action upon any responsible SCI personnel becoming aware of an SCI
event. Additionally, proposed Regulation SCI would require each SCI
entity to conduct an SCI review at least annually, and submit a report
of such review to the Commission, together with any response by senior
management. Further, proposed Regulation SCI would require an SCI
entity, with respect to its business continuity and disaster

recovery plans, to require participation by designated members or
participants in scheduled functional and performance testing of the
operation of such plans and coordinate such testing with other SCI
entities. Proposed Regulation SCI would also require SCI entities to
make, keep, and preserve books and records related to compliance with
Regulation SCI.
    The Commission is sensitive to the economic effects of proposed
Regulation SCI, including its costs and benefits.\506\ As discussed
further below, the Commission requests comment on all aspects of the
costs and benefits of the proposal, including any effects the proposed
rules may have on efficiency, competition, and capital formation.
---------------------------------------------------------------------------

    \506\ See also supra Section III.F (requesting comment on
applying proposed Regulation SCI to SB SDRs and/or SB SEFs and
discussing the potential costs and benefits of applying proposed
Regulation SCI to SB SDRs and/or SB SEFs).
---------------------------------------------------------------------------

B. Economic Baseline

    As noted in Section I.A above, all registered national securities
exchanges, all active registered clearing agencies, FINRA, two plan
processors, one ATS, and one exempt clearing agency participate in the
current ARP Inspection Program, which covers their automated
systems.\507\ Under the ARP policy statements and through the ARP
Inspection Program, these entities, among other things, are expected to
establish current and future capacity estimates, conduct capacity
stress tests, conduct annual reviews of whether affected systems can
perform adequately in light of estimated capacity levels, and identify
possible threats to the systems.\508\ The ARP policy statements and
Commission staff letters address, among other things, independent
reviews, the reporting of certain systems changes, intrusions, and
outages, and the need to comply with relevant laws and rules.\509\
---------------------------------------------------------------------------

    \507\ As noted above, the Commission, in the ARP I Release,
defined the term ``automated systems'' to refer ``collectively to
computer systems for listed and OTC equities, as well as options,
that electronically route orders to applicable market makers and
systems that electronically route and execute orders, including the
data networks that feed the systems * * * [and encompasses] systems
that disseminate transaction and quotation information and conduct
trade comparisons prior to settlement, including the associated
communication networks.'' See supra note 12.
    \508\ A more complete description of the history of the ARP
Inspection Program is discussed in supra Section I.A.
    \509\ The ARP policy statements and Commission staff letters are
discussed in supra Section I.A.
---------------------------------------------------------------------------

    Trading volume in the securities markets has become increasingly
dispersed across a broader range of market centers in recent
years,\510\ with ATSs accounting for a significant portion of
volume.\511\ However, no ATSs currently meet or exceed the volume
thresholds that would trigger compliance with the system safeguard
requirements of Rule 301(b)(6) of Regulation ATS.\512\ Thus, while ATSs
comprise a significant portion of consolidated volume, only one ATS
currently participates in the ARP Inspection Program.\513\ Dark pools
alone comprised approximately 13 percent of consolidated volume last
spring,\514\ but also are not part of the ARP Inspection Program.
Further, ATSs that trade fixed income securities, including municipal
and corporate debt securities, and non-NMS stocks (also referred to as
OTC equities) are not represented in the ARP Inspection Program and do
not meet the current thresholds in Regulation ATS for the application
of systems safeguard rules.
---------------------------------------------------------------------------

    \510\ See supra notes 44, 47, and 51.
    \511\ See supra note 50 and accompanying text.
    \512\ See supra Section III.B.1.
    \513\ See supra note 25 and accompanying text.
    \514\ See Nina Mehta, Dark Pools Capture Record U.S. Volume
Share, Bloomberg (March 1, 2012), available at: http://rblt.com/news_details.aspx?id=187.
---------------------------------------------------------------------------

    Proposed Regulation SCI would apply to SROs (including national
securities exchanges,\515\ national securities associations, registered
clearing agencies, and the MSRB \516\), SCI ATSs,\517\ plan
processors,\518\ and exempt clearing agencies subject to ARP.\519\ As
such, proposed Regulation SCI would specifically cover the trading of
NMS stocks, OTC equities, listed options, and debt securities. The
proposed rules also would impact multiple markets for services,
including the markets for trading services, listing services,
regulation and surveillance services, clearing and settlement services,
and market data.
---------------------------------------------------------------------------

    \515\ Proposed Regulation SCI would not apply to an exchange
that lists or trades security futures products that is notice-
registered with the Commission as a national securities exchange
pursuant to Section 6(g) of the Exchange Act, including security
futures exchanges. See supra note 97 and accompanying text.
    \516\ In 2011, the total par amount of municipal securities
traded was approximately $3.3 trillion in approximately 10.4 million
trades. See MSRB 2011 Fact Book at 8-9, available at: http://www.msrb.org/msrb1/pdfs/MSRB2011FactBook.pdf.
    \517\ See supra Section III.B.1 for the discussion of SCI ATSs.
    \518\ In addition, the Commission is soliciting comment on
whether, and if so how, proposed Regulation SCI should apply to SB
SDRs and/or SB SEFs. See supra Section III.F.
    \519\ See supra Section III.B.1 for the discussion of exempt
clearing agencies subject to ARP.
---------------------------------------------------------------------------

    As indicated above, many of the entities in these service markets
are currently covered by the ARP Inspection Program. Therefore, the
Commission recognizes that any economic effects, including costs and
benefits, should be compared to a baseline of current practices that
recognizes current practices pursuant to the ARP Inspection Program and
the limitations of the ARP Inspection Program discussed in Section I.C
above.\520\ In addition to the ARP Inspection Program, Commission staff
has provided guidance to ARP entities on certain aspects of the ARP
Inspection Program (e.g., in the 2001 Staff ARP Interpretive
Letter).\521\ Further, Commission staff has provided guidance on issues
outside the current scope of the ARP Inspection Program (e.g., in the
2009 Staff Systems Compliance Letter), but that are proposed to be
addressed by Regulation SCI.\522\ Below, the Commission provides
information on the current practices related to the types of market
events addressed by proposed Regulation SCI, including, where
available, information the Commission may have on the frequency of such
events. In addition, the Commission describes why each relevant service
market may not be structured in a way as to create a competitive
incentive to prevent the occurrence of these market events.\523\
---------------------------------------------------------------------------

    \520\ See also supra Section I.A for the discussion of the
current scope of the ARP Inspection Program. The Commission
acknowledges that, to the extent current practices of SCI entities
have been informed by the ARP policy statements, such practices have
not been subject to a cost-benefit analysis and that the discussion
herein considers only the incremental costs and benefits (i.e.,
compared to current practices).
    \521\ See 2001 Staff ARP Interpretive Letter, supra note 35.
    \522\ See 2009 Staff Systems Compliance Letter, supra note 36.
    \523\ The Commission compares current practices to each of the
proposed rules in infra Section V.B.3.
---------------------------------------------------------------------------

1. SCI Events
a. Systems Disruptions
    Currently, market participants employ a variety of measures to
avoid systems disruptions for a variety of reasons, including to
maintain competitive advantages, to provide optimal service to members
with access to the trading and/or other services provided by the
entity, to comply with legal obligations and, where applicable, to
participate in the ARP Inspection Program. The range of such measures
are possibly highly variable among SCI entities and within the systems
employed by SCI entities. For example, matching engines are likely
accorded high priority given the importance of low latency in trading.
Industry standards are not codified for such entities and systems,
except such as in an entity's rulebook or subscriber agreement.
Typically, however, market participants follow industry standards and
take measures that include weekend

system testing and internal performance monitoring.
    When system disruptions do occur, market participants take
corrective action in the interest of remaining competitive, to provide
optimal service, and to comply with legal obligations. To place the
effectiveness of the current ARP Inspection Program in perspective,
there were approximately 175 ARP incidents reported to the Commission
in 2011. These incidents had durations ranging from under one minute to
24 hours, with most incidents having a duration of less than 2 hours.
As noted above, the Commission believes that clearing systems and
matching engines generally are given greater priority than other
systems at SCI entities with regard to corrective action. In addition,
the Commission believes that SCI entities that currently participate in
the ARP Inspection Program strive to adhere to the next business day
resumption standard for trading and two-hour resumption standard for
clearance and settlement services, standards which the proposed rule
would codify for all SCI entities.
    As discussed in Section I.A, participation in the ARP Inspection
Program entails, among other things, conducting annual assessments of
affected systems, providing notifications of significant system changes
to the Commission, and reporting significant system outages to the
Commission. Further, Commission staff has provided guidance to the SROs
and other participants in the ARP Inspection Program on what should be
considered a ``significant system change'' and a ``significant system
outage'' for purposes of reporting systems changes and problems to
Commission staff.\524\ As such, the Commission believes that entities
that currently participate in the ARP Inspection Program have certain
processes for determining whether a systems change or outage is
``significant.'' Specifically, the 2001 Staff ARP Interpretive Letter
sets forth the types of outages and changes that should be reported to
the Commission and the timing of reporting. Also, as discussed below,
the ARP policy statements are focused on automated systems.
Specifically, entities that participate in the ARP Inspection Program
follow the ARP policy statements with respect to systems that directly
support trading, clearance and settlement, order routing, and market
data. While generally only trading, clearance and settlement, order
routing, and market data systems follow the guidelines in the ARP
policy statements, ARP staff inspects all the categories of systems
that are included in the proposed definition of ``SCI systems.'' \525\
However, ARP staff generally inspects systems that are not directly
related to trading, clearance and settlement, order routing, or market
data only if they detect red flags.
---------------------------------------------------------------------------

    \524\ See supra note 35.
    \525\ See supra Section III.B.2.
---------------------------------------------------------------------------

    As discussed above, the ARP Inspection Program has garnered
participation by all active registered clearing agencies, all
registered national securities exchanges, FINRA, plan processors, one
ATS, and one exempt clearing agency.\526\ Specifically, the Commission
estimates that there are currently 29 SCI entities that are
participants in the ARP Inspection Program.\527\ As noted, there were
approximately 175 ARP incidents reported to the Commission in 2011.
Although some entities provide the public with notices of outages,\528\
others may choose otherwise and are not required to do so.
---------------------------------------------------------------------------

    \526\ See supra Section I.A.
    \527\ See supra note 368.
    \528\ See e.g., NYSE Market Status, available at: http://usequities.nyx.com/nyse/market-status; NYSE Amex Options Outage
Update, available at: http://www.nyse.com/pdfs/Trader_Update_Amex_Outage_0928.pdf; and NYSE Arca, Recap: Exchange Outage on
Monday Morning March 7, 2011, available at: http://www.nyse.com/pdfs/2011037ExchangeOutageNotice.pdf.
---------------------------------------------------------------------------

    Further, as discussed above, pursuant to Rule 301(b)(6) of
Regulation ATS, certain aspects of the ARP policy statements apply to
ATSs that meet the thresholds set forth in that rule.\529\ Currently,
no ATSs meet such thresholds and, as such, none are required by
Commission rule to implement systems safeguard measures. The Commission
recognizes that it is in the interest of every market participant that
does not participate in the ARP Inspection Program to try to avoid
systems disruptions. Specifically, the Commission understands that
generally, ATSs, like entities that currently participate in the ARP
Inspection Program, employ a variety of measures to avoid systems
disruptions, including systems testing, performance monitoring, and the
use of fail-over back-up systems. In fact, one ATS currently
voluntarily participates in the ARP Inspection Program.\530\ However,
inasmuch as the ARP Inspection Program and the testing done and other
measures taken by those entities that participate in the program have
been beneficial to the industry, the systems of SCI entities could
still be improved. For example, contingency planning in preparation of
catastrophic events has not been fully adequate, as evidenced in the
wake of Superstorm Sandy, when an extended shutdown of the equities and
options markets resulted from, among other things, the exchanges'
belief regarding the inability of some market participants to
adequately operate from the backup facilities of all market
centers.\531\ Although testing protocols were in place and the chance
to participate in such testing was available, not all members or
participants participated in such testing.\532\ Proposed Regulation SCI
would require that designated members or participants of an SCI entity
participate in scheduled functional and performance testing of the
operation of the SCI entity's business continuity and disaster recovery
plans, including its backup systems, and further require that SCI
entities coordinate the testing of such plans on an industry- or
sector-wide basis with other SCI entities. The Commission preliminarily
believes that these proposed requirements would mitigate the chances of
similar disruptions in the future.\533\
---------------------------------------------------------------------------

