of a single problem to the market at-large.\1994\ Further, the
Commission believes that providing written notifications to the
Commission could help prevent systems failures from being dismissed as
momentary issues, because notification would help focus the SCI
entity's attention on the issue and encourage allocation of SCI entity
resources to resolve the issue as soon as reasonably practicable.
---------------------------------------------------------------------------

    \1993\ See supra Section IV.B.3.c (discussing in detail the
requirements of Rule 1002(b)).
    \1994\ See Lauer Letter at 8.
---------------------------------------------------------------------------

    As noted in Section IV.B.3.c, the Commission received comment
letters that discuss the resource and efficiency demands of the
Commission notification requirement.\1995\ Some commenters expressed
concern that SCI entities may feel compelled to characterize and report
a greater number of systems anomalies as disruptions to comply with
Regulation SCI,\1996\ and that the proposal would result in SCI
entities having ``shadow staff'' on hand solely for reporting SCI
events so as to not divert staff away from working to resolve SCI
events.\1997\ While the Commission is adopting the definitions of
systems disruptions, systems compliance issues, and systems intrusions,
and providing discussions of these definitions in this release, the
Commission acknowledges that some SCI entities could be overly cautious
in seeking to be in compliance with Regulation SCI and therefore over-
report systems issues to the Commission. Furthermore, the Commission
notes that some SCI entities currently notify the Commission of systems
related issues under the ARP Inspection Program or as part of their
current business practice, but the Commission believes that SCI
entities will have to allocate additional resources to meet the
Commission notification requirement. Although the estimated cost to
comply with the adopted notification provisions is greater than the
estimate in the SCI Proposal, the Commission is not persuaded that the
adopted rule, with its more targeted scope, will require SCI entities
to have a ``shadow staff'' on hand solely for reporting SCI events. As
discussed in Section IV.B.3.c, the Commission believes that concerns
with respect to resource demands regarding the Commission notification
requirements have been substantially mitigated by the numerous changes
from the proposal, such as the adoption of a quarterly reporting
framework for de minimis systems disruptions and de minimis systems
intrusions; the adoption of an exception from the Commission
notification requirements for de minimis systems compliance issues; the
revised definitions of SCI systems, indirect SCI systems, systems
disruption, and systems compliance issue; and the reduction in the
obligations SCI entities have with respect to reporting requirements.
In addition, the Commission is not persuaded that the burden of the
Commission notification requirement will significantly reduce SCI
entities' ability to adequately respond to SCI events. It is the
Commission's experience that the staff engaging in corrective action to
resolve an SCI event is generally distinct from the staff that has been
charged with notifying the Commission of systems issues.
---------------------------------------------------------------------------

    \1995\ See, e.g., UBS Letter at 3; Omgeo Letter at 16; MSRB
Letter at 19; OCC Letter at 14; SunGard Letter at 5; Joint SROs
Letter at 7; and NYSE Letter at 22.
    \1996\ See Joint SROs Letter at 9-10.
    \1997\ See FINRA Letter at 19.
---------------------------------------------------------------------------

    The compliance costs associated with Rule 1002(b) are attributed to
the paperwork burden of Commission notifications of SCI events,
including recordkeeping and submission of quarterly reports with
respect to de minimis SCI events, as applicable.\1998\ As discussed in
the PRA, with respect to SCI events that are not de minimis, the
Commission has estimated the total annual hourly burden to comply with
Rules 1002(b)(1)-(4) to be 125,180 hours for all SCI entities
(monetized to be approximately $40 million), or 2,845 hours per SCI
entity.\1999\ This estimate is greater than that estimated in the SCI
Proposal (which estimate was 58,080 hours for all SCI entities, or
1,320 hour per SCI entity to comply with proposed Rules 1000(b)(4)(i)-
(iii)). As more fully explained in the PRA, the Commission has
increased its estimate to comply with the Commission notification
provisions in Rules 1002(b)(1)-(4), notwithstanding the more targeted
scope of the adopted rule, as compared to the proposed rule. These
increased estimates are in response to comment that the estimates in
the SCI Proposal were too low, particularly with respect to the time
necessary for an SCI entity to prepare, review, and submit the required
notifications.\2000\ In addition, for Rule 1002(b)(5), which requires
recordkeeping of all de minimis SCI events and quarterly reporting of
de minimis systems disruptions and de minimis systems intrusions, the
Commission has estimated a total of 7,040 hours for all SCI entities
(monetized to be approximately $2 million), or 160 hours per SCI
entity, for Commission notification. The number of SCI events (de
minimis and otherwise), and the burdens to comply with notification
requirements will likely vary among individual SCI entities, based on
the nature of their business, technology, and the relative criticality
of each of their SCI systems.
---------------------------------------------------------------------------

    \1998\ When monetized, the paperwork burden would result in
approximately $42 million, in addition to approximately $2 million
in outsourcing cost, annually for all SCI entities in the aggregate.
    \1999\ See supra Section V.D.2.a (discussing the Commission's
estimate of the hours required to comply with Rule 1002(b)).
    \2000\ See id.
---------------------------------------------------------------------------

    In addition, the Commission believes that most, if not all, SCI
entities already have some internal procedures for determining the
severity of a systems issue. Nevertheless, to the extent that an SCI
entity must determine whether an SCI event is a de minimis SCI event,
Rule 1002(b) may impose one-time implementation costs on SCI entities
associated with developing a process for ensuring that they are able to
quickly and correctly make such determinations, as well as ongoing
costs in reviewing the adopted process. The initial and ongoing burden
associated with identifying certain systems and SCI events is discussed
in Section V.D.3.b.\2001\
---------------------------------------------------------------------------

    \2001\ When monetized, the paperwork burden would result in
approximately $1.1 million initially and $413,000 annually for all
ARP entities in the aggregate, and approximately $885,000 initially
and $292,000 annually for all non-ARP entities in the aggregate.
These estimates include the identification of critical SCI systems,
major SCI events, and de minimis SCI events.

---------------------------------------------------------------------------

    Proposed Rule 1000(b)(4) did not distinguish de minimis SCI events
from other SCI events in terms of the timing or type of Commission
notifications. The Commission believes that the adopted quarterly
Commission reporting requirement for de minimis systems disruptions and
de minimis systems intrusions, and the exception from the Commission
reporting requirement for de minimis systems compliance issues, will
reduce costs related to Commission reporting (as compared to the costs
of complying with the proposed Commission notification requirements)
for SCI entities, and could facilitate more efficient allocation of SCI
entities' resources toward more significant systems issues because de
minimis SCI events would be subject to a recordkeeping requirement and
de minimis systems disruptions and de minimis systems intrusions would
be subject to a quarterly reporting requirement, rather than a
requirement to report such events to the Commission more immediately.
As de minimis SCI events are defined to have no or a de minimis impact
on the SCI entity's operations or on market participants, the
Commission believes that the recordkeeping requirement and quarterly
reporting requirement, as applicable, will allow both the SCI entity
and its personnel, as well as the Commission and its staff, to focus
more of their attention and resources on other, more significant SCI
events. Moreover, the quarterly Commission notification requirement for
de minimis systems disruptions and de minimis systems intrusions will
help SCI entities and the Commission to gather information on the
nature, types, and frequency of de minimis SCI events and, thus, help
identify potential weaknesses in systems across SCI entities and
Commission's ability to monitor market events. The Commission believes
that the quarterly reporting requirement for de minimis systems
disruptions and de minimis systems intrusions balances the interest of
SCI entities in having a limited reporting burden for de minimis
systems disruptions and de minimis systems intrusions with the
Commission's interest in oversight of the information technology
programs of SCI entities.
    Furthermore, proposed Rule 1000(b)(4)(iii) would have required an
SCI entity to submit written updates pertaining to an SCI event until
the SCI event is resolved. The Commission has revised the update
requirement from the proposal in adopted Rule 1002(b)(3) so that the
submission of updates may be provided either orally or in written
form.\2002\ This revision should reduce costs as compared to proposed
Rule 1000(b)(4) by providing flexibility to SCI entities and because
oral notifications will likely result in a lower burden than written
notifications.
---------------------------------------------------------------------------

    \2002\ See supra Section IV.B.3.c.
---------------------------------------------------------------------------

    The Commission has also modified the 24-hour written notification
requirement in adopted Rule 1002(b) to make clear that the written
notification provided within 24 hours be submitted on a good faith,
best effort basis. Compared to the proposed rule, the Commission
believes the adopted rules will help provide certainty to SCI entities
that they will not be accountable for unintentional inaccuracies or
omissions contained in these submissions. The ``best efforts'' standard
will also help to ensure that SCI entities will make a diligent and
timely attempt to provide all the information required by the written
notification requirement, thus permitting the Commission to effectively
monitor SCI events.
    As discussed in Section IV.B.3.c, with respect to submitting final
written notifications, proposed Rule 1000(b)(4)(ii) would have required
the submission of the information required to be included in the final
written notification within a shorter time frame. By requiring that the
final written notification be submitted after resolution of an SCI
event, the Commission believes that the adopted rule will encourage SCI
entities to allocate their resources efficiently in resolving the SCI
event.
    One commenter expressed concern that, without a safe harbor and a
guarantee of immunity, the disclosures to the Commission required under
Regulation SCI would provide a roadmap for litigation against non-SRO
entities.\2003\ As discussed in Section IV.B.2.b, the occurrence of a
systems compliance issue does not necessarily mean that the SCI entity
will be subject to an enforcement action. Rather, the Commission will
exercise its discretion to initiate an enforcement action if the
Commission determines that action is warranted, based on the particular
facts and circumstances of an individual situation. Moreover, the
Commission recognizes that compliance with Regulation SCI will increase
the amount of information about SCI events available to the Commission
and SCI entities' members and participants, and that the greater
availability of this information has some potential to increase
litigation risks for SCI entities, including the risk of private civil
litigation. Commenters did not provide estimates of potential
litigation costs and Commission staff were unable to find readily-
available public information from which to estimate specific costs of
possible litigation associated with the increased information available
about SCI events, but based on staff experience, depending on the
complexity, scope, and length of the litigation, the costs to defend an
individual case could be quite significant. The Commission notes,
however, that it is not clear that the incremental increase in costs
due to Regulation SCI will be significant in the aggregate. Regulation
SCI does not alter the elements of any available private cause of
action, and the elements of such actions are likely to limit the
potential for recovery. Moreover, to the extent members and
participants suffer damages when SCI events occur, SCI entities are
already subject to litigation risk.
---------------------------------------------------------------------------

    \2003\ See OTC Markets Letter at 15-16 (stating that ``entities
that do not have SRO immunity, such as ATSs, may be subject to
liability based on information reported under Reg. SCI's Rule
1000(b)(4)(iv) . . . [w]ithout a safe harbor and a guarantee of
immunity, this kind of disclosure provides a roadmap for litigation
against non-SRO SCI entities''). See also FIF Letter at 5.
---------------------------------------------------------------------------

    As an alternative to the adopted rule, some commenters suggested
that non-material systems intrusions not be reported to the Commission
at all, and only be recorded by the SCI entity to reduce the instances
in which notice of systems intrusions would be required.\2004\ The
Commission continues to believe that reporting intrusions in SCI
systems and indirect SCI systems will help the Commission and its staff
to detect patterns or understand trends over time and the nature of
systems intrusions that may be occurring at multiple SCI entities and,
thus, help ensure effective Commission oversight. As discussed in
Section IV.B.3.c in detail, to reduce the burden associated with the
Commission notification requirement, the Commission established
separate reporting requirements (e.g., quarterly reporting) for de
minimis systems disruptions and de minimis systems intrusions and
provided an exception from the Commission reporting requirement for de
minimis systems compliance issues.
---------------------------------------------------------------------------

    \2004\ See Omgeo Letter at 12; and DTCC Letter at 8.
---------------------------------------------------------------------------

iv. Information Dissemination--Rule 1002(c)
    Rule 1002(c) requires an SCI entity to disseminate information
regarding

certain major SCI events to all of its members or participants and
certain other SCI events to affected members or participants.
Specifically, promptly after any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred, an SCI
entity is required to disseminate certain information regarding the SCI
event. When certain additional information becomes known, the SCI
entity is required to promptly disseminate such information. Until the
SCI event is resolved, the SCI entity is required to provide regular
updates on the required information.\2005\ As adopted, the information
dissemination requirement does not apply to SCI events to the extent
they relate to market regulation or market surveillance systems and de
minimis SCI events. Rule 1002(c) imposes new requirements that are not
currently part of the ARP Inspection Program. However, some entities
currently provide their members or participants and, in some cases,
market participants or the public more generally, with notices of
systems issues.
---------------------------------------------------------------------------

