of Compliance and a Director of Compliance will spend 3 hours
reviewing the policies and procedures.
---------------------------------------------------------------------------

    The table below summarizes the initial and ongoing annual burden
estimates for Current SCI Entities and New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Estimated burden
                                                                                hours for all
                                                               Estimated     Burden hours    entities (estimated
          Respondent type                 Burden type         respondents     per entity        respondents x
                                                              (entities)                      burden hours  per
                                                                                entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities...............  Initial..............              47              89                 4,183
                                     Annual...............              47            14.5                 681.5
New SCI Entities...................  Initial..............              23              89                 2,047
                                     Annual...............              23            14.5                 333.5
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the
average internal cost of compliance for New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
         Respondent type              Burden type       respondents    cost of compliance       respondents x
                                                        (entities)         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities............  Initial...........              47           \1\ $37,065            $1,742,055
                                  Annual............              47             \2\ 6,946               326,462
New SCI Entities................  Initial...........              23            \3\ 37,065               852,495
                                  Annual............              23             \4\ 6,946               159,758
----------------------------------------------------------------------------------------------------------------
\1\ (25 Compliance Manager hours x $344) + (25 Attorney hours x $462) + (8 Senior Systems Analyst hours x $316)
  + (8 Operations Specialist hours x $152) + (15 Chief Compliance Officer hours x $589) + (8 Director of
  Compliance hours x $542) = $37,065.
\2\ (2 Compliance Manager hours x $344) + (2 Attorney hours x $462) + (1 Senior Systems Analyst hours x $316) +
  (1 Operations Specialist hours x $152) + (5.5 Chief Compliance Officer hours x $589) + (3 Director of
  Compliance hours x $542) = $6,946.
\3\ See supra note 1 of this table.
\4\ See supra note 2 of this table.

3. Rule 1003
    The Commission anticipates that the proposed amendment will newly
impose the Rule 1003(a) requirements to report material system changes
on New SCI Entities, and New SCI Entities will incur the same burdens
that Current SCI Entities already incur to comply with these
requirements.\537\ The table below summarizes the burden that would be
newly imposed on New SCI Entities:
---------------------------------------------------------------------------

    \537\ Current SCI Entities are already required to comply with
Rule 1003(a). The burdens for compliance are summarized in the most
recent PRA Supporting Statement. See 2022 PRA Supporting Statement,
supra note 471. The proposed amendments impose no additional burden
related to this section. The Commission does not anticipate that New
SCI Entities would incur burdens beyond what is estimated in the
2022 PRA Supporting Statement.

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Burden hours for all
                                                                                Burden hours per       respondents
                                                              Estimated                              Hours per        SCI entity         (estimated
               Rule                    Respondent type       respondents     Number of reports        report         (number of         respondents x
                                                             (entities)                                            reports x hours    burden hours  per
                                                                                per report)         SCI entity)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Rule 1003(a)(1)...................  New SCI Entities.....              23  4 reports (1 per              \1\ 125               500                11,500
                                                                            quarter).
Rule 1003(a)(2)...................                                         \2\ 1 supplemental             \3\ 15                15                  345
                                                                            report.
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ The Commission's currently approved baseline is that each quarterly report under Rule 1003(a)(1) would require 125 hours. This includes 7.5
  Compliance Manager hours, 7.5 Attorney hours, 5 Chief Compliance Officer hours, 75 Senior System Analyst hours, and 30 Senior Business Analyst hours.
  See 2022 PRA Supporting Statement, supra note 471.
\2\ The Commission's currently approved baseline for Rules 1002(c)(1)(ii) and (iii) is that each SCI entity will submit one supplemental report each
  year. See 2022 PRA Supporting Statement, supra note 471.
\3\ The Commission's currently approved baseline is that the supplemental report under Rule 1003(a)(1) would require 15 hours. This includes 2
  Compliance Manager hours, 2 Attorney hours, 1 Chief Compliance Officer hours, 7 Senior System Analyst hours, and 3 Senior Business Analyst hours. See
  2022 PRA Supporting Statement, supra note 471.

    The table below summarizes the average internal cost of compliance
that would be newly imposed on New SCI Entities:

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                            Estimated                             Cost of       Average internal         (estimated
               Rule                   Respondent type      respondents    Number of reports     compliance     cost of compliance       respondents x
                                                           (entities)                           per report         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Rule 1003(a)(1)..................  New SCI Entities....              23  4 reports (1 per        \1\ $41,480          \2\ $167,360            $3,849,280
                                                                          quarter).
Rule 1003(a)(2)..................                                        1 supplemental            \3\ 5,328                 5,328               122,544
                                                                          report.
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ (7.5 Compliance Manager hours x $344) + (7.5 Attorney hours x $462) + (5 Chief Compliance Officer hours x $589) + (75 Senior Systems Analyst hours x
  $316) + (30 Senior Business Analyst hours x $305) = $41,840.
\2\ $41,480 per report x 4 reports each year = $167,360.
\3\ (2 Compliance Manager hours x $344) + (2 Attorney hours x $462) + (1 Chief Compliance Officer hours x $589) + (7 Senior Systems Analyst hours x
  $316) + (3 Senior Business Analyst hours x $305) = $5,328.

    Rule 1003(a)(1) requires each SCI entity to establish reasonable
written criteria for identifying a change to its SCI systems and the
security of indirect SCI systems as material. The Commission
anticipates that the proposed amendment will newly impose these
requirements on New SCI Entities, and New SCI Entities will incur the
same burdens that Current SCI Entities already incur to comply with
these requirements.\538\ The Commission estimates that each New SCI
entity will initially require 114 hours to establish criteria for
identifying material systems changes and 27 hours to annually to review
and update the criteria.\539\ The table below summarizes the burden
that would be newly imposed on New SCI Entities:
---------------------------------------------------------------------------

    \538\ Current SCI Entities are already required to comply with
Rule 1003(a). The burdens for compliance are summarized in the most
recent PRA Supporting Statement. See 2022 PRA Supporting Statement,
supra note 471. The proposed amendments impose no additional burden
related to this section.
    \539\ These estimates reflect the Commission-approved baseline.
See 2022 PRA Supporting Statement, supra note 471. The Commission
does not anticipate that New SCI Entities would incur burdens beyond
what is estimated in the 2022 PRA Supporting Statement.

----------------------------------------------------------------------------------------------------------------
                                                                                Estimated burden
                                                                                hours for all
                                                               Estimated     Burden hours    entities (estimated
          Respondent type                 Burden type         respondents     per entity        respondents x
                                                              (entities)                      burden hours  per
                                                                                entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities...................  Initial..............              23             114                 2,622
                                     Annual...............              23              27                   621
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the cost
of compliance for New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
                   Respondent type                      respondents    cost of compliance       respondents x
                                                        (entities)         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities....................................              23           \1\ $47,672            $1,096,456
                                                                                \2\ 12,929               297,367
----------------------------------------------------------------------------------------------------------------
\1\ (32 Compliance Manager hours x $344) + (32 Attorney hours x $462) + (10 Senior Systems Analyst hours x $316)
  + (10 Operations Specialist hours x $152) + (20 Chief Compliance Officer hours x $589) + (10 Director of
  Compliance hours x $542) = $47,672.
\2\ (4.5 Compliance Manager hours x $344) + (4.5 Attorney hours x $462) + (1.5 Senior Systems Analyst hours x
  $316) + (1.5 Operations Specialist hours x $152) + (10 Chief Compliance Officer hours x $589) + (5 Director of
  Compliance hours x $542) = $12,929.

    The Commission does not expect SCI entities to incur any external
PRA costs in connection with the reports required under Rule 1003(a).
    As for Rule 1003(b), each Current SCI Entity is already required to
perform an SCI review and therefore already incurs a baseline burden
\540\ for compliance, so the amendments should only impose a burden
required to comply with the additional requirements. Presently, none of
the New SCI Entities are required to comply with the requirements of
Rule 1003(b), but the proposed amendments will newly impose both the
baseline burden to conduct the SCI review and the additional burden to
meet the proposed requirements for the SCI review.
---------------------------------------------------------------------------

    \540\ The Commission's currently approved baseline for the
annual recordkeeping burden of conducting an SCI review and
submitting the SCI review to senior management of the SCI entity for
review is 690 hours (35 Compliance Manager hours + 80 Attorney hours
+ 375 Senior Systems Analyst hours + 5 General Counsel hours + 5
Director of Compliance hours + 20 Chief Compliance Officer hours
+170 Internal Audit Manager hours). See 2022 PRA Supporting
Statement, supra note 471.
---------------------------------------------------------------------------

    The Commission estimates that the proposed additional requirements
for conducting the SCI review will increase the burden of conducting
the SCI review and submitting the report by 50%. With respect to Rule
1003(b)(1) and (2), the Commission estimates an additional burden for
Current SCI Entities of 345 hours \541\ and 1,035 hours \542\ for New
SCI Entities. The table below summarizes the initial and ongoing annual
burden estimates for Current SCI Entities and New SCI Entities:
---------------------------------------------------------------------------

    \541\ 690 hours (baseline burden) x 0.5 = 345 hours. This
estimate includes 17.5 hours for a Compliance Manager, 40 hours for
an Attorney, 187.5 hours for a Senior Systems Analyst, 2.5 hours for
General Counsel, 10 hours for a Chief Compliance Officer, 2.5 hours
for a Director of Compliance, and 85 hours for an Internal Audit
Manager.
    \542\ 690 baseline burden hours + 345 additional burden hours =
1,035 hours. This estimate includes 52.5 hours for a Compliance
Manager, 120 hours for an Attorney, 562.5 hours for a Senior Systems
Analyst, 7.5 hours for General Counsel, 30 hours for a Chief
Compliance Officer, 7.5 hours for a Director of Compliance, and 255
hours for an Internal Audit Manager.

----------------------------------------------------------------------------------------------------------------
                                                                                Estimated burden
                                                                                hours for all
                                                               Estimated     Burden hours   entities  (estimated
                      Respondent type                         respondents     per entity        respondents x
                                                                                burden hours  per
                                                                                entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities......................................              47             345                16,215
New SCI Entities..........................................              23           1,035                23,805
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the
average internal cost of compliance for Current SCI Entities and New
SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                                        Average internal         (estimated
                   Respondent type                       Estimated     cost of compliance       respondents x
                                                        respondents        per entity         average internal
                                                                                cost of compliance
                                                                                per entity
----------------------------------------------------------------------------------------------------------------
Current SCI Entities................................              47          \1\ $123,848            $5,820,856
New SCI Entities....................................              23           \2\ 371,543            $8,545,489
----------------------------------------------------------------------------------------------------------------
\1\ (17.5 Compliance Manager hours x $344) + (40 Attorney hours x $462) + (187.5 Senior Systems Analyst hours x
  $316) + (2.5 General Counsel hours x $663) + (2.5 Director of Compliance hours x $542) + (10 Chief Compliance
  Officer hours x $589) + (85 Internal Audit Manager hours x $367) = $123,848.
\2\ (52.5 Compliance Manager hours x $344) + (120 Attorney hours x $462) + (562.5 Senior Systems Analyst hours x
  $316) + (7.5 General Counsel hours x $663) + (7.5 Director of Compliance hours x $542) + (30 Chief Compliance
  Officer hours x $589) + (255 Internal Audit Manager hours x $367) = $371,543.

