and/or SB SEFs, should the Commission propose to apply the provisions of proposed Regulation SCI differently to SB SDRs versus SB SEFs? For example, should the Commission propose to apply some or all of the provisions of proposed Regulation SCI to SB SDRs but not SB SEFs or vice versa? Why or why not?

172. What effect, if any, would there be of having SB SDRs and/or SB SEFs subject to different system safeguard rules than those proposed for SCI entities? Would there be any short term and/or long term impact of SB SDRs and/or SB SEFs being subject to different system safeguard rules than those proposed for SCI entities? For example, if SB SEFs were subject to different system safeguard rules than those proposed for SCI entities, would there be an impact on competition between SB SEFs and national securities exchanges that trade SB swaps? Please describe any expected impact on competition. Are there any provisions in proposed Regulation SCI that, if applied to SB SEFs, would create barriers to entry that could preclude small SB SEFs (e.g., those that do not exceed a specified volume or liquidity threshold) from entering the SBS market?

173. The Commission also requests comment on whether it should propose to apply all provisions of proposed Regulation SCI to SB SDRs and/or SB SEFs or just those provisions comparable to the proposed system safeguard rules for SB SDRs or SB SEFs.

174. Should the Commission, if it were to propose to apply some or all of the provisions of proposed Regulation SCI to SB SDRs and/or SB SEFs, propose that SB SEFs and/or SB SDRs have written policies and procedures reasonably designed to ensure that their SCI systems and, for purposes of security standards, SCI security systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain their operational capability and promote the maintenance of fair and orderly markets? Why or why not? If the Commission were to propose such a requirement for SB SDRs and/or SB SEFs, should SCI industry standards for SB SDRs and/or SB SEFs be different from those proposed for SCI entities? If so, please explain why. What are the industry standards that should apply to SB SEFs and/or SB SDRs? Please be as specific as possible and explain why a particular industry standard would be appropriate.

175. Do the characteristics of the SBS market support a need for a mandatory requirement that SB SDRs and/or SB SEFs maintain backup and recovery capabilities sufficiently resilient and geographically diverse to ensure next business day resumption of trading (for SB SEFs) or data repository services (for SB SDRs) following a wide scale disruption? Why or why not?

176. Should the Commission propose to require SB SEFs and/or SB SDRs to establish written policies and procedures regarding standards that result in systems designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data? Why or why not?

177. Should the Commission propose to require SB SEFs and/or SB SDRs to establish, maintain, and enforce policies and procedures reasonably designed to ensure that their SCI systems operate in the manner intended, including in a manner that complies with federal securities laws and rules and regulations thereunder and, as applicable, the entity's rules and governing documents, as proposed for SCI entities in Rule 1000(b)(2)(i)? Why or why not? Should the Commission propose a safe harbor from liability for SB SEFs and/or SB SDRs and their respective employees if they satisfy the elements of a safe harbor, similar to those for SCI entities in proposed Rules 1000(b)(2)(ii) and (iii)? Why or why not?

178. Should the Commission propose to require SB SEFs and/or SB SDRs, with respect to their business continuity and disaster recovery plans, including their backup systems, to require participation by designated participants in scheduled functional and performance testing of the operation of such plans at specified intervals, and to coordinate such required testing with other SB SEFs and/or SB SDRs, as proposed for SCI entities in Rule 1000(b)(9)? Why or why not?

179. With regard to the reporting and information dissemination requirements in proposed Rules 1000(b)(4) and Rule 1000(b)(5) of Regulation SCI, would it be appropriate to propose that an SB SDR and/or SB SEF be required to report all SCI events to the Commission, and disseminate information relating to dissemination SCI events to their participants? Why, or why not? If not, on what basis should SB SDRs and/or SB SEFs be distinguished from other SCI entities?

180. Should SB SDRs and/or SB SEFs be required to provide notice of, and file semi-annual reports for, material systems changes with the Commission, as proposed for SCI entities in Rules 1000(b)(6) and (b)(8)? Why or why not?

181. Should SB SDRs and/or SB SEFs be required to undertake an annual SCI review of systems and submit to the Commission a report of such review, together with any response of senior management, as proposed for SCI entities in Rule 1000(b)(7) and (8)? Why or why not?

182. Should SB SDRs and/or SB SEFs be required to submit any required notices, reports, and other information to the Commission on proposed new Form SCI? Why, or why not?

183. If the Commission were to determine that it would be appropriate to propose to apply some or all of the requirements of proposed Regulation SCI to SB SDRs and/or SB SEFs, should the Commission propose to apply such requirements of proposed Regulation SCI to all SB SDRs? To all SB SEFs? Are there distinctions that should be made between different types of SB SDRs (or SB SEFs) such that some requirements of proposed Regulation SCI might be appropriate for some SB SDRs (or SB SEFs) but not others? If so, what are those distinctions and what are those requirements? For example, should any requirements be based on criteria such as number of transactions or notional volume reported to a SB SDR or executed on a SB SEF? If so, what would be an appropriate threshold for any such criteria, and why?

184. Alternatively, given the nascent stage of regulatory development of the SBS markets, would it be appropriate to create a category under proposed Regulation SCI such as “new SB SCI entity” that would, for example, be applicable to SB SDRs and/or SB SEFs for a certain period of time after such entities become registered with the Commission? If so, what period of time would be appropriate (e.g., one year, three years, or some other period)? Should there be other criteria for an SB SEF (or SB SDR) to be considered a new SB SCI entity? If so, what should be the criteria for inclusion? Would market share, number of transactions, and/or notional volume be appropriate criteria? If so, at what level should the criteria thresholds be set, and why? If not, why not? How should the requirements of proposed Regulation SCI differ for such “new SB SCI entities?”

185. The Commission notes that, if it were to adopt proposed Regulation SCI and proposed Rules 13n-6 and 822, the system safeguard rules applicable to SB SDRs and SB SEFs would diverge from those applicable to SCI entities, as well as from those the CFTC has adopted for SDRs and may adopt for SEFs. What negative effects, if any, do commenters believe would result from disparity in the: (1) Commission's system safeguard rules applicable to SB SDRs and/or SB SEFs; (2) requirements of Regulation SCI applicable to SCI entities; and (3) CFTC's system safeguard rules applicable to SDRs and SEFs?

186. The Commission seeks commenters' views on all aspects of whether to propose to apply Regulation SCI to SB SDRs and/or SB SEFs, taking into account the possibility that any final Commission action on proposed Rules 13n-6 and 822 could occur prior to any final Commission action on proposed Regulation SCI. The Commission seeks commenters' views on whether a proposal to extend the requirements of proposed Regulation SCI to SB SDRs and/or SB SEFs would be beneficial to help to promote the integrity, capacity, resiliency, availability, and security of their systems. The Commission notes that having comparable system safeguard requirements may be appropriate for SB SDRs and/or SB SEFs if, as noted above, the same types of concerns and issues that have resulted in the Commission previously publishing its ARP policy statements, developing its ARP Inspection Program, adopting certain aspects of the ARP policy statements under Regulation ATS, and, ultimately, proposing Regulation SCI, also apply to SB SDRs and/or SB SEFs.

187. The Commission is particularly interested in commenters' views on the different benefits and costs associated with applying proposed Regulation SCI to SB SDRs and/or SB SEFs versus the costs and benefits of applying proposed Rules 13n-6 and 822 to SB SDRs and SB SEFs, respectively. In the SBS Proposing Releases, the Commission provided aggregate estimates of the costs of its proposed rules governing SB SDRs and SB SEFs. The SB SDR Proposing Release provided an aggregate initial cost estimate of approximately $214,913,592 to be incurred by prospective SB SDRs and an aggregate ongoing annualized cost estimate of approximately $140,302,120, both of which estimates took account of proposed Rule 13n-6. Similarly, the SB SEF Proposing Release provided an aggregate initial cost estimate of approximately $41,692,900 and an aggregate ongoing annualized cost estimate of approximately $22,342,700 to be incurred by prospective SB SEFs, both of which estimates took account of proposed Rule 822.

If the Commission were to propose to apply Regulation SCI to SB SDRs and/or SB SEFs, it preliminarily believes that the initial potential costs of such application could differ from the costs to be incurred by SCI entities that currently participate in the ARP Inspection Program on a per entity basis, as described in Sections IV and V below. This is because prospective SB SDRs and prospective SB SEFs, unlike those entities, are not now subject to the ARP Inspection Program and its standards. However, the Commission preliminarily believes that the initial potential costs of such application to SB SDRs and SB SEFs, on a per entity basis, could be equivalent to those costs estimated below in Sections IV and V with respect to SCI entities that currently do not participate in the ARP Inspection Program. Further, as noted above, the SBS Releases have accounted for potential costs to be incurred by SB SDRs and SB SEFs in implementing the proposed system safeguard requirements in Rules 13n-6 and 822, respectively and, as discussed above, the requirements in proposed Regulation SCI could be incremental to those already proposed in Rules 13n-6 and 822. The Commission therefore preliminarily believes that, if it were to decide to propose to apply some or all of the requirements of proposed Regulation SCI to SB SDRs and/or SB SEFs, the costs of applying proposed Regulation SCI to SB SDRs and/or SB SEFs would be incremental to the costs associated with proposed Rules 13n-6 and 822.

188. The Commission seeks commenters' views regarding the prospective costs, as well as the potential benefits, of proposed Regulation SCI to SB SDRs and/or SB SEFs. Commenters should quantify the costs of applying proposed Regulation SCI to SB SDRs and/or SB SEFs, to the extent possible. As noted above, commenters are urged to address specifically each requirement of proposed Regulation SCI and note whether it would be reasonable to propose to apply each such requirement to SB SDRs and/or SB SEFs and what the benefits and costs of such application would be.

4. Timing and Implementation Considerations

As noted above, the Commission has proposed rules providing a regulatory framework for SB SDRs and SB SEFs, but has not yet adopted final rules governing these entities. To date, the Commission has not received any comments with respect to the timing of the implementation of proposed Rule 13n-6 but has received one comment in connection with the timing of the implementation of proposed Rule 822.

Although the Commission has issued a policy statement regarding the anticipated sequencing of the compliance dates of final rules to be adopted by the Commission for certain provisions of Title VII of the Dodd-Frank Act, the precise timing for adoption of or compliance with any final rules relating to SB SDRs or SB SEFs, or for adoption of or compliance with proposed Regulation SCI, is not known at this time. In addition, as the Title VII Implementation Policy Statement notes, any final rules for SB SDRs and SB SEFs potentially would be considered by the Commission at different times. As such, specifying the precise timing and ordering of the implementation of any requirements of proposed Regulation SCI, or Rules 13n-6 and 822, to SB SDRs and/or SB SEFs is difficult to predict, should the Commission determine to proposed to apply some or all of the requirements of proposed Regulation SCI to SB SDRs and/or SB SEFs, or adopt Rules 13n-6 and 822 to SB SDRs and SB SEFs, respectively.

189. Nonetheless, the Commission requests comment on what—if the Commission were to propose to apply some or all of the requirements of proposed Regulation SCI to SB SDRs and/or SB SEFs—would be the most appropriate way to implement such requirements for SB SDRs and/or SB SEFs. For example, should the Commission seek to implement such requirements for SB SDRs and/or SB SEFs within the same timeframe as those entities currently defined as SCI entities under the proposal? Alternatively, should the applicability of some or all of Regulation SCI to SB SDRs and/or SB SEFs be phased in over time? If so, what provisions of proposed Regulation SCI should be phased in and what would be an appropriate phase-in period? Should there be different phase-in schedules for different SB SDRs and/or SB SEFs? Why or why not? If yes, how would the SB SDRs and/or SB SEFs be selected for different phase-in schedules? Please be specific.

190. Do commenters believe that, because the Commission's actions to implement the regulatory framework for the SB swaps market are still in progress, the Commission should not propose to apply the requirements of Regulation SCI to SB SDRs and/or SB SEFs at the same time as SCI entities, but instead should adopt the system safeguard provisions of proposed Rules 13n-6 and 822 and reconsider such requirements in the future after the SB swaps market and the Commission's regulation of such market and its participants has developed further? Why or why not? What would be the impact of this approach for SB SDRs and/or SB SEFs?

191. As discussed in the SBS Releases, the system safeguards requirements in proposed Rules 13n-6 and 822 have their origins in the Commission's ARP standards. Though they differ in scope and detail, the provisions of proposed Regulation SCI likewise trace their origin to the Commission's ARP standards. If the Commission were to adopt final rules for SB SDRs and/or SB SEFs before it were to adopt Regulation SCI, and if the Commission were to decide to propose to apply some or all of the requirements of proposed Regulation SCI to SB SDRs and/or SB SEFs, should the Commission require SB SDRs and/or SB SEFs to comply with the requirements of the system safeguards rules in proposed Rules 13n-6 and 822 first, and apply the requirements of Regulation SCI to SB SDRs and/or SB SEFs at a specific date in the future? If the Commission were to adopt Rules 13n-6 and 822 prior to adoption of proposed Regulation SCI, and if the Commission were to decide to propose to apply some or all of the requirements of proposed Regulation SCI to SB SDRs and/or SB SEFs, should the Commission delay implementation of Rules 13n-6 and 822 and instead request that SB SDRs and/or SB SEFs comply with the Commission's voluntary ARP Inspection Program until such time as the Commission were to propose and adopt Regulation SCI for SB SDRs and SB SEFs?

G. Solicitation of Comment Regarding Potential Inclusion of Broker-Dealers, Other than SCI ATSs, and Other Types of Entities

1. Policy Considerations

As discussed above, the requirements of proposed Regulation SCI would apply to national securities exchanges, registered securities associations, registered clearing agencies, the MSRB, SCI ATSs, plan processors, and exempt clearing agencies subject to ARP. They would not apply to other types of market participants, such as market makers or other broker-dealers. This proposed scope of the definition of SCI entity in part reflects the historical reach of the ARP policy statements (which apply, for example, to national securities exchanges) and existing Rule 301 of Regulation ATS (which applies systems safeguard requirements to certain ATSs).

Recent events have highlighted the significance of systems integrity of a broader set of market participants than those proposed to be included within the definition of SCI entity. Also, some broker-dealers have grown in size and importance to the market in recent years. For example, many orders are internalized by OTC market makers, one subset of broker-dealers, who handle a large portion of order flow in the market. The Commission recognizes that systems disruptions, systems compliance issues, and systems intrusions at broker-dealers, including for example OTC market makers and clearing broker-dealers, could pose a significant risk to the market. Such an occurrence could impact all orders being handled by a broker-dealer, which can be significant for larger broker-dealers. If a given broker-dealer handles a large portion of order flow and suddenly experiences a systems disruption or systems intrusion, the disruption or intrusion could cause ripple effects. For example, a systems issue at one broker-dealer could result in confusion about whether orders are handled correctly or whether the systems issue at the broker-dealer could have caused capacity issues elsewhere.

The Commission is not at this time proposing to include some classes of registered broker-dealers (other than SCI ATSs) in the definition of SCI entity. Were the Commission to decide to propose to apply the requirements of proposed Regulation SCI to such entities, the Commission would issue a separate release discussing such a proposal. Rule 15c3-5, requiring brokers or dealers with market access to implement risk management controls and supervisory procedures to limit risk, already seeks to address certain risks posed to the markets by broker-dealer systems. Specifically, in 2010 when the Commission adopted Rule 15c3-5 regarding risk management controls and supervisory procedures for brokers or dealers with market access, the Commission stated that “broker-dealers, as the entities through which access to markets is obtained, should implement effective controls reasonably designed to prevent errors or other inappropriate conduct from potentially causing a significant disruption to the markets” and that “risk management controls and supervisory procedures that are not applied on a pre-trade basis or that, with certain limited exceptions, are not under the exclusive control of the broker-dealer, are inadequate to effectively address the risks of market access arrangements, and pose a particularly significant vulnerability in the U.S. national market system.”

Pursuant to Rule 15c3-5, a broker or dealer with market access, or that provides a customer or any other person with access to an exchange or ATS through use of its market participant identifier or otherwise, must establish, document, and maintain a system of risk management controls and supervisory procedures reasonably designed to manage the financial, regulatory, and other risks of this business activity. Rule 15c3-5 also specifies the baseline standards for financial and regulatory risk management controls and supervisory procedures. The financial risk management controls and supervisory procedures must be reasonably designed to systematically limit the financial exposure of the broker or dealer that could arise as a result of market access. The regulatory risk management controls and supervisory procedures must be reasonably designed to ensure compliance with all regulatory requirements.

Under the approach set out by Rule 15c3-5, broker-dealers with market access are responsible in the first instance for establishing and maintaining appropriate risk management controls, including with respect to their systems. Although Rule 15c3-5 takes a different and more limited approach with broker-dealers than proposed Regulation SCI does with SCI entities, the requirements in Rule 15c3-5 are designed to address some of the same concerns regarding systems integrity discussed in this proposal. As an example of reasonable risk control under Rule 15c3-5, the Commission stated, “a system-driven, pre-trade control designed to reject orders that are not reasonably related to the quoted price of the security would prevent erroneously entered orders from reaching the securities markets, * * * should lead to fewer broken trades and thereby enhance the integrity of trading on the securities markets.”

In light of recent events, however, the Commission believes that it is appropriate to consider whether some types or categories of broker-dealers other than SCI ATSs should also be subject to some or all of the additional system safeguard rules that are proposed for SCI entities. Such broker-dealers could include, for example, OTC market makers (either all or those that execute a significant volume of orders), exchange market makers (either all or those that trade a significant volume on exchanges), order entry firms that handle and route order flow for execution (either all or those that handle a significant volume of investor orders), clearing broker-dealers (either all or those that engage in a significant amount of clearing activities), and large multi-service broker-dealers that engage in a variety of order handling, trading, and clearing activities.

2. Request for Comment

192. As noted above, at this time, the Commission is not proposing to apply Regulation SCI to broker-dealers other than SCI ATSs or to other types of entities that are not covered by the definition of SCI entity. Were the Commission to decide to propose to apply the requirements of Regulation SCI to such entities, the Commission would issue a separate release discussing such a proposal. Nevertheless, the Commission is soliciting comment generally on whether it should apply the requirements of proposed Regulation SCI, in whole or in part, to such entities. Specifically:

193. What are the current practices of broker-dealers in relation to the requirements of proposed Regulation SCI? Would the current practices of broker-dealers that provide market access and comply with Rule 15c3-5 change if they were also subject to proposed Regulation SCI? Why or why not? If so, how? Are there broker-dealers who do not provide the services that would require compliance with Rule 15c3-5? If so, how do the practices of those broker-dealers compare to the requirements of proposed Regulation SCI?

194. In Section VI.B.2 below, the Commission discusses potential market failures that may explain why market solutions cannot solve the problems that proposed Regulation SCI is intended to address. Does the market for broker-dealer services, including client services, market maker services, or market access services, suffer from market failures that limit the ability of the market to solve the issues that proposed Regulation SCI is intended to address? For example, are broker-dealers' clients able to easily switch broker-dealers, and how often do clients use more than one broker-dealer simultaneously (e.g., for redundancy in case of a problem at a given broker-dealer)? Are broker-dealers subject to more market discipline than SCI entities? Please explain. Conversely, does a lack of transparency regarding events like SCI events limit this market discipline? Why or why not?

195. Given the stated goals and purpose of proposed Regulation SCI and its various provisions, what are commenters' views on whether the scope of the proposed rules should be expanded to cover broker-dealers, or certain categories of broker-dealers? For example, what are commenters' views on the impact to overall market integrity or the protection of investors if an OTC market maker was no longer able to operate due to a systems disruption, systems compliance issue, or a systems intrusion? Or an exchange market maker? Or a clearing broker-dealer? What are commenters' views on the importance of different categories of broker-dealers to the stability of the overall securities market infrastructure, in the context of requiring them to comply with the proposed rules, in light of the stated goals and purpose of Regulation SCI? What risks do the systems of broker-dealers pose on the securities markets?

196. If the Commission were to subsequently propose to apply some or all of the requirements of proposed Regulation SCI to some types or categories of broker-dealers (in addition to SCI ATSs), what types of broker-dealers should the requirements apply to and why? Are there distinctions that should be made between different types of broker-dealers (e.g., OTC market makers, exchange market makers, order entry firms, clearing broker-dealers, and multi-service broker-dealers) for this purpose? If so, what are those distinctions and which requirements should apply?

197. The Commission notes that Roundtable panelists generally did not distinguish between national securities exchanges, ATSs, and different types of broker-dealers when addressing how to improve error prevention and error response strategies. Rather, Roundtable panelists and commenters referred more generally to “entities with market access” and/or “execution venues.” In this regard, should the Commission consider expanding the application of Regulation SCI to all market centers, as that term is defined in Rule 600(b)(38) of Regulation NMS, which means any exchange market maker, OTC market maker, ATS, national securities exchange, or national securities association? Why or why not? Would an expansion of proposed Regulation SCI to include all market centers (i.e., execution venues) inappropriately exclude the broader category of entities having market access? Why or why not? Alternatively, should the Commission consider applying the requirements of proposed Regulation SCI to (a) any registered market maker or (b) any broker-dealer that offers market access that, in either case, with respect to any NMS stock, has a specified percentage of average daily dollar volume? If so, what should such a percentage be? Would the levels applicable to SCI ATSs that trade NMS stocks under proposed Rule 1000(a) of Regulation SCI be appropriate for registered market makers, broker-dealers that offer market access, or other broker-dealers? Why or why not? If not, what should such a threshold be?

198. If the Commission were to propose to expand the scope of proposed Regulation SCI to a subset of broker-dealers, what are commenters' views on whether, and if so, how, the various different proposed requirements of Regulation SCI should or should not apply to such entities?

199. If the Commission were to propose to expand the scope of proposed Regulation SCI to include a subset of broker-dealers, should the Commission require such broker-dealers to have written policies and procedures reasonably designed to ensure that their systems have levels of capacity, integrity, resiliency, availability, and security adequate to maintain their operational capability, and promote the maintenance of fair and orderly markets, as proposed in Rule 1000(b)(1) for SCI entities? Why or why not? Should SCI industry standards for broker-dealers be different from those proposed for SCI entities? If so, what are the standards that should apply to broker-dealers? Please be as specific as possible and explain why a particular standard would be appropriate.

