US Codex
C.F.R.
Browse by date

View an earlier version

Latest
Current
Browse all versions by date
Notes

17 C.F.R. §§ 242.1001–242.1007

7 sections in range

§242.1001. Obligations related to policies and procedures of SCI entities.

17 C.F.R. § 242.1001

(a)
Capacity, integrity, resiliency, availability, and security.
(1)
Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.
(2)
Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:
(i)
The establishment of reasonable current and future technological infrastructure capacity planning estimates;
(ii)
Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;
(iii)
A program to review and keep current systems development and testing methodology for such systems;
(iv)
Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;
(v)
Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;
(vi)
Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and
(vii)
Monitoring of such systems to identify potential SCI events.
(3)
Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.
(4)
For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).
(b)
Systems compliance.
(1)
Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.
(2)
Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:
(i)
Testing of all SCI systems and any changes to SCI systems prior to implementation;
(ii)
A system of internal controls over changes to SCI systems;
(iii)
A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and
(iv)
A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.
(3)
Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.
(4)
Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:
(i)
Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and
(ii)
Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.
(c)
Responsible SCI personnel.
(1)
Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.
(2)
Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures.
Notes, amendments, and revision history

Source

Source: 79 FR 72436, Dec. 5, 2014, unless otherwise noted.

Authority

Authority: 15 U.S.C. 77g, 77q(a), 77s(a), 78b, 78c, 78c-4, 78g(c)(2), 78i(a), 78j, 78k-1(c), 78 l, 78m, 78n, 78 o (b), 78 o (c), 78 o (g), 78q(a), 78q(b), 78q(h), 78w(a), 78dd-1, 78mm, 80a-23, 80a-29, 80a-37, and 8343.

Source

Source: 62 FR 544, Jan. 3, 1997, unless otherwise noted.

§242.1002. Obligations related to SCI events.

17 C.F.R. § 242.1002

(a)
Corrective action. Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, each SCI entity shall begin to take appropriate corrective action which shall include, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable.
(b)
Commission notification and recordkeeping of SCI events. Each SCI entity shall:
(1)
Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, notify the Commission of such SCI event immediately;
(2)
Within 24 hours of any responsible SCI personnel having a reasonable basis to conclude that the SCI event has occurred, submit a written notification pertaining to such SCI event to the Commission, which shall be made on a good faith, best efforts basis and include:
(i)
A description of the SCI event, including the system(s) affected; and
(ii)
To the extent available as of the time of the notification— The SCI entity's current assessment of the types and number of market participants potentially affected by the SCI event; the potential impact of the SCI event on the market; a description of the steps the SCI entity has taken, is taking, or plans to take, with respect to the SCI event; the time the SCI event was resolved or timeframe within which the SCI event is expected to be resolved; and any other pertinent information known by the SCI entity about the SCI event;
(3)
Until such time as the SCI event is resolved and the SCI entity's investigation of the SCI event is closed, provide updates pertaining to such SCI event to the Commission on a regular basis, or at such frequency as reasonably requested by a representative of the Commission, to correct any materially incorrect information previously provided, or when new material information is discovered, including but not limited to, any of the information listed in paragraph (b)(2)(ii) of this section;
(4)
(i)
(A)
If an SCI event is resolved and the SCI entity's investigation of the SCI event is closed within 30 calendar days of the occurrence of the SCI event, then within five business days after the resolution of the SCI event and closure of the investigation regarding the SCI event, submit a final written notification pertaining to such SCI event to the Commission containing the information required in paragraph (b)(4)(ii) of this section.
(B)
(1) If an SCI event is not resolved or the SCI entity's investigation of the SCI event is not closed within 30 calendar days of the occurrence of the SCI event, then submit an interim written notification pertaining to such SCI event to the Commission within 30 calendar days after the occurrence of the SCI event containing the information required in paragraph (b)(4)(ii) of this section, to the extent known at the time.

(2) Within five business days after the resolution of such SCI event and closure of the investigation regarding such SCI event, submit a final written notification pertaining to such SCI event to the Commission containing the information required in paragraph (b)(4)(ii) of this section.