    With respect to Rule 1003(b)(3), the Commission estimates that the
burden for SCI entities would increase to 25 hours from the current
baseline estimate.\543\ Thus, the Commission estimates an additional
burden for

Current SCI Entities of 24 hours \544\ and a new burden of 25 hours
\545\ for New SCI Entities. The table below summarizes the initial and
ongoing annual burden estimates for Current SCI Entities and New SCI
Entities:
---------------------------------------------------------------------------

    \543\ The Commission's currently approved baseline to submit the
report for the SCI review to the board of directors is 1 hour (1
Attorney hour). See 2022 PRA Supporting Statement, supra note 471.
The Commission estimates an increase to 25 hours as a result of the
proposed requirement that senior management provide a response to
the SCI review.
    \544\ 25 hours (revised estimate) - 1 hour (baseline estimate) =
24 hours. This estimate includes 1 hours for a Compliance Manager, 3
hours for an Attorney, 13 hours for a Senior Systems Analyst, 1
hours for a Chief Compliance Officer, and 6 hours for an Internal
Audit Manager.
    \545\ This estimate includes 1 hours for a Compliance Manager, 3
hours for an Attorney, 14 hours for a Senior Systems Analyst, 1
hours for a Chief Compliance Officer, and 6 hours for an Internal
Audit Manager.

----------------------------------------------------------------------------------------------------------------
                                                                                Estimated burden
                                                                                hours for all
                                                               Estimated     Burden hours    entities (estimated
                      Respondent type                         respondents     per entity        respondents x
                                                              (entities)                      burden hours  per
                                                                                entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities......................................              47              24                 1,128
New SCI Entities..........................................              23              25                   575
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the
average internal cost of compliance for Current SCI Entities and New
SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
                   Respondent type                      respondents    cost of compliance       respondents x
                                                        (entities)         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities................................              47            \1\ $8,629              $405,563
New SCI Entities....................................              23             \2\ 8,945               205,735
----------------------------------------------------------------------------------------------------------------
\1\ (1 Compliance Manager hours x $344) + (3 Attorney hours x $462) + (13 Senior Systems Analyst hours x $316) +
  (1 Chief Compliance Officer hours x $589) + (6 Internal Audit Manager hours x $367) = $8,629.
\2\ (1 Compliance Manager hours x $344) + (3 Attorney hours x $462) + (14 Senior Systems Analyst hours x $316) +
  (1 Chief Compliance Officer hours x $589) + (6 Internal Audit Manager hours x $367) = $8,945.

    Rule 1003(b) imposes recordkeeping costs for SCI entities. The
Commission estimates that while SCI entities will handle internally
some or most of the work associated with compliance with Rule 1003(b),
SCI entities will outsource some of the work associated with an SCI
review. The Commission estimates that the proposed amendments to the
SCI review would increase the annual recordkeeping cost by 50% beyond
the current baseline.\546\ The table below summarizes the Commission's
estimates for the cost of outsourcing for Current SCI Entities and New
SCI Entities:
---------------------------------------------------------------------------

    \546\ The Commission-approved baseline for the annual
recordkeeping cost per SCI entity of outsourcing is $50,000. See
2022 PRA Supporting Statement, supra note 471.

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
                   Respondent type                      respondents    cost of compliance       respondents x
                                                        (entities)         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities................................              47           \1\ $25,000            $1,175,000
New SCI Entities....................................              23            \2\ 75,000             1,725,000
----------------------------------------------------------------------------------------------------------------
\1\ 50,000 (baseline estimate) x 0.5 = $25,000.
\2\ 50,000 (baseline estimate) x 1.5 = $75,000.

4. Rule 1004
    The rules under Regulation SCI that would require an SCI entity to
mandate member or participant participation in business continuity and
disaster recovery plan testing are discussed more fully in sections
II.B, and the proposed amendments including third-party providers in
the requirement are discussed more fully in III.C.2 above.
    Current SCI Entities are already required to establish standards
and designate members or participants for testing pursuant to Rule 1004
and therefore already incur baseline initial \547\ and ongoing burdens
\548\ for complying with Rule 1004, so the amendments should only
impose a burden required to comply with the additional requirements.
Presently, none of the New SCI Entities are required to comply with the
requirements of Rule 1004, but the proposed amendments will newly

impose both the baseline burden to establish standards for the
designation of members and participants for BC/DR testing and
coordinate industry or sector-wide basis testing and additional burden
to establish standards for the designation of third-party providers for
BC/DR testing and coordinate industry or sector-wide basis testing for
third-party providers. The Commission estimates an initial compliance
burden of 90 hours \549\ for Current SCI Entities and 450 hours \550\
for New SCI Entities. The Commission estimates an annual compliance
burden of 34 hours \551\ for Current SCI Entities and 169 hours \552\
for New SCI Entities. The table below summarizes the initial and
ongoing annual burden estimates for Current SCI Entities and New SCI
Entities:
---------------------------------------------------------------------------

    \547\ The Commission's currently approved baseline for average
initial compliance burden per respondent with 17 CFR 242.1004(a)
(``Rule 1004(a)'') (i.e., establishment of standards for the
designation of members and participants) and (c) (i.e., the
coordination of testing on an industry- or sector-wide basis) is 360
hours (40 Compliance Manager hours + 60 Attorney hours + 20
Assistant General Counsel hours + 60 Senior Operations Manager hours
+ 140 Operations Specialist hours + 26 Chief Compliance Officer
hours + 14 Director of Compliance hours). See 2022 PRA Supporting
Statement, supra note 471. The estimate of 360 hours includes the
burden for designating members or participants for testing, as
required by 17 CFR 242.1004(b) (``Rule 1004(b)''). Id. at 18 n.50.
    \548\ The average annual compliance burden for each SCI entity
to review and update the policies and procedures is 135 hours for
each entity that is not a plan processor. See 2022 PRA Supporting
Statement, supra note 471. None of the New SCI Entities are plan
processors, so the Commission is applying the 135 hour estimate to
the New SCI Entities.
    \549\ The Commission estimates that the additional burden to
establish standards for the designation of third-party providers for
BC/DR testing and coordinate testing would be 25% of the 360 hour
baseline burden hours. 360 hours x 0.25 = 90 hours. The burden hours
include 10 Compliance Manager hours, 15 Attorney hours, 5 Assistant
General Counsel hours, 35 Operations Specialist hours, 6 Chief
Compliance Officer hours, 4 Director of Compliance hours, and 15
Senior Operations Manager hours.
    \550\ 360 baseline burden hours + 90 additional burden hours =
450 hours.
    \551\ The Commission estimates that the additional annual burden
would be 25% of the 135 hour baseline burden hours, or 34 hours (135
hours x 0.25). The burden hours include 3 Compliance Manager hours,
3 Attorney hours, 1 Assistant General Counsel hours, 18 Operations
Specialist hours, 3 Chief Compliance Officer hours, 1 Director of
Compliance hours, and 5 Senior Operations Manager hours.
    \552\ 135 baseline burden hours + 34 additional burden hours =
169 hours.

----------------------------------------------------------------------------------------------------------------
                                                                                Estimated burden
                                                                                hours for all
                                                               Estimated     Burden hours   entities  (estimated
          Respondent type                 Burden type         respondents     per entity        respondents x
                                                              (entities)                      burden hours  per
                                                                                entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities...............  Initial..............              47              90                 4,230
                                     Annual...............              47              34                 1,598
New SCI Entities...................  Initial..............              23             450                10,350
                                     Annual...............              23             169                 3,887
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the cost
of compliance for Current SCI Entities and New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
         Respondent type              Burden type       respondents    cost of compliance       respondents x
                                                        (entities)         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities............  Initial...........              47           \1\ $30,072            $1,413,384
                                  Annual............              47            \2\ 10,011               470,517
New SCI Entities................  Initial...........              23           \3\ 150,478             3,460,994
                                  Annual............              23            \4\ 50,331             1,157,613
----------------------------------------------------------------------------------------------------------------
\1\ (10 Compliance Manager hours x $344) + (15 Attorney hours x $462) + (5 Assistant General Counsel hours x
  $518) + (35 Operations Specialist hours x $152) + (6 Chief Compliance Officer hours x $589) + (4 Director of
  Compliance hours x $542) + (15 Senior Operations Manager hours x $406) = $30,072.
\2\ (3 Compliance Manager hours x $344) + (3 Attorney hours x $462) + (1 Assistant General Counsel hours x $518)
  + (18 Operations Specialist hours x $152) + (3 Chief Compliance Officer hours x $589) + (1 Director of
  Compliance hours x $542) + (5 Senior Operations Manager hours x $406) = $10,011.
\3\ (50 Compliance Manager hours x $344) + (75 Attorney hours x $462) + (25 Assistant General Counsel hours x
  $518) + (175 Operations Specialist hours x $152) + (32.5 Chief Compliance Officer hours x $589) + (17.5
  Director of Compliance hours x $542) + (75 Senior Operations Manager hours x $406) = $150,478.
\4\ (13 Compliance Manager hours x $344) + (18 Attorney hours x $462) + (6 Assistant General Counsel hours x
  $518) + (88 Operations Specialist hours x $152) + (13 Chief Compliance Officer hours x $589) + (6 Director of
  Compliance hours x $542) + (25 Senior Operations Manager hours x $406) = $50,331.

    The Commission continues to believe that SCI entities (other than
plan processors) would handle internally the work associated with the
requirements of Rule 1004.
5. Rule 1005
    Rules 1005 and 1007 impose on SCI entities recordkeeping
requirements related to their compliance with Regulation SCI. These
requirements would be newly imposed on New SCI Entities as a result of
the proposed amendment. The table below summarizes the Commission's
estimates as to the burden that each New SCI Entity would incur to meet
the requirements of Rules 1005 and 1007: \553\
---------------------------------------------------------------------------

    \553\ Current SCI Entities are already required to comply with
Rules 1005 and 1007. The burdens for compliance are summarized in
the most recent PRA Supporting Statement. See 2022 PRA Supporting
Statement, supra note 471. The proposed amendments impose no
additional burden related to this section. The Commission does not
anticipate that New SCI Entities would incur burdens beyond what is
estimated in the 2022 PRA Supporting Statement.

----------------------------------------------------------------------------------------------------------------
                                                                                Burden hours for all
                                                                                respondents
                                                               Estimated     Burden hours        (estimated
          Respondent type                 Burden type         respondents   per SCI entity      respondents x
                                                              (entities)                      burden hours  per
                                                                                SCI entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities...................  Initial..............              23         \1\ 170                 3,910
                                     Annual...............                          \2\ 25                   575
----------------------------------------------------------------------------------------------------------------
\1\ The Commission approved baseline estimate for each new non-SRO SCI entity to set up or modify a
  recordkeeping system is 170 hours. See 2022 PRA Supporting Statement, supra note 471.
\2\ The Commission approved baseline estimate for each new non-SRO SCI entity to make, keep, and preserve
  records relating to compliance with Regulation SCI, as required by Rule 1005(b), is 25 hours. See 2022 PRA
  Supporting Statement, supra note 471.

    The table below summarizes the average internal cost of compliance
that would be newly imposed on New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
         Respondent type              Burden type       respondents    cost of compliance       respondents x
                                                        (entities)         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities................  Initial...........              23           \1\ $13,260              $304,980
                                  Annual............                             \2\ 1,950                44,850
----------------------------------------------------------------------------------------------------------------
\1\ 170 Compliance Clerk hours x $78 per hour = $13,260.
\2\ 25 Compliance Clerk hours x $78 per hour = $1,950.

