The Securities and Exchange Commission today censured New York-based broker dealer OTC Link LLC and ordered it to pay a $575,000 civil penalty for longstanding violations of Regulation Systems Compliance and Integrity (SCI).

According to the SEC’s settled order, between August 2016 and March 2025, OTC Link LLC failed to establish, maintain, and enforce certain written policies and procedures required by Regulation SCI for OTC Link ATS—an alternative trading system for over-the-counter securities that it operates—including policies and procedures pertaining to system security, access control, and application vulnerability management, testing, and remediation. Although staff in the SEC’s Division of Examinations examined OTC Link ATS several times during the relevant period and each time flagged certain required policies and procedures that the firm had not established or kept in draft form and failed to finalize or enforce, the SEC’s order finds that OTC Link LLC repeatedly failed to promptly remediate such deficiencies.

“OTC Link’s continual failure to remediate deficiencies even after they were repeatedly flagged by Division of Examinations staff reflects a disregard for their findings and the overall examinations process and justifies a meaningful penalty,” said Laura D’Allaird, Chief of the Division of Enforcement’s Cyber and Emerging Technologies Unit. “All SCI entities are expected to take their regulatory responsibilities seriously and promptly fix issues when they’re identified.”         

The SEC’s order finds that OTC Link LLC lacked written policies and procedures that were reasonably designed to ensure that OTC Link ATS’s SCI systems and, for purposes of security standards, indirect SCI systems, had levels of capacity, integrity, resiliency, availability, and security adequate to maintain OTC Link ATS’s operational capability and promote the maintenance of fair and orderly markets in violation of Rule 1001(a)(1) of Regulation SCI. By failing to have required minimum policies and procedures, to periodically review the effectiveness of its policies and procedures, and to take prompt action to remedy its deficiencies, the SEC’s order also finds that OTC Link LLC violated Rules 1001(a)(2) and 1001(a)(3). Without admitting the findings, OTC Link LLC agreed to a cease-and-desist order, a censure, and a civil penalty of $575,000.