    \529\ Specifically, Rule 301(b)(6) of Regulation ATS applies to
ATSs that, during at least four of the preceding six months, had:
(A) With respect to any NMS stock, 20 percent or more of the average
daily volume reported by an effective transaction reporting plan;
(B) with respect to equity securities that are not NMS stocks and
for which transactions are reported to a self-regulatory
organization, 20 percent or more of the average daily volume as
calculated by the self-regulatory organization to which such
transactions are reported; (C) with respect to municipal securities,
20 percent or more of the average daily volume traded in the United
States; or (D) with respect to corporate debt securities, 20 percent
or more of the average daily volume traded in the United States. See
17 CFR 242.301(b)(6)(i).
    \530\ See supra note 91.
    \531\ See supra Section I.D; see also supra Section III.C.7.
    \532\ See supra Section I.D. In addition, the Commission
understands that the scope of testing was limited.
    \533\ See proposed Rule 1000(b)(9); see also supra Section
III.C.7.
---------------------------------------------------------------------------

b. Systems Compliance Issues
    Currently, systems compliance issues (as proposed to be defined in
Rule 1000(a)) are not covered by the ARP Inspection Program. However,
national securities exchanges are subject to Section 6(b) of the
Exchange Act, which requires an exchange to be organized and to have
the capacity to carry out the purposes of the Exchange Act and to
comply with the provisions of the Exchange Act, the rules and
regulations thereunder, and its own rules.\534\ FINRA is subject to
Section 15A(b) of the Exchange Act, which requires a national
securities association to be organized and have the capacity to carry
out the purposes of the Exchange Act and to comply with the provisions
of the

Exchange Act, the rules and regulations thereunder, the MSRB rules, and
its own rules.\535\ Further, an ATS could face Commission sanctions if
it fails to comply with relevant federal securities laws and rules and
regulations thereunder. Events such as those described above have
recently drawn attention to systems compliance issues.\536\ In part due
to the fact that systems compliance issues are not part of the ARP
Inspection Program, the Commission does not receive comprehensive data
regarding such issues and, thus, their incidence cannot be concretely
quantified. However, based on Commission staff's experience with SROs
and the rule filing process, the Commission estimates that there are
likely approximately seven systems compliance issues per SCI entity per
year.
---------------------------------------------------------------------------

    \534\ See 15 U.S.C. 78f(b).
    \535\ See 15 U.S.C. 78o-3(b).
    \536\ See, e.g., supra notes 62-63 and accompanying text.
---------------------------------------------------------------------------

c. Systems Intrusions
    In ARP I, the Commission stated its view that SROs should promptly
notify Commission staff of any instances in which unauthorized persons
gained or attempted to gain access to SRO systems.\537\ Market
participants employ a wide variety of measures to prevent and respond
to systems intrusions. Generally, market participants use measures such
as firewalls to prevent systems intrusions, and use detection software
to identify systems intrusions. Once an intrusion has been identified,
the affected systems typically would be isolated and quarantined, and
forensics would be performed. Several SCI entities have been the
subject of security issues in recent years.\538\ The Commission
believes that, currently, these events are rarely revealed to the
public or to the members or participants of SCI entities.
---------------------------------------------------------------------------

    \537\ See ARP I, supra note 1. See also text accompanying supra
note 17.
    \538\ For example, as discussed above, in February 2011, NASDAQ
OMX Group, Inc. announced that hackers had penetrated certain of its
computer networks. See supra note 61 and accompanying text.
---------------------------------------------------------------------------

2. Potential for Market Solutions
    This section discusses potential market solutions and their
shortcomings. Various SCI and non-SCI entities offer and compete to
provide services in markets for trading services, listing services,
regulatory services, clearance and settlement services, and market
data. The markets for each of these services are regulated and
competitive, which may make it difficult to determine if markets are
functioning well due to competitive pressure or regulation, and how
much can be attributed to each. However, there are limitations to such
competition and following is a discussion of some limitations that are
common to all of these markets. Notwithstanding what may be the
limitations to competition in each of these markets, the Commission is
also mindful, in evaluating whether, and if so, how, to regulate in
this space, of the need to craft rules that appropriately take into
account the tradeoffs between the resulting costs and benefits, and the
effects on efficiency, competition, and capital formation, that would
accompany such regulation.
    Market participants may be unaware when SCI events disrupt
transactions due to, for example, a lack of timely and consistently
disseminated information about SCI events. First, providers of services
that experience SCI events may lack the incentive to disclose such
events. Second, other providers of services may choose to not publicly
comment on the identity of providers who experienced SCI events.\539\
For example, providers of trading services may choose not to point to
other providers because the next SCI event may occur on their own
systems. In addition, a person or entity pointing at other providers
may be exposed to litigation risks.
---------------------------------------------------------------------------

    \539\ The Commission notes, however, that certain providers of
trading services do provide public disclosure of systems issues at
another provider. For example, when one trading venue perceives that
a second venue is non-responsive when orders are routed to that
second venue, the first venue will declare self-help under Rule 611
of Regulation NMS, which permits the first venue to cease to route
orders to the second venue in certain instances. Certain trading
venues would provide public notification of self-help. See, e.g.,
NASDAQ Market System Status, available at: http://www.nasdaqtrader.com/Trader.aspx?id=MarketSystemStatus.
---------------------------------------------------------------------------

    While some SCI events may not directly impact markets, they are
still an indication of the risk of SCI events at a given SCI entity. It
is likely that market participants assume that services operate as
promised until an SCI event occurs. Reputation and good experiences
with a trading venue may cause market participants to trust its
effectiveness. In the absence of problems, however, a system may be
assumed to be fully functional. Once a problem occurs, market
participants will update their prior assumptions and should correctly
infer that the system is not as robust as previously believed.
    Moreover, in the case of SCI events that disrupt the entire market
or large portions of it (e.g., the data outages during the flash crash
on May 6, 2010), all providers of trading services may be affected at
the same time and, as a result, market participants may find it
challenging to identify service providers with lower risks of such SCI
events. In light of the foregoing, members and participants of SCI
entities would be important recipients of information disseminated
about SCI events because they are the parties who would most naturally
need, want, and be able to act on the information and, where
applicable, share such disseminated information to other interested
market participants, as discussed further below.
a. Market for Trading Services
    Trading services are offered by entities that would meet the
definition of SCI entity, including equities exchanges, options
exchanges, and SCI ATSs, as well as by entities that would not be
included in the proposed definition of SCI entity, such as ATSs that
are not SCI ATSs, OTC market makers, and broker-dealers. As discussed
above in Section I.B, there are currently 13 national securities
exchanges that trade equity securities, with none having an overall
market share of greater than 20 percent.\540\ There are currently 11
national securities exchanges that trade options.\541\ Of these
exchanges, CBOE, ISE, and Nasdaq OMX Phlx have the most significant
market share.\542\ ATSs--both ECNs and dark pools--as well as OTC
market makers and broker-dealers also execute substantial volumes of
stocks and bonds.\543\
---------------------------------------------------------------------------

    \540\ See supra note 47 and accompanying text. These national
securities exchanges are: BATS; BATS-Y; CBOE; CHX; EDGA; EDGX;
Nasdaq OMX BX; Nasdaq OMX Phlx; Nasdaq; NSX; NYSE; NYSE MKT; and
NYSE Arca.
    \541\ These national securities exchanges are: BATS Exchange
Options Market; BOX; C2; CBOE; ISE; MIAX; NASDAQ Options Market;
Nasdaq OMX BX Options; Nasdaq OMX Phlx; NYSE Amex Options; and NYSE
Arca.
    \542\ Specifically, during 2012, CBOE had 26.46% of the market
share, Nasdaq OMX Phlx had 19.77%, and ISE had 15.78%. Calculated
using data regarding number of contracts traded from Options
Clearing Corporation, available at: http://www.theocc.com/market-data/volume/.
    \543\ As discussed above in Section III.B.1, the Commission
estimates that the proposed definition of ``SCI entity'' would
capture approximately 15 SCI ATSs (10 SCI ATSs in NMS stocks, two
SCI ATSs in non-NMS stocks, and three SCI ATSs in municipal
securities and corporate debt securities).
---------------------------------------------------------------------------

    With respect to the competitive nature of the market for trading
services, as well as the limitations to the competitive effects, all
providers of trading services compete and have incentives to avoid
systems disruptions, systems compliance issues, and systems intrusions
because, for example, brokers and other entities will be inclined to
route orders away from trading venues

that have frequent systems problems. Indeed, trading service providers
expend resources to provide quality services and attempt to mitigate
systems disruptions, systems compliance issues, and systems intrusions;
however, it is not clear how to distinguish between efforts
attributable to competitive pressures, rather than existing legal
requirements and regulatory programs such as the ARP Inspection
Program.\544\
---------------------------------------------------------------------------

    \544\ See also supra Section V.B.1, noting the various reasons
why SCI entities currently take action to address systems problems.
---------------------------------------------------------------------------

    The Commission recognizes that there may be limits with respect to
the extent to which competition ameliorates systems problems associated
with trading services. However, the Commission remains mindful of the
need to craft rules that appropriately take into account the tradeoffs
between the costs and benefits, and the effects on efficiency,
competition, and capital formation, associated with any such rules. The
Commission preliminarily believes that it is important for SCI entity
members or participants to know about risks for SCI events at a given
service provider. As discussed above, if information about SCI events
is not disseminated to members or participants of SCI entities or are
not attributable to specific SCI entities, market participants may
misjudge the quality of trading services or otherwise make decisions
without fully accounting for such risks. Furthermore, as evidenced by
the extended shutdown of the equities and options markets that resulted
from, among other things, the exchanges' belief regarding the inability
of some market participants to adequately operate from the backup
facilities of all market centers, contingency planning has not been
adequate to help prevent market-wide outages.\545\ For example, as
noted above, the NYSE offered its members the opportunity to
participate in testing of its backup systems, but not all members chose
to participate in such testing, and the Commission understands that the
scope of the test was limited.\546\
---------------------------------------------------------------------------

    \545\ See supra Section I.D.
    \546\ See supra Section I.D. See also supra notes 83 and 532 and
accompanying text.
---------------------------------------------------------------------------

    In addition, even though there are multiple trading venues,
suppliers of trading services may have limited ability to transact in
particular securities (e.g., certain index options may only trade on
one options exchange). As a result, competition in the market for
trading services may not sufficiently mitigate the occurrence of SCI
events, and there may be insufficient disclosure of information
regarding the quality of trading services offered by SCI entities.
b. Market for Listing Services
    Certain SCI entities are in the market for listing services. In
this market, exchanges compete to list issuers to collect listing fees
and to provide ancillary services to listed companies. The NYSE and
Nasdaq are the largest U.S. exchanges in terms of the number of equity
securities listed, with the NYSE and Nasdaq serving as the listing
market for 3,262 and 2,691 securities, respectively, as of February 4,
2013.\547\ U.S. exchanges face competition from other U.S. exchanges
and from non-U.S. exchanges.
---------------------------------------------------------------------------

    \547\ See NASDAQ Company List, available at: http://www.nasdaq.com/screening/company-list.aspx, for the list of
companies listed on NYSE and NASDAQ.
---------------------------------------------------------------------------

    Competition for listings may be limited by many factors. With
respect to the limitations of competitive forces in the market for
listing services, first, while a company can be listed on a certain
exchange, trading does not necessarily occur on that exchange. In fact,
the majority of trading occurs away from the listing exchange in
today's U.S. equities markets.\548\ Second, there are switching costs
associated with moving a listing from one exchange to another, which
may cause issuers to remain at their current exchange, even in response
to the occurrence of some SCI events. Third, certain exchanges also may
be considered more ``prestigious'' than others and, to this extent,
they may wield market power over other exchanges when competing for
issuers. As a result, these exchanges may not be properly incentivized
to provide the level of service they otherwise might if they were
subject to greater competition. Members and participants of SCI
entities that serve as underwriters to issuers would be important
recipients of information disseminated by SCI entities about
dissemination SCI events, particularly if they share such information
with issuers making listing decisions.
---------------------------------------------------------------------------

