SEC fines OTC Link $575K for tech security gaps
The U.S. Securities and Exchange Commission censured OTC Link LLC and ordered the New York-based broker-dealer to pay $575,000 on September 22, 2026, resolving a nine-year compliance failure affecting its alternative trading system.
Years of Unaddressed Deficiencies
OTC Link LLC, a subsidiary of OTC Markets Group, failed to establish, maintain, and enforce written policies and procedures required by Regulation Systems Compliance and Integrity (Regulation SCI) from August 2016 through March 2025, according to the SEC enforcement action Administrative Proceeding File No. 3-22289. The regulator identified violations of Rules 1001(a)(1), 1001(a)(2), and 1001(a)(3) of Regulation SCI.
The deficiencies centered on system security, access control, and application-vulnerability management, testing, and remediation for OTC Link ATS, the alternative trading system operated by the firm Law360. The SEC determined that OTC Link lacked policies reasonably designed to ensure the systems had adequate capacity, integrity, resiliency, availability, and security.
Regulatory Relief and Remediation
In addition to the $575,000 civil penalty, due within 14 days of the order, the SEC imposed a cease-and-desist order against further violations and formally censured the firm. The action was an administrative enforcement proceeding, not a court case, and no criminal charges or sentencing was reported Money and World.
The nine-year span between the initial deficiencies in August 2016 and the remediation cutoff in March 2025 reflects the scale of the compliance gap. SEC examiners flagged these vulnerabilities repeatedly during routine oversight, yet OTC Link failed to implement adequate fixes The Industry Spread.
Regulation SCI Compliance Stakes
Regulation SCI governs the technology infrastructure supporting major trading venues and critical market participants. Broker-dealers operating alternative trading systems must design controls that prevent unauthorized access, detect system intrusions, and remediate vulnerabilities before they can be exploited. OTC Link's lapses exposed its ATS to potential operational disruption and security breaches.
The enforcement action underscores the SEC's focus on technology governance at firms operating market infrastructure. As the agency continues to scrutinize cloud adoption and third-party dependencies in trading systems, Regulation SCI compliance remains a high-priority examination area.
OTC Link LLC must now certify compliance with all Regulation SCI policies and submit quarterly attestations to the SEC for the next three years.