    The recordkeeping requirements impose recordkeeping costs for SCI
entities other than SCI SROs. The Commission estimates that a New SCI
Entity other than an SCI SRO will incur a one-time cost of $900 for
information technology costs for purchasing recordkeeping software, for
a total of $20,700.\554\
---------------------------------------------------------------------------

    \554\ $900 per SCI entity x 21 SCI entities = $18,900.
---------------------------------------------------------------------------

6. Rule 1006
    SCI entities submit Form SCI through the Electronic Form Filing
System (``EFFS''), which is also used by SCI SROs to file Form 19b-4
filings. Access to EFFS establishes reporting burdens for all SCI
entities. An SCI entity will submit to the Commission an External
Application User Authentication Form (``EAUF'') to register each
individual at the SCI entity who will access the EFFS system on behalf
of the SCI entity. The Commission is including in its burden estimates
the reporting burden for completing the EAUF for each individual at a
New SCI Entity that will request access to EFFS.\555\ The table below
summarizes the initial and ongoing burdens that would be New SCI
Entities would incur to establish access to EFFS:
---------------------------------------------------------------------------

    \555\ Current SCI Entities would already have incurred these
burdens, which are summarized in the most recent PRA Supporting
Statement. See 2022 PRA Supporting Statement, supra note 471. The
proposed amendments impose no additional burden related to this
section. The Commission does not anticipate that New SCI Entities
would incur burdens beyond what is estimated in the 2022 PRA
Supporting Statement.

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Burden hours  per   Burden hours for all
                                                                                Number of                     SCI entity  (number       respondents
                                                                 Estimated      individuals       Time to        of  individuals         (estimated
           Respondent type                Type of  burden       respondents     requesting     complete EAUF  requesting  access x      respondents x
                                                                (entities)        access                        time to  complete     burden hours  per
                                                                                EAUF)              SCI entity)
--------------------------------------------------------------------------------------------------------------------------------------------------------
New SCI Entities....................  Initial...............              23           \1\ 2        \2\ 0.15                   0.3                   6.9
                                      Annual................                           \3\ 1                                  0.15                   3.5
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ The Commission approved baseline estimate for the number of individuals per SCI entity who will request access to EFFS initially through the EAUF is
  two individuals. See 2022 PRA Supporting Statement, supra note 471.
\2\ The Commission approved baseline estimate to complete the EAUF is 0.15 hours. See 2022 PRA Supporting Statement, supra note 471.
\3\ The Commission approved baseline estimate for the number of individuals per SCI entity who will request access to EFFS annually through the EAUF is
  one individual. See 2022 PRA Supporting Statement, supra note 471.

    The table below summarizes the average internal cost of compliance
that would be newly imposed on New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
         Respondent type              Burden type       respondents    cost of compliance       respondents x
                                                        (entities)         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities................  Initial...........              23              \1\ $139                $3,197
                                  Annual............                                \2\ 69                 1,587
----------------------------------------------------------------------------------------------------------------
\1\ 0.3 Attorney hours x $462 = $139.
\2\ 0.15 Attorney hours x $462 = $69.

    Obtaining the ability for an individual to electronically sign a
Form SCI imposes reporting costs for SCI entities. The table below
summarizes the cost for individuals at each New SCI Entity to obtain
digital IDs to sign Form SCI:

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Cost per SCI entity
                                                                                (number of            Cost for all
                                                            Estimated        Number of      Cost to obtain       individuals            respondents
                    Respondent type                        respondents     individuals to     digital ID     requesting  access x        (estimated
                                                            (entities)     sign form SCI                      time to  complete     respondents x burden
                                                                                EAUF)          hours per SCI entity)
--------------------------------------------------------------------------------------------------------------------------------------------------------
New SCI Entities.......................................              23            \1\ 2          \2\ $25                    $50                 $1,150
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ The Commission approved baseline estimate for the number of individuals per SCI entity who will sign Form SCI each year is two individuals. See 2022
  PRA Supporting Statement, supra note 471.
\2\ The Commission approved baseline estimate to obtain a digital ID is $50. See 2022 PRA Supporting Statement, supra note 471.

7. Summary of the Information Collection Burden
    The table below summarizes the Commission's estimate of the total
hourly burden, total internal costs of compliance, and external cost
estimates for SCI entities under Regulation SCI.

----------------------------------------------------------------------------------------------------------------
                                                           Burden hours                 Costs of compliance
             Rule                Respondent type ---------------------------------------------------------------
                                                      Initial         Annual          Initial         Annual
----------------------------------------------------------------------------------------------------------------
Policies and procedures         Current SCI               18,142           2,726      $6,804,989      $1,099,941
 required by Rule 1001(a)        Entities.                20,470           3,335       7,667,533       1,341,245
 (except Rule 1001(a)(2)(vi))   New SCI Entities
 (Recordkeeping).
Policies and procedures         New SCI Entities           3,680           3,335       1,402,540       1,204,740
 required by Rule
 1001(a)(2)(vi)
 (Recordkeeping).
Costs for outside legal/        Current SCI                  N/A             N/A       1,365,350             N/A
 consulting services in          Entities.                   N/A             N/A       1,697,400             N/A
 initial preparation of         New SCI Entities
 policies and procedures
 required by Rule 1001(a)
 (Recordkeeping).
Policies and procedures         Current SCI               18,142           2,726       8,170,339       1,099,941
 required by Rule 1001(a)        Entities.                24,150           6,670      10,767,473       2,545,985
 Total.                         New SCI Entities
Policies and procedures         New SCI Entities           6,210           2,185       2,222,720         808,220
 required by Rule 1001(b)
 (Recordkeeping).
Costs for outside legal/        New SCI Entities             N/A             N/A         621,000               0
 consulting services in
 initial preparation of
 policies and procedures
 required by Rule 1001(b)
 (recordkeeping).
Policies and procedures         New SCI Entities           6,210           2,185       2,843,720         808,220
 required by Rule 1001(b)
 Total.
Policies and procedures         New SCI Entities           2,622             897       1,096,456         400,821
 required by Rule 1001(c)
 (Recordkeeping).
Mandate participation in        Current SCI                4,230           1,598       1,413,384         470,517
 certain testing required by     Entities.                10,350           3,887       3,460,994       1,157,613
 Rule 1004 (Recordkeeping).     New SCI Entities
SCI Event Notice Required By    Current SCI                  235             235          81,663          81,663
 Rule 1002(b)(1) (Reporting).    Entities.                   299             299         103,477         103,477
                                New SCI Entities
External Legal Costs for Rule   Current SCI                  N/A             N/A          25,556          25,556
 1001(b)(1) (Reporting).         Entities.                   N/A             N/A          33,350          33,350
                                New SCI Entities
SCI Event Notice Required By    Current SCI                  235             235         107,219         107,219
 Rule 1002(b)(1) Total.          Entities.                   299             299         136,827         136,827
                                New SCI Entities
SCI Event Notice Required By    Current SCI                3,384           3,384       1,249,683       1,249,683
 Rule 1002(b)(2) (Reporting).    Entities.                 4,416           4,416       1,630,792       1,630,792
                                New SCI Entities
External Legal Costs for Rule   Current SCI                  N/A             N/A          25,556          25,556
 1001(b)(2) (Reporting).         Entities.                   N/A             N/A          33,350          33,350
                                New SCI Entities
SCI Event Notice Required By    Current SCI                3,384           3,384       1,275,239       1,275,239
 Rule 1002(b)(2) Total.          Entities.                 4,416           4,416       1,664,142       1,664,142
                                New SCI Entities
SCI Event Notice Required By    Current SCI                493.5           493.5         172,819         172,819
 Rule 1002(b)(3) (Reporting).    Entities.                   483             483         169,142         169,142
                                New SCI Entities
External Legal Costs for Rule   Current SCI                  N/A             N/A          17,038          17,038
 1002(b)(3) (Reporting).         Entities.                   N/A             N/A          16,675          16,675
                                New SCI Entities

SCI Event Notice Required By    Current SCI                493.5           493.5         189,857         189,857
 Rule 1002(b)(3) Total.          Entities.                   483             483         185,817         185,817
                                New SCI Entities
SCI Event Notice Required By    Current SCI                4,935           4,935       1,927,752       1,927,752
 Rule 1002(b)(4) (Reporting).    Entities.                 6,440           6,440       2,515,648       2,515,648
                                New SCI Entities
External Legal Costs for        Current SCI                  N/A             N/A          25,556          25,556
 1001(b)(4) (Reporting).         Entities.                   N/A             N/A          33,350          33,350
                                New SCI Entities
SCI Event Notice Required By    Current SCI                4,935           4,935       1,953,308       1,953,308
 Rule 1002(b)(4) Total.          Entities.                 6,440           6,440       2,548,998       2,548,998
                                New SCI Entities
SCI Event Notice Required By    Current SCI                (752)           (752)       (284,444)       (284,444)
 Rule 1002(b)(5) (Reporting).    Entities.                 3,312           3,312       1,252,948       1,252,948
                                New SCI Entities
External Legal Costs for Rule   Current SCI                  N/A             N/A               0               0
 1002(b)(5) (Reporting).         Entities.                   N/A             N/A          16,675          16,675
                                New SCI Entities
SCI Event Notice Required By    Current SCI                (752)           (752)       (284,444)       (284,444)
 Rule 1002(b)(5) Total.          Entities.                 3,312           3,312       1,269,623       1,269,623
                                New SCI Entities
Dissemination of information    New SCI Entities           3,174           3,174       1,400,194       1,400,194
 required by Rule 1002(c)(1)
 (Third-Party Disclosure).
External Legal Costs for Rule   New SCI Entities             N/A             N/A          57,270          57,270
 1002(c)(1) (Third-Party
 Disclosure).
Dissemination of information    New SCI Entities           3,174           3,174       1,457,464       1,457,464
 required by Rule 1002(c)(1)
 Total.
Dissemination of information    Current SCI                1,410           1,410         621,246         621,246
 required by Rule 1002(c)(2)     Entities.                   920             920         405,352         405,352
 (Third-Party Disclosure).      New SCI Entities
External Legal Costs for Rule   Current SCI                  N/A             N/A       29,257.50       29,257.50
 1002(c)(2) (Third-Party         Entities.                   N/A             N/A          19,090          19,090
 Disclosure).                   New SCI Entities
Dissemination of information    Current SCI                1,410           1,410       650,503.5       650,503.5
 required by Rule 1002(c)(2)     Entities.                   920             920         424,442         424,442
 Total.                         New SCI Entities
Burden to develop processes to  New SCI Entities           4,554             897       1,797,312         396,934
 identify the nature of a
 system or event.
Establish reasonable written    Current SCI                4,183           681.5       1,742,055         326,462
 criteria for identifying a      Entities.                 2,047           333.5         852,495         159,758
 significant attempted          New SCI Entities
 unauthorized systems
 intrusion.
Material systems change notice  New SCI Entities          11,845          11,845       3,971,824       3,971,824
 required by Rule 1003(a)(1)
 and (2) (Reporting).
Establish reasonable written    New SCI Entities           2,622             621       1,096,456         297,367
 criteria for identifying a
 material change to its SCI
 systems and the security of
 indirect SCI systems.
SCI review required by Rule     Current SCI               16,215          16,215       5,820,856       5,820,856
 1003(b)(1) and (2)              Entities.                23,805          23,805       8,545,489       8,545,489
 (Recordkeeping).               New SCI Entities
SCI review required by Rule     Current SCI                1,128           1,128         405,563         405,563
 1003(b)(3) (Reporting).         Entities.                   575             575         205,735         205,735
                                New SCI Entities
External Legal Costs for Rule   Current SCI                  N/A             N/A       1,175,000       1,175,000
 1003(b) (Recordkeeping).        Entities.                   N/A             N/A       1,725,000       1,725,000
                                New SCI Entities
SCI Review Costs (Rule          Current SCI               17,343          17,343       7,401,419       7,401,419
 1003(b)) Total.                 Entities.                24,380          24,380      10,476,224      10,476,224
                                New SCI Entities
Corrective action required by   Current SCI                1,081             N/A         449,132             N/A
 Rule 1002(a) (Recordkeeping).   Entities.                 3,151             897       1,316,244         396,934
                                New SCI Entities
Recordkeeping required by       New SCI Entities           3,910             575         304,980          44,850
 Rules 1005/1007
 (Recordkeeping).
One-time cost to purchase       New SCI Entities             N/A             N/A          20,700             N/A
 recordkeeping software Rules
 1005/1007 (Recordkeeping).
Total recordkeeping costs       New SCI Entities           3,910             575         325,680          44,850
 required by Rules 1005/1007.
Request access to EFFS (Rule    New SCI Entities             6.9             3.5           3,197           1,587
 1006) (Reporting).
Rule 1006--obtain digital IDs   New SCI Entities             N/A             N/A           1,150           1,150
 (Reporting).
Total Costs to comply with      New SCI Entities             6.9             3.5           4,347           2,737
 Rule 1006.
                                                 ---------------------------------------------------------------
Total.........................  Overall Total...         169,576         104,289      68,764,549      41,536,601
                                Current SCI               54,685          32,054      23,068,011      13,190,021
                                 Entities.               112,845          72,235      45,696,538      28,346,580
                                New SCI Entities
Per Entity Hourly Burden/Cost.  Current SCI                1,163             682      490,808.75      280,639.75
                                 Entities \1\.             4,995           3,141       1,986,806       1,232,460
                                New SCI Entities
----------------------------------------------------------------------------------------------------------------
\1\ As noted earlier, currently no SCI competing consolidators have registered with the Commission. See supra
  note 469. To the extent that a competing consolidator registers with the Commission, its initial and ongoing
  burdens as a result of the proposed amendments would be the same as the initial and ongoing burden per entity
  calculated for Current SCI Entities.

