OTC Link left SCI policy gaps unresolved through repeated examinations

OTC Link LLC went through several SEC examinations between August 2016 and March 2025, and each examination cited deficiencies in policies required by Regulation Systems Compliance and Integrity. The SEC's settled order says previously identified deficiencies remained unaddressed in subsequent examinations and that some required vulnerability-management, testing and remediation policies remained in draft form. The relevant period lasted about eight years and seven months. The central finding is therefore not a single missing document: it is a repeated failure to convert examination findings into finalised and enforced controls over a market system designated as critical infrastructure.[1][2]

OTC Link did not admit the findings, apart from jurisdiction and subject matter, and agreed to a censure, cease-and-desist order and $575,000 penalty. The order does not say that a cyber intrusion occurred, that customer data were stolen or that trading failed. Reporting the control weakness safely requires that boundary. The public-interest concern is governance: required policies concerning access control, device configuration, data-loss prevention and application-vulnerability remediation were absent, unfinished or unenforced despite repeated regulatory notice.[1][2]

The deficiency cycle extended across almost nine years

Regulation SCI applies because OTC Link ATS met a market-share threshold for non-NMS equities and was an SCI entity. The order describes SCI entities as participants whose systems problems can affect investors, individual securities or the broader market. OTC Link ATS also functions as a qualified interdealer quotation system. OTC Markets Group's annual report says the subsidiary operates multiple registered alternative trading systems. The order, however, concerns the SCI obligations of OTC Link ATS; it should not be broadened automatically to every group platform.[1][3]

The missing denominator is the full control inventory. The order identifies examples—account management and access control, network-device security configuration, data-loss prevention, and application vulnerability management, testing and remediation—but does not publish every required procedure, every gap or the share of the control framework affected. It would therefore be wrong to say that OTC Link had no security programme. The finding is that specified written policies and minimum procedures required by Rules 1001(a)(1) and (a)(2) were not adequately established, maintained and enforced.[1]

Draft policies created a governance gap, not proof of a technical breach

A policy kept in draft can reflect ongoing improvement, legal review or administrative delay. Under Regulation SCI, however, the obligation is operational: the entity must establish, maintain and enforce written procedures and periodically review their effectiveness. A document that remains draft through an examination cycle may not define accountable owners, testing frequency, escalation, evidence retention or remediation deadlines. The order focuses on that governance failure rather than publishing exploit details, and this report does the same.[1]

The access-control and vulnerability topics are sensitive because detailed weaknesses could facilitate misuse. The order supplies no credentials, configurations or attack paths, and none are reproduced here. What can be reported safely is the affected scope: policies governing system security and reviews intended to identify internal and external threats, physical hazards and disasters. The significance lies in whether an SCI entity can prove that it knows who has access, how systems are configured, how vulnerabilities are tested and how findings are closed.[1]

OTC Markets Group had disclosed an SEC Enforcement information request relating to Regulation SCI policies and procedures before the settlement. That earlier disclosure indicated an inquiry but could not establish the final findings, period or penalty. The settled order now provides the legal status. This sequence illustrates why company risk disclosures and enforcement orders must not be conflated: one describes an unresolved inquiry; the other records findings accepted for settlement without admission.[3][1]

The penalty is smaller than the operational question

The $575,000 penalty is the monetary consequence disclosed in the order, but it is not a measure of system risk, investor loss or remediation cost. The SEC did not quantify customer harm or trading losses, and the order does not require a distribution fund. Comparing the penalty with OTC Markets Group revenue would not reveal whether the sanction was economically material to the parent, because the public-interest purpose includes deterrence and control remediation rather than compensation alone.[1][2]

A benign explanation is that OTC Link had technical controls in practice but failed to document, finalise or maintain them to the regulatory standard. The order's language leaves room for that possibility in some areas, yet it still matters: unrecorded controls are difficult to test consistently, hand over, audit or enforce. A more serious interpretation is that repeated draft status reflected weak ownership and closure discipline. The public documents do not establish which operational controls worked on any particular day.[1]

The most consequential unanswered question is remediation after March 2025. The order records the historical violations and requires cessation, but it does not publish a detailed current-state certification, independent assessment or closure schedule for each deficiency. Future annual reports, examination outcomes or an SCI review could establish that the framework is now complete. A subsequent repeat finding would indicate that the examination-to-remediation problem persisted beyond the settled period.[1][3]

For brokers that rely on alternative trading systems, the case shows that vendor and venue diligence should reach beyond uptime claims. Firms can ask whether the venue is an SCI entity, when required policies were last approved, whether testing covers indirect systems, how overdue findings are escalated and whether independent reviews confirm closure. Those are governance questions, not requests for exploitable technical detail. The order demonstrates why they matter when a platform is part of the market's execution infrastructure.[1]

The durable finding is a process failure measured in years. OTC Link ATS was examined several times; each cycle produced cited deficiencies; and subsequent examinations found earlier issues unresolved. The settlement does not prove a breach, outage or investor loss, and OTC Link did not admit the findings. It does establish that critical policies remained inadequate or unfinished across an approximately eight-and-a-half-year window. In market infrastructure, that gap between knowing a deficiency and closing it can be as important as the initial flaw.[1][2]

The entity perimeter should also remain narrow. OTC Markets Group operates several venues, but the settled findings concern OTC Link LLC and the Regulation SCI obligations of OTC Link ATS during the stated period. The order says OTC Link LLC operated five ATS platforms; it does not find that every platform suffered the same policy deficiency or that the parent company's entire technology estate was insecure. Extending the finding beyond the named entity and systems would convert a precise enforcement record into an unsupported group-wide allegation.[1][2]

Repeated examination letters are evidence of persistence, but the public order does not enumerate every examination date or every item raised in each cycle. The defensible conclusion is that certain required policies remained absent, draft or unenforced after multiple examinations and were not all promptly remediated. It is not possible from the order alone to calculate an average remediation delay for every control. That missing granularity is relevant because policy drafting, technical implementation and independent testing are different stages of control maturity.[1]

The order also does not report a successful cyber intrusion, market outage, customer loss or compromised credential caused by the deficiencies. Regulation SCI is preventive: it requires governance designed to maintain capacity, integrity, resiliency, availability and security before a failure proves the risk. Reporting the control weakness safely therefore means explaining the governance gap without publishing exploitable configurations or implying a breach that the SEC did not find. The $575,000 penalty and censure resolve the compliance case, not a quantified incident-loss claim.[1][2]

Report an error or submit an update