    \2005\ Rule 1002(c)(2) provides an exception to the information
dissemination requirement for systems intrusions when an SCI entity
determines that dissemination of information would likely compromise
the security of the SCI entity's systems, or an investigation of the
systems intrusion, and documents the reasons for such determination.
---------------------------------------------------------------------------

    As discussed in Section IV.B.3.d, a major SCI event is defined to
mean an SCI event that has any impact on a critical SCI system or a
significant impact on the SCI entity's operations or on market
participants. The Commission believes that, in the context of a major
SCI event, where the impact of the SCI event is most likely to be felt
by many market participants, the goal of aiding market participants in
evaluating the impact of the event would be efficiently served by
dissemination of information to all members or participants of the SCI
entity.\2006\
---------------------------------------------------------------------------

    \2006\ At the same time, the Commission recognizes that some SCI
events that meet the definition of ``major SCI event'' could also
qualify as de minimis SCI events. Like other de minimis SCI events,
they are excepted from the information dissemination requirement. In
particular, because major SCI events are a subset of SCI events, the
exception under Rule 1002(c)(4)(ii) applies to major SCI events that
meet the requirements of that rule.
---------------------------------------------------------------------------

    The Commission believes that Rule 1002(c) will help market
participants--specifically the members or participants of SCI entities
estimated to be affected by an SCI event and any additional members or
participants subsequently estimated to be affected by an SCI event and,
in some cases, all members or participants of an SCI entity--to better
evaluate the operations of SCI entities by requiring certain
information to be disclosed. Furthermore, increased awareness of SCI
events through information disseminated to members or participants
should provide SCI entities additional incentives to maintain robust
systems and minimize the occurrence of SCI events. More robust SCI
systems and the reduction in the occurrence of SCI events could reduce
interruptions in price discovery process and liquidity flows as
discussed above in Section VI.C.1.
    One commenter provided information about the benefits of the
proposed information dissemination requirements. Specifically,
according to this commenter, one of the major benefits of Regulation
SCI could be better sharing of information about technology
problems.\2007\ According to this commenter, sharing information about
hardware failures, systems intrusions, and software glitches will alert
others in the industry about such problems and help reduce system-wide
costs of diagnosing problems, as well as result in improved responses
to technology problems.\2008\ This commenter also believed that the
information will serve as warnings to other SCI entities to stay
vigilant to prevent similar problems.\2009\ The Commission believes
that benefits identified by the commenter could be benefits of Rule
1002(c).
---------------------------------------------------------------------------

    \2007\ See Angel Letter at 5.
    \2008\ See id.
    \2009\ See id. However, this commenter also disagreed with the
Commission that SCI entities may be reluctant to admit publicly to
their glitches. See id. at 14. According to this commenter, market
participants interact repeatedly with each other on a real-time
basis and are acutely aware of glitches when they occur. See id.
---------------------------------------------------------------------------

    As discussed above, while some entities currently provide their
members or participants and, in some cases, market participants or the
public more generally, with notices of certain systems issues (e.g.,
system outages), Rule 1002(c) imposes new requirements that are not
currently part of the ARP Inspection Program. As such, the requirements
of Rule 1002(c) will impose costs--which are attributed to paperwork
burdens--on SCI entities with respect to preparing, drafting,
reviewing, and making the information available to members or
participants. These costs are discussed in more detail in Section
V.D.2.b.\2010\
---------------------------------------------------------------------------

    \2010\ When monetized, the paperwork burden would result in
approximately $26 million, in addition to approximately $1.6 million
in outsourcing cost, annually for all SCI entities in the aggregate.
---------------------------------------------------------------------------

    In the SCI Proposal, the Commission recognized that SCI entities
incur costs to determine whether an event needs to be disseminated.
While the SCI events subject to the adopted information dissemination
requirements are different from those that would have been subject to
the proposed requirements, the Commission continues to recognize that
the determination imposes costs. Specifically, identifying major SCI
events may impose one-time implementation costs on SCI entities
associated with developing a process for ensuring that they are able to
quickly and correctly make such determinations, as well as periodic
costs in reviewing the adopted process. These costs are discussed in
more detail in Section V.D.3.b.\2011\
---------------------------------------------------------------------------

    \2011\ See also supra note 2001.
---------------------------------------------------------------------------

    One commenter expressed concern that SCI entities may over-report
issues out of an abundance of caution if SCI entities are not given
clear guidelines as to what and to whom they are required to provide
information.\2012\ This commenter believed that a flood of
notifications, taken out of context, may create investor impression
based on the quantity, not the quality, of the notifications
disseminated, that certain counterparties pose serious risks to the
market, when that is not the case.\2013\ For the reasons discussed in
Section IV.B.3.d, the Commission believes that information about SCI
events (other than major SCI events and de minimis SCI events) should
be disseminated to affected members or participants, and information
about major SCI events (other than those that qualify as de minimis SCI
events) should be disseminated to all members or participants of an SCI
entity. At the same time, as compared to proposed Rule 1000(b)(5), the
Commission is limiting the requirement for information dissemination to
all members or participants of an SCI entity to major SCI events;
limiting other information dissemination to members or participants
affected by the SCI event; and excluding de minimis SCI events and SCI
events related to market regulation or market surveillance systems from
the information dissemination requirement. These changes would limit
the compliance cost for Rule 1002(c), and are responsive to the
commenter's concern that SCI entities may over-disclose systems issues.
---------------------------------------------------------------------------

    \2012\ See Fidelity Letter at 5.
    \2013\ See id.
---------------------------------------------------------------------------

    As an alternative to the adopted rule, one commenter suggested
broadening the proposed rule to require an SCI entity to disseminate
information on SCI events to the public, and not just to its

members or participants.\2014\ This commenter believed that public
dissemination of the facts of an SCI event would help enhance investor
confidence by preventing speculation and misinformation, and would
provide important learning opportunities for the industry and other SCI
entities.\2015\ The Commission acknowledges that there can be
additional benefits from disseminating major SCI events to the public
as noted by the commenter. Under the adopted rule, an SCI entity is
required to disseminate information on major SCI events (other than
those that qualify as de minimis SCI events) to all of its members and
participants. The Commission believes that these market participants
are the most likely to act on this information and, thus, induce
additional competitive incentives for SCI entities to avoid systems
issues. As such, the Commission believes that it can achieve the
purposes of the rule without requiring public dissemination, and also
believes any additional gain in benefits from public dissemination
would be minimal.
---------------------------------------------------------------------------

    \2014\ See MFA Letter at 7.
    \2015\ See id.
---------------------------------------------------------------------------

v. Material Systems Changes--Rule 1003(a)
    Rule 1003(a)(1) requires an SCI entity to provide quarterly reports
to the Commission, describing completed, ongoing, and planned material
systems changes to its SCI systems and the security of indirect SCI
systems, during the prior, current, and subsequent calendar quarters.
Rule 1003(a)(1) also requires an SCI entity to establish reasonable
written criteria for identifying a change to its SCI systems and the
security of its indirect SCI systems as material. Rule 1003(a)(2)
requires an SCI entity to promptly submit a supplemental report to
notify the Commission of a material error in or material omission from
a previously submitted report.
    Entities that participate in the ARP Inspection Program currently
provide some material systems change notifications to the Commission
and the Commission believes that all SCI entities have some internal
processes for documenting systems changes as a matter of prudent
business practice. For example, consistent with the ARP Policy
Statements, certain entities provide annual reports on significant
systems changes and notify the Commission on an as-needed basis
regarding certain significant systems changes. In addition, ATSs are
required notify the Commission of certain systems changes pursuant to
Rule 301(b)(2)(ii) and Rule 301(b)(6)(ii)(G) of Regulation ATS, as
applicable. Rule 1003(a) changes some of the current practices and sets
forth more detailed requirements for these notifications. For example,
Rule 1003(a) covers material changes on a broader set of systems than
the ARP Inspection Program or Regulation ATS. Rule 1003(a) also
requires an SCI entity to submit quarterly reports on Form SCI
regarding material systems changes, but does not require separate
notification for each material systems change. Further, Rule 1003(a)
requires an SCI entity to promptly notify the Commission (by submitting
Form SCI) of a material error in or material omission from a previously
submitted report. To the extent that Rule 1003(a) requires SCI entities
to notify the Commission of material systems changes for more types of
systems and to the extent that it requires notification at a higher
frequency than current practice (quarterly reports vs. annual reports),
the Commission believes that Rule 1003(a) should enhance the
Commission's oversight of the operation of SCI entities.
    The compliance costs of Rule 1003(a) primarily entail costs
associated with preparing and submitting Form SCI in accordance with
the instructions thereto. The initial and ongoing cost estimates
associated with preparing and submitting Form SCI with regard to
material systems changes under Rules 1003(a)(1) and (2) are discussed
in detail in Section V.D.2.c.\2016\ The Commission does not expect Rule
1003(a) will impose significant costs on SCI entities other than those
discussed in Section V.D.2.c.
---------------------------------------------------------------------------

    \2016\ When monetized, the paperwork burden would result in
approximately $6.8 million annually for all SCI entities in the
aggregate.
---------------------------------------------------------------------------

    According to one commenter, ``[t]he larger market participants
[that will be subject to Regulation SCI] are generally experienced and
circumspect with regards to significant infrastructure changes, such as
data center migrations and major platform upgrades.'' \2017\ This
commenter expected that, for these larger entities, integrating
Regulation SCI compliance into their existing programs can occur
without crippling disruption or exorbitant cost, and expected that
insight from the implementation of Regulation SCI would contribute to
overall stability and resiliency of the markets over time.\2018\
However, this commenter expressed concern that compliance with the
Commission notification requirement will result in incremental costs
that may in some cases delay or discourage innovation.\2019\ Another
commenter similarly expressed concern about the compliance burden and
the resulting impact on competition and innovation associated with the
30-day advance Commission notification requirement for material systems
changes.\2020\ In addition, one commenter noted that the Commission
underestimated the cost of lost business opportunities and the
inability to swiftly deploy corrective solutions that would result from
the 30-day advance systems change notification requirements.\2021\ This
commenter noted that most ATS operators with advanced systems
purposefully implement frequent agile modifications instead of major
episodic changes in order to continuously improve their systems and
minimize the impact of the changes.\2022\ This commenter expressed
concern that a built-in 30-day delay in implementing changes would
encourage the deployment of larger, riskier changes more infrequently,
thereby creating longer periods of time during which a systems issue
and/or erroneous configuration would continue without correction.\2023\
This commenter also stated that the 30-day advance notification process
has the potential to delay the deployment of corrective solutions that
are necessary to ensure the provision of uninterrupted and efficient
order matching services at the best available prices.\2024\
---------------------------------------------------------------------------

    \2017\ See SunGard Letter at 3.
    \2018\ See id.
    \2019\ See id..
    \2020\ See BATS Letter at 15. See also, e.g., supra notes 999-
1000 (discussing the views of commenters that the proposed 30-day
advance notification requirement would stifle innovation and
interfere with an SCI entity's natural planning and development
process).
    \2021\ See ITG Letter at 8.
    \2022\ See id.
    \2023\ See id.
    \2024\ See id.
---------------------------------------------------------------------------

    As noted above, as adopted, Regulation SCI does not include the
proposed 30-day advance Commission notification requirement for
material systems changes. Rather, Rule 1003(a)(1) requires quarterly
reports of material systems changes. Elimination of the proposed 30-day
advance Commission notification requirement addresses the concern of
some commenters that the rule would impede agile development
methodology and favor the waterfall development methodology, or delay
the implementation of systems changes or innovations, particularly for
smaller SCI entities. The quarterly reports will also provide the
Commission and its staff with a more efficient framework to review
material systems changes,

because including all relevant material systems changes in a single
report will allow the Commission to more easily and clearly understand
an SCI entity's framework for systems changes, including how certain
material systems changes are related.\2025\
---------------------------------------------------------------------------

