United StatesSEC Regulation SCI: systems compliance and integrity policies and procedures
SEC Regulation SCI policies and procedures, 17 CFR 242.1000 and 242.1001
In force since .
A sector security regimes rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
- Establish, maintain, and enforce written policies and procedures reasonably designed to ensure that your SCI systems and, for security standards, your indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain your operational capability and promote fair and orderly markets.
- Include in those policies and procedures, at a minimum, regular reviews and testing of the systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters, and monitoring of the systems to identify potential SCI events.
- Include business continuity and disaster recovery plans reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption.
- Periodically review the effectiveness of the policies and procedures and take prompt action to remedy deficiencies. Policies and procedures consistent with current SCI industry standards are deemed reasonably designed, though compliance with those standards is not the exclusive means to comply.
These lines are LexLint's reading of the law's text, as of .
What this law does
An SCI entity is an SCI self-regulatory organization, SCI alternative trading system, plan processor, exempt clearing agency subject to ARP, or SCI competing consolidator.
Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.
The policies and procedures must include, at a minimum, regular reviews and testing of the systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters. The policies and procedures must also include business continuity and disaster recovery plans reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption.
Policies and procedures are deemed reasonably designed if they are consistent with current SCI industry standards, though compliance with those standards is not the exclusive means of complying. Regulation SCI is effective . The compliance date of Regulation SCI is nine months after the effective date of the regulation, or .
When LexLint raises it
When your app profile says your app provides financial services.