the necessary functionality to perform the service required of the
SCI systems, and have sufficient capacity to process the production
workloads at roughly comparable levels of performance, rather than
to test the actual functional or performance characteristics of the
backup or alternate recovery systems in their own right. See Omgeo
Letter at 27.
    \1178\ See Joint SROs Letter at 15-16.
    \1179\ See id. at 16.
    \1180\ See FIF Letter at 7; and UBS Letter at 4.
---------------------------------------------------------------------------

    Adopted Rule 1004(b) provides that the scope of required testing is
``functional and performance testing of the operation of BC/DR plans.''
As stated in the SCI Proposal, such functional and performance testing
should include not only testing of connectivity, but also testing of an
SCI entity's systems, such as order entry, execution, clearance and
settlement, order routing, and the transmission and/or receipt of
market data, as applicable, to determine if they can operate as
contemplated by its business continuity and disaster recovery
plans.\1181\ In response to commenters expressing concern about the
breadth of the requirement, the Commission notes that the rule requires
functional and performance testing of the ``operation of [BC/DR]
plans.'' While the type of testing required by adopted Rule 1004(b) is
more rigorous than some types of testing urged by some commenters, the
Commission does not believe that the requirement for ``functional and
performance testing of the operation of such plans'' requires
additional testing that is as burdensome as that feared by some of
those commenters. Importantly, ``functional and performance testing of
the operation of [BC/DR] plans'' entails testing that goes beyond
communication and connectivity testing, and beyond validation testing,
which are more limited types of testing urged by some commenters. But
the requirement to conduct ``functional and performance testing of the
operation of [BC/DR] plans'' does not mean that a full test of the
functional and performance characteristics of each backup facility is
required to be conducted all at once and in coordination with other SCI
entities all at the same time, as some commenters characterized the
proposed requirement.\1182\ Specifically, the Commission notes that the
testing of BC/DR plans, which is required by Rule 1004, is different
from testing of the function and performance of backup facilities
generally.\1183\ What Rule 1004 requires is coordinated testing to
evaluate annually whether such backup facilities of SCI entities can
function and perform in accordance with the operation of BC/DR plans in
the event of wide-scale disruption. In addition, the Commission notes
that performance testing, which examines whether a system is able to
perform under a particular workload, is not synonymous with ``stress
testing,'' in which capacity limits are tested, and therefore should
not require as much time to conduct as one commenter suggested.
---------------------------------------------------------------------------

    \1181\ See Proposing Release, supra note 13, at 18126.
    \1182\ Conducting the required testing is not intended to
require market downtime, but permits a range of possibilities, as
SCI entities determine to be appropriate, including weekend testing,
as well as testing in segments over the course of a year, if SCI
entities determine that, to meet the requirements of the rule, a
single annual test cannot be properly conducted within a single
period of time (e.g., over the course of a weekend).
    \1183\ Testing of the function and performance of backup
facilities generally would occur before such facilities are launched
into production (such as pursuant to Rule 1001(a)), and Regulation
SCI does not impose a requirement for coordinating such testing with
other SCI entities.
---------------------------------------------------------------------------

    In response to commenters concerned that the required testing would
necessitate system reconfigurations,\1184\ the Commission understands
that the requirement to test backup facilities may require technology
adjustments to permit testing activity to be processed by BC/DR
systems, and believes that such adjustments to permit testing are
warranted to achieve the goal, as discussed above, of achieving
reliable and effective BC/DR plans at SCI entities. The Commission also
believes that such system reconfigurations would be less burdensome
than a Commission rule requiring the establishment of a dedicated
environment for safe end-to-end testing that accurately simulates the
trading environment, which some commenters suggested might be
appropriate. One group of commenters noted the ``complexity and cost
associated with establishing an effective coordinated test script,''
and urged that the scope of the coordinated testing be ``narrowed to
cover those instances in which an SCI entity determines to enact its
disaster recovery plan.'' The Commission acknowledges that
establishment of an effective coordinated test script will involve

some costs and complexity, but believes that this is an important first
step in establishing robust and effective testing under the rule. The
Commission encourages SCI entities to develop one or more test scripts
contemplating a wide-scale disruption and the enactment by SCI entities
in the region of the wide-scale disruption of their BC/DR plans.
---------------------------------------------------------------------------

    \1184\ See supra note 1176 and accompanying text. See also
Tradebook Letter at 2-3 (stating its view that ``the only way to
test integration from order generation to allocation and then
through to final settlement, is in the production environment'' and
``test tickers that operate in the production environment are the
only way to reliably simulate exactly what will happen in the
production environment with a live order'').
---------------------------------------------------------------------------

    Further, the Commission notes that nothing in Rule 1001(a) nor Rule
1004 requires that an SCI entity's BC/DR plan specify that its backup
site must fully replicate the capacity, speed, and other features of
the primary site. Similarly, SCI entity members and participants are
not required by Regulation SCI to maintain the same level of
connectivity with the backup sites of an SCI entity as they do with the
primary sites.\1185\ In the event of a wide-scale disruption in the
securities markets, the Commission acknowledges that an SCI entity and
its members or participants may not be able to provide the same level
of liquidity as on a normal trading day. In addition, the Commission
recognizes that the concept of ``fair and orderly markets'' does not
require that trading on a day when business continuity and disaster
recovery plans are in effect will reflect the same levels of liquidity,
depth, volatility, and other characteristics of trading on a normal
trading day. Nevertheless, the Commission believes it is critical that
SCI entities and their designated members or participants be able to
operate with the SCI entities' backup systems in the event of a wide-
scale disruption. Therefore, Rule 1004 requires that an SCI entity's
BC/DR plan that meets the requirements of Rule 1001(a)(2)(v) be tested
for both its functionality and performance as specified by the SCI
entity's BC/DR plan.
---------------------------------------------------------------------------

    \1185\ See infra Section VI.C.2.b.vii (discussing the estimated
costs of adopted Rule 1004).
---------------------------------------------------------------------------

    In addition, several commenters addressed testing more
generally.\1186\ For example, some commenters urged that comprehensive,
industry-wide, end-to-end testing could be enhanced if there were
uniform test tickers supported by the testing infrastructure at all SCI
entities.\1187\ Two commenters urged the establishment of principles
for end-to-end, integrated testing.\1188\ Specifically, one of these
commenters suggested that SCI entities, the Commission, and relevant
third-parties think about how to establish a dedicated environment
where end-to-end testing could be done safely, and where it could
accurately simulate the trading environment.\1189\ This commenter also
suggested that testing plans concentrate on high volume periods, stress
testing common order types, and focusing on securities that generally
experience low liquidity.\1190\ This commenter believed that industry-
wide testing should include derivatives and cross-asset scenarios, and
possibly include some involvement by foreign regulators and markets as
well.\1191\ While the suggestions of these commenters are not
inconsistent with the rule's requirement for functional and performance
testing of BC/DR plans, the Commission has determined not to require
them because the Commission does not believe, at this time, that these
suggestions are necessary in every instance to achieve reliable and
effective BC/DR plans at SCI entities. However, to the extent an SCI
entity believes them to be appropriate for its systems, these
suggestions could be utilized in its BC/DR plans testing.
---------------------------------------------------------------------------

    \1186\ See Tradebook Letter at 1-3; CAST Letter at 9; FIA PTG
Letter at 2; and CoreOne Letter at 3-7.
    \1187\ See Tradebook Letter at 2-3; CAST Letter at 9; and FIA
PTG Letter at 2.
    \1188\ See CoreOne Letter at 3; and Tradebook Letter at 1-3.
    \1189\ See CoreOne Letter at 3.
    \1190\ See id. at 3-4.
    \1191\ See id. at 7.
---------------------------------------------------------------------------

    Importantly, the adopted rule does not prescribe how SCI entities
are to develop plans for functional and performance testing of order
entry, execution, clearance and settlement, order routing, and the
transmission and/or receipt of market data, as applicable, to determine
if these functions can operate as contemplated by SCI entity BC/DR
plans. Thus, as with the proposed requirement, the adopted rule
provides an SCI entity with discretion to determine the precise manner
and content of the BC/DR testing required pursuant to Rule 1004, and
SCI entities have discretion to determine, for example, the duration of
the testing, the sample size of transactions tested, the scenarios
tested, and the scope of the test. Therefore, while comments urging the
creation of uniform test tickers, establishment of principles for end-
to-end testing, mandatory types of test scripts, and cross-asset and
cross-jurisdictional coordination are matters that SCI entities may
wish to consider in implementing the testing required by the rule, the
Commission does not believe it is appropriate to mandate such details
in Regulation SCI. To do so would be more prescriptive than the
Commission believes is appropriate, as this requirement is designed to
provide SCI entities flexibility and discretion in determining how to
meet it. The Commission believes that the adopted testing requirement
will help to improve securities market infrastructure resilience by
helping to ensure not only that an SCI entity can operate following an
event that triggers its BC/DR plans, but also that it can do so with a
greater level of confidence that its core members or participants are
also ready based on experience during testing. The Commission is
adopting Rule 1004(b) substantively as proposed because it gives SCI
entities discretion to develop a test that meets the requirements of
the rule.
    One commenter recommended requiring that each entity be run
entirely under its backup plan at least one day a year for a full
trading day, and that the entire market run off of the backup sites at
least once a year.\1192\ While adopted Rule 1004 would not preclude
this approach, the Commission notes that other commenters disagreed
with the wisdom of it.\1193\ Specifically, one group of commenters
stated that the risks of testing in a ``live production environment on
a periodic basis'' outweigh the benefits.\1194\ Another commenter
stated that requiring SCI entities to operate using their backup
facilities would increase the risk of erroneous quotes and orders
entering the marketplace.\1195\
---------------------------------------------------------------------------

    \1192\ See Angel Letter at 10.
    \1193\ See Joint SROs Letter at 15; and Group One Letter at 2.
    \1194\ See Joint SROs Letter at 15.
    \1195\ See Group One Letter at 2.
---------------------------------------------------------------------------

    After careful consideration of these comments, the Commission has
determined not to prescribe the time of day or week during which
testing shall occur. In addition, the adopted rule does not require an
SCI entity to test its BC/DR plan in live production, but also does not
prohibit an SCI entity from testing its BC/DR plans in live production,
either, if an SCI entity determines such a method of testing to be
appropriate. The Commission continues to believe that SCI entities are
in the best position to structure the details of the test in a way that
would maximize its utility.
    With respect to testing frequency, one commenter agreed with the
proposal that an SCI entity's BC/DR plans, including its backup
systems, be tested ``at least once every 12 months.'' \1196\ One
commenter stated that the rule should explicitly set forth the required
frequency of testing.\1197\ One commenter believed that two coordinated
industry tests per year would be more appropriate.\1198\ One commenter

believed that testing once per year is arbitrary, and suggested that a
risk-based approach might justify testing certain systems with more or
less frequency.\1199\
---------------------------------------------------------------------------

    \1196\ See DTCC Letter at 13
    \1197\ See NYSE Letter at 33.
    \1198\ See FIF Letter at 6.
    \1199\ See MSRB Letter at 24.
---------------------------------------------------------------------------

    The Commission is adopting as proposed the requirement that testing
occur not less than once every 12 months. Although commenters offered
differing views on the appropriate frequency for the required
testing,\1200\ the Commission continues to believe that a testing
frequency of once every 12 months is an appropriate minimum frequency
that encourages regular and focused attention on the establishment of
meaningful and effective testing. In the context of coordinated BC/DR
testing, the Commission believes the key is for testing to occur
regularly enough to offer practical utility in the event of a wide-
scale disruption without imposing undue cost, and that a minimum
frequency of one year achieves this balance. This requirement does not
prevent SCI entities from testing more frequently, but rather is
intended to give SCI entities the flexibility to test their BC/DR
plans, including their backup systems, at more frequent intervals if
they find it appropriate to do so.
---------------------------------------------------------------------------

    \1200\ See supra notes 1196-1199.
---------------------------------------------------------------------------

iv. Industry- or Sector-Wide Coordination--Rule 1004(d)
    Proposed Rule 1000(b)(9)(a)(ii) specified that an SCI entity would
be required to coordinate the testing of BC/DR plans on an industry- or
sector-wide basis with other SCI entities. The Commission received
significant comment on this aspect of the proposal.
    Two commenters supported the coordinated testing requirement.\1201\
Specifically, one of these commenters stated that a coordination
requirement targets an area where technology risks have left the
markets more vulnerable, namely, the complex ways that firms
interact.\1202\ This commenter favored market-wide testing as a way to
better manage that risk.\1203\ This commenter also stated that
coordination is vital because the more SCI entities and member firms
that participate in testing, the more realistic that testing will
be.\1204\ Another commenter noted that one of the most important steps
in validating and maintaining systems integrity is an effective BC/DR
model and urged the Commission to promptly advance a program to
introduce a new and more comprehensive BC/DR testing paradigm.\1205\
---------------------------------------------------------------------------