    In summary, the estimated paperwork related compliance burdens for
SCI entities as a result of the amendments are approximately 170,000
hours and $69 million initially and approximately 104,000 hours and $41
million annually.

E. Collection of Information Is Mandatory

    The collections of information pursuant to Regulation SCI is
mandatory as to all entities subject to the rule.

F. Confidentiality of Responses to Collection of Information

    The Commission expects that the written policies and procedures,
processes, criteria, standards, or other written documents developed or
revised by SCI entities pursuant to Regulation SCI will be retained by
SCI entities in accordance with, and for the periods specified in 17
CFR 240.17a-1 (``Rule 17a-1'' of the Exchange Act) and Rule 1005, as
applicable. Should such documents be made available for examination or
inspection by the Commission and its representatives, they would be
kept confidential subject to the provisions of applicable law.\556\ In
addition, the information submitted to the Commission pursuant to
Regulation SCI that is filed on Form SCI, as required by Rule 1006,
will be treated as confidential, subject to applicable law, including
amended 17 CFR 240.24b-2 (``Rule 24b-2'').\557\ The information
disseminated by SCI entities pursuant to Rule 1002(c) under Regulation
SCI to their members or participants will not be confidential.
---------------------------------------------------------------------------

    \556\ See, e.g., 15 U.S.C. 78x (governing the public
availability of information obtained by the Commission); 5 U.S.C.
552 et seq.
    \557\ See, e.g., 15 U.S.C. 78x (governing the public
availability of information obtained by the Commission); 5 U.S.C.
552 et seq. See also Form SCI section IV (including a provision
stating ``Confidential treatment is requested pursuant to 17 CFR
240.24b-2(g) (``Rule 24b-(g)'')).
---------------------------------------------------------------------------

G. Request for Comment

    Pursuant to 44 U.S.C. 3506(c)(2)(B), the Commission solicits
comment on the proposed collections of information in order to:
    91. Evaluate whether the proposed collections of information are
necessary for the proper performance of the functions of the
Commission, including whether the information would have practical
utility;
    92. Evaluate the accuracy of the Commission's estimates of the
burden of the proposed collections of information;
    93. Determine whether there are ways to enhance the quality,
utility, and clarity of the information to be collected; and
    94. Evaluate whether there are ways to minimize the burden of the
collection of information on those who respond, including through the
use of automated collection techniques or other forms of information
technology.
    Persons submitting comments on the collection of information
requirements should direct them to the Office of Management and Budget,
Attention: Desk Officer for the Securities and Exchange Commission,
Office of Information and Regulatory Affairs, Washington, DC 20503, and
should also send a copy of their comments to Vanessa A. Countryman,
Secretary, Securities and Exchange Commission, 100 F Street NE,
Washington, DC 20549-1090, with reference to File Number S7-07-23.
Requests for materials submitted to OMB by the Commission with regard
to this collection of information should be in writing, with reference
to File Number S7-07-23 and be submitted to the Securities and Exchange
Commission, Office of FOIA/PA Services, 100 F Street NE, Washington, DC
20549-2736. As OMB is required to make a decision concerning the
collections of information between 30 and 60 days after publication, a
comment to OMB is best assured of having its full effect if OMB
receives it within 30 days of publication.

V. Economic Analysis

A. Introduction

    The Commission is sensitive to the economic effects, including the
costs and benefits, of its rules. When engaging in rulemaking pursuant
to the Exchange Act that requires the Commission to consider or
determine whether an action is necessary or appropriate in the public
interest, section 3(f) of the Exchange Act requires the Commission to
consider, in addition to the protection of investors, whether the
action would promote efficiency, competition, and capital formation. In
addition, section 23(a)(2) of the Exchange Act requires the Commission
in making rules pursuant to the Exchange Act to consider the impact any
such rule would have on competition. The Exchange Act prohibits the
Commission from adopting any rule that would impose a burden on
competition not necessary or appropriate in furtherance of the purposes
of the Exchange Act.
    As explained above, the Commission believes that developments in
the U.S. securities markets since the adoption of Regulation SCI in
2014 warrant expanding the scope of Regulation SCI as well as
strengthening the obligations of SCI entities. These developments
include the growth of electronic trading, which allows greater volumes
of securities transactions to take place across a multitude of trading
systems in our markets. In addition, large institutional and other
professional market participants today employ sophisticated methods to
trade electronically on multiple venues simultaneously in ever-
increasing volumes with increasing speed. In recent years, financial
institutions have increasingly used and relied on third parties that
provide information and communications technology systems.\558\
Together, these developments have resulted in greater dispersal,
sophistication, and interconnection of the systems underpinning our
U.S. securities markets, thereby bringing potential new risks.
---------------------------------------------------------------------------

    \558\ See, e.g., FINRA, Cloud Computing in the Securities
Industry (Aug. 16, 2021), available at https://www.finra.org/rules-guidance/key-topics/fintech/report/cloud-computing; see also
Franklin Allen et al., A Survey of Fintech Research and Policy
Discussion, 1 Rev. Corp. Fin. 259, 259 (2021) (``Cloud storage and
cloud computing have also played increasing roles in payment
systems, financial services, and the financial system overall'').
See also Financial Stability Board, Regulatory and Supervisory
Issues Relating to Outsourcing and Third-Party Relationships,
(discussion paper Nov. 9, 2020), available at https://www.fsb.org/wp-content/uploads/P091120.pdf.
---------------------------------------------------------------------------

    The proposed amendments to Regulation SCI would expand the
definition of ``SCI entity'' to include a broader range of entities
that perform key functions in U.S. securities market infrastructure,
and update certain other definitions and provisions to take account of
technological market developments, including cybersecurity and vendor
management, since the adoption of Regulation SCI in 2014. The proposed
expansion would add to the definition of ``SCI entity'' registered
security-based swap data repositories, and registered broker-dealers
exceeding certain asset and transaction activity thresholds, and the
proposal would expand the category of exempt clearing agencies subject
to Regulation SCI to include all clearing agencies exempted from
registration. Additional proposed amendments to Regulation SCI are
designed to update the requirements of Regulation SCI relating to: (i)
systems classification and lifecycle management; (ii) vendor
management; (iii) cybersecurity; (iv) SCI review; (v) current SCI
industry standards; and (vi) other matters.
    The Commission is sensitive to the economic effects of the proposed
expansion and strengthening of Regulation SCI, including its costs and
benefits. As discussed further below, the Commission requests comment
on all

aspects of the costs and benefits of the proposal, including any
effects the proposed rules may have on efficiency, competition, and
capital formation.

B. Baseline

    The Commission proposes to expand the scope of Regulation SCI to
include new entities as well as strengthen the obligations of SCI
entities. In order to assess the benefits and costs that can properly
be attributed to the proposed rules, the Commission begins by
considering the relevant baselines--the current market practices as
well as applicable regulations in the absence of these proposed rules.
1. New SCI Entities
    The proposed rules will affect new SCI entities, specifically
SBSDRs, certain broker-dealers, and certain exempt clearing agencies,
in addition to existing SCI entities. The baseline for each category of
entities is discussed in turn, including applicable regulatory
baselines and relevant market descriptions.
a. Registered Security-Based Swap Data Repositories
i. Affected Parties
    The Commission proposes to include SBSDRs as SCI entities. SBSDRs
are required for the dissemination of SBS market data to provide price
transparency, limit risk posed to the maintenance of fair and orderly
markets, promote the market stability, prevent market abuses, and
reduce operational risk. They play an important role in transparency in
the market for SBSs and make available to the Commission SBS data that
will provide a broad view of this market and help monitor for pockets
of risk and potential market abuses that might not otherwise be
observed by the Commission and other relevant authorities.
    Security-based swaps entail the transfer of financial obligations
between two parties with sometimes a long time horizon. Counterparties
to a security-based swap rely on each other's creditworthiness and bear
this credit risk and market risk until the security-based swap
terminates or expires.\559\ The information provided by SBSDRs, such as
individual counterparty trade and position data, helps the Commission
gain a better understanding of the actual and potential market
risks.\560\ This information also helps the Commission and other
relevant authorities investigate market manipulation, fraud, and other
market abuses.
---------------------------------------------------------------------------

    \559\ For cleared trades, the clearing agencies generally step
in the place of the original counterparties and effectively assume
the risk should there be a default.
    \560\ See SBSR Adopting Release, supra note 96 (for information
required to be reported by SBSDRs to the Commission).
---------------------------------------------------------------------------

    As of February 2023, two data repositories for security-based swap
markets are registered with the Commission. The registered SBSDRs are
Depository Trust & Clearing Corporation Data Repository (``DDR'') and
the ICE Trade Vault (``ITV''). DDR operates as a registered SBSDR for
security-based swap transactions in the credit, equity, and interest
rate derivatives asset classes. ITV operates as a registered SBSDR for
security-based swap transactions in the credit derivatives asset
class.\561\ As of March 2022, 47 entities had registered with the
Commission as security-based swap dealers and pursuant to Regulation
SBSR, they are required to report the trade activities to the
SBSDRs.\562\ In total, these two SBSDRs received approximately 542.6
million reports \563\ between November 2021 and September 2022, from
contracts of 15,593 distinct counterparties.\564\
---------------------------------------------------------------------------

