the integrity of the U.S. securities markets? Why or why not? Please
explain. What would be the costs associated with proposed Rule
1000(b)(9)? What would be the benefits? Please be specific. What would
be the potential competitive impacts of proposed Rule 1000(b)(9),
including impacts on small members or small participants? To the extent
possible, please provide data to support your views.
    154. To help ensure that the goals of an SCI entity's business
continuity and disaster recovery plans are achieved, should the
Commission impose other requirements (in addition to the mandatory
testing participation

requirement in proposed Rule 1000(b)(9)) on the members or participants
of SCI entities? \272\ For example, proposed Rule 1000(b)(1)(i)(E)
would require that an SCI entity's business continuity and disaster
recovery plans allow for ``maintaining backup and recovery capabilities
sufficiently resilient and geographically diverse to ensure next
business day resumption of trading.'' Should the Commission require SCI
entities to mandate that some or all of their members or participants
be able to meet the next business day resumption of trading standards
for SCI entities in proposed Rule 1000(b)(1)(i)(E)? Why or why not? If
not all, which members or participants should be required to meet such
resumption of trading standards? For example, should an SCI entity
require members or participants that execute transactions above a
certain volume threshold and/or that account for a certain percentage
of trading on the SCI entity to meet such resumption of trading
standards? Why or why not? If so, what should be such threshold or
thresholds?
---------------------------------------------------------------------------

    \272\ See also infra Section III.G (soliciting comment on
whether broker-dealers, other than SCI ATSs, should be subject to
some or all of the additional system safeguard rules that are
proposed for SCI entities).
---------------------------------------------------------------------------

    155. Are there other requirements that SCI entities should mandate
for their members or participants to help SCI entities meet their
obligations under proposed Regulation SCI? If so, what are they? Please
describe. For example, should the Commission also require each SCI
entity to mandate that its members or participants maintain continuous
connectivity with the SCI entity's backup data centers? Why or why not?
If not all, which members or participants should be required to
maintain continuous connectivity with the SCI entity's backup data
centers? For example, should an SCI entity require members or
participants designated under proposed Rule 1000(b)(9)(iii), or that
execute transactions above a certain volume threshold and/or that
account for a certain percentage of trading on the SCI entity, to
maintain such connectivity? Why or why not? If so, what should be such
threshold or thresholds?

D. Proposed Rule 1000(c)-(f): Recordkeeping, Electronic Filing on Form
SCI, and Access

1. Recordkeeping Requirements
    The Commission notes that many SCI entities are already subject to
recordkeeping requirements,\273\ but that records relating to systems
review and testing may not be specifically addressed in certain current
recordkeeping rules. Accordingly, the Commission is proposing Rule
1000(c) to specifically address recordkeeping requirements for SCI
entities with respect to records relating to Regulation SCI compliance.
---------------------------------------------------------------------------

    \273\ See, e.g., 17 CFR 240.17a-1, applicable to SCI SROs; 17
CFR 240.17a-3, 17a-4, applicable to broker-dealers; and 17 CFR
242.301-303, applicable to ATSs.
     It has been the experience of the Commission that SCI entities
presently subject to the ARP Inspection Program (nearly all of whom
are SCI SROs that are also subject to the record keeping
requirements of Rule 17a-1(a)) do generally keep and preserve the
types of records that would be subject to the requirements of
proposed Rule 1000(c). Nevertheless, the Commission preliminarily
believes that Regulation SCI's codification of these preservation
practices will support an accurate, timely, and efficient inspection
and examination process and help ensure that all types of SCI
entities keep and preserve such records.
---------------------------------------------------------------------------

    Proposed Rule 1000(c)(1) would require each SCI SRO to make, keep,
and preserve all documents relating to its compliance with Regulation
SCI, as prescribed by Rule 17a-1 under the Exchange Act.\274\ Rule 17a-
1(a) under the Exchange Act requires every national securities
exchange, national securities association, registered clearing agency,
and the MSRB to keep and preserve at least one copy of all documents,
including all correspondence, memoranda, papers, books, notices,
accounts, and other such records as shall be made and received by it in
the course of its business as such and in the conduct of its self-
regulatory activity.\275\ In addition, Rule 17a-1(b) requires these
entities to keep all such documents for a period of not less than five
years, the first two years in an easily accessible place, subject to
the destruction and disposition provisions of Rule 17a-6.\276\ Rule
17a-1(c) requires these entities, upon request of any representative of
the Commission, to promptly furnish to the possession of Commission
representatives copies of any documents required to be kept and
preserved by it pursuant to Rule 17a-1(a) and (b).\277\ The Commission
believes that the breadth of Rule 17a-1 under the Exchange Act is such
that it would require SCI SROs to make, keep, and preserve records
relating to their compliance with proposed Regulation SCI should the
Commission adopt Regulation SCI. Thus, the Commission proposes to
cross-reference Rule 17a-1 in proposed Regulation SCI to be clear that
it intends all SCI entities to be subject to the same recordkeeping
requirements regarding compliance with proposed Regulation SCI.
---------------------------------------------------------------------------

    \274\ 17 CFR 240.17a-1.
    \275\ See 17 CFR 240.17a-1(a). Such records would, for example,
include copies of incident reports and the results of systems
testing.
    \276\ See 17 CFR 240.17a-1(b). Rule 17a-6(a) under the Exchange
Act states: ``Any document kept by or on file with a national
securities exchange, national securities association, registered
clearing agency or the Municipal Securities Rulemaking Board
pursuant to the Act or any rule or regulation thereunder may be
destroyed or otherwise disposed of by such exchange, association,
clearing agency or the Municipal Securities Rulemaking Board at the
end of five years or at such earlier date as is specified in a plan
for the destruction or disposition of any such documents if such
plan has been filed with the Commission by such exchange,
association, clearing agency or the Municipal Securities Rulemaking
Board and has been declared effective by the Commission.'' 17 CFR
240.17a-6(a).
    \277\ See 17 CFR 240.17a-1(c).
---------------------------------------------------------------------------

    For SCI entities that are not SCI SROs (i.e., SCI ATSs, plan
processors, and exempt clearing agencies subject to ARP), the
Commission is proposing broad recordkeeping requirements relating to
compliance with proposed Regulation SCI that are consistent with those
applicable to SROs under Rule 17a-1 under the Exchange Act. Thus, the
Commission is proposing Rule 1000(c)(2), which would require SCI
entities other than SCI SROs to: (i) Make, keep, and preserve at least
one copy of all documents, including correspondence, memoranda, papers,
books, notices, accounts, and other such records, relating to its
compliance with Regulation SCI, including, but not limited to, records
relating to any changes to its SCI systems and SCI security systems;
(ii) keep all such documents for a period of not less than five years,
the first two years in a place that is readily accessible to the
Commission or its representatives for inspection and examination; \278\
and (iii) upon request of any representative of the Commission,
promptly furnish to the possession of such representative copies of any
documents required to be kept and preserved by it pursuant to (i) and
(ii) above.
---------------------------------------------------------------------------

    \278\ The proposed five-year and two-year time frames would be
the same as those applicable to SCI SROs pursuant to Rule 17a-1
under the Exchange Act, and the Commission preliminarily believes it
would be appropriate for all SCI entities to be subject to the same
time frame requirements.
---------------------------------------------------------------------------

    Proposed Rule 1000(c)(3), applicable to all SCI entities, would
require each SCI entity, upon or immediately prior to ceasing to do
business or ceasing to be registered under the Exchange Act, to take
all necessary action to ensure that records required to be made, kept,
and preserved by proposed Rule 1000(c) would be accessible to the
Commission or its representatives for the remainder of the period
required by proposed Rule 1000(c). For example, an SCI entity could
fulfill its obligations under proposed Rule 1000(c)(3) by delivering

such records, immediately prior to deregistration, to a repository or
other similar entity and by making all necessary arrangements for such
records to be readily accessible to the Commission or its
representative, for inspection and examination for the duration of the
requirement under proposed Rule 1000(c)(3).
    The Commission preliminarily believes that its ability to examine
for and enforce compliance with proposed Regulation SCI could be
hampered if an SCI entity were not required to adequately provide
accessibility for the full proposed retention period. In addition,
while many SCI events may occur, be discovered, and be resolved in a
short time frame, there may be other SCI events that may not be
discovered until months or years after their occurrences, or may take
significant periods of time to fully resolve. In such cases, having an
SCI entity's records available even after it has ceased to do business
or be registered under the Exchange Act would be beneficial. Because
SCI events have the potential to negatively impact investor decisions,
risk exposure, and market efficiency, the Commission also preliminarily
believes that its ability to oversee the securities markets could be
undermined if it is unable to review records to determine the causes
and consequences of one or more SCI events experienced by an SCI entity
that deregisters or ceases to do business. This information would
provide an additional tool to help the Commission reconstruct important
market events and better understand how such events impacted investor
decisions, risk exposure, and market efficiency.
    Proposed Rule 1000(e) would provide that, if the records required
to be made or kept by an SCI entity under proposed Regulation SCI were
prepared or maintained by a service bureau or other recordkeeping
service on behalf of the SCI entity, the SCI entity would be required
to ensure that the records are available for review by the Commission
and its representatives by submitting a written undertaking, in a form
acceptable to the Commission, by such service bureau or other
recordkeeping service, signed by a duly authorized person at such
service bureau or other recordkeeping service. The written undertaking
would be required to include an agreement by the service bureau
designed to permit the Commission and its representatives to examine
such records at any time or from time to time during business hours,
and to promptly furnish to the Commission and its representatives true,
correct, and current electronic files in a form acceptable to the
Commission or its representatives or hard copies of any, all, or any
part of such records, upon request, periodically, or continuously and,
in any case, within the same time periods as would apply to the SCI
entity for such records. The preparation or maintenance of records by a
service bureau or other recordkeeping service would not relieve an SCI
entity from its obligation to prepare, maintain, and provide the
Commission and its representatives with access to such records.
Proposed Rule 1000(e) is substantively the same as the requirement
applicable to broker-dealers under Rule 17a-4(i) of the Exchange
Act.\279\
---------------------------------------------------------------------------

    \279\ 17 CFR 240.17a-4(i).
---------------------------------------------------------------------------

    The Commission is proposing this requirement for SCI entities to
prevent the inability of the Commission to obtain required SCI entity
records because they are held by a third party that may not otherwise
have an obligation to make such records available to the Commission. In
addition, the requirement that SCI entities obtain from such third
parties a written undertaking would help ensure that such service
bureau or other recordkeeping service is aware of this obligation with
respect to records relating to proposed Regulation SCI. The Commission
preliminarily believes that it is appropriate to include this
requirement in proposed Regulation SCI to help ensure that the
Commission would have prompt and efficient access to all required
records, including those housed at a service bureau or any other
recordkeeping service.\280\
---------------------------------------------------------------------------

    \280\ See 17 CFR 240.17a-4(i) (records preserved or maintained
by a service bureau).
---------------------------------------------------------------------------

Request for Comment
    156. The Commission requests comment on all aspects of proposed
Rule 1000(c). Specifically, do SCI entities currently make, keep, and
preserve the types of records that would be required to be made, kept,
and preserved by proposed Rule 1000(c)? Are there any records that
could be important to make, keep, and preserve that would not be
captured under proposed Rule 1000(c) or the existing recordkeeping
requirements for SROs under Rule 17a-1? If so, please explain and
identify the records. Should any of the records subject to proposed
Rule 1000(c) not be required? If so, please explain and identify the
records. Should the Commission require SCI entities to furnish records
to Commission representatives electronically in a tagged data format
(e.g., XML, XBRL, or similar structured data formats which may be
tagged)? The Commission notes that a tagged data format would have the
benefit of permitting records to be organized and searched more easily,
and thereby enable more efficient analyses, but that there would also
be costs associated with implementing a tagged data format requirement.
Do commenters believe the benefits of using a tagged data format would
justify the costs? Why or why not? Please explain. If so, should any
particular electronic format be mandated? If so, please describe.
    157. Should the Commission lengthen or shorten the proposed periods
for SCI entities to keep and preserve records? If so, by how much and
why? Is it appropriate for an SCI entity, prior to ceasing to do
business or ceasing to be regulated under the Exchange Act, to be
required to ensure that its records are accessible in some way to the
Commission and its representatives? Why or why not? What practical
steps do commenters envision an SCI entity taking to comply with this
proposed requirement?
    158. The Commission requests comment on all aspects of proposed
Rule 1000(e). Specifically, would the written undertaking required by
proposed Rule 1000(e) be sufficient to help ensure that the Commission
and its representatives would be able to obtain and examine true,
correct, and current records of SCI entities? Why or why not? Are the
provisions of proposed Rule 1000(e) an appropriate means of addressing
any potential problems with access to books and records at service
bureaus? Why or why not? Are there alternatives that the Commission
should consider with respect to recordkeeping requirements for SCI
entities? If so, please explain your reasoning.
2. Electronic Submission of Reports, Notifications, and Other
Communications on Form SCI
    Proposed Rule 1000(d) provides that, except with respect to
notifications to the Commission under proposed Rule 1000(b)(4)(i)
(Commission notification of certain SCI events), and oral notifications
to the Commission under proposed Rule 1000(b)(6)(ii) (Commission
notification of certain material systems changes), any notification,
review, description, analysis, or report required to be submitted to
the Commission under proposed Regulation SCI must be submitted
electronically and contain an electronic signature. This proposed
requirement is intended to provide a uniform manner in which the
Commission would receive--and SCI entities would provide--written

notifications, reviews, descriptions, analyses, or reports made
pursuant to proposed Regulation SCI. The Commission preliminarily
believes that such standardization would guide SCI entities in
completing such submissions and make it easier and more efficient for
them to draft and submit such required reports. Additionally, the
standardization would make it easier and more efficient for the
Commission to promptly review, analyze, and respond, as necessary, to
the information proposed to be provided.\281\ The electronic signature
requirement is consistent with the intention of the Commission to
receive documents that can be readily accessed and processed
electronically.
---------------------------------------------------------------------------