(ii)
Written notifications required by paragraph (b)(4)(i) of this section shall include:
(A)
A detailed description of— The SCI entity's assessment of the types and number of market participants affected by the SCI event; the SCI entity's assessment of the impact of the SCI event on the market; the steps the SCI entity has taken, is taking, or plans to take, with respect to the SCI event; the time the SCI event was resolved; the SCI entity's rule(s) and/or governing document(s), as applicable, that relate to the SCI event; and any other pertinent information known by the SCI entity about the SCI event;
(B)
A copy of any information disseminated pursuant to paragraph (c) of this section by the SCI entity to date regarding the SCI event to any of its members or participants; and
(C)
An analysis of parties that may have experienced a loss, whether monetary or otherwise, due to the SCI event, the number of such parties, and an estimate of the aggregate amount of such loss.
(5)
The requirements of paragraphs (b)(1) through (4) of this section shall not apply to any SCI event that has had, or the SCI entity reasonably estimates would have, no or a de minimis impact on the SCI entity's operations or on market participants. For such events, each SCI entity shall:
(i)
Make, keep, and preserve records relating to all such SCI events; and
(ii)
Submit to the Commission a report, within 30 calendar days after the end of each calendar quarter, containing a summary description of such systems disruptions and systems intrusions, including the SCI systems and, for systems intrusions, indirect SCI systems, affected by such systems disruptions and systems intrusions during the applicable calendar quarter.
(c)
Dissemination of SCI events.
(1)
Each SCI entity shall—
(i)
Promptly after any responsible SCI personnel has a reasonable basis to conclude that an SCI event that is a systems disruption or systems compliance issue has occurred, disseminate the following information about such SCI event:
(A)
The system(s) affected by the SCI event; and
(B)
A summary description of the SCI event; and
(ii)
When known, promptly further disseminate the following information about such SCI event—
(A)
A detailed description of the SCI event;
(B)
The SCI entity's current assessment of the types and number of market participants potentially affected by the SCI event; and
(C)
A description of the progress of its corrective action for the SCI event and when the SCI event has been or is expected to be resolved; and
(iii)
Until resolved, provide regular updates of any information required to be disseminated under paragraphs (c)(1)(i) and (ii) of this section.
(2)
Each SCI entity shall, promptly after any responsible SCI personnel has a reasonable basis to conclude that a SCI event that is a systems intrusion has occurred, disseminate a summary description of the systems intrusion, including a description of the corrective action taken by the SCI entity and when the systems intrusion has been or is expected to be resolved, unless the SCI entity determines that dissemination of such information would likely compromise the security of the SCI entity's SCI systems or indirect SCI systems, or an investigation of the systems intrusion, and documents the reasons for such determination.
(3)
The information required to be disseminated under paragraphs (c)(1) and (2) of this section promptly after any responsible SCI personnel has a reasonable basis to conclude that an SCI event has occurred, shall be promptly disseminated by the SCI entity to those members or participants of the SCI entity that any responsible SCI personnel has reasonably estimated may have been affected by the SCI event, and promptly disseminated to any additional members or participants that any responsible SCI personnel subsequently reasonably estimates may have been affected by the SCI event; provided, however, that for major SCI events, the information required to be disseminated under paragraphs (c)(1) and (2) of this section shall be promptly disseminated by the SCI entity to all of its members or participants.
(4)
The requirements of paragraphs (c)(1) through (3) of this section shall not apply to:
(i)
SCI events to the extent they relate to market regulation or market surveillance systems; or
(ii)
Any SCI event that has had, or the SCI entity reasonably estimates would have, no or a de minimis impact on the SCI entity's operations or on market participants.
Notes, amendments, and revision history

Source

Source: 79 FR 72436, Dec. 5, 2014, unless otherwise noted.

Authority

Authority: 15 U.S.C. 77g, 77q(a), 77s(a), 78b, 78c, 78c-4, 78g(c)(2), 78i(a), 78j, 78k-1(c), 78 l, 78m, 78n, 78 o (b), 78 o (c), 78 o (g), 78q(a), 78q(b), 78q(h), 78w(a), 78dd-1, 78mm, 80a-23, 80a-29, 80a-37, and 8343.

Source

Source: 62 FR 544, Jan. 3, 1997, unless otherwise noted.

§242.1003. Obligations related to systems changes; SCI review.