    \2025\ As discussed above, Commission staff will not use
material systems change reports to require any approval of planned
systems changes in advance of their implementation pursuant to any
provision of Regulation SCI, or to delay implementation of material
systems changes pursuant to any provision of Regulation SCI. See
supra Section IV.B.4.b.
---------------------------------------------------------------------------

vi. SCI Review--Rule 1003(b)
    Rule 1003(b) requires an SCI entity to conduct an SCI review of its
compliance with Regulation SCI not less than once each year,\2026\ and
submit a report of the SCI review to senior management of the SCI
entity for review no more than 30 calendar days after completion of
such SCI review. Rule 1003(b) also requires an SCI entity to submit a
report of the SCI review to the Commission and to the board of
directors of the SCI entity or the equivalent of such board, together
with any response by senior management, within 60 calendar days after
its submission to senior management of the SCI entity.
---------------------------------------------------------------------------

    \2026\ However, penetration test reviews of the network,
firewalls, and production systems are required to be conducted not
less than once every three years. See Rule 1003(b)(i). Assessments
of SCI systems directly supporting market regulation or market
surveillance are required to be conducted at a frequency based upon
the risk assessment conducted as part of the SCI review, but also
not less than once every three years. See Rule 1003(b)(1)(ii).
---------------------------------------------------------------------------

    Systems reviews have been part of the ARP Inspection Program, and
through this program, the Commission understands that many SCI entities
currently undertake annual systems reviews and that senior management
and/or the board of directors or a committee thereof reviews reports of
such reviews. However, the Commission believes that the scope of the
systems reviews, and the level of senior management and/or board
involvement in such reviews, varies among ARP entities. The Commission
expects that the SCI review requirement would produce greater
consistency in the approach that SCI entities take in systems reviews,
which would help improve the efficiency of the Commission's oversight
(e.g., inspection) of SCI entities' systems. In addition, the
Commission believes that the SCI review requirement would result in SCI
entities having an improved awareness of the relative strengths and
weaknesses of their systems independent of the assessment of Commission
staff, which should, in turn, improve systems and reduce the number of
SCI events. As discussed in Section VI.C.1, the reduction in occurrence
of SCI events could reduce interruptions in the price discovery process
and liquidity flows.
    The initial and ongoing paperwork burden associated with conducting
an SCI review, submitting a report of the SCI review to senior
management of the SCI entity for review, and submitting a report of the
SCI review and any response by senior management to the Commission and
to the board of directors of the SCI entity or the equivalent of such
board is discussed in Section V.D.2.d.\2027\ SCI entities will also
incur costs in addition to the paperwork burden to comply with the SCI
review requirement. Although the Commission understands that most SCI
entities currently undertake annual systems reviews, Rule 1003(b) sets
forth specific requirements related to the SCI review. In particular,
an SCI review is required to include a risk assessment with respect to
SCI systems and indirect SCI systems of an SCI entity, an assessment of
internal control design and effectiveness of SCI systems and indirect
SCI systems, and penetration testing reviews. Moreover, Rule 1003(b)
specifies that the SCI review is to determine the SCI entity's
compliance with Regulation SCI. Rule 1003(b) also requires a report of
the SCI review and any senior management response to be submitted to
the board of directors of the SCI entity or the equivalent of such
board and thus SCI entities may incur an additional cost as a result of
additional time the board allocates to evaluate the review. The
Commission cannot estimate costs other than paperwork burdens because
the Commission does not have the information necessary to provide a
reasonable estimate. In particular, the Commission lacks information on
how SCI entities will structure their reviews.
---------------------------------------------------------------------------

    \2027\ When monetized, the paperwork burden would result in
approximately $9.7 million, in addition to approximately $2.2
million in outsourcing cost, annually for all SCI entities in the
aggregate.
---------------------------------------------------------------------------

    As discussed above in Section IV.B.5, the Commission is not
adopting a requirement that SCI reviews be conducted by an independent
third party because the Commission believes that the goals of
Regulation SCI can be achieved through reviews by either internal
objective personnel or external objective personnel. The Commission
acknowledges that, in some cases, there could be potential benefits
from requiring third party reviews. However, as noted in Section
IV.B.5, third parties can also have conflicts of interest that prevent
a particular entity or personnel from meeting the objectivity standard
required for an SCI review. In addition, during the Technology
Roundtable in which participants discussed third party review, some
panelists suggested that the use of an external third party is
unnecessary because, for example, the training for a third party as
well as the costs involved with third party evaluations would be large
with little additional benefit.\2028\ The Commission agrees that SCI
entities would likely need to provide significant guidance to third-
party reviewers on the specific features of the entity's systems. The
Commission recognizes that a third-party review requirement could
impose additional costs on SCI entities, and believes that it is
appropriate at this time to allow SCI entities to decide whether to
incur such costs instead of mandating third-party review.
---------------------------------------------------------------------------

    \2028\ See Transcript of the Technology Roundtable, at 86-91.
---------------------------------------------------------------------------

vii. Business Continuity and Disaster Recovery Plan Testing--Rule 1004
    Rule 1004(b) requires the testing of an SCI entity's business
continuity and disaster recovery plans at least once every 12 months.
Rules 1004(a) and (b) require participation in such testing by those
members or participants that an SCI entity reasonably determines are,
taken as a whole, the minimum number necessary for the maintenance of
fair and orderly markets in the event of the activation of its business
continuity and disaster recovery plans. Rule 1004(c) requires an SCI
entity to coordinate such testing on an industry- or sector-wide basis
with other SCI entities.
    The requirements under Rule 1004 are not a part of the ARP
Inspection Program. As discussed above in Section VI.B.2, the
securities industry generally has a voluntary system for testing
business continuity and disaster recovery plans and market
participants, including exchanges, members of exchanges, clearing
agencies, clearing members, and ATSs, already coordinate certain
business continuity and disaster recovery plan testing to some extent.
For example, some SCI entities already require some of their members or
participants to connect to their backup systems. Further, although
participation is not always mandatory, some SCI entities already
provide their members or participants with the opportunity to test the
SCI entity's business continuity and disaster recovery plans. However,
because not all SCI entities require member or participant
participation in business continuity and disaster recovery plans
testing, the Commission

understands that not all market participants participate in such
testing. Moreover, the Commission understands that, to the extent such
participation occurs, it may in many cases be limited in nature (e.g.,
testing for connectivity to backup systems).\2029\
---------------------------------------------------------------------------

    \2029\ See Proposing Release, supra note 13, at 18164.
---------------------------------------------------------------------------

    The Commission believes that, for SCI entities, voluntary testing
is insufficient, and that business continuity and disaster recovery
planning for market centers and certain members or participants must be
an integral component of business continuity and disaster recovery
preparedness. The Commission further believes that the requirements
under Rule 1004 should help ensure that the securities markets will
have improved backup infrastructure and fewer market-wide shutdowns. As
discussed in detail in Section VI.C.1, fewer market-wide shutdowns
should help facilitate continuous liquidity flows in markets, reduce
pricing errors, and thus improve the quality of the price discovery
process.
    With respect to these benefits, one commenter suggested measuring
benefits of reducing outages and technical issues by looking at, for
example, loss of trading commissions due to outages.\2030\ This
commenter estimated that the potential loss of equity commissions by
broker-dealers over the two-day market closure from Superstorm Sandy
may have been approximately $374 million.\2031\ The Commission believes
that measuring potential benefits in terms of transaction costs
(commission revenue) does not fully account for other benefits, such as
uninterrupted liquidity flows and price discovery.\2032\ Furthermore,
the Commission believes that the estimated commission loss noted by the
commenter likely overstates the actual losses in commissions because
some of the ``lost'' trading may have only been delayed until the
markets re-opened after Superstorm Sandy. Accordingly, the Commission
is not persuaded that the estimate provided by the commenter represents
the quantified benefit associated with this component of Regulation
SCI. The Commission is unable to estimate the benefit of this component
of Regulation SCI because the Commission does not have quantified
information on the extent that a reduction in SCI events will help
facilitate liquidity flows in markets, reduce pricing errors, and thus
improve the quality of the price discovery process. Furthermore, the
Commission is unable to quantify the impact of ``delayed'' trading
because it lacks the information necessary to provide a reasonable
estimate. In particular, data on the trading activity lost as opposed
to ``delayed'' due to the two-day market closure would be extremely
difficult to piece together in a meaningful way.
---------------------------------------------------------------------------

    \2030\ See Angel Letter at 15-16. The Commission also notes that
this commenter and others expressed the view that enhanced BC/DR
testing would have substantial benefits. See, e.g., id. at 9-10
(stating that the ``ability of SROs to require their members to
participate in testing is an important step forward in making sure
that testing is as realistic as possible . . . [and] is one of the
most valuable parts of Regulation SCI and will do the most to ensure
improved market network reliability''); and UBS Letter at 5 (stating
that the ``critical task of BCP testing should not be undertaken in
isolated silos by individual firms. Individual BCP testing that does
not involve realistic scenarios with connected participants may mask
gaps and/or be insufficient from a systems integrity standpoint''
and that the benefits of a ``new and more comprehensive BCP testing
paradigm'' would be ``broad and considerable'').
    \2031\ This commenter based this estimate on FINRA member equity
commissions in 2010 obtained from SIFMA. See Angel Letter at 16. In
addition, this commenter referred to the losses and legal and
administrative costs associated with the Facebook IPO, as well as
the losses associated with the May 6, 2010 incident. See id. at 15-
16. This commenter also more generally stated that the benefits of
reducing outages and major technical issues are pretty
straightforward--catastrophic failures in exchange systems are
extremely costly, both in terms of direct losses to participants and
in reduced investor confidence in the markets. See id. at 15.
According to this commenter, even a modest reduction in the overall
risk of a meltdown is quite cost effective to the economy as a
whole. See id.
    \2032\ As noted by this commenter, the $374 million loss does
not include lost trading profits to investors, or loss of utility
from being able to hedge risk, monetize holdings, or otherwise
trade. See id. at 16.
---------------------------------------------------------------------------

Costs to SCI Entities
    The mandatory testing of SCI entity business continuity and
disaster recovery plans, including backup systems, as required under
Rule 1004, will result in additional costs to SCI entities. The
Commission notes that some SCI entities already offer availability for
their members or participants to test business continuity and disaster
recovery plans. Furthermore, as mentioned above, market participants,
including SCI entities, already coordinate certain business continuity
plan testing to an extent. However, Rule 1004 mandates participation in
testing for some entities that do not currently participate, requires
more rigorous testing than currently required, and requires greater
coordination than SCI entities and market participants currently engage
in. In particular, Rule 1004 requires SCI entities to designate their
members or participants to participate in business continuity and
disaster recovery plan testing and to coordinate such testing with
other SCI entities on an industry- or sector-wide basis. The
requirement of member or participant designation in business continuity
and disaster recovery plan testing under Rule 1004 imposes additional
costs as an SCI would have to allocate resources towards initially
establishing and later updating standards for the designation of its
members and participants for testing. Furthermore, the requirement to
coordinate industry- or sector-wide testing will impose additional
administrative costs because an SCI entity would be required to notify
its members or participants and also organize, schedule, and manage the
coordinated testing.\2033\
---------------------------------------------------------------------------

    \2033\ Administrative costs associated with coordinating testing
are included as part of the PRA burden of Rule 1004. See supra
Section V.D.1.b. As discussed in Section V.D.1.b, the Commission
continues to believe that plan processors will outsource the work
related to compliance with Rule 1004.
---------------------------------------------------------------------------

    Some commenters stated that the scope of the proposed testing
requirement would impose costs on SCI entities that the Commission did
not account for, including the cost to reconfigure their systems to
engage in functional and performance testing, the cost of establishing
effective coordinated test scripts for the testing, and time necessary
to conduct the required testing.\2034\ Another commenter stated that
testing will be costly to ATSs and their subscribers, and that the
aggregate cost for all would be higher than the $66 million estimated
in the SCI Proposal.\2035\ This commenter noted that the cost includes
the time, resources, and professional staff that would be devoted to
the testing process, and the resulting lost business opportunities
associated with the ability to focus on revenue generating
projects.\2036\ In addition, this commenter stated that, while
connectivity between an ATS and its subscribers may already be
established, additional configurations and build out of systems may be
required to create a testing environment that simulates live market
conditions.\2037\
---------------------------------------------------------------------------

    \2034\ See supra Section IV.B.6.b (discussing comments on
proposed Rule 1000(b)(9)).
    \2035\ See ITG Letter at 15-16.
    \2036\ See id.
    \2037\ See id.
---------------------------------------------------------------------------