    \1201\ See Angel Letter at 9; and UBS Letter at 4.
    \1202\ See Angel Letter at 9.
    \1203\ See id.
    \1204\ See id.
    \1205\ See UBS Letter at 4-5. This commenter also stated that
improved BC/DR testing should not be delayed until Regulation SCI is
adopted. See UBS Letter at 5.
---------------------------------------------------------------------------

    In contrast, some commenters opposed the proposed comprehensive,
coordinated testing structure.\1206\ Some commenters stated that
coordinating testing presents significant technological and logistical
challenges that need to be weighed carefully.\1207\ One commenter
stated that coordinated testing is a good aspirational goal, but
expressed concern that too much is outside of the control of an
individual SCI entity, and therefore the rule should, at most, require
SCI entities to attempt to coordinate such testing.\1208\ Another
commenter stated that the fixed-income market is so fragmented that
coordinated testing is difficult to conduct and much less
imperative.\1209\
---------------------------------------------------------------------------

    \1206\ See DTCC Letter at 12-13; FINRA Letter at 37-39; OCC
Letter at 17-18; and ISE Letter at 8.
    \1207\ See LiquidPoint Letter at 4; and SIFMA Letter at 17-18.
See also supra notes 1175-1177 and accompanying text.
    \1208\ See CME Letter at 13.
    \1209\ See TMC Letter at 3.
---------------------------------------------------------------------------

    Some commenters offered suggestions on how to improve the proposed
coordination requirement. One commenter urged that coordination only be
required among providers of singular services in the market (i.e.,
exchanges that list securities, exclusive processors under NMS plans,
and clearing and settlement agencies).\1210\ Some commenters believed
that coordination would work best if it was organized by an entity with
regulatory authority over SCI entities, or by an organization
designated by the Commission to fulfill that role.\1211\ One such
commenter supported coordinating testing through a Commission-approved
plan, provided SCI entities have the right to maintain the
confidentiality of certain critical information.\1212\ Another
commenter recommended that the Commission work with the CFTC to adopt a
coordinated approach to dealing with technology issues across financial
markets, including through participation by derivatives exchanges in
testing alongside their equity markets counterparts.\1213\
---------------------------------------------------------------------------

    \1210\ See Direct Edge Letter at 9.
    \1211\ See DTCC Letter at 13; OCC Letter at 18; and NYSE Letter
at 33.
    \1212\ See NYSE Letter at 33.
    \1213\ See Angel Letter at 12.
---------------------------------------------------------------------------

    After careful consideration of the comments, the Commission has
determined to adopt the coordination requirement as proposed.
Specifically, Rule 1004(d) requires that an SCI entity ``coordinate the
testing of [BC/DR] plans on an industry- or sector-wide basis with
other SCI entities.'' The Commission recognizes that coordinating
industry- or sector-wide testing among SCI entities and their
designated members or participants may present logistical challenges.
Because of these challenges, the Commission does not believe that a
more prescriptive approach is warranted. Instead, the coordination
requirement provides discretion to SCI entities to determine how to
meet it.
    The Commission does not agree with commenters suggesting that the
Commission should assume leadership on the organization of coordinated
testing, designate an organization to fulfill that role, or require a
``Commission-approved plan'' for testing, because it believes at this
time that SCI entities can achieve coordination more quickly and
efficiently without the imposition of a formal procedural framework
that these suggestions would entail.\1214\ In response to comment
suggesting that coordination should be aspirational rather than
required, the Commission believes that, because trading in the U.S.
securities markets today is dispersed among a wide variety of
exchanges, ATSs, and other trading venues, and is often conducted
through sophisticated trading strategies that access many trading
platforms simultaneously, requiring SCI entities to coordinate testing
would result in testing under more realistic market conditions.\1215\
The Commission also continues to believe that it would be more cost-
effective for SCI entity members and participants to participate in
testing of SCI entity BC/DR plans on an industry- or sector-wide basis
than to test with each SCI entity on an individual basis because such
coordination would likely reduce duplicative testing efforts.\1216\ In

addition, if SCI entities that are ``providers of singular services''
in the markets (i.e., which the Commission believes would be synonymous
with SCI entities that are providers of ``critical SCI systems'') lead
coordination efforts on behalf of all SCI entities, such an approach
would not be impermissible under Rule 1004(d), provided all SCI
entities agreed to such an approach.
---------------------------------------------------------------------------

    \1214\ With respect to the suggestion that there be a Commission
approved plan, the Commission notes that Rule 608 of Regulation NMS
is designed to facilitate participation in NMS plans by self-
regulatory organizations, which does not include SCI entities that
are not SCI SROs, including SCI ATSs. The Commission notes that at
least one commenter suggested that the Commission work with the CFTC
to adopt a coordinated approach to testing. But, as discussed above,
the Commission believes that Regulation SCI is an important step to
reduce the risks associated with a decision to activate BC/DR plans.
And, although the Commission may in the future consider additional
initiatives to promote further coordination with the CFTC, in the
Commission's view, this initial step of adopting Regulation SCI
should not be delayed.
    \1215\ See Proposing Release, supra note 13, at 18126.
    \1216\ In response to comment that coordinated BC/DR testing is
not needed in the current fixed-income market, the Commission notes
that it has determined to exclude ATSs trading only municipal
securities or corporate debt securities from the scope of Regulation
SCI. See supra notes 189-192 and accompanying text (discussing the
exclusion of ATSs trading only fixed-income securities from the
definition of SCI ATS).
---------------------------------------------------------------------------

    In response to commenters who more generally expressed concern
about the rule subjecting SCI entity members and participants to
multiple duplicative and costly testing requirements,\1217\ the
Commission notes that the flexibility provided in the adopted
coordination requirement, in tandem with the more focused adopted
mandatory designation requirement should mitigate these concerns. As
discussed above, adoption of a more focused designation requirement
that requires SCI entities to exercise reasonable discretion is likely
to reduce the extent to which SCI entity member or participant
designations overlap and possibly result in a smaller number of SCI
entity members or participants being designated for participation in
testing than as contemplated by the SCI Proposal, and a fewer number of
members or participants designated to participate in testing should
simplify efforts to coordinate testing. However, as some commenters
noted, it remains possible that, despite coordination, some firms that
are members of multiple SCI entities may be designated to participate
in testing with multiple SCI entities at greater cost than if they had
been designated by only one SCI entity, and may be required to test
more than once annually, as this may be necessary for each SCI entity
to meet its obligations under the rule. Though the Commission
recognizes that the possibility of being designated by multiple SCI
entities to participate in the testing of their BC/DR plans may be
costly, the Commission ultimately believes that such a cost is
appropriate to help ensure that the BC/DR plan of each SCI entity is
useful and effective. If, for example, a firm is designated for
mandatory testing by multiple SCI entities, it would be so designated
because each such SCI entity determines that such firm is necessary to
the successful activation of its BC/DR plan. The Commission recognizes
that it is conceivable that a firm that is required to participate in
testing with multiple SCI entities assesses the costs and burdens of
participating in every such test to be too great, and makes its own
business decision to withdraw its membership or participation in one or
more such SCI entities so as to avoid the costs and burdens of such
testing, but believes such scenario to be unlikely. Specifically, the
Commission believes that it is unlikely that a firm determined to be
significant enough to be designated to participate in testing by an SCI
entity (even a smaller SCI entity) would choose to withdraw its
membership or participation in an SCI entity solely because of the
costs and burdens of Regulation SCI's BC/DR testing provisions. The
Commission also believes that such firm is likely to be a larger firm
with greater resources and a significant level of participation in such
SCI entity, and is likely to already be connected to the backup
facility of the SCI SRO that is designating it to test. The Commission
continues to believe that SCI entities are best suited to find the most
efficient and effective manner in which to test its BC/DR plans.\1218\
---------------------------------------------------------------------------

    \1217\ See supra notes 1159-1160 and accompanying text.
    \1218\ See Proposing Release, supra note 13, at 18126.
---------------------------------------------------------------------------

    Furthermore, the Commission is also adopting a longer compliance
period with regard to the industry- or sector-wide coordinated testing
requirement in adopted Rule 1004(d).\1219\ Specifically, SCI entities
will have 21 months from the Effective Date to coordinate the testing
of an SCI entity's business continuity and disaster recovery plans on
an industry- or sector-wide basis with other SCI entities pursuant to
adopted Rule 1004(d). In sum, the Commission believes that Rule 1004,
as adopted, will enhance the resilience of the infrastructure of the
U.S. securities markets.
---------------------------------------------------------------------------

    \1219\ See infra Section IV.F (discussing the delayed
implementation time for adopted Rule 1004(d)).
---------------------------------------------------------------------------

C. Recordkeeping, Electronic Filing on Form SCI, and Access--Rules
1005-1007

    Adopted Rules 1005 through 1007 specify several additional
requirements of Regulation SCI relating to recordkeeping and electronic
filing and submission. As discussed below, the Commission has
determined not to adopt the proposed provision regarding Commission
access to the systems of an SCI entity because the Commission can
adequately assess an SCI entity's compliance with Regulation SCI
through existing recordkeeping requirements and examination authority,
as well as through the new recordkeeping requirement in Rule 1005 of
Regulation SCI.
1. Recordkeeping--Rules 1005-1007
a. Recordkeeping Related to Compliance With Regulation SCI--Rule 1005
    Proposed Rule 1000(c) required SCI SROs to make, keep, and preserve
all documents relating to their compliance with Regulation SCI, as
prescribed in Rule 17a-1 under the Exchange Act. Proposed Rule 1000(c)
required SCI entities other than SCI SROs to: Make, keep, and preserve
at least one copy of all documents relating to their compliance with
Regulation SCI; keep these documents for not less than five years, the
first two years in a place that is readily accessible to the Commission
or its representatives for inspection and examination; and promptly
furnish to Commission representatives \1220\ copies of any of these
documents upon request. Further, proposed Rule 1000(c) provided that,
upon or immediately prior to ceasing to do business or ceasing to be
registered under the Exchange Act, an SCI entity must ensure that the
required records are accessible to the Commission and its
representatives in a manner required by Rule 1000(c) for the remainder
of the period required by Rule 1000(c).
---------------------------------------------------------------------------

    \1220\ As discussed above, the Commission has renamed the ARP
Inspection Program the Technology Controls Program. See supra note
6.
---------------------------------------------------------------------------

    The Commission received one comment letter supporting proposed Rule
1000(c).\1221\ The Commission is adopting Rule 1000(c) as proposed, but
re-designated as Rule 1005.\1222\
---------------------------------------------------------------------------

    \1221\ See MSRB Letter at 25. As discussed above, some
commenters suggested recordkeeping in lieu of certain Commission
reporting requirements. See, e.g., supra note 881 and accompanying
text.
    \1222\ The Commission notes that adopted Rule 1005 replaces the
term ``SCI security systems'' with ``indirect SCI systems'' as
described in more detail in Section IV.A.2.d. Furthermore, internal
cross references to Rules 1000(c)(2)(i) and (c)(2)(ii) in Rule
1000(c)(2)(iii) were updated to paragraphs (b)(1) and (b)(2) of Rule
1005 in accordance with the renumbering of the rule.
---------------------------------------------------------------------------

    As noted in the SCI Proposal, SCI entities are already subject to
recordkeeping requirements,\1223\ but records relating to Regulation
SCI may not be specifically addressed in certain

current recordkeeping rules.\1224\ As adopted, Rule 1005 specifically
addresses recordkeeping requirements for SCI entities with respect to
records relating to Regulation SCI compliance.
---------------------------------------------------------------------------

    \1223\ See, e.g., 17 CFR 240.17a-1, applicable to SCI SROs; 17
CFR 240.17a-3 and 17a-4, applicable to broker-dealers; and 17 CFR
242.301-303, applicable to ATSs.
     It has been the experience of the Commission that SCI entities
presently subject to the ARP Inspection Program (nearly all of whom
are SCI SROs that are also subject to the recordkeeping requirements
of Rule 17a-1(a)) do generally keep and preserve the types of
records that would be subject to the requirements of Rule 1005.
Nevertheless, the Commission continues to believe that Regulation
SCI's codification of these preservation practices will support an
accurate, timely, and efficient inspection and examination process
and help ensure that all types of SCI entities keep and preserve
such records.
    \1224\ See Proposing Release, supra note 13, at 18128.
---------------------------------------------------------------------------