200. Should the Commission require such broker-dealers to establish, maintain, and enforce policies and procedures reasonably designed to ensure that their systems operate in the manner intended, including in a manner that complies with federal securities laws and rules and regulations thereunder, as proposed in Rule 1000(b)(2)(i) for SCI entities? Why or why not? Should the Commission establish a safe harbor from liability for such broker-dealers and their respective employees if they satisfy the elements of a safe harbor, similar to those in proposed Rules 1000(b)(2)(ii) and (iii) for SCI entities and their employees? Why or why not?

201. Should the Commission require such broker-dealers, upon any of their responsible SCI personnel becoming aware of an SCI event, to begin to take appropriate corrective action including, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable, as proposed in Rule 1000(b)(3) for SCI entities? Why or why not? Should such broker-dealers' corrective action be triggered by something other than awareness of an SCI event? If so, what would be an appropriate trigger?

202. With regard to the reporting and information dissemination requirements for SCI entities in proposed Rules 1000(b)(4) and 1000(b)(5), would it be appropriate to require such broker-dealers to report all SCI events to the Commission, and disclose dissemination SCI events to their customers?

203. Should such broker-dealers be required to notify the Commission of material systems changes, as proposed in Rule 1000(b)(6) for SCI entities? Why or why not?

204. Should such broker-dealers be required to undertake an annual SCI review of their systems, as proposed in Rule 1000(b)(7) for SCI entities? Should such broker-dealers also be required to provide the Commission with reports regarding the SCI review and material systems changes, as proposed in Rule 1000(b)(8) for SCI entities? Why or why not?

205. Should such broker-dealers be required to submit any required notices, reports, and other information to the Commission on proposed new Form SCI? Why or why not?

206. Alternatively, should the Commission propose to require that each SCI SRO establish rules requiring that its members adopt written policies and procedures reasonably designed to ensure that their systems have levels of capacity, integrity, resiliency, availability, and security adequate to maintain their operational capability, and promote the maintenance of fair and orderly markets? Why or why not? Similarly, should the Commission propose to require that each SCI SRO establish rules requiring that its members adopt written policies and procedures reasonably designed to ensure that the systems of such members operate in the manner intended, including in a manner that complies with applicable federal securities laws and rules and regulations thereunder and the SCI SRO's rules? Why or why not? In either case, would such a proposal raise any competitive issues, such as between national securities exchanges and ATSs?

207. In addition, should the Commission consider including other entities in the definition of SCI entity (e.g., transfer agents), thus subjecting them to some or all of the requirements under proposed Regulation SCI? If yes, to which entities should some or all of proposed Regulation SCI apply and why? If not, why not? If commenters believe other types of entities should be included in the definition of SCI entity, should the Commission include all entities of a given type in the definition? Why or why not? If not, how should the Commission distinguish those entities that should be included (e.g., size, volume, types of services performed, etc.)? Please describe and be as specific as possible.

208. If the Commission were to subsequently propose and adopt a rule applying Regulation SCI to all or certain categories of broker-dealers or other entities, what are commenters' views as to the type and scale of the costs of such application? Please explain. In addition, what are commenters' views as to the potential impact on efficiency, competition, and capital formation of such application? Please explain.

IV. Paperwork Reduction Act

Certain provisions of the proposal contain “collection of information” requirements within the meaning of the Paperwork Reduction Act of 1995 (“PRA”) and the Commission will submit them to the Office of Management and Budget (“OMB”) for review in accordance with 44 U.S.C. 3507 and 5 CFR 1320.11. The title of the new collection of information is Regulation Systems Compliance and Integrity. An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number.

A. Summary of Collection of Information

Proposed Regulation SCI would include four categories of obligations that would require a collection of information within the meaning of the PRA. Specifically, an SCI entity would be required to: (1) Establish specified written policies and procedures, and mandate participation by designated members or participants in certain testing of the SCI entity's business continuity and disaster recovery plans; (2) provide certain notifications, disseminate certain information, and create reports; (3) take corrective actions, identify certain SCI events for which immediate Commission notification is required, and identify dissemination SCI events; and (4) comply with recordkeeping and access requirements relating to its compliance with proposed Regulation SCI.

1. Requirements To Establish Written Policies and Procedures and Mandate Participation in Certain Testing

Proposed Rules 1000(b)(1) and (b)(2) would require SCI entities to establish policies and procedures with respect to various matters. Proposed Rule 1000(b)(1) would require each SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, SCI security systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets. Proposed Rule 1000(b)(1)(i) specifies that such policies and procedures would be required to include, at a minimum: (A) The establishment of reasonable current and future capacity planning estimates; (B) periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner; (C) a program to review and keep current systems development and testing methodology for such systems; (D) regular reviews and testing of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters; (E) business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse to ensure next business day resumption of trading and two-hour resumption of clearance and settlement services following a wide-scale disruption; and (F) standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data. Proposed Rule 1000(b)(1)(ii) states that such policies and procedures would be deemed to be reasonably designed if they are consistent with current SCI industry standards, which would be required to be: (A) Comprised of information technology practices that are widely available for free to information technology professionals in the financial sector; and (B) issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. The proposed SCI industry standards contained in the publications identified on Table A are intended to serve as standards that SCI entities could use, if they so choose, to comply with the requirements of proposed Rule 1000(b)(1), though compliance with such SCI industry standards would not be the exclusive means to comply with the requirements of proposed Rule 1000(b)(1).

Proposed Rule 1000(b)(2)(i) would require each SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in the manner intended, including in a manner that complies with the federal securities laws and rules and regulations thereunder and the entity's rules and governing documents, as applicable. An SCI entity would be deemed not to have violated proposed Rule 1000(b)(2)(i) if: (A) It has established and maintained policies and procedures reasonably designed to provide for: (1) testing of all such systems and any changes to such systems prior to implementation; (2) periodic testing of all such systems and any changes to such systems after their implementation; (3) a system of internal controls over changes to such systems; (4) ongoing monitoring of the functionality of such systems to detect whether they are operating in the manner intended; (5) assessments of SCI systems compliance performed by personnel familiar with applicable federal securities laws and rules and regulations thereunder and the SCI entity's rules and governing documents, as applicable; and (6) review by regulatory personnel of SCI systems design, changes, testing, and controls to prevent, detect, and address actions that do not comply with applicable federal securities laws and rules and regulations thereunder and the SCI entity's rules and governing documents, as applicable; (B) the SCI entity has established and maintained a system for applying such policies and procedures which would reasonably be expected to prevent and detect, insofar as practicable, any violation of such policies and procedures by the SCI entity or any person employed by the SCI entity; and (C) the SCI entity: has reasonably discharged the duties and obligations incumbent upon it by such policies and procedures; and was without reasonable cause to believe that such policies and procedures were not being complied with in any material respect. Further, pursuant to proposed Rule 1000(b)(2)(iii), a person employed by an SCI entity would be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by any other person of proposed Rule 1000(b)(2)(i) if the person employed by the SCI entity: (A) Has reasonably discharged the duties and obligations incumbent upon such person by such policies and procedures; and (B) was without reasonable cause to believe that such policies and procedures were not being complied with in any material respect.

Proposed Rule 1000(b)(9)(i) would require an SCI entity, with respect to its business continuity and disaster recovery plans, including its backup systems, to require participation by designated members or participants in scheduled functional and performance testing of the operation of such plans in the manner and frequency as specified by the SCI entity, at least once every 12 months (e.g., for SCI SROs, by submitting proposed rule changes under Section 19(b) of the Exchange Act; for SCI ATSs, by revising membership or subscriber agreements and internal procedures; for plan processors, through an amendment to an SCI Plan under Rule 608 of Regulation NMS; and, for exempt clearing agencies subject to ARP, by revising participant agreements and internal procedures). Proposed Rule 1000(b)(9)(ii) would further require an SCI entity to coordinate such required testing on an industry- or sector-wide basis with other SCI entities. Proposed Rule 1000(b)(9)(iii) would require an SCI entity to designate members or participants it deems necessary, for the maintenance of fair and orderly markets in the event of the activation of its business continuity and disaster recovery plans, to participate in the testing of such plans. It would also require the SCI entity to notify and update the Commission of its designations and standards for designation, and promptly update such notification after any changes to its designations or standards.

2. Notice, Dissemination, and Reporting Requirements for SCI Entities

A number of proposed rules under Regulation SCI would require SCI entities to notify or report information to the Commission, or disseminate information to their members or participants. Proposed Rules 1000(b)(4), (b)(5), (b)(6), (b)(7), and (b)(8) each contain a notification, dissemination, or reporting requirement.

Proposed Rule 1000(b)(4) would require notice of SCI events to the Commission. Proposed Rule 1000(b)(4)(i) would require an SCI entity to notify the Commission upon any responsible SCI personnel becoming aware of a systems disruption that the SCI entity reasonably estimates would have a material impact on its operations or on market participants, any systems compliance issue, or any systems intrusion.

Proposed Rule 1000(b)(4)(ii) would require an SCI entity, within 24 hours of any responsible SCI personnel becoming aware of any SCI event, to submit a written notification to the Commission on Form SCI pertaining to such SCI event. Proposed Rule 1000(b)(4)(iv)(A) would specify that, for a notification made pursuant to proposed Rule 1000(b)(4)(ii), an SCI entity must include all pertinent information known about the SCI event, including: a detailed description of the SCI event; the SCI entity's current assessment of the types and number of market participants potentially affected by the SCI event; the potential impact of the SCI event on the market; and the SCI entity's current assessment of the SCI event, including a discussion of the determination of whether the SCI event is a dissemination SCI event or not. In addition, to the extent available as of the time of the initial notification, the notification would be required to include: a description of the steps the SCI entity is taking, or plans to take, with respect to the SCI event; the time the SCI event was resolved or timeframe within which the SCI event is expected to be resolved; a description of the SCI entity's rule(s) and/or governing document(s), as applicable, that relate to the SCI event; and an analysis of the parties that may have experienced a loss, whether monetary or otherwise, due to the SCI event, the number of such parties, and an estimate of the aggregate amount of such loss. Further, for a written notification to the Commission of an SCI event under proposed Rule 1000(b)(4)(ii), an SCI entity would be required to attach a copy of any information disseminated to date regarding the SCI event to its members or participants or on the SCI entity's publicly available Web site.

Proposed Rule 1000(b)(4)(iii) would require an SCI entity to submit written updates on Form SCI pertaining to an SCI event to the Commission on a regular basis, or at such frequency as reasonably requested by a representative of the Commission, until such time as the SCI event is resolved. Proposed Rule 1000(b)(4)(iv)(B) specifies that, for a notification made pursuant to proposed Rule 1000(b)(4)(iii), the SCI entity would be required to update any information previously provided regarding an SCI event, including any information under proposed Rule 1000(b)(4)(iv)(A)(2) that was not available at the time of submission of a notification under proposed Rule 1000(b)(4)(ii). Further, for a written notification to the Commission of an SCI event under proposed Rule 1000(b)(4)(iii), an SCI entity would be required to attach a copy of any information disseminated to date regarding the SCI event to its members or participants or on the SCI entity's publicly available Web site.

Proposed Rule 1000(b)(5) would require dissemination to members or participants of dissemination SCI events and specify the nature and timing of such required dissemination, with limited exceptions for dissemination SCI events that are systems intrusions, as discussed further below. Proposed Rule 1000(b)(5)(i)(A) would require that an SCI entity, promptly after any responsible SCI personnel becomes aware of a dissemination SCI event, disseminate to its members or participants the following information about such SCI event: (1) The systems affected by the SCI event; and (2) a summary description of the SCI event. In addition, proposed Rule 1000(b)(5)(i)(B) would require an SCI entity to, when known, further disseminate to its members or participants: (1) a detailed description of the SCI event; (2) the SCI entity's current assessment of the types and number of market participants potentially affected by the SCI event; and (3) a description of the progress of its corrective action for the SCI event and when the SCI event has been or is expected to be resolved. Proposed Rule 1000(b)(5)(i)(C) would further require that an SCI entity provide regular updates to members or participants on any of the information required to be disseminated under proposed Rules 1000(b)(5)(i)(A) and (i)(B).

Proposed Rule 1000(b)(5)(ii) would provide a limited exception to the proposed requirement of prompt dissemination to members or participants of information regarding dissemination SCI events for systems intrusion. Proposed Rule 1000(b)(5)(ii) would require an SCI entity, promptly after any responsible SCI personnel becomes aware of a systems intrusion, to disseminate to its members or participants a summary description of the systems intrusion, including a description of the corrective action taken by the SCI entity and when the systems intrusion has been or is expected to be resolved, unless the SCI entity determines that dissemination of such information would likely compromise the security of the SCI entity's SCI systems or SCI security systems, or an investigation of the systems intrusion, and documents the reasons for such determination.

Proposed Rule 1000(b)(6) would require an SCI entity, absent exigent circumstances, to notify the Commission on Form SCI at least 30 calendar days before implementation of any planned material systems change, including a description of the planned material systems change as well as the expected dates of commencement and completion of implementation of such change. If exigent circumstances exist, or if the information previously provided to the Commission regarding any material systems change has become materially inaccurate, an SCI entity would instead be required to notify the Commission, either orally or in writing on Form SCI, with any oral notification to be memorialized within 24 hours after such oral notification by a written notification, as early as reasonably practicable.

Proposed Rule 1000(b)(7) would require an SCI entity to conduct an SCI review of the entity's compliance with Regulation SCI not less than once each calendar year, and to submit a report of the SCI review to senior management of the SCI entity for review no more than 30 calendar days after completion of such SCI review.

Proposed Rule 1000(b)(8) contains two reporting requirements. Specifically, proposed Rule 1000(b)(8) would require an SCI entity to submit as an attachment to Form SCI: (i) A report of the SCI review required by proposed Rule 1000(b)(7), together with any response by senior management, within 60 calendar days after its submission to senior management of the SCI entity; and (ii) a report within 30 calendar days after the end of June and December of each year, containing a summary description of the progress of any material systems change during the six-month period ending on June 30 or December 31, as the case may be, and the date or expected date of completion of implementation of such change.

3. Requirements To Take Corrective Actions, Identify Immediate Notification SCI Events, and Identify Dissemination SCI Events

Proposed Rule 1000(b)(3) would require an SCI entity, upon any responsible SCI personnel becoming aware of an SCI event, to begin to take appropriate corrective action which would be required to include, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable. Given these requirements of proposed Rule 1000(b)(3), SCI entities would likely work to develop a process for ensuring that they are prepared to comply with the corrective action requirement and would likely also periodically review this process.

In addition, proposed Rule 1000(a) would define a “dissemination SCI event” to mean an SCI event that is a: (1) Systems compliance issue; (2) systems intrusion; or (3) systems disruption that results, or the SCI entity reasonably estimates would result, in significant harm or loss to market participants.

Under the proposed Commission notification and member or participant dissemination requirements of proposed Rules 1000(b)(4) and (b)(5), when an SCI event occurs, an SCI entity must determine whether an SCI event is an immediate notification SCI event or a dissemination SCI event. As such, SCI entities would likely work to develop a process for ensuring that they are able to make determinations regarding the nature of the SCI event quickly and accurately, and periodically review this process.

4. Recordkeeping Requirements

Proposed Rule 1000(c) would set forth recordkeeping requirements for SCI entities. Under proposed Rule 1000(c)(1), SCI SROs would be required to make, keep, and preserve all documents relating to their compliance with Regulation SCI as prescribed in Rule 17a-1 under the Exchange Act. Under proposed Rule 1000(c)(2), each SCI entity that is not an SCI SRO would be required to make, keep, and preserve at least one copy of all documents, including correspondence, memoranda, papers, books, notices, accounts, and other such records, relating to its compliance with Regulation SCI including, but not limited to, records relating to any changes to its SCI systems and SCI security systems, for a period of not less than five years, the first two years in a place that is readily accessible to the Commission or its representatives for inspection and examination. Upon request of any representative of the Commission, such SCI entities would be required to promptly furnish to the possession of such representative copies of any documents required to be kept and preserved by it under proposed Rule 1000(c)(2). Under proposed Rule 1000(c)(3), upon or immediately prior to ceasing to do business or ceasing to be registered under the Exchange Act, an SCI entity must take all necessary action to ensure that the records required to be made, kept, and preserved by this section will be accessible to the Commission and its representatives in the manner required by proposed Rule 1000(c) and for the remainder of the period required by proposed Rule 1000(c).

In addition, proposed Rule 1000(e) would provide that, if the records required to be filed or kept by an SCI entity under proposed Regulation SCI are prepared or maintained by a service bureau or other recordkeeping service on behalf of the SCI entity, the SCI entity would be required to ensure that the records are available for review by the Commission and its representatives by submitting a written undertaking, in a form acceptable to the Commission, by such service bureau or other recordkeeping service and signed by a duly authorized person at such service bureau or other recordkeeping service.

B. Proposed Use of Information

1. Requirements To Establish Written Policies and Procedures and Mandate Participation in Certain Testing

The proposed requirements that SCI entities establish certain written policies and procedures with respect to their systems, and that they require designated members or participants to participate in the testing of their business continuity and disaster recovery plans, would further the goals of the national market system and reinforce Exchange Act obligations by requiring entities important to the functioning of the U.S. securities markets to carefully design, develop, test, maintain, and surveil systems integral to their operations, and operate them in compliance with relevant federal securities laws and the rules and regulations thereunder, as well as their own rules and policies.

2. Notification, Dissemination, and Reporting Requirements for SCI Entities

The information that would be collected pursuant to the proposed requirements for notifications, disseminations of information, and reports would assist the Commission in its oversight of SCI entities and the securities markets, help ensure the orderly operation of the U.S. securities markets, and help protect investors and the public interest. In particular, the proposed requirements that SCI entities notify the Commission of all SCI events, disseminate information to members or participants, undertake and submit to the Commission an SCI review not less than once each calendar year, and submit reports of material systems changes are designed to help ensure compliance with the other provisions of proposed Regulation SCI and accountability of SCI entities in the event of systems problems. Further, the Commission preliminarily believes that the member or participant information dissemination requirement for dissemination SCI events would make members or participants aware that their trading activity might have been or might be impacted by the occurrence of a dissemination SCI event, so that they could consider that information in making trading decisions, seeking corrective action, or pursuing remedies, among other things. The Commission also preliminarily believes that the prospect of disseminating information regarding dissemination SCI events to members or participants would provide an incentive for SCI entities to better focus on improving the integrity and compliance of their systems.

3. Requirements To Take Corrective Actions, Identify Immediate Notification Events, and Identify Dissemination SCI Events

The proposed requirement that SCI entities begin to take appropriate corrective action upon any responsible SCI personnel becoming aware of an SCI event would help ensure that SCI entities dedicate adequate resources to timely address an SCI event and place an emphasis on mitigating potential harm to investors and market integrity. The proposed threshold for notification of certain SCI events to the Commission under proposed Rule 1000(b)(4)(i) would help ensure that the Commission is made aware of significant SCI events when any responsible SCI personnel becomes aware of such events. The proposed definition of dissemination SCI event would help ensure potentially impacted members or participants have basic information about SCI events so that they might be able to better assess whether they should use the services of an SCI entity.

5. Recordkeeping Requirements

The proposed recordkeeping requirements in Rules 1000(c) and (e) would assist Commission staff during an examination of an SCI entity to assess its compliance with the proposed rules. In addition, access to the records of SCI entities would help Commission staff to carry out its oversight responsibilities of SCI entities and the securities markets. Further, the proposed recordkeeping requirements would aid SCI entities and the Commission in documenting, reviewing, and correcting any SCI event, as well as in identifying market participants that may have been harmed by such an event.

C. Respondents

The “collection of information” requirements contained in proposed Regulation SCI would apply to SCI entities, as described below. Currently, there are 26 entities that would satisfy the proposed definition of SCI SRO, 15 entities that would satisfy the proposed definition of SCI ATS, 2 entities that would satisfy the definition of plan processor, and 1 entity that would meet the definition of exempt clearing agency subject to ARP. Accordingly, the Commission estimates that there are currently 44 entities that would meet the definition of SCI entity and be subject to the collection of information requirements of proposed Regulation SCI.

The Commission requests comment on the accuracy of these estimated figures.

D. Total Initial and Annual Reporting and Recordkeeping Burdens

As discussed above, all of the national securities exchanges, national securities associations, registered clearing agencies, and plan processors currently participate on a voluntary basis in the ARP Inspection Program. Under the ARP Inspection Program, Commission staff conducts on-site inspections and attends periodic technology briefings by staff of these entities, generally covering systems capacity and testing, review of systems vulnerability, review of planned systems development, and business continuity planning. In addition, Commission staff monitors systems failures and planned major systems changes at these entities.

Under proposed Regulation SCI, many of the principles of the ARP policy statements with which SCI SROs are familiar would be codified. However, because the proposed regulation would have a broader scope than the current ARP Inspection Program and would impose mandatory recordkeeping obligations on entities subject to the rules, proposed Regulation SCI would impose paperwork burdens on all SCI entities. The Commission's total burden estimates reflect the total burdens on all SCI entities, taking into account the extent to which some SCI entities already comply with some of the proposed requirements of Regulation SCI. As discussed below, the Commission preliminarily believes that the extent of these burdens will vary for different types of SCI entities. The Commission notes that the hour figures set forth in this section are the Commission's preliminary best estimate of the paperwork burden for compliance with proposed Regulation SCI based on a variety of sources, including the Commission's experience with the current ARP Inspection Program and other similar estimated burdens for analogous rulemakings. However, the Commission recognizes that commenters may have other informed views of the actual burdens that would be imposed by these requirements and thus, the Commission solicits comment on the appropriateness and accuracy of each of the estimated burdens below.