    Another commenter stated that there are dozens of man-days of pre-
test planning, preparation, pre-testing testing, testing, and post-
mortem reviews for SCI entities associated with the industry test
initiatives.\2038\ According to this commenter, there are anywhere from
tens to hundreds of business and technology staff engaged

in this initiative.\2039\ This commenter estimated the following staff
levels required to support testing: Exchanges--175-200+ man-days;
member firms--80-85 man-days; and ATSs--12-25 man-days.\2040\ Based on
the commenter's upper estimates measured in man-days, the Commission
estimated monetary values by allocating hours among the traders,
technologists, programmers/system administrators, exchange personnel,
and analysts necessary for implementation of disaster recovery testing.
This estimation yields implied annual average total cost estimates of
$500,000 and $60,000 for exchanges and ATSs, respectively.\2041\ For
the reasons discussed below, the Commission believes that this
commenter's cost estimate does not accurately reflect the costs to SCI
entities.
---------------------------------------------------------------------------

    \2038\ See Tellefsen Letter at 11.
    \2039\ See id.
    \2040\ See id.
    \2041\ The allocations are based on Commission staff experience
that exchanges would divide their personnel as 85% technologists, 5%
exchange rule enforcement personnel, and 10% business analysts, and
ATSs are assumed to divide their personnel as 90% technologists and
10% business analysts based on staff experience. The hourly rates
are from SIFMA's Management & Professional Earnings in the
Securities Industry 2012, modified by Commission staff to account
for an 1800-hour work-year and multiplied by 5.35 to account for
bonuses, firm size, employee benefits and overhead. The calculation
for ATSs was as follows: 25 days x (10% time required by analysts x
$245/hour + 90% time required by technologists x $282/hour) =
$55,660 per ATS. For each exchange: 200 days x (85% time required by
technologists x $282/hour + 10% time required by analysts x $245/
hour + 5% time required by supervisors x $446/hour) = $458,400 per
exchange. The Commission has rounded up because the breakdown
between analysts, supervisors, and technologists may vary between
ATSs and Exchanges.
    In the absence of a specific estimate provided by the commenter
for plan processors or clearing agencies, the estimate for exchanges
is assumed to apply to these types of SCI entities. Estimates for
members and participants are discussed separately below.
---------------------------------------------------------------------------

    The Commission recognizes that the factors described by commenters
will contribute to costs for SCI entities associated with business
continuity and disaster recovery plans testing. For example, as
discussed in Section IV.B.6.b, the Commission acknowledges that systems
reconfiguration for functional and performance testing and establishing
an effective coordinated test script could be a complex process and
result in costs. At the same time, the Commission believes that systems
reconfiguration and the establishment of an effective coordinated test
script is an important first step in establishing robust and effective
business continuity and disaster continuity plans testing. The
Commission also notes that costs of Rule 1004 are likely to be lower
than those estimated by commenters because of changes made to the
proposed rule. For example, although Rule 1004 would require testing of
BC/DR plans that is more rigorous than some types of testing urged by
some commenters, the adopted rule includes a more targeted member and
participant designation provision than the proposed rule. As discussed
above in Section IV.B.6.b, compared to proposed Rule 1000(b)(9), the
Commission believes that the adoption of a more targeted designation
requirement is likely to result in a smaller number of SCI entity
members or participants being designated to participate in business
continuity and disaster recovery plans testing and thus should result
in lower costs for SCI entities to coordinate testing.\2042\
---------------------------------------------------------------------------

    \2042\ See supra Section IV.B.6.b (discussing the designation
requirement in adopted Rule 1004).
---------------------------------------------------------------------------

    The Commission is unable to provide a quantified estimate of the
specific costs for SCI entities associated with the mandatory testing
of SCI entity business continuity and disaster recovery plans,
including backup systems. Although several commenters provided general
estimates as to the costs of compliance with Rule 1004, these
commenters did not provide their assumptions or a description of the
quantified costs associated with each potential source of costs. Given
the lack of information provided by commenters and that these costs
could vary significantly based on the specific systems of each SCI
entity, the Commission is unable to determine whether the costs
provided by commenters are representative. Additionally, the Commission
notes that commenters appeared to focus on costs as if assuming there
is no testing today. Because SCI entities currently engage in some
coordinated BC/DR testing, the Commission believes that the average
incremental cost to SCI entities, in addition to the burden estimated
in the PRA, would be lower than these commenters' cost estimates. The
Commission also believes that costs would be significantly lower in the
year following the initial year of testing. Because the Commission does
not have detailed information regarding the current level of BC/DR
testing and coordination of such testing by each SCI entity, and the
cost associated with such testing and coordination, however, the
Commission cannot at this time provide a quantified estimate of the
cost for SCI entities to comply with Rule 1004.
Costs to SCI Entity Members and Participants
    The Commission believes that Rule 1004 will also impose costs on
SCI entity designated members and participants. In the SCI Proposal,
based on discussions with market participants, the Commission estimated
that the cost of business continuity and disaster recovery plan testing
would range from immaterial administrative costs (for SCI entity
members and participants that currently maintain connections to SCI
entity backup systems) to a range of $24,000 to $60,000 per year per
member or participant in connection with each SCI entity.\2043\ As
noted in the SCI Proposal and also above, the Commission understood
that most of the larger members or participants of SCI entities already
maintain connectivity with the backup systems of SCI entities and,
thus, the additional connectivity costs imposed by proposed Rule
1000(b)(9) to these larger members or participants may be
minimal.\2044\ However, among smaller members or participants of SCI
entities, the number of members or participants who maintain such
connectivity is lower.\2045\ Therefore, costs at the higher end of the
estimated range would accrue for members or participants who would need
to invest in additional infrastructure and to maintain connectivity
with an SCI entity's backup systems in order to participate in testing.
---------------------------------------------------------------------------

    \2043\ See Proposing Release, supra note 13, at 18172.
    \2044\ See id. at 18172 and n. 642.
    \2045\ See id. at 18172.
---------------------------------------------------------------------------

    Furthermore, in the SCI Proposal, the Commission acknowledged that
it is difficult to provide an estimate for the total aggregate cost to
SCI entity members or participants under proposed Rule
1000(b)(9).\2046\ Because each SCI entity had discretion in determining
its standards for designating members or participants for the testing
required by proposed Rule 1000(b)(9)(i), the Commission did not have
enough information to estimate the number of members or participants at
each SCI entity that would be designated as required to participate in
testing and to determine whether such designated members or
participants are those that already maintain connections to SCI entity
backup systems. With limited information, the Commission provided a
total aggregate annual cost estimate in the SCI Proposal of
approximately $66 million for designated members and participants to
participate in business continuity and disaster recovery plans
testing.\2047\
---------------------------------------------------------------------------

    \2046\ See id.
    \2047\ See id. at 18172 and n.643.
---------------------------------------------------------------------------

    Several commenters stated that the Commission underestimated the
cost of

business continuity and disaster recovery plan testing under proposed
Rule 1000(b)(9). One commenter noted that the Commission failed to take
into account those SCI entities that engage in systems-specific testing
upon implementation or initial connection by a market participant, but
do not engage in business continuity and disaster recovery testing with
the participation of market participants.\2048\ One commenter noted
that the average cost for a broker-dealer to maintain fully redundant
systems at all relevant exchange backup facilities would be
approximately $3 million annually, according to one of its informal
surveys.\2049\ Further, this cost would not include the initial capital
costs related to the infrastructure or the labor/employment necessary
for the maintenance and monitoring of backup connection and
facilities.\2050\
---------------------------------------------------------------------------

    \2048\ See MSRB Letter at 38.
    \2049\ See FIA PTG Letter at 3. See also BIDS Letter at 8
(commenting that testing and backup connections are expensive, and
the expense of the connections could outweigh the value or the
utilization of the value that certain venues provide).
    \2050\ See FIA PTG Letter at 3. This commenter noted that the
costs vary widely among members and exchanges but are not
insubstantial. See id.
---------------------------------------------------------------------------

    Other commenters stated that the Commission underestimated other
aspects of the cost of business continuity and disaster recovery plan
testing under proposed Rule 1000(b)(9). One commenter believed that the
requirement for members to connect to an SCI entity's backup site could
pose significant economic burden and provide little benefit to the
market.\2051\ This commenter believed that the cost of such connections
would be well over the $10,000 per connection that the Commission
estimated.\2052\ According to this commenter, establishing and
maintaining a connection with comparable trading capability and latency
could cost a broker-dealer that co-locates at an SCI entity's data
center between $15,000 and $20,000 monthly simply for the necessary
communication lines.\2053\ In addition, this commenter noted that such
members would need additional hardware (estimated to be up to $500,000)
to establish an appropriate presence at the backup site to ensure that
they could trade in an efficient manner with low latency.\2054\ This
commenter believed that compliance with the Rule 1000(b)(9)
requirements could cause broker-dealers to reduce the number of SCI
entities through which they trade.\2055\ This commenter suggested that
the standard for designating members should be those members ``critical
to the operation of the SCI entity.'' \2056\
---------------------------------------------------------------------------

    \2051\ See ISE Letter at 9.
    \2052\ See id.
    \2053\ See id.
    \2054\ See id.
    \2055\ See id.
    \2056\ See id. According to this commenter, under the suggested
standard, its focus would be on its seven Primary Market Makers who
provide continuous liquidity, and these members would provide a
baseline of liquidity for trading. See id. However, this commenter
believed that, in order to satisfy the standard to provide ``fair
and orderly trading,'' it may need to require some or all of its 145
Electronic Access Members who access liquidity. See id.
---------------------------------------------------------------------------

    Another commenter estimated that the costs to a market making firm
to support fully redundant exchange and ATS backup facilities would be
approximately $7 million to $10 million in initial capital, with annual
costs of between $5 million and $9 million.\2057\ According to this
commenter, this cost is not justified by the benefits because backup
facilities would not be used in the event of an outage at the primary
site,\2058\ and would lead firms to reconsider their ability to make
markets on as many trading platforms and potentially reduce price
competition.\2059\
---------------------------------------------------------------------------

    \2057\ See KCG Letter at 4, 12. This commenter stated that the
cost of supporting a backup facility of an SCI entity would be
reduced, if the backup facility of an SCI entity were at the primary
site of another SCI entity where the market maker traded. See id. at
12.
    \2058\ See id. at 4.
    \2059\ See id. at 12.
---------------------------------------------------------------------------

    The same commenter who provided an estimate of burdens for SCI
entities expressed the view that there are also dozens of man-days of
pre-test planning, preparation, pre-testing testing, testing, and post-
mortem reviews for members and participants that would be associated
with industry test initiatives.\2060\ Based on the commenter's upper
estimates for member firms, measured in man-days, the Commission
assigned monetary values using appropriate hours allocation among the
traders, technologists, programmers/system administrators, exchange
personnel, and analysts necessary for implementation of disaster
recovery testing. This procedure yields an annual average total cost
estimate of about $200,000 for each member firm.\2061\ For the reasons
discussed below, the Commission believes that this commenter's cost
estimate does not accurately reflect the costs to members or
participants.
---------------------------------------------------------------------------

    \2060\ See also supra note 2038 and accompanying text
(discussing this commenter's cost estimate for SCI entities).
    \2061\ The allocations are based on the staff experience that
member firms divide their personnel as 45% traders, 45%
technologists, and 10% business analysts. The hourly rates are from
SIFMA's Management & Professional Earnings in the Securities
Industry 2012, modified by Commission staff to account for an 1800-
hour work-year and multiplied by 5.35 to account for bonuses, firm
size, employee benefits and overhead. The calculation for member
firms was as follows: 85 days x (10% time required by analysts x
$245/hour + 45% time required by technologists x $282/hour + 45%
time required by traders x $312/hour) = $198,424 per member firm.
---------------------------------------------------------------------------

    The Commission acknowledges that members or participants will incur
costs as a result of Rule 1004. However, the Commission believes that
the members or participants likely to be designated to participate in
such testing are those that conduct a high level of activity with the
SCI entity, or that play an important role for the SCI entity (such as
market makers), and who are more likely to have already established
connections to the SCI entity's backup site. The Commission believes
that many of these members or participants already have established
connectivity with the SCI entity's backup site and already monitor and
maintain such connectivity, and thus the additional connectivity costs
imposed by Rule 1004 would be modest to these members or participants.
    For members or participants that currently do not have
connectivity, the Commission recognizes the requirements of Rule 1004
will impose costs on members or participants in establishing,
maintaining, and monitoring backup connection and facilities. The
Commission believes that a few commenters who stated that the
Commission underestimated these costs may have based their cost
estimates for proposed Rule 1000(b)(9) on the assumption that member
connections to SCI entities' backup systems need to be the same as
those at the primary site.\2062\ However, as discussed above in Section
IV.B.6, Rule 1004 does not require SCI entity members or participants
to maintain the same level of connectivity with the backup sites of an
SCI entity as they do with the primary sites. In the event of a wide-
scale disruption in the securities markets, the Commission acknowledges
that an SCI entity and its members or participants may not be able to
provide the same level of liquidity as on a normal trading day. In
addition, the Commission recognizes that the concept of ``fair and
orderly markets'' does not require that trading on a day when business
continuity and disaster recovery plans are in effect reflect the same
level of liquidity, depth, volatility, and other characteristics of
trading on a normal trading day.
---------------------------------------------------------------------------

