SEC fines OTC Link $575,000 for nine years of Regulation SCI failures

The SEC censured broker-dealer OTC Link LLC and imposed a $575,000 penalty for failing, between August 2016 and March 2025, to establish and enforce Regulation SCI policies covering system security, access control and vulnerability management on its OTC Link ATS. The order turns on repeated failures to remediate deficiencies after examiners flagged them, making it essential reading for SCI entities on how the agency weighs examination history.

• OTC Link LLC was censured and ordered to pay a $575,000 civil penalty for Regulation SCI violations from August 2016 to March 2025.
• The SEC found deficient policies on system security, access control and application vulnerability management, testing and remediation for OTC Link ATS.
• Examiners flagged the gaps several times; the order cites repeated failure to promptly remediate as justifying the penalty, and found breaches of Rules 1001(a)(1), (a)(2) and (a)(3).