SEC fines OTC Link $575,000 over nine years of unresolved system-security compliance failures
The censure and civil penalty resolve findings that the broker-dealer repeatedly failed to fix written policy gaps around system security, access control and vulnerability management for its OTC Link ATS platform, despite examiners flagging the deficiencies multiple times since 2016.
The SEC announced on September 22 that it censured broker-dealer OTC Link LLC and ordered the firm to pay a $575,000 civil penalty, settling allegations that it violated Regulation Systems Compliance and Integrity, known as Reg SCI, over a nine-year span.
According to the SEC’s order, between August 2016 and March 2025 OTC Link failed to establish, maintain and enforce written policies and procedures reasonably designed to ensure the security, access control and vulnerability management of the systems supporting its OTC Link ATS, an alternative trading system used for quoting and trading over-the-counter securities. Reg SCI requires certain market infrastructure entities, including significant ATSs, to maintain robust technology-governance programs precisely because a systems failure at that layer can disrupt trading market-wide.
The SEC found that the deficiencies were not a one-time lapse: examiners flagged the same categories of gaps to the firm on multiple occasions across the nine-year period, and OTC Link repeatedly failed to fully remediate them. OTC Link settled without admitting or denying the SEC’s findings, as is standard in SEC administrative settlements of this kind.
The size of the penalty is modest relative to some recent fintech and market-structure settlements, but the length of the violation period is the more notable element: it points to a compliance program that examiners identified as deficient repeatedly over nearly a decade without the underlying issues being fixed, which is the pattern Reg SCI enforcement actions have increasingly targeted across market infrastructure providers.