    \281\ This proposed requirement is consistent with electronic-
reporting standards set forth in other Commission rules under the
Exchange Act, such as Rule 17a-25 (Electronic Submission of
Securities Transaction Information by Exchange Members, Brokers, and
Dealers). See 17 CFR 240.17a-25.
---------------------------------------------------------------------------

    Proposed Rule 1000(d) also would require that submissions by SCI
entities be filed electronically on new proposed Form SCI, in
accordance with the instructions contained in Form SCI.\282\ The
Commission's proposal contemplates the use of an online filing system,
similar to the electronic form filing system (``EFFS'') currently used
by SCI SROs to submit Form 19b-4 filings, through which an SCI entity
would be able to file a completed Form SCI.\283\ Based on the
widespread use and availability of the Internet, the Commission
preliminarily believes that filing Form SCI in an electronic format
would be less burdensome and a more efficient filing process for SCI
entities and the Commission, as it is likely to be less expensive and
cumbersome than mailing and filing paper forms to the Commission.
---------------------------------------------------------------------------

    \282\ See proposed Rule 1000(d) and infra Section III.E.
    \283\ See Securities Exchange Act Release No. 50486 (October 4,
2004), 69 FR 60287 (October 8, 2004) (adopting the EFFS for use in
filing Form 19b-4).
---------------------------------------------------------------------------

Request for Comment
    159. The Commission requests comment on all aspects of proposed
Rule 1000(d). Do commenters believe that the electronic submission
requirement of proposed Rule 1000(d) is appropriate? Alternatively,
would the submission of a required notification, review, description,
analysis, or report via electronic mail to one or more Commission email
addresses be a more appropriate way for the Commission to implement the
proposed requirement? Are there other alternative methods that would be
preferable? If so, please describe. Should there be any additional
security requirements for such communications (e.g., password
protection or encryption)? If so, please describe. Should the
submissions be made in a tagged data format, e.g., XML, XBRL, or
similar structured data formats which may be tagged? The Commission
notes that a tagged data format would have the benefit of permitting
records to be organized and searched more easily, and thereby enable
more efficient analyses, but that there would also be costs associated
with implementing a tagged data format requirement. Do commenters
believe the benefits of using a tagged data format would justify the
costs? Why or why not? Please explain. If so, should any particular
electronic format be mandated? If so, please describe.
3. Access to the Systems of an SCI Entity
    Proposed Rule 1000(f) would require SCI entities to provide
Commission representatives reasonable access to their SCI systems and
SCI security systems. Thus, the proposed rule would facilitate the
access of representatives of the Commission to such systems of an SCI
entity either remotely or on site.\284\ Proposed Rule 1000(f) is
intended to be consistent with the Commission's current authority with
respect to access to records generally \285\ and help ensure that
Commission representatives have ready access to the SCI systems and SCI
security systems of SCI entities in order to evaluate an SCI entity's
practices with regard to the requirements of proposed Regulation
SCI.\286\
---------------------------------------------------------------------------

    \284\ For example, with access to an SCI entity's SCI systems
and SCI security systems, Commission representatives could test an
SCI entity's firewalls and vulnerability to intrusions.
    \285\ See, e.g., Section 17(b) of the Exchange Act which states
that all records of the entities listed in Section 17(a) ``are
subject at any time, or from time to time, to such reasonable
periodic, special, or other examinations by representatives of the
Commission * * * as the Commission * * * deems necessary or
appropriate in the public interest, for the protection of investors,
or otherwise in furtherance of the purposes of [the Exchange Act].''
    \286\ See 15 U.S.C. 78q(b). The Commission believes proposed
Rule 1000(f) also is authorized by Sections 11A, 6(b)(1), 15A(b)(2),
and 17A(b)(3)(A) of the Exchange Act, among others. See supra notes
9-11 and accompanying text.
---------------------------------------------------------------------------

Request for Comment
    160. The Commission requests comment generally on proposed Rule
1000(f). Are there restrictions that should be placed on the proposed
access that would still allow the Commission and its representatives to
be able to evaluate an SCI entity's practices with regard to the
requirements of proposed Regulation SCI? If so, what should such
restrictions be and why? Please describe.

E. New Proposed Form SCI

    The Commission is proposing that the notices, reports, and other
information required to be provided to the Commission pursuant to
proposed Rules 1000(b)(4), (6), (8), and (10) of Regulation SCI be
submitted electronically on new proposed Form SCI. Proposed Form SCI
would solicit information through a series of questions designed to
elicit short-form answers and also would require SCI entities to
provide information and/or reports in narrative form by attaching
specified exhibits. All filings on proposed Form SCI would require that
an SCI entity identify itself and indicate the basis for submitting
Form SCI, whether a: notification or update notification regarding an
SCI event pursuant to proposed Rule 1000(b)(4); notice of a planned
material systems change pursuant to proposed Rule 1000(b)(6);
submission of a required report pursuant to proposed Rule 1000(b)(8);
or notification of an SCI entity's standards for designation of members
or participants to participate in required testing and the identity of
such designated members or participants pursuant to proposed Rule
1000(b)(9). A filing on Form SCI required by proposed Rules 1000(b)(4),
(6), (8), or (9) would require that an SCI entity provide additional
information on attached exhibits, as discussed below.
1. Notice of SCI Events Pursuant to Proposed Rule 1000(b)(4)
    As discussed above, proposed Rule 1000(b)(4)(i) would require an
SCI entity, upon any responsible SCI personnel becoming aware of a
systems disruption that the SCI entity reasonably estimates would have
a material impact on its operations or on market participants, any
systems compliance issue, or any systems intrusion, to notify the
Commission of such SCI event. Proposed Rule 1000(b)(4)(ii) would
require an SCI entity, upon any responsible SCI personnel becoming
aware of any SCI event, to notify the Commission of the SCI event in
writing within 24 hours. Proposed Rule 1000(b)(4)(iii) would require
continuing written updates on a regular basis, or at such frequency as
reasonably requested by a representative of the Commission, until such
time as the SCI event is resolved. Proposed Rule 1000(b)(4)(iv) would
direct an SCI entity to submit the required notifications on Form SCI.
Further, proposed Rule 1000(b)(4)(iv) and new proposed Form SCI would
specify the particular information an

SCI entity would be required to provide to the Commission to comply
with the Commission notification requirements of proposed Rules
1000(b)(4)(ii) and 1000(b)(4)(iii). As such, proposed Rule 1000(b)(4)
would specify when and how notices would be required to be filed, and
it and new proposed Form SCI would address the content of required
notices.
    For a written notification to the Commission of an SCI event under
proposed Rule 1000(b)(4)(ii), new proposed Form SCI would require that
an SCI entity indicate that the filing is being made pursuant to
proposed Rule 1000(b)(4)(ii) and provide the following information in a
short, standardized format: (i) Whether the filing is a Rule
1000(b)(4)(ii) notification or Rule 1000(b)(4)(iii) update of an SCI
event; (ii) the SCI event type(s) (i.e., systems compliance issue,
systems intrusion, and/or systems disruption); (iii) whether the event
is a systems disruption that the SCI entity reasonably estimates would
have a material impact on its operations or on market participants;
(iv) if so, whether the Commission has been notified of the SCI event;
(v) whether the SCI event has been resolved; (vi) the date/time the SCI
event started; (vii) the duration of the SCI event; (viii) the date and
time when responsible SCI personnel became aware of the SCI event; (ix)
the estimated number of market participants impacted by the SCI event;
(x) the type(s) of systems impacted; \287\ and (xi) if applicable, the
type of systems disruption.\288\ In addition, proposed Form SCI would
require attachment of Exhibit 1, providing a narrative description of
the SCI event, including: (1) A detailed description of the SCI event;
(2) the SCI entity's current assessment of the types and number of
market participants potentially affected by the SCI event; (3) the
potential impact of the SCI event on the market; and (4) the SCI
entity's current assessment of the SCI event, including a discussion of
the SCI entity's determination regarding whether the SCI event is a
dissemination SCI event or not.\289\ In addition, to the extent
available as of the time of the initial notification, Exhibit 1 would
require inclusion of the following information: (1) A description of
the steps the SCI entity is taking, or plans to take, with respect to
the SCI event; (2) the time the SCI event was resolved or timeframe
within which the SCI event is expected to be resolved; (3) a
description of the SCI entity's rule(s) and/or governing documents, as
applicable, that relate to the SCI event; and (4) an analysis of the
parties that may have experienced a loss, whether monetary or
otherwise, due to the SCI event, the number of such parties, and an
estimate of the aggregate amount of such loss.\290\
---------------------------------------------------------------------------

    \287\ The types of systems listed on proposed Form SCI track the
types of systems that make up the proposed definitions of ``SCI
system'' and ``SCI security system'' in proposed Rule 1000(a).
    \288\ The types of systems disruptions listed on proposed Form
SCI track the provisions of the proposed definition of ``system
disruption'' in proposed Rule 1000(a) and include, with respect to
SCI systems: (1) A failure to maintain service level agreements or
constraints; (2) a disruption of normal operations, including
switchover to back-up equipment with near-term recovery of primary
hardware unlikely; (3) a loss of use of any such system; (4) a loss
of transaction or clearance and settlement data; (5) significant
back-ups or delays in processing; (6) a significant diminution of
ability to disseminate timely and accurate market data; or (7) a
queuing of data between system components or queuing of messages to
or from customers of such duration that normal service delivery is
affected.
    \289\ See proposed Rule 1000(b)(4)(iv)(A)(1).
    \290\ See proposed Rule 1000(b)(4)(iv)(A)(2).
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(4)(iii) would require an SCI entity to
provide continuing written updates regularly for each SCI event, or at
such frequency as reasonably requested by a representative of the
Commission, until such time as the SCI event is resolved.\291\ Proposed
Form SCI would require that an SCI entity indicate that it is providing
such written update pursuant to Rule 1000(b)(4)(iii) and attach such
update as Exhibit 2 to Form SCI.
---------------------------------------------------------------------------

    \291\ See proposed Rule 1000(b)(4)(iv)(B).
---------------------------------------------------------------------------

    If any of the foregoing information is not available for inclusion
on Exhibit 1 as of the date of the initial notification, the SCI entity
would be required to provide such information when it becomes available
on Exhibit 2. The information proposed to be required in narrative
format in Exhibit 1, and if applicable, Exhibit 2, is intended to
elicit a fuller description of the SCI event, and would require an SCI
entity to provide detail and context not easily conveyed in short-form
responses.
    Proposed Form SCI would further require attachment of Exhibit 3,
providing a copy in pdf or html format of any information disseminated
to date regarding the SCI event to its members or participants or on
the SCI entity's publicly available Web site.\292\
---------------------------------------------------------------------------

    \292\ See proposed Rule 1000(b)(4)(iv)(C).
---------------------------------------------------------------------------