    With respect to SCI SROs, Rule 17a-1(a) under the Exchange Act
requires every national securities exchange, national securities
association, registered clearing agency, and the MSRB to keep and
preserve at least one copy of all documents, including all
correspondence, memoranda, papers, books, notices, accounts, and other
such records as shall be made and received by it in the course of its
business as such and in the conduct of its self-regulatory
activity.\1225\ In addition, Rule 17a-1(b) requires these entities to
keep all such documents for a period of not less than five years, the
first two years in an easily accessible place, subject to the
destruction and disposition provisions of Rule 17a-6.\1226\ Rule 17a-
1(c) requires these entities, upon request of any representative of the
Commission, to promptly furnish to the possession of Commission
representatives copies of any documents required to be kept and
preserved by it pursuant to Rules 17a-1(a) and (b).\1227\ Therefore, as
noted in the SCI Proposal, the breadth of Rule 17a-1 under the Exchange
Act is such that it would require SCI SROs to make, keep, and preserve
records relating to their compliance with Regulation SCI.\1228\ The
Commission continues to believe that it is appropriate to cross-
reference Rule 17a-1 in Rule 1005 to be clear that all SCI entities are
subject to the same recordkeeping requirements regarding compliance
with Regulation SCI. The Commission also continues to believe that it
is appropriate to adopt recordkeeping requirements for SCI entities
other than SCI SROs that are consistent with the recordkeeping
requirements applicable to SROs under Rule 17a-1 under the Exchange
Act. The Commission believes it is important to require such records be
kept at both SCI SROs and SCI entities other than SCI SROs because such
records are essential to understanding whether an SCI entity is meeting
its obligations under Regulation SCI, to assess whether an SCI entity
has appropriate policies and procedures with respect to its technology
systems, to help identify the causes and consequences of an SCI event,
and to understand the types of material systems changes occurring at an
SCI entity.\1229\
---------------------------------------------------------------------------

    \1225\ See 17 CFR 240.17a-1(a). Such records would, for example,
include copies of incident reports and the results of systems
testing.
    \1226\ See 17 CFR 240.17a-1(b). Rule 17a-6(a) under the Exchange
Act states: ``Any document kept by or on file with a national
securities exchange, national securities association, registered
clearing agency or the Municipal Securities Rulemaking Board
pursuant to the Act or any rule or regulation thereunder may be
destroyed or otherwise disposed of by such exchange, association,
clearing agency or the Municipal Securities Rulemaking Board at the
end of five years or at such earlier date as is specified in a plan
for the destruction or disposition of any such documents if such
plan has been filed with the Commission by such exchange,
association, clearing agency or the Municipal Securities Rulemaking
Board and has been declared effective by the Commission.'' 17 CFR
240.17a-6(a).
    \1227\ See 17 CFR 240.17a-1(c).
    \1228\ See Proposing Release, supra note 13, at 18128.
    \1229\ To achieve the goals for which the recordkeeping
requirements are designed, and to comply with the recordkeeping
requirements of Rule 17a-1 and Rule 1005 of Regulation SCI, SCI
entities must ensure that the records that they make, keep, and
maintain are complete and accurate.
---------------------------------------------------------------------------

    Further, as noted above, the definitions of SCI system and indirect
SCI system include systems operated ``on behalf of'' an SCI entity by
third parties. An SCI entity retains legal responsibility for systems
operated on its behalf and, as such, is responsible for producing to
Commission representatives records required to be made, kept, and
preserved under Regulation SCI, even if those records are maintained by
third parties, and the SCI entity is responsible for ensuring that such
third parties produce those requested documents, upon examination or
other request. Accordingly, the Commission believes that an SCI entity
should have processes and requirements in place, such as contractual
provisions with a third party, to ensure that it is able to satisfy the
requirements of Regulation SCI for systems operated on its behalf by a
third party, including the recordkeeping requirements in Rule
1005.\1230\ The Commission believes that if an SCI entity is unable to
ensure compliance with Regulation SCI with regard to third party
systems or recordkeeping, it should reassess its decision to outsource
its systems or recordkeeping.
---------------------------------------------------------------------------

    \1230\ See also Rule 1007, which states that, if records
required to be filed or kept by an SCI entity under Regulation SCI
are prepared or maintained by a service bureau or other
recordkeeping service on behalf of the SCI entity, the SCI entity is
required to ensure that the records are available for review by the
Commission and its representatives by submitting a written
undertaking, in a form acceptable to the Commission, by such service
bureau or other recordkeeping service, signed by a duly authorized
person at such service bureau or other recordkeeping service.
---------------------------------------------------------------------------

    The Commission believes that Rule 1005 will facilitate its
inspections and examinations of SCI entities and assist it in
evaluating an SCI entity's compliance with Regulation SCI. In
particular, Rule 1005 should facilitate Commission examination of SCI
entities by helping to reduce delays in obtaining relevant records
during an examination. Therefore, as noted in the SCI Proposal, the
Commission's ability to examine for, and enforce compliance with,
Regulation SCI could be hampered if an SCI entity were not required to
adequately provide accessibility to its records for the full proposed
retention period.
    Further, while many SCI events may occur, be discovered, and be
resolved in a short time frame, there may be other SCI events that may
not be discovered until months or years after their occurrences, or may
take significant periods of time to fully resolve. In such cases,
having an SCI entity's records available even after it has ceased to do
business or be registered under the Exchange Act would be beneficial.
Because SCI events have the potential to negatively impact trade
execution, price discovery, liquidity, and investor participation, the
Commission believes that its ability to oversee the securities markets
could be undermined if it is unable to review records to determine the
causes and consequences of one or more SCI events experienced by an SCI
entity that deregisters or ceases to do business. This information
should provide an additional tool to help the Commission reconstruct
important market events and better understand how such events impacted
trade execution, price discovery, liquidity, and investor
participation.
b. Service Bureau--Rule 1007
    Proposed Rule 1000(e) required that, if the records required to be
filed or kept by an SCI entity under Regulation SCI were prepared or
maintained by a service bureau or other recordkeeping service on behalf
of the SCI entity, the SCI entity ensure that the records are available
for review by the Commission and its representatives by submitting a
written undertaking, in a form acceptable to the Commission, by such
service bureau or other recordkeeping service and signed by a duly
authorized person at such service bureau or other recordkeeping
service. Further, the written undertaking was required to include an
agreement by the service bureau designed to permit the Commission and
its representatives to examine such records at any time or from time to
time during business hours, and to promptly furnish to the Commission
and its representatives true, correct, and current electronic files in
a form acceptable to the Commission or its representatives or hard
copies of any, all, or any part of such records,

upon request, periodically, or continuously and, in any case, within
the same time periods as would apply to the SCI entity for such
records. Proposed Rule 1000(e) also provided that the preparation or
maintenance of records by a service bureau or other recordkeeping
service would not relieve an SCI entity from its obligation to prepare,
maintain, and provide the Commission and its representatives with
access to such records.
    The Commission did not receive any comments on proposed Rule
1000(e) and is adopting Rule 1000(e) as proposed, but re-designated as
Rule 1007. As noted in the SCI Proposal, Rule 1007 is substantively the
same as the requirement applicable to broker-dealers under Rule 17a-
4(i) of the Exchange Act.\1231\ The Commission continues to believe
that this requirement will help ensure the Commission's ability to
obtain required records that are held by a third party who may not
otherwise have an obligation to make such records available to the
Commission. In addition, the Commission continues to believe that the
requirement that SCI entities obtain from such third parties a written
undertaking will also help ensure that such service bureau or other
recordkeeping service is aware of its obligation with respect to
records relating to Regulation SCI. The Commission believes that this
requirement will help ensure that the Commission has prompt and
efficient access to all required records, including those housed at a
service bureau or any other recordkeeping service.\1232\
---------------------------------------------------------------------------

    \1231\ 17 CFR 240.17a-4(i). See Proposing Release, supra note
13, at 18129.
    \1232\ See 17 CFR 240.17a-4(i) (records preserved or maintained
by a service bureau).
---------------------------------------------------------------------------

2. Electronic Filing and Submission of Reports, Notifications, and
Other Communications--Rule 1006
    Proposed Rule 1000(d) required that, except with respect to
notifications to the Commission made pursuant to proposed Rule
1000(b)(4)(i) (Commission notification of certain SCI events) or oral
notifications to the Commission made pursuant to proposed Rule
1000(b)(6)(ii) (Commission notification of certain material systems
changes), any notification, review, description, analysis, or report to
the Commission required under Regulation SCI be submitted
electronically on Form SCI and include an electronic signature.
Proposed Rule 1000(d) also required that the signatory to an
electronically submitted Form SCI manually sign a signature page or
document, in the manner prescribed by Form SCI, authenticating,
acknowledging, or otherwise adopting his or her signature that appears
in typed form within the electronic filing. This document would be
required to be executed before or at the time Form SCI is
electronically submitted and would be required to be retained by the
SCI entity in accordance with the recordkeeping requirements of
Regulation SCI. The Commission is adopting Rule 1000(d) substantially
as proposed, as discussed below, but re-designated as Rule 1006.
    One commenter supported the electronic submission of Form
SCI.\1233\ One commenter suggested that the Commission should make
clear that Regulation SCI filings do not need to be made in a tagged
data format such as XBRL, which could be costly.\1234\ Another
commenter stated that the electronic signature requirement was
appropriate only if the final rule included a safe harbor for good
faith reporting of SCI events.\1235\ According to this commenter, the
requirement that there be an electronic signature and a manual
signature could put SCI entity personnel at risk if it is later
determined that there were factual errors, omissions, or other flaws in
the initial filing.\1236\
---------------------------------------------------------------------------

    \1233\ See MSRB Letter at 25.
    \1234\ See OTC Markets Letter at 4. See also FINRA Letter at 28.
    \1235\ See Omgeo Letter at 20.
    \1236\ See id.
---------------------------------------------------------------------------

    After consideration of the comments, the Commission is adopting
Rule 1000(d) substantially as proposed, and with updated internal cross
references to reflect revisions to other aspects of Regulation SCI, as
adopted. Specifically, Rule 1006 provides that notifications made
pursuant to Rule 1002(b)(1) (immediate Commission notification of SCI
events) and updates made pursuant to Rule 1002(b)(3) (updates regarding
SCI events) are not required to be filed on Form SCI.\1237\ As noted in
the SCI Proposal, Rule 1006 is intended to provide a uniform manner in
which the Commission would receive--and SCI entities would provide--
written notifications, reviews, descriptions, analyses, or reports made
pursuant to Regulation SCI.\1238\ Rule 1006 should therefore allow SCI
entities to efficiently draft and submit the required reports, and for
the Commission to efficiently review, analyze, and respond to the
information provided.\1239\ In addition, the Commission believes that
filing Form SCI in an electronic format would be less burdensome and
more efficient for SCI entities and the Commission than mailing and
filing paper forms.\1240\ Further, after considering comments regarding
the burden of submitting Form SCI in a tagged data format such as XBRL,
the Commission is not requiring the use of XBRL formatting for Form
SCI. Rather, certain fields in Sections I-III of Form SCI will require
information to be provided by SCI entities in a format that will allow
the Commission to gather information in a structured manner (e.g., the
submission type and SCI event type in Section I), whereas the exhibits
to Form SCI will allow SCI entities to provide narrative responses,
such as through a text format. Further, the Commission also is
specifying that documents filed through the EFFS system must be in a
text-searchable format without the use of optical character
recognition. If, however, a portion of a Form SCI submission (e.g., an
image or diagram) cannot be made available in a text-searchable format,
such portion may be submitted in a non-text-searchable format.\1241\
The Commission believes that requiring documents to be submitted in a
text-searchable format (with the limited exception noted) is necessary
to allow Commission staff to efficiently review and analyze information
provided by SCI entities. In particular, a text-searchable format
allows Commission staff to better gather, analyze and use data
submitted as exhibits, whereas a non-text-searchable format submission
would require significantly more steps and labor to review and analyze
data. The Commission notes that word processing and spreadsheet
applications that are widely used by many businesses, including SCI
entities, generate documents in this format.
---------------------------------------------------------------------------

    \1237\ See supra Section IV.B.3.c (discussing the Commission
notification requirement for SCI events). Adopted Rule 1006 refers
to an electronically ``filed'' Form SCI, rather than an
electronically ``submitted'' Form SCI as proposed in Rule
1000(d)(1). This change clarifies that notices and reports required
to be submitted under Regulation SCI are filings under the Exchange
Act and Regulation SCI. See proposed and adopted 17 CFR 249.1900
(stating that Form SCI shall be used to ``file'' notices and reports
as required by Regulation SCI). See also amended Rule 24b-2
(referring to material ``filed'' in electronic format on Form SCI).
    \1238\ See Proposing Release, supra note 13, at 18129-30.
    \1239\ See id. at 18130.
    \1240\ The Commission will implement Form SCI through the
electronic form filing system (``EFFS'') currently used by SCI SROs
to file Form 19b-4 filings. See Securities Exchange Act Release No.
50486 (October 4, 2004), 69 FR 60287 (October 8, 2004) (adopting the
EFFS for use in filing Form 19b-4). See also Proposing Release,
supra note 13, at 18130.
    \1241\ See General Instructions to Form SCI, Item A.
---------------------------------------------------------------------------