    \561\ See DTCC Data Repository (U.S.) LLC; Order Approving
Application, supra note 111; ICE Trade Vault, LLC; Order Approving
Application, supra note 111. Note that additional entities may
register as SBSDRs in the future.
    \562\ See List of Registered Security-Based Swap Dealers and
Major Security-Based Swap Participants, supra note 110 (providing
the list of registered security-based swap dealers and major SBS
participants that was updated as of Mar. 28, 2022).
    \563\ The transaction reports include not only the initial
trade, but also life-cycle events.
    \564\ Number of reports and number of counterparties are
calculated from trade activities data of the DDR and ITV reports.
Number of counterparties is calculated as the number of unique
counterparties' IDs. Due to data limitation, we only included
reports occurred on or after Nov. 8, 2021.
---------------------------------------------------------------------------

ii. Regulatory Baseline
    As discussed above in section III.A.2, SBSDRs are subject to Rule
13n-6, which requires that ``every security-based swap data repository,
with respect to those systems that support or are integrally related to
the performance of its activities, shall establish, maintain, and
enforce written policies and procedures reasonably designed to ensure
that its systems provide adequate levels of capacity, integrity,
resiliency, availability, and security.'' \565\ The SBSDRs registered
with the Commission are also registered with the CFTC as swap data
repositories and accordingly are also subject to CFTC rules and
regulations related to swap data repositories, including the ``SDR
System Safeguards'' rule.\566\ That rule requires swap data
repositories to establish and maintain emergency procedures,
geographically diverse backup facilities and staff, and a business
continuity and disaster recovery plan that should enable next day
resumption of the swap data repository's operations following the
disruption.\567\
---------------------------------------------------------------------------

    \565\ See 17 CFR 240.13n-6.
    \566\ See 17 CFR 49.24.
    \567\ See 17 CFR 49.24(a).
---------------------------------------------------------------------------

    In addition, the rule requires programs of risk analysis and
oversight with respect to its operations and automated systems to
address each of the following categories of risk analysis and
oversight: (1) information security; (2) business continuity and
disaster recovery planning and resources; (3) capacity and performance
planning; (4) systems operations; (5) systems development and quality
assurance; (6) physical security and environmental controls; and (7)
enterprise risk management.\568\ This rule also requires systems
monitoring to identify potential systems disruptions and cybersecurity
attacks via provisions relating to capacity and performance planning,
information security, and physical security and environmental controls.
It also requires swap data repositories to maintain a security incident
response plan that must include, among other items, policies and
procedures for reporting security incidents and for internal and
external communication and information sharing regarding security
incidents, the hand-off and escalation points in its security incident
response process, and the roles and responsibilities of its management,
staff and independent contractors in responding to security
incidents.\569\
---------------------------------------------------------------------------

    \568\ See 17 CFR 49.24(b).
    \569\ See 17 CFR 49.24.
---------------------------------------------------------------------------

    Furthermore, the rule requires regular, periodic testing and review
of business continuity and disaster recovery capabilities.\570\ Under
the rule, both the senior management and the board of directors of a
swap data repository receive and review reports setting forth the
results of the specified testing and assessment. A swap data repository
is required to establish and follow appropriate procedures for the
remediation of issues identified through the review, and for evaluation
of the effectiveness of testing and assessment protocols.\571\
---------------------------------------------------------------------------

    \570\ Id.
    \571\ 17 CFR 49.24(m) (Internal reporting and review).
---------------------------------------------------------------------------

    The System Safeguards rule requires SDRs to conduct testing and
review sufficiency to ensure that their

automated systems are reliable, secure, and have adequate scalable
capacity.\572\ The System Safeguards rule requires SDRs to conduct
external and internal penetration testing at a frequency determined by
an appropriate risk analysis, but no less frequently than
annually.\573\
---------------------------------------------------------------------------

    \572\ See 17 CFR 49.24(j).
    \573\ See 17 CFR 49.24(j)(3).
---------------------------------------------------------------------------

    The System Safeguards rule also specifies and defines five types of
system safeguards testing that a SDR necessarily must perform to
fulfill the testing requirement: vulnerability testing; penetration
testing; controls testing; security incident response plan testing; and
enterprise technology risk assessment.\574\ SDRs are required to notify
CFTC staff of any system malfunctions, cyber security incidents, or
activation of the business continuity and disaster recovery plan.\575\
A swap data repository must also give CFTC staff advance notice of
planned changes to automated systems that may affect the reliability,
security, or adequate scalable capacity of such systems.\576\ Finally,
the CFTC's System Safeguards rule requires an SDR to follow generally
accepted standards and best practices with respect to the development,
operation, reliability, security, and capacity of automated systems
related to SDR data.\577\
---------------------------------------------------------------------------

    \574\ Id.
    \575\ See 17 CFR 49.24(g).
    \576\ See 17 CFR 49.24(h).
    \577\ See 17 CFR 49.24(c).
---------------------------------------------------------------------------

b. Broker-Dealers
i. Affected Parties
    The Commission is proposing to expand the application of Regulation
SCI to include certain broker-dealers in the definition of SCI entity.
There are approximately 3,500 broker-dealers registered with the
Commission pursuant to section 15(b) of the Exchange Act as of Q3
2022.\578\ Figure 1 represents the distribution of all registered
broker-dealer firms between Q4 2021 and Q3 2022 by level of total
assets \579\ (Panel A) and by percentage of aggregate total assets
\580\ (Panel B) with firm size (Panel A) and percentage of aggregate
total assets (Panel B) increasing along the x-axis from left to right.
These entities encompass a broad range of sizes, business activities,
and business models.\581\ The distribution of firms \582\ by level of
total assets (Panel A) shows that the vast majority of firms \583\ fall
somewhere within the $30,000 to $450,000,000 dollar range, with a small
minority of firms showing up as a descending long right tail. The
distribution of broker-dealers \584\ by percentage of aggregate total
assets (Panel B) shows that a small number of firms individually had
percentages of aggregate total assets in the high single digits to low
double digits.
---------------------------------------------------------------------------

    \578\ See supra note 131.
    \579\ The level of total assets is measured by the average
quarterly total assets for each broker-dealer between Q4 2021 and Q3
2022.
    \580\ The percentage of aggregate total assets is estimated by
the average quarterly percentage of aggregate total assets for each
broker-dealer between Q4 2021 and Q3 2022.
    \581\ See 2022 FINRA Industry Snapshot, supra note 131.
    \582\ Panel A of Figures 1 through 5 is represented on a
logarithmic scale for ease of viewing when the distribution is far
less evenly distributed if displayed using a standard x-axis.
    \583\ This represents the range of the average quarterly total
assets for firms that fall between the 5th and 95th percentile.
    \584\ The number of individual firms in Panel B of Figures 1
through 5 is more visible here due to use of a standard x-axis even
though the y-axis is represented logarithmically. The use of a
logarithmic y-axis does however flatten the overall distribution
with a disproportionate effect on the firms with percentage of
aggregate average daily dollar volume between 0% and 2.5% making it
slightly less obvious upon first glance that the vast majority of
firms actually fall between 0% and 2.5%.
---------------------------------------------------------------------------

BILLING CODE 8011-01-P
[GRAPHIC] [TIFF OMITTED] TP14AP23.000

    Figures 2 through 5 represent the distribution of firms by level of
transaction activity \585\ as measured by average daily dollar volume
\586\ (Panel A) and the distribution of firms by percentage of
transaction activity \587\ (Panel B) for each of four asset classes
including NMS stocks, exchange-listed options, U.S. Treasury
Securities, and Agency Securities respectively. The distributions of
firms \588\ by level of transaction activity (Panel A) show that the
vast majority of firms \589\ fall somewhere within the $30,000 to $14.4
billion dollar range, $500,000 to $3.1 billion dollar range, $2,000 to
$4.0 billion dollar range, and $500 to $1.2 billion dollar range for
the NMS, stock

exchange-listed options, U.S. Treasury Securities, and Agency
Securities markets, respectively.
---------------------------------------------------------------------------

    \585\ The level of transaction activity in Panel A of Figures 2
through 5 is measured by the average of monthly average daily dollar
volume for each broker-dealer from Jan. 2022 to June 2022.
    \586\ These measures are described in more detail in section
III.A.2.b.iii.
    \587\ Id.
    \588\ See supra note 582.
    \589\ This represents the range of the average of monthly
average daily dollar volume for firms that fall between the 5th and
95th percentile.
---------------------------------------------------------------------------

    Figures 2 through 5 (Panel B), showing the distribution of broker-
dealers by percentage of aggregate average daily dollar volume,\590\
indicate that a very small number of firms \591\ individually had
percentages of aggregate average daily dollar volume in the high single
digits to low double digits.
---------------------------------------------------------------------------

    \590\ The percentage of aggregate average daily dollar volume in
Panel B of figures 2 through 5 is estimated by the average of
monthly percentage for each broker-dealer of aggregate average daily
dollar volume reported to the plan processors (SIPs) of the CTA/CQ
Plans and Nasdaq UTP Plan, OPRA Plan, or FINRA TRACE in each
respective asset class from Jan. 2022 to June 2022.
    \591\ See supra note 584.
    [GRAPHIC] [TIFF OMITTED] TP14AP23.001

    [GRAPHIC] [TIFF OMITTED] TP14AP23.002

[GRAPHIC] [TIFF OMITTED] TP14AP23.003

[GRAPHIC] [TIFF OMITTED] TP14AP23.004

BILLING CODE 8011-01-C
    A substantial number of firms had transaction activity \592\ across
these four markets: 336 had transaction activity in NMS equities,\593\
105 had options transaction activity,\594\ 703 had transaction activity
in U.S. Treasury Securities,\595\ and 461 had transaction activity in
Agency Securities.\596\
---------------------------------------------------------------------------

    \592\ The number of firms that had transaction activity here may
be different than the number of firms that reported business lines
on Form BD at least in part due to differences in how business
activities are categorized on Form BD, and also because firms are
able to indicate lines of business based on expected business rather
than current business. With respect to categorical differences, Form
BD does not allow firms to distinguish between NMS and OTC equity
business as both types of stocks can be traded over the counter.
Additionally, Form BD does not distinguish between lines of business
for exchange-traded or OTC options. Finally, Form BD allows firms to
indicate government securities broker or dealer lines of business
but does not allow firms to specify more granularly treasury or
agency securities businesses.
    \593\ Estimate is based on Consolidated Audit Trail (CAT) data
from Jan. 2022 to June 2022.
    \594\ Id.
    \595\ Estimate is based on TRACE for Treasury Securities data
from Jan. 2022 to June 2022 and firm names as of Feb. 1, 2023.
    \596\ Estimate is based on regulatory TRACE data from Jan. 2022
to June 2022.
---------------------------------------------------------------------------

ii. Regulatory Baseline
    As discussed above in section III.A.2.b.ii, there are already a
number of Exchange Act and FINRA rules that affect how broker-dealers
design and maintain their technology and promote business continuity
and regulatory compliance. These include: Commission broker-dealer
rules; \597\ FINRA supervision rules \598\ (discussed at length in
section III.A.2.b); and FINRA's business continuity and reporting rules
(Rule 4370 and 4530, respectively) discussed previously in section
III.A2.b and further in this section. Furthermore, the Commission's
cybersecurity-related regulations (Regulation S-P and 17 CFR part 248,
subpart C (Regulation S-ID)) are discussed further below.\599\
---------------------------------------------------------------------------

    \597\ See supra section III.A.2.b (discussing Rules 17a-3, 17a-
4, 17a-11, 15c3-1, 15c3-3, and 15c3-5 (the Market Access Rule)).
    \598\ FINRA rule 3110 and 3130.
    \599\ See supra note 156.
---------------------------------------------------------------------------

