SEC Censures OTC Link LLC, Levies $575,000 Fine for Regulation SCI Failures
SEC censured OTC Link LLC and imposed a $575,000 penalty for longstanding Regulation SCI policy failures at OTC Link ATS from August 2016 to March 2025.
Summary
On Sept. 22, 2026, the SEC censured New York-based broker-dealer OTC Link LLC and imposed a $575,000 civil penalty for Regulation SCI violations from August 2016 through March 2025. The settled order found that OTC Link lacked, failed to maintain, or did not enforce required written policies for OTC Link ATS, its alternative trading system for over-the-counter securities. Deficiencies covered system security, access controls, and application vulnerability management, testing, and remediation.
Division of Examinations staff reviewed OTC Link ATS several times, repeatedly identifying required policies that were missing, unfinished, or unenforced, but the firm did not promptly correct them. The SEC found violations of Rules 1001(a)(1), 1001(a)(2), and 1001(a)(3), including inadequate controls for the capacity, integrity, resiliency, availability, and security of SCI systems and relevant indirect SCI systems, insufficient periodic policy reviews, and delayed remediation. Without admitting the findings, OTC Link agreed to cease and desist, accept the censure, and pay the penalty. Laura D’Allaird, chief of the Enforcement Division’s Cyber and Emerging Technologies Unit, said the repeated failures disregarded examination findings and justified a meaningful penalty.
Positives
- OTC Link LLC agreed to cease and desist, formally requiring an end to the cited Regulation SCI violations.
- The settled order resolves the enforcement matter without OTC Link LLC admitting the SEC’s findings.
- Several Division of Examinations reviews repeatedly identified control deficiencies at OTC Link ATS, reflecting sustained regulatory scrutiny.
Risks & concerns
- $575,000 is the civil penalty imposed alongside the SEC’s censure and cease-and-desist order.
- August 2016 through March 2025 marks more than eight years of cited Regulation SCI compliance failures.
- Required policies covering security, access controls, and vulnerability management, testing, and remediation were missing, unfinished, or unenforced.
- OTC Link LLC repeatedly failed to promptly correct deficiencies after SEC examination staff flagged them multiple times.
- Rules 1001(a)(1), 1001(a)(2), and 1001(a)(3) were violated through inadequate controls, reviews, and remediation, according to the order.