    \2062\ See supra notes 2049, 2050, 2052-2054, and 2057 and
accompanying text (discussing commenters' estimates of the cost to
maintain fully redundant systems at relevant SCI entity backup
facilities).
---------------------------------------------------------------------------

    The Commission, however, is unable to provide a quantified estimate
of the

specific costs for SCI entity members or participants associated with
the mandatory testing required by Rule 1004. Although several
commenters provided general estimates as to the costs of compliance
with Rule 1004, these commenters did not provide their assumptions or a
description of the quantified costs associated with each potential
source of costs. Given the lack of information provided by commenters
and that these costs could vary significantly based on the specific
systems of each SCI entity and member or participant, the Commission is
unable to determine whether the costs provided by commenters are
representative. Additionally, the Commission notes that some commenters
appeared to focus on costs as if assuming there is no testing today.
Because some members and participants of SCI entities currently
participate in SCI entities' BC/DR testing, these members and
participants would not incur the full costs estimated by the
commenters. Thus the Commission believes that the average incremental
cost to members or participants would be lower than these commenter's
estimates because the estimates do not account for current practices.
The Commission also believes that costs will be highly variable among
member firms, and will be significantly lower in the year following the
initial year of testing. Because the Commission does not have detailed
information regarding the current level of engagement by members or
participants in BC/DR testing and the associated costs, or the details
of the BC/DR testing that SCI entities will implement pursuant to Rule
1004, the Commission cannot at this time provide a precise quantified
estimate of the cost for SCI entities' designated members or
participants to comply with Rule 1004.\2063\ The Commission also notes
that it is critical that SCI entities and their designated members or
participants be able to operate with the SCI entities' backup systems
in the event of a wide-scale disruption, and believes that the costs
that would be incurred by essential market participants are appropriate
in light of the benefits discussed above.\2064\
---------------------------------------------------------------------------

    \2063\ Although the Commission cannot at this time precisely
estimate the total cost of compliance with Rule 1004, the Commission
believes that $10,000 on average per SCI entity is a reasonable
estimate solely for the incremental cost of connectivity associated
with the requirements of Rule 1004. As noted above, the Commission
continues to believe that it is reasonable to estimate that the
members or participants of SCI entities that are most likely to be
designated as required to participate in testing are those that
conduct a high level of activity with the SCI entity, or that play
an important role for the SCI entity (such as market makers), and
that such members or participants are likely to already maintain
connectivity with an SCI entity's backup systems. Therefore, the
Commission is not persuaded that its estimate of the average
connectivity cost for each member or participant of an SCI entity
should be modified from $10,000.
    \2064\ Further, in response to comment that the added benefit of
requiring fully redundant backup systems is almost impossible to
measure while the cost of implementation is significant, the
Commission acknowledges that testing of a BC/DR plan does not
guarantee flawless execution of that plan, but still believes
testing is warranted because a tested plan is likely to be more
reliable and effective than an inadequately tested plan.
---------------------------------------------------------------------------

    Although the Commission generally believes that the aggregate cost
to SCI entity members or participants under Rule 1004 will be lower
than the cost estimated for proposed Rule 1000(b)(9), the Commission
continues to believe it is difficult to provide an estimate for the
aggregate cost to SCI entity members or participants because under Rule
1004, each SCI entity has reasonable discretion in designating its
members or participants for the required testing, and, as noted above,
the Commission does not possess necessary information to estimate the
number of designated members or participants and to determine whether
such designated members or participants are those that already have
established and maintained connectivity to the SCI entity's backup
systems. Accordingly, the Commission cannot at this time provide a
quantified estimate of the total aggregate cost to SCI entity members
or participants under Rule 1004.\2065\
---------------------------------------------------------------------------

    \2065\ The Commission believes that it can reasonably estimate
connectivity costs but not all costs associated with BC/DR testing.
With respect to connectivity, the Commission now estimates that Rule
1004 will impose a total aggregate annual cost of approximately $18
million for designated members and participants. This estimate
assumes that each of the 44 SCI entities will designate between 10
and 20 percent of its members or participants to participate in the
necessary testing. This 10-20 percent estimate is based on staff
experience and takes into consideration comment that typically 20
percent of an SCI entity's members might provide 80 percent of the
order flow or liquidity (see Tellefsen Letter at 9), and balances it
against another commenter's view that if the standard for
designation was to identify those firms ``critical to the operation
of the SCI entity'' (which is more targeted than the adopted
standard), this commenter would designate approximately five percent
of its members to participate in testing (see ISE Letter at 9). The
Commission understands that many SCI entities have between 200 and
400 members or participants, although some have more and some have
fewer. Therefore, the Commission estimates that on average, each SCI
entity will designate approximately 40 members or participants in
such testing. Based on these assumptions, the Commission estimates
the total aggregate cost for connectivity to all designated members
or participants of all SCI entities to be approximately $17.6
million (44 SCI entities x 40 members or participants x $10,000 =
$17.6 million).
---------------------------------------------------------------------------

    Moreover, as noted above in Section IV.B.6.b, the Commission
believes that adoption of a designation requirement that requires SCI
entities to exercise reasonable discretion to identify those members or
participants that, taken as a whole, are the ``minimum necessary'' for
the maintenance of fair and orderly markets in the event of the
activation of such plans is likely to result in a smaller number of SCI
entity members or participants being designated for participation in
testing as compared to the SCI Proposal, thus reducing total costs to
all members or participants combined. Because the Commission believes
that SCI entities have an incentive to limit the imposition of the cost
and burden associated with testing to the minimum necessary to comply
with the rule, it also believes that, given the option, most SCI
entities would, in the exercise of reasonable discretion, prefer to
designate fewer members or participants to participate in testing, than
to designate more. On balance, the Commission believes that the adopted
rule will incentivize SCI entities to designate those members and
participants that are in fact the minimum necessary for the maintenance
of fair and orderly markets in the event of the activation of their BC/
DR plans, and that this should reduce the number of designations to
which any particular member or participant would be subject, compared
to the SCI Proposal.
    It remains possible, as some commenters noted, that firms that are
members of multiple SCI entities will be the subject of multiple
designations, and that multiple designations could require certain
firms to maintain connections to backup sites and participate in
testing of the BC/DR plans of multiple SCI entities. As discussed in
Section IV.B.6.b, the Commission believes this possibility, though
real, may be mitigated by the fact that designations are likely to be
made to firms that are already connected to one or more SCI entity
backup facilities, because they are more likely to be significant
members or participants of the applicable SCI entities; and that,
because some SCI entity backup facilities are located in close
proximity to each other, multiple connections to such backup facilities
may be less costly than if SCI entity backup facilities were not so
located. The Commission recognizes that there would be greater costs to
a firm being designated by multiple SCI entities to participate in the
testing of their business continuity and disaster recovery plans, but
believes that these greater costs are warranted for such firms, as they
represent significant participants in each of the SCI entities for
which they are designated, and their participation in the testing of
each such

SCI entity's business continuity and disaster recovery plans is
necessary to evaluate whether such plans are reliable and effective.
The Commission recognizes that a firm that is designated to participate
in testing with multiple SCI entities may assess the costs and burdens
of participating in every test to be too great, and make business
decisions to withdraw its membership or participation from one or more
such SCI entities so as to avoid the costs and burdens of such testing.
The Commission believes such a scenario is unlikely because such firm
is likely to be a larger firm with a significant level of participation
in such SCI entity and is likely to already have connections to backup
facilities of the SCI entity.
    The Commission believes that the cost associated with Rule 1004 is
unlikely to induce the designated members or participants to reduce the
number of SCI entities through which they trade and adversely affect
price competitiveness in markets.\2066\ As noted above, the Commission
also recognizes that costs to some SCI entity members or participants
associated with Rule 1004 could be significant, and also highly
variable depending on the business continuity and disaster recovery
plans being tested. Based on industry sources, the Commission
understands that most of the larger members or participants of SCI
entities already maintain connectivity with the backup systems of SCI
entities. However, the Commission understands that there is a lower
incidence of smaller members or participants maintaining connectivity
with the backup sites of SCI entities.\2067\ As such, the Commission
believes that the compliance costs associated with Rule 1004 would be
higher for those members or participants that are designated for
testing by SCI entities who would need to invest in additional
infrastructure to maintain connectivity with an SCI entity's backup
systems to participate in testing, which the Commission believes is
more likely to be the case for smaller members or participants
designated for testing.
---------------------------------------------------------------------------

    \2066\ See supra notes 2055 and 2059 and accompanying text.
    \2067\ See Proposing Release, supra note 13, at 18172, n. 642.
---------------------------------------------------------------------------

    The Commission acknowledges that the compliance costs associated
with Rule 1004 could raise barriers to entry and affect competition
among members or participants of SCI entities. Specifically, to the
extent that members or participants could be subject to designation in
business continuity and disaster recovery plan testing and could incur
additional compliance costs, the member or participant designation
requirement of Rule 1004 could raise barriers to entry. Also, as
discussed above, the compliance costs of the rule will likely be higher
for smaller members or participants of SCI entities compared to larger
members or participants of SCI entities. However, the Commission
believes the adverse effect on competition may be mitigated to some
extent as the most likely members or participants to be designated for
testing are larger members or participants who already maintain
connectivity with an SCI entity's backup systems. Further, the adverse
effect on competition could be partially mitigated to the extent that
larger firms, which are members of multiple SCI entities, could incur
additional compliance costs as these larger member firms could be
subject to multiple designations for business continuity and disaster
recovery plan testing.
    One commenter noted that mere network connectivity to an exchange
or ATS would be insufficient for a market maker to provide meaningful
liquidity on an SCI entity.\2068\ This commenter noted that, if the
Commission does not intend for SCI entities to be able to trade in the
same way from a backup facility as it trades from the primary site,
then market makers could maintain a more limited remote connectivity to
the backup site and incur less cost, although this commenter believed
that such an approach would not facilitate the posting of competitive
quotes.\2069\ This commenter believed that this alternative approach
would result in unusually wide markets, and would not result in any
benefits.\2070\
---------------------------------------------------------------------------

    \2068\ See KCG Letter at 12.
    \2069\ See id. at 13.
    \2070\ See id. at 13.
---------------------------------------------------------------------------

    As discussed in Section IV.B.6, Rule 1001(a) does not require that
backup facilities of SCI entities fully duplicate the features of
primary facilities. Further as discussed in Section IV.B.6, SCI entity
members or participants are not required by Regulation SCI to maintain
the same level of connectivity with the backup sites of an SCI entity
as they do with the primary sites. In the event of a wide-scale
disruption in the securities markets, the Commission acknowledges that
SCI entities and their members or participants may not be able to
provide the same level of liquidity as on a normal trading day.
However, the Commission expects that, on a day when business continuity
and disaster recovery plans are in effect due to a wide-scale
disruption in the securities markets, the requirements of Rule 1004
will help ensure adequate levels of liquidity and pricing efficiency to
facilitate trading and maintain fair and orderly markets without
imposing excessive costs on SCI entities and market participants by
requiring them to maintain the same connectivity with the backup
systems as with the primary sites.
Alternatives
    Several commenters suggested alternatives to the proposed BC/DR
testing requirements.\2071\ Two commenters suggested that few ATSs are
critical enough to warrant inclusion in the BC/DR testing
requirement.\2072\ One commenter suggested that only SCI entities that
provide market functions on which other market participants depend be
subject to the requirements for separate backup and recovery
capabilities.\2073\ Furthermore, one commenter urged that BC/DR testing
coordination only be required among providers of singular services in
the market (i.e., exchange that lists securities, exclusive processors
under NMS plans, and clearing and settlement agencies).\2074\
---------------------------------------------------------------------------

