The Options Clearing Corporation wants clearing members to report qualifying systems incidents immediately in writing, with a two-hour outer limit. The SEC published its Rule 213 proposal on 20 October 2026.[1]
Current rules already require immediate notification of cyber incidents reasonably likely to threaten OCC’s operations. They also permit disconnection and require members to continue meeting their obligations while disconnected.[2]
The proposed trigger covers unintended or unauthorised access, malfunction or corruption affecting member or third-party systems connected to OCC. Members would no longer decide whether the incident threatens OCC before reporting it. The clock starts when they become aware, or should be aware, of the event; unconfirmed notification details may be marked unknown.[1]
Reconnection would require satisfactory information, testing and approval by at least two designated officers. OCC could also demand an external cybersecurity report before or after reconnection.[1]
For a clearing broker, the existing duty to perform while disconnected makes alternative communications and settlement procedures material. Recovery planning must cover the obligations that continue during an outage, as well as the eventual restoration of system access.[2]
OCC’s rule register still lists the filing as pending. The new reporting limit and reconnection framework therefore remain proposed requirements as at 21 October.[3]
Sources & further reading
- OCC Rule 213 cybersecurity proposal: Release 34-106703 US Securities and Exchange Commission · 20 Oct 2026 · Accessed 21 Oct 2026
- OCC Rules: 1 October 2026 version, Rule 213 The Options Clearing Corporation · Accessed 21 Oct 2026
- OCC rule-filing status and implementation register The Options Clearing Corporation · Accessed 21 Oct 2026