    The Commission preliminarily believes that the proposed items of
information required to be disclosed by an SCI entity on Exhibit 1
within 24 hours of any of its responsible SCI personnel becoming aware
of an SCI event, or when available, on Exhibit 2, would help the
Commission and its staff quickly assess the nature and scope of an SCI
event, and help the SCI entity identify the appropriate response to the
SCI event, including ways to mitigate the impact of the SCI event on
investors and promote the maintenance of fair and orderly markets.
2. Notices of Material Changes Pursuant to Proposed Rule 1000(b)(6)
    Proposed Rule 1000(b)(6) would require an SCI entity to notify the
Commission of planned material systems changes on proposed Form SCI 30
calendar days in advance of such change, unless exigent circumstances
exist or information previously provided regarding a material systems
change has become materially inaccurate, necessitating notice regarding
a material systems change with less than 30 calendar days' notice. To
implement this requirement, proposed Form SCI would require an SCI
entity to indicate on Form SCI that it is filing a planned material
systems change notification, provide the date of the planned material
systems change, indicate whether exigent circumstances exist or if the
information previously provided to the Commission regarding any planned
material systems change has become materially inaccurate, and, if so,
whether the Commission has been notified orally, and attach as Exhibit
4 a description of the planned material systems change as well as the
expected dates of commencement and completion of implementation of such
changes, or, if applicable, a material systems change that has already
been made due to exigent circumstances.
3. Reports Submitted Pursuant to Rule 1000(b)(8)
    Proposed Rule 1000(b)(8) would require an SCI entity to submit to
the Commission: (i) A report of the SCI review required by proposed
Rule 1000(b)(7), together with any response by senior management,
within 60 calendar days after submission of the SCI review to senior
management; and (ii) a report within 30 calendar days after the end of
June and December of each year containing a summary description of the
progress of any material systems change during the six-month period
ending on June 30 or December 31, as the case may be, and the date, or
expected date, of completion of implementation of such changes. For
filings of the reports of SCI reviews, proposed Form SCI would require
an SCI entity to indicate on Form SCI that it is filing a report of SCI
review, indicate the date of completion of the SCI review, and date of
submission of the SCI review to senior management of the SCI entity.
The report of the SCI review required by

proposed Rule 1000(b)(7), together with any response by senior
management, would be required to be submitted as Exhibit 5 to proposed
Form SCI. For filings of the semi-annual reports of material systems
changes, proposed Form SCI would require an SCI entity to indicate on
Form SCI that it is filing a semi-annual report of material systems
changes, and attach the semi-annual report as Exhibit 6 to proposed
Form SCI.
4. Notifications of Member or Participant Designation Standards and
List of Designees Pursuant to Proposed Rule 1000(b)(9)
    Proposed Rule 1000(b)(9) would require an SCI entity to notify the
Commission of its standards for designating members or participants it
deems necessary, for the maintenance of fair and orderly markets in the
event of the activation of the SCI entity's business continuity and
disaster recovery plans, to participate in the testing of such plans as
well as a list of members or participants designated in accordance with
such standards, and prompt updates following any changes to such
standards and designations. Form SCI would require such information to
be submitted as Exhibit 7 to Form SCI. Thus, an SCI SRO would be
required to attach any relevant provisions of its rules, an SCI ATS or
exempt clearing agency subject to ARP would be required to attach its
relevant internal processes or other documents, and a plan processor
would be required to attach the relevant provisions of its SCI Plan.
    The Commission preliminarily believes that the proposed mechanism
of submitting the reports, notices, and other information required by
proposed Rules 1000(b)(4), (6), (8), and (10) by attaching them as
exhibits to Form SCI would be an efficient manner for providing such
information to the Commission and its staff, and that it would be more
cost-effective for SCI entities as well as the Commission than
requiring the submission in a paper format or using an electronic
method that differs from that proposed.
5. Other Information and Electronic Signature
    In addition to the foregoing, proposed Form SCI would require an
SCI entity to provide Commission staff with point of contact
information for systems personnel and regulatory personnel responsible
for addressing an SCI event, including the name, title, telephone
number and email address of such persons. Proposed Form SCI would also
require the SCI entity to designate on the form contact information for
a senior officer of the SCI entity responsible for matters concerning
the submission of such Form SCI. Finally, proposed Form SCI would
require an electronic signature to help ensure the authenticity of the
Form SCI submission. The Commission preliminarily believes these
proposed requirements would expedite communications between Commission
staff and an SCI entity and help to ensure that only personnel
authorized by the SCI entity are submitting required filings and
working with Commission staff to address an SCI event or systems issue
promptly and efficiently.
    To the extent that the Commission receives confidential information
pursuant to these reports and submissions, such information would be
kept confidential, subject to the provisions of applicable law.\293\
---------------------------------------------------------------------------

    \293\ See, e.g., 5 U.S.C. 552 (Exemption 4 of the Freedom of
Information Act provides an exemption for ``trade secrets and
commercial or financial information obtained from a person and
privileged or confidential.'' 5 U.S.C. 552(b)(4). Exemption 8 of the
Freedom of Information Act provides an exemption for matters that
are ``contained in or related to examination, operating, or
condition reports prepared by, on behalf of, or for the use of an
agency responsible for the regulation or supervision of financial
institutions.'' 5 U.S.C. 552(b)(8)).
---------------------------------------------------------------------------

Request for Comment
    161. The Commission requests comment on all aspects of proposed
Form SCI. Do commenters believe proposed Form SCI would capture the
information necessary to assist the Commission in obtaining relevant
information about SCI events to mitigate the effects of such events on
investors and the public? Specifically, do commenters believe that the
proposal to elicit the following information on Form SCI within 24
hours of any responsible SCI personnel becoming aware of an SCI event
is appropriate: (i) Whether the filing is a Rule 1000(b)(4)(ii)
notification or Rule 1000(b)(4)(iii) update of an SCI event; (ii) the
SCI event type(s) (i.e., systems compliance issue, systems intrusion,
and/or systems disruption); (iii) whether the event is a systems
disruption that the SCI entity reasonably estimates would have a
material impact on its operations or on market participants; (iv) if
so, whether the Commission has been notified of the SCI event; (v)
whether the SCI event has been resolved; (vi) the date/time the SCI
event started; (vii) the duration of the SCI event (viii) the date and
time when responsible SCI personnel became aware of the SCI event; (ix)
the estimated number of market participants impacted by the SCI event;
(x) the type(s) of systems impacted; and (xi) if applicable, the type
of systems disruption.
    162. Do commenters believe that all relevant information relating
to a systems disruption, systems compliance issue, or systems intrusion
would be captured on proposed Form SCI? If not, what additional
information should be included on proposed Form SCI? For example,
should proposed Form SCI require that an SCI entity specifically
identify market participants that may have been affected by the SCI
event? Why or why not?
    163. Do commenters believe the proposed information required to be
provided to the Commission regarding SCI events in the 24-hour
notification on Exhibit 1 is appropriate? Do commenters believe that
the proposal to require an update notification on Exhibit 2, and the
information required to be provided for such updates, are appropriate?
Why or why not?
    164. Commenters that believe the information proposed to be
required on Form SCI, whether in short form or in narrative form on
proposed Exhibits 1 and 2, is not appropriate should explain their
reasoning and suggest alternatives, as appropriate. Should any
information proposed to be required be eliminated? Should any other
information be required? Please describe and explain.
    165. Do commenters believe the required contents of proposed
Exhibit 3 are appropriate (i.e., a copy in pdf or html format of any
information disseminated to an SCI entity's members or participants or
on the SCI entity's publicly available Web site)? If not, why not?
    166. Do commenters believe submission of proposed Form SCI and
attachment of Exhibits 4, 5, 6, and 7 regarding material systems
changes, SCI reviews, and notifications of standards for designations
and designees for the testing of an SCI entity's business continuity
and disaster recovery plans, is an appropriate method for SCI entities
to provide this information to the Commission? If not, why not? Should
any information proposed to be required be eliminated? Should any other
information be required? Please explain.
    167. Is the proposal to require contact information for systems,
regulatory, and senior officer appropriate? Should any information
proposed to be required be eliminated? Is there any other type of
information that proposed Form SCI should require? Is the proposal to
require an electronic signature appropriate? If not, why not?
    168. Would proposed Form SCI contain enough information so that the
Commission and its staff would be able

to accurately analyze SCI events, material changes to systems, and all
other required filings?
    169. Upon receiving information submitted as part of an SCI
entity's electronic filing, it is the Commission's objective that such
information be easily analyzed, searched, and manipulated. The
Commission has designed proposed Form SCI with this objective in mind,
particularly with the uniform requirements on the front of the form.
The Commission, however, is cognizant that certain information,
particularly with respect to the information required on the various
exhibits to the proposed form, may not be as easily analyzed, searched,
or manipulated. The Commission seeks comment as to whether it should
mandate that proposed Form SCI as a whole, including the proposed
exhibits, employ a particular structured data format that would allow
the Commission and its staff to analyze, search, and manipulate the
form's information. At the same time, the Commission recognizes that
employing a particular tagged data format may potentially reduce the
flexibility afforded to such entities to collect and report data in a
manner that is more efficient and cost effective for them. The
Commission requests comments as to whether there may be tagged data
formats that are sufficiently flexible and that are accepted and used
throughout the industry, such as XML, XBRL, or another structured data
format that could be used for proposed Form SCI. Are there different
standard data formats currently in use depending on the type of SCI
entity that would enable the Commission to achieve its goals? If so,
what are they? Should the SCI entity have the flexibility to specify
the acceptable data format for submitting information? Why or why not?
Do commenters have concerns with proposed Regulation SCI requiring the
use of a tagged data format, such as XML, XBRL, or some other
structured data format that may be tagged, to report data? If so, what
are they? Are there any licensing fees or other costs associated with
the use of tagged data formats, such as XML, XBRL, or similar
structured data formats that may be tagged? If so, what action should
the Commission take, if any, to help ensure wide availability of a
common data format by all participants?

F. Request for Comment on Applying Proposed Regulation SCI to Security-
Based Swap Data Repositories and Security-Based Swap Execution
Facilities

    On July 21, 2010, the President signed the Dodd-Frank Act into
law.\294\ The Dodd-Frank Act was enacted, among other things, to
promote the financial stability of the United States by improving
accountability and transparency of the nation's financial system.\295\
Title VII of the Dodd-Frank Act provides the Commission and the CFTC
with the authority to regulate over-the-counter (``OTC'') derivatives.
---------------------------------------------------------------------------

    \294\ The Dodd-Frank Wall Street Reform and Consumer Protection
Act (Pub. L. 111-203, H.R. 4173) (``Dodd-Frank Act'').
    \295\ See Public Law 111-203 Preamble.
---------------------------------------------------------------------------

1. Proposed System Safeguard Rules for SB SDRs and SB SEFs
    Section 763 of the Dodd-Frank Act amends the Exchange Act by adding
various new statutory provisions to govern the regulation of various
entities, including security-based swap data repositories and security-
based swap execution facilities.\296\ Under the authority of Section
13(n) of the Exchange Act, applicable to SB SDRs, and Section 3D(d) of
the Exchange Act, applicable to SB SEFs, the Commission recently
proposed rules for these entities with regard to their automated
systems' capacity, resiliency, and security.\297\ Specifically, in the
SB SDR Proposing Release and the SB SEF Proposing Release,
respectively, the Commission proposed Rule 13n-6 and Rule 822 under the
Exchange Act, which would set forth the requirements for these entities
with regard to their automated systems' capacity, resiliency, and
security.\298\ In each release, the Commission stated that it was
proposing standards comparable to the standards applicable to SROs,
including exchanges and clearing agencies, and other registrants,
pursuant to the Commission's ARP standards.\299\
---------------------------------------------------------------------------

    \296\ See Public Law 111-203, Section 763 (adding Sections
13(n), 3C, and 3D of the Exchange Act). The Dodd-Frank Act also
directs the Commission to harmonize to the extent possible
Commission regulation of SB SDRs and SB SEFs with CFTC regulation of
swap data repositories (``SDRs'') and swap execution facilities
(``SEFs'') under the CFTC's jurisdiction, an endeavor that
Commission staff is undertaking as it seeks to move the SB SDR and
SB SEF proposals toward adoption. See Public Law 111-203, Section
712, directing the Commission, before commencing any rulemaking with
regard to SB SDRs or SB SEFs, to consult and coordinate with the
CFTC for purposes of assuring regulatory consistency and
comparability to the extent possible.
    \297\ See Securities Exchange Act Release Nos. 63347 (November
19, 2010), 75 FR 77306 (December 10, 2010) (proposing new Rule 13n-6
under the Exchange Act applicable to SB SDRs) (``SB SDR Proposing
Release''); 63825 (February 2, 2011), 76 FR 10948 (February 28,
2011) (proposing new Rule 822 under the Exchange Act applicable to
SB SEFs) (``SB SEF Proposing Release,'' together with the SB SDR
Proposing Release, the ``SBS Releases''). See also Public Law 111-
203, Section 761(a) (adding Section 3(a)(75) of the Exchange Act)
(defining the term ``security-based swap data repository''), and
Section 761(a) (adding Section 3(a)(77) of the Exchange Act)
(defining the term ``security-based swap execution facility'').
    \298\ See SB SDR Proposing Release and SB SEF Proposing Release,
supra note 297.
    \299\ See SB SDR Proposing Release, supra note 293, at 77332 and
SB SEF Proposing Release, supra note 297, at 10987.
---------------------------------------------------------------------------

    Proposed Rules 13n-6 and 822, applicable to SB SDRs and SB SEFs,
respectively, would require these entities, ``with respect to those
systems that support or are integrally related to the performance of
its activities'' to ``establish, maintain, and enforce written policies
and procedures reasonably designed to ensure that its systems provide
adequate levels of capacity, resiliency, and security.'' \300\ Under
proposed Rules 13n-6 and 822, such policies and procedures, at a
minimum, would require these SB SDRs and SB SEFs to: (i) Establish
reasonable current and future capacity estimates; (ii) conduct periodic
capacity stress tests of critical systems to determine such systems'
ability to process transactions in an accurate, timely, and efficient
manner; (iii) develop and implement reasonable procedures to review and
keep current their system development and testing methodologies; (iv)
review the vulnerability of their systems and data center computer
operations to internal and external threats, physical hazards, and
natural disasters; and (v) establish adequate contingency and disaster
recovery plans.\301\ Proposed Rules 13n-6 and 822 would further require
SB SDRs and SB SEFs to submit, on an annual basis, an ``objective
review'' of their systems to the Commission within 30 calendar days of
its completion; \302\ notify the Commission in writing of material
systems outages; and notify the Commission in writing at least 30
calendar days before implementation of any planned material systems
changes.
---------------------------------------------------------------------------

