SEC censures OTC Link and fines it $575,000 over policies it never finished writing

The Securities and Exchange Commission on 22 September instituted and simultaneously settled administrative and cease-and-desist proceedings against OTC Link LLC, the broker-dealer subsidiary of OTC Markets Group Inc. that runs the OTC Link alternative trading system. The Commission found that between August 2016 and March 2025 the firm did not establish, maintain and enforce written policies and procedures required by Regulation Systems Compliance and Integrity, and that it did not fix the shortcomings after examination staff wrote them up again and again.

OTC Link was censured, ordered to cease and desist, and ordered to pay a civil money penalty of $575,000. It settled without admitting the findings, conceding only the Commission's jurisdiction over it and over the subject matter of the proceedings, according to the order entered as Securities Exchange Act Release Number 106458 in Administrative Proceeding File Number 3-22748.

The proceedings were instituted under Sections 15(b)(4) and 21C of the Securities Exchange Act of 1934. The order finds willful violations of Rules 1001(a)(1), 1001(a)(2) and 1001(a)(3) of Regulation SCI, and explains in a footnote that willfully here means no more than that the person charged with the duty knows what he is doing.

The policy that stayed a draft

Division of Examinations staff examined OTC Link ATS several times over the period at issue and issued a deficiency letter after each one. The order describes a single policy that survived all of them unfinished.

"For example, OTC Link ATS's access control policy, first found to be in draft form and therefore noted as deficient in connection with a fiscal-year 2016 examination, remained in draft form and was again cited in deficiency letters issued by Division of Examinations staff in 2019 and 2022. As of fiscal year 2023, OTC Link ATS's access control policy had still not been formally established."

That is one document flagged across four examination cycles spanning seven fiscal years. The order records the same pattern in wider terms at paragraph 3, saying that although staff examined the trading system several times and each time cited the firm for failing to establish, maintain and enforce certain policies and procedures required by Regulation SCI, the firm failed to remediate all such deficiencies during the period.

Laura D'Allaird, chief of the Division of Enforcement's Cyber and Emerging Technologies Unit, put the reasoning for the size of the penalty on the record in the accompanying press release. "OTC Link's continual failure to remediate deficiencies even after they were repeatedly flagged by Division of Examinations staff reflects a disregard for their findings and the overall examinations process and justifies a meaningful penalty," she said.

What the rule asks for

Regulation SCI was adopted in 2014 and applies to a defined set of market infrastructure operators: certain self-regulatory organisations, alternative trading systems, plan processors and exempt clearing agencies. Rule 1001(a)(1) requires each such entity to establish, maintain and enforce written policies and procedures reasonably designed to ensure that its systems have levels of capacity, integrity, resiliency, availability and security adequate to maintain operational capability and promote the maintenance of fair and orderly markets.

Rule 1001(a)(2) sets out what those policies must contain, including capacity planning, stress tests, disaster recovery plans able to resume trading by the next business day, and regular reviews and testing to identify vulnerabilities. Rule 1001(a)(3) requires the entity to review how well the policies work and act promptly on deficiencies in them.

The failures the order names are concrete. Under Rule 1001(a)(1), they include written policies on account management and access control, network device security configuration management, and data loss prevention. Under Rule 1001(a)(2), they include the vulnerability review and testing policies required by subparagraph (iv), some of which the firm kept in draft and never finalised.

OTC Link LLC has been registered as a broker-dealer since 2012 and operates five alternative trading platforms. The order notes at paragraph 5 that OTC Markets Group Inc.'s own securities trade over the counter under the ticker symbol OTCM on the platforms its subsidiary runs.

Nothing broke, on this record

The order alleges no outage, no intrusion and no loss of data. It is a policies-and-procedures case brought under Rule 1001(a) alone. No SCI event, breach or trading interruption appears anywhere in it, and Rule 1002, which governs corrective action and notification to the Commission when an SCI event does occur, is not charged.

Other things the document does not establish are worth stating plainly. It does not say how many examinations there were, only that there were several, nor how many deficiency letters followed. It does not quantify the trading system's share of volume in equity securities that are not national market system stocks, so it does not show on its face how the platform crossed the five per cent threshold that made it subject to the rule. No disgorgement is ordered and no investor harm is alleged. No individual is charged, and no officer of either company is named. No public statement from either company is on the record.

What the firm did, and what it owes

The order records remediation the firm began before the proceedings. In 2024 OTC Link retained third-party compliance consultants of its own accord to review the trading system's Regulation SCI compliance programme and make recommendations on its policies and procedures. Since March 2025, the order says, the firm has established additional written policies required by the regulation, including ones concerning application vulnerability management, account management and access control, and network device configuration management. March 2025 is also where the period at issue closes.

Section IV of the order imposes the cease-and-desist, the censure, the penalty and a penalty offset provision, and nothing else. No compliance consultant is mandated, no certification is required and no reporting obligation is attached.

The $575,000 is payable within 14 days of entry, to the Commission for transfer to the general fund of the United States Treasury, subject to Exchange Act Section 21F(g)(3), with interest accruing under federal law if payment is late. The offset provision bars the firm from arguing that the penalty should reduce compensatory damages in any related investor action; if a court grants one anyway, the firm must notify Commission counsel within 30 days and pay that amount over to the Commission.

It is the second settled action against the firm in just over two years. On 12 August 2024 the Commission charged OTC Link LLC with failing to file Suspicious Activity Reports for more than three years, in violation of Exchange Act Section 17(a) and Rule 17a-8. The firm paid $1.19 million and agreed to a censure and a cease-and-desist order, again without admitting or denying the findings.

The order was signed by the Commission, Vanessa A. Countryman, Secretary, and is published as the order instituting administrative and cease-and-desist proceedings, alongside the Commission's press release of the same date.