On 22 September 2026, the US Securities and Exchange Commission censured OTC Link LLC and ordered it to pay a $575,000 civil penalty for Regulation SCI violations at OTC Link ATS, the alternative trading system it operates for over-the-counter securities. The core finding is blunt. From August 2016 to March 2025, required written policies on access control and application vulnerability management were missing or stuck in draft, and the firm did not fix them after SEC examiners flagged them more than once.
What's affected
According to the SEC's order (Release No. 106458, Administrative Proceeding File No. 3-22748):
- Entity: OTC Link LLC, a New York based broker-dealer and indirect subsidiary of OTC Markets Group Inc. OTC Link ATS was an "SCI entity" throughout the relevant period.
- Rules violated: Regulation SCI Rules 1001(a)(1), (a)(2) and (a)(3). The SEC found the violations willful.
- Missing system security policies: the order cites account management and access control, network device security configuration management, and data loss prevention.
- Missing vulnerability review and testing policies required by Rule 1001(a)(2)(iv), including "application vulnerability management, testing, and remediation policies and procedures, some of which Respondent kept in 'draft' form and failed to finalize."
- Repeat findings: the access control policy was first noted as a draft in connection with a fiscal year 2016 examination, cited again in deficiency letters in 2019 and 2022, and as of fiscal year 2023 was still not formally established.
- Remediation: the firm hired outside compliance consultants in 2024, and since March 2025 has established policies on application vulnerability management, account management and access control, and network device configuration management.
- Sanctions: cease and desist, censure, and a $575,000 penalty. OTC Link consented without admitting or denying the findings, apart from jurisdiction.
Laura D'Allaird, Chief of the Enforcement Division's Cyber and Emerging Technologies Unit, said in the SEC's release that the firm's "continual failure to remediate deficiencies even after they were repeatedly flagged" justified a meaningful penalty.
Does this apply to you?
Regulation SCI applies only to "SCI entities." The order lists them: certain self-regulatory organizations, alternative trading systems that meet volume thresholds, plan processors and exempt clearing agencies. For an ATS trading equity securities that are not NMS stocks, the threshold quoted in the order is 5% or more of average daily dollar volume in at least four of the preceding six calendar months.
Check yourself against these criteria:
- You are an SCI entity. Rule 1001(a) applies directly. Your written policies must cover the minimum topics in Rule 1001(a)(2), including regular reviews and testing to identify vulnerabilities, and you must review them periodically under Rule 1001(a)(3).
- You sell software or managed services to an SCI entity. You are not regulated by Regulation SCI, but your customer's policies cover their SCI systems and, for security standards, indirect SCI systems. Expect them to ask how you manage vulnerabilities in what you supply.
- You are in another regulated sector. The rule does not reach you, but the pattern does. Most frameworks expect written, approved and enforced vulnerability management procedures, and examiners notice drafts.
What to do now
- This week: list every security policy and procedure your regulator or auditor expects. Mark each as approved, draft or missing. Anything in draft for more than one review cycle is a finding waiting to happen.
- By 31 October 2026: pull every open item from past examination or audit letters. Assign an owner and a closing date to each. The SEC's order turned on repeat findings, not a single gap.
- By 30 November 2026: make sure your application vulnerability management procedure says, in writing, how you find vulnerabilities in your code and dependencies, how you rate them, your remediation timelines and how you verify fixes.
- By 31 December 2026: collect evidence that the procedure is followed: scan results, tickets, fix timestamps and exceptions with approvals. A policy without enforcement records is not "enforced" in the sense Rule 1001(a)(1) uses.
- Every year: review the policies under a dated record, as Rule 1001(a)(3) requires for SCI entities.
Why it matters
There was no breach in this order. The SEC penalized a gap between what the rule required on paper and what the firm had written and enforced, made worse by ignoring repeated exam findings. That is the cheapest kind of finding to prevent and one of the most common to get.
For AppSec teams, the takeaway is to make application vulnerability management a documented, approved procedure with evidence attached, not a practice that lives in someone's head or a wiki page labeled draft. Regulators read "draft" as "not established."
Try it yourself
Open your application vulnerability management procedure. Check three things: does it have an approval date in the last 12 months, does it name remediation timelines by severity, and can you produce last month's evidence that those timelines were met? If any answer is no, that is your first ticket.
Click through it at your own pace, or open it full screen.
Quick check
Did OTC Link suffer a cyber incident according to the SEC order?
The order does not describe one. It is about missing or unfinalized written policies and the failure to remediate examination findings between August 2016 and March 2025.
Which Regulation SCI rule requires SCI entities to review their policies and promptly fix deficiencies?
Rule 1001(a)(3). The SEC found OTC Link violated it by failing to take prompt action on deficiencies flagged by examiners.
How long did the access control policy stay in draft?
It was first noted as a draft in connection with a fiscal year 2016 examination, cited again in 2019 and 2022, and still not formally established as of fiscal year 2023.