    As noted above, one commenter stated that the electronic signature
requirement was appropriate only if the

final rule included a safe harbor for good faith reporting of SCI
events. The Commission is adopting the electronic signature requirement
as proposed. The Commission notes that, as discussed above in Section
IV.B.3.c, immediate Commission notification following an SCI event and
updates regarding the SCI event may be given orally; the 24-hour
Commission notification is required to be made on a good faith, best
efforts basis; and the final Commission notification is not required
until the resolution of the SCI event and the completion of the SCI
entity's investigation of the SCI event. The Commission also notes that
the purpose of the electronic signature requirement on Form SCI is to
ensure that the person submitting the form to the Commission has been
properly authorized by the SCI entity to submit the form on its
behalf.\1242\ Therefore, the electronic signature requirement would not
put SCI entity personnel at risk if the SCI entity later determines
that there were factual errors, omissions, or other flaws in the
initial filing. As such, the Commission does not agree with the comment
that the electronic signature requirement was appropriate only if the
final rule included a safe harbor for good faith reporting of SCI
events.\1243\
---------------------------------------------------------------------------

    \1242\ Additionally, similar to use of the EFFS in the context
of electronic filing of Form 19b-4, by using a digital ID for each
duly authorized signatory providing an electronic signature, both
the Commission and an SCI entity may be assured of the authenticity
and integrity of the electronic filing of Form SCI. See infra
Section V.D.2.e (noting the necessity of completing a form to gain
access to EFFS).
    \1243\ The same rationale also applies to the requirement for
manual signature in Rule 1006.
---------------------------------------------------------------------------

Amendment To Facilitate Electronic Filing Requirements
    In addition, to permit implementation of Rule 1006,\1244\ the
Commission is adopting an amendment to Rule 24b-2 under the Exchange
Act.\1245\ Rule 24b-2 currently provides confidential treatment
requests and the confidential portion of an electronic filing may be
submitted in paper format only.\1246\ The Commission is amending Rule
24b-2 by amending the rule's preliminary note, and paragraph (b) of the
rule to clarify that under Rule 24b-2, confidential treatment requests
and the confidential portion of an electronic filing may be submitted
in paper format only, unless Rule 24b-2 provides otherwise. The
Commission also is adding a new paragraph (g) to Rule 24b-2 to provide
an electronic means by which an SCI entity may request confidential
treatment of its filings on Form SCI. New paragraph (g) will provide
that an SCI entity's electronic filings on Form SCI pursuant to
Regulation SCI must include any information with respect to which
confidential treatment is requested (``confidential portion''), and
provide that, in lieu of the procedures described in Rule 24b-2b, an
SCI entity may request confidential treatment of all information
submitted on Form SCI by completing Section IV of Form SCI. The
Commission's amendment provides an exception from Rule 24b-2's paper-
only request for confidential treatment for all Form SCI filings, and
specifically permits an SCI entity to electronically request
confidential treatment of all information filed on Form SCI in
accordance with Regulation SCI. The Commission believes that allowing
for electronic submission of confidential treatment requests will
reduce the burden on SCI entities by not requiring a separate paper
submission, and provided the confidential treatment request is properly
made, will expedite Commission review of the requests for confidential
treatment, as all information submitted on Form SCI will be deemed to
be the subject of the request for confidential treatment.
---------------------------------------------------------------------------

    \1244\ See Rule 1006, 17 CFR 242.1006; see also General
Instruction E to Form SCI (requiring Form SCI and exhibits to be
filed electronically under Rule 1006).
    \1245\ 17 CFR 240.24b-2.
    \1246\ See 17 CFR 240.24b-2.
---------------------------------------------------------------------------

    If such a confidential treatment request is properly made, the
Commission will keep the information collected pursuant to Form SCI
confidential to the extent permitted by law.\1247\
---------------------------------------------------------------------------

    \1247\ The Freedom of Information Act (``FOIA'') provides at
least two pertinent exemptions under which the Commission has
authority to withhold certain information. FOIA Exemption 4 provides
an exemption for ``trade secrets and commercial or financial
information obtained from a person and privileged or confidential.''
5 U.S.C. 552(b)(4). FOIA Exemption 8 provides an exemption for
matters that are ``contained in or related to examination,
operating, or condition reports prepared by, on behalf of, or for
the use of an agency responsible for the regulation or supervision
of financial institutions.'' 5 U.S.C. 552(b)(8).
---------------------------------------------------------------------------

3. Access to the Systems of an SCI Entity
    Proposed Rule 1000(f) would have required each SCI entity to
provide Commission representatives reasonable access to its SCI systems
and SCI security systems to assess the SCI entity's compliance with
Regulation SCI.\1248\ In the SCI Proposal, the Commission noted that
the proposed rule would facilitate the access of representatives of the
Commission to such systems of an SCI entity either remotely or on site,
noting, for example, that with such access, Commission representatives
could test an SCI entity's firewalls and vulnerability to
intrusions.\1249\ Further, the Commission noted that the proposed rule
was intended to be consistent with the Commission's current authority
with respect to access to records generally \1250\ and could help
ensure that Commission representatives have ready access to the SCI
systems and SCI security systems of SCI entities in order to evaluate
an SCI entity's practices with regard to the requirements of Regulation
SCI.\1251\ As discussed below, the Commission has determined not to
adopt the proposed requirement because it believes it can achieve the
goal of the proposed rule through its existing recordkeeping
requirements and examination authority, as well as through the new
recordkeeping requirement in Rule 1005 of Regulation SCI.
---------------------------------------------------------------------------

    \1248\ See proposed Rule 1000(f) and Proposing Release, supra
note 13, at Section III.D.3.
    \1249\ See Proposing Release, supra note 13, at 18130.
    \1250\ See Proposing Release, supra note 13, at 18130 (citing
Section 17(b) of the Exchange Act, as well as Sections 11A, 6(b)(1),
15A(b)(2), and 17A(b)(3)(A) of the Exchange Act).
    \1251\ See Proposing Release, supra note 13, at 18130.
---------------------------------------------------------------------------

    Many commenters criticized the SCI Proposal's discussion of the
proposed access requirement as permitting unfettered access by third
parties that could pose significant security risks to an SCI entity's
systems.\1252\ Potential issues identified by commenters included
unauthorized access to confidential information,\1253\ risk and damage
to systems,\1254\ and contractual issues with third party
vendors.\1255\ One commenter stated that the Commission should bear in
mind that access to such highly sensitive environments of SCI entities
carries a duty of care commensurate with the sensitivity of the access
and information involved.\1256\
---------------------------------------------------------------------------

    \1252\ See, e.g., NYSE Letter at 34; BATS Letter at 15; ISE
Letter at 10; MSRB Letter at 25-26; Omgeo Letter at 28-29; SIFMA
Letter at 18-19; FIF Letter at 7; Fidelity Letter at 5-6;
LiquidPoint Letter at 4; ITG Letter at 16; KCG Letter at 20-21;
Joint SROs Letter at 17-18; OCC Letter at 20; UBS Letter at 5;
Tellefsen Letter at 10; and FINRA Letter at 41.
    \1253\ See, e.g., FINRA Letter at 41; and Omgeo Letter at 29.
    \1254\ See, e.g., Omgeo Letter at 29; and ITG Letter at 16.
    \1255\ See, e.g., SIFMA Letter at 19.
    \1256\ See OCC Letter at 20.
---------------------------------------------------------------------------

    While several commenters advocated for the elimination of the
proposed access provision,\1257\ some commenters recommended ways to
refine the proposed requirement while still achieving its goals.\1258\
These

suggestions included: Limiting the category of Commission staff to whom
access could be provided; \1259\ providing the Commission with access
to ``configuration and information flows of the system, instead of
direct access;'' \1260\ providing the Commission with reports and
metrics on systems vulnerabilities rather than direct access; \1261\
requiring only that SCI entities demonstrate for Commission staff their
controls and safeguards and compliance with the rule; \1262\ mandating
training of Commission staff and supervision of Commission staff access
by SCI entity personnel; \1263\ and requiring that an SCI entity's
staff conduct any tests while Commission staff observed, rather than
providing Commission staff with direct access.\1264\ One commenter also
noted that the concept of reasonable access was vague.\1265\ Other
commenters asked that the Commission more clearly prescribe what would
constitute ``reasonable access.'' \1266\ One commenter also recommended
that SCI entities provide an individual contact for a designated
Commission representative to communicate and meet with regarding an SCI
entity's systems.\1267\
---------------------------------------------------------------------------

    \1257\ See, e.g., ITG Letter at 16; and CME Letter at 11.
    \1258\ See, e.g., NYSE Letter at 34; OCC Letter at 20; ISE
Letter at 10; DTCC Letter at 14; CME Letter at 11; Omgeo Letter at
29; Joint SROs Letter at 18; and MSRB Letter at 26.
    \1259\ See, e.g., NYSE Letter at 34.
    \1260\ See NYSE Letter at 34.
    \1261\ See, e.g., ISE Letter at 10; DTCC Letter at 14; OCC
Letter at 20; and CME Letter at 11.
    \1262\ See, e.g., Omgeo Letter at 28-29; and DTCC Letter at 14.
    \1263\ See MSRB Letter at 26.
    \1264\ See OCC Letter at 20.
    \1265\ See, e.g., ITG Letter at 16.
    \1266\ See, e.g., MSRB Letter at 26; Joint SROs Letter at 18;
and FINRA Letter at 41.
    \1267\ See SIFMA Letter at 19.
---------------------------------------------------------------------------

    A few commenters also questioned whether the proposed access
requirement is authorized by Section 17(b) or Section 11A of the
Exchange Act, as stated in the SCI Proposal.\1268\ Other commenters
considered the proposed access requirement unnecessary and questioned
the Commission's justification for needing this authority.\1269\
Another commenter pointed out that this type of access is authorized by
other sections of the Exchange Act and an additional provision in
Regulation SCI is redundant.\1270\
---------------------------------------------------------------------------

    \1268\ See NYSE Letter at 34; BATS Letter at 15; and CME Letter
at 11.
    \1269\ See FINRA Letter at 41; BATS Letter at 15; Omgeo Letter
at 28-29; and Fidelity Letter at 5.
    \1270\ See Angel Letter at 18.
---------------------------------------------------------------------------

    After consideration of the views of commenters, the Commission has
determined not to adopt the proposed reasonable access provision
because it believes it can achieve its goals through existing
recordkeeping requirements and its examination authority, as well as
through the new recordkeeping requirement in Rule 1005 of Regulation
SCI. As discussed in the SCI Proposal, the reasonable access provision
was designed to help ensure that the Commission was able to evaluate an
SCI entity's practices with regard to the requirements of proposed
Regulation SCI.\1271\ The Commission believes that it can adequately
assess an SCI entity's compliance with Regulation SCI through its
authority provided by existing provisions of the Exchange Act and rules
thereunder, as well as through the additional recordkeeping provisions
being adopted today in Rule 1005 of Regulation SCI, as described above.
In this regard, as discussed above, Section 17(a) of the Exchange Act
provides the Commission with the authority to adopt recordkeeping
rules, and the breadth of Rule 17a-1 thereunder is such that it would
require SCI SROs to make, keep, and preserve records relating to their
compliance with Regulation SCI, including records produced by SCI
systems and indirect SCI systems.\1272\ Further, adopted Rule 1005
specifically imposes requirements on each SCI entity (other than SCI
SROs) to, among other things: Make, keep, and preserve at least one
copy of all documents relating to its compliance with Regulation SCI;
keep all such documents for a period of not less than five years, the
first two years in a place that is readily accessible to the Commission
or its representatives for inspection and examination; and upon request
of any representative of the Commission, promptly furnish to the
possession of such representative copies of any documents required to
be kept and preserved by it pursuant to Rules 1005(b)(1) and (2).\1273\
The Commission also notes that Section 17(b) of the Exchange Act
authorizes the Commission to conduct reasonable periodic, special, or
other examinations of all records maintained by the entities described
in Section 17(a).\1274\ These examinations can be conducted ``at any
time, or from time to time,'' as the Commission ``deems necessary or
appropriate in the public interest, for the protection of investors, or
otherwise in furtherance of the purposes of [the Exchange Act].''
\1275\
---------------------------------------------------------------------------

    \1271\ See Proposing Release, supra note 13, at 18130.
    \1272\ See supra note 1251 and accompanying text.
    \1273\ See supra Section IV.C.1 (discussing recordkeeping
requirements of adopted Rule 1005). As noted above, the
recordkeeping requirements also extend to records of third parties.
Specifically, an SCI entity is responsible for producing to
Commission representatives records required to be made, kept, and
preserved under Regulation SCI, even if those records are maintained
by third parties, and the SCI entity is responsible for ensuring
that such third parties produce those requested documents, upon
examination or other request. See id.
    \1274\ See Section 17(b) of the Exchange Act, 15 U.S.C. 78q(b).
    \1275\ Id.
---------------------------------------------------------------------------