1. Requirements To Establish Written Policies and Procedures and Mandate Participation in Certain Testing

The proposed rules that would require an SCI entity to establish policies and procedures and to mandate member or participant participation in business continuity and disaster recovery plans testing are discussed more fully in Section III.C above.

a. Policies and Procedures Required by Proposed Rule 1000(b)(1)

The Commission preliminarily estimates that an SCI entity that has not previously participated in the ARP Inspection Program would require an average of 210 burden hours to develop and draft policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, SCI security systems, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets, as proposed to be required by Rule 1000(b)(1) of Regulation SCI (except for policies and procedures for standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data, which are addressed separately). The estimated 210 hours required for such entities would include the time expended to draft relevant policies and procedures and the time expended for review of the draft policies and procedures by the SCI entity's management. The Commission preliminarily believes that all SCI entities would conduct this work internally.

For SCI entities that currently participate in the ARP Inspection Program (29 entities, nearly all of which are SCI SROs ), the Commission preliminarily believes that in developing their policies and procedures, these entities would be starting from a baseline of fifty percent, and therefore the average paperwork burden of developing the proposed policies and procedures would be 105 burden hours. The Commission preliminarily believes that a fifty percent baseline for SCI entities that participate in the ARP Inspection Program is appropriate because, although these entities already have substantial policies and procedures in place, proposed Rule 1000(b)(1) would require these entities to devote substantial time to reviewing and revising their existing policies and procedures to ensure that they are sufficiently robust in the context of a new and expanded regulatory regime. The Commission preliminarily believes that these entities would conduct this work internally.

With regard to the proposed requirement in Rule 1000(b)(1) that an SCI entity's policies and procedures include standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data, the Commission preliminarily estimates that each SCI entity would spend an average of 130 hours annually to comply with this requirement. As this proposed requirement is not currently addressed by the ARP Inspection Program, the Commission preliminarily estimates that the total initial and ongoing burden would be the same for all SCI entities and SCI entities would conduct this work internally.

As noted above, the Commission preliminarily believes that SCI entities would handle internally most of the work associated with establishing, maintaining, and enforcing written policies and procedures as proposed to be required by Rule 1000(b)(1). However, based on its experience with the ARP Inspection Program, the Commission preliminarily believes that SCI entities also would seek outside legal and/or consulting services in the initial preparation of such policies and procedures, and that the average cost of such outside legal and/or consulting advice would be $20,000 per respondent, for a total of $880,000 for all respondents.

As noted above, the Commission preliminarily estimates that the average initial number of burden hours per respondent to comply with proposed Rule 1000(b)(1) (except for policies and procedures for standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data) would be 105 hours for SCI entities that are current ARP Inspection Program participants and 210 hours for SCI entities that are not current ARP Inspection Program participants, for a total of 6,195 hours. In addition, the Commission preliminarily estimates that the average initial number of burden hours per respondent to comply with the requirement for policies and procedures for standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data would be 130 hours for a total of 5,720 hours for all respondents.

The Commission preliminarily estimates that, once an SCI entity has drafted the policies and procedures proposed to be required by Rule 1000(b)(1) (except for policies and procedures for standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data), it would spend on average approximately 60 hours annually to review its written policies and procedures to ensure that they are up-to-date and to prepare any necessary new or amended policies and procedures. Using a fifty percent baseline for SCI entities that participate in the ARP Inspection Program and therefore currently review and revise policies and procedures from time to time, the Commission preliminarily estimates that the total annual ongoing burden to comply with proposed Rule 1000(b)(1) (except for policies and procedures for standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data) would be 30 hours per respondent for this group of respondents. The Commission therefore estimates the ongoing burden to comply with proposed Rule 1000(b)(1) (except for policies and procedures for standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data) to be 870 hours for SCI entities that are current ARP Inspection Program participants and 900 hours for SCI entities that are not ARP Inspection Program participants, for a total of 1,770 hours for all respondents. As noted above, the Commission preliminarily estimates that the average ongoing number of burden hours per respondent to comply with the proposed requirement for policies and procedures for standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data would be 130 hours for each respondent, for a total of 5,720 hours for all respondents. The Commission preliminarily believes that the work associated with updating the policies and procedures proposed to be required by proposed Rule 1000(b)(1) would be done internally.

b. Policies and Procedures Required by Proposed Rule 1000(b)(2)

With regard to proposed Rule 1000(b)(2)(i), which would require each SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in the manner intended, including in a manner that complies with the federal securities laws and rules and regulations thereunder and, as applicable, the entity's rules and governing documents, the Commission preliminarily believes that each SCI entity would elect to comply with the safe harbor provisions in proposed Rules 1000(b)(2)(ii) and (iii), and preliminarily estimates that each SCI entity would initially spend approximately 180 hours to design their policies and procedures accordingly. This estimate would include the time necessary to review and revise any existing policies and procedures to ensure that they satisfy the proposed safe harbor provisions, and the Commission preliminarily believes this estimate would be the same for all SCI entities. Therefore, the Commission preliminarily estimates that proposed Rule 1000(b)(2) would carry an initial one-time burden of 180 hours per respondent, for a total initial one-time burden of 7,920 hours for all respondents. The Commission also preliminarily estimates that each SCI entity that is an SRO would spend approximately 120 hours annually to review these written policies and procedures to ensure that they are up-to-date and to prepare any necessary new or amended policies and procedures, and that other types of SCI entities would spend approximately 60 hours to do this work. Therefore, the Commission preliminarily estimates that proposed Rule 1000(b)(2) would carry an ongoing annual burden of 120 hours per SRO respondent and 60 hours per non-SRO respondent, for a total ongoing annual burden of 4,200 hours for all respondents. These estimated burdens per respondent also would include the time expended for the review of the draft policies and procedures by the SCI entity's management.

As with proposed Rule 1000(b)(1), the Commission preliminarily believes that SCI entities would handle internally most of the work associated with establishing and maintaining written policies and procedures that are reasonably designed to ensure that their SCI systems operate in the manner intended, including in a manner that complies with the federal securities laws and rules and regulations thereunder and, as applicable, the entity's rules and governing documents, and that meet the requirements of the proposed safe harbor provisions of proposed Rule 1000(b)(2)(ii). However, based on its experience with the ARP Inspection Program, the Commission preliminarily believes that SCI entities also would seek outside legal and/or consulting advice in the initial preparation of such policies and procedures, and that the average cost of outside legal/consulting advice would be $20,000 per respondent, for a total of $880,000 for all respondents.

c. Mandate Participation in Certain Testing

Proposed Rule 1000(b)(9) would require each SCI entity, with respect to its business continuity and disaster recovery plans, including its backup systems, to require participation by designated members or participants in scheduled functional and performance testing of the operation of such plans at specified intervals, and coordinate such testing on an industry- or sector-wide basis with other SCI entities. The Commission preliminarily believes that all SCI entities would be subject to this proposed requirement, and that none of these entities currently require participation by members or participants in scheduled functional and performance testing of their business continuity and disaster recovery plans, as proposed Rule 1000(b)(9) would have them require.

Although SCI entities may seek to implement the proposed requirements in different ways (e.g., for SCI SROs, by submitting proposed rule changes under Section 19(b) of the Exchange Act; for SCI ATSs, by revising membership or subscriber agreements and internal procedures; for plan processors, through an amendment to an SCI Plan under Rule 608 of Regulation NMS; and, for exempt clearing agencies subject to ARP, by revising participant agreements and internal procedures), the Commission preliminarily believes that the average paperwork burden associated with the proposed rule would be the same for all SCI entities because they would likely make similar changes to their rules, agreements, procedures, or SCI Plans, and would likely take similar actions to implement and coordinate mandatory testing. Based on its experience with SCI entities, the Commission preliminarily believes that SCI entities, other than plan processors, would handle this work internally.

The Commission preliminarily estimates that each SCI entity (other than plan processors) would spend approximately 130 hours initially to meet the requirements of proposed Rules 1000(b)(9)(i) and (ii). This estimate takes into consideration the requirement to mandate participation by designated members or participants in testing under proposed Rule 1000(b)(9)(i), as well as the requirement under proposed Rule 1000(b)(9)(ii) that an SCI entity coordinate required testing with other SCI entities. Specifically, the estimated 130 hours assumes that it would take an SCI entity 35 hours to write a proposed rule, or revise a membership/subscriber agreement or participant agreement, as the case may be, to establish the participation requirement for the SCI entity's designated members or participants, and an additional 95 hours of follow-up work (e.g., notice and schedule coordination) to ensure implementation. Therefore, the Commission preliminarily estimates that proposed Rules 1000(b)(9)(i) and (ii) would carry an initial burden of 130 hours per respondent, for a total initial burden of 5,460 hours for all respondents. For plan processors, the Commission preliminarily estimates that proposed Rules 1000(b)(9)(i) and (ii) would carry an initial cost of $52,000 per respondent, for a total initial cost of $104,000 hours for all plan processors.

The Commission also preliminarily estimates that each SCI entity (other than plan processors) would spend approximately 95 hours annually to review the written rules or requirements to ensure that they remain up-to-date and to prepare any necessary amendments and undertake necessary coordination to ensure implementation and enforcement of the requirement. Therefore, the Commission preliminarily estimates that proposed Rules 1000(b)(9)(i) and (ii) would carry an ongoing annual burden of 95 hours per respondent, for a total ongoing annual burden of 3,990 hours for all respondents. For plan processors, the Commission preliminarily estimates that proposed Rules 1000(b)(9)(i) and (ii) would carry an ongoing annual cost of $38,000 hours per respondent, for a total ongoing annual cost of $76,000 for all plan processors.

The Commission preliminarily estimates that each SCI entity (other than plan processors) would spend approximately 35 hours initially to meet the requirements of proposed Rule 1000(b)(9)(iii). This estimate takes into consideration the burden for an SCI entity to establish standards for designating members or participants who must participate in its business continuity and disaster recovery plans testing and file such standards with the Commission on Form SCI, as well as the burden for an SCI entity to determine, compile, and submit its list of designated members or participants on Form SCI. Specifically, the Commission estimates that each SCI entity would take 35 hours to write a proposed rule or an internal procedure, as the case may be, to establish standards for designating members or participants, to apply the standards to compile the list of designees, and to file such standards and the list of designees on Form SCI. Therefore, the Commission preliminarily estimates that proposed Rule 1000(b)(9)(iii) would carry an initial burden of 35 hours per respondent, for a total initial burden of 1,470 hours for all respondents. For plan processors, the Commission preliminarily estimates that proposed Rule 1000(b)(9)(iii) would carry an initial cost of $14,000 per respondent, for a total initial cost of $28,000 hours for all plan processors.

The Commission also preliminarily estimates that each SCI entity (other than plan processors) would spend approximately 3 hours annually to review the designation standards to ensure that they remain up-to-date and to prepare any necessary amendments, to review its list of designated members or participants, and to update prior Commission notifications with respect to the standards for designation and the list of designees. Therefore, the Commission preliminarily estimates that proposed Rule 1000(b)(9)(iii) would carry an ongoing annual burden of 3 hours per respondent, for a total ongoing annual burden of 126 hours for all respondents. For plan processors, the Commission preliminarily estimates that proposed Rule 1000(b)(9)(iii) would carry an ongoing annual cost of $1,200 hours per respondent, for a total ongoing annual cost of $2,400 for all plan processors.

2. Notice, Dissemination, and Reporting Requirements for SCI Entities

The proposed rules that would require an SCI entity to notify the Commission of SCI events, disseminate certain SCI events to members or participants, and submit specified reports are discussed more fully in Section III.C above.

a. Notices Required by Proposed Rule 1000(b)(4)

Proposed Rule 1000(b)(4) would require notice of SCI events to the Commission. The burden estimates to comply with proposed Rule 1000(b)(4) include the burdens associated with Commission notification of immediate notification SCI events and the submission of Form SCI in accordance with the instructions thereto.

Proposed Rule 1000(b)(4)(i) would require an SCI entity, upon any responsible SCI personnel becoming aware of a systems disruption that the SCI entity reasonably estimates would have a material impact on its operations or on market participants, any systems compliance issue, or any systems intrusion, to notify the Commission of such SCI event. As noted above, notification required by proposed Rule 1000(b)(4)(i) may be done orally or in writing. The Commission preliminarily estimates that each SCI entity would experience an average of 40 immediate notification SCI events per year. The Commission further preliminarily estimates that one-fourth of the notifications under proposed Rule 1000(b)(4)(i) would be in writing (i.e., 10 written notifications and 30 oral notifications), and that each written notification would require an in-house attorney half an hour to prepare and submit to the Commission. Thus, the Commission preliminarily estimates that the initial and ongoing burden to comply with the notification requirement of proposed Rule 1000(b)(4)(i) would be 5 hours annually per respondent, and 220 hours annually for all respondents.

Proposed Rule 1000(b)(4)(ii) would require an SCI entity, within 24 hours of any responsible SCI personnel becoming aware of any SCI event, to submit a written notification to the Commission on Form SCI pertaining to such SCI event. The Commission preliminarily estimates that each SCI entity would experience an average of 65 SCI events per year. Thus, the Commission preliminarily estimates that there would be an average of 65 SCI event notices per year for each respondent. The Commission preliminarily estimates that each notification under proposed Rule 1000(b)(4)(ii) would require an average of 20 burden hours, with a compliance manager and in-house attorney each spending approximately 10 hours in collaboration to draft, review, and submit the report. Thus, the Commission preliminarily estimates that the initial and ongoing burden to comply with the reporting requirement of proposed Rule 1000(b)(4)(ii) would be 1,300 hours annually per respondent, and 57,200 hours annually for all respondents.

Proposed Rule 1000(b)(4)(iii) would require an SCI entity to submit written updates to the Commission on Form SCI pertaining to SCI events on a regular basis, or at such frequency as reasonably requested by a representative of the Commission, until such time as the SCI event is resolved. Based on Commission staff's experience with the ARP Inspection Program, the Commission preliminarily estimates that, on average, each SCI entity would submit 5 updates per year under proposed Rule 1000(b)(4)(iii), and that each update would require an average of 3 burden hours, with a compliance manager and in-house attorney each spending approximately 1.5 hours in collaboration to draft, review, and submit the update. Thus, the Commission preliminarily estimates that the initial and ongoing burden to comply with the continuous update requirement of proposed Rule 1000(b)(4)(iii) would be 15 hours annually per respondent, and 660 hours annually for all respondents.

b. Disseminations Required by Proposed Rule 1000(b)(5)

Proposed Rule 1000(b)(5) would require disseminations of information to members or participants relating to dissemination SCI events. Based on the definition of dissemination SCI event, the Commission preliminarily estimates that each SCI entity would experience an average of 14 dissemination SCI events each year that are not systems intrusions, resulting in an average of 14 member or participant dissemination per respondent per year under proposed Rule 1000(b)(5)(i).

Proposed Rule 1000(b)(5)(i)(A) would require an SCI entity, promptly after any responsible SCI personnel becomes aware of a dissemination SCI event other than a systems intrusion, to disseminate to its members or participants the following information about such SCI event: (1) The systems affected by the SCI event; and (2) a summary description of the SCI event.

In addition to the costs for outside legal advice discussed below, the Commission estimates that each initial member or participant dissemination would require an average of 3 hours to prepare and make available to members or participants, with an in-house attorney spending approximately 2.67 hours in drafting and reviewing the dissemination, and a webmaster spending approximately 0.33 hours in making the dissemination available to members or participants. Thus, the Commission preliminarily estimates that the initial and ongoing burden to comply with the initial member or participant dissemination requirement of proposed Rule 1000(b)(5)(i)(A) would be approximately 42 hours annually per respondent, and 1,848 hours annually for all respondents.

Proposed Rule 1000(b)(5)(i)(B) would require the SCI entity to further disseminate, when known, the following information to its members or participants: (1) A detailed description of the SCI event; (2) the SCI entity's current assessment of the types and number of market participants potentially affected by the SCI event; and (3) a description of the progress of its corrective action for the SCI event and when the SCI event has been or is expected to be resolved. In addition to the outside costs discussed below, the Commission preliminarily estimates that each update under proposed Rule 1000(b)(5)(i)(B) would require an average of 5 hours to prepare and make available to members or participants, with an in-house attorney spending approximately 4.67 hours in drafting and reviewing the update, and a webmaster spending approximately 0.33 hour in making the update available to members or participants. Thus, the Commission preliminarily estimates that the initial and ongoing burden to comply with the update requirement of proposed Rule 1000(b)(5)(i)(B) would be approximately 70 hours annually per respondent, and 3,080 hours annually for all respondents.

Proposed Rule 1000(b)(5)(i)(C) would require an SCI entity to provide regular updates to members or participants of any information required to be disseminated under proposed Rule 1000(b)(5). As noted above, there were approximately 175 ARP incidents reported to the Commission in 2011. These incidents had durations ranging from under one minute to 24 hours, with most incidents having a duration of less than 2 hours. Based on the relatively short duration of the ARP incidents reported to the Commission in 2011, the Commission preliminarily estimates that, on average, each SCI entity would provide one regular update per year per dissemination SCI event under proposed Rule 1000(b)(5)(i)(C). In addition to the costs for outside legal advice discussed below, the Commission preliminarily estimates that each update would require an average of 1 hour to prepare and make available to members or participants, with an in-house attorney spending approximately 0.67 hour in drafting and reviewing the update, and a webmaster spending approximately 0.33 hour in making the update available to members or participants. Thus, the Commission preliminarily estimates that the initial and ongoing burden to comply with the regular update requirement of proposed Rule 1000(b)(5)(i)(C) would be approximately 14 hours annually per respondent, and 616 hours annually for all respondents.

Under proposed Rule 1000(b)(5)(ii), promptly after any responsible SCI personnel becomes aware of a systems intrusion, the SCI entity would be required to disseminate to its members or participants a summary description of the systems intrusion, including a description of the corrective action taken by the SCI entity and when the systems intrusion has been or is expected to be resolved, unless the SCI entity determines that dissemination of such information would likely compromise the security of the SCI entity's SCI systems or SCI security systems, or an investigation of the systems intrusion, and documents the reasons for such determination. Based on the definition of dissemination SCI event, the Commission preliminarily estimates that each SCI entity would experience an average of 1 dissemination SCI event that is a systems intrusion each year, resulting in an average of 1 member or participant dissemination per respondent per year under proposed Rule 1000(b)(5)(ii). In addition to the costs for outside legal advice discussed below, the Commission estimates that each member or participant dissemination under proposed Rule 1000(b)(5)(ii) would require an average of 3 hours to prepare and make available to members or participants, with an in-house attorney spending approximately 2.67 hours in drafting and reviewing the dissemination, and a webmaster spending approximately 0.33 hours in making the dissemination available to members or participants. Thus, the Commission preliminarily estimates that the initial and ongoing burden to comply with the member or participant dissemination requirement under proposed Rule 1000(b)(5)(ii) would be approximately 3 hours annually per respondent, and 132 hours annually for all respondents.

The Commission preliminarily believes that SCI entities would internally handle most of the work associated with disseminating information on dissemination SCI events to members or participants. However, based on its experience with the ARP Inspection Program, the Commission preliminarily believes that SCI entities also would seek outside legal advice in the preparation of the disseminations required under proposed Rule 1000(b)(5), and that the average cost of outside legal advice would be $15,000 per respondent per year, for a total of $660,000 for all respondents per year.

c. Notices Required by Proposed Rules 1000(b)(6)

Proposed Rules 1000(b)(6) would require notification to the Commission on Form SCI of material systems changes. The Commission preliminarily believes this work would be conducted internally. The burden estimates to comply with proposed Rule 1000(b)(6) include the burdens associated with submission of Form SCI in accordance with the instructions thereto.

Specifically, proposed Rule 1000(b)(6) would require the SCI entity, absent exigent circumstances, to notify the Commission on Form SCI at least 30 calendar days before the implementation of any planned material systems change, including a description of the planned material systems change as well as the expected dates of commencement and completion of the implementation of such change. Based on its experience with the ARP Inspection Program, Commission preliminarily estimates that there would be an average of 60 planned material systems changes per respondent per year. As such, the Commission preliminarily estimates that there would be an average of 60 notifications per respondent per year, and each notification would require an average of 2 hours to prepare and submit, with an attorney spending approximately 0.33 hours and a senior systems analyst spending approximately 1.67 hours in drafting and reviewing the notification. For the 15 SCI entity respondents that do not currently participate in the ARP Inspection Program, the Commission preliminarily estimates that the initial and ongoing burden to comply with the notice requirement of proposed Rule 1000(b)(6) would be approximately 120 hours annually per respondent, and 1,800 hours annually for all respondents. Because SCI entities that currently participate in the ARP Inspection Program already notify the Commission of planned material systems changes, the Commission preliminarily estimates that these entities would be starting from a baseline of fifty percent, and that the increased burden for these 30 SCI entities would be 60 hours annually per respondent. The Commission preliminarily estimates that the total initial and ongoing burden for SCI entities that currently participate in the ARP Inspection Program would be 60 hours annually per respondent, for a total burden of 1,740 hours for all of these respondents. Thus, the total estimated initial and ongoing burden to comply with proposed Rule 1000(b)(6) would be 3,540 for all respondents.

d. SCI Review Required by Proposed Rule 1000(b)(7)

Proposed Rule 1000(b)(7) would require each SCI entity to conduct an SCI review of its compliance with Regulation SCI not less than once each calendar year, and submit a report of the SCI review to its senior management for review no more than 30 calendar days after completion of such SCI review. The Commission preliminarily estimates that the initial and ongoing burden of conducting an SCI review and submitting the SCI review to senior management of the SCI entity for review would be approximately 625 hours for each respondent and 27,500 hours annually for all respondents.

e. Reports Required by Proposed Rule 1000(b)(8)

Proposed Rule 1000(b)(8) would require each SCI entity to submit certain reports to the Commission. The burden estimates to comply with proposed Rule 1000(b)(8) include the burdens associated with submission of Form SCI in accordance with the instructions thereto.