    \2071\ See SIFMA Letter at 17; BIDS Letter at 8; and ITG Letter
at 15.
    \2072\ See BIDS Letter at 8; and ITG Letter at 15.
    \2073\ See KCG Letter at 8.
    \2074\ See Direct Edge Letter at 9.
---------------------------------------------------------------------------

    The Commission is not persuaded that SCI ATSs should be excluded
from the requirements of BC/DR testing plans. In today's market, as
discussed in Section IV.A.1.b, ATSs collectively represent a
significant source of liquidity for stock trading. Although the concept
of ``fair and orderly markets'' when BC/DR plans are in effect does not
require the same level of liquidity, depth, volatility, and other
characteristics of trading on a normal trading day, the Commission
believes that excluding significant ATSs from BC/DR testing could harm
liquidity, depth, and volatility when BC/DR plans are in effect and,
thus, could significantly reduce the benefits of Rule 1004.
Furthermore, with respect to the commenter that urged the Commission
only to include providers of singular services in BC/DR testing
coordination, as mentioned in Section IV.A.1.b, because trading in the
U.S. securities markets today is dispersed among exchanges, ATSs, and
other trading venues, and often involves trading strategies that
require access to multiple trading venues, including ATSs,
simultaneously, including all SCI entities, the Commission believes
that requiring SCI entities to coordinate testing would result in
testing under

more realistic market conditions and help ensure that securities
markets have improved backup infrastructure, fewer market shutdowns,
and fair and orderly markets in the event of the activation of BC/DR
plans.
    Furthermore, one commenter stated that coordinated BC/DR testing is
a good aspirational goal, but expressed concern that too much is
outside of the control of an individual SCI entity, and therefore the
rule should, at most, require SCI entities to attempt to coordinate
such testing.\2075\ With respect to the comment suggesting that BC/DR
testing coordination should be an aspirational goal rather than a
requirement, the Commission believes that voluntary BC/DR testing is
insufficient and will not further the goal of Regulation SCI as
evidenced by Superstorm Sandy discussed in Section IV.B.6. As discussed
above, the Commission acknowledges that there could be potential
difficulties, including communicating with other SCI entities, in
coordinating BC/DR testing on an industry- or sector-wide basis.
---------------------------------------------------------------------------

    \2075\ See CME Letter at 13.
---------------------------------------------------------------------------

c. Recordkeeping and Electronic Filing--Rules 1005-1007
    Entities that participate in the ARP Inspection Program currently
keep records related to the ARP Inspection Program. However, the
recordkeeping requirements of Rules 1005-1007 would apply to more
entities, systems, and types of systems issues than the ARP Inspection
Program. In addition, SCI entities are already subject to certain
Commission recordkeeping requirements.\2076\ However, records relating
to Regulation SCI may not be specifically addressed in the
recordkeeping requirements of certain rules.\2077\ The Commission
believes that the recordkeeping requirements specifically related to
Regulation SCI would enhance the ability of the Commission to evaluate
SCI entities' compliance with Regulation SCI.
---------------------------------------------------------------------------

    \2076\ See, e.g., 17 CFR 240.17a-1, applicable to SCI SROs; 17
CFR 240.17a-3 and 17a-4, applicable to broker-dealers; and 17 CFR
242.301-303, applicable to ATSs.
     It has been the experience of the Commission that SCI entities
presently subject to the ARP Inspection Program (nearly all of whom
are SCI SROs that are also subject to the recordkeeping requirements
of Rule 17a-1(a)) do generally keep and preserve the types of
records that would be subject to the requirements of Rule 1005.
Nevertheless, the Commission continues to believe that Regulation
SCI's codification of these preservation practices will support an
accurate, timely, and efficient inspection and examination process
and help ensure that all types of SCI entities keep and preserve
such records.
    \2077\ See Proposing Release, supra note 13, at 18128.
---------------------------------------------------------------------------

    With respect to SCI SROs in particular, the Commission notes that
they are subject to the recordkeeping requirements of Rule 17a-1 under
the Exchange Act, and the breadth of Rule 17a-1 is such that it would
require SCI SROs to make, keep, and preserve records relating to their
compliance with Regulation SCI. Therefore, Rule 1005(a) requires each
SCI SRO to make, keep, and preserve all documents relating to its
compliance with Regulation SCI as prescribed in Rule 17a-1 under the
Exchange Act.\2078\
---------------------------------------------------------------------------

    \2078\ See supra Section IV.C.1.a (discussing recordkeeping
requirements for SROs under Rule 17a-1).
---------------------------------------------------------------------------

    Rule 1005(b) requires each SCI entity that is not an SCI SRO to
make, keep, and preserve at least one copy of all documents relating to
its compliance with Regulation SCI. Each such SCI entity is required to
keep all such documents for a period of not less than five years, the
first two years in a place that is readily accessible to the Commission
or its representatives for inspection and examination. Each such SCI
entity is also required to promptly furnish copies of such documents to
Commission representatives upon request. Rule 1005(c) requires each
such SCI entity, upon or immediately prior to ceasing to do business or
ceasing to be registered under the Exchange Act, to take all necessary
action to ensure that the records required to be made, kept, and
preserved by Rule 1005 shall be accessible to the Commission and its
representatives in the manner required by Rule 1005 and for the
remainder of the period required by Rule 1005.
    According to Rule 1007, if the records required to be filed or kept
by an SCI entity under Regulation SCI are prepared or maintained by a
service bureau or other recordkeeping service on behalf of the SCI
entity, the SCI entity is required to ensure that such records are
available for review by the Commission and its representatives by
submitting a written undertaking, in a form acceptable to the
Commission, by such service bureau or other recordkeeping service to
that effect.
    For SCI entities other than SCI SROs, Rule 1005 specifically
addresses recordkeeping requirements with respect to records relating
to Regulation SCI compliance. The Commission believes that Rules 1005
and 1007 would allow Commission staff to perform efficient inspections
and examinations of SCI entities for their compliance with Regulation
SCI, and would increase the likelihood that Commission staff can
identify conduct inconsistent with Regulation SCI at earlier stages in
the inspection and examination process. Furthermore, as discussed in
Section IV.C.1.a, although many SCI events may be resolved in a short
time frame, there may be other SCI events that may not be discovered
for an extended period of time after their occurrences, or may take
significant periods of time to fully resolve. In such cases, having an
SCI entity's records available for a longer period of time or even
after it has ceased to do business or be registered under the Exchange
Act would be beneficial. Preserved information should provide the
Commission with an additional source to help determine the causes and
consequences of one or more SCI events and better understand how such
events may have impacted trade execution, price discovery, liquidity,
and investor participation. Consequently, the Commission believes that
the requirements of Rules 1005 and 1007 would help ensure compliance
with Regulation SCI and help realize the potential benefits (e.g.,
better pricing efficiency, price discovery, and liquidity flows) of the
regulation.
    As noted above, the breadth of Rule 17a-1 under the Exchange Act is
such that it would require SCI SROs to make, keep, and preserve records
relating to their compliance with Regulation SCI. Therefore, for SCI
SROs, the incremental compliance costs associated with Rules 1005 and
1007 will be modest.\2079\ On the other hand, for SCI entities that are
not SCI SROs, the recordkeeping requirements of Rules 1005 and 1007
will impose additional costs, including one-time cost to set up or
modify an existing recordkeeping system to comply with Rules 1005 and
1007. The initial and ongoing compliance costs associated with the
recordkeeping requirements are attributed to paperwork burdens, which
are discussed in Section V.D.4 above.\2080\
---------------------------------------------------------------------------

    \2079\ As noted above, it has been the experience of the
Commission that SCI entities presently subject to the ARP Inspection
Program generally keep and preserve the types of records that would
be subject to the requirements of Rule 1005. Nearly all of these ARP
participants are SCI SROs that are also subject to the recordkeeping
requirements of Rule 17a-1.
    \2080\ When monetized, the paperwork burden associated with all
recordkeeping requirements would result in approximately $857,000
initially for all non-SRO SCI entities in the aggregate, and $27,000
annually for all non-SRO SCI entities in the aggregate.
---------------------------------------------------------------------------

    Rule 1006 requires SCI entities to electronically file all written
information to the Commission on Form SCI (except for notifications
submitted pursuant to Rules 1002(b)(1) and (b)(3)).

Rule 1006 should provide a uniform manner in which the Commission would
receive--and SCI entities would provide--written notifications,
reviews, descriptions, analyses, or reports required by Regulation
SCI.\2081\ Rule 1006 should add efficiency for SCI entities in drafting
and submitting the required reports, and for the Commission in
reviewing, analyzing, and responding to the information provided.\2082\
All costs associated with Form SCI are attributed to paperwork burdens
discussed in Section V.
---------------------------------------------------------------------------

    \2081\ See Proposing Release, supra note 13, at 18129-30.
    \2082\ See id. at 18130.
---------------------------------------------------------------------------

    Every SCI entity will be required to have the ability to
electronically submit Form SCI through the EFFS system, and every
person designated to sign Form SCI will be required to have an
electronic signature and a digital ID. Each SCI entity will also be
required to submit documents attached as exhibits through the EFFS
system in a text-searchable format, subject to a limited
exception.\2083\ The Commission believes that requiring documents to be
submitted in a text-searchable format, subject to a limited exception,
is necessary to allow Commission staff to efficiently review and
analyze information provided by SCI entities. Additionally, the
Commission believes that this requirement will not impose an additional
burden on SCI entities, as SCI entities likely already prepare
documents in an electronic format that is text searchable or can
readily be converted into a format that is text searchable. The
Commission also believes that many SCI entities currently have the
ability to access the EFFS system and electronically submit Form SCI
such that the requirement to submit Form SCI electronically will not
impose significant new implementation or ongoing costs.\2084\ The
Commission also believes that some of the persons who will be
designated to sign Form SCI already have digital IDs and the ability to
provide an electronic signature. To the extent that some persons do not
have digital IDs, the additional cost to obtain and maintain digital
IDs is accounted for in the paperwork burden.\2085\
---------------------------------------------------------------------------

    \2083\ As noted in Section IV.C.2, the General Instructions to
Form SCI, Item A. specify that documents filed through the EFFS
system must be in a text-searchable format without the use of
optical character recognition, with a limited exception to allow for
a portion of a Form SCI submission (e.g., an image or diagram) that
cannot be made available in a text-searchable format to be submitted
in a non-text-searchable format.
    \2084\ The initial and ongoing costs associated with various
electronic submissions of Form SCI are discussed in the Paperwork
Reduction Act section above. See supra Section V.
    \2085\ See supra Section V.D.2.e.
---------------------------------------------------------------------------

    As an alternative to the adopted electronic submission requirement,
the Commission considered requiring data to be submitted in a tagged
data format such as XBRL. Requiring reports to be filed in a tagged
data format such as XBRL would likely permit faster and more efficient
analysis of information disclosed in reports but would also likely
impose additional compliance costs associated with tagging information
in the narrative responses.
    Rather than requiring the use of XBRL formatting for Form SCI, the
Commission notes that certain fields in Sections I-III of Form SCI will
require information provided by SCI entities to be in a format that
will allow the Commission to gather information in a structured manner
(e.g., the submission type and SCI event type in Section I). By
collecting information on Form SCI in a way that allows the Commission
to gather key information in a structured manner, the Commission
believes it will be able to more efficiently review and process filings
made on Form SCI. Moreover, gathering certain information in Sections
I-III of Form SCI in a structured format should not result in an
additional cost to SCI entities.

