SEC censures OTC Link over years of Regulation SCI failures

OTC Link LLC walked out of Sept. 22 with a censure, a cease-and-desist order and a $575,000 civil penalty after the SEC concluded the firm had spent the better part of a decade violating Regulation Systems Compliance and Integrity. The SEC’s press release puts the violation window at August 2016 through March 2025 — a span of 104 calendar months when both endpoint months are counted.

The action targets OTC Link ATS, one of five alternative trading system platforms operated by OTC Link LLC. Per the administrative order, OTC Link LLC is a Delaware limited liability company headquartered in New York, an indirect wholly owned subsidiary of OTC Markets Group Inc., and has been registered with the Commission as a broker-dealer since 2012. An SCI ATS is an alternative trading system that meets specific volume thresholds for equity securities — the designation carries written-control obligations under Regulation SCI that the order finds OTC Link failed to meet across that period.

OTC Link LLC failed to establish, maintain and enforce written policies and procedures covering system security, access control, application vulnerability management, testing and remediation — requirements Regulation SCI has imposed since 2014. Rule 1001(a)(1) requires SCI entities to maintain written policies and procedures across system capacity, integrity, resiliency, availability and security. Rule 1001(a)(2) sets floors for capacity planning, stress testing, vulnerability assessment and business continuity. Rule 1001(a)(3) requires periodic review of those policies and prompt remediation of any deficiencies found.

SEC Division of Examinations staff flagged deficiencies multiple times across the violation window. The firm failed to fix them promptly. Access control is the most glaring thread in the order: the deficiency was first noted in 2016, cited again in 2019, cited again in 2022, and the relevant policy was still sitting in draft form throughout all of that. As of fiscal year 2023, OTC Link still hadn’t formally established it.

In 2024, OTC Link LLC retained third-party compliance consultants to review its Regulation SCI compliance program. The order says OTC Link established additional written policies and procedures since March 2025. OTC Link agreed to the cease-and-desist order, censure and civil penalty without admitting the findings.

Laura D’Allaird, chief of the SEC Division of Enforcement’s Cyber and Emerging Technologies Unit, didn’t soften the characterization. “OTC Link’s continual failure to remediate deficiencies even after they were repeatedly flagged by Division of Examinations staff reflects a disregard for their findings and the overall examinations process and justifies a meaningful penalty,” D’Allaird said in the SEC release. Her broader message was blunter still: “All SCI entities are expected to take their regulatory responsibilities seriously and promptly fix issues when they’re identified.” [Analysis: The repeated citation of the same access-control deficiency across 2016, 2019, 2022 and into fiscal year 2023 is the sharpest illustration of the pattern D’Allaird describes.]

The OTC Link action illustrates a distinct enforcement path: written-control deficiencies, identified repeatedly by examiners, produced a censure and a six-figure penalty under Rules 1001(a)(1), 1001(a)(2) and 1001(a)(3) of Regulation SCI even after the firm eventually moved to address them.