    \300\ See SB SDR Proposing Release, 75 FR 77370 and SB SEF
Proposing Release, 76 FR 11064, supra note 297.
    \301\ Id.
    \302\ Such review may be performed internally if an external
firm reports on the objectivity, competency, and work performance
with respect to the internal review.
---------------------------------------------------------------------------

    To date, the Commission has received two comment letters from one
commenter in response to proposed Rule 13n-6 \303\ and four comment
letters

in response to proposed Rule 822.\304\ Both comment letters on proposed
Rule 13n-6 expressed support for the proposed rule.\305\ Two commenters
on proposed Rule 822 expressed support for the proposed rule.\306\ Two
other commenters on proposed Rule 822 suggested modifications,
including that the Commission (1) require SB SEFs to establish policies
and procedures reasonably designed to prevent any provision in a valid
swap transaction from being invalidated or modified through the
utilization of, or execution on, a SB SEF; \307\ and (2) provide for
the implementation of the system safeguards requirements on a staged
basis.\308\
---------------------------------------------------------------------------

    \303\ See Letter from Larry E. Thompson, General Counsel, The
Depository Trust & Clearing Corporation to Elizabeth M. Murphy,
Secretary, Commission, dated January 24, 2011 (``DTCC SB SDR Letter
1''); and Letter from Larry E. Thompson, General Counsel, Depository
Trust & Clearing Corporation to Mary Shapiro, Chairman, Commission,
dated June 3, 2011 (``DTCC SB SDR Letter 2'').
    \304\ See Letter from American Benefits Counsel to Elizabeth M.
Murphy, Secretary, Commission, dated April 8, 2011 (``ABC SB SEF
Letter''); Letter from Nancy C. Gardner, Executive Vice President &
General Counsel, Markets Division, Thomson Reuters to Elizabeth M.
Murphy, Secretary, Commission, dated April 4, 2011 (``Thomson SB SEF
Letter''); Letter from Stephen Merkel, Chairman, Wholesale Markets
Brokers' Association Americas to Elizabeth M. Murphy, Secretary,
Commission, dated April 4, 2011 (``WMBAA SB SEF Letter''); and
Letter from Robert Pickel, Executive Vice Chairman, International
Swaps and Derivatives Association, and Kenneth E. Bentsen, Jr.,
Executive Vice President, Public Policy and Advocacy, Securities
Industry and Financial Markets Association to Elizabeth M. Murphy,
Secretary, Commission, dated April 4, 2011 (``ISDA SIFMA SB SEF
Letter'').
    \305\ See DTCC SB SDR Letter 1, supra note 304, at 3; DTCC SB
SDR Letter 2, supra note 304, at 4 (recommending that SB SDRs
``maintain multiple levels of operational redundancy and data
security'').
    \306\ See Thomson SB SEF Letter, supra note 304, at 8; WMBAA SB
SEF Letter, supra note 304, at 24.
    \307\ See ABC SB SEF Letter, supra note 304, at 10.
    \308\ See ISDA SIFMA SB SEF Letter, supra note 304, at 12
(noting that the system safeguard requirements would require time
and systems expertise to implement fully).
---------------------------------------------------------------------------

2. Proposed System Safeguard Rules for SB SDRs and SB SEFs as Compared
to Proposed Regulation SCI
    As noted above, proposed Regulation SCI is intended to build upon
and update the Commission's ARP standards,\309\ which were the basis
for proposed Rules 13n-6 and 822 for SB SDRs and SB SEFs, respectively.
Although proposed Rules 13n-6 and 822 have much in common with proposed
Regulation SCI, they differ in scope and detail from proposed
Regulation SCI in a number of ways. Among the differences are certain
provisions in proposed Regulation SCI that proposed Rules 13n-6 and 822
do not include. Specifically, as discussed above, proposed Regulation
SCI would: (i) Define the terms ``SCI systems'' and ``SCI security
systems;'' \310\ (ii) specifically require the establishment,
maintenance, and enforcement of written policies and procedures
reasonably designed to ensure that SCI systems and, for purposes of
security standards, SCI security standards, have levels of capacity,
integrity, resiliency, availability, and security adequate to maintain
an SCI entity's operational capability and promote the maintenance of
fair and orderly markets; \311\ (iii) require SCI entities to establish
policies and procedures regarding standards that result in systems
designed, developed, tested, maintained, operated, and surveilled in a
manner that facilitates the successful collection, processing, and
dissemination of market data; (iv) require SCI entities to establish,
maintain, and enforce reasonably designed written policies and
procedures to ensure that SCI systems operate in the manner intended,
including in a manner that complies with the federal securities laws
and rules and regulations thereunder and, as applicable, the entity's
rules and governing documents; (v) require SCI entities to take
corrective action, including devoting adequate resources, to remedy an
SCI event as soon as reasonably practicable; \312\ (vi) require SCI
entities to have backup and recovery capabilities sufficiently
resilient and geographically diverse to ensure next business day
resumption of trading following a wide scale disruption; (vii) require
an annual SCI review of the SCI entity's compliance with proposed
Regulation SCI and the reporting of such review to the Commission;
(viii) require an SCI entity, with respect to its business continuity
and disaster recovery plans, including its backup systems, to require
participation by designated members or participants in scheduled
functional and performance testing of the operation of such plans at
specified intervals, and to coordinate such required testing with other
SCI entities; (ix) require all SCI events to be reported to the
Commission, and certain types of SCI events to be disseminated to an
SCI entity's members or participants; and (x) establish semi-annual
reporting obligations for planned material systems changes. In
addition, proposed Regulation SCI would establish a system for
submitting required notices, reports, and other information to the
Commission on proposed new Form SCI. Each of these proposed
requirements goes beyond the explicit requirements in proposed Rules
13n-6 and 822.
---------------------------------------------------------------------------

    \309\ See supra Sections I and II.
    \310\ See proposed Rule 1000(a), which would define ``SCI
systems'' as ``all computer, network, electronic, technical,
automated, or similar systems of, or operated by or on behalf of, an
SCI entity, whether in production, development, or testing, that
directly support trading, clearance and settlement, order routing,
market data, regulation, or surveillance,'' and ``SCI security
systems'' as ``any systems that share network resources with SCI
systems that, if breached, would be reasonably likely to pose a
security threat to SCI systems.''
    \311\ While proposed Rule 13n-6 did not specifically include
such a requirement for SB SDRs, the SB SDR Proposing Release stated
that ``[a]s a general matter, the Commission preliminarily believes
that, if an SDR's policies and procedures satisfy industry best
practices standards, then these policies and procedures would be
adequate.'' See SB SDR Proposing Release, supra note 297, at 77333.
See also SB SEF Proposing Release, supra note 297, at 10988.
    \312\ See proposed Rule 1000(a), defining ``SCI event'' as an
event at an SCI entity that constitutes: (1) A systems disruption;
(2) a systems compliance issue; or (3) a systems intrusion.
---------------------------------------------------------------------------

3. Consideration of Applying the Requirements of Proposed Regulation
SCI to SB SDRs and/or SB SEFs
    If the Commission were to adopt Rules 13n-6 and 822 as proposed in
the SBS Releases and also adopt Regulation SCI as proposed herein,
there would be differences, as noted above, between the obligations
imposed on SB SDRs and SB SEFs with respect to system safeguards on the
one hand and the obligations imposed on SCI entities on the other.
Therefore, the Commission solicits comment on whether it should propose
to apply the requirements of proposed Regulation SCI, in whole or in
part, to SB SDRs and/or SB SEFs. In providing views on whether the
Commission should propose to apply proposed Regulation SCI to SB SDRs
and/or SB SEFs, commenters are encouraged to consider the discussion
regarding each provision of proposed Regulation SCI that is set forth
in Sections III.B through III.E above. Should the Commission to decide
to propose to apply the requirements of proposed Regulation SCI to such
entities, the Commission would issue a separate release discussing such
a proposal.
    In enacting Title VII of the Dodd-Frank Act, Congress judged it
important to increase the transparency and oversight of the OTC
derivatives market. In addition, in proposing Regulation SB SEF, the
Commission noted that SB SEFs are intended to ``lead to a more robust,
transparent, and competitive environment for the market for security-
based swaps (``SBS'' or ``SB swaps'').'' \313\ Similarly, in proposing
rules for SB SDRs, the Commission

noted that ``SDRs may be especially critical during times of market
turmoil, both by giving relevant authorities information to help limit
systemic risk and by promoting stability through enhanced
transparency'' and that, ``[b]y enhancing stability in the SBS market,
SDRs may also indirectly enhance stability across markets, including
equities and bond markets.'' \314\
---------------------------------------------------------------------------

    \313\ See SB SEF Proposing Release, supra note 297, at 11035.
    \314\ See SB SDR Proposing Release, supra note 297, at 77307.
---------------------------------------------------------------------------

    The Commission notes that it may or may not be appropriate to apply
the requirements of proposed Regulation SCI to SB SDRs and SB SEFs. In
particular, SB SDRs will play an important role in limiting systemic
risk and promoting the stability of the SBS market. SB SDRs also would
serve as information disseminators \315\ in a manner similar to plan
processors in the equities and options markets that, under this
proposal, would be subject to the requirements of proposed Regulation
SCI. SB SEFs would function as trading markets, and in that respect
could be viewed as analogous to national securities exchanges and SCI
ATSs, both of which function as trading markets and are included in the
proposed definition of SCI entity.\316\ The Commission preliminarily
believes that the same types of concerns and issues that have resulted
in the Commission previously publishing its ARP policy statements,\317\
developing its ARP Inspection Program,\318\ adopting certain aspects of
the ARP policy statements under Regulation ATS,\319\ and, ultimately,
proposing Regulation SCI,\320\ may similarly apply to SB SDRs and SB
SEFs. In proposing Rule 13n-6, the Commission noted that systems
failures can limit access to data, call into question the integrity of
data, and prevent market participants from being able to report
transaction data, and thereby have a large impact on market confidence,
risk exposure, and market efficiency.\321\ Similarly, in proposing Rule
822, the Commission noted that the proposed system safeguard
requirements for SB SEFs are designed to prevent and minimize the
impact of systems failures that might negatively impact the stability
of the SB swaps market.\322\ At the same time, because the Commission
recognizes that there may be differences between the markets for the
types of securities that would be covered by proposed Regulation SCI
and the SBS market, including differing levels of automation and stages
of regulatory development, the Commission requests comment on whether
it would be appropriate to propose to apply the requirements of
proposed Regulation SCI to SB SDRs and/or SB SEFs. As discussed further
below, the Commission also requests comment on whether, if commenters
believe proposed Regulation SCI should apply to SB SDRs and/or SB SEFs,
the system safeguard rules currently proposed for SB SDRs and SB SEFs
in the SBS Releases should, if adopted, be replaced, at some point in
the future, by the requirements proposed in this release and, if so,
how.
---------------------------------------------------------------------------

    \315\ See Securities Exchange Act Release No. 63346 (November
19, 2010), 75 FR 75208, 75227 (December 2, 2010) (proposing
Regulation SBSR).
    \316\ See SB SEF Proposing Release, supra note 297, at 10987,
n.246 (``Because SB SEFs would be an integral part of the market for
SB swaps, and therefore an integral part of the national market
system, the Commission believes that it is appropriate to model a SB
SEF's rules on system safeguards on ARP.'').
    \317\ See supra notes 1 and 12-18 and accompanying text.
    \318\ See supra notes 25-26 and accompanying text.
    \319\ See supra note 26 and accompanying text.
    \320\ See supra Section I.B.
    \321\ See SB SDR Proposing Release, supra note 297, at 77332.
    \322\ See SB SEF Proposing Release, supra note 297, at 10987.
---------------------------------------------------------------------------