    Taken together, the Commission believes that these provisions
afford the Commission the authority and ability to assess SCI entities'
compliance with the requirements of Regulation SCI, rendering the
adoption of a reasonable access provision unnecessary. Pursuant to this
authority, in some circumstances, the Commission's assessment of an SCI
entity's compliance may require appropriate access to certain SCI
systems in coordination with the relevant SCI entity. In particular,
the Commission's ability to assess the accuracy and completeness of an
SCI entity's records with regard to Regulation SCI, including the
written policies and procedures established and maintained pursuant to
Rule 1001 and the report of the SCI review prepared in accordance with
Rule 1003(b), and to evaluate whether SCI entities are otherwise
complying with Regulation SCI, may necessitate the observation of SCI
systems and indirect SCI systems by Commission representatives.\1276\
---------------------------------------------------------------------------

    \1276\ The Commission notes that, under the ARP Inspection
Program, such access has been routinely requested by Commission
staff and provided by ARP entities.
---------------------------------------------------------------------------

    The Commission believes that such access would not require an SCI
entity to agree to remote or direct access by Commission personnel to
an SCI entity's systems, such as by permitting Commission staff to run
tests or use system scanning tools on its SCI systems or indirect SCI
systems. Rather, as suggested by some commenters, access would entail
allowing Commission staff to observe the SCI entity's SCI systems and
indirect SCI systems with appropriate safeguards, including through
systems demonstrations for Commission staff performed by the SCI entity
and running tests on an SCI system with Commission staff onsite to
observe.\1277\ The Commission believes that such access does not raise
the potential security risks posed by unrestricted third party access
to SCI systems.\1278\
---------------------------------------------------------------------------

    \1277\ See supra notes 1262 and 1264 and accompanying text.
    \1278\ The Commission believes that the elimination of the
proposed reasonable access provision addresses the other comments on
this provision.
---------------------------------------------------------------------------

D. Form SCI

    Pursuant to proposed Rule 1000(d), subject to certain exceptions,
notices, reports, and other information required

to be provided to the Commission under Regulation SCI would have been
required to be submitted electronically through the EFFS on proposed
Form SCI.\1279\ Proposed Form SCI included detailed instructions
regarding the specific information that SCI entities would have been
required to submit to the Commission. After careful consideration of
comments, the Commission is adopting Form SCI with certain
modifications, as further discussed below. These modifications to
proposed Form SCI correspond to the changes to the Commission
notification and reporting requirements as adopted, each of which is
discussed in greater detail above.\1280\
---------------------------------------------------------------------------

    \1279\ Proposed Rule 1000(d) provided exceptions for
notifications under proposed Rule 1000(b)(4)(i) and oral
notifications pursuant to proposed Rule 1000(b)(6)(ii).
    \1280\ See supra Sections IV.B.3.c, IV.B.4, and IV.B.5
(discussing the reporting requirements of the adopted regulation).
See also supra Section IV.B.6 (discussing the business continuity
and disaster recovery plans testing requirement for SCI entity
members or participants, and elimination of the proposed Commission
notification requirement related to member or participation
designations).
---------------------------------------------------------------------------

    Adopted Rule 1006 provides that, except with respect to
notifications to the Commission made pursuant to Rule 1002(b)(1) or
updates to the Commission made pursuant to Rule 1002(b)(3), all
notifications, reviews, descriptions, analyses, or reports to the
Commission required to be submitted under Regulation SCI must be filed
electronically on Form SCI. Form SCI solicits information through a
series of questions designed to elicit short-form answers, but also
requires SCI entities to provide information and/or reports in
narrative form by attaching specified exhibits. All filings on Form SCI
require that an SCI entity identify itself and indicate the basis for
submitting the form. Specifically, an SCI entity would indicate on the
form the specific type of submission it is making: A notification
regarding an SCI event pursuant to Rule 1002(b)(2); a final report or
interim status report regarding an SCI event pursuant to Rule
1002(b)(4); a quarterly report on de minimis systems disruptions and de
minimis systems intrusions pursuant to Rule 1002(b)(5)(ii); a quarterly
report of material systems changes pursuant to Rule 1003(a)(1); a
supplemental report of material system changes pursuant to Rule
1003(a)(2); or a submission of the report of an SCI review, together
with any response by senior management, pursuant to Rule 1003(b)(3). In
addition, Form SCI permits, but does not require, SCI entities to
utilize the form to submit initial notifications of SCI events pursuant
to Rule 1002(b)(1), as well as updates regarding SCI events pursuant to
Rule 1002(b)(3). Moreover, if an SCI entity decides to withdraw a
previously submitted Form SCI, it would complete page 1 of Form SCI and
select the appropriate check box to indicate the withdrawal. A filing
on Form SCI also requires that an SCI entity provide additional
information on attached exhibits, as discussed below. Because Form SCI
is a report that is required to be filed under the Exchange Act and
Regulation SCI, it is unlawful for any person to willfully or knowingly
make, or cause to be made, a false or misleading statement with respect
to any material fact in Form SCI.\1281\
---------------------------------------------------------------------------

    \1281\ See, e.g., Section 32(a) of the Exchange Act, 15 U.S.C.
78ff(a).
---------------------------------------------------------------------------

    Several commenters addressed the information required by Form SCI
as well as the submission process for the form. One commenter asked a
number of questions on how the submission process would work in
practice, including: (i) Whether the form would be rejected by the
Commission if information was missing; (ii) whether the Commission
would deem it a failure to comply with Regulation SCI if a Form SCI is
rejected for incompleteness and the SCI entity is unable to resubmit
within the applicable reporting time frame; (iii) how SCI entities
would update or correct information previously submitted on Form SCI;
(iv) will the EFFS system be available for Form SCI submissions during
non-business hours and whether there is an alternative means to submit
notifications if the EFFS system is down or unavailable; (v) who at the
Commission would be reviewing submissions and whether they would be
familiar with technical jargon; and (vi) whether the SCI entities will
be expected to attach documentation supporting the descriptions
provided in the exhibits.\1282\ The commenter also expressed several
concerns, including: (i) The amount of time it would take SCI entities
to master the new submission process for proposed Form SCI and
suggested a delayed implementation or transition period; (ii) that the
form could encourage SCI entities to guess where they are missing
information if a form could be rejected for incomplete information;
(iii) that a submission that needs to be updated or corrected would not
be considered timely filed; (iv) that the updating procedure could
become burdensome if the SCI entity needed to explain the reason for
any changes to information previously provided; and (v) that
submissions would be more burdensome if technical notifications and
reports needed to be translated into plain English.\1283\ Another
commenter requested that the electronic filing system that the
Commission puts in place to receive Form SCI submissions be made
available on weekends and outside normal business hours.\1284\ This
commenter also suggested that the Commission remain open to changes to
Form SCI as it and SCI entities gain experience with the use of Form
SCI and that the Commission should work with SCI entities to test the
electronic submission system to ensure its operational
capability.\1285\
---------------------------------------------------------------------------

    \1282\ See FINRA Letter at 28-30.
    \1283\ See id.
    \1284\ See MSRB Letter at 19, 25. See also FINRA Letter at 29
(questioning whether the EFFS system would be available during non-
business hours for Form SCI submissions).
    \1285\ See MSRB Letter at 25-26.
---------------------------------------------------------------------------

    The Commission has considered these comments and has addressed many
of the issues raised by commenters by revising the substantive
requirements of adopted Rules 1002 and 1003, as well as making certain
changes to the adopted form. With respect to a commenter's question
regarding whether a Form SCI would be rejected if information was
missing,\1286\ as stated in the General Instructions for Form SCI, an
SCI entity must provide all information required by the form, including
the exhibits. The General Instructions for Form SCI also state that a
filing that is incomplete or similarly deficient may be returned to the
SCI entity, and any filing so returned will be deemed not to have been
filed with the Commission.\1287\ In response to the commenter who
expressed concern that a submission that needed to be updated or
corrected would not be considered timely filed, the Commission notes
that an SCI entity is responsible for submitting a complete and correct
Form SCI within the time period specified in the relevant provisions
under Regulation SCI.\1288\ At the same time, the Commission notes

that, while the SCI event notification under Rule 1002(b)(2) is
required to be provided within 24 hours of any responsible SCI
personnel having a reasonable basis to conclude that an SCI event
occurred, information for such notifications is only required to be
provided on a good faith, best efforts basis. For other types of
notifications and reports required to be submitted on Form SCI, SCI
entities have more time to prepare such submission, and to ensure that
the information provided is complete and correct.
---------------------------------------------------------------------------

    \1286\ See supra note 1282 and accompanying text.
    \1287\ While the Commission has the ability to reject a Form SCI
filing, the Commission notes that the Form SCI submission process is
different from the Form 19b-4 filing process. Specifically, SCI
entities file Form SCI to provide notification to the Commission
regarding SCI events and material systems changes, and reports of
SCI reviews. On the other hand, SROs file Form 19b-4 for immediately
effective rule changes or to seek Commission approval of rule
changes. Therefore, the process for rejecting a Form 19b-4 filing
does not apply to Form SCI submissions.
    \1288\ With respect to a commenter's concern that SCI entities
may have to guess where information is missing if a form could be
rejected for incomplete information, the Commission intends there to
be communication between Commission staff and SCI entity personnel
in instances where a Form SCI is rejected to discuss the information
missing in the submission and anything else necessary to comply with
the form requirements. See supra note 1283 and accompanying text.
---------------------------------------------------------------------------

    With respect to a commenter's question regarding how SCI entities
would update or correct information previously submitted on Form SCI,
the Commission notes that the rules under Regulation SCI already
provide for updates for many of the Form SCI submissions. Specifically,
Rule 1002(b)(2) requires certain information to be submitted on a good
faith, best efforts basis within 24 hours of any responsible SCI
personnel having a reasonable basis to conclude that an SCI event has
occurred. Rule 1002(b)(3) requires SCI entities to provide updates
regarding SCI events until the SCI event is resolved and the SCI
entity's investigation of the SCI event is closed.\1289\ As such, SCI
entities may use the updates under Rule 1002(b)(3) to correct or update
previously submitted information. Also, Rule 1003(a)(2) requires SCI
entities to submit supplemental reports to notify the Commission of any
material error in or material omission from a previously submitted
material systems change report.
---------------------------------------------------------------------------

    \1289\ As discussed in detail in Section IV.B.3.c above, Rule
1002(b)(3) allows SCI entities to discuss the update with Commission
staff orally, rather than by completing the form, although an SCI
entity may use Form SCI if it chooses to do so. To the extent an SCI
entity chooses to utilize the form for such updates, the written
updates can facilitate the Commission's tracking and assessment of
SCI events.
---------------------------------------------------------------------------

    With respect to the Form SCI submissions where the rules do not
specifically provide for updates (i.e., SCI event notifications under
Rule 1002(b)(4), quarterly SCI event notifications under Rule
1002(b)(5), report of SCI reviews under Rule 1003(b)(3)), if an SCI
entity discovers that a previously submitted Form SCI must be corrected
or updated, the SCI entity should contact Commission staff as it
corrects or updates the prior submission. In addition, an SCI entity
will be able to withdraw and re-submit a previously submitted Form
SCI.\1290\ However, as noted above, an SCI entity is responsible for
submitting a complete and correct Form SCI within the time period
specified in the relevant provisions under Regulation SCI.\1291\
---------------------------------------------------------------------------

    \1290\ See General Instructions to Form SCI, Item F.
    \1291\ As noted above, one commenter expressed concern that an
updating procedure could become burdensome if the SCI entity needs
to explain the reason for any changes to information previously
provided. See supra note 1283 and accompanying text. The Commission
notes that, with respect to rules under Regulation SCI that require
updates, those rules specify the information that is required to be
contained in an update, and do not require an explanation of the
reason for the update. With respect to the Form SCI submissions
where the rules do not specifically provide for updates, as noted
above, the SCI entity can contact Commission staff as the SCI entity
corrects or updates the prior submission.
---------------------------------------------------------------------------

    In addition, in response to comments,\1292\ the Commission notes
that Form SCI does not require SCI entities to attach documentation
supporting the descriptions in the exhibits, although SCI entities will
be able to do so if they so choose by attaching the documentation as
part of the relevant exhibit. Moreover, in response to the commenter
who asked who at the Commission would be reviewing submissions and
whether they would be familiar with technical jargon, the Commission
notes that appropriate Commission staff from different offices or
divisions with the necessary expertise to understand the Form SCI
submission will review it depending on the nature of the submission
(i.e., legal or technical), and thus, it is not necessary for SCI
entities to translate technical jargon into plain English.
---------------------------------------------------------------------------

    \1292\ See supra notes 1282-1283 and accompanying text.
---------------------------------------------------------------------------