    \548\ See BATS Market Volume Summary, available at: http://www.batstrading.com/market_summary/ (displaying the dispersion of
trading in equity securities, which indicates that trading occurs
away from listing exchanges).
---------------------------------------------------------------------------

c. Market for Regulation and Surveillance Services
    Regulation and surveillance are required by statutes and rules and,
therefore, all regulated market participants (e.g., exchanges or ATSs)
have a demand for regulation and surveillance services. Suppliers in
this market may be in-house or third parties, and potentially include
all of the exchanges and FINRA. Because of regulatory services
agreements (``RSAs'') between FINRA and several national securities
exchanges, as of February 2011, FINRA's Market Regulation Department
was responsible for surveillance of 80 percent of the trading volume in
U.S. equity markets and 35 percent of the volume in U.S. options
markets.\549\ Also, in 2011, BATS and BATS-Y entered into RSAs with
CBOE as the supplier.\550\ On the other hand, some exchanges have not
entered into RSAs.
---------------------------------------------------------------------------

    \549\ See FINRA 2011 Annual Regulatory and Examination
Priorities Letter (February 8, 2011), available at: http://www.finra.org/web/groups/industry/@ip/<EMAIL_ADDRESS>    \550\ See BATS Global Markets, Inc., Amendment No. 5 to Form S-
1, dated March 21, 2012 (Registration No. 333-174166).
---------------------------------------------------------------------------

    There are other regulatory services arrangements in addition to
RSAs. For example, in 2008, the Commission declared effective a plan
for allocating regulatory responsibilities pursuant to Rule 17d-2,\551\
which among other things, allocated regulatory responsibility for the
surveillance, investigation, and enforcement of Common Rules \552\ over
Common NYSE Members,\553\ with respect to NYSE-listed stocks and NYSE
Arca-listed stocks, to NYSE and over Common FINRA Members,\554\ with
respect to NASDAQ-listed stocks, Amex-listed stocks, and any CHX
solely-listed stock, to FINRA.\555\
---------------------------------------------------------------------------

    \551\ See Securities Exchange Act Release No. 58536 (September
12, 2008), 73 FR 54646 (September 22, 2008). See also 17 CFR
240.17d-2 (permitting SROs to propose joint plans for the allocation
of regulatory responsibilities with respect to their common
members).
    \552\ Such rules include federal securities laws and rules
promulgated by the Commission pertaining to insider trading, and the
rules of the plan participants that are related to insider trading
as provided on Exhibit A to a Rule 17d-2 Plan. See Agreement for the
Allocation of Regulatory Responsibility of Surveillance,
Investigation and Enforcement for Insider Trading pursuant to Sec.
17(d) of the Securities Exchange Act of 1934, 15 U.S.C. Sec.
78q(d), and Rule 17d-2 thereunder.
    \553\ Common NYSE Members include those who are members of the
NYSE and of at least one of the plan participants. See id.
    \554\ Common FINRA Members include those who are members of
FINRA and of at least one of the plan participants. See id.
    \555\ Participants in this plan are: BATS, BATS-Y, CBOE, CHX,
EDGA, EDGX, FINRA, Nasdaq OMX BX, Nasdaq OMX Phlx, Nasdaq, NSX,
NYSE, NYSE Amex, and NYSE Arca. See id. In January 2011, this Rule
17d-2 plan was amended as a result of an agreement under which FINRA
assumed the responsibility for performing the market surveillance
and enforcement functions previously conducted by NYSE Regulation
for its U.S. equities and options markets. Under the plan, FINRA
charges participants a fee for the performance of regulatory
responsibilities. See Securities Exchange Act Release No. 63750
(January 21, 2011), 76 FR 4948 (January 27, 2011). There are other
types of Rule 17d-2 plans, including multilateral and bilateral
plans. While other SROs perform some regulatory functions under the
options-related market surveillance and Regulation NMS multiparty
17d-2 plans, FINRA provides the bulk of services under all other
17d-2 plans.

---------------------------------------------------------------------------

    With respect to limitations of competition that are specific to the
market for regulatory and surveillance services, if investors, issuers,
or other market participants become aware of SCI events by virtue of
the members or participants of SCI entities sharing information they
have received about dissemination SCI events, and such information
suggests that an SRO has low-quality regulation and surveillance, they
may avoid such venues since they may feel that their interests are not
being adequately protected. In the case of an RSA, there is competition
among providers of such services because the user of the service can
enter into a contract with a different provider. An SRO that purchases
regulatory and surveillance services pursuant to an RSA retains the
ultimate responsibility and liability for its self-regulatory
obligations, and has an interest in seeking a service provider that
would provide a high level of regulatory and surveillance
services.\556\ Since the purchaser of these services could face
Commission sanctions and experience damages to their reputation for
violations resulting from inadequate regulation and surveillance,
providers of these services may have the incentive to ensure that they
provide a high level of service.
---------------------------------------------------------------------------

    \556\ In contrast to an RSA, under Rule 17d-2(d) under the
Exchange Act, ``[u]pon the effectiveness of such a plan or part
thereof, any self-regulatory organization which is a party to the
plan shall be relieved of responsibility as to any person for whom
such responsibility is allocated under the plan to another self-
regulatory organization to the extent of such allocation.'' 17 CFR
240.17d-2(d).
---------------------------------------------------------------------------

    A factor that limits competition in this market is that it is
highly concentrated. As noted above, FINRA accounts for the
surveillance of 80 percent of trading volume in U.S. equity markets
and, although any SRO could potentially be a provider of such services,
not all choose to do so, and thus there may not be many alternatives
for RSAs. With respect to the market for Rule 17d-2 plans, the
Commission recognizes that the level of competition may be limited, as
Rule 17d-2 was intended to address regulatory duplication for broker-
dealers that are members of more than one SRO, and one of which is
usually FINRA.
d. Market for Clearance and Settlement Services
    Certain SCI entities are in the market for clearance and settlement
services. There are seven registered clearing agencies with active
operations--DTC, FICC, NSCC, OCC, ICE Clear Credit, ICE Clear Europe,
and CME \557\--as well as one exempt clearing agency.\558\ An SCI event
in this market could have very disruptive and widespread effects on the
financial markets. Because each clearing agency has a critical role in
the operation of a particular product market, clearing agencies may
already have heightened incentives to ensure that their systems have
adequate levels of capacity, integrity, resiliency, availability, and
security.\559\ At the same time, one of the major impediments to
competition in this market is that it is highly concentrated in
particular classes of securities (e.g., equities or options). This may
limit incentives for clearing agencies to have levels of capacity,
integrity, resiliency, availability, and security that are appropriate
for their role in the securities market. Thus, for the market for
clearance and settlement services, it is especially important for the
Commission and clearing agency participants to have current and
accurate information about SCI events to help ensure that the clearing
agencies are properly incentivized to provide high-quality service.
---------------------------------------------------------------------------

    \557\ As noted above, active registered clearing agencies are
part of the current ARP Inspection Program. See supra note 95 and
accompanying text.
    \558\ As noted above, Omgeo is part of the current ARP
Inspection Program. See supra notes 133-135 and accompanying text.
    \559\ See generally 2003 Interagency White Paper, supra note 31.
---------------------------------------------------------------------------

e. Market for Market Data
    Finally, certain SCI entities provide market data. There are two
different types of market data, namely consolidated data and
proprietary data. As discussed above, when Congress mandated a national
market system in 1975, it emphasized that the systems for collecting
and distributing consolidated market data would ``form the heart of the
national market system.'' \560\ Moreover, the Commission has identified
certain benefits of consolidated market data, including providing the
public with access to a comprehensive, accurate, and reliable source of
information for NMS stocks.\561\ One of the Commission's primary
concerns is that the market for consolidated data functions properly.
---------------------------------------------------------------------------

    \560\ See Concept Release on Equity Market Structure, supra note
42, at 3600 (quoting H.R. Rep. No. 94-229, 94th Cong., 1st Sess. 93
(1975)).
    \561\ See supra note 187 and accompanying text.
---------------------------------------------------------------------------

    Market data is a critical part of the investment and trading
process.\562\ The data is needed for pre- and post-trade transparency
and allows market participants to make well-informed investment and
trading decisions.\563\ Indeed, based on Commission staff experience,
the Commission understands that many trading algorithms make trading
decisions based primarily on market data and rely on that data being
current and accurate. An SCI event in connection with market data could
significantly disrupt markets.\564\
---------------------------------------------------------------------------

    \562\ See supra notes 187-189 and accompanying text.
    \563\ See id.
    \564\ For example, on January 3, 2013, Nasdaq reported that its
securities information processor (which is the plan processor of the
CQS Plan, an SCI plan) experienced ``an issue with stale data,''
which lasted approximately 10 to 15 minutes. See http://www.nasdaq.com/article/update-traders-report-technical-issue-involving-nasdaq-listed-securities-20130103-01046#.URutFaVEHmd. See
also http://www.reuters.com/article/2013/01/03/exchanges-data-outage-idUSL1E9C3DQL20130103. As a result, last sale and quotation
data was not available for Nasdaq-listed (``Tape C'') securities
during that time. See id. Although proprietary data feeds were
available, only subscribers receiving such feeds could continue
trading with current market data during the outage. Market centers
EDGA and EDGX temporarily suspended trading in all Tape C securities
in response to the outage. See id.
---------------------------------------------------------------------------

    The process of collecting and disseminating consolidated quotation
and transaction data is governed by the SCI plans. For securities
listed on Nasdaq, data distribution is governed by the Nasdaq UTP Plan.
For securities listed on NYSE, NYSE Amex, and several other exchanges,
data distribution is governed by the CTA Plan and the CQS Plan. For
options, data distribution is governed by the OPRA Plan. These SCI
plans also oversee the collection of fees for access to the
consolidated data network, and the allocation of the resulting revenue
across the exchanges. Currently, there are two entities designated as
plan processors by SCI plans--SIAC and Nasdaq.\565\ Due to the extreme
concentration in the market segment for consolidated data, there is
virtually no competition between SCI plan processors which could lead
to little incentive in ensuring a high-quality product with minimal
disruptions.
---------------------------------------------------------------------------

    \565\ See supra note 131.
---------------------------------------------------------------------------

3. Proposed Regulation SCI and Its Impact on Current Practices
    Proposed Regulation SCI would be a codification and enhancement of
the current ARP Inspection Program. As discussed further below with
respect to each of the proposed rules, proposed Regulation SCI would:
(A) Be mandatory and codify many aspects of the ARP policy statements;
(B) expand the scope of the ARP policy statements to other types of
systems and event types; and (C) expand the scope of the ARP Inspection
Program to other types of entities.