17 C.F.R. § 242.1003

(a)
Systems changes. Each SCI entity shall:
(1)
Within 30 calendar days after the end of each calendar quarter, submit to the Commission a report describing completed, ongoing, and planned material changes to its SCI systems and the security of indirect SCI systems, during the prior, current, and subsequent calendar quarters, including the dates or expected dates of commencement and completion. An SCI entity shall establish reasonable written criteria for identifying a change to its SCI systems and the security of indirect SCI systems as material and report such changes in accordance with such criteria.
(2)
Promptly submit a supplemental report notifying the Commission of a material error in or material omission from a report previously submitted under this paragraph (a).
(b)
SCI review. Each SCI entity shall:
(1)
Conduct an SCI review of the SCI entity's compliance with Regulation SCI not less than once each calendar year; provided, however, that:
(i)
Penetration test reviews of the network, firewalls, and production systems shall be conducted at a frequency of not less than once every three years; and
(ii)
Assessments of SCI systems directly supporting market regulation or market surveillance shall be conducted at a frequency based upon the risk assessment conducted as part of the SCI review, but in no case less than once every three years; and
(2)
Submit a report of the SCI review required by paragraph (b)(1) of this section to senior management of the SCI entity for review no more than 30 calendar days after completion of such SCI review; and
(3)
Submit to the Commission, and to the board of directors of the SCI entity or the equivalent of such board, a report of the SCI review required by paragraph (b)(1) of this section, together with any response by senior management, within 60 calendar days after its submission to senior management of the SCI entity.
Notes, amendments, and revision history

Source

Source: 79 FR 72436, Dec. 5, 2014, unless otherwise noted.

Authority

Authority: 15 U.S.C. 77g, 77q(a), 77s(a), 78b, 78c, 78c-4, 78g(c)(2), 78i(a), 78j, 78k-1(c), 78 l, 78m, 78n, 78 o (b), 78 o (c), 78 o (g), 78q(a), 78q(b), 78q(h), 78w(a), 78dd-1, 78mm, 80a-23, 80a-29, 80a-37, and 8343.

Source

Source: 62 FR 544, Jan. 3, 1997, unless otherwise noted.

§242.1004. SCI entity business continuity and disaster recovery plans testing requirements for members or participants.

17 C.F.R. § 242.1004

With respect to an SCI entity's business continuity and disaster recovery plans, including its backup systems, each SCI entity shall:
(a)
Establish standards for the designation of those members or participants that the SCI entity reasonably determines are, taken as a whole, the minimum necessary for the maintenance of fair and orderly markets in the event of the activation of such plans;
(b)
Designate members or participants pursuant to the standards established in paragraph (a) of this section and require participation by such designated members or participants in scheduled functional and performance testing of the operation of such plans, in the manner and frequency specified by the SCI entity, provided that such frequency shall not be less than once every 12 months; and
(c)
Coordinate the testing of such plans on an industry- or sector-wide basis with other SCI entities.
Notes, amendments, and revision history

Source

Source: 79 FR 72436, Dec. 5, 2014, unless otherwise noted.

Authority

Authority: 15 U.S.C. 77g, 77q(a), 77s(a), 78b, 78c, 78c-4, 78g(c)(2), 78i(a), 78j, 78k-1(c), 78 l, 78m, 78n, 78 o (b), 78 o (c), 78 o (g), 78q(a), 78q(b), 78q(h), 78w(a), 78dd-1, 78mm, 80a-23, 80a-29, 80a-37, and 8343.

Source

Source: 62 FR 544, Jan. 3, 1997, unless otherwise noted.

§242.1005. Recordkeeping requirements related to compliance with Regulation SCI.

17 C.F.R. § 242.1005

(a)
An SCI SRO shall make, keep, and preserve all documents relating to its compliance with Regulation SCI as prescribed in § 240.17a-1 of this chapter.
(b)
An SCI entity that is not an SCI SRO shall—
(1)
Make, keep, and preserve at least one copy of all documents, including correspondence, memoranda, papers, books, notices, accounts, and other such records, relating to its compliance with Regulation SCI, including, but not limited to, records relating to any changes to its SCI systems and indirect SCI systems;
(2)
Keep all such documents for a period of not less than five years, the first two years in a place that is readily accessible to the Commission or its representatives for inspection and examination; and
(3)
Upon request of any representative of the Commission, promptly furnish to the possession of such representative copies of any documents required to be kept and preserved by it pursuant to paragraphs (b)(1) and (2) of this section.
(c)
Upon or immediately prior to ceasing to do business or ceasing to be registered under the Securities Exchange Act of 1934, an SCI entity shall take all necessary action to ensure that the records required to be made, kept, and preserved by this section shall be accessible to the Commission and its representatives in the manner required by this section and for the remainder of the period required by this section.
Notes, amendments, and revision history

Source

Source: 79 FR 72436, Dec. 5, 2014, unless otherwise noted.

