SEC fines OTC Link $575,000 over years of ignored cybersecurity rule warnings

The Securities and Exchange Commission censured OTC Link LLC on September 22 and ordered the New York broker-dealer to pay a $575,000 civil penalty, finding it failed for nearly nine years to put in place cybersecurity policies required under Regulation Systems Compliance and Integrity (Reg SCI) — and kept failing even after examiners repeatedly flagged the gaps.

OTC Link operates OTC Link ATS, an alternative trading system for over-the-counter securities. According to the SEC's settled order, from August 2016 to March 2025 the firm did not establish, maintain, and enforce written policies and procedures Reg SCI requires, including ones covering system security, access control, and application vulnerability management, testing, and remediation. The SEC found this breached Rule 1001(a)(1), which requires SCI systems to have adequate capacity, integrity, resiliency, availability, and security. It also found violations of Rules 1001(a)(2) and 1001(a)(3) for failing to periodically review whether its policies worked and to promptly fix known problems.

The repeat-offender framing is the SEC's own. Its Division of Examinations examined OTC Link ATS several times during the period, and each time flagged required policies the firm either had never written or had left in unfinalized draft form — yet, the order says, OTC Link "repeatedly failed to promptly remediate" them. "OTC Link's continual failure to remediate deficiencies even after they were repeatedly flagged by Division of Examinations staff reflects a disregard for their findings and the overall examinations process and justifies a meaningful penalty," said Laura D'Allaird, chief of the Enforcement Division's Cyber and Emerging Technologies Unit.

Without admitting or denying the findings, OTC Link agreed to a cease-and-desist order, a censure, and the $575,000 penalty.

Key facts

• Penalty: $575,000 civil penalty, plus a censure and cease-and-desist order (SEC order, Sept. 22, 2026).
• Conduct period: August 2016–March 2025 (SEC order).
• Rules cited: Reg SCI Rules 1001(a)(1), 1001(a)(2), and 1001(a)(3) (SEC order).
• Entity: OTC Link LLC, operator of OTC Link ATS, an OTC-securities ATS (SEC order).
• Resolution: settled, no admission of findings (SEC order).

The real-world read

This is a settlement, not a court finding, and OTC Link neither admitted nor denied the SEC's account — standard for these resolutions, but worth stating plainly. The order describes no breach, data loss, or market disruption; the charge is paperwork and process — missing or unfinalized policies, not a hack. What the SEC is punishing is the pattern: examiners flagging the same gaps across multiple visits and the firm not closing them. The penalty size reads as a message to other SCI entities about ignoring examiner findings, more than a reflection of demonstrated harm. Note the source: this account comes solely from the SEC's own release and order. OTC Link's side isn't reflected here, and the release doesn't say what, if anything, was ultimately remediated after March 2025.

Opinion, and whose

The SEC's D'Allaird cast the case as one about respect for the examinations process, arguing the repeat failures "justif[y] a meaningful penalty." That characterization is the regulator's; OTC Link, having settled without admissions, has not publicly contested or endorsed it.

Sources

• SEC — Press Release, "SEC Censures OTC Link LLC for Repeated Compliance Failures Related to Regulation SCI," Sept. 22, 2026 (primary): the penalty, conduct period, rules cited, the D'Allaird quote, and settlement terms. Links to the underlying SEC order. Government enforcement announcement — not marketing; reflects the regulator's account only.

This is news reporting, not financial or legal advice.