    170. Are the SBS markets sufficiently similar to the markets within
which the proposed SCI entities operate such that it would be
appropriate to apply the same system safeguard requirements to SB SDRs
and/or SB SEFs that would be applicable to SCI entities? Why or why
not? Do commenters believe that there are characteristics of the SBS
markets that the Commission should consider to support its applying
different system safeguard rules to SB SDRs and/or SB SEFs than to SCI
entities? If so, what are those characteristics, and why should
different rules apply to SB SDRs and/or SB SEFs? If not, why not?
    171. If the Commission were to propose to apply some or all of the
provisions of proposed Regulation SCI to SB SDRs and/or SB SEFs, should
the Commission propose to apply the provisions of proposed Regulation
SCI differently to SB SDRs versus SB SEFs? For example, should the
Commission propose to apply some or all of the provisions of proposed
Regulation SCI to SB SDRs but not SB SEFs or vice versa? Why or why
not?
    172. What effect, if any, would there be of having SB SDRs and/or
SB SEFs subject to different system safeguard rules than those proposed
for SCI entities? Would there be any short term and/or long term impact
of SB SDRs and/or SB SEFs being subject to different system safeguard
rules than those proposed for SCI entities? For example, if SB SEFs
were subject to different system safeguard rules than those proposed
for SCI entities, would there be an impact on competition between SB
SEFs and national securities exchanges that trade SB swaps? Please
describe any expected impact on competition. Are there any provisions
in proposed Regulation SCI that, if applied to SB SEFs, would create
barriers to entry that could preclude small SB SEFs (e.g., those that
do not exceed a specified volume or liquidity threshold) from entering
the SBS market?
    173. The Commission also requests comment on whether it should
propose to apply all provisions of proposed Regulation SCI to SB SDRs
and/or SB SEFs or just those provisions comparable to the proposed
system safeguard rules for SB SDRs or SB SEFs.
    174. Should the Commission, if it were to propose to apply some or
all of the provisions of proposed Regulation SCI to SB SDRs and/or SB
SEFs, propose that SB SEFs and/or SB SDRs have written policies and
procedures reasonably designed to ensure that their SCI systems and,
for purposes of security standards, SCI security systems, have levels
of capacity, integrity, resiliency, availability, and security,
adequate to maintain their operational capability and promote the
maintenance of fair and orderly markets? Why or why not? If the
Commission were to propose such a requirement for SB SDRs and/or SB
SEFs, should SCI industry standards for SB SDRs and/or SB SEFs be
different from those proposed for SCI entities? If so, please explain
why. What are the industry standards that should apply to SB SEFs and/
or SB SDRs? Please be as specific as possible and explain why a
particular industry standard would be appropriate.
    175. Do the characteristics of the SBS market support a need for a
mandatory requirement that SB SDRs and/or SB SEFs maintain backup and
recovery capabilities sufficiently resilient and geographically diverse
to ensure next business day resumption of trading (for SB SEFs) or data
repository services (for SB SDRs) following a wide scale disruption?
Why or why not?
    176. Should the Commission propose to require SB SEFs and/or SB
SDRs to establish written policies and procedures regarding standards
that result in systems designed, developed, tested, maintained,
operated, and surveilled in a manner that facilitates the successful
collection, processing, and dissemination of market data? Why or why
not?
    177. Should the Commission propose to require SB SEFs and/or SB
SDRs to establish, maintain, and enforce policies and procedures
reasonably designed to ensure that their SCI systems operate in the
manner intended, including in a

manner that complies with federal securities laws and rules and
regulations thereunder and, as applicable, the entity's rules and
governing documents, as proposed for SCI entities in Rule
1000(b)(2)(i)? Why or why not? Should the Commission propose a safe
harbor from liability for SB SEFs and/or SB SDRs and their respective
employees if they satisfy the elements of a safe harbor, similar to
those for SCI entities in proposed Rules 1000(b)(2)(ii) and (iii)? Why
or why not?
    178. Should the Commission propose to require SB SEFs and/or SB
SDRs, with respect to their business continuity and disaster recovery
plans, including their backup systems, to require participation by
designated participants in scheduled functional and performance testing
of the operation of such plans at specified intervals, and to
coordinate such required testing with other SB SEFs and/or SB SDRs, as
proposed for SCI entities in Rule 1000(b)(9)? Why or why not?
    179. With regard to the reporting and information dissemination
requirements in proposed Rules 1000(b)(4) and Rule 1000(b)(5) of
Regulation SCI, would it be appropriate to propose that an SB SDR and/
or SB SEF be required to report all SCI events to the Commission, and
disseminate information relating to dissemination SCI events to their
participants? Why, or why not? If not, on what basis should SB SDRs
and/or SB SEFs be distinguished from other SCI entities?
    180. Should SB SDRs and/or SB SEFs be required to provide notice
of, and file semi-annual reports for, material systems changes with the
Commission, as proposed for SCI entities in Rules 1000(b)(6) and
(b)(8)? Why or why not?
    181. Should SB SDRs and/or SB SEFs be required to undertake an
annual SCI review of systems and submit to the Commission a report of
such review, together with any response of senior management, as
proposed for SCI entities in Rule 1000(b)(7) and (8)? Why or why not?
    182. Should SB SDRs and/or SB SEFs be required to submit any
required notices, reports, and other information to the Commission on
proposed new Form SCI? Why, or why not?
    183. If the Commission were to determine that it would be
appropriate to propose to apply some or all of the requirements of
proposed Regulation SCI to SB SDRs and/or SB SEFs, should the
Commission propose to apply such requirements of proposed Regulation
SCI to all SB SDRs? To all SB SEFs? Are there distinctions that should
be made between different types of SB SDRs (or SB SEFs) such that some
requirements of proposed Regulation SCI might be appropriate for some
SB SDRs (or SB SEFs) but not others? If so, what are those distinctions
and what are those requirements? For example, should any requirements
be based on criteria such as number of transactions or notional volume
reported to a SB SDR or executed on a SB SEF? If so, what would be an
appropriate threshold for any such criteria, and why?
    184. Alternatively, given the nascent stage of regulatory
development of the SBS markets, would it be appropriate to create a
category under proposed Regulation SCI such as ``new SB SCI entity''
that would, for example, be applicable to SB SDRs and/or SB SEFs for a
certain period of time after such entities become registered with the
Commission? If so, what period of time would be appropriate (e.g., one
year, three years, or some other period)? Should there be other
criteria for an SB SEF (or SB SDR) to be considered a new SB SCI
entity? If so, what should be the criteria for inclusion? Would market
share, number of transactions, and/or notional volume be appropriate
criteria? If so, at what level should the criteria thresholds be set,
and why? If not, why not? How should the requirements of proposed
Regulation SCI differ for such ``new SB SCI entities?''
    185. The Commission notes that, if it were to adopt proposed
Regulation SCI and proposed Rules 13n-6 and 822, the system safeguard
rules applicable to SB SDRs and SB SEFs would diverge from those
applicable to SCI entities, as well as from those the CFTC has adopted
for SDRs and may adopt for SEFs.\323\ What negative effects, if any, do
commenters believe would result from disparity in the: (1) Commission's
system safeguard rules applicable to SB SDRs and/or SB SEFs; (2)
requirements of Regulation SCI applicable to SCI entities; and (3)
CFTC's system safeguard rules applicable to SDRs and SEFs?
---------------------------------------------------------------------------

    \323\ As noted above, SDRs and SEFs, entities similar to SB SDRs
and SB SEFs, respectively, are subject to the CFTC's jurisdiction.
The CFTC's system safeguards rules for SDRs, and those proposed for
SEFs differ from those rules that the Commission is proposing in
Regulation SCI. See 76 FR 54538 (September 1, 2011) (adopting 17 CFR
part 49, Swap Data Repositories: Registration Standards, Duties and
Core Principles, Effective October 31, 2011); 76 FR 1214 (January 7,
2011) (proposing 17 CFR part 37, Core Principles and Other
Requirements for Swap Execution Facilities). For example, for SDRs,
the CFTC requires same day recovery for ``critical SDRs'' whereas
proposed Regulation SCI would require next business day recovery for
trading services (and two-hour recovery for clearing and settlement
services). See CFTC Rule 49.24.
---------------------------------------------------------------------------

    186. The Commission seeks commenters' views on all aspects of
whether to propose to apply Regulation SCI to SB SDRs and/or SB SEFs,
taking into account the possibility that any final Commission action on
proposed Rules 13n-6 and 822 could occur prior to any final Commission
action on proposed Regulation SCI. The Commission seeks commenters'
views on whether a proposal to extend the requirements of proposed
Regulation SCI to SB SDRs and/or SB SEFs would be beneficial to help to
promote the integrity, capacity, resiliency, availability, and security
of their systems. The Commission notes that having comparable system
safeguard requirements may be appropriate for SB SDRs and/or SB SEFs
if, as noted above, the same types of concerns and issues that have
resulted in the Commission previously publishing its ARP policy
statements, developing its ARP Inspection Program, adopting certain
aspects of the ARP policy statements under Regulation ATS, and,
ultimately, proposing Regulation SCI, also apply to SB SDRs and/or SB
SEFs.
    187. The Commission is particularly interested in commenters' views
on the different benefits and costs associated with applying proposed
Regulation SCI to SB SDRs and/or SB SEFs versus the costs and benefits
of applying proposed Rules 13n-6 and 822 to SB SDRs and SB SEFs,
respectively. In the SBS Proposing Releases, the Commission provided
aggregate estimates of the costs of its proposed rules governing SB
SDRs and SB SEFs. The SB SDR Proposing Release provided an aggregate
initial cost estimate of approximately $214,913,592 to be incurred by
prospective SB SDRs and an aggregate ongoing annualized cost estimate
of approximately $140,302,120, both of which estimates took account of
proposed Rule 13n-6.\324\

Similarly, the SB SEF Proposing Release provided an aggregate initial
cost estimate of approximately $41,692,900 and an aggregate ongoing
annualized cost estimate of approximately $22,342,700 to be incurred by
prospective SB SEFs, both of which estimates took account of proposed
Rule 822.\325\
---------------------------------------------------------------------------

    \324\ See SB SDR Proposing Release, supra note 297, at 77364. In
the SB SDR Proposing Release, the Commission estimated that the
paperwork burden associated with proposed Rule 13n-6 would come from
preparing and implementing policies associated with SB SDR duties,
data collection and maintenance, automated systems and direct
electronic access, and from preparing reports and reviews. See id.
at 77345-46. The Commission estimated that there would be up to 10
SB SDRs subject to the proposed SB SDR rules. See id. at 77355.
Based on the information in the SB SDR Proposing Release, the
Commission estimated that the aggregate burden on an estimated 10 SB
SDRs to prepare and implement the policies and procedures under Rule
13n-6 would be 2100 hours along with 500 hours of outside legal
services at $400 an hour, and that the aggregate annual burden on
such SB SDRs to maintain such policies would be an additional 600
hours. See id. at 77349. Based on the information in the SB SDR
Proposing Release, the Commission estimated that the annual
aggregate burden on SB SDRs to promptly notify the Commission and
submit a written description and analysis of outages and any
remedial measures would be 154 hours and the aggregate annual burden
on SB SDRs to notify the Commission of planned material system
changes would be 1200 hours. See id. at 77349-50. The Commission
estimated that the aggregate annual burden on SB SDRs to submit an
objective review would be 8250 hours and $900,000. See id. at 77350.
    \325\ See SB SEF Proposing Release, supra note 297, at 11034. In
the SB SEF Proposing Release, the Commission estimated that the
paperwork burden associated with Rule 822 would come from rule
writing requirements under Rule 822(a)(1), and from reporting
requirements under Rules 822(a)(2), 822(a)(3), and 822(a)(4). See
id. at 11017-19. The Commission also estimated that there would be
up to 20 SB SEFs subject to the proposed SB SEF rules. See id. at
11023. Based on the information in the SB SEF Proposing Release, the
Commission estimated that the aggregate burden on an estimated 20 SB
SEFs to draft rules to implement Rule 822 would be 200 hours, see
id. at 11026, and that the aggregate annual burden on an estimated
20 SB SEFs to comply with the reporting requirements under Rule 822
would be 19,208 hours and $1,800,000. See id. at 11029.
---------------------------------------------------------------------------

    If the Commission were to propose to apply Regulation SCI to SB
SDRs and/or SB SEFs, it preliminarily believes that the initial
potential costs of such application could differ from the costs to be
incurred by SCI entities that currently participate in the ARP
Inspection Program on a per entity basis, as described in Sections IV
and V below. This is because prospective SB SDRs and prospective SB
SEFs, unlike those entities, are not now subject to the ARP Inspection
Program and its standards.\326\ However, the Commission preliminarily
believes that the initial potential costs of such application to SB
SDRs and SB SEFs, on a per entity basis, could be equivalent to those
costs estimated below in Sections IV and V with respect to SCI entities
that currently do not participate in the ARP Inspection Program.
Further, as noted above, the SBS Releases have accounted for potential
costs to be incurred by SB SDRs and SB SEFs in implementing the
proposed system safeguard requirements in Rules 13n-6 and 822,
respectively and, as discussed above, the requirements in proposed
Regulation SCI could be incremental to those already proposed in Rules
13n-6 and 822. The Commission therefore preliminarily believes that, if
it were to decide to propose to apply some or all of the requirements
of proposed Regulation SCI to SB SDRs and/or SB SEFs, the costs of
applying proposed Regulation SCI to SB SDRs and/or SB SEFs would be
incremental to the costs associated with proposed Rules 13n-6 and 822.
---------------------------------------------------------------------------

    \326\ As stated in the SB SDR Proposing Release, ``[t]he
Commission believes that persons currently operating as SDRs may
have developed and implemented aspects of the proposed rules
already,'' and that ``the Commission does not believe that the one-
time cost of [enhancements to their information technology systems]
will be significant.'' See supra note 297, at 77358.
---------------------------------------------------------------------------

