In March 2013, the Securities and Exchange Commission (SEC) proposed new rules designed to strengthen the technology infrastructure of certain participants in U.S. securities markets. Citing the heavy reliance on technology and automated systems in todays markets, the SEC noted that a technology infrastructure failure could have significant and even devastating implications for investors and financial markets. Those risks were highlighted by various technology issues that arose prior to the 2013 proposals. Now the new regulations have been approved for implementation.
The new rules are known as Regulation Systems Compliance and Integrity (Regulation SCI) and are intended to reduce the likelihood of systems glitches and to improve system resiliency when technological problems occur. The entities governed by Regulation SCI will be required to have comprehensive policies and procedures in place for their technological systems as well as a framework for taking appropriate corrective action when systems issues occur. The regulation also requires notifications and reports to the SEC regarding systems problems as well as systems changes. There is also a requirement to inform members and participants in the event that systems issues occur. Testing and review provisions mandate business continuity testing and annual reviews of automated systems.
Regulation SCI applies to certain key market participants referred to as SCI entities, which include: self-regulatory organizations (SROs), plan processors, clearing agencies and alternative trading systems (ATSs) that exceed certain volume thresholds. Such entities are required to “ensure their core technology meets certain standards, conduct business continuity testing, and provide certain notifications in the event of systems disruptions and other events” by way of designing, developing, testing, maintaining and monitoring systems that are integral to their operations.
New Controls for New Technology
In a statement released by SEC Chair Mary Jo White, the importance of notification to the SEC was underscored:
The rules adopted today mark an historic shift in the Commissions regulation of the U.S. securities markets that will better protect investors by requiring comprehensive new controls for the technological systems that form the core of our current market. The rules provide greater accountability for those responsible for our critical market systems, helping ensure that such systems operate effectively and that any issues are promptly corrected and communicated to market participants and the Commission.
Regulation SCI becomes effective 60 days after publication in the Federal Register, and SCI entities will have nine months from such effective date to come into compliance with its rules. An ATS that becomes newly subject to Regulation SCI due to achieving the thresholds for the first time will have an additional six months from the time that the ATS first meets the applicable thresholds to comply.