Pursuant to proposed Rule 1000(b)(8)(i), each SCI entity would be required to submit to the Commission, as an attachment to Form SCI, a report of the SCI review required by proposed Rule 1000(b)(7), together with any response by senior management of the SCI entity, within 60 calendar days after its submission to senior management of the SCI entity. The Commission estimates that each SCI entity would require 1 hour to submit the SCI review using Form SCI, for a total annual initial and ongoing burden of 44 hours for all respondents.

Proposed Rule 1000(b)(8)(ii) would require each SCI entity to submit, using Form SCI, a report within 30 calendar days after the end of June and December of each year, containing a summary description of the progress of any material systems changes during the six-month period ending on June 30 or December 31, as the case may be, and the date, or expected date, of completion of their implementation. The Commission preliminarily estimates that the initial and ongoing burden to comply with proposed Rule 1000(b)(8)(ii) would be approximately 60 hours per respondent per report or 120 hours annually, and 5,280 hours annually for all respondents.

3. Requirements To Take Corrective Actions, Identify Immediate Notification SCI Events, and Identify Dissemination SCI Events

The proposed rules that could result in SCI entities establishing additional processes for compliance with proposed Regulation SCI are discussed more fully in Section III.C above.

a. Requirement To Take Corrective Actions

Proposed Rule 1000(b)(3) would require an SCI entity, upon any responsible SCI personnel becoming aware of an SCI event, to begin to take corrective action which shall include, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable. Based on its experience with the ARP Inspection Program, the Commission believes that entities that participate in the ARP Inspection Program already take corrective actions in response to a systems issue, and believes that other SCI entities also take corrective actions in response to a systems issue. Nevertheless, the Commission preliminarily believes that proposed Rule 1000(b)(3) would likely result in SCI entities revising their policies in this regard, which would help to ensure that their information technology staff has the ability to access systems in order to take appropriate corrective actions. As such, proposed Rule 1000(b)(3) may impose a one-time implementation burden on SCI entities associated with developing a process for ensuring that they are prepared for the corrective action requirement. Proposed Rule 1000(b)(3) also may impose periodic burdens on SCI entities in reviewing that process. The Commission preliminarily estimates that the initial burden to implement such a process would be 42 hours per SCI entity or 1,848 hours for all SCI entities. The Commission also preliminarily estimates that the ongoing burden to review such a process would be 12 hours annually per SCI entity or 528 hours annually for all SCI entities.

b. Requirements To Identify Immediate Notification SCI Events and Dissemination SCI Events

Proposed Rule 1000(a) would define a “dissemination SCI event” to mean an SCI event that is a: (1) Systems compliance issue; (2) systems intrusion; or (3) systems disruption that results, or the SCI entity reasonably estimates would result, in significant harm or loss to market participants.

When an SCI event occurs, an SCI entity would need to determine whether the event is an immediate notification SCI event or a dissemination SCI event, because the proposed rules would impose different obligations on SCI entities for these types of SCI events. As such, immediate notification SCI events and dissemination SCI events may impose an initial one-time implementation burden on SCI entities in developing a process to ensure that they are able to quickly and correctly make a determination regarding whether the SCI event is subject to proposed Rule 1000(b)(4)(i) or (b)(5). The definition may also impose periodic burdens on SCI entities in reviewing that process.

Because the ARP Inspection Program already provides for the reporting of “significant system changes” and “significant system outages” to Commission staff, the Commission believes that, as compared to entities that do not participate in the ARP Inspection Program, entities that currently participate in the ARP Inspection Program would already have internal processes for determining the significance of a systems issue. Therefore, the Commission preliminarily estimates that the proposed definition would impose half as much burden on entities that participate in the ARP Inspection Program as compared to entities that do not participate in the ARP Inspection Program.

For SCI entities that currently do not participate in the ARP Inspection Program, the Commission preliminarily believes that the initial burden would be 42 hours per entity or 630 hours for all such entities. For entities that currently participate in the ARP Inspection Program, the Commission preliminarily believes that the initial burden would be 21 hours per entity or 609 hours for all such entities. For SCI entities that currently do not participate in the ARP Inspection Program, the Commission preliminarily believes that ongoing burden would be 12 hours annually per entity or 180 hours for all such entities. For SCI entities that currently participate in the ARP Inspection Program, the Commission preliminarily believes that ongoing burden would be 6 hours annually per entity or 174 hours for all such entities.

4. Recordkeeping Requirements

As more fully discussed in Section III.D above, proposed Rule 1000(c) would specifically require SCI entities other than SCI SROs to make, keep, and preserve at least one copy of all documents relating to its compliance with proposed Regulation SCI. The Commission is not proposing a new recordkeeping requirement for SCI SROs because the documents relating to compliance with proposed Regulation SCI are subject to their existing recordkeeping and retention requirements under Rule 17a-1 under the Exchange Act. Because Rule 17a-1 under the Exchange Act requires every SRO to keep on file for a period of not less than 5 years, the first 2 years in an easily accessible place, at least one copy of all documents that it makes or receives respecting its self-regulatory activities, and that all such documents be made available for examination by the Commission and its representatives, the Commission believes that proposed Rule 1000(c) would not result in any burden that is not already accounted for in the Commission's burden estimates for Rule 17a-1.

For SCI entities other than SCI SROs, Regulation SCI-related records would be required to be kept for a period of not less than five years, the first two years in a place that is readily accessible to the Commission or its representatives for inspection and examination. Upon the request of any representative of the Commission, an SCI entity would be required to promptly furnish to the possession of such representative copies of any documents required to be kept and preserved by it pursuant to proposed Rule 1000(c).

For SCI entities other than SCI SROs, the Commission preliminarily estimates that the initial and ongoing burden to make, keep, and preserve records relating to compliance with proposed Regulation SCI would be approximately 25 hours annually per respondent for a total annual burden of 450 hours for all respondents. In addition, the Commission estimates that each SCI entity other than an SCI SRO would incur a one-time burden to set up or modify an existing recordkeeping system to comply with proposed Rule 1000(c). Specifically, the Commission estimates that, for each SCI entity other than an SCI SRO, setting up or modifying a recordkeeping system would create an initial burden of 170 hours and $900 in information technology costs for purchasing recordkeeping software, for a total initial burden of 3,060 hours and a total initial cost of $16,200.

The Commission preliminarily believes that proposed Rule 1000(c)(3), which would require an SCI entity, upon or immediately prior to ceasing to do business or ceasing to be registered under the Exchange Act, to take all necessary action to ensure that the records required to be made, kept, and preserved by Rule 1000(c)(1) and Rule (c)(2) remain accessible to the Commission and its representatives in the manner and for the remainder of the period required by Rule 1000(c), would not result in any additional paperwork burden that is not already accounted for in the Commission's burden estimates for proposed Rule 1000(c)(1) and Rule 1000(c)(2).

6. Request for Comment on Extent and Cost of Outsourcing

209. The Commission's estimates of the hourly burdens discussed above reflect the Commission's preliminary view that SCI entities would conduct the work proposed to be required by proposed Rules 1000(a), 1000(b)(1), 1000(b)(2), 1000(b)(3), 1000(b)(4), 1000(b)(5), 1000(b)(6), 1000(b)(7), 1000(b)(8), and 1000(b)(9) internally. The Commission acknowledges, however, that some SCI entities, particularly smaller SCI entities, and/or SCI entities that do not currently participate in the ARP Inspection Program, may elect to outsource the work if it would be more cost effective to so do. The Commission does not at this time have sufficient information to reasonably estimate the cost to outsource the work proposed to be required by proposed Rules 1000(a), 1000(b)(1), 1000(b)(2), 1000(b)(3), 1000(b)(4), 1000(b)(5), 1000(b)(6), 1000(b)(7), 1000(b)(8), and 1000(b)(9), or the number of entities that would choose to outsource this work, for purposes of the PRA. The Commission seeks comment, however, on its preliminary view that SCI entities would conduct such work internally. Further, the Commission seeks comment on whether some SCI entities would in fact find it more cost effective to outsource the work that would be required to comply with the proposed rules, and if so, how many of these SCI entities would therefore outsource this work and at what cost.

For purposes of facilitating such comment, presented below are certain preliminary assumptions and calculations regarding such potential outsourcing on which the Commission requests comment. Specifically, for purposes of soliciting comment, the Commission is assuming that it would take the same number of hours for a consultant and/or outside attorney to complete the work to be required by proposed Rules 1000(a), 1000(b)(1), 1000(b)(2), 1000(b)(3), 1000(b)(4), 1000(b)(5), 1000(b)(6), 1000(b)(7), 1000(b)(8), and 1000(b)(9), as it would take for an SCI entity to complete that work internally (using the Commission's preliminary estimates above). Further, the Commission is assuming that work would be conducted at a rate of $400 per hour.

Based on the forgoing assumptions, the estimated cost to outsource the work that the Commission preliminarily assumed would be done internally would be as follows:

For identification of immediate notification SCI events and dissemination SCI events: The initial cost would be (a) for an SCI entity that has not participated in the ARP Inspection Program, $16,800; and (b) for an SCI entity that currently participates in the ARP Inspection Program, $8,400. The ongoing annual cost would be (a) for an SCI entity that has not participated in the ARP Inspection Program, $4,800; and (b) for an SCI entity that currently participates in the ARP Inspection Program, $2,400.

For proposed Rule 1000(b)(1) except proposed Rule 1000(b)(1)(i)(F): The initial cost would be (a) for an SCI entity that has not participated in the ARP Inspection Program, $84,000; and (b) for an SCI entity that currently participates in the ARP Inspection Program, $42,000. The ongoing annual costs would be (a) for an SCI entity that has not participated in the ARP Inspection Program, $24,000; and (b) for an SCI entity that currently participates in the ARP Inspection Program, $12,000.

For proposed Rule 1000(b)(1)(i)(F): The initial cost for each SCI entity would be $52,000. The ongoing annual cost for each SCI entity would be $52,000.

For proposed Rule 1000(b)(2): The initial cost for each SCI entity would be $72,000. The ongoing annual cost would be (a) for an SCI entity that is an SCI SRO, $48,000; and (b) for an SCI entity that is not an SCI SRO, $24,000.

For proposed Rule 1000(b)(3): The initial cost for each SCI entity would be $16,800. The ongoing annual cost for each SCI entity would be $4,800.

For proposed Rule 1000(b)(4): The initial and the ongoing annual cost for each SCI entity would be (a) for proposed Rule 1000(b)(4)(i), $2,000; (b) for proposed Rule 1000(b)(4)(ii), $520,000; and (c) for proposed Rule 1000(b)(4)(iii), $6,000.

For proposed Rule 1000(b)(5): The initial and the ongoing annual cost for each SCI entity would be (a) for proposed Rule 1000(b)(5)(i)(A), $16,800; (b) for proposed Rule 1000(b)(5)(i)(B), $28,000; (c) for proposed Rule 1000(b)(5)(i)(C), $5,600; and (d) for proposed Rule 1000(b)(5)(ii), $1,200.

For proposed Rule 1000(b)(6): The initial and ongoing annual cost would be (a) for SCI entities that do not currently participate in the ARP Inspection Program, $48,000; and (b) for SCI entities that currently participate in the ARP Inspection Program, $24,000.

For proposed Rule 1000(b)(7): The initial and ongoing annual cost would be $250,000 for each SCI entity.

For proposed Rule 1000(b)(8): The initial and ongoing annual cost for each SCI entity would be (a) for proposed Rule 1000(b)(8)(i), $400; and (b) for proposed Rule 1000(b)(8)(ii), $48,000 for each SCI entity.

For proposed Rule 1000(b)(9)(i) and (ii): The initial annual cost would be $52,000 for each SCI entity. The ongoing annual cost would be $38,000 for each SCI entity.

For proposed Rule 1000(b)(9)(iii): The initial annual cost would be $14,000 for each SCI entity. The ongoing annual cost would be $1,200 for each SCI entity.

210. As discussed above, the Commission requests comment on these preliminary estimates regarding potential outsourcing and the underlying assumptions. For example, is it reasonable to assume that the number of hours for a consultant and/or outside attorney to complete the work would be the same as the number of hours for internal staff to complete the work? If not, why not? Are there certain types of SCI entities (e.g., those having relatively few employees or a smaller number of systems) that would be more likely to find it cost effective to outsource the work, either initially or an ongoing basis? Please explain. Would the cost to outsource vary depending on the extent and volume of the outsourcing, or the period of time over which such outsourcing took place? Please explain.

7. Total Paperwork Burden Under Regulation SCI

Based on the foregoing, the Commission preliminarily estimates that the total one-time initial burden for all SCI entities to comply with Regulation SCI would be 133,482 hours and the total one-time initial cost would be $2.6 million. The Commission preliminarily estimates that the total annual ongoing burden for all SCI entities to comply with Regulation SCI would be 117,258 hours and the total annual ongoing cost would be $738,400.

211. The Commission seeks comment on the collection of information burdens associated with proposed Regulation SCI. Specifically:

212. Do commenters agree with the Commission's estimate of the number of respondents required to comply with proposed Regulation SCI? Why or why not?

213. Do commenters agree with the Commission's estimate of the burden for SCI entities to comply proposed Regulation SCI? Why or why not?

214. Would there be additional burdens, beyond those described here, associated with the collection of information under proposed Regulation SCI? Please explain.

215. How much additional burden would proposed Regulation SCI impose upon those SCI entities that already are voluntarily in compliance with existing ARP Policy Statements?

216. Would SCI entities generally perform the work required by proposed Regulation SCI internally or outsource the work?

E. Collection of Information Is Mandatory

All collections of information pursuant to the proposed rules would be a mandatory collection of information.

F. Confidentiality

To the extent that the Commission receives confidential information pursuant to the reports and submissions that SCI entities would submit under proposed Form SCI, such information would be kept confidential, subject to the provisions of applicable law.

G. Retention Period of Recordkeeping Requirements

SCI entities would be required to retain records and information under proposed Regulation SCI for a period of not less than five years, the first two years in a place that is readily accessible to the Commission or its representatives.

H. Request for Comments

217. Pursuant to 44 U.S.C. 3506(c)(2)(B), the Commission solicits comment to: (1) Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility; (2) evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information; (3) enhance the quality, utility, and clarity of the information to be collected; and (4) minimize the burden of collection of information on those who are to respond, including through the use of automated collection techniques or other forms of information technology.

Persons wishing to submit comments on the collection of information requirements should direct them to the Office of Management and Budget, Attention: Desk Officer for the Securities and Exchange Commission, Office of Information and Regulatory Affairs, Room 3208, New Executive Office Building, Washington, DC 20503; and should send a copy to Elizabeth M. Murphy, Secretary, Securities and Exchange Commission, 100 F Street NE., Washington, DC 20549-1090 with reference to File No. S7-01-13. OMB is required to make a decision concerning the collection of information between 30 and 60 days after publication, so a comment to OMB is best assured of having its full effect if OMB receives it within 30 calendar days of publication. The Commission will submit the proposed collection of information to OMB for approval. Requests for the materials to be submitted to OMB by the Commission with regard to this collection of information should be in writing, refer to File No. S7-01-13, and be submitted to the Securities and Exchange Commission, Office of Investor Education and Advocacy, 100 F Street NE., Washington, DC 20549-0213.

I. Reduced Burdens From Proposed Repeal of Rule 301(b)(6) (OMB Control Number 3235-0509)

The instant proposal also would amend Regulation ATS under the Exchange Act, by removing paragraph (b)(6) of Rule 301 thereunder. Removal of Rule 301(b)(6) would eliminate certain “collection of information” requirements within the meaning of the PRA that the Commission has submitted to OMB in accordance with 44 U.S.C. 3507 and 5 CFR 1320.11, and that OMB has approved. The approved collection of information is titled “Rule 301: Requirements for Alternative Trading Systems,” and has a valid OMB control number of 3235-0509. Some of the information collection burdens imposed by Regulation ATS would be reduced by the proposed repeal of Rule 301(b)(6). Specifically, the paperwork burdens that would be eliminated by the repeal of Rule 301(b)(6) would be: (i) Burdens on ATSs associated with the requirement to make records relating to any steps taken to comply with systems capacity, integrity and security requirements under Rule 301 (estimated to be 20 hours and $2,212); and (ii) burdens on ATSs associated with the requirement to provide notices to the Commission to report systems outages (estimated to be 2.5 hours and $276.50).

The Commission will submit the proposed amended collection of information to reflect these reductions to OMB for approval. Requests for the materials to be submitted to OMB by the Commission with regard to this collection of information should be in writing, refer to File No. S7-01-13, and be submitted to the Securities and Exchange Commission, Office of Investor Education and Advocacy, 100 F Street NE., Washington, DC 20549-0213.

V. Economic Analysis

A. Background

As discussed more fully above, the Commission believes that the convergence of several developments—the evolution of the markets to become significantly more dependent upon sophisticated automated systems (driven by regulatory developments and the continual evolution of technologies for generating, routing, and executing orders), the limitations of the existing ARP Inspection Program, and the lessons of recent events (as discussed in Section I.D above)—highlight the need to consider an updated and formalized regulatory framework for ensuring that the U.S. securities trading markets develop and maintain systems with adequate capacity, integrity, resiliency, availability, and security, and reinforce the requirement that SCI systems operate in compliance with the Exchange Act. The Commission is also cognizant of the comments made at the Roundtable and the comment letters submitted in connection with the Roundtable. Proposed Regulation SCI would codify and enhance the Commission's ARP Inspection Program, as well as establish specific requirements to help ensure that the SCI systems of SCI entities operate in compliance with the federal securities laws and rules.

Specifically, proposed Regulation SCI would require each SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, SCI security systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets, as well as written policies and procedures reasonably designed to ensure that its SCI systems operate in the manner intended, including in a manner in compliance with the federal securities laws and rules, and its own rules or governing documents, as applicable. Proposed Regulation SCI also would require SCI entities to provide certain notices and reports to the Commission on Form SCI regarding, among other things, SCI events and material systems changes. Further, proposed Regulation SCI would require SCI entities to disseminate information to members or participants relating to dissemination SCI events and to begin taking appropriate corrective action upon any responsible SCI personnel becoming aware of an SCI event. Additionally, proposed Regulation SCI would require each SCI entity to conduct an SCI review at least annually, and submit a report of such review to the Commission, together with any response by senior management. Further, proposed Regulation SCI would require an SCI entity, with respect to its business continuity and disaster recovery plans, to require participation by designated members or participants in scheduled functional and performance testing of the operation of such plans and coordinate such testing with other SCI entities. Proposed Regulation SCI would also require SCI entities to make, keep, and preserve books and records related to compliance with Regulation SCI.

The Commission is sensitive to the economic effects of proposed Regulation SCI, including its costs and benefits. As discussed further below, the Commission requests comment on all aspects of the costs and benefits of the proposal, including any effects the proposed rules may have on efficiency, competition, and capital formation.

B. Economic Baseline

As noted in Section I.A above, all registered national securities exchanges, all active registered clearing agencies, FINRA, two plan processors, one ATS, and one exempt clearing agency participate in the current ARP Inspection Program, which covers their automated systems. Under the ARP policy statements and through the ARP Inspection Program, these entities, among other things, are expected to establish current and future capacity estimates, conduct capacity stress tests, conduct annual reviews of whether affected systems can perform adequately in light of estimated capacity levels, and identify possible threats to the systems. The ARP policy statements and Commission staff letters address, among other things, independent reviews, the reporting of certain systems changes, intrusions, and outages, and the need to comply with relevant laws and rules.

Trading volume in the securities markets has become increasingly dispersed across a broader range of market centers in recent years, with ATSs accounting for a significant portion of volume. However, no ATSs currently meet or exceed the volume thresholds that would trigger compliance with the system safeguard requirements of Rule 301(b)(6) of Regulation ATS. Thus, while ATSs comprise a significant portion of consolidated volume, only one ATS currently participates in the ARP Inspection Program. Dark pools alone comprised approximately 13 percent of consolidated volume last spring, but also are not part of the ARP Inspection Program. Further, ATSs that trade fixed income securities, including municipal and corporate debt securities, and non-NMS stocks (also referred to as OTC equities) are not represented in the ARP Inspection Program and do not meet the current thresholds in Regulation ATS for the application of systems safeguard rules.

Proposed Regulation SCI would apply to SROs (including national securities exchanges, national securities associations, registered clearing agencies, and the MSRB ), SCI ATSs, plan processors, and exempt clearing agencies subject to ARP. As such, proposed Regulation SCI would specifically cover the trading of NMS stocks, OTC equities, listed options, and debt securities. The proposed rules also would impact multiple markets for services, including the markets for trading services, listing services, regulation and surveillance services, clearing and settlement services, and market data.

As indicated above, many of the entities in these service markets are currently covered by the ARP Inspection Program. Therefore, the Commission recognizes that any economic effects, including costs and benefits, should be compared to a baseline of current practices that recognizes current practices pursuant to the ARP Inspection Program and the limitations of the ARP Inspection Program discussed in Section I.C above. In addition to the ARP Inspection Program, Commission staff has provided guidance to ARP entities on certain aspects of the ARP Inspection Program (e.g., in the 2001 Staff ARP Interpretive Letter). Further, Commission staff has provided guidance on issues outside the current scope of the ARP Inspection Program (e.g., in the 2009 Staff Systems Compliance Letter), but that are proposed to be addressed by Regulation SCI. Below, the Commission provides information on the current practices related to the types of market events addressed by proposed Regulation SCI, including, where available, information the Commission may have on the frequency of such events. In addition, the Commission describes why each relevant service market may not be structured in a way as to create a competitive incentive to prevent the occurrence of these market events.

1. SCI Events

a. Systems Disruptions

Currently, market participants employ a variety of measures to avoid systems disruptions for a variety of reasons, including to maintain competitive advantages, to provide optimal service to members with access to the trading and/or other services provided by the entity, to comply with legal obligations and, where applicable, to participate in the ARP Inspection Program. The range of such measures are possibly highly variable among SCI entities and within the systems employed by SCI entities. For example, matching engines are likely accorded high priority given the importance of low latency in trading. Industry standards are not codified for such entities and systems, except such as in an entity's rulebook or subscriber agreement. Typically, however, market participants follow industry standards and take measures that include weekend system testing and internal performance monitoring.