    With respect to different types of systems, as discussed in more
detail above, the ARP policy statements are focused on automated
systems.\566\ Specifically, entities that participate in the ARP
Inspection Program follow the ARP policy statements with respect to
systems that directly support trading, clearance and settlement, order
routing, and market data.\567\ Proposed Regulation SCI, on the other
hand, would apply to more types of systems than the ARP policy
statements. As discussed above, in addition to the systems covered by
the ARP Inspection Program, the proposed definition of ``SCI systems''
would also include systems that directly support regulation and
surveillance that are not currently part of the ARP Inspection Program.
Further, the provisions of proposed Regulation SCI relating to security
standards and systems intrusions would also apply to ``SCI security
systems,'' which would be defined to mean any systems that share
network resources with SCI systems that, if breached, would be
reasonably likely to pose a security threat to SCI systems.
---------------------------------------------------------------------------

    \566\ See supra Section I.A for more discussion of the ARP
policy statements and the ARP Inspection Program. According to ARP
I, the term ``automated systems'' or ``automated trading systems''
means computer systems for listed and OTC equities, as well as
options, that electronically route orders to applicable market
makers and systems that electronically route and execute orders,
including the data networks that feed the systems. The term
``automated systems'' also encompasses systems that disseminate
transaction and quotation information and conduct trade comparisons
prior to settlement, including the associated communication
networks. Moreover, ARP I states that because lack of adequate
communications capacity can be as damaging to the overall
performance of an exchange during peak periods as poorly designed
order processing, capacity tests of the data networks that feed the
computer systems also should be conducted. See ARP I, supra note 1,
at n.21.
    \567\ While generally only trading, clearance and settlement,
order routing, and market data systems follow the guidelines in the
ARP policy statements, ARP staff inspects all the categories of
systems that are included in the proposed definition of ``SCI
systems.'' However, ARP staff generally inspects systems that do not
directly support trading, clearance and settlement, order routing,
or market data only if staff detects red flags.
---------------------------------------------------------------------------

    Additionally, while the ARP Inspection Program and proposed
Regulation SCI both cover certain types of systems disruptions \568\
and systems intrusions,\569\ proposed Regulation SCI also would cover
systems compliance issues. Finally, the ARP Inspection Program includes
29 participants that are SCI entities, consisting of 17 registered
national securities exchanges, seven registered clearing agencies,
FINRA, two plan processors, one ATS, and one exempt clearing agency.
Because no ATSs currently satisfy the thresholds in Rule 306(b)(6)(i)
of Regulation ATS, no ATSs currently are subject to the systems
safeguard requirements of Regulation ATS \570\ although, as noted
above, one ATS voluntarily participates in the ARP Inspection Program.
Proposed Regulation SCI would include all of the entities currently
under the ARP Inspection Program. With respect to ATSs, proposed
Regulation SCI would include an estimated 10 SCI ATSs in NMS stocks, an
estimated two SCI ATSs in non-NMS stocks, an estimated three SCI ATSs
in municipal securities and corporate debt securities, and one SRO
(i.e., the MSRB).
---------------------------------------------------------------------------

    \568\ See 2001 Staff ARP Interpretive Letter, supra note 35. See
also supra Section III.B.3.a for a discussion of the differences
between the definition of ``significant system outage'' as used
currently in the ARP Inspection Program and the proposed definition
of ``systems disruption.''
    \569\ See ARP I, supra note 1, at 48707 (referring to instances
where unauthorized persons gained or attempted to gain access to
systems). Proposed Rule 1000(a) would define ``systems intrusion''
to mean any unauthorized entry into the SCI systems or SCI security
systems of the SCI entity.
    \570\ See 17 CFR 242.301(b)(6).
---------------------------------------------------------------------------

    Proposed Rules 1000(b)(4) and (b)(5) would require, respectively,
that all SCI events be reported to the Commission, and that information
relating to dissemination SCI events be disseminated to members or
participants of an SCI entity. Proposed Rule 1000(a) would define a
dissemination SCI event to mean an SCI event that is a: (1) Systems
compliance issue; (2) systems intrusion; or (3) systems disruption that
results, or the SCI entity reasonably estimates would result, in
significant harm or loss to market participants. Under the ARP
Inspection Program, only ``significant'' outages should be reported to
the Commission, and there are no quantitative standards to define
``significant'' outage. Similarly, proposed Regulation SCI would not
specify a quantitative standard for immediate notification SCI events
or dissemination SCI events. Instead, immediate notification SCI events
would include any systems disruption that the SCI entity reasonably
estimates would have a material impact on its operations or on market
participants, any systems compliance issue, and any systems intrusion.
With respect to dissemination SCI events, certain information about all
systems compliance issues and systems intrusions would be required to
be disseminated to members or participants, although information about
systems intrusions in some cases could be delayed. Systems disruptions
would also be dissemination SCI events, however, only if they result,
or the SCI entity reasonably estimates would result, in significant
harm or loss to market participants.
    Proposed Rule 1000(b)(1) (Capacity, Integrity, Resiliency,
Availability, and Security) addresses the capacity, integrity,
resiliency, availability, and security of the systems of SCI entities.
Rule 1000(b)(1) would require an SCI entity to establish, maintain, and
enforce written policies and procedures reasonably designed to ensure
that its SCI systems and, for purposes of security standards, SCI
security systems, have levels of capacity, integrity, resiliency,
availability, and security, adequate to maintain the SCI entity's
operational capability and promote the maintenance of fair and orderly
markets.
    Proposed Rule 1000(b)(1)(i) would further require that an SCI
entity's policies and procedures include the establishment of
reasonable current and future capacity planning estimates, periodic
capacity stress tests, a program to review and keep current systems
development and testing methodology, regular reviews and testing of
such systems, including backup systems, business continuity and
disaster recovery plans, and standards that result in systems that
facilitate the successful collection, processing, and dissemination of
market data. The items in proposed Rule 1000(b)(1)(i)(A)-(E) are the
same as those in the ARP Inspection Program and Rule 301(b)(6) of
Regulation ATS.\571\
---------------------------------------------------------------------------

    \571\ See supra Section III.C.1 for a detailed discussion of
proposed Rule 1000(b)(1), including comparisons to the provisions of
the ARP Inspection Program.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(1)(ii) would further provide that an SCI
entity's policies and procedures would be deemed to be reasonably
designed if they are consistent with current SCI industry
standards.\572\ The Commission preliminarily believes that SCI entities
would be familiar with such standards because they would be required to
be widely available for free to information technology professionals in
the financial sector, and must be issued by an authoritative body that
is a U.S. governmental entity or agency, association of U.S.
governmental entities or agencies, or widely recognized
organization.\573\ As noted above, compliance with the identified SCI
industry standards would not be the exclusive means to comply with the

requirements of proposed Rule 1000(b)(1).
---------------------------------------------------------------------------

    \572\ See proposed Rule 1000(b)(1)(ii).
    \573\ See infra text commencing at note 630, discussing examples
of SCI industry standards that may originate from NIST publications
and/or other publications listed in Table A, and the potential costs
they may impose on SCI entities.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(2)(i) (Systems Compliance) is not currently
part of the ARP Inspection program and would require each SCI entity to
establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems operate in the
manner intended, including in a manner that complies with the federal
securities laws and rules and regulations thereunder and the entity's
rules and governing documents, as applicable.\574\
---------------------------------------------------------------------------

    \574\ However, as noted above in Section V.B.1.b, SCI entities
are already required to comply with relevant laws and rules.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(3) (Corrective Action) would require that,
upon any responsible SCI personnel becoming aware of an SCI event, an
SCI entity begin to take appropriate corrective action. The Commission
understands that market participants already take steps to address
systems issues should they occur, but preliminarily believes that
proposed Rule 1000(b)(3) may result in SCI entities incurring
additional information technology costs, primarily because proposed
Rule 1000(b)(3) requires each SCI entity, upon any responsible SCI
personnel becoming aware of an SCI event, to begin to take appropriate
corrective action. Thus, SCI entities would not be able to delay the
start of taking corrective action, which in turn could result in some
SCI entities potentially seeking to, for example, update their systems
with newer technology earlier than they might have otherwise. As these
increased costs would likely occur primarily as a result of SCI
entities making usual and customary investments sooner than they would
otherwise, these costs are difficult to quantify.
    Proposed Rule 1000(b)(4) (Commission Notification) would require
that an SCI entity notify the Commission of all SCI events. Proposed
Rule 1000(b)(4) would apply to more entities, systems, and types of
systems issues than the ARP policy statements (or the 2001 Staff ARP
Interpretive Letter) and also require more detailed reporting to the
Commission.\575\
---------------------------------------------------------------------------

    \575\ See discussion of proposed Rule 1000(b)(4) in supra
Section III.C.4. In addition, proposed Rule 1000(d) would require,
with limited exception, that any written notification, review,
description, analysis, or report to the Commission be submitted
electronically on Form SCI.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(5) (Dissemination of Information to Members
or Participants) would require an SCI entity to disseminate information
relating to dissemination SCI events to members or participants.
Proposed Rule 1000(b)(5) would impose a new requirement that is not
currently part of the ARP Inspection Program. As noted above in Section
V.B.1.a, some entities provide their members or participants with
notices of outages currently. However, although proposed Rule
1000(b)(5) would permit information regarding some systems intrusions
to be delayed,\576\ the Commission expects that dissemination of
information to members or participants about dissemination SCI events
would increase significantly.
---------------------------------------------------------------------------

    \576\ See proposed Rule 1000(b)(5)(ii).
---------------------------------------------------------------------------

    With respect to proposed Rule 1000(b)(6) (Material Systems
Changes), while entities may voluntarily submit similar material
systems change notifications to the Commission under the ARP Inspection
Program, proposed Regulation SCI would set forth more detailed
requirements.\577\ Proposed Rule 1000(b)(6) would require an SCI entity
to notify the Commission of planned material systems changes on
proposed Form SCI at least 30 calendar days in advance of such change,
unless exigent circumstances exist or information previously provided
to the Commission regarding a planned material systems change has
become materially inaccurate, necessitating notice regarding a material
systems change with less than 30 calendar days' notice.
---------------------------------------------------------------------------

    \577\ See supra Sections III.C.4 and III.E.2 discussing the
reporting requirements in proposed Rule 1000(b)(6).
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(7) (SCI Review) would require an SCI entity
to conduct an SCI review of its compliance with Regulation SCI at least
annually, and submit a report of the SCI review to senior management of
the SCI entity for review no more than 30 calendar days after
completion of the SCI review. Because systems reviews have always been
part of the ARP Inspection Program, the Commission believes that most
SCI entities currently undertake annual systems reviews, reports of
which the Commission understands are reviewed by senior management. The
Commission believes, however, that the scope of the systems review
undertaken by ARP entities, and senior management involvement in in
such reviews, varies among ARP entities. The Commission expects that
proposed Regulation SCI, which defines the parameters of an SCI review,
would foster greater consistency in the approach that SCI entities take
with respect to systems reviews.
    Proposed Rule 1000(b)(8) (Reports) would require an SCI entity to
submit various reports to the Commission. Specifically, proposed Rule
1000(b)(8)(i) would require an SCI entity to submit a report of the SCI
review required by proposed Rule 1000(b)(7), together with any response
by senior management, within 60 calendar days after its submission to
senior management of the SCI entity. Proposed Rule 1000(b)(8)(ii) would
require an SCI entity to submit a report, within 30 calendar days after
the end of June and December of each year, containing a summary
description of the progress of any material systems change during the
six-month period ending on June 30 or December 31, as the case may be,
and the date, or expected date, of completion of implementation of such
changes. Such reports to be filed with the Commission pursuant to
proposed Rule 1000(b)(8) would be required to be filed electronically
on Form SCI. Proposed Rule 1000(b)(8) would codify current practice
under the ARP Inspection Program, in which ARP entities submit reports
of systems reviews and report progress on material systems changes to
ARP staff. However, proposed Rule 1000(8) would specify a more detailed
process for submission of such reports.
    Proposed Rule 1000(b)(9) (SCI Entity Business Continuity and
Disaster Recovery Plans Testing Requirements for Members or
Participants) is not part of the current ARP Inspection Program and
would require an SCI entity, with respect to its business continuity
and disaster recovery plans, including its backup systems, to require
participation by designated members or participants in scheduled
functional and performance testing of the operation of such plans, in
the manner and frequency as specified by the SCI entity, at least once
every 12 months. In addition, the proposed rule would require an SCI
entity to coordinate such testing on an industry- or sector-wide basis
with other SCI entities.\578\ Further, the proposed rule would require
each SCI entity to designate those members or participants it deems
necessary, for the maintenance of fair and orderly markets in the event
of the activation of its business continuity and disaster recovery
plans, to participate in the testing of such plans. Each SCI entity
would be required to notify the Commission of such designations and its
standards for designation, and promptly update such notification after
any changes to its designations or standards. Although nothing prevents
SCI entities from doing so, the Commission currently does not mandate
that members or participants of SCI entities test the business
continuity and disaster recovery plans, including

backup systems, of SCI entities. This proposed rule would allow greater
oversight by the Commission over the business continuity and disaster
recovery capabilities of SCI entities. While the Commission believes
that many SCI entities currently provide the opportunity for their
members or participants to test their business continuity and disaster
recovery plans, the Commission believes that few require participation
by all or designated members or participants in such testing.\579\ In
addition, the Commission understands that, to the extent such
participation occurs, it may in many cases be limited in nature (e.g.,
testing for connectivity to backup systems). Finally, while the
securities industry does coordinate certain testing, the Commission
believes that the two-day closure of the equities and options markets
in the wake of Superstorm Sandy has shown that more significant testing
and better coordination of such testing could benefit market
participants.\580\
---------------------------------------------------------------------------

    \578\ See supra note 269 and accompanying text.
    \579\ See infra note 641.
    \580\ See supra Section I.D.
---------------------------------------------------------------------------