    In response to the commenter who expressed concern as to the amount
of time it would take SCI entities to master the Form SCI submission
process and suggested delayed implementation, the Commission believes
that, by utilizing the EFFS system currently used by many SROs for Rule
19b-4 and Rule 19b-7 filings, it will allow for a quicker and smoother
implementation of the Form SCI submission process for certain SCI
entities, and allow the Commission to apply its experience with EFFS to
facilitate the submissions of notifications and reports required by
Regulation SCI. Nevertheless, the Commission notes that it is delaying
the date for compliance with Regulation SCI, as discussed in Section
IV.F below. The Commission does not expect that the Form SCI submission
process will require substantial time for SCI entities to master and
the delayed date for compliance with Regulation SCI provides SCI
entities with more time to learn and adopt it.
    With respect to commenters' question regarding whether the EFFS
system will be available during non-business hours and whether there is
an alternative means to submit notifications if the EFFS system is down
or unavailable,\1293\ the Commission notes that, as is the case with
Rule 19b-4 and Rule 19b-7 filings, EFFS is available 24 hours a day. If
EFFS becomes unavailable for a period of time, the Commission
recognizes that SCI entities will not be able to submit any required
notifications during that time period, and the Commission would expect
the SCI entities to file any required notifications promptly once it
becomes available. In response to the commenter who suggested that the
Commission remain open to changes to Form SCI and that the Commission
work with SCI entities to test the electronic submission system to
ensure its operational capability, the Commission expects, as it has
done with the SRO rule filing process, to periodically evaluate the
effectiveness of the submission process for Form SCI, as well as the
form itself, and may consider improvements in the future as
appropriate.\1294\ The Commission also notes that it expects, prior to
the compliance date, that its staff will provide materials to SCI
entities regarding the operation of the electronic filing system to
submit Forms SCI. Furthermore, the Commission will perform internal
testing to help ensure the operational capability of EFFS prior to the
compliance date.
---------------------------------------------------------------------------

    \1293\ See supra notes 1282, 1284 and accompanying text.
    \1294\ See supra note 1285 and accompanying text.
---------------------------------------------------------------------------

1. Notice of SCI Events Pursuant to Rule 1002(b)
    Proposed Rule 1000(b)(4) would have required each SCI entity to
submit certain information regarding SCI events to the Commission using
proposed Form SCI.\1295\ The Commission is adopting proposed Rule
1000(b)(4) as Rule 1002(b) with certain modifications, which are
discussed above in Section IV.B.3.c.
---------------------------------------------------------------------------

    \1295\ Proposed Rule 1000(d) provided an exception for
notifications under proposed Rule 1000(b)(4)(i).
---------------------------------------------------------------------------

    With respect to Commission notifications under Rule 1002, adopted
Form SCI requires an SCI entity to provide the following information in
a short, standardized format: (i) Whether the Commission has previously
been notified of the SCI event pursuant to Rule 1002(b)(1); (ii) the
type of submission (i.e., an initial notification pursuant to Rule
1002(b)(1), a notification pursuant to Rule 1002(b)(2), an update
pursuant to Rule 1002(b)(3), a final report pursuant to Rule
1002(b)(4), or an interim status report

pursuant to Rule 1002(b)(4)); (iii) the type(s) of SCI event (i.e.,
systems compliance issue, systems disruption, or systems intrusion);
\1296\ (iv) the date/time the SCI event occurred; (v) the duration of
the SCI event; (vi) when responsible SCI personnel had a reasonable
basis to conclude that an SCI event occurred; (vii) whether the SCI
event has been resolved and, if so, the date/time of resolution; (viii)
whether the SCI entity's investigation of the SCI event is closed and,
if so, the date of closure; (ix) the estimated number of market
participants potentially impacted by the SCI event; (x) whether the SCI
event is a major SCI event; (xi) the types of systems impacted (i.e.,
trading, clearance and settlement, order routing, market data, market
regulation, market surveillance, or indirect SCI systems) and the name
of such system(s); and (xii) whether any critical SCI system(s) are
impacted by the SCI event and, if so, the types of such critical SCI
systems (i.e., systems that directly support functionality relating to:
Clearance and settlement systems of clearing agencies; openings,
reopenings, and closings on the primary listing market; trading halts;
initial public offerings; the provision of consolidated market data;
exclusively listed securities; or systems that provide functionality to
the securities markets for which the availability of alternatives is
significantly limited or nonexistent and without which there would be a
material impact on fair and orderly markets) and a description of such
systems.
---------------------------------------------------------------------------

    \1296\ Some SCI events may meet the definition of more than a
single SCI event type, and the form permits SCI entities to check
one, two, or all three SCI event types.
---------------------------------------------------------------------------

    If an SCI entity chooses to utilize Form SCI to submit an initial
notification required by Rule 1002(b)(1), an SCI entity will be able to
submit a short description of the SCI event, and be allowed to attach
documents regarding such SCI event as part of Exhibit 6 of Form SCI if
the SCI entity chooses to do so.
    For a notification required by Rule 1002(b)(2), in addition to
providing the applicable standardized information on Form SCI as
discussed above, an SCI entity is required to submit an Exhibit 1. An
SCI entity is required to provide the following information on a good
faith, best efforts basis in the Exhibit 1: (i) A description of the
SCI event, including the system(s) affected; and (ii) to the extent
available as of the time of notification, the SCI entity's current
assessment of the types and number of market participants potentially
affected by the SCI event; the potential impact of the SCI event on the
market; a description of the steps the SCI entity has taken, is taking,
or plans to take, with respect to the SCI event; the time the SCI event
was resolved or timeframe within which the SCI event is expected to be
resolved; and any other pertinent information known by the SCI entity
about the SCI event.
    If an SCI entity chooses to utilize Form SCI to submit an update
required by Rule 1002(b)(3), an SCI entity will be able to submit a
short description of the update, and be allowed to attach documents
regarding such update as part of Exhibit 6 of Form SCI if the SCI
entity chooses to do so.
    For a submission required by Rule 1002(b)(4), in addition to
providing the applicable standardized information on Form SCI as
discussed above, adopted Form SCI also requires an SCI entity to
indicate if it is a final report or an interim status report and submit
an Exhibit 2. If an SCI event is resolved and the SCI entity's
investigation of the SCI event is closed within 30 calendar days of the
occurrence of the SCI event, an SCI entity must file a final report
under Rule 1002(b)(4)(i)(A) within five business days after the
resolution of the SCI event and closure of the investigation regarding
the SCI event. However, if an SCI event is not resolved or the SCI
entity's investigation of the SCI event is not closed within 30
calendar days of the occurrence of the SCI event, an SCI entity must
file an interim status report under Rule 1002(b)(4)(i)(B)(1) within 30
calendar days after the occurrence of the SCI event. For SCI events in
which an interim status report is required to be filed, an SCI entity
must file a final report under Rule 1002(b)(4)(i)(B)(2) within five
business days after the resolution of the SCI event and closure of the
investigation regarding the SCI event. For any submission required by
Rule 1002(b)(4), an SCI entity is required to provide the following
information in the Exhibit 2: (i) A detailed description of: The SCI
entity's assessment of the types and number of market participants
affected by the SCI event; the SCI entity's assessment of the impact of
the SCI event on the market; the steps the SCI entity has taken, is
taking, or plans to take, with respect to the SCI event; the time the
SCI event was resolved; the SCI entity's rule(s) and/or governing
document(s), as applicable, that relate to the SCI event; and any other
pertinent information known by the SCI entity about the SCI event; (ii)
a copy of any information disseminated pursuant to Rule 1002(c) by the
SCI entity to date regarding the SCI event to any of its members or
participants; and (iii) an analysis of parties that may have
experienced a loss, whether monetary or otherwise, due to the SCI
event, the number of such parties, and an estimate of the aggregate
amount of such loss. As noted above, if an SCI entity submits an
interim written notification under Rule 1000(b)(4)(i)(B), the SCI
entity is required to provide the information specified in Exhibit 2,
but only to the extent known at the time. The SCI entity is also
required to subsequently submit a final report under Rule
1000(b)(4)(i)(B) and provide all the information specified in Exhibit
2.
    Rule 1002(b)(5) states that the Commission notification
requirements under Rules 1002(b)(1)-(4) do not apply to any SCI event
that has had, or the SCI entity reasonably estimates would have, no or
a de minimis impact on the SCI entity's operations or on market
participants. Rule 1002(b)(5)(i) instead requires that an SCI entity
make, keep, and preserve records relating to all such SCI events and
Rule 1002(b)(5)(ii) requires an SCI entity to submit to the Commission
quarterly reports containing a summary description of such de minimis
systems disruptions and de minimis systems intrusions. For a quarterly
report required by Rule 1002(b)(5), an SCI entity is required to
indicate the end date of the applicable calendar quarter for which the
report is being submitted. The SCI entity is also required to submit an
Exhibit 3, containing a summary description of such de minimis systems
disruptions and de minimis systems intrusions, including the SCI
systems and, for systems intrusions, the indirect SCI systems, affected
by such de minimis systems disruptions and de minimis systems
intrusions during the applicable calendar quarter.
2. Notices of Material Systems Changes Pursuant to Rule 1003(a)
    Proposed Rule 1000(b)(6) would have required an SCI entity to
provide advance Commission notifications of material systems changes.
Proposed Rule 1000(b)(8)(ii) would have required an SCI entity to
submit to the Commission semi-annual reports on material systems
changes. As discussed in detail in Section IV.B.4 above, many
commenters were critical of the proposed reporting framework with
respect to material systems changes, including the 30-day advance
notification procedure. After considering the views of commenters, the
Commission is not adopting the 30-day advance notification requirement
or the semi-annual reporting requirement

for material systems changes. Rather, an SCI entity is required to
submit quarterly reports for material systems changes under Rule
1003(a)(1). An SCI entity is also required under Rule 1003(a)(2) to
promptly submit a supplemental report notifying the Commission of a
material error in or material omission from a report previously
submitted under Rule 1003(a).
    One commenter raised a concern that an advance notification could
be rejected by the Commission for inadequate description and result in
a delay to a planned systems change.\1297\ As noted above in Section
IV.B.4, the Commission is adopting a quarterly reporting system that
does not require the advanced notification of individual planned
material systems changes required by proposed Rule 1000(b)(6). The
adopted framework is intended to keep the Commission and its staff
apprised of systems changes at SCI entities while reducing the burdens
related to notifying the Commission of such changes and allowing for
the various types of development processes used by SCI entities
(including agile development processes). Also, as noted above in
Section IV.B.4, Regulation SCI does not provide for a new review or
approval process for SCI entities' material systems changes. As such,
Commission staff will not use material systems change reports to
require any approval of prospective systems changes in advance of their
implementation pursuant to any provision of Regulation SCI, or to delay
implementation of material systems changes pursuant to any provision of
Regulation SCI.\1298\
---------------------------------------------------------------------------

    \1297\ See SIFMA Letter at 16.
    \1298\ At the same time, the Commission notes that the General
Instructions for Form SCI state that a filing that is incomplete or
similarly deficient may be returned to the SCI entity, and any
filing so returned will be deemed not to have been filed with the
Commission.
---------------------------------------------------------------------------

    For a notification required by Rule 1003(a) (including supplemental
reports under Rule 1003(a)(2)), an SCI entity is required to indicate
the end date of the applicable calendar quarter for which the report is
being submitted and submit an Exhibit 4. For a notification required by
Rule 1003(a)(1), Exhibit 4, is required to contain a description of
completed, ongoing, and planned material changes to its SCI systems and
the security of its indirect SCI systems, during the prior, current,
and subsequent calendar quarters, including the dates or expected dates
of commencement and completion. For a notification required by Rule
1003(a)(2), Exhibit 4 is required to contain the supplemental report of
a material error in or material omission from a report previously
submitted under Rule 1003(a)(1).\1299\
---------------------------------------------------------------------------

    \1299\ See General Instructions to Form SCI, Item C.
---------------------------------------------------------------------------

3. Reports of SCI Reviews Pursuant to 1003(b)
    Proposed Rule 1000(b)(8)(i) would have required an SCI entity to
submit to the Commission a report of the SCI review required by
proposed Rule 1000(b)(7), together with any response by senior
management, within 60 calendar days after its submission to senior
management of the SCI entity. As discussed above in Section IV.B.5, the
Commission is adopting this Commission reporting requirement as
proposed. There were no comments on proposed Form SCI with respect to
reports of SCI reviews.
    For a notification required by Rule 1003(b), an SCI entity is
required to indicate on Form SCI the date of completion of the SCI
review and the date of submission of the SCI review to the SCI entity's
senior management. An SCI entity is also required to submit an Exhibit
5, containing the report of the SCI review that was submitted to the
SCI entity's senior management, along with any response to the report
by senior management.\1300\
---------------------------------------------------------------------------

    \1300\ As discussed in Section IV.B.5, the SCI review would
contain: (1) A risk assessment with respect to SCI systems and
indirect SCI systems of an SCI entity; and (2) an assessment of
internal control design and effectiveness of SCI systems and
indirect SCI systems to include logical and physical security
controls, development processes, and information technology
governance, consistent with industry standards.
---------------------------------------------------------------------------

4. Notification of Member or Participant Designation Standards and List
of Designees
    Proposed Rule 1000(b)(9) would have required an SCI entity to
notify the Commission of its members or participants that have been
designated for business continuity and disaster recovery plans testing,
as well as the standards for such designation. Proposed Rule 1000(b)(9)
would have also required SCI entities to promptly update such
notification after any changes to its list of designees or standards
for designation. As discussed above in Section IV.B.6, the Commission
is not adopting these Commission notification requirements.
5. Other Information and Electronic Signature
    Proposed Form SCI would have required an SCI entity to provide the
Commission with contact information for the systems personnel,
regulatory personnel, and senior officer responsible for addressing an
SCI event, including the name, title, telephone number, and email
address of such persons. Proposed Form SCI would also have given the
SCI entity an option to provide contact information for an additional
systems personnel and regulatory personnel. Finally, proposed Form SCI
would have required an electronic signature to help ensure the
authenticity of the Form SCI submission.
    Adopted Form SCI more generally requires an SCI entity to provide
contact information for a person who is prepared to respond to
questions for a particular submission. Form SCI continues to require an
electronic signature to help ensure the authenticity of the Form SCI
submission. The Commission believes that these requirements will
expedite communications between Commission staff and SCI entities,
because they will help identify the person or persons responsible for
communicating with Commission staff about an SCI event even though one
or more other persons may be responsible for addressing and resolving
the SCI event, and also help ensure that only authorized personnel at
each SCI entity submit filings required by adopted Regulation SCI.

