---
title: "SEC fines OTC Link $575K over system security failures"
slug: "sec-fines-otc-link-575k-over-system-security-failures"
published: "2026-10-18"
beat: "Policy"
tags: ["Policy"]
creator: "Agentry Newsroom"
editor: "Susanne Sperling, Editor — Human in the Loop"
tools: ["Claude (Anthropic)", "Perplexity Sonar"]
creativeWorkStatus: "verified"
dateReviewed: "2026-10-18"
aiActArticle50: "compliant"
humanView: "https://agentry.news/policy/sec-fines-otc-link-575k-over-system-security-failures"
agentView: "https://agentry.news/agent/sec-fines-otc-link-575k-over-system-security-failures"
---# SEC fines OTC Link $575K over system security failures

> The U.S. Securities and Exchange Commission on September 22, 2026, imposed a $575,000 penalty on OTC Link LLC, a New York-based broker-dealer, for failing to establish and maintain adequate security p

*Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. [AI policy](/ai-policy).*

The U.S. Securities and Exchange Commission issued a cease-and-desist order and $575,000 civil penalty against **OTC Link LLC** on September 22, 2026, citing systematic failures to maintain technology and security controls on its alternative trading system for over-the-counter securities [Daily Federal](https://www.dailyfederal.com/article/sec-censures-otc-link-llc-imposes-575-000-penalty-688).

## Nine Years of Unresolved Deficiencies

The SEC found that OTC Link LLC violated **Regulation SCI Rules 1001(a)(1), 1001(a)(2), and 1001(a)(3)** across a conduct period spanning **August 2016 through March 2025**. The violations centered on the company's failure to establish, maintain, and enforce written policies and procedures governing security, access control, vulnerability management, testing, and remediation of systems supporting OTC Link ATS [Financial Crunch](https://www.fincrunch.org/article/sec-otc-link-575000-settlement-reg-sci).

Beyond initial deficiencies, the SEC identified a pattern of non-compliance: OTC Link LLC failed to periodically review the effectiveness of its security policies and repeatedly ignored corrective-action orders from the SEC's Division of Examinations staff. **Laura D'Allaird**, chief of the SEC Division of Enforcement's Cyber and Emerging Technologies Unit, characterized the conduct as deliberate. "OTC Link's continual failure to remediate deficiencies even after they were repeatedly flagged by division of examinations staff reflects a disregard for their findings and the overall examinations process and justifies a meaningful penalty," D'Allaird said [Investment Executive](https://www.investmentexecutive.com/news/regulation/sec-sanctions-ats-for-compliance-failings/).

## Administrative Order and Payment

OTC Link LLC agreed to the order and penalty **without admitting or denying the SEC's findings**. The $575,000 civil penalty was payable within 14 days of the order [The Industry Spread](https://theindustryspread.com/sec-34-106458-otc-link-575000-regulation-sci-penalty/). The proceeding was administrative, not a criminal court action.

The enforcement action underscores the SEC's intensified focus on systems compliance and integrity at alternative trading venues. OTC Link operates as a subsidiary of OTC Markets Group and facilitates trading in securities not listed on national exchanges. Regulation SCI, which governs market infrastructure operators, mandates robust governance and technological safeguards to protect market integrity and investor protection.

The nearly nine-year span of alleged violations—from the financial crisis aftermath through 2025—reflects either a systemic organizational failure to prioritize security governance or prolonged indifference to regulatory direction. For broker-dealers operating trading systems, the case signals that the SEC will impose material penalties for sustained non-compliance with infrastructure security mandates, regardless of whether actual fraud or data breach occurred.

## Regulatory Implications

This enforcement action joins a broader SEC campaign against technology and cybersecurity governance failures across the financial services industry. The penalty sends a clear message that administrative oversight of trading platforms must include contemporaneous remediation of identified deficiencies [Law360](https://www.law360.com/technology/articles/2528644/sec-fines-broker-dealer-over-system-security-failures).