Authority

Authority: 15 U.S.C. 77g, 77q(a), 77s(a), 78b, 78c, 78c-4, 78g(c)(2), 78i(a), 78j, 78k-1(c), 78 l, 78m, 78n, 78 o (b), 78 o (c), 78 o (g), 78q(a), 78q(b), 78q(h), 78w(a), 78dd-1, 78mm, 80a-23, 80a-29, 80a-37, and 8343.

Source

Source: 62 FR 544, Jan. 3, 1997, unless otherwise noted.

§242.1006. Electronic filing and submission.

17 C.F.R. § 242.1006

(a)
Except with respect to notifications to the Commission made pursuant to § 242.1002(b)(1) or updates to the Commission made pursuant to paragraph § 242.1002(b)(3), any notification, review, description, analysis, or report to the Commission required to be submitted under Regulation SCI shall be filed electronically on Form SCI (§ 249.1900 of this chapter), include all information as prescribed in Form SCI and the instructions thereto, and contain an electronic signature; and
(b)
The signatory to an electronically filed Form SCI shall manually sign a signature page or document, in the manner prescribed by Form SCI, authenticating, acknowledging, or otherwise adopting his or her signature that appears in typed form within the electronic filing. Such document shall be executed before or at the time Form SCI is electronically filed and shall be retained by the SCI entity in accordance with § 242.1005.
Notes, amendments, and revision history

Source

Source: 79 FR 72436, Dec. 5, 2014, unless otherwise noted.

Authority

Authority: 15 U.S.C. 77g, 77q(a), 77s(a), 78b, 78c, 78c-4, 78g(c)(2), 78i(a), 78j, 78k-1(c), 78 l, 78m, 78n, 78 o (b), 78 o (c), 78 o (g), 78q(a), 78q(b), 78q(h), 78w(a), 78dd-1, 78mm, 80a-23, 80a-29, 80a-37, and 8343.

Source

Source: 62 FR 544, Jan. 3, 1997, unless otherwise noted.

§242.1007. Requirements for service bureaus.

17 C.F.R. § 242.1007

If records required to be filed or kept by an SCI entity under Regulation SCI are prepared or maintained by a service bureau or other recordkeeping service on behalf of the SCI entity, the SCI entity shall ensure that the records are available for review by the Commission and its representatives by submitting a written undertaking, in a form acceptable to the Commission, by such service bureau or other recordkeeping service, signed by a duly authorized person at such service bureau or other recordkeeping service. Such a written undertaking shall include an agreement by the service bureau to permit the Commission and its representatives to examine such records at any time or from time to time during business hours, and to promptly furnish to the Commission and its representatives true, correct, and current electronic files in a form acceptable to the Commission or its representatives or hard copies of any or all or any part of such records, upon request, periodically, or continuously and, in any case, within the same time periods as would apply to the SCI entity for such records. The preparation or maintenance of records by a service bureau or other recordkeeping service shall not relieve an SCI entity from its obligation to prepare, maintain, and provide the Commission and its representatives access to such records.
Notes, amendments, and revision history

Source

Source: 79 FR 72436, Dec. 5, 2014, unless otherwise noted.

Authority

Authority: 15 U.S.C. 77g, 77q(a), 77s(a), 78b, 78c, 78c-4, 78g(c)(2), 78i(a), 78j, 78k-1(c), 78 l, 78m, 78n, 78 o (b), 78 o (c), 78 o (g), 78q(a), 78q(b), 78q(h), 78w(a), 78dd-1, 78mm, 80a-23, 80a-29, 80a-37, and 8343.

Source

Source: 62 FR 544, Jan. 3, 1997, unless otherwise noted.