When system disruptions do occur, market participants take corrective action in the interest of remaining competitive, to provide optimal service, and to comply with legal obligations. To place the effectiveness of the current ARP Inspection Program in perspective, there were approximately 175 ARP incidents reported to the Commission in 2011. These incidents had durations ranging from under one minute to 24 hours, with most incidents having a duration of less than 2 hours. As noted above, the Commission believes that clearing systems and matching engines generally are given greater priority than other systems at SCI entities with regard to corrective action. In addition, the Commission believes that SCI entities that currently participate in the ARP Inspection Program strive to adhere to the next business day resumption standard for trading and two-hour resumption standard for clearance and settlement services, standards which the proposed rule would codify for all SCI entities.

As discussed in Section I.A, participation in the ARP Inspection Program entails, among other things, conducting annual assessments of affected systems, providing notifications of significant system changes to the Commission, and reporting significant system outages to the Commission. Further, Commission staff has provided guidance to the SROs and other participants in the ARP Inspection Program on what should be considered a “significant system change” and a “significant system outage” for purposes of reporting systems changes and problems to Commission staff. As such, the Commission believes that entities that currently participate in the ARP Inspection Program have certain processes for determining whether a systems change or outage is “significant.” Specifically, the 2001 Staff ARP Interpretive Letter sets forth the types of outages and changes that should be reported to the Commission and the timing of reporting. Also, as discussed below, the ARP policy statements are focused on automated systems. Specifically, entities that participate in the ARP Inspection Program follow the ARP policy statements with respect to systems that directly support trading, clearance and settlement, order routing, and market data. While generally only trading, clearance and settlement, order routing, and market data systems follow the guidelines in the ARP policy statements, ARP staff inspects all the categories of systems that are included in the proposed definition of “SCI systems.” However, ARP staff generally inspects systems that are not directly related to trading, clearance and settlement, order routing, or market data only if they detect red flags.

As discussed above, the ARP Inspection Program has garnered participation by all active registered clearing agencies, all registered national securities exchanges, FINRA, plan processors, one ATS, and one exempt clearing agency. Specifically, the Commission estimates that there are currently 29 SCI entities that are participants in the ARP Inspection Program. As noted, there were approximately 175 ARP incidents reported to the Commission in 2011. Although some entities provide the public with notices of outages, others may choose otherwise and are not required to do so.

Further, as discussed above, pursuant to Rule 301(b)(6) of Regulation ATS, certain aspects of the ARP policy statements apply to ATSs that meet the thresholds set forth in that rule. Currently, no ATSs meet such thresholds and, as such, none are required by Commission rule to implement systems safeguard measures. The Commission recognizes that it is in the interest of every market participant that does not participate in the ARP Inspection Program to try to avoid systems disruptions. Specifically, the Commission understands that generally, ATSs, like entities that currently participate in the ARP Inspection Program, employ a variety of measures to avoid systems disruptions, including systems testing, performance monitoring, and the use of fail-over back-up systems. In fact, one ATS currently voluntarily participates in the ARP Inspection Program. However, inasmuch as the ARP Inspection Program and the testing done and other measures taken by those entities that participate in the program have been beneficial to the industry, the systems of SCI entities could still be improved. For example, contingency planning in preparation of catastrophic events has not been fully adequate, as evidenced in the wake of Superstorm Sandy, when an extended shutdown of the equities and options markets resulted from, among other things, the exchanges' belief regarding the inability of some market participants to adequately operate from the backup facilities of all market centers. Although testing protocols were in place and the chance to participate in such testing was available, not all members or participants participated in such testing. Proposed Regulation SCI would require that designated members or participants of an SCI entity participate in scheduled functional and performance testing of the operation of the SCI entity's business continuity and disaster recovery plans, including its backup systems, and further require that SCI entities coordinate the testing of such plans on an industry- or sector-wide basis with other SCI entities. The Commission preliminarily believes that these proposed requirements would mitigate the chances of similar disruptions in the future.

b. Systems Compliance Issues

Currently, systems compliance issues (as proposed to be defined in Rule 1000(a)) are not covered by the ARP Inspection Program. However, national securities exchanges are subject to Section 6(b) of the Exchange Act, which requires an exchange to be organized and to have the capacity to carry out the purposes of the Exchange Act and to comply with the provisions of the Exchange Act, the rules and regulations thereunder, and its own rules. FINRA is subject to Section 15A(b) of the Exchange Act, which requires a national securities association to be organized and have the capacity to carry out the purposes of the Exchange Act and to comply with the provisions of the Exchange Act, the rules and regulations thereunder, the MSRB rules, and its own rules. Further, an ATS could face Commission sanctions if it fails to comply with relevant federal securities laws and rules and regulations thereunder. Events such as those described above have recently drawn attention to systems compliance issues. In part due to the fact that systems compliance issues are not part of the ARP Inspection Program, the Commission does not receive comprehensive data regarding such issues and, thus, their incidence cannot be concretely quantified. However, based on Commission staff's experience with SROs and the rule filing process, the Commission estimates that there are likely approximately seven systems compliance issues per SCI entity per year.

c. Systems Intrusions

In ARP I, the Commission stated its view that SROs should promptly notify Commission staff of any instances in which unauthorized persons gained or attempted to gain access to SRO systems. Market participants employ a wide variety of measures to prevent and respond to systems intrusions. Generally, market participants use measures such as firewalls to prevent systems intrusions, and use detection software to identify systems intrusions. Once an intrusion has been identified, the affected systems typically would be isolated and quarantined, and forensics would be performed. Several SCI entities have been the subject of security issues in recent years. The Commission believes that, currently, these events are rarely revealed to the public or to the members or participants of SCI entities.

2. Potential for Market Solutions

This section discusses potential market solutions and their shortcomings. Various SCI and non-SCI entities offer and compete to provide services in markets for trading services, listing services, regulatory services, clearance and settlement services, and market data. The markets for each of these services are regulated and competitive, which may make it difficult to determine if markets are functioning well due to competitive pressure or regulation, and how much can be attributed to each. However, there are limitations to such competition and following is a discussion of some limitations that are common to all of these markets. Notwithstanding what may be the limitations to competition in each of these markets, the Commission is also mindful, in evaluating whether, and if so, how, to regulate in this space, of the need to craft rules that appropriately take into account the tradeoffs between the resulting costs and benefits, and the effects on efficiency, competition, and capital formation, that would accompany such regulation.

Market participants may be unaware when SCI events disrupt transactions due to, for example, a lack of timely and consistently disseminated information about SCI events. First, providers of services that experience SCI events may lack the incentive to disclose such events. Second, other providers of services may choose to not publicly comment on the identity of providers who experienced SCI events. For example, providers of trading services may choose not to point to other providers because the next SCI event may occur on their own systems. In addition, a person or entity pointing at other providers may be exposed to litigation risks.

While some SCI events may not directly impact markets, they are still an indication of the risk of SCI events at a given SCI entity. It is likely that market participants assume that services operate as promised until an SCI event occurs. Reputation and good experiences with a trading venue may cause market participants to trust its effectiveness. In the absence of problems, however, a system may be assumed to be fully functional. Once a problem occurs, market participants will update their prior assumptions and should correctly infer that the system is not as robust as previously believed.

Moreover, in the case of SCI events that disrupt the entire market or large portions of it (e.g., the data outages during the flash crash on May 6, 2010), all providers of trading services may be affected at the same time and, as a result, market participants may find it challenging to identify service providers with lower risks of such SCI events. In light of the foregoing, members and participants of SCI entities would be important recipients of information disseminated about SCI events because they are the parties who would most naturally need, want, and be able to act on the information and, where applicable, share such disseminated information to other interested market participants, as discussed further below.

a. Market for Trading Services

Trading services are offered by entities that would meet the definition of SCI entity, including equities exchanges, options exchanges, and SCI ATSs, as well as by entities that would not be included in the proposed definition of SCI entity, such as ATSs that are not SCI ATSs, OTC market makers, and broker-dealers. As discussed above in Section I.B, there are currently 13 national securities exchanges that trade equity securities, with none having an overall market share of greater than 20 percent. There are currently 11 national securities exchanges that trade options. Of these exchanges, CBOE, ISE, and Nasdaq OMX Phlx have the most significant market share. ATSs—both ECNs and dark pools—as well as OTC market makers and broker-dealers also execute substantial volumes of stocks and bonds.

With respect to the competitive nature of the market for trading services, as well as the limitations to the competitive effects, all providers of trading services compete and have incentives to avoid systems disruptions, systems compliance issues, and systems intrusions because, for example, brokers and other entities will be inclined to route orders away from trading venues that have frequent systems problems. Indeed, trading service providers expend resources to provide quality services and attempt to mitigate systems disruptions, systems compliance issues, and systems intrusions; however, it is not clear how to distinguish between efforts attributable to competitive pressures, rather than existing legal requirements and regulatory programs such as the ARP Inspection Program.

The Commission recognizes that there may be limits with respect to the extent to which competition ameliorates systems problems associated with trading services. However, the Commission remains mindful of the need to craft rules that appropriately take into account the tradeoffs between the costs and benefits, and the effects on efficiency, competition, and capital formation, associated with any such rules. The Commission preliminarily believes that it is important for SCI entity members or participants to know about risks for SCI events at a given service provider. As discussed above, if information about SCI events is not disseminated to members or participants of SCI entities or are not attributable to specific SCI entities, market participants may misjudge the quality of trading services or otherwise make decisions without fully accounting for such risks. Furthermore, as evidenced by the extended shutdown of the equities and options markets that resulted from, among other things, the exchanges' belief regarding the inability of some market participants to adequately operate from the backup facilities of all market centers, contingency planning has not been adequate to help prevent market-wide outages. For example, as noted above, the NYSE offered its members the opportunity to participate in testing of its backup systems, but not all members chose to participate in such testing, and the Commission understands that the scope of the test was limited.

In addition, even though there are multiple trading venues, suppliers of trading services may have limited ability to transact in particular securities (e.g., certain index options may only trade on one options exchange). As a result, competition in the market for trading services may not sufficiently mitigate the occurrence of SCI events, and there may be insufficient disclosure of information regarding the quality of trading services offered by SCI entities.

b. Market for Listing Services

Certain SCI entities are in the market for listing services. In this market, exchanges compete to list issuers to collect listing fees and to provide ancillary services to listed companies. The NYSE and Nasdaq are the largest U.S. exchanges in terms of the number of equity securities listed, with the NYSE and Nasdaq serving as the listing market for 3,262 and 2,691 securities, respectively, as of February 4, 2013. U.S. exchanges face competition from other U.S. exchanges and from non-U.S. exchanges.

Competition for listings may be limited by many factors. With respect to the limitations of competitive forces in the market for listing services, first, while a company can be listed on a certain exchange, trading does not necessarily occur on that exchange. In fact, the majority of trading occurs away from the listing exchange in today's U.S. equities markets. Second, there are switching costs associated with moving a listing from one exchange to another, which may cause issuers to remain at their current exchange, even in response to the occurrence of some SCI events. Third, certain exchanges also may be considered more “prestigious” than others and, to this extent, they may wield market power over other exchanges when competing for issuers. As a result, these exchanges may not be properly incentivized to provide the level of service they otherwise might if they were subject to greater competition. Members and participants of SCI entities that serve as underwriters to issuers would be important recipients of information disseminated by SCI entities about dissemination SCI events, particularly if they share such information with issuers making listing decisions.

c. Market for Regulation and Surveillance Services

Regulation and surveillance are required by statutes and rules and, therefore, all regulated market participants (e.g., exchanges or ATSs) have a demand for regulation and surveillance services. Suppliers in this market may be in-house or third parties, and potentially include all of the exchanges and FINRA. Because of regulatory services agreements (“RSAs”) between FINRA and several national securities exchanges, as of February 2011, FINRA's Market Regulation Department was responsible for surveillance of 80 percent of the trading volume in U.S. equity markets and 35 percent of the volume in U.S. options markets. Also, in 2011, BATS and BATS-Y entered into RSAs with CBOE as the supplier. On the other hand, some exchanges have not entered into RSAs.

There are other regulatory services arrangements in addition to RSAs. For example, in 2008, the Commission declared effective a plan for allocating regulatory responsibilities pursuant to Rule 17d-2, which among other things, allocated regulatory responsibility for the surveillance, investigation, and enforcement of Common Rules over Common NYSE Members, with respect to NYSE-listed stocks and NYSE Arca-listed stocks, to NYSE and over Common FINRA Members, with respect to NASDAQ-listed stocks, Amex-listed stocks, and any CHX solely-listed stock, to FINRA.

With respect to limitations of competition that are specific to the market for regulatory and surveillance services, if investors, issuers, or other market participants become aware of SCI events by virtue of the members or participants of SCI entities sharing information they have received about dissemination SCI events, and such information suggests that an SRO has low-quality regulation and surveillance, they may avoid such venues since they may feel that their interests are not being adequately protected. In the case of an RSA, there is competition among providers of such services because the user of the service can enter into a contract with a different provider. An SRO that purchases regulatory and surveillance services pursuant to an RSA retains the ultimate responsibility and liability for its self-regulatory obligations, and has an interest in seeking a service provider that would provide a high level of regulatory and surveillance services. Since the purchaser of these services could face Commission sanctions and experience damages to their reputation for violations resulting from inadequate regulation and surveillance, providers of these services may have the incentive to ensure that they provide a high level of service.

A factor that limits competition in this market is that it is highly concentrated. As noted above, FINRA accounts for the surveillance of 80 percent of trading volume in U.S. equity markets and, although any SRO could potentially be a provider of such services, not all choose to do so, and thus there may not be many alternatives for RSAs. With respect to the market for Rule 17d-2 plans, the Commission recognizes that the level of competition may be limited, as Rule 17d-2 was intended to address regulatory duplication for broker-dealers that are members of more than one SRO, and one of which is usually FINRA.

d. Market for Clearance and Settlement Services

Certain SCI entities are in the market for clearance and settlement services. There are seven registered clearing agencies with active operations—DTC, FICC, NSCC, OCC, ICE Clear Credit, ICE Clear Europe, and CME —as well as one exempt clearing agency. An SCI event in this market could have very disruptive and widespread effects on the financial markets. Because each clearing agency has a critical role in the operation of a particular product market, clearing agencies may already have heightened incentives to ensure that their systems have adequate levels of capacity, integrity, resiliency, availability, and security. At the same time, one of the major impediments to competition in this market is that it is highly concentrated in particular classes of securities (e.g., equities or options). This may limit incentives for clearing agencies to have levels of capacity, integrity, resiliency, availability, and security that are appropriate for their role in the securities market. Thus, for the market for clearance and settlement services, it is especially important for the Commission and clearing agency participants to have current and accurate information about SCI events to help ensure that the clearing agencies are properly incentivized to provide high-quality service.

e. Market for Market Data

Finally, certain SCI entities provide market data. There are two different types of market data, namely consolidated data and proprietary data. As discussed above, when Congress mandated a national market system in 1975, it emphasized that the systems for collecting and distributing consolidated market data would “form the heart of the national market system.” Moreover, the Commission has identified certain benefits of consolidated market data, including providing the public with access to a comprehensive, accurate, and reliable source of information for NMS stocks. One of the Commission's primary concerns is that the market for consolidated data functions properly.

Market data is a critical part of the investment and trading process. The data is needed for pre- and post-trade transparency and allows market participants to make well-informed investment and trading decisions. Indeed, based on Commission staff experience, the Commission understands that many trading algorithms make trading decisions based primarily on market data and rely on that data being current and accurate. An SCI event in connection with market data could significantly disrupt markets.

The process of collecting and disseminating consolidated quotation and transaction data is governed by the SCI plans. For securities listed on Nasdaq, data distribution is governed by the Nasdaq UTP Plan. For securities listed on NYSE, NYSE Amex, and several other exchanges, data distribution is governed by the CTA Plan and the CQS Plan. For options, data distribution is governed by the OPRA Plan. These SCI plans also oversee the collection of fees for access to the consolidated data network, and the allocation of the resulting revenue across the exchanges. Currently, there are two entities designated as plan processors by SCI plans—SIAC and Nasdaq. Due to the extreme concentration in the market segment for consolidated data, there is virtually no competition between SCI plan processors which could lead to little incentive in ensuring a high-quality product with minimal disruptions.

3. Proposed Regulation SCI and Its Impact on Current Practices

Proposed Regulation SCI would be a codification and enhancement of the current ARP Inspection Program. As discussed further below with respect to each of the proposed rules, proposed Regulation SCI would: (A) Be mandatory and codify many aspects of the ARP policy statements; (B) expand the scope of the ARP policy statements to other types of systems and event types; and (C) expand the scope of the ARP Inspection Program to other types of entities.

With respect to different types of systems, as discussed in more detail above, the ARP policy statements are focused on automated systems. Specifically, entities that participate in the ARP Inspection Program follow the ARP policy statements with respect to systems that directly support trading, clearance and settlement, order routing, and market data. Proposed Regulation SCI, on the other hand, would apply to more types of systems than the ARP policy statements. As discussed above, in addition to the systems covered by the ARP Inspection Program, the proposed definition of “SCI systems” would also include systems that directly support regulation and surveillance that are not currently part of the ARP Inspection Program. Further, the provisions of proposed Regulation SCI relating to security standards and systems intrusions would also apply to “SCI security systems,” which would be defined to mean any systems that share network resources with SCI systems that, if breached, would be reasonably likely to pose a security threat to SCI systems.

Additionally, while the ARP Inspection Program and proposed Regulation SCI both cover certain types of systems disruptions and systems intrusions, proposed Regulation SCI also would cover systems compliance issues. Finally, the ARP Inspection Program includes 29 participants that are SCI entities, consisting of 17 registered national securities exchanges, seven registered clearing agencies, FINRA, two plan processors, one ATS, and one exempt clearing agency. Because no ATSs currently satisfy the thresholds in Rule 306(b)(6)(i) of Regulation ATS, no ATSs currently are subject to the systems safeguard requirements of Regulation ATS although, as noted above, one ATS voluntarily participates in the ARP Inspection Program. Proposed Regulation SCI would include all of the entities currently under the ARP Inspection Program. With respect to ATSs, proposed Regulation SCI would include an estimated 10 SCI ATSs in NMS stocks, an estimated two SCI ATSs in non-NMS stocks, an estimated three SCI ATSs in municipal securities and corporate debt securities, and one SRO (i.e., the MSRB).

Proposed Rules 1000(b)(4) and (b)(5) would require, respectively, that all SCI events be reported to the Commission, and that information relating to dissemination SCI events be disseminated to members or participants of an SCI entity. Proposed Rule 1000(a) would define a dissemination SCI event to mean an SCI event that is a: (1) Systems compliance issue; (2) systems intrusion; or (3) systems disruption that results, or the SCI entity reasonably estimates would result, in significant harm or loss to market participants. Under the ARP Inspection Program, only “significant” outages should be reported to the Commission, and there are no quantitative standards to define “significant” outage. Similarly, proposed Regulation SCI would not specify a quantitative standard for immediate notification SCI events or dissemination SCI events. Instead, immediate notification SCI events would include any systems disruption that the SCI entity reasonably estimates would have a material impact on its operations or on market participants, any systems compliance issue, and any systems intrusion. With respect to dissemination SCI events, certain information about all systems compliance issues and systems intrusions would be required to be disseminated to members or participants, although information about systems intrusions in some cases could be delayed. Systems disruptions would also be dissemination SCI events, however, only if they result, or the SCI entity reasonably estimates would result, in significant harm or loss to market participants.

Proposed Rule 1000(b)(1) (Capacity, Integrity, Resiliency, Availability, and Security) addresses the capacity, integrity, resiliency, availability, and security of the systems of SCI entities. Rule 1000(b)(1) would require an SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, SCI security systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.

Proposed Rule 1000(b)(1)(i) would further require that an SCI entity's policies and procedures include the establishment of reasonable current and future capacity planning estimates, periodic capacity stress tests, a program to review and keep current systems development and testing methodology, regular reviews and testing of such systems, including backup systems, business continuity and disaster recovery plans, and standards that result in systems that facilitate the successful collection, processing, and dissemination of market data. The items in proposed Rule 1000(b)(1)(i)(A)-(E) are the same as those in the ARP Inspection Program and Rule 301(b)(6) of Regulation ATS.

Proposed Rule 1000(b)(1)(ii) would further provide that an SCI entity's policies and procedures would be deemed to be reasonably designed if they are consistent with current SCI industry standards. The Commission preliminarily believes that SCI entities would be familiar with such standards because they would be required to be widely available for free to information technology professionals in the financial sector, and must be issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. As noted above, compliance with the identified SCI industry standards would not be the exclusive means to comply with the requirements of proposed Rule 1000(b)(1).

Proposed Rule 1000(b)(2)(i) (Systems Compliance) is not currently part of the ARP Inspection program and would require each SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in the manner intended, including in a manner that complies with the federal securities laws and rules and regulations thereunder and the entity's rules and governing documents, as applicable.

Proposed Rule 1000(b)(3) (Corrective Action) would require that, upon any responsible SCI personnel becoming aware of an SCI event, an SCI entity begin to take appropriate corrective action. The Commission understands that market participants already take steps to address systems issues should they occur, but preliminarily believes that proposed Rule 1000(b)(3) may result in SCI entities incurring additional information technology costs, primarily because proposed Rule 1000(b)(3) requires each SCI entity, upon any responsible SCI personnel becoming aware of an SCI event, to begin to take appropriate corrective action. Thus, SCI entities would not be able to delay the start of taking corrective action, which in turn could result in some SCI entities potentially seeking to, for example, update their systems with newer technology earlier than they might have otherwise. As these increased costs would likely occur primarily as a result of SCI entities making usual and customary investments sooner than they would otherwise, these costs are difficult to quantify.

Proposed Rule 1000(b)(4) (Commission Notification) would require that an SCI entity notify the Commission of all SCI events. Proposed Rule 1000(b)(4) would apply to more entities, systems, and types of systems issues than the ARP policy statements (or the 2001 Staff ARP Interpretive Letter) and also require more detailed reporting to the Commission.