    FINRA Rule 4370 primarily requires that each broker-dealer create
and maintain a written business continuity plan \600\ identifying
procedures relating

to an emergency or significant business disruption that are reasonably
designed to enable them to meet their existing obligations to customers
with explicit requirements for data back-up and recovery with respect
to mission critical systems as well as an alternate physical location
of employees.\601\ Each broker-dealer must update its plan in the event
of any material change to the member's operations, structure, business
or location. Each member must also conduct an annual review of its
business continuity plan to determine whether any modifications are
necessary in light of changes to the member's operations, structure,
business, or location. FINRA identified that firms \602\ frequently
tested their BC/DRs plans as part of their annual review and also
included key vendors in those tests.\603\ Furthermore, a broker-dealer
must disclose to its customers through public disclosure statements how
its business continuity plan addresses the possibility of a future
significant business disruption and how the member plans to respond to
events of varying scope. Such required business continuity public
disclosure statements \604\ offer some summary information on broker-
dealer actual practices that relate to FINRA Rule 4370. Recent FINRA
exam findings reports \605\ in relation to FINRA Rule 4370 suggest
increasing attention by broker-dealers to operational resiliency issues
and the value of capacity planning, stress testing, and the review of
testing and development methodology.
---------------------------------------------------------------------------

    \600\ See FINRA, 2019 Report on Examination Findings and
Observations: Business Continuity Plans (BCPs) (Oct. 16, 2019),
available at https://www.finra.org/rules-guidance/guidance/reports/2019-report-exam-findings-and-observations. Broker-dealers are
required to conduct an annual review of their business continuity
plans along with recommended testing and evaluation of its
effectiveness with vendor participation.
    \601\ FINRA Rules 4370, 3110 (Supervision), and 4511 (General
Requirements), as well as Securities Exchange Act of 1934 (Exchange
Act) Rules 17a-3 and 17a-4.
    \602\ FINRA did not disclose the number or identity of these
firms.
    \603\ See FINRA, 2019 Report on Examination Findings and
Observations: Business Continuity Plans (BCPs), supra note 600.
    \604\ While broker-dealers are required to provide a brief
summary disclosure statement regarding their BCPs to customers, they
do not disclose the actual BCP. Based on a review of 2021 and 2022
BCP disclosure statements, firms often did not provide any detail on
operational capacity to meet demand surges or any specific
timeframes for resumption of service. They sometimes mention the use
of redundant service centers, data centers, systems, and staff
across geographically diverse locations in case primary centers and
systems go offline; immediate failover to backup systems and plans
to restore services quickly in the event of a technology disruption;
and review of third parties' business contingency plans.
    \605\ See FINRA, 2022 Report on FINRA's Examination and Risk
Monitoring Program (Feb. 9, 2022), available at https://www.finra.org/sites/default/files/2022-02/2022-report-finras-examination-risk-monitoring-program.pdf. See also FINRA, 2020 Risk
Monitoring and Examination Priorities Letter (Jan. 9, 2020),
available at https://www.finra.org/rules-guidance/communications-firms/2020-risk-monitoring-and-examination-priorities-letter; FINRA,
Equity Trading Initiatives: Supervision and Control Practices for
Algorithmic Trading Strategies (Mar. 2015), available at https://www.finra.org/sites/default/files/notice_doc_file_ref/Notice_Regulatory_15-09.pdf.
---------------------------------------------------------------------------

    FINRA rules relating to supervision \606\ require each member to
establish, maintain, and enforce written procedures to supervise the
types of business in which it engages and the activities of its
associated persons that are reasonably designed to achieve compliance
with applicable securities laws and regulations including Federal
cybersecurity laws and regulations applicable to broker-dealers such as
Regulation S-P \607\ and Regulation S-ID.\608\ As discussed in section
III.D.1.c.i, Regulation S-P's safeguards provisions require broker-
dealers to adopt written policies and procedures that address
administrative, technical, and physical safeguards for the protection
of customer records and information.\609\ The Regulation S-P Safeguards
Rule further provides that these policies and procedures must: (1)
insure the security and confidentiality of customer records and
information; (2) protect against any anticipated threats or hazards to
the security or integrity of customer records and information; and (3)
protect against unauthorized access to or use of customer records or
information that could result in substantial harm or inconvenience to
any customer.\610\ Additionally, the Regulation S-P Disposal Rule
requires broker-dealers that maintain or otherwise possess consumer
report information for a business purpose to properly dispose of the
information by taking reasonable measures to protect against
unauthorized access to or use of the information in connection with its
disposal.\611\ In contrast, Regulation S-ID is more narrowly concerned
with identity theft. Broker-dealers subject to Regulation S-ID must
develop and implement a written identity theft program that includes
policies and procedures to identify and detect relevant red flags.\612\
---------------------------------------------------------------------------

    \606\ FINRA Rules 3110 (Supervision) and 3120 (Supervisory
Control Systems).
    \607\ See 17 CFR 248.1 through 248.30.
    \608\ See 17 CFR 248.201 and 248.202.
    \609\ See 17 CFR 248.30(a).
    \610\ See 17 CFR 248.30(a)(1) through (3).
    \611\ See 17 CFR 248.30(b)(2). Regulation S-P currently defines
the term ``disposal'' to mean: (1) the discarding or abandonment of
consumer report information; or (2) the sale, donation, or transfer
of any medium, including computer equipment, on which consumer
report information is stored. See 17 CFR 248.30(b)(1)(iii).
    \612\ See 17 CFR 248.201.
---------------------------------------------------------------------------

    Past Commission staff statements \613\ and FINRA guidance \614\
with respect to these rules identify common elements of reasonably
designed cybersecurity policies and procedures including risk
assessment, user security and access,

information protection, incident response,\615\ and training.\616\
---------------------------------------------------------------------------

    \613\ See OCIE, SEC, Cybersecurity: Safeguarding Client Accounts
against Credential Compromise (Sep. 15, 2020), available at https://www.sec.gov/files/Risk%20Alert%20-%20Credential%20Compromise.pdf;
OCIE, SEC, Select COVID-19 Compliance Risks and Considerations for
Broker-Dealers and Investment Advisers (Aug. 12, 2020), available at
https://www.sec.gov/files/Risk%20Alert%20-%20COVID-19%20Compliance.pdf; OCIE, SEC, Cybersecurity: Ransomware Alert
(July 10, 2020), available at https://www.sec.gov/files/Risk%20Alert%20-%20Ransomware.pdf; OCIE, SEC, Report on OCIE
Cybersecurity and Resiliency Observations (Jan. 27, 2020), available
at https://www.sec.gov/files/OCIE%20Cybersecurity%20and%20Resiliency%20Observations.pdf; OCIE,
SEC, OCIE Safeguarding Customer Records and Information in Network
Storage--Use of Third Party Security Features (May 23, 2019),
available at https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Network%20Storage.pdf; OCIE, SEC, Investment Adviser and Broker-
Dealer Compliance Issues Related to Regulation S-P--Privacy Notices
and Safeguard Policies (Apr. 16, 2019), available at https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Regulation%20S-P.pdf;
OCIE, SEC, Observations from Cybersecurity Examinations (Aug. 7,
2017), available at https://www.sec.gov/files/observations-from-cybersecurity-examinations.pdf; OCIE, SEC, Cybersecurity: Ransomware
Alert (May 17, 2017), available at https://www.sec.gov/files/risk-alert-cybersecurity-ransomware-alert.pdf; OCIE, SEC, OCIE's 2015
Cybersecurity Examination Initiative (Sep. 15, 2015), available at
https://www.sec.gov/files/ocie-2015-cybersecurity-examination-initiative.pdf; OCIE, SEC, Cybersecurity Examination Sweep Summary
(Feb. 3, 2015), available at https://www.sec.gov/about/offices/ocie/cybersecurity-examination-sweep-summary.pdf; OCIE, SEC, OCIE's 2014
Cybersecurity Initiative (Apr. 15, 2014), available at https://
www.sec.gov/ocie/announcement/Cybersecurity-Risk-Alert_Appendix_-
4.15.14.pdf.
    \614\ See FINRA, Core Cybersecurity Threats and Effective
Controls for Small Firms (May 2022), available at https://www.finra.org/sites/default/files/2022-05/Core_Cybersecurity_Threats_and_Effective_Controls-Small_Firms.pdf;
FINRA, Cloud Computing in the Securities Industry (Aug. 16, 2021),
available at https://www.finra.org/rules-guidance/key-topics/fintech/report/cloud-computing; FINRA, Common Cybersecurity Threats
(July 9, 2019), available at https://www.finra.org/rules-guidance/guidance/common-cybersecurity-threats; FINRA, Report on Selected
Cybersecurity Practices (Dec. 1, 2018), available at https://www.finra.org/rules-guidance/guidance/common-cybersecurity-threats;
FINRA, Report on FINRA Examination Findings (Dec. 6, 2017),
available at https://www.finra.org/sites/default/files/2017-Report-FINRA-Examination-Findings.pdf; FINRA, Small Firm Cybersecurity
Checklist (May 23, 2016), available at https://www.finra.org/compliance-tools/small-firm-cybersecurity-checklist. Cybersecurity
has also been a regular theme of FINRA's Regulatory and Examination
Priorities Letter since 2008 often with reference to Regulation S-P.
Similarly the SEC sponsored a Cybersecurity Roundtable and the
Division of Examination conducted cybersecurity initiative I and II
to assess industry practices and legal and compliance issues
associated with broker-dealer and investment adviser cybersecurity
preparedness.
    \615\ See FINRA, 2021 Report on FINRA's Examination and Risk
Monitoring Program (Feb. 01, 2021), available at https://www.finra.org/rules-guidance/guidance/reports/2021-finras-examination-and-risk-monitoring-program/cybersecurity (FINRA
recommended among effective practices with respect to incident
response: Establishing and regularly testing (often using tabletop
exercises) a written formal incident response plan that outlines
procedures for responding to cybersecurity and information security
incidents; and developing frameworks to identify, classify,
prioritize, track and close cybersecurity-related incidents.).
    \616\ These categories vary somewhat in terms of nomenclature
and the specific categories themselves across different Commission
and FINRA publications.
---------------------------------------------------------------------------

    Consistent with these rules, nearly all broker-dealers that
participated in two Commission exam sweeps in 2015 and 2017 reported
\617\ maintaining some cybersecurity policies and procedures;
conducting some periodic risk assessments to identify threats and
vulnerabilities,\618\ conducting firm-wide systems inventorying or
cataloguing, ensuring regular system maintenance including the
installation of software patches to address security vulnerabilities,
performing some penetration testing,\619\ although both sweeps also
discussed various flaws in compliance. A separate staff statement,
based on observed industry practices, noted that at least some firms
implemented capabilities that are able to control, monitor, and inspect
all incoming and outgoing network traffic to prevent unauthorized or
harmful traffic and implemented capabilities that are able to detect
threats on endpoints.\620\ In the two Commission exam sweeps, many
firms indicated that policies and procedures were vetted and approved
by senior management and that firms provided annual cybersecurity
reports to the board while some also provided ad hoc reports in the
event of major cybersecurity events.\621\ Broadly, many broker-dealers
reported relying on industry standards with respect to cybersecurity
\622\ typically by adhering to a specific industry standard or
combination of industry standards or by using industry standards as
guidance in designing policies and procedures. In the Commission's 2017
sweep, however, weaknesses in policies and procedures and failure to
implement policies and procedures were observed at a majority of the
participating firms.\623\
---------------------------------------------------------------------------