    188. The Commission seeks commenters' views regarding the
prospective costs, as well as the potential benefits, of proposed
Regulation SCI to SB SDRs and/or SB SEFs. Commenters should quantify
the costs of applying proposed Regulation SCI to SB SDRs and/or SB
SEFs, to the extent possible. As noted above, commenters are urged to
address specifically each requirement of proposed Regulation SCI and
note whether it would be reasonable to propose to apply each such
requirement to SB SDRs and/or SB SEFs and what the benefits and costs
of such application would be.
4. Timing and Implementation Considerations
    As noted above, the Commission has proposed rules providing a
regulatory framework for SB SDRs and SB SEFs, but has not yet adopted
final rules governing these entities. To date, the Commission has not
received any comments with respect to the timing of the implementation
of proposed Rule 13n-6 \327\ but has received one comment in connection
with the timing of the implementation of proposed Rule 822.\328\
---------------------------------------------------------------------------

    \327\ The Commission, however, has received comments that
suggest a phase-in approach to the proposed SB SDR rules generally
may be appropriate. These comments generally indicate that a phase-
in approach would be necessary to enable existing swap data
repositories and other market participants to make the necessary
changes to their operations. See, e.g., Letter in response to a
joint public roundtable conducted by Commission and CFTC staff on
implementation issues raised by Title VII of the Dodd-Frank Act on
May 2 and 3, 2011, from The Financial Services Roundtable, available
on the Commission's Web site at: http://www.sec.gov/comments/4-625/4625-1.pdf (stating that ``it may be prudent to have different
portions of a single rulemaking proposal take effect at different
times and with due consideration of steps that are preconditions to
other steps,'' suggesting, as an example, that ``a requirement to
designate a CCO should be implemented quickly, but that the CCO be
given time to design, implement, and test the compliance system
before any requirement to certify as to the compliance system
becomes effective'' and supporting a phase-in approach ``that
recognizes the varying levels of sophistication, resources and scale
of operations within a particular category of market participant'').
    \328\ See ISDA SIFMA SB SEF Letter at 12 (``Many of the proposed
rules will pose significant operational and administrative hurdles
for market participants and SB SEFs. For example, the proposed rules
have requirements for system safeguards that will require time and
systems expertise to implement fully. We strongly suggest that SB
SEFs be allowed to adopt the rules on a staged basis so that the
basic functioning of the SB SEF and the market can be established
before all requirements are imposed.''). As with the proposed SB SDR
rules, the Commission has received general comments suggesting that
a phase-in approach for all SB SEF Rules may be generally
appropriate. See, e.g., Thomson SB SEF Letter at 8 (stating that
``in order to ensure the proper operation of these markets, it may
be necessary for the SEC to adopt a phased-in approach and we would
urge avoiding over-hasty rulemaking which could result in unintended
consequences for the markets and the broader economy'').
---------------------------------------------------------------------------

    Although the Commission has issued a policy statement regarding the
anticipated sequencing of the compliance dates of final rules to be
adopted by the Commission for certain provisions of Title VII of the
Dodd-Frank Act,\329\ the precise timing for adoption of or compliance
with any final rules relating to SB SDRs or SB SEFs, or for adoption of
or compliance with proposed Regulation SCI, is not known at this time.
In addition, as the Title VII Implementation Policy Statement notes,
any final rules for SB SDRs and SB SEFs potentially would be considered
by the Commission at different times.\330\ As such, specifying the
precise timing and ordering of the implementation of any requirements
of proposed Regulation SCI, or Rules 13n-6 and 822, to SB SDRs and/or
SB SEFs is difficult to predict, should the Commission determine to
proposed to apply some or all of the requirements of proposed
Regulation SCI to SB SDRs and/or SB SEFs, or adopt Rules 13n-6 and 822
to SB SDRs and SB SEFs, respectively.
---------------------------------------------------------------------------

    \329\ See Securities Exchange Act Release No. 67177 (June 11,
2012), 77 FR 35625 (June 14, 2012) (Statement of General Policy on
the Sequencing of the Compliance Dates for Final Rules Applicable to
Security-Based Swaps Adopted Pursuant to the Securities Exchange Act
of 1934 and the Dodd-Frank Wall Street Reform and Consumer
Protection Act) (``Title VII Implementation Policy Statement'').
    \330\ See id. at 35629 (noting that the rules pertaining to the
registration and regulation of SB SDRs are in the second category of
rules, whereas the rules pertaining to the registration and
regulation of SB SEFs are in the fifth category of rules).
---------------------------------------------------------------------------

    189. Nonetheless, the Commission requests comment on what--if the
Commission were to propose to apply some or all of the requirements of
proposed Regulation SCI to SB SDRs and/or SB SEFs--would be the most
appropriate way to implement such requirements for SB SDRs and/or SB
SEFs. For example, should the Commission seek to implement such
requirements for SB SDRs and/or SB SEFs within the same timeframe as
those entities currently defined as SCI entities under the proposal?
Alternatively, should the applicability of some or all of Regulation
SCI to SB SDRs and/or SB SEFs be phased in over time? If so, what
provisions of proposed Regulation SCI should be phased in and

what would be an appropriate phase-in period? Should there be different
phase-in schedules for different SB SDRs and/or SB SEFs? Why or why
not? If yes, how would the SB SDRs and/or SB SEFs be selected for
different phase-in schedules? Please be specific.
    190. Do commenters believe that, because the Commission's actions
to implement the regulatory framework for the SB swaps market are still
in progress, the Commission should not propose to apply the
requirements of Regulation SCI to SB SDRs and/or SB SEFs at the same
time as SCI entities, but instead should adopt the system safeguard
provisions of proposed Rules 13n-6 and 822 and reconsider such
requirements in the future after the SB swaps market and the
Commission's regulation of such market and its participants has
developed further? Why or why not? What would be the impact of this
approach for SB SDRs and/or SB SEFs?
    191. As discussed in the SBS Releases,\331\ the system safeguards
requirements in proposed Rules 13n-6 and 822 have their origins in the
Commission's ARP standards. Though they differ in scope and detail, the
provisions of proposed Regulation SCI likewise trace their origin to
the Commission's ARP standards.\332\ If the Commission were to adopt
final rules for SB SDRs and/or SB SEFs before it were to adopt
Regulation SCI, and if the Commission were to decide to propose to
apply some or all of the requirements of proposed Regulation SCI to SB
SDRs and/or SB SEFs, should the Commission require SB SDRs and/or SB
SEFs to comply with the requirements of the system safeguards rules in
proposed Rules 13n-6 and 822 \333\ first, and apply the requirements of
Regulation SCI to SB SDRs and/or SB SEFs at a specific date in the
future? If the Commission were to adopt Rules 13n-6 and 822 prior to
adoption of proposed Regulation SCI, and if the Commission were to
decide to propose to apply some or all of the requirements of proposed
Regulation SCI to SB SDRs and/or SB SEFs, should the Commission delay
implementation of Rules 13n-6 and 822 and instead request that SB SDRs
and/or SB SEFs comply with the Commission's voluntary ARP Inspection
Program until such time as the Commission were to propose and adopt
Regulation SCI for SB SDRs and SB SEFs?
---------------------------------------------------------------------------

    \331\ See supra note 299 and accompanying text.
    \332\ See supra notes 310-312 and accompanying text.
    \333\ See supra notes 298-302 and accompanying text.
---------------------------------------------------------------------------

G. Solicitation of Comment Regarding Potential Inclusion of Broker-
Dealers, Other than SCI ATSs, and Other Types of Entities

1. Policy Considerations
    As discussed above, the requirements of proposed Regulation SCI
would apply to national securities exchanges, registered securities
associations, registered clearing agencies, the MSRB, SCI ATSs, plan
processors, and exempt clearing agencies subject to ARP. They would not
apply to other types of market participants, such as market makers or
other broker-dealers. This proposed scope of the definition of SCI
entity in part reflects the historical reach of the ARP policy
statements (which apply, for example, to national securities exchanges)
and existing Rule 301 of Regulation ATS (which applies systems
safeguard requirements to certain ATSs).
    Recent events have highlighted the significance of systems
integrity of a broader set of market participants than those proposed
to be included within the definition of SCI entity.\334\ Also, some
broker-dealers have grown in size and importance to the market in
recent years. For example, many orders are internalized by OTC market
makers, one subset of broker-dealers, who handle a large portion of
order flow in the market.\335\ The Commission recognizes that systems
disruptions, systems compliance issues, and systems intrusions at
broker-dealers, including for example OTC market makers and clearing
broker-dealers, could pose a significant risk to the market. Such an
occurrence could impact all orders being handled by a broker-dealer,
which can be significant for larger broker-dealers. If a given broker-
dealer handles a large portion of order flow and suddenly experiences a
systems disruption or systems intrusion, the disruption or intrusion
could cause ripple effects. For example, a systems issue at one broker-
dealer could result in confusion about whether orders are handled
correctly or whether the systems issue at the broker-dealer could have
caused capacity issues elsewhere.\336\
---------------------------------------------------------------------------

    \334\ For example, on August 1, 2012, Knight Capital Group, Inc.
(``Knight'') reported that it ``experienced a technology issue at
the opening of trading at the NYSE * * * [which was] related to
Knight's installation of trading software and resulted in Knight
sending numerous erroneous orders in NYSE-listed securities into the
market * * *. Knight has traded out of its entire erroneous trade
position, which has resulted in a realized pre-tax loss of
approximately $440 million.'' See Knight Capital Group Provides
Update Regarding August 1st Disruption To Routing In NYSE-listed
Securities (August 2, 2012), available at: http://www.knight.com/investorRelations/pressReleases.asp?compid=105070&releaseID=1721599.
    Among other things, Knight provides market making services in
U.S. equities and U.S. options; institutional sales and trading
services; electronic execution services; and corporate and other
services. See Knight Operating Subsidiaries, available at: http://www.knight.com/ourFirm/operatingSubsidiaries.asp. Knight also
operates two registered ATSs, Knight Match and Knight Bond Point.
See Knight Match, available at: http://www.knight.com/electronicExecutionServices/knightMatch.asp; Knight BondPoint,
available at: http://www.knight.com/electronicExecutionServices/knightBondpoint.asp; and Alternative Trading Systems Active Filers
as of April 30, 2012, available at: http://www.sec.gov/foia/ats/atslist0412.pdf.
    \335\ See Concept Release on Equity Market Structure, supra note
42, at 3600 (stating: ``OTC market makers, for example, appear to
handle a very large percentage of marketable (immediately
executable) order flow of individual investors that is routed by
retail brokerage firms. A review of the order routing disclosures
required by Rule 606 of Regulation NMS of eight broker-dealers with
significant retail customer accounts reveals that nearly 100% of
their customer market orders are routed to OTC market makers.'')
    \336\ For example, if an e-market-maker handling 20 percent of
message traffic experiences a systems issue, the order flow could be
diverted elsewhere, including to entities that are unable to handle
the increase in message traffic, resulting in a disruption to that
entity's systems as well. Similarly, a broker-dealer accidentally
could run a test during live trading and flood markets with message
traffic such that those markets hit their capacity limits, resulting
in a disruption.
---------------------------------------------------------------------------

    The Commission is not at this time proposing to include some
classes of registered broker-dealers (other than SCI ATSs) in the
definition of SCI entity. Were the Commission to decide to propose to
apply the requirements of proposed Regulation SCI to such entities, the
Commission would issue a separate release discussing such a proposal.
Rule 15c3-5, requiring brokers or dealers with market access to
implement risk management controls and supervisory procedures to limit
risk, already seeks to address certain risks posed to the markets by
broker-dealer systems. Specifically, in 2010 when the Commission
adopted Rule 15c3-5 regarding risk management controls and supervisory
procedures for brokers or dealers with market access,\337\ the
Commission stated that

``broker-dealers, as the entities through which access to markets is
obtained, should implement effective controls reasonably designed to
prevent errors or other inappropriate conduct from potentially causing
a significant disruption to the markets'' and that ``risk management
controls and supervisory procedures that are not applied on a pre-trade
basis or that, with certain limited exceptions, are not under the
exclusive control of the broker-dealer, are inadequate to effectively
address the risks of market access arrangements, and pose a
particularly significant vulnerability in the U.S. national market
system.'' \338\
---------------------------------------------------------------------------

    \337\ See Securities Exchange Act Release No. 63241 (November 3,
2010), 75 FR 69792 (November 15, 2010) (``Market Access Release'').
Rule 15c3-5(a)(1) defines ``market access'' to mean: (i) access to
trading in securities on an exchange or ATS as a result of being a
member or subscriber of the exchange or ATS, respectively; or (ii)
access to trading in securities on an ATS provided by a broker-
dealer operator of an ATS to a non-broker-dealer. See 17 CFR
240.15c3-5(a)(1). In adopting Rule 15c3-5(a)(1), the Commission
stated that ``the risks associated with market access * * * are
present whenever a broker-dealer trades as a member of an exchange
or subscriber to an ATS, whether for its own proprietary account or
as agent for its customers, including traditional agency brokerage
and through direct market access or sponsored access arrangements.''
See Market Access Release at 69798. As such, the Commission stated
that ``to effectively address these risks, Rule 15c3-5 must apply
broadly to all access to trading on an Exchange or ATS.'' See id.
    \338\ Id. at 69794.
---------------------------------------------------------------------------

