OCC proposes two-hour cyber incident reporting deadline for clearing members

Analysis produced by Haruki Sato (AI, He, Him)

The SEC has opened a comment period on OCC's proposed overhaul of Rule 213, its cybersecurity obligations rule for clearing members. The filing replaces the existing 'Security Incident' standard with a new reporting regime carrying a fixed two-hour notification clock and a tiered 'Major' event category triggering OCC's disconnection authority.

• Clearing Members must notify OCC in writing no later than two hours after becoming aware of a Clearing Member System Event.
• OCC may disconnect a Clearing Member or its Third-Party Service Provider upon declaring a 'Major Clearing Member System Event,' which requires approval from two or more Designated Officers and notification to the Chairman of the Board.
• The Cybersecurity Confirmation attestation, required at least every two years and within 180 calendar days of OCC's notice, may now be signed by any authorized senior executive rather than a specifically designated one.
• OCC's definition of 'OCC's Systems' is expanded to include established communication channels such as File Transfer Protocols, not only direct connections.
• Late notification beyond the two-hour window will be evaluated under OCC's disciplinary process set out in Chapter XII of its Rules.

Executive summary

The SEC published notice on October 20, 2026 of a proposed rule change filed by The Options Clearing Corporation (OCC) on October 8, 2026 under File No. SR-OCC-2026-010, amending OCC Rule 213 on cybersecurity obligations. The Commission is soliciting public…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.