E. Other Comments Received

1. Applying Regulation SCI to Security-Based Swap Data Repositories and
Security-Based Swap Execution Facilities
    As noted in the SCI Proposal, on July 21, 2010, the President
signed the Dodd-Frank Act into law.\1301\ The Dodd-Frank Act was
enacted, among other things, to promote the financial stability of the
United States by improving the accountability and transparency of the
nation's financial system.\1302\ Title VII of the Dodd-Frank Act
provides the Commission and the CFTC with the authority to regulate
over-the-counter derivatives.
---------------------------------------------------------------------------

    \1301\ The Dodd-Frank Wall Street Reform and Consumer Protection
Act (Pub. L. 111-203, H.R. 4173) (``Dodd-Frank Act'').
    \1302\ See Dodd-Frank Act Preamble.
---------------------------------------------------------------------------

    In particular, as noted in the SCI Proposal, Section 763 of the
Dodd-Frank Act amends the Exchange Act by adding new statutory
provisions to govern the regulation of various entities, including
security-based swap data repositories (``SB SDRs'') and security-based
swap execution facilities (``SB SEFs'').\1303\

Under the authorities of Section 13(n) of the Exchange Act, applicable
to SB SDRs, and Section 3D(d) of the Exchange Act, applicable to SB
SEFs, the Commission proposed rules for these entities with regard to
their automated systems' capacity, resiliency, and security.\1304\ In
the SB SDR Proposing Release and the SB SEF Proposing Release,
respectively, the Commission proposed Rule 13n-6 and Rule 822 under the
Exchange Act, which would set forth the requirements for these entities
with regard to their automated systems' capacity, resiliency, and
security. In each release, the Commission stated that it was proposing
standards comparable to the standards applicable to SROs, including
exchanges and clearing agencies, and other registrants, pursuant to the
Commission's ARP standards.\1305\ The SCI Proposal described in detail
the SB SDR and SB SEF proposals relating to systems' capacity,
resiliency, and security; the comments received on those proposals; and
the differences between proposed Regulation SCI and those
proposals.\1306\
---------------------------------------------------------------------------

    \1303\ See Dodd-Frank Act, Section 763 (adding Sections 13(n),
3C, and 3D of the Exchange Act). The Dodd-Frank Act also directs the
Commission to harmonize to the extent possible Commission regulation
of SB SDRs and SB SEFs with CFTC regulation of swap data
repositories (``SDRs'') and swap execution facilities (``SEFs'')
under the CFTC's jurisdiction, an endeavor that Commission staff is
undertaking as it seeks to move the SB SDR and SB SEF proposals
toward adoption. See Dodd-Frank Act, Section 712 (directing the
Commission, before commencing any rulemaking with regard to SB SDRs
or SB SEFs, to consult and coordinate with the CFTC for purposes of
assuring regulatory consistency and comparability to the extent
possible).
    \1304\ See Securities Exchange Act Release Nos. 63347 (November
19, 2010), 75 FR 77306 (December 10, 2010) (proposing new Rule 13n-6
under the Exchange Act applicable to SB SDRs) (``SB SDR Proposing
Release''); 63825 (February 2, 2011), 76 FR 10948 (February 28,
2011) (proposing new Rule 822 under the Exchange Act applicable to
SB SEFs) (``SB SEF Proposing Release''). See also Dodd-Frank Act,
Section 761(a) (adding Section 3(a)(75) of the Exchange Act)
(defining the term ``security-based swap data repository''), and
Section 761(a) (adding Section 3(a)(77) of the Exchange Act)
(defining the term ``security-based swap execution facility'').
    \1305\ See SB SDR Proposing Release, supra note 1304, at 77332
and SB SEF Proposing Release, supra note 1304, at 10987.
    \1306\ See Proposing Release, supra note 13, at 18133-34.
---------------------------------------------------------------------------

    In the SCI Proposal, the Commission recognized that there could be
differences between Regulation SCI, as adopted, and Rules 13n-6 and
822, if adopted. Therefore, the Commission sought comment on whether it
should propose to apply the requirements of Regulation SCI, in whole or
in part, to SB SDRs and/or SB SEFs.\1307\ In addition, the Commission
sought comment on what--if the Commission were to propose to apply some
or all of the requirements of Regulation SCI to SB SDRs or SB SEFs--
would be the most appropriate way to implement such requirements for SB
SDRs and SB SEFs.\1308\ However, the Commission also noted that, should
the Commission decide to propose to apply the requirements of
Regulation SCI to SB SDRs or SB SEFs, the Commission would issue a
separate release discussing such a proposal.\1309\
---------------------------------------------------------------------------

    \1307\ See id. at 18134-37.
    \1308\ See id. at 18137-38. As noted in the SCI Proposal,
although the Commission has issued a policy statement regarding the
anticipated sequencing of the compliance dates of final rules to be
adopted by the Commission for certain provisions of Title VII of the
Dodd-Frank Act, the precise timing for adoption of or compliance
with any final rules relating to SB SDRs or SB SEFs is not known at
this time. See Securities Exchange Act Release No. 67177 (June 11,
2012), 77 FR 35625 (June 14, 2012) (Statement of General Policy on
the Sequencing of the Compliance Dates for Final Rules Applicable to
Security-Based Swaps Adopted Pursuant to the Securities Exchange Act
of 1934 and the Dodd-Frank Wall Street Reform and Consumer
Protection Act).
    \1309\ See Proposing Release, supra note 13, at 18134.
---------------------------------------------------------------------------

    One commenter supported the inclusion of SB SEFs and possibly SB
SDRs under proposed Regulation SCI.\1310\ Several commenters supported
some form of harmonization, but were cognizant of the practical
differences between options and equities, on the one hand, and
derivatives, on the other.\1311\
---------------------------------------------------------------------------

    \1310\ See Tellefsen Letter at 5.
    \1311\ See DTCC Letter at 18-19; and NYC Bar Letter at 2-5. See
also CoreOne Letter at 5-7.
---------------------------------------------------------------------------

    In the context of considering whether Regulation SCI should apply
to SB SDRs or SB SEFs, one commenter supported principles-based rules
relating to systems compliance and integrity, and generally believed
that principles applicable to one type of system should be applicable
to all types of systems.\1312\ This commenter noted that the Commission
should not promulgate principles-based rules that would apply different
principles to different systems, unless such difference is clearly
warranted by the facts and circumstances relating to and the purpose of
a particular system.\1313\ This commenter also commented that, because
technology continues to evolve at a rapid pace and because specific and
technical rules may create conflicting standards, any attempt to
provide specific and technical rules should be avoided, unless the
context clearly warrants such specific and technical rules.\1314\ This
commenter concluded that the similarities between certain SCI entities
and SB SDRs and SB SEFs do not provide a clear justification for a
different set of rules.\1315\
---------------------------------------------------------------------------

    \1312\ See NYC Bar Letter at 3.
    \1313\ See id. at 3-4.
    \1314\ See id. at 4.
    \1315\ See id. This commenter also specifically noted that
important market systems should not have differing recovery
requirements without a clear justification, particularly in light of
a Congressional mandate in the Dodd-Frank Act to ensure regulatory
consistency and comparability, to the extent possible. See NYC Bar
Letter at 5.
---------------------------------------------------------------------------

    One commenter noted that SB SDRs should have standards that are
consistent with, but not identical to, those of SCI entities.\1316\
According to this commenter, the functions that SB SDRs perform are
significantly different from those performed by SCI entities.\1317\
However, this commenter supported applying to SB SDRs: Proposed Rule
1000(b)(1)(i)(A)-(E); \1318\ requirements relating to Commission
notification of SCI events (by adopting the notification provisions
described in proposed Rule 13n-6(3)); and requirements for business
continuity planning and testing (but SB SDRs should not be required to
test with other SB SDRs given the structure of the proposed SB SDR
Regulations).\1319\ Finally, rather than making Regulation SCI
applicable to SB SDRs, this commenter recommended that these provisions
be incorporated into Rule 13n-6.\1320\
---------------------------------------------------------------------------

    \1316\ See DTCC Letter at 18.
    \1317\ See id.
    \1318\ However, this commenter noted that specific industry
standards should be adopted for SB SDRs, rather than adopting
existing standards that were largely developed before repositories
were developed and were not intended to cover these types of
entities. See id.
    \1319\ See id. at 18-19.
    \1320\ See id. at 19.
---------------------------------------------------------------------------

    The Commission appreciates the comments received on the potential
application of Regulation SCI to SB SDRs and SB SEFs. As noted above,
should the Commission decide to propose to apply the requirements of
Regulation SCI to SB SDRs or SB SEFs, the Commission would issue a
separate release discussing such a proposal and would take these
comments into account.
2. Applying Regulation SCI to Broker-Dealers Other Than SCI ATSs and
Other Types of Entities
    Regulation SCI, as proposed and as adopted, would apply to national
securities exchanges, registered securities associations, registered
clearing agencies, the MSRB, SCI ATSs, plan processors, and exempt
clearing agencies subject to ARP. It would not apply to other types of
market participants, such as market makers or other broker-dealers. As
noted in the SCI Proposal, recent events have highlighted the
significance of systems integrity of a broader set of market
participants than those included in the definition of SCI entity.\1321\
Also, as

noted in the SCI Proposal, some broker-dealers have grown in size and
importance to the market in recent years.\1322\ As such, the Commission
recognized that systems disruptions, systems compliance issues, and
systems intrusions at broker-dealers could pose a significant risk to
the market.\1323\ The Commission also noted that Rule 15c3-5 under the
Exchange Act,\1324\ which requires brokers or dealers with market
access to implement risk management controls and supervisory procedures
to limit risk, already seeks to address certain risks posed to the
markets by broker-dealer systems.\1325\
---------------------------------------------------------------------------

    \1321\ See Proposing Release, supra note 13, at 18138, n. 334.
    \1322\ See id. at 18138, n. 335.
    \1323\ See id. at 18138.
    \1324\ 17 CFR 240.15c3-5.
    \1325\ See supra note 114 and Proposing Release, supra note 13,
at 18138-39.
---------------------------------------------------------------------------

    The Commission did not propose to apply Regulation SCI to
registered broker-dealers (other than SCI ATSs) or to other types of
entities not covered by the definition of SCI entity. As noted in the
SCI Proposal, if the Commission were to decide to propose to apply the
requirements of Regulation SCI to such entities, the Commission would
issue a separate release discussing such a proposal.\1326\
Nevertheless, in the SCI Proposal, the Commission sought comment on
whether such entities should be subject to Regulation SCI in whole or
in part.\1327\
---------------------------------------------------------------------------

    \1326\ See id. at 18139.
    \1327\ See id. at 18139-41.
---------------------------------------------------------------------------

    Some commenters stated that the Commission should expand the
definition of SCI entity to include broker-dealers.\1328\ One commenter
stated that the goals of Regulation SCI could not be met without
expanding the definition of SCI entity to include the following types
of broker-dealers: Exchange market maker, OTC market maker, and any
other broker or dealer that executes orders internally by trading as a
principal or crossing orders as an agent.\1329\ This commenter stated
that these entities should be included because they play a critical
role in the markets, handle market share that exceeds that of certain
SCI ATSs, and, like exchanges and ATSs, rely heavily on sophisticated
automated systems.\1330\ Another commenter also believed that the
objectives of Regulation SCI could more readily be achieved if the
regulation also applied to market makers, high-frequency trading firms,
and other broker-dealers because the activities of these types of
entities could present systemic risks to the market.\1331\
---------------------------------------------------------------------------