    \617\ See Cybersecurity Examination Sweep Summary, supra note
613 (Of 57 examined broker-dealers, the vast majority adopted
written information security policies, conducted periodic audits to
determine compliance with these information security policies and
procedures, conducted risk assessments and reported considering such
risk assessments in establishing their cybersecurity policies and
procedures. With respect to vendors, the majority of the broker-
dealers required cybersecurity risk assessments of vendors with
access to their firms' networks and had at least some specific
policies and procedures relating to vendors.). See also Observations
from Cybersecurity Examinations, supra note 613 (This largely
aligned with the prior 2015 Exam Sweep but is based on additional
data from a mixed group of 75 broker-dealers and investment
advisers. For example, nearly all firms had incident response plans.
Still, it appeared that a number of firms did not appear to fully
remediate some of the high risk observations that they discovered
from these tests and vulnerability scans in a timely manner or
failed to conduct penetration testing regularly).
    \618\ See Report on Selected Cybersecurity Practices, supra note
614. According to FINRA's 2018 RCA, 94% of higher revenue firms and
70% of mid-level revenue firms use a risk assessment as part of
their cybersecurity program. The Risk Control Assessment (RCA)
Survey is a voluntary survey conducted by FINRA on an annual basis
with all active member firms.
    \619\ Id. According to FINRA's 2018 RCA, 100% of higher revenue
firms include penetration testing as a component in their overall
cybersecurity program.
    \620\ See Cybersecurity and Resiliency Observations, supra note
614.
    \621\ See Cybersecurity Examination Sweep Summary, supra note
613, and Observations from Cybersecurity Examinations, supra note
613.
    \622\ Id. Among the firms that were part of the sweep, nearly
90% used one or more of the NIST, ISO or ISACA frameworks or
standards. More specifically, 65% of the respondents reported that
they use the ISO 27001/27002 standard while 25% use COBIT. Some
firms use combinations of these standards for various parts of their
cybersecurity programs. While the report focused on firm utilization
of cybersecurity frameworks specifically, in many cases, the
referenced frameworks were broader IT frameworks.
    \623\ See OCIE, SEC, Observations from Cybersecurity
Examinations (Aug. 7, 2017), available at https://www.sec.gov/files/observations-from-cybersecurity-examinations.pdf.
---------------------------------------------------------------------------

    FINRA Rule 3110's supervisory obligation also extends to member
firms' outsourcing of certain ``covered activities''--activities or
functions that, if performed directly by a member firm, would be
required to be the subject of a supervisory system and written
supervisory procedures pursuant to FINRA Rule 3110. These vendor
management obligations are discussed in further guidance.\624\ As
discussed in section III.A.2.b of this release, FINRA Rule 4530
requires broker-dealer reporting of certain events to FINRA, including,
among other things, compliance issues and other events \625\ where a
broker-dealer has concluded or should have reasonably concluded that a
violation of securities or other enumerated law, rule, or regulation of
any domestic or foreign regulatory body or SRO has occurred. Broker-
dealers affiliated with a banking organization \626\ may also be
affected by a cybersecurity notification requirement. For example, if a
broker-dealer is a subsidiary of a bank holding company, an incident at
the broker-dealer would likely be reported by the bank holding company
to its respective banking regulator.
---------------------------------------------------------------------------

    \624\ See Regulatory Notice 21-29: Vendor Management and
Outsourcing, supra note 165; Notice to Members 05-48: Outsourcing,
supra note 165. FINRA found that most firms had adequate privacy and
security language in contracts where customer or firm confidential
data or high-risk systems were at risk. Standard contract language
topics that firms included were: non-disclosure agreements/
confidentiality agreements, data storage, retention, and delivery;
breach notification responsibilities; right-to-audit clauses; vendor
employee access limitations; use of subcontractors; and vendor
obligations upon contract termination. Id.
    \625\ While FINRA has urged firms to report material cyber
incidents that do not trigger a reporting obligation to their
regulatory coordinator, current practices are unclear.
    \626\ In the simplification of the Volcker Rule, effective Jan.
21, 2020, Commission staff estimated that there were 202 broker-
dealers that were affiliated with banking organizations.
---------------------------------------------------------------------------

    Aside from specific dissemination obligations under Regulation SCI
for a limited number of broker-dealers with respect to their related
SCI ATSs, there are no Commission or FINRA requirements for broker-
dealers to disseminate notifications of breaches to members or clients
although many firms do so \627\ pursuant to various state data breach
laws.\628\ Broker-dealers are subject to state laws known as ``Blue Sky
Laws,'' which generally are regulations established as safeguards for
investors against securities fraud.\629\ All 50 states have enacted
laws in recent years requiring firms to notify individuals of data
breaches, standards differ by state, with some states imposing
heightened notification requirements relative to other states.\630\
---------------------------------------------------------------------------

    \627\ See Cybersecurity Examination Sweep Summary, supra note
613 (Based on a small sample of firms, the vast majority of broker-
dealers maintained plans for data breach incidents and most had
plans for notifying customers of material events.)
    \628\ See Digital Guardian, The Definitive Guide to U.S. State
Data Breach Laws, digitalguardian.com, available at https://info.digitalguardian.com/rs/768-OQW-145/images/the-definitive-guide-to-us-state-data-breach-laws.pdf (last visited Nov. 15, 2022).
    \629\ See, e.g., Office of Investor Education and Advocacy,
Commission, Blue Sky Laws, available at https://www.investor.gov/introduction-investing/investing-basics/glossary/blue-sky-laws.
    \630\ For example, some states may require a firm to notify
individuals when a data breach includes biometric information, while
others do not. Compare Cal. Civil Code sec. 1798.29 (notice to
California residents of a data breach generally required when a
resident's personal information was or is reasonably believed to
have been acquired by an unauthorized person; ``personal
information'' is defined to mean an individual's first or last name
in combination with one of a list of specified elements, which
includes certain unique biometric data), with Ala. Stat. secs. 8-38-
2, 8-38-4, 8-38-5 (notice of a data breach to Alabama residents is
generally required when sensitive personally identifying information
has been acquired by an unauthorized person and is reasonably likely
to cause substantial harm to the resident to whom the information
relates; ``sensitive personally identifying information'' is defined
as the resident's first or last name in combination with one of a
list of specified elements, which does not include biometric
information).

---------------------------------------------------------------------------

    Additionally, market data, including bids, offers, quotation sizes,
among other types of data, are currently collected from broker-dealers
and consolidated and distributed pursuant to a variety of Exchange Act
rules and joint industry plans.\631\
---------------------------------------------------------------------------

    \631\ See, e.g., Rules 601 through 17 CFR 242.604 (``Rule 604'')
of Regulation NMS and 17 CFR 242.301(b)(3) (``Rule 301(b)(3)'') of
Regulation ATS.
---------------------------------------------------------------------------

c. Exempt Clearing Agencies
i. Affected Parties
    Certain SCI entities are in the market for clearance and settlement
services. Registered clearing agencies and certain exempt clearing
agencies are already SCI entities. The Commission proposes to extend
Regulation SCI to include all other exempt clearing agencies. The
proposed amendment would have the immediate effect of introducing two
exempt clearing agencies into the scope of Regulation SCI.
    There are broadly two types of clearing agencies: registered
clearing agencies and exempt clearing agencies. There are seven
registered and active clearing agencies: DTC, FICC, NSCC, ICC, ICEEU,
the Options Clearing Corp., and LCH SA. There are two other clearing
agencies that are no longer active but both maintain registration with
the Commission.\632\ In addition to these registered clearing agencies,
there are clearing agencies that have received from the Commission an
exemption from registration as a clearing agency under section 17A of
the Exchange Act. There are five exempt clearing agencies: Bloomberg
STP (inactive), ITPMATCH (DTCC), SSCNET (SS&C Technologies), Euroclear
Bank SA/NV, and Clearstream Banking, S.A. Of these exempt clearing
agencies, Bloomberg STP, ITPMATCH (DTCC), and SSCNET (SS&C
Technologies) are subject to Regulation SCI as ``exempt clearing
agencies subject to ARP,'' together with registered clearing agencies.
---------------------------------------------------------------------------

    \632\ See BSECC Notice and SCCP Notice, supra note 230.
---------------------------------------------------------------------------

    The other two, Euroclear Bank SA/NV, and Clearstream Banking, S.A,
both exempt clearing agencies,\633\ have not been required to comply
with Regulation SCI. Each performs CSD functions and provides clearance
and settlement for U.S. Treasury transactions, subject to volume limits
set forth in their exemptions. Euroclear Bank also provides collateral
management services for U.S. equity transactions involving a U.S.
person and a non-U.S. person.
---------------------------------------------------------------------------

    \633\ See Euroclear Exemption, supra note 231 (providing an
exemption to Euroclear Bank SA/NV (successor in name to Morgan
Guaranty Trust Company of NY)); Clearstream Exemption, supra note
231 (providing an exemption to Clearstream Banking, S.A. (successor
in name to Cedel Bank, soci[eacute]t[eacute] anonyme, Luxembourg)).
Furthermore, pursuant to the Commission's statement on CCPs in the
European Union (``EU'') authorized under the European Markets
Infrastructure Regulation (``EMIR''), an EU CCP may request an
exemption from the Commission where it has determined that the
application of SEC requirements would impose unnecessary,
duplicative, or inconsistent requirements in light of EMIR
requirements to which it is subject. See Statement on Central
Counterparties Authorized under the European Markets Infrastructure
Regulation Seeking to Register as a Clearing Agency or to Request
Exemptions from Certain Requirements Under the Securities Exchange
Act of 1934 supra note 240 (stating that in seeking an exemption, an
EU CCP could provide ``a self-assessment . . . [to] explain how the
EU CCP's compliance with EMIR corresponds to the requirements in the
Exchange Act and applicable SEC rules thereunder, such as Rule 17Ad-
22 and Regulation SCI.'').
---------------------------------------------------------------------------

ii. Regulatory Baseline
    The two exempt clearing agencies not subject to ARP are required
per Commission exemptive orders to submit to the Commission a number of
items including transaction volume data,\634\ notification regarding
material adverse changes in any account maintained for customers,\635\
one or more disclosure documents, amendments to its application for
exemption on Form CA-1,\636\ responses to a Commission request for
information,\637\ etc. In the case of one exempt clearing agency, its
exemptive order also requires submission of additional items related to
its systems including quarterly reports describing completed, ongoing,
and planned material system changes,\638\ notification \639\ regarding
systems events; \640\ as well as a requirement to take appropriate
corrective action regarding such systems events. This exempt clearing
agency is also required to maintain policies and procedures that are
reasonably designed to identify, manage, and monitor systems
operational risk; clearly define the roles and responsibilities of
personnel for addressing operational risk; review such policies and
procedures; conduct systems audits and system tests periodically and at
implementation of significant changes; clearly define operational
reliability objectives for the systems; ensure that the systems have
scalable capacity adequate to handle increasing stress volumes and
achieve the systems service-level objectives; establish comprehensive
physical and information security policies that address all potential
vulnerabilities and threats to the systems; and establish a business
continuity plan \641\ for the systems that addresses events posing a
significant risk of disrupting the systems' operations, including
events that could cause a wide-scale or major disruption in the
provision of the clearing agency activities. Such policies and
procedures should be consistent with current information technology
industry standards \642\ and be reasonably designed to ensure that the
systems operate on an ongoing basis in a manner that complies with the
conditions applicable to the systems and with the exempt clearing
agency's rules and governing documents applicable to the clearing
agency activities. This exempt clearing agency must also provide the

Commission with an annual update regarding policies and procedures.
---------------------------------------------------------------------------