    Pursuant to Rule 15c3-5, a broker or dealer with market access, or
that provides a customer or any other person with access to an exchange
or ATS through use of its market participant identifier or otherwise,
must establish, document, and maintain a system of risk management
controls and supervisory procedures reasonably designed to manage the
financial, regulatory, and other risks of this business activity.\339\
Rule 15c3-5 also specifies the baseline standards for financial and
regulatory risk management controls and supervisory procedures.\340\
The financial risk management controls and supervisory procedures must
be reasonably designed to systematically limit the financial exposure
of the broker or dealer that could arise as a result of market
access.\341\ The regulatory risk management controls and supervisory
procedures must be reasonably designed to ensure compliance with all
regulatory requirements.\342\
---------------------------------------------------------------------------

    \339\ See 17 CFR 240.15c3-5(b). Certain broker-dealers are
exempt from some of the requirements under Rule 15c3-5. See id.
    \340\ See 17 CFR 240.15c3-5(c).
    \341\ See 17 CFR 240.15c3-5(c)(1). Such financial risk
management controls and supervisory procedures must be reasonably
designed to: (i) Prevent the entry of orders that exceed appropriate
pre-set credit or capital thresholds in the aggregate for each
customer and the broker or dealer, and where appropriate, more
finely-tuned by sector, security or otherwise by rejecting orders if
such orders would exceed the applicable credit or capital
thresholds; and (ii) prevent the entry of erroneous orders, by
rejecting orders that exceed appropriate price or size parameters,
on an order-by-order basis or over a short period of time, or that
indicate duplicative orders. See 17 CFR 240.15c3-5(c)(1).
    \342\ See 17 CFR 240.15c3-5(c)(2). Such regulatory risk
management controls and supervisory procedures must be reasonably
designed to: (i) Prevent the entry of orders unless there has been
compliance with all regulatory requirements that must be satisfied
on a pre-order entry basis; (ii) prevent the entry of orders for
securities for a broker or dealer, customer, or other person if such
person is restricted from trading those securities; (iii) restrict
access to trading systems and technology that provide market access
to persons and accounts pre-approved and authorized by the broker or
dealer; and (iv) assure that appropriate surveillance personnel
receive immediate post-trade execution reports that result from
market access. See 17 CFR 240.15c3-5(c)(2).
---------------------------------------------------------------------------

    Under the approach set out by Rule 15c3-5, broker-dealers with
market access are responsible in the first instance for establishing
and maintaining appropriate risk management controls, including with
respect to their systems. Although Rule 15c3-5 takes a different and
more limited approach with broker-dealers than proposed Regulation SCI
does with SCI entities, the requirements in Rule 15c3-5 are designed to
address some of the same concerns regarding systems integrity discussed
in this proposal. As an example of reasonable risk control under Rule
15c3-5, the Commission stated, ``a system-driven, pre-trade control
designed to reject orders that are not reasonably related to the quoted
price of the security would prevent erroneously entered orders from
reaching the securities markets, * * * should lead to fewer broken
trades and thereby enhance the integrity of trading on the securities
markets.'' \343\
---------------------------------------------------------------------------

    \343\ See Market Access Release, supra note 337, at 69794.
---------------------------------------------------------------------------

    In light of recent events, however, the Commission believes that it
is appropriate to consider whether some types or categories of broker-
dealers other than SCI ATSs should also be subject to some or all of
the additional system safeguard rules that are proposed for SCI
entities. Such broker-dealers could include, for example, OTC market
makers (either all or those that execute a significant volume of
orders), exchange market makers (either all or those that trade a
significant volume on exchanges), order entry firms that handle and
route order flow for execution (either all or those that handle a
significant volume of investor orders), clearing broker-dealers (either
all or those that engage in a significant amount of clearing
activities), and large multi-service broker-dealers that engage in a
variety of order handling, trading, and clearing activities.
2. Request for Comment
    192. As noted above, at this time, the Commission is not proposing
to apply Regulation SCI to broker-dealers other than SCI ATSs or to
other types of entities that are not covered by the definition of SCI
entity. Were the Commission to decide to propose to apply the
requirements of Regulation SCI to such entities, the Commission would
issue a separate release discussing such a proposal. Nevertheless, the
Commission is soliciting comment generally on whether it should apply
the requirements of proposed Regulation SCI, in whole or in part, to
such entities. Specifically:
    193. What are the current practices of broker-dealers in relation
to the requirements of proposed Regulation SCI? \344\ Would the current
practices of broker-dealers that provide market access and comply with
Rule 15c3-5 change if they were also subject to proposed Regulation
SCI? Why or why not? If so, how? Are there broker-dealers who do not
provide the services that would require compliance with Rule 15c3-5? If
so, how do the practices of those broker-dealers compare to the
requirements of proposed Regulation SCI?
---------------------------------------------------------------------------

    \344\ As noted above, one ATS currently voluntarily participates
in the ARP Inspection Program. See supra note 91.
---------------------------------------------------------------------------

    194. In Section VI.B.2 below, the Commission discusses potential
market failures that may explain why market solutions cannot solve the
problems that proposed Regulation SCI is intended to address. Does the
market for broker-dealer services, including client services, market
maker services, or market access services, suffer from market failures
that limit the ability of the market to solve the issues that proposed
Regulation SCI is intended to address? For example, are broker-dealers'
clients able to easily switch broker-dealers, and how often do clients
use more than one broker-dealer simultaneously (e.g., for redundancy in
case of a problem at a given broker-dealer)? Are broker-dealers subject
to more market discipline than SCI entities? Please explain.
Conversely, does a lack of transparency regarding events like SCI
events limit this market discipline? Why or why not?
    195. Given the stated goals and purpose of proposed Regulation SCI
and its various provisions,\345\ what are commenters' views on whether
the scope of the proposed rules should be expanded to cover broker-
dealers, or certain categories of broker-dealers? For example, what are
commenters' views on the impact to overall market integrity or the
protection of investors if an OTC market maker was no longer able to
operate due to a systems disruption, systems compliance issue, or a
systems intrusion? Or an exchange market maker? Or a clearing broker-
dealer? What are commenters' views on the

importance of different categories of broker-dealers to the stability
of the overall securities market infrastructure, in the context of
requiring them to comply with the proposed rules, in light of the
stated goals and purpose of Regulation SCI? What risks do the systems
of broker-dealers pose on the securities markets?
---------------------------------------------------------------------------

    \345\ See supra Section III.
---------------------------------------------------------------------------

    196. If the Commission were to subsequently propose to apply some
or all of the requirements of proposed Regulation SCI to some types or
categories of broker-dealers (in addition to SCI ATSs), what types of
broker-dealers should the requirements apply to and why? Are there
distinctions that should be made between different types of broker-
dealers (e.g., OTC market makers, exchange market makers, order entry
firms, clearing broker-dealers, and multi-service broker-dealers) for
this purpose? If so, what are those distinctions and which requirements
should apply?
    197. The Commission notes that Roundtable panelists generally did
not distinguish between national securities exchanges, ATSs, and
different types of broker-dealers when addressing how to improve error
prevention and error response strategies. Rather, Roundtable panelists
and commenters referred more generally to ``entities with market
access'' and/or ``execution venues.'' \346\ In this regard, should the
Commission consider expanding the application of Regulation SCI to all
market centers, as that term is defined in Rule 600(b)(38) of
Regulation NMS,\347\ which means any exchange market maker, OTC market
maker, ATS, national securities exchange, or national securities
association? \348\ Why or why not? Would an expansion of proposed
Regulation SCI to include all market centers (i.e., execution venues)
inappropriately exclude the broader category of entities having market
access? Why or why not? Alternatively, should the Commission consider
applying the requirements of proposed Regulation SCI to (a) any
registered market maker or (b) any broker-dealer that offers market
access that, in either case, with respect to any NMS stock, has a
specified percentage of average daily dollar volume? If so, what should
such a percentage be? Would the levels applicable to SCI ATSs that
trade NMS stocks under proposed Rule 1000(a) of Regulation SCI be
appropriate for registered market makers, broker-dealers that offer
market access, or other broker-dealers? Why or why not? If not, what
should such a threshold be?
---------------------------------------------------------------------------

    \346\ See, e.g., letter from Better Markets, supra note 74,
arguing that regulators should encourage firms to adopt more robust
software development practices and audit any firm with direct market
access or require third-party certification and mandate minimum
requirements for testing any application that has direct market
access. In addition, the panelist from NYSE stated that common
standards for technology deployment should apply across all
execution venues.
    \347\ 17 CFR 242.600(b)(38).
    \348\ Rule 600(b)(24) defines exchange market maker to mean any
member of a national securities exchange that is registered as a
specialist or market maker pursuant to the rules of such exchange,
and Rule 600(b)(52) defines OTC market maker to mean any dealer that
holds itself out as being willing to buy from and sell to its
customers, or others, in the U.S., an NMS stock for its own account
on a regular or continuous basis otherwise than on a national
securities exchange in amounts of less than block size. See 17 CFR
242.600(b)(24) and 17 CFR 242.600(b)(52).
---------------------------------------------------------------------------

    198. If the Commission were to propose to expand the scope of
proposed Regulation SCI to a subset of broker-dealers, what are
commenters' views on whether, and if so, how, the various different
proposed requirements of Regulation SCI should or should not apply to
such entities?
    199. If the Commission were to propose to expand the scope of
proposed Regulation SCI to include a subset of broker-dealers, should
the Commission require such broker-dealers to have written policies and
procedures reasonably designed to ensure that their systems have levels
of capacity, integrity, resiliency, availability, and security adequate
to maintain their operational capability, and promote the maintenance
of fair and orderly markets, as proposed in Rule 1000(b)(1) for SCI
entities? Why or why not? Should SCI industry standards for broker-
dealers be different from those proposed for SCI entities? If so, what
are the standards that should apply to broker-dealers? Please be as
specific as possible and explain why a particular standard would be
appropriate.
    200. Should the Commission require such broker-dealers to
establish, maintain, and enforce policies and procedures reasonably
designed to ensure that their systems operate in the manner intended,
including in a manner that complies with federal securities laws and
rules and regulations thereunder, as proposed in Rule 1000(b)(2)(i) for
SCI entities? Why or why not? Should the Commission establish a safe
harbor from liability for such broker-dealers and their respective
employees if they satisfy the elements of a safe harbor, similar to
those in proposed Rules 1000(b)(2)(ii) and (iii) for SCI entities and
their employees? Why or why not?
    201. Should the Commission require such broker-dealers, upon any of
their responsible SCI personnel becoming aware of an SCI event, to
begin to take appropriate corrective action including, at a minimum,
mitigating potential harm to investors and market integrity resulting
from the SCI event and devoting adequate resources to remedy the SCI
event as soon as reasonably practicable, as proposed in Rule 1000(b)(3)
for SCI entities? Why or why not? Should such broker-dealers'
corrective action be triggered by something other than awareness of an
SCI event? If so, what would be an appropriate trigger?
    202. With regard to the reporting and information dissemination
requirements for SCI entities in proposed Rules 1000(b)(4) and
1000(b)(5), would it be appropriate to require such broker-dealers to
report all SCI events to the Commission, and disclose dissemination SCI
events to their customers?
    203. Should such broker-dealers be required to notify the
Commission of material systems changes, as proposed in Rule 1000(b)(6)
for SCI entities? Why or why not?
    204. Should such broker-dealers be required to undertake an annual
SCI review of their systems, as proposed in Rule 1000(b)(7) for SCI
entities? Should such broker-dealers also be required to provide the
Commission with reports regarding the SCI review and material systems
changes, as proposed in Rule 1000(b)(8) for SCI entities? Why or why
not?
    205. Should such broker-dealers be required to submit any required
notices, reports, and other information to the Commission on proposed
new Form SCI? Why or why not?
    206. Alternatively, should the Commission propose to require that
each SCI SRO establish rules requiring that its members adopt written
policies and procedures reasonably designed to ensure that their
systems have levels of capacity, integrity, resiliency, availability,
and security adequate to maintain their operational capability, and
promote the maintenance of fair and orderly markets? Why or why not?
Similarly, should the Commission propose to require that each SCI SRO
establish rules requiring that its members adopt written policies and
procedures reasonably designed to ensure that the systems of such
members operate in the manner intended, including in a manner that
complies with applicable federal securities laws and rules and
regulations thereunder and the SCI SRO's rules? Why or why not? In
either case, would such a proposal raise any competitive issues, such
as between

national securities exchanges and ATSs? \349\
---------------------------------------------------------------------------

    \349\ The Commission notes that all broker-dealers are members
of one or more SCI SROs (such as FINRA and/or a national securities
exchange), while participants on ATSs may include non-broker-dealer
market participants.
---------------------------------------------------------------------------

    207. In addition, should the Commission consider including other
entities in the definition of SCI entity (e.g., transfer agents), thus
subjecting them to some or all of the requirements under proposed
Regulation SCI? If yes, to which entities should some or all of
proposed Regulation SCI apply and why? If not, why not? If commenters
believe other types of entities should be included in the definition of
SCI entity, should the Commission include all entities of a given type
in the definition? Why or why not? If not, how should the Commission
distinguish those entities that should be included (e.g., size, volume,
types of services performed, etc.)? Please describe and be as specific
as possible.
    208. If the Commission were to subsequently propose and adopt a
rule applying Regulation SCI to all or certain categories of broker-
dealers or other entities, what are commenters' views as to the type
and scale of the costs of such application? Please explain. In
addition, what are commenters' views as to the potential impact on
efficiency, competition, and capital formation of such application?
Please explain.