    Proposed Rules 1000(c) and (e) relate to the recordkeeping
requirements under proposed Regulation SCI. As discussed above, SCI
SROs already are subject to recordkeeping requirements that would apply
to all documents relating to their compliance with proposed Regulation
SCI.\581\ Further, entities that participate in the ARP Inspection
Program currently keep records related to the ARP Inspection Program,
and the Commission recognizes that all SCI entities are subject to some
recordkeeping requirement. Nevertheless, with respect to SCI entities
other than SCI SROs, proposed Rules 1000(c) and (e) would impose
specific recordkeeping requirements with respect to documents related
to compliance with Regulation SCI and thus would impose a burden on
such entities.
---------------------------------------------------------------------------

    \581\ See supra Section III.D.1.
---------------------------------------------------------------------------

    Lastly, proposed Rule 1000(f) would require SCI entities to provide
Commission representatives reasonable access to its SCI systems and SCI
security systems to allow Commission representatives to assess the
entity's compliance with proposed Regulation SCI. As discussed above,
although the Commission believes that Section 17(b) of the Exchange Act
already provides the Commission with authority to access the systems of
SCI entities, the Commission is proposing Rule 1000(f) to highlight
such authority and help ensure that Commission representatives have
ready access to systems of SCI entities.\582\
---------------------------------------------------------------------------

    \582\ See supra Section III.D.3.
---------------------------------------------------------------------------

C. Consideration of Costs and Benefits, and the Effect on Efficiency,
Competition, and Capital Formation

    Section 3(f) of the Exchange Act requires the Commission, whenever
it engages in rulemaking pursuant to the Exchange Act and is required
to consider or determine whether an action is necessary or appropriate
in the public interest, to consider, in addition to the protection of
investors, whether the action would promote efficiency, competition,
and capital formation.\583\ In addition, Section 23(a)(2) of the
Exchange Act requires the Commission, when making rules under the
Exchange Act, to consider the impact such rules would have on
competition.\584\ Exchange Act Section 23(a)(2) prohibits the
Commission from adopting any rule that would impose a burden on
competition not necessary or appropriate in furtherance of the purposes
of the Exchange Act.\585\ In considering these matters, the Commission
has been mindful of the history and background discussed above and has
considered the impact proposed Regulation SCI would have on
competition, and preliminarily believes that proposed Regulation SCI
would promote efficiency, competition, and capital formation, and would
not impose a burden on competition not necessary or appropriate in
furtherance of the purposes of the Exchange Act.
---------------------------------------------------------------------------

    \583\ 15 U.S.C. 78c(f).
    \584\ 15 U.S.C. 78w(a)(2).
    \585\ 15 U.S.C. 78w(a)(2).
---------------------------------------------------------------------------

1. Summary of Benefits, Costs and Quantification
    While the current practices of some SCI entities already satisfy
some of the requirements of proposed Regulation SCI, the Commission
preliminarily believes proposed Regulation SCI could benefit the U.S.
financial markets in several ways. The Commission preliminarily
believes that Regulation SCI should result in fewer systems
disruptions, systems compliance issues, and systems intrusions. It
should also increase the information available to the Commission
regarding any systems disruptions, systems compliance issues, and
systems intrusions that do occur. In addition, it should increase the
information available to members or participants of SCI entities
regarding dissemination SCI events. As explained further below, such
disseminations of information could promote the ability of market
participants to assess the operation of markets because events would be
more transparent. The changes also could reduce market participants'
search costs, ultimately improving the ability of competition to
discourage SCI events and potentially improving the allocative
efficiency of capital. To the extent that Regulation SCI promotes the
allocation of capital to its most efficient uses, the Commission
preliminarily believes that Regulation SCI may promote capital
formation.\586\ The potential economic costs of proposed Regulation SCI
include compliance costs, which the Commission attempts to quantify,
and other costs. Such other costs include costs associated with the
increase in costs and time needed to make systems changes to comply
with new and amended rules and regulations, the impact on innovation,
and barriers to entry.\587\
---------------------------------------------------------------------------

    \586\ The Commission notes, however, that whether there is
ultimately an effect on capital formation will depend, in part, on
the degree of the potential effects on allocative efficiency.
    \587\ See infra Section V.C.3.b.
---------------------------------------------------------------------------

    The Commission discusses below a number of costs and benefits that
are related to proposed Regulation SCI. Many of these costs and
benefits are difficult to quantify with any degree of certainty,
especially as the practices of market participants are expected to
evolve and appropriately adapt to changes in technology and market
developments. In addition, the extent to which the proposed rule's
standards and the ability to enforce such standards will help reduce
the frequency and severity of SCI events is unknown. Therefore, much of
the discussion is qualitative in nature but, where possible, the
Commission quantifies the costs.
    Many, but not all, of the costs of the proposed rules involve a
collection of information, and these costs and burdens are discussed in
the Paperwork Reduction Act Section above.\588\ When monetized, those
estimated burdens and costs for SCI entities total approximately $44
million in initial costs and approximately $37 million in annual
ongoing costs. In addition, in the Economic Cost Section below,\589\
the

Commission has quantified other costs for SCI entities that total
between approximately $17.6 million \590\ and $132 million \591\ in
initial costs and between $11.7 million \592\ and $88 million \593\ in
annual ongoing costs. When aggregated, the total quantified costs for
SCI entities are estimated as between approximately $61.6 million \594\
and $176 million \595\ in initial costs and between $48.7 million \596\
and $125 million \597\ in annual ongoing costs. In addition to the
costs to SCI entities, the Commission also preliminarily estimates the
total costs to members or participants of SCI entities to participate
in the business continuity and disaster recovery plans testing
specified by proposed Rule 1000(b)(9) to be $66 million annually.\598\
Thus, the total quantified costs for SCI entities and members or
participants of SCI entities are estimated as between approximately
$127.6 million \599\ and $242 million \600\ in initial costs and
between $114.7 million \601\ and $191 million \602\ in annual ongoing
costs. A detailed discussion of other potential economic costs of the
proposal, such as potential costs to the Commission and potential
burdens on competition, is provided below.
---------------------------------------------------------------------------

    \588\ See supra Section IV.
    \589\ See infra Section V.C.4.a (estimating the cost for: (i)
Complying with the substantive requirements that are the subject of
the policies and procedures required by proposed Rules 1000(b)(1)
and (2), including consistency with SCI industry standards (which,
solely for purposes of this Economic Analysis, would be the proposed
SCI industry standards contained in the publications identified in
Table A); (2) establishing and maintaining a methodology for
ensuring that the SCI entity is prepared for the corrective action
requirement under proposed Rule 1000(b)(3); and (iii) establishing
and maintaining a methodology for determining whether an SCI event
is an immediate notification SCI event or a dissemination SCI
event).
    \590\ See infra note 634 (estimating cost for complying with the
substantive requirements underlying policies and procedures required
by proposed Rules 1000(b)(1) and (2)).
    \591\ See infra note 635 (estimating cost for complying with the
substantive requirements underlying policies and procedures required
by proposed Rules 1000(b)(1) and (2)).
    \592\ See infra note 639 (estimating cost for complying with the
substantive requirements underlying policies and procedures required
by proposed Rules 1000(b)(1) and (2)).
    \593\ See infra note 640 (estimating cost for complying with the
substantive requirements underlying policies and procedures required
by proposed Rules 1000(b)(1) and (2)).
    \594\ $61.6 million = $44 million (PRA cost) + $17.6 million
(other costs for SCI entities).
    \595\ $176 million = $44 million (PRA cost) + $132 million
(other costs for SCI entities).
    \596\ $48.7 million = $37 million (PRA cost) + $11.7 million
(other costs for SCI entities).
    \597\ $125 million = $37 million (PRA cost) + $88 million (other
costs for SCI entities).
    \598\ See infra note 643 and accompanying text.
    \599\ $127.6 million = $44 million (PRA cost) + $17.6 million
(other costs for SCI entities) + $66 million (costs for members or
participants of SCI entities).
    \600\ $242 million = $44 million (PRA cost) + $132 million
(other costs for SCI entities) + $66 million (costs for members or
participants of SCI entities).
    \601\ $114.7 million = $37 million (PRA cost) + $11.7 million
(other costs for SCI entities) + $66 million (costs for members or
participants of SCI entities).
    \602\ $191 million = $37 million (PRA cost) + $88 million (other
costs for SCI entities) + $66 million (costs for members or
participants of SCI entities).
---------------------------------------------------------------------------

2. Economic Benefits
    Broadly, although the current practices of some SCI entities
already satisfy some of the requirements of proposed Regulation SCI,
the Commission preliminarily believes that proposed Regulation SCI
would bring several overarching benefits to the securities markets.
First and most significantly, the Commission preliminarily believes
that proposed Regulation SCI would promote more robust systems and
hence fewer systems disruptions and market-wide closures, systems
compliance issues, and systems intrusions. As a result, the Commission
expects fewer interruptions to SCI systems, including systems that
directly support execution facilities, matching engines, and the
dissemination of market data, and fewer errors with the pricing of
securities, which should promote price efficiency. The Commission also
expects fewer interruptions to other SCI systems, including systems
that directly support regulatory systems and surveillance systems,
which should help ensure compliance with relevant laws and rules. In
addition, the Commission would expect fewer interruptions to SCI
security systems, which should help prevent problems that could lead to
disruption of an SCI entity's general operations and, ultimately, its
market-related activities.\603\
---------------------------------------------------------------------------

    \603\ See supra Section III.B.2, discussing the Commission's
proposed definitions of SCI systems and SCI security systems.
---------------------------------------------------------------------------

    Second, the Commission preliminarily believes that proposed
Regulation SCI would enhance the availability of relevant information
to members or participants of SCI entities and promote dissemination of
information to persons (i.e., members or participants of SCI entities)
who are most directly affected by dissemination SCI events and who
would most naturally need, want, and be able to act on the information.
The increased availability of information regarding SCI events should
reduce the costs to members or participants of SCI entities when
evaluating SCI entities and improve their ability to make more informed
decisions about whether or not to avoid dealing with entities that
experience significant systems issues. This enhanced information, as
well as the improved price efficiency, should lead to greater
allocative efficiency of capital. Moreover, it is expected that the
increased awareness of dissemination SCI events would enhance
competition among SCI entities with respect to the maintenance of
robust systems.
    Third, the Commission preliminarily believes that fewer market-
wide, unscheduled shutdowns would have many of the same benefits as
avoidance of temporary shutdowns, but on a greater scale. Fourth, the
Commission preliminarily believes that its own ability to monitor the
markets and ensure their smooth functioning would be significantly
enhanced by proposed Regulation SCI. These potential benefits are
discussed in more detail below in relation to each of the proposed
rules.
a. Rule 1000(a) Definitions
    In general, the definitions in Rule 1000(a) either clarify a
provision or circumscribe the scope of a provision in proposed
Regulation SCI. Therefore, many of the costs and benefits associated
with the impacts of the definitions are incorporated in the discussion
below on the costs and benefits of the substantive provisions where the
definitions are used.
    This section contains a discussion of the benefits of the expansion
in scope that are not discussed above. In summary, the Commission
preliminarily believes that the proposed definition of ``SCI entity''
and ``SCI event,'' although they would broaden the scope of Regulation
SCI beyond the scope of the ARP Inspection Program, are essential parts
of proposed Regulation SCI.
i. SCI Entities
    As explained above, the difference between the entities that
currently participate in the ARP Inspection Program and the entities
covered by proposed Regulation SCI is the inclusion of additional ATSs
and the MSRB. Because no ATSs currently meet the thresholds specified
in Rule 301(b)(6) of Regulation ATS, other than the one ATS that
currently participates in the ARP Inspection Program, none are subject
to the systems safeguard requirements under that rule even though they
comprise a significant portion of consolidated volume.\604\ The
Commission preliminarily believes that the inclusion of SCI ATSs under
proposed Regulation SCI would help ensure that ATSs, which serve as
markets to bring buyers and sellers together in the national market
system, are subject to rules regarding systems capacity, integrity,
resiliency, availability, security, and compliance, including those
rules that could help prevent SCI events and that require Commission
reporting and the dissemination of information to

members or participants of SCI entities.\605\ The Commission
preliminarily believes that the inclusion of the MSRB in proposed
Regulation SCI would provide benefits to the market because, as noted
above, the MSRB is the only SRO relating to municipal securities and
the sole provider of consolidated market data for the municipal
securities market.\606\
---------------------------------------------------------------------------