    \1328\ See NYSE Letter at 8-10; and Liquidnet Letter at 2-3.
Another commenter expressed its view that inclusion of order routing
systems within the definition of ``SCI systems'' puts SCI entities
at a competitive disadvantage against broker-dealers that are not
covered by Regulation SCI. See BATS Letter at 4. See also supra
notes 48-50, 94-96, and 152 and accompanying text (discussing
comments regarding broadening the coverage of ``SCI entity'' and
``SCI ATS'' and the effect of the adopted ATS thresholds on barriers
to entry), and infra Section VI.C.1.c (discussing the effect of
Regulation SCI on competition between SCI entities and non-SCI
entities).
    \1329\ See NYSE Letter at 9.
    \1330\ See id.
    \1331\ See Liquidnet Letter at 2.
---------------------------------------------------------------------------

    In connection with questions in the SCI Proposal regarding the
application of Regulation SCI to broker-dealers other than SCI ATSs,
one commenter urged the Commission to broaden the definition of SCI
entity to include any entity with direct electronic access to equity
markets because the equity markets can be disrupted by a single
server.\1332\ Another commenter stated that all direct access
proprietary trading market participants (including high frequency
market participants) should be included as SCI entities because of
their significant footprint in the markets, past incidents like Knight
Capital Group's massive trading losses from a systems malfunction in
August 2012,\1333\ and flaws in the existing compliance controls and
practices of such firms.\1334\ One commenter stated that Regulation SCI
should be extended to any trading platforms that transact significant
volume, including systems that are not required to register as an ATS,
because all executions are against the bids and offers of a single
dealer.\1335\
---------------------------------------------------------------------------

    \1332\ See Lauer Letter at 3. See also supra notes 212-213
(explaining that the Commission believes that many systems with
direct market access are captured by the adopted definition but the
Commission is not expanding the scope of Regulation SCI to include
other broker-dealer entities and their systems at this time).
    \1333\ See Proposing Release, supra note 13, at 18090, n. 70
(discussing Knight's systems malfunction in August 2012).
    \1334\ See Leuchtkafer Letter at 1-7. See supra notes 124-126
and accompanying text (discussing the Commission's determination to
not apply Regulation SCI to non-ATS broker-dealers at this time).
    \1335\ See BlackRock Letter at 4.
---------------------------------------------------------------------------

    A few commenters further argued that Rule 15c3-5 under the Exchange
Act is not sufficient by itself and therefore some broker-dealers
should be treated as SCI entities.\1336\ One of these commenters stated
that non-ATS broker-dealers should be treated as SCI entities because
Rule 15c3-5, concerning the implementation of risk management and
supervisory controls to limit risk associated with routing orders to
exchanges or ATSs, does not address reliability or integrity of the
systems that implement such controls.\1337\
---------------------------------------------------------------------------

    \1336\ See Lauer Letter at 3 and NYSE Letter at 9.
    \1337\ See NYSE Letter at 9.
---------------------------------------------------------------------------

    Many other commenters stated more generally that broker-dealers
should not be captured by the definition of SCI entity.\1338\ Several
commenters stated that they do not support the expansion of Regulation
SCI to all broker-dealers because broker-dealers generally perform
functions that do not have any systemic impact on the operation of the
national market system and are presently subject to numerous
regulations that require the establishment of controls (such as the
Market Access Rule, Rule 17a-3, and Rule 17a-4), making Regulation SCI
duplicative and unduly burdensome.\1339\
---------------------------------------------------------------------------

    \1338\ See SIFMA Letter at 3; MFA Letter at 4-5; FIA PTG Letter
at 5; FSI Letter at 3; WF Letter at 2; Fidelity Letter at 4; KCG
Letter at 14-17; LiquidPoint Letter at 4; and FSR Letter at 2-3, n.
5.
    \1339\ See SIFMA Letter at 3; MFA Letter at 4-5; FIA PTG Letter
at 5; WF Letter at 2; KCG Letter at 15-17; LiquidPoint Letter at 4;
and FSR Letter at 2-3, n. 5.
---------------------------------------------------------------------------

    One commenter stated that broker-dealers are currently subject to
high standards of systems compliance and integrity by FINRA and state
laws, and disciplinary actions for failure to maintain sufficient
protection of customer data and supervisory policies.\1340\ Moreover,
this commenter noted that, if potential systems issues could be
addressed by Regulation SCI as applied to SCI entities, there would be
no need to apply Regulation SCI to broker-dealers conducting activities
on behalf of retail clients.\1341\ This commenter stated that
additional regulation would only be warranted after a meticulous cost-
benefit analysis and implementation of the additional regulation at the
lowest cost to firms and investors.\1342\ This commenter concluded that
the inclusion of broker-dealers would raise investors' costs and is
unnecessary.\1343\
---------------------------------------------------------------------------

    \1340\ See FSI Letter at 3.
    \1341\ See id.
    \1342\ See id.
    \1343\ See id.
---------------------------------------------------------------------------

    Another commenter believed that non-SCI ATS broker-dealers should
not be included in the definition of SCI entity because, despite the
longstanding practice of retail brokers routing their customers' orders
to market markers for execution, those market makers are not
critical.\1344\ Moreover, this commenter believed that FINRA's rules
with respect to broker-dealers are more appropriate than the SCI
Proposal, and FINRA rules hold broker-dealers accountable and do not
shield them from liability.\1345\ This commenter stated that the
combination of Commission and FINRA rules on

broker-dealers ensures that broker-dealers are sufficiently regulated,
although this commenter stated that FINRA could provide additional
guidance on its rules in light of the weaknesses revealed by Superstorm
Sandy.\1346\ Similarly, another commenter stated that broker-dealers
should not be regulated under Regulation SCI because broker-dealer
operational regulation has been overseen almost entirely by
FINRA.\1347\ Specifically, FINRA member broker-dealers are required to
create and implement written supervisory procedures covering the
operation of their business.\1348\ According to this commenter, this
process allows broker-dealers to devise procedures that keep them in-
line with FINRA and Commission regulations, and allows FINRA to focus
on bigger picture issues impacting the broker-dealer industry.\1349\
---------------------------------------------------------------------------

    \1344\ See KCG Letter at 14.
    \1345\ See id. at 14-15.
    \1346\ See id. at 14-17.
    \1347\ See OTC Markets Letter at 11.
    \1348\ See id.
    \1349\ See id.
---------------------------------------------------------------------------

    In addition, one commenter stated that the Commission should not
propose a requirement that SCI SROs require their members to institute
policies and procedures similar to those required under Regulation
SCI.\1350\ According to this commenter, SCI SROs already impose
regulatory requirements addressing similar concerns as those that
Regulation SCI is designed to address.\1351\
---------------------------------------------------------------------------

    \1350\ See WF Letter at 2.
    \1351\ See id. at 2-3.
---------------------------------------------------------------------------

    One commenter stated that the term SCI entity should not encompass
clearing broker-dealers or transfer agents because they are not
involved in ``real-time'' trading activities and therefore there would
not be any material impact on critical market functions should their
systems fail.\1352\ Additionally, this commenter stated that because
Regulation SCI ``is designed to formalize the Commission's existing ARP
Program,'' and clearing broker-dealers and transfer agents do not
participate in ARP, those entities should not be included within the
scope of Regulation SCI.\1353\ Another commenter echoed these positions
with respect to transfer agents, and also stated that transfer agents
should not be included within the definition of SCI entity because the
majority of transfer agents do not have electronic connectivity to SCI
entities.\1354\ Additionally, this commenter stated that larger
transfer agents are already required to have business continuity plans
and written policies and procedures to ensure that their systems are
robust and will function as intended.\1355\ In determining whether to
expand the scope of SCI entities, one commenter commented that the
Commission should consider the role of an entity in the securities
markets and the risks presented by that entity, and stated that
transfer agents should not be covered because they raise fewer risks to
the markets than the proposed SCI entities, as their systems do not
directly support the functions intended to be targeted by the SCI
Proposal.\1356\ Another commenter similarly stated that transfer agents
should not be covered because there is little chance that a problem
with a transfer agent's operations would impact market activity.\1357\
---------------------------------------------------------------------------

    \1352\ See Fidelity Letter at 4.
    \1353\ See id.
    \1354\ See STA Letter at 2.
    \1355\ See id.
    \1356\ See ICI Letter at 3.
    \1357\ See Oppenheimer Letter at 2.
---------------------------------------------------------------------------

    The Commission appreciates the comments received on the potential
application of Regulation SCI to broker-dealers other than SCI ATSs and
other types of entities. As noted above, should the Commission decide
to propose to apply the requirements of Regulation SCI to these
entities, the Commission would issue a separate release discussing such
a proposal and would take these comments into account.

F. Effective Date and Compliance Dates

    Several commenters provided recommendations for when the
requirements of Regulation SCI should go into effect and/or when SCI
entities should be required to comply with the various requirements of
the regulation.\1358\ Each commenter recommended allowing what they
believed to be sufficient time for SCI entities to prepare for what
they perceived as complex or substantial regulatory
responsibilities.\1359\
---------------------------------------------------------------------------

    \1358\ See e.g., FINRA Letter at 41-42; DTCC Letter at 3; OCC
Letter at 2; MSRB Letter at 39-40; KCG Letter at 19; SIFMA Letter at
7; and OTC Markets Letter at 4, 22-23.
    \1359\ See e.g., FINRA Letter at 41-42; DTCC Letter at 3; OCC
Letter at 2; MSRB Letter at 39-40; KCG Letter at 19; SIFMA Letter at
7; and OTC Markets Letter at 4, 22-23.
---------------------------------------------------------------------------

    Several commenters suggested that the implementation period should
vary between those entities and/or systems currently subject to the ARP
Inspection Program and those that are not.\1360\ For example, one
commenter suggested an implementation period of no less than two years
for SCI systems that are subject to the ARP Inspection Program and
three years for all other systems.\1361\ Similarly, another commenter
recommended that certain systems of non-ARP participants should be
provided at least an additional one year transition period, after a
six-month delayed effectiveness after final approval of Regulation SCI
for SCI systems of current ARP participants that are trading, clearance
and settlement, and order routing systems.\1362\ Another commenter
stated that systems currently covered by the ARP Inspection Program
should be granted two years to phase-in the rule and that non-ARP
systems would need a phase-in period of at least four years.\1363\ One
commenter also noted more generally that the time needed to meet the
new requirements of Regulation SCI will vary by the type of SCI entity
and the level of its current participation in the ARP Inspection
Program.\1364\
---------------------------------------------------------------------------

    \1360\ See, e.g., FINRA Letter at 41-42; DTCC Letter at 3; and
OTC Markets Letter at 4, 22-23.
    \1361\ See FINRA Letter at 41-42.
    \1362\ See MSRB Letter at 39-40.
    \1363\ See OTC Markets Letter at 4, 22-23.
    \1364\ See DTCC Letter at 3.
---------------------------------------------------------------------------

    Some commenters requested a special phase-in period for ATSs.
Specifically, two commenters suggested that ATSs should be given six
months after meeting the given threshold in the definition of SCI ATS
to come into compliance with Regulation SCI.\1365\
---------------------------------------------------------------------------

    \1365\ See KCG Letter at 19; and SIFMA Letter at 7. See also
adopted Rule 1000 (definition of ``SCI ATS'') and supra Section
IV.A.1.b (discussing definition of ``SCI ATS'').
---------------------------------------------------------------------------

    Other commenters provided detailed suggestions for a phase-in
compliance timeline for the requirements of Regulation SCI.\1366\ For
example, one commenter suggested implementing the rule in three phases
so that it would apply: (1) After initial six-month delayed
effectiveness, to SCI systems of current ARP participants that are
trading, clearance and settlement, and order routing systems, and after
one additional year, to such systems of non-ARP participants (for at
least one annual cycle); (2) to indirect SCI systems relating to the
systems in phase one (for at least one annual cycle); and (3) to SCI
systems that are market data, regulation and surveillance systems and
related indirect SCI systems.\1367\ Another commenter believed the rule
should be phased-in over four stages, where each SCI entity would: (1)
Review its SCI systems risk-based assessment with Commission staff; (2)
review and update its policies and procedures to reasonably ensure
compliance with Regulation SCI; (3) implement such policies and
procedures; and (4) conduct an annual review.\1368\
---------------------------------------------------------------------------

    \1366\ See MSRB Letter at 39-40; and OCC Letter at 2-3.
    \1367\ See MSRB Letter at 40.
    \1368\ See OCC Letter at 3.

---------------------------------------------------------------------------

    Other commenters recommended individual compliance deadlines for
certain requirements of Regulation SCI.\1369\ Specifically, two
commenters suggested that phased-in compliance should be permitted for
proposed Rule 1000(b)(9) addressing testing of SCI entity business
continuity and disaster recovery plans by SCI entity members or
participants.\1370\ Specifically, one commenter believed that, if end-
to-end business continuity and disaster recovery plans testing were to
be required, it should be phased-in to allow SCI entities to conduct