Proposed Rule 1000(b)(5) (Dissemination of Information to Members or Participants) would require an SCI entity to disseminate information relating to dissemination SCI events to members or participants. Proposed Rule 1000(b)(5) would impose a new requirement that is not currently part of the ARP Inspection Program. As noted above in Section V.B.1.a, some entities provide their members or participants with notices of outages currently. However, although proposed Rule 1000(b)(5) would permit information regarding some systems intrusions to be delayed, the Commission expects that dissemination of information to members or participants about dissemination SCI events would increase significantly.

With respect to proposed Rule 1000(b)(6) (Material Systems Changes), while entities may voluntarily submit similar material systems change notifications to the Commission under the ARP Inspection Program, proposed Regulation SCI would set forth more detailed requirements. Proposed Rule 1000(b)(6) would require an SCI entity to notify the Commission of planned material systems changes on proposed Form SCI at least 30 calendar days in advance of such change, unless exigent circumstances exist or information previously provided to the Commission regarding a planned material systems change has become materially inaccurate, necessitating notice regarding a material systems change with less than 30 calendar days' notice.

Proposed Rule 1000(b)(7) (SCI Review) would require an SCI entity to conduct an SCI review of its compliance with Regulation SCI at least annually, and submit a report of the SCI review to senior management of the SCI entity for review no more than 30 calendar days after completion of the SCI review. Because systems reviews have always been part of the ARP Inspection Program, the Commission believes that most SCI entities currently undertake annual systems reviews, reports of which the Commission understands are reviewed by senior management. The Commission believes, however, that the scope of the systems review undertaken by ARP entities, and senior management involvement in in such reviews, varies among ARP entities. The Commission expects that proposed Regulation SCI, which defines the parameters of an SCI review, would foster greater consistency in the approach that SCI entities take with respect to systems reviews.

Proposed Rule 1000(b)(8) (Reports) would require an SCI entity to submit various reports to the Commission. Specifically, proposed Rule 1000(b)(8)(i) would require an SCI entity to submit a report of the SCI review required by proposed Rule 1000(b)(7), together with any response by senior management, within 60 calendar days after its submission to senior management of the SCI entity. Proposed Rule 1000(b)(8)(ii) would require an SCI entity to submit a report, within 30 calendar days after the end of June and December of each year, containing a summary description of the progress of any material systems change during the six-month period ending on June 30 or December 31, as the case may be, and the date, or expected date, of completion of implementation of such changes. Such reports to be filed with the Commission pursuant to proposed Rule 1000(b)(8) would be required to be filed electronically on Form SCI. Proposed Rule 1000(b)(8) would codify current practice under the ARP Inspection Program, in which ARP entities submit reports of systems reviews and report progress on material systems changes to ARP staff. However, proposed Rule 1000(8) would specify a more detailed process for submission of such reports.

Proposed Rule 1000(b)(9) (SCI Entity Business Continuity and Disaster Recovery Plans Testing Requirements for Members or Participants) is not part of the current ARP Inspection Program and would require an SCI entity, with respect to its business continuity and disaster recovery plans, including its backup systems, to require participation by designated members or participants in scheduled functional and performance testing of the operation of such plans, in the manner and frequency as specified by the SCI entity, at least once every 12 months. In addition, the proposed rule would require an SCI entity to coordinate such testing on an industry- or sector-wide basis with other SCI entities. Further, the proposed rule would require each SCI entity to designate those members or participants it deems necessary, for the maintenance of fair and orderly markets in the event of the activation of its business continuity and disaster recovery plans, to participate in the testing of such plans. Each SCI entity would be required to notify the Commission of such designations and its standards for designation, and promptly update such notification after any changes to its designations or standards. Although nothing prevents SCI entities from doing so, the Commission currently does not mandate that members or participants of SCI entities test the business continuity and disaster recovery plans, including backup systems, of SCI entities. This proposed rule would allow greater oversight by the Commission over the business continuity and disaster recovery capabilities of SCI entities. While the Commission believes that many SCI entities currently provide the opportunity for their members or participants to test their business continuity and disaster recovery plans, the Commission believes that few require participation by all or designated members or participants in such testing. In addition, the Commission understands that, to the extent such participation occurs, it may in many cases be limited in nature (e.g., testing for connectivity to backup systems). Finally, while the securities industry does coordinate certain testing, the Commission believes that the two-day closure of the equities and options markets in the wake of Superstorm Sandy has shown that more significant testing and better coordination of such testing could benefit market participants.

Proposed Rules 1000(c) and (e) relate to the recordkeeping requirements under proposed Regulation SCI. As discussed above, SCI SROs already are subject to recordkeeping requirements that would apply to all documents relating to their compliance with proposed Regulation SCI. Further, entities that participate in the ARP Inspection Program currently keep records related to the ARP Inspection Program, and the Commission recognizes that all SCI entities are subject to some recordkeeping requirement. Nevertheless, with respect to SCI entities other than SCI SROs, proposed Rules 1000(c) and (e) would impose specific recordkeeping requirements with respect to documents related to compliance with Regulation SCI and thus would impose a burden on such entities.

Lastly, proposed Rule 1000(f) would require SCI entities to provide Commission representatives reasonable access to its SCI systems and SCI security systems to allow Commission representatives to assess the entity's compliance with proposed Regulation SCI. As discussed above, although the Commission believes that Section 17(b) of the Exchange Act already provides the Commission with authority to access the systems of SCI entities, the Commission is proposing Rule 1000(f) to highlight such authority and help ensure that Commission representatives have ready access to systems of SCI entities.

C. Consideration of Costs and Benefits, and the Effect on Efficiency, Competition, and Capital Formation

Section 3(f) of the Exchange Act requires the Commission, whenever it engages in rulemaking pursuant to the Exchange Act and is required to consider or determine whether an action is necessary or appropriate in the public interest, to consider, in addition to the protection of investors, whether the action would promote efficiency, competition, and capital formation. In addition, Section 23(a)(2) of the Exchange Act requires the Commission, when making rules under the Exchange Act, to consider the impact such rules would have on competition. Exchange Act Section 23(a)(2) prohibits the Commission from adopting any rule that would impose a burden on competition not necessary or appropriate in furtherance of the purposes of the Exchange Act. In considering these matters, the Commission has been mindful of the history and background discussed above and has considered the impact proposed Regulation SCI would have on competition, and preliminarily believes that proposed Regulation SCI would promote efficiency, competition, and capital formation, and would not impose a burden on competition not necessary or appropriate in furtherance of the purposes of the Exchange Act.

1. Summary of Benefits, Costs and Quantification

While the current practices of some SCI entities already satisfy some of the requirements of proposed Regulation SCI, the Commission preliminarily believes proposed Regulation SCI could benefit the U.S. financial markets in several ways. The Commission preliminarily believes that Regulation SCI should result in fewer systems disruptions, systems compliance issues, and systems intrusions. It should also increase the information available to the Commission regarding any systems disruptions, systems compliance issues, and systems intrusions that do occur. In addition, it should increase the information available to members or participants of SCI entities regarding dissemination SCI events. As explained further below, such disseminations of information could promote the ability of market participants to assess the operation of markets because events would be more transparent. The changes also could reduce market participants' search costs, ultimately improving the ability of competition to discourage SCI events and potentially improving the allocative efficiency of capital. To the extent that Regulation SCI promotes the allocation of capital to its most efficient uses, the Commission preliminarily believes that Regulation SCI may promote capital formation. The potential economic costs of proposed Regulation SCI include compliance costs, which the Commission attempts to quantify, and other costs. Such other costs include costs associated with the increase in costs and time needed to make systems changes to comply with new and amended rules and regulations, the impact on innovation, and barriers to entry.

The Commission discusses below a number of costs and benefits that are related to proposed Regulation SCI. Many of these costs and benefits are difficult to quantify with any degree of certainty, especially as the practices of market participants are expected to evolve and appropriately adapt to changes in technology and market developments. In addition, the extent to which the proposed rule's standards and the ability to enforce such standards will help reduce the frequency and severity of SCI events is unknown. Therefore, much of the discussion is qualitative in nature but, where possible, the Commission quantifies the costs.

Many, but not all, of the costs of the proposed rules involve a collection of information, and these costs and burdens are discussed in the Paperwork Reduction Act Section above. When monetized, those estimated burdens and costs for SCI entities total approximately $44 million in initial costs and approximately $37 million in annual ongoing costs. In addition, in the Economic Cost Section below, the Commission has quantified other costs for SCI entities that total between approximately $17.6 million and $132 million in initial costs and between $11.7 million and $88 million in annual ongoing costs. When aggregated, the total quantified costs for SCI entities are estimated as between approximately $61.6 million and $176 million in initial costs and between $48.7 million and $125 million in annual ongoing costs. In addition to the costs to SCI entities, the Commission also preliminarily estimates the total costs to members or participants of SCI entities to participate in the business continuity and disaster recovery plans testing specified by proposed Rule 1000(b)(9) to be $66 million annually. Thus, the total quantified costs for SCI entities and members or participants of SCI entities are estimated as between approximately $127.6 million and $242 million in initial costs and between $114.7 million and $191 million in annual ongoing costs. A detailed discussion of other potential economic costs of the proposal, such as potential costs to the Commission and potential burdens on competition, is provided below.

2. Economic Benefits

Broadly, although the current practices of some SCI entities already satisfy some of the requirements of proposed Regulation SCI, the Commission preliminarily believes that proposed Regulation SCI would bring several overarching benefits to the securities markets. First and most significantly, the Commission preliminarily believes that proposed Regulation SCI would promote more robust systems and hence fewer systems disruptions and market-wide closures, systems compliance issues, and systems intrusions. As a result, the Commission expects fewer interruptions to SCI systems, including systems that directly support execution facilities, matching engines, and the dissemination of market data, and fewer errors with the pricing of securities, which should promote price efficiency. The Commission also expects fewer interruptions to other SCI systems, including systems that directly support regulatory systems and surveillance systems, which should help ensure compliance with relevant laws and rules. In addition, the Commission would expect fewer interruptions to SCI security systems, which should help prevent problems that could lead to disruption of an SCI entity's general operations and, ultimately, its market-related activities.

Second, the Commission preliminarily believes that proposed Regulation SCI would enhance the availability of relevant information to members or participants of SCI entities and promote dissemination of information to persons (i.e., members or participants of SCI entities) who are most directly affected by dissemination SCI events and who would most naturally need, want, and be able to act on the information. The increased availability of information regarding SCI events should reduce the costs to members or participants of SCI entities when evaluating SCI entities and improve their ability to make more informed decisions about whether or not to avoid dealing with entities that experience significant systems issues. This enhanced information, as well as the improved price efficiency, should lead to greater allocative efficiency of capital. Moreover, it is expected that the increased awareness of dissemination SCI events would enhance competition among SCI entities with respect to the maintenance of robust systems.

Third, the Commission preliminarily believes that fewer market-wide, unscheduled shutdowns would have many of the same benefits as avoidance of temporary shutdowns, but on a greater scale. Fourth, the Commission preliminarily believes that its own ability to monitor the markets and ensure their smooth functioning would be significantly enhanced by proposed Regulation SCI. These potential benefits are discussed in more detail below in relation to each of the proposed rules.

a. Rule 1000(a) Definitions

In general, the definitions in Rule 1000(a) either clarify a provision or circumscribe the scope of a provision in proposed Regulation SCI. Therefore, many of the costs and benefits associated with the impacts of the definitions are incorporated in the discussion below on the costs and benefits of the substantive provisions where the definitions are used.

This section contains a discussion of the benefits of the expansion in scope that are not discussed above. In summary, the Commission preliminarily believes that the proposed definition of “SCI entity” and “SCI event,” although they would broaden the scope of Regulation SCI beyond the scope of the ARP Inspection Program, are essential parts of proposed Regulation SCI.

i. SCI Entities

As explained above, the difference between the entities that currently participate in the ARP Inspection Program and the entities covered by proposed Regulation SCI is the inclusion of additional ATSs and the MSRB. Because no ATSs currently meet the thresholds specified in Rule 301(b)(6) of Regulation ATS, other than the one ATS that currently participates in the ARP Inspection Program, none are subject to the systems safeguard requirements under that rule even though they comprise a significant portion of consolidated volume. The Commission preliminarily believes that the inclusion of SCI ATSs under proposed Regulation SCI would help ensure that ATSs, which serve as markets to bring buyers and sellers together in the national market system, are subject to rules regarding systems capacity, integrity, resiliency, availability, security, and compliance, including those rules that could help prevent SCI events and that require Commission reporting and the dissemination of information to members or participants of SCI entities. The Commission preliminarily believes that the inclusion of the MSRB in proposed Regulation SCI would provide benefits to the market because, as noted above, the MSRB is the only SRO relating to municipal securities and the sole provider of consolidated market data for the municipal securities market.

ii. Systems and SCI Events

As stated above, proposed Regulation SCI would expand on current practice, would apply a broader range of systems, and would include more event types. Specifically, entities that participate in the ARP Inspection Program follow the ARP policy statements with respect to systems that directly support trading, clearance and settlement, order routing, and market data. The proposed definition of “SCI systems” would include the foregoing systems as well as those that directly support regulation and surveillance. The Commission preliminarily believes that including regulation and surveillance systems could help ensure the SCI entity's ability to monitor its compliance with relevant laws, rules, and its own rules, and detect any violations of such laws or rules. Further, the provisions of proposed Regulation SCI regarding systems security and intrusions also would apply to “SCI security systems.” Because SCI security systems may present potentially vulnerable entry points to an SCI entity's network, the Commission also preliminarily believes that it is important for proposed Regulation SCI to include those systems with respect to security standards and systems intrusions.

By defining SCI events to include systems disruptions, systems compliance issues, and systems intrusions, proposed Regulation SCI would further assist the Commission in its oversight of SCI entities. As stated above, SCI entities already follow practices similar to parts of proposed Regulation SCI for certain systems disruptions and systems intrusions. The inclusion of systems compliance issues should help the Commission and market participants to become better informed of the efforts of the SCI entities to comply with relevant laws and rules, and their own rules as applicable, and could enhance the enforcement of such laws and rules. Further, by defining a dissemination SCI event to include a subset of SCI events (i.e., a systems compliance issue, systems intrusion, or systems disruption that would result, or the SCI entity reasonably estimates would result in significant harm or loss to market participants), proposed Regulation SCI would further assist SCI entity members or participants in their decisions regarding whether or not to utilize the systems of a given SCI entity.

b. Rule 1000(b)(1)-(10) Requirements for SCI Entities

The development and growth of automated electronic trading have allowed increasing volumes of securities transactions across the multitude of trading centers that constitute the U.S. national market system. These securities transactions take place within an interconnected market where systems disruptions, systems compliance issues, and systems intrusions at one market center can impact or harm trading throughout the entire national market system. Thus, there is a need for operators of significant market systems, such as SCI entities, to have in place robust systems to prevent systems issues or, in the event that systems issues occur, to recover quickly.

Proposed Rule 1000(b)(1)-(2) would set forth requirements relating to written policies and procedures that SCI entities would be required to establish, maintain, and enforce. Proposed Rule 1000(b)(1) would require an SCI entity to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, SCI security systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.

The rule would further provide that an SCI entity's policies and procedures must include the establishment of reasonable current and future capacity planning estimates, periodic capacity stress tests, a program to review and keep current systems development and testing methodology of such systems, regular reviews and testing of such systems, including backup systems, business continuity and disaster recovery plans, and standards that result in such systems facilitating the successful collection, processing, and dissemination of market data. As discussed above, the Commission regards SCI entities as part of the critical infrastructure of the U.S. securities markets and therefore, although proposed Rule 1000(b)(1)(i)(A)-(E) would codify certain provisions of the ARP policy statements, the Commission preliminarily believes that specifically setting forth these requirements in a Commission rule would benefit the securities markets by helping to diminish the risks and incidences of systems intrusions, systems compliance issues, and systems disruptions. Such policies and procedures should also assist in speedy recoveries from systems intrusions, systems compliance issues, and systems disruptions. Proposed Rule 1000(b)(1)(i)(F) does not have precedent in Regulation ATS or the ARP policy statements, and would require SCI entities to have standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data. The Commission preliminarily believes that this proposal should help to ensure that timely and accurate market data is available to all market participants.

Proposed Rule 1000(b)(1)(ii) would deem an SCI entity's policies and procedures required by proposed Rule 1000(b)(1) to be reasonably designed if they are consistent with current SCI industry standards. Thus, the SCI industry standards would provide flexibility to allow each SCI entity to determine how to best meet the requirements in proposed Rule 1000(b)(1), taking into account, for example, its nature, size, technology, business model, and other aspects of its business, because compliance with SCI industry standards would not be the exclusive means by which an SCI entity could satisfy the requirements of proposed Rule 1000(b)(1).

Proposed Rule 1000(b)(2)(i), which would require written policies and procedures reasonably designed to ensure that an SCI entity's SCI systems operate in the manner intended, should help to minimize instances where systems do not operate in compliance with the federal securities laws and rules and regulations thereunder and, as applicable, the entity's rules and governing documents. In particular, the elements of the safe harbor for SCI entities in proposed Rule 1000(b)(2)(ii)(A) relating to policies and procedures on testing and monitoring also should help to ensure, on an ongoing basis, that an SCI entity's SCI systems operate in the manner intended, including in a manner that complies with the federal securities laws and rules and regulations thereunder and, as applicable, the entity's rules and governing documents, thus minimizing systems compliance issues and consequently the total time needed to bring a system back into compliance. In addition, the elements of the safe harbor in proposed Rule 1000(b)(2)(ii)(A) relating to policies and procedures for systems compliance assessments by personnel familiar with applicable laws and rules and systems reviews by regulatory personnel should help ensure the performance of effective compliance audits and reviews, and should help provide assurance that SCI entities are operating in compliance with applicable laws and rules.

Proposed Rule 1000(b)(3), which would require an SCI entity to begin taking appropriate corrective action upon any responsible SCI personnel becoming aware of an SCI event, should further help ensure that SCI entities invest sufficient resources as soon as reasonably practicable to address systems intrusions, systems compliance issues, and systems disruptions.

Moreover, proposed Rules 1000(b)(1)-(3) should improve price efficiency by reducing the likelihood and duration of systems issues, thereby helping to avoid the price inefficiencies that occur during times when systems disruptions, systems compliance issues, or systems intrusions can make systems unavailable or unreliable. Specifically, systems issues that could impact the accuracy or the timeliness, and thus the reliability, of market data could lead to inaccuracies in pricing and slow-down pricing, and make data less reliable. Therefore, to the extent that proposed Rules 1000(b)(1)-(3) could reduce the likelihood or duration of systems issues, they may lead to more reliable market data (because there would be less inaccuracies and the market data would be more timely), which could help improve the quality of market data. This, in turn, could enhance price efficiency in the market for market data, which then could promote allocative efficiency of capital and capital formation.

Proposed Regulation SCI is intended, in part, to facilitate the Commission's ability to monitor the impact on the securities markets by SCI entities' systems that support the performance of the entities' activities. The Commission preliminarily believes that proposed Rules 1000(b)(1)-(3), as well as 1000(b)(4), would provide for more effective Commission oversight of the operation of the systems of SCI entities.

Specifically, while entities that participate in the ARP Inspection Program already notify Commission staff of certain systems issues, the Commission preliminarily believes that proposed Rule 1000(b)(4), relating to Commission notification of SCI events, should further enhance the effectiveness of Commission oversight of the operation of SCI entities. Under the proposed rule, upon any responsible SCI personnel becoming aware of an immediate notification SCI event, an SCI entity would be required to notify the Commission of the SCI event. Within 24 hours of any responsible SCI personnel becoming aware of an SCI event, an SCI entity would be required to submit a written notification pertaining to such SCI event on Form SCI. Until such time as the SCI event is resolved, the SCI entity would be required to provide updates regularly, or at such frequency as requested by an authorized representative of the Commission. Although this process would represent costs to an SCI entity, the documentation of SCI events will help prevent such systems failures from being dismissed or ignored as glitches or momentary issues because it would focus the SCI entity's attention on the issue and encourage allocation of SCI entity resources to resolve the issue as soon as reasonably practicable.

As noted above, the Commission is concerned that members or participants of SCI entities may be unaware of the occurrence of some SCI events, and therefore may make decisions without all relevant information. Proposed Rule 1000(b)(5) would require an SCI entity, upon any responsible SCI personnel becoming aware of a dissemination SCI event other than a systems intrusion, to disseminate certain information regarding the dissemination SCI event to its members or participants. Such information would include the systems affected by the event and a summary description of the event. When known, the SCI entity would be required to further disseminate to its members or participants: a detailed description of the SCI event; its current assessment of the types and number of market participants potentially affected by the SCI event; and a description of the progress of its corrective action for the SCI event and when the SCI event has been or is expected to be resolved. An SCI entity also would be required to provide regular updates to members or participants regarding the disseminated information. The Commission preliminarily believes that proposed Rule 1000(b)(5) would help market participants—specifically the members or participants of SCI entities—to better evaluate the operations of SCI entities based on more readily available information.

As discussed above, the Commission believes that the existing competition among the markets has not sufficiently mitigated the occurrence of certain systems problems, and thus preliminarily believes that requiring the dissemination of information about certain SCI events, as described above, to members or participants could potentially further incentivize SCI entities to create more robust systems. In addition, targeting this set of market participants (i.e., an SCI entity's members or participants) to receive information about dissemination SCI events has the benefit of providing the information to those that are most likely to need, want, and act on the information, without imposing the additional costs associated with requiring broader public dissemination. Moreover, another benefit of increased dissemination of information about dissemination SCI events to SCI entity members or participants would be the resultant reduction in search costs for market participants when they are gathering information to make a determination with respect to the use of an entity's services. Also, proposed Rule 1000(b)(5) would require SCI entities to disseminate specified information for dissemination SCI events, which would allow market participants to more easily compare the available information from all SCI entities for which they are members or participants. The foregoing benefits would be further enhanced to the extent information relating to dissemination SCI events is shared by members or participants of SCI entities with other market participants. Lastly, because an SCI entity would be permitted to delay dissemination of information regarding a systems intrusion to members or participants if it determines that such information would likely compromise the security of its SCI systems or SCI security systems, or an investigation of the systems intrusion, proposed Rule 1000(b)(5) would not undermine the need to maintain the non-public nature of certain systems intrusions for a temporary period (until the SCI entity determines that dissemination of such information would not likely compromise the security of the SCI entity's SCI systems or SCI security systems, or an investigation of the systems intrusion).