    \604\ As noted above, one ATS voluntarily participates in the
ARP Inspection Program. See supra note 25.
    \605\ Proposed Regulation SCI would not expand the types of
securities currently covered by the ARP Inspection Program and Rule
301(b)(6) of Regulation ATS. The Commission recognizes that although
currently no ATSs are subject to the systems safeguard requirements
under Rule 301(b)(6) because they do not satisfy the thresholds in
that rule, the Commission estimates that approximately 15 ATSs would
be subject to proposed Regulation SCI.
    \606\ As discussed above, in 2008, the Commission amended Rule
15c2-12 to designate the MSRB as the single centralized disclosure
repository for continuing municipal securities disclosure. In 2009,
the MSRB established EMMA, which serves as the official repository
of municipal securities disclosure, providing the public with free
access to relevant municipal securities data, and is the central
database for information about municipal securities offerings,
issuers, and obligors. Additionally, the MSRB's RTRS, with limited
exceptions, requires municipal bond dealers to submit transaction
data to the MSRB within 15 minutes of trade execution, and such near
real-time post-trade transaction data can be accessed through the
MSRB's EMMA Web site. See supra note 96.
---------------------------------------------------------------------------

ii. Systems and SCI Events
    As stated above, proposed Regulation SCI would expand on current
practice, would apply a broader range of systems, and would include
more event types. Specifically, entities that participate in the ARP
Inspection Program follow the ARP policy statements with respect to
systems that directly support trading, clearance and settlement, order
routing, and market data. The proposed definition of ``SCI systems''
would include the foregoing systems as well as those that directly
support regulation and surveillance. The Commission preliminarily
believes that including regulation and surveillance systems could help
ensure the SCI entity's ability to monitor its compliance with relevant
laws, rules, and its own rules, and detect any violations of such laws
or rules. Further, the provisions of proposed Regulation SCI regarding
systems security and intrusions also would apply to ``SCI security
systems.'' \607\ Because SCI security systems may present potentially
vulnerable entry points to an SCI entity's network, the Commission also
preliminarily believes that it is important for proposed Regulation SCI
to include those systems with respect to security standards and systems
intrusions.\608\
---------------------------------------------------------------------------

    \607\ See supra Section III.B.2, discussing the Commission's
proposed definitions of SCI systems and SCI security systems.
    \608\ See id.
---------------------------------------------------------------------------

    By defining SCI events to include systems disruptions, systems
compliance issues, and systems intrusions, proposed Regulation SCI
would further assist the Commission in its oversight of SCI entities.
As stated above, SCI entities already follow practices similar to parts
of proposed Regulation SCI for certain systems disruptions and systems
intrusions. The inclusion of systems compliance issues should help the
Commission and market participants to become better informed of the
efforts of the SCI entities to comply with relevant laws and rules, and
their own rules as applicable, and could enhance the enforcement of
such laws and rules. Further, by defining a dissemination SCI event to
include a subset of SCI events (i.e., a systems compliance issue,
systems intrusion, or systems disruption that would result, or the SCI
entity reasonably estimates would result in significant harm or loss to
market participants), proposed Regulation SCI would further assist SCI
entity members or participants in their decisions regarding whether or
not to utilize the systems of a given SCI entity.
b. Rule 1000(b)(1)-(10) Requirements for SCI Entities
    The development and growth of automated electronic trading have
allowed increasing volumes of securities transactions across the
multitude of trading centers that constitute the U.S. national market
system. These securities transactions take place within an
interconnected market where systems disruptions, systems compliance
issues, and systems intrusions at one market center can impact or harm
trading throughout the entire national market system. Thus, there is a
need for operators of significant market systems, such as SCI entities,
to have in place robust systems to prevent systems issues or, in the
event that systems issues occur, to recover quickly.
    Proposed Rule 1000(b)(1)-(2) would set forth requirements relating
to written policies and procedures that SCI entities would be required
to establish, maintain, and enforce. Proposed Rule 1000(b)(1) would
require an SCI entity to establish, maintain, and enforce written
policies and procedures reasonably designed to ensure that its SCI
systems and, for purposes of security standards, SCI security systems,
have levels of capacity, integrity, resiliency, availability, and
security, adequate to maintain the SCI entity's operational capability
and promote the maintenance of fair and orderly markets.
    The rule would further provide that an SCI entity's policies and
procedures must include the establishment of reasonable current and
future capacity planning estimates, periodic capacity stress tests, a
program to review and keep current systems development and testing
methodology of such systems, regular reviews and testing of such
systems, including backup systems, business continuity and disaster
recovery plans, and standards that result in such systems facilitating
the successful collection, processing, and dissemination of market
data.\609\ As discussed above, the Commission regards SCI entities as
part of the critical infrastructure of the U.S. securities markets and
therefore, although proposed Rule 1000(b)(1)(i)(A)-(E) would codify
certain provisions of the ARP policy statements, the Commission
preliminarily believes that specifically setting forth these
requirements in a Commission rule would benefit the securities markets
by helping to diminish the risks and incidences of systems intrusions,
systems compliance issues, and systems disruptions. Such policies and
procedures should also assist in speedy recoveries from systems
intrusions, systems compliance issues, and systems disruptions.
Proposed Rule 1000(b)(1)(i)(F) does not have precedent in Regulation
ATS or the ARP policy statements, and would require SCI entities to
have standards that result in such systems being designed, developed,
tested, maintained, operated, and surveilled in a manner that
facilitates the successful collection, processing, and dissemination of
market data. The Commission preliminarily believes that this proposal
should help to ensure that timely and accurate market data is available
to all market participants.
---------------------------------------------------------------------------

    \609\ See proposed Rule 1000(b)(1)(i)(A)-(F), discussed in supra
Section III.C.1.a.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(1)(ii) would deem an SCI entity's policies
and procedures required by proposed Rule 1000(b)(1) to be reasonably
designed if they are consistent with current SCI industry
standards.\610\ Thus, the SCI industry standards would provide
flexibility to allow each SCI entity to determine how to best meet the
requirements in proposed Rule 1000(b)(1), taking into account, for
example, its nature, size, technology, business model, and other
aspects of its business, because compliance with SCI

industry standards would not be the exclusive means by which an SCI
entity could satisfy the requirements of proposed Rule 1000(b)(1).
---------------------------------------------------------------------------

    \610\ Proposed SCI industry standards are contained in the
publications that are set forth in Table A. See supra Section
III.C.1.b.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(2)(i), which would require written policies
and procedures reasonably designed to ensure that an SCI entity's SCI
systems operate in the manner intended, should help to minimize
instances where systems do not operate in compliance with the federal
securities laws and rules and regulations thereunder and, as
applicable, the entity's rules and governing documents. In particular,
the elements of the safe harbor for SCI entities in proposed Rule
1000(b)(2)(ii)(A) relating to policies and procedures on testing and
monitoring also should help to ensure, on an ongoing basis, that an SCI
entity's SCI systems operate in the manner intended, including in a
manner that complies with the federal securities laws and rules and
regulations thereunder and, as applicable, the entity's rules and
governing documents, thus minimizing systems compliance issues and
consequently the total time needed to bring a system back into
compliance.\611\ In addition, the elements of the safe harbor in
proposed Rule 1000(b)(2)(ii)(A) relating to policies and procedures for
systems compliance assessments by personnel familiar with applicable
laws and rules and systems reviews by regulatory personnel should help
ensure the performance of effective compliance audits and reviews, and
should help provide assurance that SCI entities are operating in
compliance with applicable laws and rules.
---------------------------------------------------------------------------

    \611\ As noted above, the Commission recognizes that SCI
entities are already required to comply with federal securities
laws, rules and regulations thereunder, and their own rules.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(3), which would require an SCI entity to
begin taking appropriate corrective action upon any responsible SCI
personnel becoming aware of an SCI event, should further help ensure
that SCI entities invest sufficient resources as soon as reasonably
practicable to address systems intrusions, systems compliance issues,
and systems disruptions.\612\
---------------------------------------------------------------------------

    \612\ As noted above, the Commission believes that SCI entities
already take corrective actions in response to systems issues.
---------------------------------------------------------------------------

    Moreover, proposed Rules 1000(b)(1)-(3) should improve price
efficiency by reducing the likelihood and duration of systems issues,
thereby helping to avoid the price inefficiencies that occur during
times when systems disruptions, systems compliance issues, or systems
intrusions can make systems unavailable or unreliable. Specifically,
systems issues that could impact the accuracy or the timeliness, and
thus the reliability, of market data could lead to inaccuracies in
pricing and slow-down pricing, and make data less reliable. Therefore,
to the extent that proposed Rules 1000(b)(1)-(3) could reduce the
likelihood or duration of systems issues, they may lead to more
reliable market data (because there would be less inaccuracies and the
market data would be more timely), which could help improve the quality
of market data. This, in turn, could enhance price efficiency in the
market for market data, which then could promote allocative efficiency
of capital and capital formation.
    Proposed Regulation SCI is intended, in part, to facilitate the
Commission's ability to monitor the impact on the securities markets by
SCI entities' systems that support the performance of the entities'
activities. The Commission preliminarily believes that proposed Rules
1000(b)(1)-(3), as well as 1000(b)(4), would provide for more effective
Commission oversight of the operation of the systems of SCI entities.
    Specifically, while entities that participate in the ARP Inspection
Program already notify Commission staff of certain systems issues, the
Commission preliminarily believes that proposed Rule 1000(b)(4),
relating to Commission notification of SCI events, should further
enhance the effectiveness of Commission oversight of the operation of
SCI entities. Under the proposed rule, upon any responsible SCI
personnel becoming aware of an immediate notification SCI event,\613\
an SCI entity would be required to notify the Commission of the SCI
event. Within 24 hours of any responsible SCI personnel becoming aware
of an SCI event, an SCI entity would be required to submit a written
notification pertaining to such SCI event on Form SCI. Until such time
as the SCI event is resolved, the SCI entity would be required to
provide updates regularly, or at such frequency as requested by an
authorized representative of the Commission. Although this process
would represent costs to an SCI entity,\614\ the documentation of SCI
events will help prevent such systems failures from being dismissed or
ignored as glitches or momentary issues because it would focus the SCI
entity's attention on the issue and encourage allocation of SCI entity
resources to resolve the issue as soon as reasonably practicable.
---------------------------------------------------------------------------

    \613\ See supra Section III.C.3.b.
    \614\ See supra Section IV.D.2.a.
---------------------------------------------------------------------------

    As noted above, the Commission is concerned that members or
participants of SCI entities may be unaware of the occurrence of some
SCI events, and therefore may make decisions without all relevant
information. Proposed Rule 1000(b)(5) would require an SCI entity, upon
any responsible SCI personnel becoming aware of a dissemination SCI
event other than a systems intrusion, to disseminate certain
information regarding the dissemination SCI event to its members or
participants.\615\ Such information would include the systems affected
by the event and a summary description of the event. When known, the
SCI entity would be required to further disseminate to its members or
participants: a detailed description of the SCI event; its current
assessment of the types and number of market participants potentially
affected by the SCI event; and a description of the progress of its
corrective action for the SCI event and when the SCI event has been or
is expected to be resolved. An SCI entity also would be required to
provide regular updates to members or participants regarding the
disseminated information. The Commission preliminarily believes that
proposed Rule 1000(b)(5) would help market participants--specifically
the members or participants of SCI entities--to better evaluate the
operations of SCI entities based on more readily available information.
---------------------------------------------------------------------------

    \615\ For a dissemination SCI event that is a systems intrusion,
an SCI entity must disseminate to members or participants a summary
description of the systems intrusion, including a description of the
corrective action taken by the SCI entity and when the systems
intrusion has been or is expected to be resolved, unless it
determines that dissemination of such information would likely
compromise the security of the SCI entity's SCI systems or SCI
security systems, or an investigation of the systems intrusion.
---------------------------------------------------------------------------