    \634\ Id. This is provided in the form of quarterly reports,
calculated on a twelve-month rolling basis, of volume statistics
related to government securities. One exempt clearing agency also
reports volume statistics related to equities.
    \635\ Id. This is for customers that are members or affiliates
of members of a U.S. registered clearing agency in the case of one
exempt clearing or US participants in the case of the other.
    \636\ Id. This must be filed prior to the implementation of any
change in stated policies, practices, or procedures that makes the
information contained in the original Form CA-1 incomplete or
inaccurate in any material respect.
    \637\ Id. This would typically concern a U.S. customer or its
affiliate about whom the Commission has financial solvency concerns.
    \638\ This must be filed within 30 calendar days after the end
of each quarter. These reported information represents changes
related to the Clearing Agency Activities during the prior, current,
and subsequent calendar quarters, including the dates or expected
dates of commencement and completion.
    \639\ This requires notification of such systems event within 24
hours after occurrence; regular updates until such time as a systems
event is resolved and investigation of the systems event is closed;
interim written notification within 48 hours after the occurrence of
a systems event or promptly thereafter if such a deadline cannot be
met; a written final report within ten business days after the
occurrence of a systems event or promptly thereafter if such a
deadline cannot be met. For systems events characterized as ``bronze
level'' events (i.e., a Systems Event in which the incident is
clearly understood, almost immediately under control, involves only
one business unit and/or entity, and is resolved within a few
hours), the clearing agency is instead required to provide on a
quarterly basis an aggregated list of bronze level events.
    \640\ This includes disruptions, compliance issues, or
intrusions of the systems that impact, or is reasonably likely to
impact clearing agency activities.
    \641\ The business continuity plan would require the use of a
secondary site designed to ensure two-hour resumption of operation
following disruptive events; regular testing of business continuity
plans; identification, monitoring, and management of the risks that
key participants, other financial market infrastructures, and
service and utility providers might pose to the systems' operations
in relation to the clearing agency activities.
    \642\ The exempt clearing agency is required to provide annual
notice to the Commission regarding the industry standards utilized.
These standards consist of information technology practices that are
widely available to information technology professionals in the
financial sector and issued by a widely recognized organization.
---------------------------------------------------------------------------

    Additionally, the two exempt clearing agencies not subject to ARP
are subject to Europe's Central Securities Depositories Regulation
(CSDR) which provides a set of common requirements for CSDs operating
securities settlement systems across the EU.\643\ CSDR provides, among
other things, Operational Risk rules (Article 45).\644\ There are more
specific requirements in the CSDR's Regulatory Technical Standards
\645\ including identifying operational risks; \646\ methods to test,
address and minimize operational risks; \647\ IT systems; \648\ and
business continuity.\649\
---------------------------------------------------------------------------

    \643\ The two exempt clearing agencies may also be subject to
the EU Regulation, the Digital Operational Resilience Act (DORA),
which went into effect in 2015: See Proposal for a Regulation of the
European Parliament and of the Council on Digital Operational
Resilience for the Financial Sector and Amending Regulations (EC) No
1060/2009, (EU) No 648/2012, (EU) No 600/2014 and (EU) No 909/2014
available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020PC0595.
    \644\ See Commission Regulation No. 909/2014 of July 23, 2014,
on improving securities settlement in the European Union and on
central securities depositories and amending Directives 98/26/EC and
2014/65/EU and Regulation (EU) No 236/2012, art. 45, 2014 O.J. (L
257) 47, available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014R0909.
    \645\ See Commission Delegated Regulation 2017/392,
Supplementing Regulation (EU) No 909/2014 of the European Parliament
and of the Council with Regard to Regulatory Technical Standards on
Authorization, Supervisory and Operational Requirements for Central
Securities Depositories. 65 Off. J. Eur. Union 48 (2017) available
at https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0392&from=EN.
    \646\ Id. art. 45:1.
    \647\ Id. art. 45:2.
    \648\ Id. art. 45:3.
    \649\ Id. art. 45:4.
---------------------------------------------------------------------------

    Furthermore, each of these two exempt clearing agencies publish
disclosure framework reports \650\ that purport to describe the
policies and procedures \651\ with respect to the operational risk
framework of the Principles for Financial Market Infrastructures (PFMI)
published by CPSS and IOSCO.\652\
---------------------------------------------------------------------------

    \650\ See infra notes 683-684.
    \651\ The respective disclosure documents have not been reviewed
by the Commission and its staff for accuracy and may or may not
demonstrate implementation/compliance with international standards.
    \652\ Bank for International Settlements (BIS), Principles for
Financial Market Infrastructures: Disclosure Framework and
Assessment Methodology (Dec. 2012), available at https://www.bis.org/cpmi/publ/d106.pdf.
---------------------------------------------------------------------------

2. Existing SCI Entities
a. Affected Parties
    In addition to these proposed new SCI entities, Regulation SCI has
applied to entities that facilitate several different markets,
including the market for trading services, the market for listing
services, the market for regulation and surveillance services, the
market for clearance and settlement services, and the market for market
data.\653\ As of this writing, there are 47 SCI entities. These include
35 SCI SROs (including 24 exchanges, 9 registered clearing agencies,
FINRA, and the MSRB), 7 SCI ATSs (including 5 NMS stock ATSs and 2 non-
NMS stock ATSs), 2 plan processors, and 3 exempt clearing agencies
subject to ARP.\654\ All of them are already required to comply with
Regulation SCI, and, as discussed in section V.B.2.b, subsets of these
entities also have other specific rules that apply to them.
---------------------------------------------------------------------------

    \653\ 17 CFR 242.1000 (definitions of ``SCI systems'' and
``critical SCI systems'').
    \654\ In 2021, the Commission amended Regulation SCI to add
competing consolidators that exceed a 5% consolidated market data
gross revenue threshold over a specified time period as SCI
entities. Currently, no competing consolidators have registered with
the Commission. See Market Data Infrastructure Adopting Release,
supra note 24.
---------------------------------------------------------------------------

    The general characteristics of the markets in which the existing
SCI entities operate are described in the SCI Proposing Release \655\
and SCI Adopting Release.\656\ There are, however, broad changes to
these markets--as they pertain to Regulation SCI--that should be noted.
The markets have changed in at least four important ways. First, the
total trading volumes have increased across all types of
securities.\657\ Second, there is an increased reliance on technology
and automation among financial institutions, a trend which accelerated
due to the COVID-19 pandemic.\658\ Third, and relatedly, financial
institutions have become increasingly dependent on third parties--
including cloud service providers--to operate their businesses and
provide their services.\659\ This is, in fact, a general trend among
all global companies, and this trend, too, has been driven in part by
the COVID-19 pandemic.\660\ Fourth, cybersecurity events have grown in
both number and sophistication.\661\ These developments in the market
have significantly increased the negative externalities that may flow
from systems failures.
---------------------------------------------------------------------------

    \655\ See SCI Proposing Release, supra note 14, at section V.
See also Market Data Infrastructure Adopting Release, supra note 24,
for a description of competing consolidator market characteristics.
    \656\ See SCI Adopting Release, supra note 1, at section VI.
    \657\ See, e.g., SIFMA Insights: Electronic Trading Market
Structure Primer, supra note 3 (summarizing electronic trading
history and trends in different markets); SEC, Staff Report on
Equity and Options Market Structure Conditions in Early 2021 (Oct.
14, 2021), available at https://www.sec.gov/files/staff-report-equity-options-market-struction-conditions-early-2021.pdf; see also
U.S. House Committee on Financial Services, Game Stopped: How the
Meme Stock Market Event Exposed Troubling Business Practices,
Inadequate Risk Practices, and the Need for Legislative and
Regulatory Reform (June 2022), available at: https://democrats-financialservices.house.gov/uploadedfiles/6.22_hfsc_gs.report_hmsmeetbp.irm.nlrf.pdf.
    \658\ See, e.g., Henning Soller, et al., Innovative Technologies
in Financial Institutions: Risk as a Strategic Issue, McKinsey
Digital (Sep. 25, 2020), available at: https://www.mckinsey.com/business-functions/mckinsey-digital/our-insights/tech-forward/innovative-technologies-in-financial-institutions-risk-as-a-strategic-issue (``The current COVID-19 crisis has significantly
accelerated the need for financial institutions to adopt innovative
technologies.'').
    \659\ See, e.g., Noah Kessler, Cloud Is on the Rise in Financial
Services and Regulators Are Taking Note, ABA Risk and Compliance
(Sept. 29, 2021), available at https://bankingjournal.aba.com/2021/09/cloud-is-on-the-rise-in-financial-services-and-regulators-are-taking-note/.
    \660\ See, e.g., Deloitte, 2021 Global Shared Services and
Outsourcing Survey Report 3, available at https://www2.deloitte.com/content/dam/Deloitte/global/Documents/Process-and-Operations/gx-2021-global-shared-services-report.pdf (``[T]here's an increasing
shift to leverage global, multifunctional, and virtual or remote
models, especially driven by learnings from COVID-19'').
    \661\ See, e.g., Chuck Brooks, Alarming Cyber Statistics For
Mid-Year 2022 That You Need To Know, Forbes.com (June 3, 2022),
available at https://www.forbes.com/sites/chuckbrooks/2022/06/03/alarming-cyber-statistics-for-mid-year-2022-that-you-need-to-know/?sh=2429c57e7864.
---------------------------------------------------------------------------

    Current SCI entities are required to report systems intrusions,
either immediately or on a quarterly basis, rather than immediately if
de miminis in impact. However, current SCI entities have not been
reporting attempted intrusions, as they were not required to do so.
b. Regulatory Baseline
    The common regulatory baseline for current SCI entities is
Regulation SCI which was adopted in 2014. Regulation SCI requires,
among other things, that these entities establish, maintain, and
enforce written policies and procedures reasonably designed to ensure
that their SCI systems have levels of capacity, integrity, resiliency,
availability, and security adequate to maintain their operational
capability and promote the maintenance of fair and orderly markets and
operate in a manner that complies with the Exchange Act and the rules
and regulations thereunder and the entity's rules and governing
documents, as applicable, and specifies certain minimum requirements
for such policies and procedures. As a policies and procedures based
rule, and one that employs a risk-based approach, Regulation SCI
provides flexibility to allow each SCI entity to determine how

to best meet the requirements in Rule 1001(a).
    In addition, 17 CFR 242.613 (``Rule 613'') of Regulation NMS
requires national securities exchanges and national securities
associations (FINRA) to jointly develop and submit to the Commission a
Consolidated Audit Trail National Market System (CAT NMS) Plan.\662\
---------------------------------------------------------------------------

    \662\ 17 CFR 242.613.
---------------------------------------------------------------------------

    Under the Commission-approved CAT NMS Plan, the national securities
exchanges and FINRA (the Participants) conduct the activities related
to the CAT through a jointly owned limited liability company,
Consolidated Audit Trail, LLC (``Company'').\663\ FINRA CAT, LLC--a
wholly-owned subsidiary of FINRA--has entered into an agreement with
the Company to act as the plan processor for the CAT. However, the
Participants remain ultimately responsible for the performance of the
CAT and its compliance with any statutes, rules, and regulations.\664\
The Plan Processor must develop three sets of policies and procedures:
(1) the CAT information security program and related data security
policies and procedures; (2) user security and access policies and
procedures; and (3) breach management policies and procedures.\665\
---------------------------------------------------------------------------

    \663\ Consolidated Audit Trail, LLC, CAT NMS Plan, secs. 1.1,
3.1, 4.1 (July 2020), available at https://catnmsplan.com/sites/default/files/2020-07/LLC-Agreement-of-Consolidated-Audit-Trail-LLC-as-of-7.24.20.pdf; see also CAT NMS Plan Approval Order, supra note
393; Joint Industry Plan; Order Approving Amendment to the National
Market System Plan Governing the Consolidated Audit Trail,
Securities Exchange Act Release No. 89397 (July 24, 2020), 85 FR
45941 (July 30, 2020).
    \664\ CAT NMS Plan, secs. 4.3, 5.1, 6.1. The Participants
jointly own on an equal basis the Company. As such, the CAT's
Central Repository is a facility of each of the Participants, and
also an SCI system of each of the Participants. See SCI Adopting