VII. Regulatory Flexibility Act Certification

    The Regulatory Flexibility Act (``RFA'') \2086\ requires Federal
agencies, in promulgating rules, to consider the impact of those rules
on small entities. The Commission certified in the SCI Proposal,
pursuant to Section 605(b) of the Regulatory Flexibility Act of 1980
(``RFA''),\2087\ that proposed Regulation SCI would not, if adopted,
have a significant impact on a substantial number of small entities.
The Commission received no comments on this certification.
---------------------------------------------------------------------------

    \2086\ 5 U.S.C. 601 et seq.
    \2087\ 5 U.S.C. 605(b).
---------------------------------------------------------------------------

A. SCI Entities

    Paragraph (a) of Rule 0-10 provides that for purposes of the RFA, a
small entity when used with reference to a ``person'' other than an
investment company means a person that, on the last day of its most
recent fiscal year, had total assets of $5 million or less.\2088\ With
regard to broker-dealers, small entity means a broker or dealer that
had total capital of less than $500,000 on the date in the prior fiscal
year as of which its audited financial statements were prepared
pursuant to Rule 17a-5(d) under the Exchange Act, or, if not required
to file such statements, had total capital of less than $500,000 on the
last business day of the preceding fiscal year (or in the time that it
has been in business, if shorter), and that is not affiliated with any
person (other than a natural person) that is not a small business or
small organization.\2089\ With regard to clearing agencies, small
entity means a clearing agency that compared, cleared, and settled less
than $500 million in securities transactions during the preceding
fiscal year (or in the time that it has been in business, if shorter),
had less than $200 million of funds and securities in its custody or
control at all times during the preceding fiscal year (or in the time
that it has been in business, if shorter), and is not affiliated with
any person (other than a natural person) that is not a small business
or small organization.\2090\ With regard to exchanges, small entity
means an exchange that has been exempt from the reporting requirements
of Rule 601 under Regulation NMS, and is not affiliated with any person
(other than a natural person) that is not a small business or small
organization.\2091\ With regard to securities information processors,
small entity means a securities information processor that had gross
revenue of less than $10 million during the preceding fiscal year (or
in the time it has been in business, if shorter), provided service to
fewer than 100 interrogation devices or moving tickers at all times
during the preceding fiscal year (or in the time it has been in
business, if shorter), and is not affiliated with any person (that is
not a natural person) that is not a small business or small
organization.\2092\ Under the standards adopted by the Small Business
Administration (``SBA''), entities engaged in financial investments and
related activities are considered small entities if they have $35.5
million or less in average annual receipts.\2093\
---------------------------------------------------------------------------

    \2088\ See 17 CFR 240.0-10(a).
    \2089\ See 17 CFR 240.0-10(c).
    \2090\ See 17 CFR 240.0-10(d).
    \2091\ See 17 CFR 240.0-10(e).
    \2092\ See 17 CFR 240.0-10(g).
    \2093\ See SBA's Table of Small Business Size Standards,
Subsector 523 and 13 CFR 121.201. Such entities include firms
engaged in investment banking and securities dealing, securities
brokerage, commodity contracts dealing, commodity contracts
brokerage, securities and commodity exchanges, miscellaneous
intermediation, portfolio management, investment advice, trust,
fiduciary and custody activities, and miscellaneous financial
investment activities.
---------------------------------------------------------------------------

    Based on the Commission's existing information about the entities
that will be subject to Regulation SCI, the Commission believes that
SCI entities that are self-regulatory organizations

(national securities exchanges, national securities associations,
registered clearing agencies, and the MSRB) or exempt clearing agencies
subject to ARP would not fall within the Commission's definition of
small entity as described above. With regard to plan processors, which
are defined under Rule 600(b)(55) of Regulation NMS to mean a self-
regulatory organization or securities information processor acting as
an exclusive processor in connection with the development,
implementation and/or operation of any facility contemplated by an
effective NMS plan,\2094\ the Commission's definition of small entity
as it relates to self-regulatory organizations and securities
information processors would apply. The Commission does not believe
that any plan processor would be a small entity as defined above. With
regard to SCI ATSs, because they are registered as broker-dealers, the
Commission's definition of small entity as it relates to broker-dealers
would apply. The Commission does not believe that any of the SCI ATSs
would be a small entity as defined above.
---------------------------------------------------------------------------

    \2094\ See 17 CFR 242.600(b)(55).
---------------------------------------------------------------------------

B. Certification

    For the foregoing reasons, the Commission again certifies that
Regulation SCI will not have a significant economic impact on a
substantial number of small entities.

VIII. Statutory Authority and Text of Amendments

    Pursuant to the Exchange Act, 15 U.S.C. 78a et seq., and
particularly, Sections 2, 3, 5, 6, 11A, 15, 15A, 17, 17A, 23(a), and 24
thereof, 15 U.S.C. 78b, 78c, 78e, 78f, 78k-1, 78o, 78o-3, 78q, 78q-1,
78x, and 78w(a), the Commission adopts Regulation SCI under the
Exchange Act and Form SCI under the Exchange Act, and amends Regulation
ATS and Rule 24b-2 under the Exchange Act.

List of Subjects in 17 CFR Parts 240, 242, and 249

    Brokers; Confidential business information; Reporting and
recordkeeping requirements; and Securities.

    In accordance with the foregoing, Title 17, Chapter II of the Code
of Federal Regulations is amended as follows:

PART 240--GENERAL RULES AND REGULATIONS, SECURITIES EXCHANGE ACT OF
1934

0
1. The authority citation for part 240 continues to read in part as
follows:

    Authority:  15 U.S.C. 77c, 77d, 77g, 77j, 77s, 77z-2, 77z-3,
77eee, 77ggg, 77nnn, 77sss, 77ttt, 78c, 78c-3, 78c-5, 78d, 78e, 78f,
78g, 78i, 78j, 78j-1, 78k, 78k-1, 78l, 78m, 78n, 78n-1, 78o, 78o-4,
78o-10, 78p, 78q, 78q-1, 78s, 78u-5, 78w, 78x, 78ll, 78mm, 80a-20,
80a-23, 80a-29, 80a-37, 80b-3, 80b-4, 80b-11, 7201 et seq., and
8302; 7 U.S.C. 2(c)(2)(E); 12 U.S.C. 5221(e)(3); 18 U.S.C. 1350,
unless otherwise noted.
* * * * *

0
2. Amend Sec.  240.24b-2 by:
0
a. After the words PRELIMINARY NOTE: Adding the words ``Except as
otherwise provided in this rule,'' and revising the word
``Confidential'' to read ``confidential''.
0
b. Adding at the beginning of paragraph (b) introductory text the words
``Except as otherwise provided in paragraph (g) of this section,'' and
revising the word ``The'' to read ``the''.
0
c. Adding paragraph (g).
    The addition reads as follows:

Sec.  240.24b-2.  Nondisclosure of information filed with the
Commission and with any exchange.

* * * * *
    (g) An SCI entity (as defined in Sec.  242.1000 of this chapter)
shall not omit the confidential portion from the material filed in
electronic format on Form SCI pursuant to Regulation SCI, Sec.
242.1000 et. seq., and, in lieu of the procedures described in
paragraph (b) of this section, may request confidential treatment of
all information provided on Form SCI by completing Section IV of Form
SCI.

PART 242--REGULATIONS M, SHO, ATS, AC, NMS AND SCI AND CUSTOMER
MARGIN REQUIREMENTS FOR SECURITY FUTURES

0
3. The authority citation for part 242 continues to read as follows:

    Authority:  15 U.S.C. 77g, 77q(a), 77s(a), 78b, 78c, 78g(c)(2),
78i(a), 78j, 78k-1(c), 78l, 78m, 78n, 78o(b), 78o(c), 78o(g),
78q(a), 78q(b), 78q(h), 78w(a), 78dd-1, 78mm, 80a23, 80a-29, and
80a-37.
* * * * *

0
4. The heading of part 242 is revised to read as set forth above.

Sec.  242.301  [Amended]

0
5. Amend Sec.  242.301 by removing paragraphs (b)(6)(i)(A) and (B) and
redesignating paragraphs (b)(6)(i)(C) and (D) as paragraphs
(b)(6)(i)(A) and (B), respectively.

0
6. Add Sec. Sec.  242.1000 through 242.1007 to read as follows:
Sec.
Regulation SCI--Systems Compliance and Integrity
242.1000 Definitions.
242.1001 Obligations related to policies and procedures of SCI
entities.
242.1002 Obligations related to SCI events.
242.1003 Obligations related to systems changes; SCI review.
242.1004 SCI entity business continuity and disaster recovery plans
testing requirements for members or participants.
242.1005 Recordkeeping requirements related to compliance with
Regulation SCI.
242.1006 Electronic filing and submission.
242.1007 Requirements for service bureaus.

Sec.  242.1000  Definitions.

    For purposes of Regulation SCI (Sec. Sec.  242.1000 through
242.1007), the following definitions shall apply:
    Critical SCI systems means any SCI systems of, or operated by or on
behalf of, an SCI entity that:
    (1) Directly support functionality relating to:
    (i) Clearance and settlement systems of clearing agencies;
    (ii) Openings, reopenings, and closings on the primary listing
market;
    (iii) Trading halts;
    (iv) Initial public offerings;
    (v) The provision of consolidated market data; or
    (vi) Exclusively-listed securities; or
    (2) Provide functionality to the securities markets for which the
availability of alternatives is significantly limited or nonexistent
and without which there would be a material impact on fair and orderly
markets.
    Electronic signature has the meaning set forth in Sec.  240.19b-
4(j) of this chapter.
    Exempt clearing agency subject to ARP means an entity that has
received from the Commission an exemption from registration as a
clearing agency under Section 17A of the Act, and whose exemption
contains conditions that relate to the Commission's Automation Review
Policies (ARP), or any Commission regulation that supersedes or
replaces such policies.
    Indirect SCI systems means any systems of, or operated by or on
behalf of, an SCI entity that, if breached, would be reasonably likely
to pose a security threat to SCI systems.
    Major SCI event means an SCI event that has had, or the SCI entity
reasonably estimates would have:
    (1) Any impact on a critical SCI system; or

    (2) A significant impact on the SCI entity's operations or on
market participants.
    Plan processor has the meaning set forth in Sec.  242.600(b)(55).
    Responsible SCI personnel means, for a particular SCI system or
indirect SCI system impacted by an SCI event, such senior manager(s) of
the SCI entity having responsibility for such system, and their
designee(s).
    SCI alternative trading system or SCI ATS means an alternative
trading system, as defined in Sec.  242.300(a), which during at least
four of the preceding six calendar months:
    (1) Had with respect to NMS stocks:
    (i) Five percent (5%) or more in any single NMS stock, and one-
quarter percent (0.25%) or more in all NMS stocks, of the average daily
dollar volume reported by applicable transaction reporting plans; or
    (ii) One percent (1%) or more in all NMS stocks of the average
daily dollar volume reported by applicable transaction reporting plans;
or
    (2) Had with respect to equity securities that are not NMS stocks
and for which transactions are reported to a self-regulatory
organization, five percent (5%) or more of the average daily dollar
volume as calculated by the self-regulatory organization to which such
transactions are reported;
    (3) Provided, however, that such SCI ATS shall not be required to
comply with the requirements of Regulation SCI until six months after
satisfying any of paragraphs (a) or (b) of this section, as applicable,
for the first time.
    SCI entity means an SCI self-regulatory organization, SCI
alternative trading system, plan processor, or exempt clearing agency
subject to ARP.
    SCI event means an event at an SCI entity that constitutes:
    (1) A systems disruption;
    (2) A systems compliance issue; or
    (3) A systems intrusion.
    SCI review means a review, following established procedures and
standards, that is performed by objective personnel having appropriate
experience to conduct reviews of SCI systems and indirect SCI systems,
and which review contains:
    (1) A risk assessment with respect to such systems of an SCI
entity; and
    (2) An assessment of internal control design and effectiveness of
its SCI systems and indirect SCI systems to include logical and
physical security controls, development processes, and information
technology governance, consistent with industry standards.
    SCI self-regulatory organization or SCI SRO means any national
securities exchange, registered securities association, or registered
clearing agency, or the Municipal Securities Rulemaking Board; provided
however, that for purposes of this section, the term SCI self-
regulatory organization shall not include an exchange that is notice
registered with the Commission pursuant to 15 U.S.C. 78f(g) or a
limited purpose national securities association registered with the
Commission pursuant to 15 U.S.C. 78o-3(k).
    SCI systems means all computer, network, electronic, technical,
automated, or similar systems of, or operated by or on behalf of, an
SCI entity that, with respect to securities, directly support trading,
clearance and settlement, order routing, market data, market
regulation, or market surveillance.
    Senior management means, for purposes of Rule 1003(b), an SCI
entity's Chief Executive Officer, Chief Technology Officer, Chief
Information Officer, General Counsel, and Chief Compliance Officer, or
the equivalent of such employees or officers of an SCI entity.
    Systems compliance issue means an event at an SCI entity that has
caused any SCI system of such entity to operate in a manner that does
not comply with the Act and the rules and regulations thereunder or the
entity's rules or governing documents, as applicable.
    Systems disruption means an event in an SCI entity's SCI systems
that disrupts, or significantly degrades, the normal operation of an
SCI system.
    Systems intrusion means any unauthorized entry into the SCI systems
or indirect SCI systems of an SCI entity.