IV. Paperwork Reduction Act

    Certain provisions of the proposal contain ``collection of
information'' requirements within the meaning of the Paperwork
Reduction Act of 1995 (``PRA'') \350\ and the Commission will submit
them to the Office of Management and Budget (``OMB'') for review in
accordance with 44 U.S.C. 3507 and 5 CFR 1320.11. The title of the new
collection of information is Regulation Systems Compliance and
Integrity. An agency may not conduct or sponsor, and a person is not
required to respond to, a collection of information unless it displays
a currently valid OMB control number.
---------------------------------------------------------------------------

    \350\ 44 U.S.C. 3501 et seq.
---------------------------------------------------------------------------

A. Summary of Collection of Information

    Proposed Regulation SCI would include four categories of
obligations that would require a collection of information within the
meaning of the PRA. Specifically, an SCI entity would be required to:
(1) Establish specified written policies and procedures, and mandate
participation by designated members or participants in certain testing
of the SCI entity's business continuity and disaster recovery plans;
(2) provide certain notifications, disseminate certain information, and
create reports; (3) take corrective actions, identify certain SCI
events for which immediate Commission notification is required, and
identify dissemination SCI events; and (4) comply with recordkeeping
and access requirements relating to its compliance with proposed
Regulation SCI.
1. Requirements To Establish Written Policies and Procedures and
Mandate Participation in Certain Testing
    Proposed Rules 1000(b)(1) and (b)(2) would require SCI entities to
establish policies and procedures with respect to various matters.
Proposed Rule 1000(b)(1) would require each SCI entity to establish,
maintain, and enforce written policies and procedures reasonably
designed to ensure that its SCI systems and, for purposes of security
standards, SCI security systems, have levels of capacity, integrity,
resiliency, availability, and security, adequate to maintain the SCI
entity's operational capability and promote the maintenance of fair and
orderly markets. Proposed Rule 1000(b)(1)(i) specifies that such
policies and procedures would be required to include, at a minimum: (A)
The establishment of reasonable current and future capacity planning
estimates; (B) periodic capacity stress tests of such systems to
determine their ability to process transactions in an accurate, timely,
and efficient manner; (C) a program to review and keep current systems
development and testing methodology for such systems; (D) regular
reviews and testing of such systems, including backup systems, to
identify vulnerabilities pertaining to internal and external threats,
physical hazards, and natural or manmade disasters; (E) business
continuity and disaster recovery plans that include maintaining backup
and recovery capabilities sufficiently resilient and geographically
diverse to ensure next business day resumption of trading and two-hour
resumption of clearance and settlement services following a wide-scale
disruption; and (F) standards that result in such systems being
designed, developed, tested, maintained, operated, and surveilled in a
manner that facilitates the successful collection, processing, and
dissemination of market data. Proposed Rule 1000(b)(1)(ii) states that
such policies and procedures would be deemed to be reasonably designed
if they are consistent with current SCI industry standards, which would
be required to be: (A) Comprised of information technology practices
that are widely available for free to information technology
professionals in the financial sector; and (B) issued by an
authoritative body that is a U.S. governmental entity or agency,
association of U.S. governmental entities or agencies, or widely
recognized organization. The proposed SCI industry standards contained
in the publications identified on Table A are intended to serve as
standards that SCI entities could use, if they so choose, to comply
with the requirements of proposed Rule 1000(b)(1), though compliance
with such SCI industry standards would not be the exclusive means to
comply with the requirements of proposed Rule 1000(b)(1).
    Proposed Rule 1000(b)(2)(i) would require each SCI entity to
establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems operate in the
manner intended, including in a manner that complies with the federal
securities laws and rules and regulations thereunder and the entity's
rules and governing documents, as applicable. An SCI entity would be
deemed not to have violated proposed Rule 1000(b)(2)(i) if: (A) It has
established and maintained policies and procedures reasonably designed
to provide for: (1) testing of all such systems and any changes to such
systems prior to implementation; (2) periodic testing of all such
systems and any changes to such systems after their implementation; (3)
a system of internal controls over changes to such systems; (4) ongoing
monitoring of the functionality of such systems to detect whether they
are operating in the manner intended; (5) assessments of SCI systems
compliance performed by personnel familiar with applicable federal
securities laws and rules and regulations thereunder and the SCI
entity's rules and governing documents, as applicable; and (6) review
by regulatory personnel of SCI systems design, changes, testing, and
controls to prevent, detect, and address actions that do not comply
with applicable federal securities laws and rules and regulations
thereunder and the SCI entity's rules and governing documents, as
applicable; (B) the SCI entity has established and maintained a system
for applying such policies and procedures which would reasonably be
expected to prevent and detect, insofar as practicable, any violation
of such policies and procedures by the SCI entity or any person
employed by the SCI entity; and (C) the SCI entity: has reasonably
discharged the duties and obligations incumbent upon it by such

policies and procedures; and was without reasonable cause to believe
that such policies and procedures were not being complied with in any
material respect. Further, pursuant to proposed Rule 1000(b)(2)(iii), a
person employed by an SCI entity would be deemed not to have aided,
abetted, counseled, commanded, caused, induced, or procured the
violation by any other person of proposed Rule 1000(b)(2)(i) if the
person employed by the SCI entity: (A) Has reasonably discharged the
duties and obligations incumbent upon such person by such policies and
procedures; and (B) was without reasonable cause to believe that such
policies and procedures were not being complied with in any material
respect.
    Proposed Rule 1000(b)(9)(i) would require an SCI entity, with
respect to its business continuity and disaster recovery plans,
including its backup systems, to require participation by designated
members or participants in scheduled functional and performance testing
of the operation of such plans in the manner and frequency as specified
by the SCI entity, at least once every 12 months (e.g., for SCI SROs,
by submitting proposed rule changes under Section 19(b) of the Exchange
Act; for SCI ATSs, by revising membership or subscriber agreements and
internal procedures; for plan processors, through an amendment to an
SCI Plan under Rule 608 of Regulation NMS; and, for exempt clearing
agencies subject to ARP, by revising participant agreements and
internal procedures). Proposed Rule 1000(b)(9)(ii) would further
require an SCI entity to coordinate such required testing on an
industry- or sector-wide basis with other SCI entities. Proposed Rule
1000(b)(9)(iii) would require an SCI entity to designate members or
participants it deems necessary, for the maintenance of fair and
orderly markets in the event of the activation of its business
continuity and disaster recovery plans, to participate in the testing
of such plans. It would also require the SCI entity to notify and
update the Commission of its designations and standards for
designation, and promptly update such notification after any changes to
its designations or standards.
2. Notice, Dissemination, and Reporting Requirements for SCI Entities
    A number of proposed rules under Regulation SCI would require SCI
entities to notify or report information to the Commission, or
disseminate information to their members or participants. Proposed
Rules 1000(b)(4), (b)(5), (b)(6), (b)(7), and (b)(8) each contain a
notification, dissemination, or reporting requirement.
    Proposed Rule 1000(b)(4) would require notice of SCI events to the
Commission. Proposed Rule 1000(b)(4)(i) would require an SCI entity to
notify the Commission upon any responsible SCI personnel becoming aware
of a systems disruption that the SCI entity reasonably estimates would
have a material impact on its operations or on market participants, any
systems compliance issue, or any systems intrusion.
    Proposed Rule 1000(b)(4)(ii) would require an SCI entity, within 24
hours of any responsible SCI personnel becoming aware of any SCI event,
to submit a written notification to the Commission on Form SCI
pertaining to such SCI event.\351\ Proposed Rule 1000(b)(4)(iv)(A)
would specify that, for a notification made pursuant to proposed Rule
1000(b)(4)(ii), an SCI entity must include all pertinent information
known about the SCI event, including: a detailed description of the SCI
event; the SCI entity's current assessment of the types and number of
market participants potentially affected by the SCI event; the
potential impact of the SCI event on the market; and the SCI entity's
current assessment of the SCI event, including a discussion of the
determination of whether the SCI event is a dissemination SCI event or
not. In addition, to the extent available as of the time of the initial
notification, the notification would be required to include: a
description of the steps the SCI entity is taking, or plans to take,
with respect to the SCI event; the time the SCI event was resolved or
timeframe within which the SCI event is expected to be resolved; a
description of the SCI entity's rule(s) and/or governing document(s),
as applicable, that relate to the SCI event; and an analysis of the
parties that may have experienced a loss, whether monetary or
otherwise, due to the SCI event, the number of such parties, and an
estimate of the aggregate amount of such loss. Further, for a written
notification to the Commission of an SCI event under proposed Rule
1000(b)(4)(ii), an SCI entity would be required to attach a copy of any
information disseminated to date regarding the SCI event to its members
or participants or on the SCI entity's publicly available Web site.
---------------------------------------------------------------------------

    \351\ For a written notification to the Commission of an SCI
event under proposed Rule 1000(b)(4)(ii), new proposed Form SCI
would require that an SCI entity indicate that the filing is being
made pursuant to Rule 1000(b)(4)(ii) and provide the following
information in a short, standardized format: (i) Whether the filing
is a Rule 1000(b)(4)(ii) notification or Rule 1000(b)(4)(iii) update
of an SCI event; (ii) the SCI event type(s) (i.e., systems
compliance issue, systems intrusion, and/or systems disruption);
(iii) whether the event is a systems disruption that the SCI entity
reasonably estimates would have a material impact on its operations
or on market participants; (iv) if so, whether the Commission has
been notified of the SCI event; (v) whether the SCI event has been
resolved; (vi) the date/time the SCI event started; (vii) the
duration of the SCI event (viii) the date and time when responsible
SCI personnel became aware of the SCI event; (ix) the estimated
number of market participants impacted by the SCI event; (x) the
type(s) of systems impacted; and (xi) if applicable, the type of
systems disruption.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(4)(iii) would require an SCI entity to submit
written updates on Form SCI pertaining to an SCI event to the
Commission on a regular basis, or at such frequency as reasonably
requested by a representative of the Commission, until such time as the
SCI event is resolved. Proposed Rule 1000(b)(4)(iv)(B) specifies that,
for a notification made pursuant to proposed Rule 1000(b)(4)(iii), the
SCI entity would be required to update any information previously
provided regarding an SCI event, including any information under
proposed Rule 1000(b)(4)(iv)(A)(2) that was not available at the time
of submission of a notification under proposed Rule 1000(b)(4)(ii).
Further, for a written notification to the Commission of an SCI event
under proposed Rule 1000(b)(4)(iii), an SCI entity would be required to
attach a copy of any information disseminated to date regarding the SCI
event to its members or participants or on the SCI entity's publicly
available Web site.
    Proposed Rule 1000(b)(5) would require dissemination to members or
participants of dissemination SCI events and specify the nature and
timing of such required dissemination, with limited exceptions for
dissemination SCI events that are systems intrusions, as discussed
further below.\352\ Proposed Rule 1000(b)(5)(i)(A) would require that
an SCI entity, promptly after any responsible SCI personnel becomes
aware of a dissemination SCI event, disseminate to its members or
participants the following information about such SCI event: (1) The
systems affected by the SCI event; and (2) a summary description of the
SCI event. In addition, proposed Rule 1000(b)(5)(i)(B) would require an
SCI entity to, when known, further disseminate to its members or
participants: (1) a detailed description of the SCI event; (2) the SCI
entity's

current assessment of the types and number of market participants
potentially affected by the SCI event; and (3) a description of the
progress of its corrective action for the SCI event and when the SCI
event has been or is expected to be resolved. Proposed Rule
1000(b)(5)(i)(C) would further require that an SCI entity provide
regular updates to members or participants on any of the information
required to be disseminated under proposed Rules 1000(b)(5)(i)(A) and
(i)(B).
---------------------------------------------------------------------------

    \352\ As discussed above, the Commission proposes that the term
``dissemination SCI event'' be defined as ``an SCI event that is a:
(1) Systems compliance issue; (2) systems intrusion; or (3) systems
disruption that results, or the SCI entity reasonably estimates
would result, in significant harm or loss to market participants.''
See supra Section III.B.4.d.
---------------------------------------------------------------------------