The US Securities and Exchange Commission (SEC) announced a settlement with OTC Link on September 22, 2026, regarding multiple breaches related to Regulation Systems Compliance and Integrity (Regulation SCI). The settlement follows the SEC’s identification of ongoing control and compliance deficiencies at OTC Link over several years.
SEC details control failures
According to the SEC, between August 2016 and March 2025, OTC Link failed to maintain adequate written policies and procedures for systems security, access controls, and vulnerability management. The regulator stated these failures included insufficient documentation, incomplete remediation activities, and inadequate access control protocols.
OTC Link, a subsidiary of OTC Markets Group and a registered alternative trading system, agreed to a censure and a $575,000 civil penalty as part of the settlement. The company did not admit or deny the SEC’s findings.
OTC Link accepted the SEC’s penalty and censure, agreeing to settle without admitting or denying the investigative conclusions that spanned nearly nine years of operational reviews and compliance inspections.
The SEC’s action focused on the lack of proper internal safeguards and the failure to implement regular testing routines critical for market systems regulated under SCI.
Mini dictionary: Regulation SCI (Systems Compliance and Integrity) is a regulatory framework introduced by the SEC in 2014. It aims to strengthen the technological infrastructure and operational security of US securities markets by requiring entities to establish stringent controls over their trading systems, including written policies, testing, and proactive remediation of security vulnerabilities.
The importance of written procedures
A trading system’s resilience does not depend solely on deploying security technologies. Clearly defined responsibilities, ongoing testing, and documented processes for addressing identified risks are essential to demonstrate that controls are effective and maintained over time.
The SEC’s findings focused exclusively on compliance lapses. No evidence or claim was made that the deficiencies resulted in trading losses or any specific customer impact. The settlement should not be interpreted as an indication of a confirmed data breach or client harm.
Implications for investors
Regulatory enforcement actions can identify internal weaknesses within trading platforms, but they do not necessarily imply that all customer transactions were compromised. In such cases, investors are urged to consider the timeframe, type of conduct in question, and the specific remedy imposed.
The $575,000 penalty issued to OTC Link represents a regulatory sanction based on compliance shortcomings—it is not restitution for individual customers or trades. This action serves as a reminder that the integrity of market infrastructure depends on sustained internal controls, regardless of trading volumes or transaction numbers.
The SEC’s case highlights how a firm’s compliance track record can influence its standing in the marketplace, and underlines the expectation of ongoing operational oversight for all registered trading systems.