Sec.  242.1001  Obligations related to policies and procedures of SCI
entities.

    (a) Capacity, integrity, resiliency, availability, and security.
(1) Each SCI entity shall establish, maintain, and enforce written
policies and procedures reasonably designed to ensure that its SCI
systems and, for purposes of security standards, indirect SCI systems,
have levels of capacity, integrity, resiliency, availability, and
security, adequate to maintain the SCI entity's operational capability
and promote the maintenance of fair and orderly markets.
    (2) Policies and procedures required by paragraph (a)(1) of this
section shall include, at a minimum:
    (i) The establishment of reasonable current and future
technological infrastructure capacity planning estimates;
    (ii) Periodic capacity stress tests of such systems to determine
their ability to process transactions in an accurate, timely, and
efficient manner;
    (iii) A program to review and keep current systems development and
testing methodology for such systems;
    (iv) Regular reviews and testing, as applicable, of such systems,
including backup systems, to identify vulnerabilities pertaining to
internal and external threats, physical hazards, and natural or manmade
disasters;
    (v) Business continuity and disaster recovery plans that include
maintaining backup and recovery capabilities sufficiently resilient and
geographically diverse and that are reasonably designed to achieve next
business day resumption of trading and two-hour resumption of critical
SCI systems following a wide-scale disruption;
    (vi) Standards that result in such systems being designed,
developed, tested, maintained, operated, and surveilled in a manner
that facilitates the successful collection, processing, and
dissemination of market data; and
    (vii) Monitoring of such systems to identify potential SCI events.
    (3) Each SCI entity shall periodically review the effectiveness of
the policies and procedures required by this paragraph (a), and take
prompt action to remedy deficiencies in such policies and procedures.
    (4) For purposes of this paragraph (a), such policies and
procedures shall be deemed to be reasonably designed if they are
consistent with current SCI industry standards, which shall be
comprised of information technology practices that are widely available
to information technology professionals in the financial sector and
issued by an authoritative body that is a U.S. governmental entity or
agency, association of U.S. governmental entities or agencies, or
widely recognized organization. Compliance with such current SCI
industry standards, however, shall not be the exclusive means to comply
with the requirements of this paragraph (a).
    (b) Systems compliance. (1) Each SCI entity shall establish,
maintain, and enforce written policies and procedures reasonably
designed to ensure that its SCI systems operate in a manner that
complies with the Act and the rules and regulations thereunder and the
entity's rules and governing documents, as applicable.
    (2) Policies and procedures required by paragraph (b)(1) of this
section shall include, at a minimum:
    (i) Testing of all SCI systems and any changes to SCI systems prior
to implementation;
    (ii) A system of internal controls over changes to SCI systems;
    (iii) A plan for assessments of the functionality of SCI systems
designed to

detect systems compliance issues, including by responsible SCI
personnel and by personnel familiar with applicable provisions of the
Act and the rules and regulations thereunder and the SCI entity's rules
and governing documents; and
    (iv) A plan of coordination and communication between regulatory
and other personnel of the SCI entity, including by responsible SCI
personnel, regarding SCI systems design, changes, testing, and controls
designed to detect and prevent systems compliance issues.
    (3) Each SCI entity shall periodically review the effectiveness of
the policies and procedures required by this paragraph (b), and take
prompt action to remedy deficiencies in such policies and procedures.
    (4) Safe harbor from liability for individuals. Personnel of an SCI
entity shall be deemed not to have aided, abetted, counseled,
commanded, caused, induced, or procured the violation by an SCI entity
of this paragraph (b) if the person:
    (i) Has reasonably discharged the duties and obligations incumbent
upon such person by the SCI entity's policies and procedures; and
    (ii) Was without reasonable cause to believe that the policies and
procedures relating to an SCI system for which such person was
responsible, or had supervisory responsibility, were not established,
maintained, or enforced in accordance with this paragraph (b) in any
material respect.
    (c) Responsible SCI personnel. (1) Each SCI entity shall establish,
maintain, and enforce reasonably designed written policies and
procedures that include the criteria for identifying responsible SCI
personnel, the designation and documentation of responsible SCI
personnel, and escalation procedures to quickly inform responsible SCI
personnel of potential SCI events.
    (2) Each SCI entity shall periodically review the effectiveness of
the policies and procedures required by paragraph (c)(1) of this
section, and take prompt action to remedy deficiencies in such policies
and procedures.

Sec.  242.1002  Obligations related to SCI events.

    (a) Corrective action. Upon any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred, each SCI
entity shall begin to take appropriate corrective action which shall
include, at a minimum, mitigating potential harm to investors and
market integrity resulting from the SCI event and devoting adequate
resources to remedy the SCI event as soon as reasonably practicable.
    (b) Commission notification and recordkeeping of SCI events. Each
SCI entity shall:
    (1) Upon any responsible SCI personnel having a reasonable basis to
conclude that an SCI event has occurred, notify the Commission of such
SCI event immediately;
    (2) Within 24 hours of any responsible SCI personnel having a
reasonable basis to conclude that the SCI event has occurred, submit a
written notification pertaining to such SCI event to the Commission,
which shall be made on a good faith, best efforts basis and include:
    (i) A description of the SCI event, including the system(s)
affected; and
    (ii) To the extent available as of the time of the notification:
The SCI entity's current assessment of the types and number of market
participants potentially affected by the SCI event; the potential
impact of the SCI event on the market; a description of the steps the
SCI entity has taken, is taking, or plans to take, with respect to the
SCI event; the time the SCI event was resolved or timeframe within
which the SCI event is expected to be resolved; and any other pertinent
information known by the SCI entity about the SCI event;
    (3) Until such time as the SCI event is resolved and the SCI
entity's investigation of the SCI event is closed, provide updates
pertaining to such SCI event to the Commission on a regular basis, or
at such frequency as reasonably requested by a representative of the
Commission, to correct any materially incorrect information previously
provided, or when new material information is discovered, including but
not limited to, any of the information listed in paragraph (b)(2)(ii)
of this section;
    (4)(i)(A) If an SCI event is resolved and the SCI entity's
investigation of the SCI event is closed within 30 calendar days of the
occurrence of the SCI event, then within five business days after the
resolution of the SCI event and closure of the investigation regarding
the SCI event, submit a final written notification pertaining to such
SCI event to the Commission containing the information required in
paragraph (b)(4)(ii) of this section.
    (B)(1) If an SCI event is not resolved or the SCI entity's
investigation of the SCI event is not closed within 30 calendar days of
the occurrence of the SCI event, then submit an interim written
notification pertaining to such SCI event to the Commission within 30
calendar days after the occurrence of the SCI event containing the
information required in paragraph (b)(4)(ii) of this section, to the
extent known at the time.
    (2) Within five business days after the resolution of such SCI
event and closure of the investigation regarding such SCI event, submit
a final written notification pertaining to such SCI event to the
Commission containing the information required in paragraph (b)(4)(ii)
of this section.
    (ii) Written notifications required by paragraph (b)(4)(i) of this
section shall include:
    (A) A detailed description of: The SCI entity's assessment of the
types and number of market participants affected by the SCI event; the
SCI entity's assessment of the impact of the SCI event on the market;
the steps the SCI entity has taken, is taking, or plans to take, with
respect to the SCI event; the time the SCI event was resolved; the SCI
entity's rule(s) and/or governing document(s), as applicable, that
relate to the SCI event; and any other pertinent information known by
the SCI entity about the SCI event;
    (B) A copy of any information disseminated pursuant to paragraph
(c) of this section by the SCI entity to date regarding the SCI event
to any of its members or participants; and
    (C) An analysis of parties that may have experienced a loss,
whether monetary or otherwise, due to the SCI event, the number of such
parties, and an estimate of the aggregate amount of such loss.
    (5) The requirements of paragraphs (b)(1) through (4) of this
section shall not apply to any SCI event that has had, or the SCI
entity reasonably estimates would have, no or a de minimis impact on
the SCI entity's operations or on market participants. For such events,
each SCI entity shall:
    (i) Make, keep, and preserve records relating to all such SCI
events; and
    (ii) Submit to the Commission a report, within 30 calendar days
after the end of each calendar quarter, containing a summary
description of such systems disruptions and systems intrusions,
including the SCI systems and, for systems intrusions, indirect SCI
systems, affected by such systems disruptions and systems intrusions
during the applicable calendar quarter.
    (c) Dissemination of SCI events. (1) Each SCI entity shall:
    (i) Promptly after any responsible SCI personnel has a reasonable
basis to conclude that an SCI event that is a systems disruption or
systems compliance issue has occurred, disseminate the following
information about such SCI event:
    (A) The system(s) affected by the SCI event; and

    (B) A summary description of the SCI event; and
    (ii) When known, promptly further disseminate the following
information about such SCI event:
    (A) A detailed description of the SCI event;
    (B) The SCI entity's current assessment of the types and number of
market participants potentially affected by the SCI event; and
    (C) A description of the progress of its corrective action for the
SCI event and when the SCI event has been or is expected to be
resolved; and
    (iii) Until resolved, provide regular updates of any information
required to be disseminated under paragraphs (c)(1)(i) and (ii) of this
section.
    (2) Each SCI entity shall, promptly after any responsible SCI
personnel has a reasonable basis to conclude that a SCI event that is a
systems intrusion has occurred, disseminate a summary description of
the systems intrusion, including a description of the corrective action
taken by the SCI entity and when the systems intrusion has been or is
expected to be resolved, unless the SCI entity determines that
dissemination of such information would likely compromise the security
of the SCI entity's SCI systems or indirect SCI systems, or an
investigation of the systems intrusion, and documents the reasons for
such determination.
    (3) The information required to be disseminated under paragraphs
(c)(1) and (2) of this section promptly after any responsible SCI
personnel has a reasonable basis to conclude that an SCI event has
occurred, shall be promptly disseminated by the SCI entity to those
members or participants of the SCI entity that any responsible SCI
personnel has reasonably estimated may have been affected by the SCI
event, and promptly disseminated to any additional members or
participants that any responsible SCI personnel subsequently reasonably
estimates may have been affected by the SCI event; provided, however,
that for major SCI events, the information required to be disseminated
under paragraphs (c)(1) and (2) of this section shall be promptly
disseminated by the SCI entity to all of its members or participants.
    (4) The requirements of paragraphs (c)(1) through (3) of this
section shall not apply to:
    (i) SCI events to the extent they relate to market regulation or
market surveillance systems; or
    (ii) Any SCI event that has had, or the SCI entity reasonably
estimates would have, no or a de minimis impact on the SCI entity's
operations or on market participants.

Sec.  242.1003  Obligations related to systems changes; SCI review.

    (a) Systems changes. Each SCI entity shall:
    (1) Within 30 calendar days after the end of each calendar quarter,
submit to the Commission a report describing completed, ongoing, and
planned material changes to its SCI systems and the security of
indirect SCI systems, during the prior, current, and subsequent
calendar quarters, including the dates or expected dates of
commencement and completion. An SCI entity shall establish reasonable
written criteria for identifying a change to its SCI systems and the
security of indirect SCI systems as material and report such changes in
accordance with such criteria.
    (2) Promptly submit a supplemental report notifying the Commission
of a material error in or material omission from a report previously
submitted under this paragraph (a).
    (b) SCI review. Each SCI entity shall:
    (1) Conduct an SCI review of the SCI entity's compliance with
Regulation SCI not less than once each calendar year; provided,
however, that:
    (i) Penetration test reviews of the network, firewalls, and
production systems shall be conducted at a frequency of not less than
once every three years; and
    (ii) Assessments of SCI systems directly supporting market
regulation or market surveillance shall be conducted at a frequency
based upon the risk assessment conducted as part of the SCI review, but
in no case less than once every three years; and
    (2) Submit a report of the SCI review required by paragraph (b)(1)
of this section to senior management of the SCI entity for review no
more than 30 calendar days after completion of such SCI review; and
    (3) Submit to the Commission, and to the board of directors of the
SCI entity or the equivalent of such board, a report of the SCI review
required by paragraph (b)(1) of this section, together with any
response by senior management, within 60 calendar days after its
submission to senior management of the SCI entity.

Sec.  242.1004  SCI entity business continuity and disaster recovery
plans testing requirements for members or participants.

    With respect to an SCI entity's business continuity and disaster
recovery plans, including its backup systems, each SCI entity shall:
    (a) Establish standards for the designation of those members or
participants that the SCI entity reasonably determines are, taken as a