SEC order traces OTC Link’s draft access policy through repeated examinations

OTC Link ATS’s access-control policy remained in draft after repeated SEC examinations, according to the regulator’s September 2026 settlement with its operator, OTC Link LLC. The Securities and Exchange Commission says examiners first identified the draft policy as deficient in fiscal 2016, raised it again in deficiency letters in 2019 and 2022, and found it had still not been formally established as of fiscal 2023. The chronology is the most instructive part of the $575,000 case: a control issue could recur across examinations without the required policy being finalised.[1][2]

The settled order records failures concerning written technology controls from August 2016 to March 2025. OTC Link consented to the order without admitting its findings, apart from admitting the SEC’s jurisdiction. The order also records remedial work: the company engaged outside compliance consultants in 2024 and established additional policies from March 2025. It does not find that a hacker exploited the draft-policy problem, quantify investor losses or establish that the same deficiencies continued after that remediation.[1]

Which entity was disciplined?

The respondent is OTC Link LLC, described by the SEC as a registered broker-dealer operating OTC Link ATS, an alternative trading system for over-the-counter securities. The order explains the system’s status as an SCI entity throughout the relevant period. That is not synonymous with the entirety of OTC Markets Group Inc., nor with every broker quoting or trading over-the-counter securities. OTC Link ATS is not a national securities exchange or a self-regulatory organisation; it operates under a different venue structure. Its regulatory significance comes in part from the scale and type of transactions that trigger the SCI framework, not from being a stock exchange in the conventional sense.[1]

The entity boundary matters to users of the venue. Brokers routing orders, issuers whose securities trade over the counter, market-data distributors and the ATS operator occupy different roles. The order concerns the operator’s Regulation SCI obligations. It does not establish that every broker using OTC Link had the same policy deficiencies or that every security quoted through the system was affected by an operational incident.[1]

The rule that turns documentation into a market-integrity obligation

Regulation SCI links written policies to the operation of important market systems. Rule 1001(a)(1) requires policies and procedures reasonably designed to provide adequate capacity, integrity, resiliency, availability and security. Paragraph (a)(2) specifies minimum areas of coverage, including vulnerability reviews and testing. Paragraph (a)(3) requires periodic review of effectiveness and prompt action to remedy deficiencies. The SEC found violations of all three: policy coverage, required testing-related procedures and the response to deficiencies identified over time.[1]

The SEC’s order records failures in several categories, including account management and access control, network-device security configuration, data-loss prevention, and application vulnerability management, testing and remediation. Some required policies remained in draft. These subjects are operationally connected: an organisation must decide who can obtain access, how configuration changes are controlled, how flaws are identified and how remediation is reviewed.[1]

Reconstructing the examination sequence

The order’s access-control example is specific. An initial fiscal-2016 examination found a draft policy; letters in 2019 and 2022 again identified it; and it remained unestablished as of fiscal 2023. The wider case ran through March 2025 and covered other areas as well. Those dates should not be collapsed into a claim that every deficiency was present in exactly the same form throughout the entire period. Nor does a fiscal-year finding establish the precise number of days a particular approval remained outstanding.[1]

What was corrected, and when?

In 2024, OTC Link retained third-party compliance consultants to review its SCI programme and recommend changes. The SEC says that, in connection with that review, the firm established additional required policies from March 2025, including application vulnerability management, account management and access control, and network-device configuration management. This is material evidence of action by the company. It narrows the case to the historical conduct described, while stopping short of a public certification that every control thereafter worked effectively.[1]

Why a draft policy is more than a paperwork issue

An access-control policy sets the rules for who may reach a system, how permissions are approved and reviewed, and what happens when access should be removed. In market infrastructure, those decisions connect technology staff, compliance and management. A draft can contain useful work, but leaving required policies unestablished creates uncertainty over the authoritative standard and accountability for carrying it out. The SEC’s case concerns that governance obligation; it does not require a successful cyber intrusion before a breach of the written-policy rules can be found.[1]

Written approval and technical effectiveness remain separate questions. A final policy may be poorly implemented, while some operational safeguards can exist before formal documentation is complete. The order does not disclose the underlying permissions, testing results or a complete record of system events. It would therefore go beyond the evidence to conclude that the venue had no access controls at all. The established finding is that specified policies and procedures required by SCI were not properly established, maintained or enforced.[1]

The penalty and the remedy

The settlement censured OTC Link and ordered it to cease and desist from violations of Rules 1001(a)(1), (a)(2) and (a)(3). The $575,000 civil penalty was payable to the SEC for transfer to the US Treasury’s general fund, subject to the statutory provision specified in the order. It was not presented as compensation for a measured set of customer losses. Comparing that penalty with assumed trading damage would require evidence the order does not provide.[1]

How the venue fits into market structure

For brokers and other users, the practical issue is dependence on shared trading infrastructure. Their own systems may function while a venue or its supporting services encounter a problem. The SCI policy requirements address the operator’s ability to maintain orderly and reliable services within that network. The case consequently matters beyond the operator’s compliance department, even though the public record supplies no basis for attaching a loss figure to individual users.[1]

What would establish the present position

A current assessment would need the approved policies, evidence of implementation, relevant testing and subsequent examination outcomes. The order records significant remediation but does not publish all of those materials. The useful follow-up is whether the revised controls were embedded and tested, rather than repeating the historical draft-policy finding as if it necessarily described the venue today.[1]

The case demonstrates why repeated examination findings deserve their own chronology. A fine records the enforcement outcome; the sequence of drafts, deficiency letters and later remedial work explains the governance issue. Readers can assess both from the settled record without assuming a successful attack, customer loss or continuing failure that the SEC did not establish.[1]

Report an error or submit an update