In summary, because proposed Regulation SCI would, among other things, require SCI entities to provide members and participants with more information regarding their operations, the Commission preliminarily believes that SCI entities would have additional incentives to establish and maintain more robust automated systems to minimize the occurrence of SCI events. Fewer systems issues could improve pricing efficiency which, in turn, could promote allocative efficiency of capital and thus, capital formation.

In addition to the Commission notification requirements under proposed Rule 1000(b)(4), the Commission preliminarily believes that proposed Rule 1000(b)(6) would enhance the Commission's oversight of the operation of SCI entities, even though entities participating in the ARP Inspection Program may already provide these types of notifications to Commission staff. Proposed Rule 1000(b)(6) would require an SCI entity to notify the Commission on Form SCI of material systems changes at least 30 calendar days before the implementation of any planned material systems change. In the case of exigent circumstances, or if the information previously provided regarding a planned material systems change becomes materially inaccurate, proposed Rule 1000(b)(6) would require oral or written notification as early as reasonably practicable. Any oral notification of planned material systems change must be memorialized within 24 hours by a written notification on Form SCI. The Commission preliminarily believes that this provision would provide the Commission and its staff advance notice and time to evaluate planned material systems changes by SCI entities, thus improving the Commission's ability to oversee SCI entities.

Proposed Rule 1000(b)(7) would require an SCI entity to conduct an SCI review of its compliance with Regulation SCI not less than once each calendar year, and submit a report of the SCI review to senior management of the SCI entity for review no more than 30 calendar days after completion of such SCI review. The Commission preliminarily believes that the proposal to require SCI entities to conduct an objective assessment of their systems at least annually would result in SCI entities having an improved awareness of the relative strengths and weaknesses of their systems independent of the assessment of ARP staff, which should in turn improve the value and efficiency of an ARP inspection.

Proposed Rule 1000(b)(8) would require each SCI entity to submit certain periodic reports to the Commission through Form SCI, including annual reports on the SCI reviews of its compliance with Regulation SCI and semi-annual reports on the progress of material systems changes. These reports should keep the Commission informed, on an ongoing basis, by providing information with which the Commission could evaluate each SCI entity's compliance with Regulation SCI and the progress of its material systems changes.

The Commission preliminarily believes that proposed Rules 1000(b)(1)-(8), taken together, should result in actual systems improvements as well as enhanced availability of relevant information regarding SCI events to the Commission and members or participants of SCI entities. This, in turn, could facilitate better decisions by market participants, which could promote allocative efficiency of capital and capital formation, potentially providing an overall benefit to the securities markets and promoting the protection of investors and the public interest. Additionally, the means by which trading is conducted may be altered as a result of Regulation SCI. For example, if an SCI entity member or participant submits orders to a particular market for execution, and subsequently learns that the execution venue's systems in use may be prone to failure, such member or participant may choose to favor another market in the future. This change would potentially enhance competition as SCI entity members or participants rely on information disseminated regarding dissemination SCI events to make more informed choices about the best venue for execution.

Proposed Rule 1000(b)(9)(i) would require an SCI entity, with respect to its business continuity and disaster recovery plans, including its backup systems, to require participation by designated members or participants in scheduled functional and performance testing of the operation of such plans, in the manner and frequency as specified by the SCI entity, at least once every 12 months. Proposed Rule 1000(b)(9)(ii) would further require an SCI entity to coordinate such testing on an industry- or sector-wide basis with other SCI entities. The Commission expects that this proposed requirement should help ensure that the securities markets will have improved backup infrastructure and fewer market-wide shutdowns, thus helping SCI entities and other market participants to avoid lost revenues and profits that would otherwise result from such shutdowns. Further, the notifications required by proposed Rule 1000(b)(9)(iii) should keep the Commission informed, on an ongoing basis, of an SCI entity's current standards for designating members or participants and current list of designees.

c. Rule 1000(c)-(f)—Recordkeeping, Electronic Filing, and Access

While all SCI entities already are subject to some recordkeeping and access requirements, the Commission preliminarily believes the proposed recordkeeping and access requirements specifically related to proposed Regulation SCI would enhance the ability of the Commission to evaluate SCI entities' compliance. Specifically, proposed Rule 1000(c) would require each SCI entity, other than an SCI SRO, to make, keep, and preserve at least one copy of all documents and records relating to its compliance with Regulation SCI for a period of not less than five years. Each SCI entity also would be required to furnish such documents to Commission representatives upon request. Further, according to proposed Rule 1000(e), if the records required to be filed or kept by an SCI entity under proposed Regulation SCI are prepared or maintained by a service bureau or other recordkeeping service on behalf of the SCI entity, the SCI entity must ensure that such records are available to review by the Commission and its representatives by submitting a written undertaking by such service bureau or recordkeeping service to that effect. The Commission preliminarily believes that these proposed rules should allow Commission staff to perform efficient inspections and examinations of SCI entities for their compliance with the proposed rules, and should increase the likelihood that Commission staff may identify conduct inconsistent with the proposed rules at earlier stages in the inspection and examination process.

Proposed Rule 1000(d) would require SCI entities to electronically submit all written information to the Commission through Form SCI (except any written notification submitted pursuant to proposed Rule 1000(b)(4)(i)). The Commission preliminarily believes that this provision would allow the Commission to receive information in a uniform electronic format with specified content, which would enhance Commission staff's ability to review and analyze submitted information.

Finally, proposed Rule 1000(f) would require each SCI entity to give Commission representatives reasonable access to its SCI systems and SCI security systems to allow Commission representatives to assess its compliance with proposed Regulation SCI. The Commission preliminarily believes that this provision would enhance Commission oversight by specifically highlighting the Commission's authority to have its representatives directly access and examine SCI entities' systems to confirm their compliance with proposed Regulation SCI.

The Commission preliminarily believes that these requirements would place the Commission in a stronger position to assess the risks relating to SCI entities' systems and, thus, would provide the Commission with greater ability to protect investors. The Commission also preliminarily believes that its oversight should help ensure that SCI entities are reasonably equipped to handle market demand and provide liquidity, including during periods of market distress.

3. Economic Costs

a. Direct Compliance Costs

The Commission recognizes that proposed Regulation SCI would impose costs on SCI entities, as well as costs on certain members or participants of SCI entities. The Commission preliminarily believes that the majority of these costs would be direct compliance costs. SCI entities would incur costs in establishing, maintaining, and enforcing policies and procedures related to systems capacity, integrity, resiliency, availability, security, and compliance. SCI entities also would incur costs in taking appropriate corrective actions upon any responsible SCI personnel becoming aware of an SCI event, notifying and updating the Commission with respect to the occurrence of SCI events, disseminating information to members or participants regarding dissemination SCI events, notifying the Commission of material systems changes, conducting SCI reviews, submitting to the Commission periodic reports, requiring designated members to participate in testing of business continuity and disaster recovery plans and coordinating such testing, and complying with recordkeeping and access requirements.

As stated above in Section IV.D, proposed Regulation SCI would codify many of the ARP policy statement principles familiar and applicable to current participants in the ARP Inspection Program. The Commission recognizes, however, that the proposed rules would apply to entities that are not currently covered by the ARP Inspection Program, and would cover areas not currently within the scope of the ARP Inspection Program. Thus, those costs are incremental relative to the current compliance cost of the ARP Inspection Program.

While proposed Regulation SCI would codify the provisions of the ARP policy statements, the proposed definitions of “SCI entity,” “SCI event,” “SCI systems,” and “SCI security systems” are broader than the entities, events, and systems covered by the ARP Inspection Program and, as stated above, will include more entities, events, and systems. Specifically, proposed Rule 1000(b)(1)(i) would codify aspects of the ARP policy statements with the exception of Rule 1000(b)(1)(i)(F), which would require policies and procedures regarding standards that result in systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data. In addition, because the ARP policy statements provide that SROs should promptly notify Commission staff of certain system outages and any instances in which unauthorized persons gained or attempted to gain access to their systems, proposed Rule 1000(b)(4), among other things, would codify parts of the ARP policy statements. Further, because the ARP policy statements provide that SROs should notify Commission staff of certain changes to their automated systems, proposed Rule 1000(b)(6) would codify a part of the ARP policy statements. Lastly, because the ARP policy statements provide that SROs should undertake reviews of their systems, proposed Rule 1000(b)(7), among other things, would reflect this part of the ARP policy statements. With respect to the proposed requirements that are not currently covered by the ARP Inspection Program, they include: policies and procedures in addition to those required by proposed Rule 1000(b)(1)(i)(A)-(E) that would be necessary to achieve policies and procedures reasonably designed to ensure that systems of an SCI entity have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets; policies and procedures reasonably designed to ensure the operation of SCI systems in the manner intended; the initiation of appropriate corrective actions upon any responsible SCI personnel becoming aware of an SCI event; the dissemination of information to members or participants; requirements regarding member or participant testing; and recordkeeping and access with respect to Regulation SCI-related documents.

Many of these incremental costs are calculated in detail in the Paperwork Reduction Act Section above, which estimates that the total one-time initial burden for all SCI entities to comply with Regulation SCI would be approximately 133,482 hours and $2.6 million, and that the total annual ongoing burden for all SCI entities to comply with Regulation SCI would be approximately 117,258 hours and $738,400.

In addition to the direct cost estimates derived from the Paperwork Reduction Act burdens, the Commission preliminarily believes that SCI entities could incur costs when enforcing the policies and procedures required under proposed Rules 1000(b)(1) and (2), taking corrective action to mitigate the potential harm resulting from an SCI event under proposed Rule 1000(b)(3), and in determining whether an SCI event is an immediate notification SCI event or meets the definition of a dissemination SCI event under proposed Rule 1000(a).

As discussed in detail in Section III.C.1 above, proposed Rule 1000(b)(1) would require SCI entities to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that their SCI systems and, for purposes of security standards, SCI security systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets. In addition to the burden of establishing and maintaining such policies and procedures as set forth in the Paperwork Reduction Act Section above, the Commission preliminarily believes that SCI entities would incur costs in enforcing the substantive requirements that are the subject of the policies and procedures.

Further, as discussed in detail in Section III.C.2 above, proposed Rule 1000(b)(2) would require SCI entities to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that their SCI systems operate in the manner intended, including in a manner that complies with federal securities laws and rules and regulations thereunder and the entity's rules and governing documents, as applicable. In addition to the burden of establishing and maintaining such policies and procedures as set forth in the Paperwork Reduction Act Section above, the Commission preliminarily believes that SCI entities would incur costs in enforcing the substantive requirements that are the subject of the policies and procedures.

As noted above, NIST is an agency within the U.S. Department of Commerce that has issued numerous special publications regarding information technology systems. For example, one of the publications listed in Table A is the NIST Draft Security and Privacy Controls for Federal Information Systems and Organizations (Special Publication 800-53 Rev. 4) (February 2012) (“NIST 800-53”). This publication is a security controls catalog providing guidance for selecting and specifying security controls for federal information systems and organizations. NIST 800-53 addresses how federal entities should achieve secure information systems, taking into account the fundamental elements of: (i) Multitiered risk management; (ii) the structure and organization of controls; (iii) security control baselines; (iv) the use of common controls and inheritance of security capabilities; (v) external environments and service providers; (vi) assurance and trustworthiness; and (vii) revisions and extensions to security controls and control baselines, among others. Although NIST 800-53 sets forth standards for federal agencies, it is also intended to serve a diverse audience of information system and information security professionals, including those having information system, security, and/or risk management and oversight responsibilities, information system development responsibilities, information security implementation and operational responsibilities, information security assessment and monitoring responsibilities, as well as commercial companies producing information technology products, systems, security-related technologies, and security services.

The Commission preliminarily believes that many SCI entities will choose to establish, maintain, and enforce policies and procedures that are consistent with the proposed SCI industry standards contained in the publications set forth in Table A for purposes of satisfying the requirements of proposed Rule 1000(b)(1). However, as noted above, compliance with the identified SCI industry standards would not be the exclusive means to comply with the requirements of proposed Rule 1000(b)(1). The Commission understands that the Table A publications, including NIST 800-53, are familiar to information technology personnel employed by many SCI entities, and that some SCI entities, particularly the SCI SROs and plan processors that participate in the ARP Inspection Program, currently adhere to all or at least some of the standards in NIST 800-53, or similar standards set forth in publications issued by other standards setting bodies, with some entities fully or nearly fully implementing such standards, while other entities may not have implemented such standards as broadly. For SCI entities that are not part of the ARP Inspection Program, while such entities may be familiar with such publications and standards generally, the Commission is not certain as to the level of compliance with such standards, and believes that there may be some such entities that are fully or nearly fully complaint, while others may have little or no compliance with such standards.

With respect to the substantive systems requirements resulting from adherence to SCI industry standards (which, solely for purposes of this Economic Analysis Section, the Commission assumes to be the proposed SCI industry standards contained in the publications identified in Table A, or publications setting forth substantially similar standards) underlying proposed Rule 1000(b)(1), as noted above, the Commission believes that certain entities that would satisfy the definition of SCI entity, particularly some that currently participate in the ARP Inspection Program, already comply with some of the requirements. On the other hand, the Commission believes that some SCI entities, including some that currently participate in the ARP Inspection Program, do not currently comply with some or all of the proposed requirements. Further, although the Commission believes that each SCI entity would incur costs in complying with these requirements, the Commission believes that some entities already comply with SCI industry standards with respect to some of their systems. Moreover, the Commission acknowledges that certain SCI entities are larger or more complex than others, and that proposed Rule 1000(b)(1) would impose higher costs on larger and more complex systems.

Because the Commission does not at this time have sufficient information to reasonably estimate each SCI entity's current level of compliance with the proposed SCI industry standards contained in the publications set forth in Table A, the Commission estimates a range of average costs for each SCI entity to comply with such standards. The Commission acknowledges that some SCI entities would incur costs near the bottom of the range because their systems policies and procedures currently meet SCI industry standards (which, as noted above, solely for purposes of this Economic Analysis Section, the Commission assumes to be the proposed SCI industry standards contained in the publications identified in Table A or in substantially similar publications). On the other hand, some SCI entities would incur costs near the middle or top of the range because their systems policies and procedures do not currently meet such standards. Because the Commission lacks sufficient information regarding the current practices of all SCI entities, the Commission seeks comment on the extent to which SCI entities already have in place systems policies and procedures that would meet the proposed SCI industry standards (which, solely for purposes of this Economic Analysis Section, the Commission assumes to be the proposed SCI industry standards contained in the publications identified in Table A or in substantially similar publications).

Further, unlike the Paperwork Reduction Act Section where the Commission estimates a fifty-percent baseline with respect to proposed Rule 1000(b)(1)(i)(A)-(E) for entities that currently participate in the ARP Inspection Program, the Commission preliminarily estimates the same cost range for all SCI entities for compliance with the proposed substantive requirements that are the subject of the policies and procedures. On the one hand, the Commission believes that certain SCI entities (in particular, some entities that participate in the ARP Inspection Program) may already comply with some of the substantive requirements and thus would incur less incremental cost for complying with such requirements. On the other hand, the Commission believes that some SCI entities that currently participate in the ARP Inspection Program are larger and have more complex systems than those that do not participate in the ARP Inspection Program and, therefore, would incur more incremental cost for complying with the substantive requirements. As such, the Commission preliminarily believes it is unlikely that SCI entities that do not participate in the ARP Inspection Program would incur twice the cost as SCI entities that participate in the ARP Inspection Program to comply with the substantive systems requirements underlying the policies and procedures required by proposed Regulation SCI.

Based on discussion with industry participants, the Commission preliminarily estimates that, to comply with the substantive requirements that are the subject of the policies and procedures required by proposed Rules 1000(b)(1) and (2), including consistency with the SCI industry standards (which, solely for purposes of this Economic Analysis, the Commission assumes to be the proposed SCI industry standards contained in the publications identified in Table A or in substantially similar publications) in connection with proposed Rule 1000(b)(1), on average, each SCI entity would incur an initial cost of between approximately $400,000 and $3 million. Based on this average, the Commission preliminarily estimates that SCI entities would incur a total initial cost of between approximately $17.6 million and $132 million. The Commission seeks comment on the estimated average initial cost range for SCI entities to comply with the substantive requirements underlying the policies and procedures required by proposed Rules 1000(b)(1) and (2).

The preliminary cost estimates described above represent an estimated average cost range per SCI entity, and the Commission acknowledges that some of the costs to comply with the substantive requirements of proposed Rules 1000(b)(1) and (2) may be significantly higher than the estimated average for some SCI entities, while some of the costs may be significantly lower for other SCI entities. In particular, the Commission preliminarily believes that the costs associated with the requirement in proposed Rule 1000(b)(1)(i)(E) that an SCI entity have policies and procedures that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse to ensure next business day resumption of trading and two-hour resumption of clearance and settlement services following a wide-scale disruption is an area in which different SCI entities may encounter significantly different compliance costs. For example, among national securities exchanges, the Commission understands that many, though not all, national securities exchanges already have or soon expect to have backup facilities that do not rely on the same infrastructure components used by their primary facility. For those national securities exchanges that do not have such backup facilities, the cost to build and maintain such facilities may result in their compliance costs being significantly higher than those of national securities exchanges that already satisfy the proposed requirement. The application of the geographic diversity requirement to other entities, such as ATSs, under the proposed rule, would depend on the nature, size, technology, business model, and other aspects of their business.

218. The Commission requests commenters' views on how many SCI entities would not currently satisfy the proposed requirement relating to geographic diversity of backup sites. The Commission requests commenters' views on the costs of establishing backup sites to satisfy the proposed geographic diversity requirement, particularly for entities that currently would not satisfy the proposed requirement. In such a case, given the likely significant cost and time associated with building such backup sites, how long do commenters believe it would take for SCI entities to come into compliance with such a proposed requirement? Would it be appropriate for the Commission to allow an extended period prior to which compliance with this proposed requirement would be effective? Why or why not? If so, how long should such period be and why? Should such an extended period only be permitted for a subset of SCI entities. If so, how should such a subset be determined? Please describe.

As noted above, because the Commission does not at this time have sufficient information to reasonably estimate each SCI entity's current level of compliance with the substantive requirements underlying the policies and procedures, the Commission preliminarily estimates a range of average initial costs for each SCI entity to comply with the substantive requirements underlying the policies and procedures required by proposed Rules 1000(b)(1) and (2). Based on the estimates of the initial costs, Commission estimates a range of average ongoing cost for each SCI entity to comply with the requirements using two-thirds of the initial cost. The Commission preliminarily believes that a two-thirds estimate is appropriate because although proposed Rules 1000(b)(1) and (2) would require SCI entities to comply with certain systems requirements including, for example, establishing reasonable current and future capacity planning estimates on an ongoing basis, as well as conducting tests and reviews of their systems on an going basis, the Commission preliminarily believes that SCI entities would incur an additional initial cost to, for example, revise the underlying software code of their systems to the extent needed to bring those systems into compliance with the requirements of the proposed rules. Therefore, the Commission preliminarily estimates that, to comply with the substantive requirements that are the subject of the policies and procedures required by proposed Rules 1000(b)(1) and (2), including consistency with SCI industry standards in connection with proposed Rule 1000(b)(1), on average, each SCI entity would incur an ongoing annual cost of between approximately $267,000 and $2 million. Based on this estimated range, the Commission preliminarily estimates that SCI entities would incur a total ongoing cost of between approximately $11.7 million and $88 million. The Commission seeks comment on the estimated average ongoing cost range for SCI entities to comply with the substantive requirements underlying the policies and procedures required by proposed Rules 1000(b)(1) and (2).

The mandatory testing of SCI entity business continuity and disaster recovery plans, including backup systems, as proposed to be required under proposed Rule 1000(b)(9), would place an additional burden on SCI entities. The Commission believes that some SCI entities require some or all of their members or participants to connect to their backup systems and that most, if not all, SCI entities already offer their members or participants the opportunity to test such plans, although they do not currently mandate participation by all members or participants in such testing. In addition, market participants, including SCI entities, already coordinate certain business continuity plan testing to some extent. Thus, the Commission preliminarily believes that additional costs of proposed Rule 1000(b)(9) to SCI entities would be minimal. However, for SCI entity members or participants, additional costs could be significant, and highly variable depending on the business continuity and disaster recovery plans being tested. However, based on discussions with market participants, the Commission preliminarily estimates the cost of the testing of such plans to range from immaterial administrative costs (for SCI entity members and participants that currently maintain connections to SCI entity backup systems) to a range of $24,000 to $60,000 per year per member or participant in connection with each SCI entity. Costs at the higher end of this range would accrue for members or participants who would need to invest in additional infrastructure and to maintain connectivity with an SCI entity's backup systems in order to participate in testing. The Commission is unable at this time to provide a precise cost estimate for the total aggregate cost to SCI entity members and participants of the requirements relating to proposed Rule 1000(b)(9), as it does not know how each SCI entity will determine its standards for designating members or participants that it would require to participate in the testing required by proposed Rule 1000(b)(9)(i), and thus does not know the number of members or participants at each SCI entity that would be designated as required to participate in testing, and whether such designated members and participants are those that already maintain connections to SCI entity backup systems. However, the Commission preliminarily believes that an aggregate annual cost of approximately $66 million to designated members and participants is a reasonable estimate. The Commission requests comment on these estimates and the assumptions underlying them.