    As discussed above,\616\ the Commission believes that the existing
competition among the markets has not sufficiently mitigated the
occurrence of certain systems problems, and thus preliminarily believes
that requiring the dissemination of information about certain SCI
events, as described above, to members or participants could
potentially further incentivize SCI entities to create more robust
systems. In addition, targeting this set of market participants (i.e.,
an SCI entity's members or participants) to receive information about
dissemination SCI events has the benefit of providing the information
to those that are most likely to need, want, and act on the
information, without imposing the additional costs associated with
requiring broader public dissemination. Moreover, another benefit of
increased dissemination of information about dissemination SCI events
to SCI entity

members or participants would be the resultant reduction in search
costs for market participants when they are gathering information to
make a determination with respect to the use of an entity's services.
Also, proposed Rule 1000(b)(5) would require SCI entities to
disseminate specified information for dissemination SCI events, which
would allow market participants to more easily compare the available
information from all SCI entities for which they are members or
participants. The foregoing benefits would be further enhanced to the
extent information relating to dissemination SCI events is shared by
members or participants of SCI entities with other market participants.
Lastly, because an SCI entity would be permitted to delay dissemination
of information regarding a systems intrusion to members or participants
if it determines that such information would likely compromise the
security of its SCI systems or SCI security systems, or an
investigation of the systems intrusion, proposed Rule 1000(b)(5) would
not undermine the need to maintain the non-public nature of certain
systems intrusions for a temporary period (until the SCI entity
determines that dissemination of such information would not likely
compromise the security of the SCI entity's SCI systems or SCI security
systems, or an investigation of the systems intrusion).
---------------------------------------------------------------------------

    \616\ See supra Section V.B.2.
---------------------------------------------------------------------------

    In summary, because proposed Regulation SCI would, among other
things, require SCI entities to provide members and participants with
more information regarding their operations, the Commission
preliminarily believes that SCI entities would have additional
incentives to establish and maintain more robust automated systems to
minimize the occurrence of SCI events. Fewer systems issues could
improve pricing efficiency which, in turn, could promote allocative
efficiency of capital and thus, capital formation.
    In addition to the Commission notification requirements under
proposed Rule 1000(b)(4), the Commission preliminarily believes that
proposed Rule 1000(b)(6) would enhance the Commission's oversight of
the operation of SCI entities, even though entities participating in
the ARP Inspection Program may already provide these types of
notifications to Commission staff. Proposed Rule 1000(b)(6) would
require an SCI entity to notify the Commission on Form SCI of material
systems changes at least 30 calendar days before the implementation of
any planned material systems change. In the case of exigent
circumstances, or if the information previously provided regarding a
planned material systems change becomes materially inaccurate, proposed
Rule 1000(b)(6) would require oral or written notification as early as
reasonably practicable. Any oral notification of planned material
systems change must be memorialized within 24 hours by a written
notification on Form SCI. The Commission preliminarily believes that
this provision would provide the Commission and its staff advance
notice and time to evaluate planned material systems changes by SCI
entities, thus improving the Commission's ability to oversee SCI
entities.
    Proposed Rule 1000(b)(7) would require an SCI entity to conduct an
SCI review of its compliance with Regulation SCI not less than once
each calendar year, and submit a report of the SCI review to senior
management of the SCI entity for review no more than 30 calendar days
after completion of such SCI review. The Commission preliminarily
believes that the proposal to require SCI entities to conduct an
objective assessment of their systems at least annually would result in
SCI entities having an improved awareness of the relative strengths and
weaknesses of their systems independent of the assessment of ARP staff,
which should in turn improve the value and efficiency of an ARP
inspection.
    Proposed Rule 1000(b)(8) would require each SCI entity to submit
certain periodic reports to the Commission through Form SCI, including
annual reports on the SCI reviews of its compliance with Regulation SCI
and semi-annual reports on the progress of material systems changes.
These reports should keep the Commission informed, on an ongoing basis,
by providing information with which the Commission could evaluate each
SCI entity's compliance with Regulation SCI and the progress of its
material systems changes.
    The Commission preliminarily believes that proposed Rules
1000(b)(1)-(8), taken together, should result in actual systems
improvements as well as enhanced availability of relevant information
regarding SCI events to the Commission and members or participants of
SCI entities. This, in turn, could facilitate better decisions by
market participants, which could promote allocative efficiency of
capital and capital formation, potentially providing an overall benefit
to the securities markets and promoting the protection of investors and
the public interest. Additionally, the means by which trading is
conducted may be altered as a result of Regulation SCI. For example, if
an SCI entity member or participant submits orders to a particular
market for execution, and subsequently learns that the execution
venue's systems in use may be prone to failure, such member or
participant may choose to favor another market in the future. This
change would potentially enhance competition as SCI entity members or
participants rely on information disseminated regarding dissemination
SCI events to make more informed choices about the best venue for
execution.
    Proposed Rule 1000(b)(9)(i) would require an SCI entity, with
respect to its business continuity and disaster recovery plans,
including its backup systems, to require participation by designated
members or participants in scheduled functional and performance testing
of the operation of such plans, in the manner and frequency as
specified by the SCI entity, at least once every 12 months. Proposed
Rule 1000(b)(9)(ii) would further require an SCI entity to coordinate
such testing on an industry- or sector-wide basis with other SCI
entities. The Commission expects that this proposed requirement should
help ensure that the securities markets will have improved backup
infrastructure and fewer market-wide shutdowns, thus helping SCI
entities and other market participants to avoid lost revenues and
profits that would otherwise result from such shutdowns. Further, the
notifications required by proposed Rule 1000(b)(9)(iii) should keep the
Commission informed, on an ongoing basis, of an SCI entity's current
standards for designating members or participants and current list of
designees.
c. Rule 1000(c)-(f)--Recordkeeping, Electronic Filing, and Access
    While all SCI entities already are subject to some recordkeeping
and access requirements, the Commission preliminarily believes the
proposed recordkeeping and access requirements specifically related to
proposed Regulation SCI would enhance the ability of the Commission to
evaluate SCI entities' compliance. Specifically, proposed Rule 1000(c)
would require each SCI entity, other than an SCI SRO, to make, keep,
and preserve at least one copy of all documents and records relating to
its compliance with Regulation SCI for a period of not less than five
years.\617\ Each SCI entity also would be required to furnish such

documents to Commission representatives upon request. Further,
according to proposed Rule 1000(e), if the records required to be filed
or kept by an SCI entity under proposed Regulation SCI are prepared or
maintained by a service bureau or other recordkeeping service on behalf
of the SCI entity, the SCI entity must ensure that such records are
available to review by the Commission and its representatives by
submitting a written undertaking by such service bureau or
recordkeeping service to that effect. The Commission preliminarily
believes that these proposed rules should allow Commission staff to
perform efficient inspections and examinations of SCI entities for
their compliance with the proposed rules, and should increase the
likelihood that Commission staff may identify conduct inconsistent with
the proposed rules at earlier stages in the inspection and examination
process.
---------------------------------------------------------------------------

    \617\ As discussed above in Section III.D.1, Regulation SCI-
related documents would already be included in SCI SROs'
comprehensive recordkeeping requirements under Rule 17a-1 under the
Exchange Act.
---------------------------------------------------------------------------

    Proposed Rule 1000(d) would require SCI entities to electronically
submit all written information to the Commission through Form SCI
(except any written notification submitted pursuant to proposed Rule
1000(b)(4)(i)). The Commission preliminarily believes that this
provision would allow the Commission to receive information in a
uniform electronic format with specified content, which would enhance
Commission staff's ability to review and analyze submitted information.
    Finally, proposed Rule 1000(f) would require each SCI entity to
give Commission representatives reasonable access to its SCI systems
and SCI security systems to allow Commission representatives to assess
its compliance with proposed Regulation SCI. The Commission
preliminarily believes that this provision would enhance Commission
oversight by specifically highlighting the Commission's authority to
have its representatives directly access and examine SCI entities'
systems to confirm their compliance with proposed Regulation SCI.
    The Commission preliminarily believes that these requirements would
place the Commission in a stronger position to assess the risks
relating to SCI entities' systems and, thus, would provide the
Commission with greater ability to protect investors. The Commission
also preliminarily believes that its oversight should help ensure that
SCI entities are reasonably equipped to handle market demand and
provide liquidity, including during periods of market distress.
3. Economic Costs
a. Direct Compliance Costs
    The Commission recognizes that proposed Regulation SCI would impose
costs on SCI entities, as well as costs on certain members or
participants of SCI entities. The Commission preliminarily believes
that the majority of these costs would be direct compliance costs. SCI
entities would incur costs in establishing, maintaining, and enforcing
policies and procedures related to systems capacity, integrity,
resiliency, availability, security, and compliance.\618\ SCI entities
also would incur costs in taking appropriate corrective actions upon
any responsible SCI personnel becoming aware of an SCI event,\619\
notifying and updating the Commission with respect to the occurrence of
SCI events,\620\ disseminating information to members or participants
regarding dissemination SCI events,\621\ notifying the Commission of
material systems changes,\622\ conducting SCI reviews,\623\ submitting
to the Commission periodic reports,\624\ requiring designated members
to participate in testing of business continuity and disaster recovery
plans and coordinating such testing,\625\ and complying with
recordkeeping and access requirements.\626\
---------------------------------------------------------------------------

    \618\ See proposed Rules 1000(b)(1) and (2). These proposed
rules would also impose costs for outside legal and/or consulting
advice, as set forth in the Paperwork Reduction Act Section above.
See supra Section IV.
    \619\ See proposed Rule 1000(b)(3).
    \620\ See proposed Rule 1000(b)(4).
    \621\ See proposed Rule 1000(b)(5). This proposed rule would
also impose costs for outside legal advice, as set forth in the
Paperwork Reduction Act discussion above. See supra Section IV.
    \622\ See proposed Rule 1000(b)(6).
    \623\ See proposed Rule 1000(b)(7).
    \624\ See proposed Rule 1000(b)(8).
    \625\ See proposed Rule 1000(b)(9).
    \626\ See proposed Rules 1000(c), (e), and (f).
---------------------------------------------------------------------------

    As stated above in Section IV.D, proposed Regulation SCI would
codify many of the ARP policy statement principles familiar and
applicable to current participants in the ARP Inspection Program. The
Commission recognizes, however, that the proposed rules would apply to
entities that are not currently covered by the ARP Inspection Program,
and would cover areas not currently within the scope of the ARP
Inspection Program. Thus, those costs are incremental relative to the
current compliance cost of the ARP Inspection Program.
    While proposed Regulation SCI would codify the provisions of the
ARP policy statements, the proposed definitions of ``SCI entity,''
``SCI event,'' ``SCI systems,'' and ``SCI security systems'' are
broader than the entities, events, and systems covered by the ARP
Inspection Program and, as stated above, will include more entities,
events, and systems. Specifically, proposed Rule 1000(b)(1)(i) would
codify aspects of the ARP policy statements \627\ with the exception of
Rule 1000(b)(1)(i)(F), which would require policies and procedures
regarding standards that result in systems being designed, developed,
tested, maintained, operated, and surveilled in a manner that
facilitates the successful collection, processing, and dissemination of
market data. In addition, because the ARP policy statements provide
that SROs should promptly notify Commission staff of certain system
outages and any instances in which unauthorized persons gained or
attempted to gain access to their systems, proposed Rule 1000(b)(4),
among other things, would codify parts of the ARP policy
statements.\628\ Further, because the ARP policy statements provide
that SROs should notify Commission staff of certain changes to their
automated systems, proposed Rule 1000(b)(6) would codify a part of the
ARP policy statements.\629\ Lastly, because the ARP policy statements
provide that SROs should undertake reviews of their systems, proposed
Rule 1000(b)(7), among other things, would reflect this part of the ARP
policy statements. With respect to the proposed requirements that are
not currently covered by the ARP Inspection Program, they include:
policies and procedures in addition to those required by proposed Rule
1000(b)(1)(i)(A)-(E) that would be necessary to achieve policies and
procedures reasonably designed to ensure that systems of an SCI entity
have levels of capacity, integrity, resiliency, availability, and
security, adequate to maintain the SCI entity's operational capability
and promote the maintenance of fair and orderly markets; policies and
procedures reasonably designed to ensure the operation of SCI systems
in the manner intended; the initiation of appropriate corrective
actions upon any responsible SCI personnel becoming aware of an SCI
event; the dissemination of information to members or participants;

requirements regarding member or participant testing; and recordkeeping
and access with respect to Regulation SCI-related documents.
---------------------------------------------------------------------------

