FACT SHEET

Regulation SCI: 

Proposed 

Expansion and 

Updates

U.S. SECURITIES AND EXCHANGE COMMISSION PAGE 1 OF 2

Why This Matters

Regulation SCI was adopted in 2014 to strengthen the technology infrastructure of the U.S. 

securities markets. Regulation SCI applies to certain entities (SCI entities) with respect to 

their automated and similar systems (SCI systems) that directly support any one of six key 

securities market functions—trading, clearance and settlement, order routing, market data, 

market regulation, or market surveillance—as well as systems (indirect SCI systems) that, if 

breached, would be reasonably likely to pose a security threat to SCI systems. These 

systems include those outsourced to third parties. 

Application of Regulation SCI to a broader range of entities, together with updates to account 

for heightened cybersecurity risks, wider use of cloud service providers, and increasingly 

complex and interconnected nature of SCI entities’ systems, should help ensure that the 

technology infrastructure of the U.S. securities markets remains robust, resilient, and secure.

How This Rule Would Apply

SCI entities today include self-regulatory organizations, such as national securities 

exchanges, registered clearing agencies, registered securities associations, and the 

Municipal Securities Rulemaking Board; alternative trading systems meeting volume 

thresholds with respect to National Market System (NMS) stocks and non-NMS stocks;

exclusive disseminators of consolidated market data; certain competing consolidators of 

market data meeting a gross revenue threshold; and certain exempt clearing agencies. 

Regulation SCI currently requires SCI entities to, among other things: have comprehensive 

policies and procedures reasonably designed to ensure that their systems have levels of 

capacity, integrity, resiliency, availability, and security adequate to maintain operational 

capability and promote the maintenance of fair and orderly markets; take appropriate 

corrective action in response to systems issues; provide notices and reports to the 

Commission designed to facilitate oversight of securities market technology; disseminate 

information about systems issues to affected parties; conduct an annual review of 

The Securities and Exchange Commission proposed amendments to expand the scope of 

entities subject to Regulation Systems Compliance and Integrity (SCI) and to update several of 

the regulation’s requirements. These proposed amendments are designed to take account of the 

evolution of technology and trading since the regulation’s adoption in 2014 and to continue to 

help ensure the capacity, integrity, resiliency, availability, and security of the technology 

infrastructure of the U.S. securities markets. 
FACT SHEET | Regulation SCI: Proposed Expansion and Updates

U.S. SECURITIES AND EXCHANGE COMMISSION Page 2 of 2

compliance with Regulation SCI (SCI review); conduct coordinated business continuity and 

disaster recovery (BC/DR) testing; and make, keep, and preserve records.

The proposed amendments would expand the definition of “SCI entities” to include: 

• Registered security-based swap data repositories; 

• Broker-dealers registered with the Commission under Section 15(b) that exceed a 

total assets threshold or a transaction activity threshold in NMS stocks, exchangelisted options, U.S Treasury securities, or Agency securities; and

• All clearing agencies exempted from registration.

The proposed amendments would also update and strengthen Regulation SCI, including to: 

• Specify that an SCI entity’s required policies and procedures include:

o An inventory, classification, and lifecycle management program for SCI 

systems and indirect SCI systems;

o A program to manage and oversee third party providers, including cloud 

service providers, that provide or support SCI or indirect SCI systems.

o BC/DR plans that address the unavailability of any third party provider without 

which there would be a material impact on critical SCI systems; 

o A program to prevent unauthorized access to SCI systems and information 

therein; and

o Identification of current SCI industry standards with which each such policy 

and procedure is consistent, if any;

• Amend the definition of “systems intrusion” to include additional types of cyber events 

and threats, which is intended to capture cybersecurity events such as certain 

distributed denial-of-service attacks, and require notification of systems intrusions to 

the Commission without delay;

• Update the SCI review to specify that objective personnel assess the risks to covered 

systems, internal control design and operating effectiveness, and third-party provider 

management risks and controls, and require penetration testing at least annually; 

• Specify that SCI entities include key third-party providers in annual BC/DR testing; 

and

• Update Regulation SCI’s recordkeeping provisions and Form SCI consistent with 

these amendments.

Additional Information:

The public comment period will remain open until 60 days after the date of publication of the proposing release 

in the Federal Register.