The Commission preliminarily believes that the corrective action to mitigate harm resulting from SCI events would impose modest incremental costs on SCI entities because in the usual course of business, SCI entities already take corrective actions in response to systems issues. Proposed Rule 1000(b)(3) supplements the existing incentives of SCI entities to correct an SCI event quickly by focusing on potential harm to investors and market integrity and by requiring SCI entities to devote adequate resources to begin to take corrective action as soon as reasonably practicable. Based on its experience with the ARP Inspection Program, the Commission believes that entities currently participating in the ARP Inspection Program already take corrective actions in response to a systems issue, and believes that other SCI entities also take corrective actions in response to a systems issue. Nevertheless, the Commission preliminarily believes that proposed Rule 1000(b)(3) could result in modestly increased costs for SCI entities per SCI event for corrective action relative to current practice for SCI entities, as a result of undertaking corrective action sooner than they might have otherwise and/or increasing investment in newer more updated systems earlier than they might have otherwise. If, however, proposed Regulation SCI reduces the frequency and severity of SCI events, the overall costs to SCI entities of corrective action may not increase significantly from the costs incurred without proposed Regulation SCI. However, the degree to which proposed Regulation SCI will reduce the frequency and severity of SCI events is unknown. Thus, the Commission is, at this time, unable to estimate the precise impact of proposed Regulation SCI due to an SCI entity's corrective action. Thus, the Commission requests comment regarding the costs associated with proposed Regulation SCI's corrective action requirements, including what such costs would be on an annualized basis.

When an SCI event occurs, an SCI entity needs to determine whether the event is an immediate notification SCI event or dissemination SCI event because the proposed rule would impose different obligations on SCI entities for such events. Identifying these types of SCI events may impose one-time implementation costs on SCI entities associated with developing a process for ensuring that they are able to quickly and correctly make such determinations, as well as periodic costs in reviewing the adopted process.

The Commission notes that proposed Rule 1000(d) would require that any written notification, review, description, analysis, or report to the Commission (except any written notification submitted pursuant to proposed Rule 1000(b)(4)(i)) be submitted electronically and contain an electronic signature. This proposed rule would require that every SCI entity have the ability to submit forms electronically with an electronic signature. The Commission believes that most, if not all, SCI entities currently have the ability to access and submit an electronic form such that the requirement to submit Form SCI electronically will not impose new implementation costs. The initial and ongoing costs associated with various electronic submissions of Form SCI are discussed in the Paperwork Reduction Act Section above.

The Commission recognizes that some of the costs imposed by proposed Regulation SCI may ultimately be transferred to intermediaries, such as market participants that access national securities exchanges or clearing agencies, for example, in the form of higher fees. The Commission recognizes that, if costs relating to compliance with proposed Regulation SCI are passed on in the form of increased prices to users of SCI entities, there may be a loss of efficiency as a result of the net increase in costs to SCI entity customers. The Commission also preliminarily believes that, for some SCI entities, the cost estimates may be lower than the actual costs to be incurred, such as for entities that are not currently part of the ARP Inspection Program or that have complex automated systems. However, on balance, the Commission preliminarily believes that the incremental direct cost estimates above are appropriate.

b. Other Costs

The Commission recognizes that proposed Regulation SCI could have other potential costs that cannot be quantified at this time. For example, entities covered by the proposed rule frequently make systems changes to comply with new and amended rules and regulations such as rules and regulations under federal securities laws and SRO rules. The Commission recognizes that, for entities that meet the definition of SCI entities, because they must continue to comply with proposed Regulation SCI when they make systems changes, proposed Regulation SCI could increase the costs and time needed to make systems changes to comply with new and amended rules and regulations. The Commission requests comment on the nature of such additional costs and time.

The Commission also considered whether proposed Regulation SCI would impact innovation in ATSs or raise barriers to entry. The Commission recognizes that, if proposed Regulation SCI were to cause SCI entities, including ATSs, to allocate resources towards ensuring they have robust systems and the personnel necessary to comply with proposed Regulation SCI's requirements and away from new features for their systems, or investing in research and development, proposed Regulation SCI may have a negative impact on innovation among such entities and thus impact competition. Similarly, if the costs of proposed Regulation SCI were to be viewed by persons considering forming new ATSs to be so onerous so as to dissuade them from starting new ATSs, competition would also be negatively impacted. To balance any concern about discouraging innovation and raising barriers to entry against the need for regulation, the Commission proposes thresholds for SCI ATSs that are designed to include only the ATSs that are most likely to have a significant impact on markets due to an SCI event, and requests comment on the thresholds. The tradeoffs associated with these thresholds are discussed in more detail below.

Finally, by specifying the timing, type, and format of information to be submitted to the Commission and by requiring electronic submission of Form SCI, Commission staff should be able to more efficiently review and analyze the information submitted. It is particularly important for the Commission to be able to review and analyze filings on Form SCI efficiently because proposed Regulation SCI would require all SCI events to be reported to the Commission. The Commission is not proposing at this time to require the data to be submitted in a tagged data format (e.g., XML, XBRL, or another structured data format that may be tagged), although it has requested specific comment as to whether it should, and the costs and benefits of doing so. The Commission recognizes that it could more readily analyze filings submitted in a tagged data format than in PDF format, and the subsequent potential benefits to investors may be greater. However, these benefits are balanced against the costs to the SCI entities of submitting filings in a tagged format.

c. Scaling

The Commission recognizes that the benefits of every provision of proposed Regulation SCI may not justify the costs of the provision if every requirement applied to every SCI entity and SCI event. In particular, the Commission recognizes that applying each requirement to every SCI entity and every SCI event could adversely affect competition and efficiency. Therefore, the Commission has proposed that not all SCI events be subject to the same requirements as immediate notification SCI events and dissemination SCI events and that ATSs that do not meet the definition of SCI ATS, and broker-dealers who are not ATSs, should not be subject to same requirements as SCI entities. The discussion that follows lays out the tradeoffs associated with determining the appropriate cutoffs for determining which events are immediate notification SCI events or dissemination SCI events, and which ATSs are SCI ATSs. In sum, the Commission believes that the requirements balance the need for regulation against the potential efficiency, competition, and capital formation concerns of the regulation. In the Commission's judgment, the cost of complying with the proposed rules would not be so large as to significantly raise barriers to entry or otherwise alter the competitive landscape of the entities involved.

As defined in proposed Rule 1000(a), a dissemination SCI event is an SCI event that is a: systems compliance issue; systems intrusion; or system disruption that results, or the SCI entity reasonably estimate would result, in a significant harm or loss to market participants. If the criteria for dissemination SCI events is set too low, the member or participant dissemination requirements under proposed Regulation SCI could be very costly. Therefore, the Commission carefully considered tradeoffs in defining the term dissemination SCI event. On the one hand, the definition should ensure that SCI events that have significant impacts on the markets are captured as dissemination SCI events. On the other hand, not every SCI event should be included. There are higher costs associated with dealing with dissemination SCI events as compared to SCI events that are not dissemination SCI events due to the additional requirements relating to dissemination of information to members or participants. Second, SCI entity members or participants may be provided with unnecessary information if information about too many SCI events that do not have significant impact on the markets is disseminated to members or participants. If there is excessive dissemination of insignificant events, truly important events may get hidden among others that do not have the same degree of significance or impact on the securities markets. SCI entity members or participants also may not pay attention to disseminated SCI events if an excessive number of insignificant events are disseminated and notifications about SCI events may become routine. The proposed definition of dissemination SCI event is an attempt to balance these concerns.

Section III.B.1 discusses the definition of “SCI ATS” in proposed Rule 1000(a). The proposal would replace the threshold for NMS stocks of 20 percent or more of the average daily volume in any NMS stock. The proposal bases the definition of SCI ATS on average daily dollar volume and sets the threshold at five percent or more in any single NMS stock and one-quarter percent of more in all NMS stocks, or one percent or more in all NMS stocks. The proposal changes the threshold for non-NMS stocks to at least five percent of the aggregate average daily dollar volume from twenty percent of the average daily share volume. These proposed thresholds reflect developments in equities markets that resulted in a higher number of trading venues and less concentrated trading, and are designed to ensure that the proposed rule is applied to all ATSs that trade more than a limited amount of securities and for which SCI events may cause significant impact on the overall market. The main benefit of the proposed thresholds is to bring more ATSs into the SCI ATS definition than currently subject to the systems safeguard provisions of Rule 301(b)(6) of Regulation ATS, which in turn would make them SCI entities. This would help ensure that SCI ATSs that trade a certain amount of securities are covered by the proposed regulation. The Commission recognizes the potential for a low threshold to discourage automation and innovation but, as noted below, the Commission has balanced the concerns regarding discouraging automation and innovation against the need for regulation, and preliminarily believes that innovation is unlikely to be hampered and automation is likely to continue to increase. To that extent, the proposed rule uses a two-prong approach for NMS stocks. The threshold is based on market share in individual stocks. However, it is also required that the ATS has a certain market share of the overall market in all NMS stocks to prevent an ATS from being subject to proposed Regulation SCI for meeting the five percent threshold in any single NMS stock for a micro-cap stock, but not having significant market share in all NMS stocks. As discussed above, the Commission believes that approximately 10 NMS stock ATSs and two non-NMS stock ATSs would fall within the definition of SCI ATS.

For municipal and corporate debt securities, the proposal would lower the threshold from 20 percent or more to five percent or more. However, the proposal contemplates a two-prong approach considering either average daily dollar volume or average daily transaction volume, and exceeding the threshold in either one would qualify an ATS as an SCI ATS. The use of the two metrics is intended to take into account the fact that ATSs in the debt securities markets may handle primarily retail trades (i.e., large transaction volume but small dollar volume) or institutional-sized trades (i.e., large dollar volume but small transaction volume).

The proposed thresholds for municipal and corporate debt securities are different from the proposed thresholds for NMS stocks. This difference reflects the fact that, in the debt securities markets (i.e., municipal securities and corporate debt securities), the degree of automation and electronic trading is much lower than in the markets for NMS stocks, which the Commission preliminarily believes may reduce the need for more stringent rules and regulations. In addition, the Commission preliminarily believes that the imposition of a threshold lower than five percent on the current debt securities markets could have the unintended effect of discouraging automation in these markets and discouraging new entrants into these markets. Also, due to the large number of issues outstanding in these debt securities markets, trading volume may be extremely low in a given issue, but also may fluctuate significantly from day to day and issue to issue. Therefore, the thresholds for debt securities consider aggregate volume instead of volume in an individual issue. As discussed above, the Commission preliminarily believes that three municipal securities and corporate debt securities ATSs would fall within the definition of SCI ATS.

D. Request for Comment on Economic Analysis

219. The Commission is sensitive to the potential economic effects, including the costs and benefits, of proposed Regulation SCI. The Commission has identified above certain costs and benefits associated with the proposal and requests comment on all aspects of its preliminary economic analysis. The Commission encourages commenters to identify, discuss, analyze, and supply relevant data, information, or statistics regarding any such costs or benefits. In particular, the Commission seeks comment on the following:

220. Do commenters agree that the release provides a fair representation of current practices and how those current practices would change under proposed Regulation SCI? Why or why not? Please be specific in your response regarding current practices and how they would change under proposed Regulation SCI.

221. Do commenters agree with the Commission's characterization of the relevant markets in which SCI entities participate, as well as the market failures identified with respect to each of the relevant markets? Why or why not? Specifically, do commenters agree with the identified level of competition in each of the relevant markets? Why or why not?

222. What is a typical market participant's general level of expectation of how well the market operates? Do market participants currently have all the information they need to make informed decisions that manage their exposure to SCI events? If not, would proposed Regulation SCI provide the needed information? Why or why not?

223. Do commenters agree with the Commission's analysis of the costs and benefits of each provision of proposed Regulation SCI, including the definitions under proposed Rule 1000(a)? Why or why not?

224. Do commenters believe that there are additional benefits or costs that could be quantified or otherwise monetized? If so, please identify these categories and, if possible, provide specific estimates or data.

225. Are there any additional benefits that may arise from proposed Regulation SCI? Or are there benefits described above that would not likely result from proposed Regulation SCI? If so, please explain these benefits or lack of benefits in detail.

226. Are there any additional costs that may arise from proposed Regulation SCI? Are there any potential unintended consequences of proposed Regulation SCI? Or are there costs described above that would not likely result from proposed Regulation SCI? If so, please explain these costs or lack of costs in detail.

227. Do the types or extent of any anticipated benefits or costs from proposed Regulation SCI differ between the different types of SCI entities? For example, do potential benefits or costs differ with respect to SCI SROs as compared to SCI ATSs? Please explain.

228. Are there methods (including any suggested by Roundtable panelists or commenters) by which the Commission could reduce the costs imposed by Regulation SCI while still achieving the goals? Please explain.

229. Does the release appropriately describe the potential impacts of proposed Regulation SCI on the promotion of efficiency, competition, and capital formation? Why or why not?

230. To the extent that there are reasonable alternatives to any of the rules under proposed Regulation SCI, what are the potential costs and benefits of those reasonable alternatives relative to the proposed rules? What are the potential impacts on the promotion of efficiency, competition, and capital formation of those reasonable alternatives? For example, what would be the effect on the economic analysis of requiring SCI entities to conduct an SCI review that requires penetration testing annually? What would be the effect on the economic analysis of requiring SCI entities to inform members and participants of all SCI events? What would be the effect on the economic analysis of requiring filing in a tagged data format (e.g., XML, XBRL, or another structured data format that may be tagged)? What would be the effect on the economic analysis of including broker-dealers, or a subset thereof, in the definition of SCI entities?

231. In addition, as noted above, the proposed requirement that an SCI entity disseminate information relating to dissemination SCI events to its members or participants is focused on disseminating information to those who need, want, and can act on the information disseminated. The Commission also preliminarily believes that this proposed requirement could promote competition and capital formation. Are there alternative mechanisms for achieving the Commission's goals while promoting competition and capital formation? Are there costs associated with this proposed approach that have not been considered? For example, would the requirement to disseminate information to members or participants about dissemination SCI events increase an SCI entity's litigation costs, or cause an SCI entity to lose business (e.g., if market participants misjudge the meaning of information disseminated about dissemination SCI events)? Would the benefits of the proposed information dissemination outweigh the costs? Why or why not? Please explain.

232. The Commission also generally requests comment on the competitive or anticompetitive effects, as well as the efficiency and capital formation effects, of proposed Regulation SCI on market participants if the proposed rules are adopted as proposed. Commenters should provide analysis and empirical data to support their views on the competitive or anticompetitive effects, as well as the efficiency and capital formation effects, of proposed Regulation SCI.

233. Finally, as stated above, proposed Rule 1000(b)(1) would require SCI entities to establish, maintain, and enforce written policies and procedures, reasonably designed to ensure that their SCI systems and, for purposes of security standards, SCI security systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets. As discussed above, the Commission is proposing that an SCI entity's policies and procedures required by proposed Rule 1000(b)(1) be deemed to be reasonably designed if they are consistent with current SCI industry standards. However, the costs identified above may not fully incorporate all of the costs of adhering to initial or future SCI industry standards. For example, if a SCI industry standard is based on the standards of NIST (which issues a number of the publications listed in Table A), it could include additional requirements not otherwise required in proposed Regulation SCI such as establishment of assurance-related controls (including, for example, conduct of integrity checks on software and firmware components, or monitoring of established secure configuration settings). Any additional requirements would likely impose costs on SCI entities. Therefore, the Commission requests comment on what benefits or costs, quantifiable or otherwise, could potentially be imposed by the identification of SCI industry standards. What are market participants' current level of compliance with the industry standards contained in the publications listed in Table A? What would be the costs to SCI entities (in addition to the cost of adhering to current practice) of the Commission identifying examples of industry standards? What would be the benefits? Please explain.

VI. Consideration of Impact on the Economy

For purposes of the Small Business Regulatory Enforcement Fairness Act of 1996, or “SBREFA,” the Commission must advise OMB as to whether proposed Regulation SCI constitutes a “major” rule. Under SBREFA, a rule is considered “major” where, if adopted, it results or is likely to result in: (1) An annual effect on the economy of $100 million or more (either in the form of an increase or decrease); (2) a major increase in costs or prices for consumers or individual industries; or (3) a significant adverse effect on competition, investment or innovation.

234. The Commission requests comment on the potential impact of proposed Regulation SCI on the economy on an annual basis, on the costs or prices for consumers or individual industries, and any potential effect on competition, investment, or innovation. Commenters are requested to provide empirical data and other factual support for their views to the extent possible.

VII. Regulatory Flexibility Act Certification

The Regulatory Flexibility Act (“RFA”) requires Federal agencies, in promulgating rules, to consider the impact of those rules on small entities. Section 603(a) of the Administrative Procedure Act, as amended by the RFA, generally requires the Commission to undertake a regulatory flexibility analysis of all proposed rules, or proposed rule amendments, to determine the impact of such rulemaking on “small entities.” Section 605(b) of the RFA states that this requirement shall not apply to any proposed rule or proposed rule amendment, which if adopted, would not have significant economic impact on a substantial number of small entities.

A. SCI Entities

Paragraph (a) of Rule 0-10 provides that for purposes of the RFA, a small entity when used with reference to a “person” other than an investment company means a person that, on the last day of its most recent fiscal year, had total assets of $5 million or less. With regard to broker-dealers, small entity means a broker or dealer that had total capital of less than $500,000 on the date in the prior fiscal year as of which its audited financial statements were prepared pursuant to Rule 17a-5(d) under the Exchange Act, or, if not required to file such statements, total capital of less than $500,000 on the last business day of the preceding fiscal year (or in the time that it has been in business, if shorter), and that is not affiliated with any person that is not a small business or small organization. With regard to clearing agencies, small entity means a clearing agency that compared, cleared, and settled less than $500 million in securities transactions during the preceding fiscal year (or in the time that it has been in business, if shorter), had less than $200 million of funds and securities in its custody or control at all times during the preceding fiscal year (or in the time that it has been in business, if shorter), and is not affiliated with any person (other than a natural person) that is not a small business or small organization. With regard to exchanges, a small entity is an exchange that has been exempt from the reporting requirements of Rule 601 under Regulation NMS, and is not affiliated with any person (other than a natural person) that is not a small business or small organization. With regard to securities information processors, a small entity is a securities information processor that had gross revenue of less than $10 million during the preceding year (or in the time it has been in business, if shorter), provided service to fewer than 100 interrogation devices or moving tickers at all times during the preceding fiscal year (or in the time it has been in business, if shorter), and is not affiliated with any person (that is not a natural person) that is not a small business or small organization. Under the standards adopted by the Small Business Administration (“SBA”), entities engaged in financial investments and related activities are considered small entities if they have $7 million or less in annual receipts.

Based on the Commission's existing information about the entities that will be subject to proposed Regulation SCI, the Commission preliminarily believes that SCI entities that are self-regulatory organizations (national securities exchanges, national securities associations, registered clearing agencies, and the MSRB) or exempt clearing agencies subject to ARP would not fall within the definition of “small entity” as described above. With regard to plan processors, which are defined under Rule 600(b)(55) of Regulation NMS to mean a self-regulatory organization or securities information processor acting as an exclusive processor in connection with the development, implementation and/or operation of any facility contemplated by an effective NMS plan, the Commission's definition of “small entity” as it relates to self-regulatory organizations and securities information processors would apply. The Commission preliminarily does not believe that any plan processor would be a “small entity” as defined above. With regard to SCI ATSs, because they are registered as broker-dealers, the Commission's definition of “small entity” as it relates to broker-dealers would apply. As stated above, the Commission preliminarily believes that approximately 15 ATSs would satisfy the definition of SCI ATSs and would be impacted by proposed Regulation SCI. The Commission preliminarily does not believe that any of these 15 SCI ATSs would be a “small entity” as defined above.

B. Certification

For the foregoing reasons, the Commission certifies that proposed Regulation SCI would not have a significant economic impact on a substantial number of small entities for the purposes of the RFA.

235. The Commission requests comment regarding this certification. The Commission requests that commenters describe the nature of any impact on small entities and provide empirical data to illustrate the extent of the impact.

VIII. Statutory Authority and Text of Proposed Amendments

Pursuant to the Exchange Act, 15 U.S.C. 78a et seq., and particularly, Sections 2, 3, 5, 6, 11A, 15, 15A, 17, 17A, and 23(a) thereof, 15 U.S.C. 78b, 78c, 78e, 78f, 78k-1, 78 o, 78 o-3, 78q, 78q-1, and 78w(a), the Commission proposes to adopt Regulation SCI under the Exchange Act and Form SCI under the Exchange Act, and to amend Regulation ATS under the Exchange Act.

List of Subjects in 17 CFR Parts 242 and 249

• Securities, brokers, reporting and recordkeeping requirements

For the reasons stated in the preamble, the Commission is proposing to amend title 17, chapter II of the Code of Federal Regulations as follows:

PART 242—REGULATIONS M, SHO, ATS, AC, NMS AND SCI AND CUSTOMER MARGIN REQUIREMENTS FOR SECURITY FUTURES

1a. The authority citation for part 242 continues to read as follows:

Authority: 15 U.S.C. 77g, 77q(a), 77s(a), 78b, 78c, 78g(c)(2), 78i(a), 78j, 78k-1(c), 78 l, 78m, 78n, 78o(b), 78o(c), 78o(g), 78q(a), 78q(b), 78q(h), 78w(a), 78dd-1, 78mm, 80a23, 80a-29, and 80a-37.

1b. The heading of part 242 is revised to read as set forth above.

2. In § 242.301, remove and reserve paragraph (b)(6).

3. Add an undesignated center heading and § 242.1000 to read as follows:

Regulation SCI—Systems Compliance and Integrity

PART 249—FORMS, SECURITIES EXCHANGE ACT OF 1934

4. The general authority citation for part 249 continues to read in part as follows:

Authority: 15 U.S.C. 78a et seq. and 7201 et seq.; 12 U.S.C. 5461 et seq.; and 18 U.S.C. 1350, unless otherwise noted.

5. Add subpart T, consisting of § 249.1900, to read as follows:

Subpart T—Form SCI, for filing notices and reports as required by Regulation SCI.