    \627\ Rule 301(b)(6) of Regulation ATS also contains similar
requirements for ATSs that meet the thresholds in that rule.
    \628\ However, because of the proposed definition of ``SCI
event,'' SCI entities must also report systems compliance issues to
the Commission. Proposed Regulation SCI would also set forth
detailed and specific requirements with respect to Commission
notifications.
    \629\ Again, proposed Regulation SCI would also set forth more
detailed and specific requirements with respect to such Commission
notifications.
---------------------------------------------------------------------------

    Many of these incremental costs are calculated in detail in the
Paperwork Reduction Act Section above, which estimates that the total
one-time initial burden for all SCI entities to comply with Regulation
SCI would be approximately 133,482 hours and $2.6 million, and that the
total annual ongoing burden for all SCI entities to comply with
Regulation SCI would be approximately 117,258 hours and $738,400.
    In addition to the direct cost estimates derived from the Paperwork
Reduction Act burdens, the Commission preliminarily believes that SCI
entities could incur costs when enforcing the policies and procedures
required under proposed Rules 1000(b)(1) and (2), taking corrective
action to mitigate the potential harm resulting from an SCI event under
proposed Rule 1000(b)(3), and in determining whether an SCI event is an
immediate notification SCI event or meets the definition of a
dissemination SCI event under proposed Rule 1000(a).
    As discussed in detail in Section III.C.1 above, proposed Rule
1000(b)(1) would require SCI entities to establish, maintain, and
enforce written policies and procedures reasonably designed to ensure
that their SCI systems and, for purposes of security standards, SCI
security systems, have levels of capacity, integrity, resiliency,
availability, and security, adequate to maintain the SCI entity's
operational capability and promote the maintenance of fair and orderly
markets. In addition to the burden of establishing and maintaining such
policies and procedures as set forth in the Paperwork Reduction Act
Section above, the Commission preliminarily believes that SCI entities
would incur costs in enforcing the substantive requirements that are
the subject of the policies and procedures.
    Further, as discussed in detail in Section III.C.2 above, proposed
Rule 1000(b)(2) would require SCI entities to establish, maintain, and
enforce written policies and procedures reasonably designed to ensure
that their SCI systems operate in the manner intended, including in a
manner that complies with federal securities laws and rules and
regulations thereunder and the entity's rules and governing documents,
as applicable. In addition to the burden of establishing and
maintaining such policies and procedures as set forth in the Paperwork
Reduction Act Section above, the Commission preliminarily believes that
SCI entities would incur costs in enforcing the substantive
requirements that are the subject of the policies and procedures.
    As noted above,\630\ NIST is an agency within the U.S. Department
of Commerce that has issued numerous special publications regarding
information technology systems. For example, one of the publications
listed in Table A is the NIST Draft Security and Privacy Controls for
Federal Information Systems and Organizations (Special Publication 800-
53 Rev. 4) (February 2012) (``NIST 800-53'').\631\ This publication is
a security controls catalog providing guidance for selecting and
specifying security controls for federal information systems and
organizations. NIST 800-53 addresses how federal entities should
achieve secure information systems, taking into account the fundamental
elements of: (i) Multitiered risk management; (ii) the structure and
organization of controls; (iii) security control baselines; (iv) the
use of common controls and inheritance of security capabilities; (v)
external environments and service providers; (vi) assurance and
trustworthiness; and (vii) revisions and extensions to security
controls and control baselines, among others. Although NIST 800-53 sets
forth standards for federal agencies, it is also intended to serve a
diverse audience of information system and information security
professionals, including those having information system, security,
and/or risk management and oversight responsibilities, information
system development responsibilities, information security
implementation and operational responsibilities, information security
assessment and monitoring responsibilities, as well as commercial
companies producing information technology products, systems, security-
related technologies, and security services.\632\
---------------------------------------------------------------------------

    \630\ See supra Section III.C.1.b.
    \631\ See NIST 800-53, available at: http://csrc.nist.gov/publications/drafts/800-53-rev4/sp800-53-rev4-ipd.pdf.
    \632\ See id. at 3.
---------------------------------------------------------------------------

    The Commission preliminarily believes that many SCI entities will
choose to establish, maintain, and enforce policies and procedures that
are consistent with the proposed SCI industry standards contained in
the publications set forth in Table A for purposes of satisfying the
requirements of proposed Rule 1000(b)(1). However, as noted above,
compliance with the identified SCI industry standards would not be the
exclusive means to comply with the requirements of proposed Rule
1000(b)(1). The Commission understands that the Table A publications,
including NIST 800-53, are familiar to information technology personnel
employed by many SCI entities, and that some SCI entities, particularly
the SCI SROs and plan processors that participate in the ARP Inspection
Program, currently adhere to all or at least some of the standards in
NIST 800-53, or similar standards set forth in publications issued by
other standards setting bodies, with some entities fully or nearly
fully implementing such standards, while other entities may not have
implemented such standards as broadly. For SCI entities that are not
part of the ARP Inspection Program, while such entities may be familiar
with such publications and standards generally, the Commission is not
certain as to the level of compliance with such standards, and believes
that there may be some such entities that are fully or nearly fully
complaint, while others may have little or no compliance with such
standards.
    With respect to the substantive systems requirements resulting from
adherence to SCI industry standards (which, solely for purposes of this
Economic Analysis Section, the Commission assumes to be the proposed
SCI industry standards contained in the publications identified in
Table A, or publications setting forth substantially similar standards)
underlying proposed Rule 1000(b)(1), as noted above, the Commission
believes that certain entities that would satisfy the definition of SCI
entity, particularly some that currently participate in the ARP
Inspection Program, already comply with some of the requirements. On
the other hand, the Commission believes that some SCI entities,
including some that currently participate in the ARP Inspection
Program, do not currently comply with some or all of the proposed
requirements. Further, although the Commission believes that each SCI
entity would incur costs in complying with these requirements, the
Commission believes that some entities already comply with SCI industry
standards with respect to some of their systems. Moreover, the
Commission acknowledges that certain SCI entities are larger or more
complex than others, and that proposed Rule 1000(b)(1) would impose
higher costs on larger and more complex systems.
    Because the Commission does not at this time have sufficient
information to reasonably estimate each SCI entity's current level of
compliance with the proposed SCI industry standards contained in the
publications set forth in Table A, the Commission estimates a

range of average costs for each SCI entity to comply with such
standards. The Commission acknowledges that some SCI entities would
incur costs near the bottom of the range because their systems policies
and procedures currently meet SCI industry standards (which, as noted
above, solely for purposes of this Economic Analysis Section, the
Commission assumes to be the proposed SCI industry standards contained
in the publications identified in Table A or in substantially similar
publications). On the other hand, some SCI entities would incur costs
near the middle or top of the range because their systems policies and
procedures do not currently meet such standards. Because the Commission
lacks sufficient information regarding the current practices of all SCI
entities, the Commission seeks comment on the extent to which SCI
entities already have in place systems policies and procedures that
would meet the proposed SCI industry standards (which, solely for
purposes of this Economic Analysis Section, the Commission assumes to
be the proposed SCI industry standards contained in the publications
identified in Table A or in substantially similar publications).
    Further, unlike the Paperwork Reduction Act Section where the
Commission estimates a fifty-percent baseline with respect to proposed
Rule 1000(b)(1)(i)(A)-(E) for entities that currently participate in
the ARP Inspection Program, the Commission preliminarily estimates the
same cost range for all SCI entities for compliance with the proposed
substantive requirements that are the subject of the policies and
procedures. On the one hand, the Commission believes that certain SCI
entities (in particular, some entities that participate in the ARP
Inspection Program) may already comply with some of the substantive
requirements and thus would incur less incremental cost for complying
with such requirements. On the other hand, the Commission believes that
some SCI entities that currently participate in the ARP Inspection
Program are larger and have more complex systems than those that do not
participate in the ARP Inspection Program and, therefore, would incur
more incremental cost for complying with the substantive requirements.
As such, the Commission preliminarily believes it is unlikely that SCI
entities that do not participate in the ARP Inspection Program would
incur twice the cost as SCI entities that participate in the ARP
Inspection Program to comply with the substantive systems requirements
underlying the policies and procedures required by proposed Regulation
SCI.
    Based on discussion with industry participants, the Commission
preliminarily estimates that, to comply with the substantive
requirements that are the subject of the policies and procedures
required by proposed Rules 1000(b)(1) and (2), including consistency
with the SCI industry standards (which, solely for purposes of this
Economic Analysis, the Commission assumes to be the proposed SCI
industry standards contained in the publications identified in Table A
or in substantially similar publications) in connection with proposed
Rule 1000(b)(1), on average, each SCI entity would incur an initial
cost of between approximately $400,000 and $3 million.\633\ Based on
this average, the Commission preliminarily estimates that SCI entities
would incur a total initial cost of between approximately $17.6 million
\634\ and $132 million.\635\ The Commission seeks comment on the
estimated average initial cost range for SCI entities to comply with
the substantive requirements underlying the policies and procedures
required by proposed Rules 1000(b)(1) and (2).
---------------------------------------------------------------------------

    \633\ The Commission preliminarily estimates a range of cost for
complying with the substantive requirements that are the subject of
the policies and procedures required by proposed Rules 1000(b)(1)
and (2) because some SCI entities are already in compliance with
some of these substantive requirements. For example, the Commission
believes that many SCI SROs (e.g., certain national securities
exchanges and registered clearing agencies) already have or have
begun implementation of business continuity and disaster recovery
plans that include maintaining backup and recovery capabilities
sufficiently resilient and geographically diverse to ensure next
business day resumption of trading and two-hour resumption of
clearance and settlement services following a wide-scale disruption.
    \634\ $17.6 million = ($400,000) x (44 SCI entities).
    \635\ $132 million = ($3 million) x (44 SCI entities).
---------------------------------------------------------------------------

    The preliminary cost estimates described above represent an
estimated average cost range per SCI entity, and the Commission
acknowledges that some of the costs to comply with the substantive
requirements of proposed Rules 1000(b)(1) and (2) may be significantly
higher than the estimated average for some SCI entities, while some of
the costs may be significantly lower for other SCI entities. In
particular, the Commission preliminarily believes that the costs
associated with the requirement in proposed Rule 1000(b)(1)(i)(E) that
an SCI entity have policies and procedures that include maintaining
backup and recovery capabilities sufficiently resilient and
geographically diverse to ensure next business day resumption of
trading and two-hour resumption of clearance and settlement services
following a wide-scale disruption is an area in which different SCI
entities may encounter significantly different compliance costs. For
example, among national securities exchanges, the Commission
understands that many, though not all, national securities exchanges
already have or soon expect to have backup facilities that do not rely
on the same infrastructure components used by their primary facility.
For those national securities exchanges that do not have such backup
facilities, the cost to build and maintain such facilities may result
in their compliance costs being significantly higher than those of
national securities exchanges that already satisfy the proposed
requirement.\636\ The application of the geographic diversity
requirement to other entities, such as ATSs, under the proposed rule,
would depend on the nature, size, technology, business model, and other
aspects of their business.
---------------------------------------------------------------------------

    \636\ As noted, solely for purposes of this Economic Analysis,
the Commission has assumed that the SCI industry standards would be
those contained in the publications identified in Table A or in
substantially similar publications. However, as proposed Rule
1000(b)(1)(ii) makes clear, compliance with such current industry
standards, including the geographic diversity requirements contained
in the 2003 Interagency White Paper, supra note 31, is not the
exclusive means to comply with the requirements of proposed Rule
1000(b)(1). See also supra note 182.
---------------------------------------------------------------------------

    218. The Commission requests commenters' views on how many SCI
entities would not currently satisfy the proposed requirement relating
to geographic diversity of backup sites. The Commission requests
commenters' views on the costs of establishing backup sites to satisfy
the proposed geographic diversity requirement, particularly for
entities that currently would not satisfy the proposed requirement. In
such a case, given the likely significant cost and time associated with
building such backup sites, how long do commenters believe it would
take for SCI entities to come into compliance with such a proposed
requirement? Would it be appropriate for the Commission to allow an
extended period prior to which compliance with this proposed
requirement would be effective? Why or why not? If so, how long should
such period be and why? Should such an extended period only be
permitted for a subset of SCI entities. If so, how should such a subset
be determined? Please describe.
    As noted above, because the Commission does not at this time have