Federal Register / Vol. 88, No. 225 / Friday, November 24, 2023 / Notices 82441 

28Section 19(b)(2) of the Act, as amended by the 

Securities Acts Amendments of 1975, Public Law 

94–29 (June 4, 1975), grants the Commission 

flexibility to determine what type of proceeding— 

either oral or notice and opportunity for written 

comments—is appropriate for consideration of a 

particular proposal by a self-regulatory 

organization. See Securities Acts Amendments of 

1975, Senate Comm. on Banking, Housing & Urban 

Affairs, S. Rep. No. 75, 94th Cong., 1st Sess. 30 

(1975). 29 17 CFR 200.30–3(a)(57). 

1 15 U.S.C. 78s(b)(1). 

2 17 CFR 240.19b–4. 

3Securities Exchange Act Release No. 97225 

(Mar. 30, 2023), 88 FR 20195 (Apr. 5, 2023) (File 

No. SR–OCC–2023–003) (‘‘Notice of Filing’’). 4Comments on the proposed rule change are 

available at https://www.sec.gov/comments/sr-occ2023-003/srocc2023003.htm. 5 15 U.S.C. 78s(b)(2). 

6See Securities Exchange Act Release No. 97525 

(May 18, 2023), 88 FR 33655 (May 24, 2023) (File 

No. SR–OCC–2023–003). 

7See Securities Exchange Act Release No. 97602 

(May 26, 2023), 88 FR 36351 (June 2, 2023) (File 

No. SR–OCC–2023–003) (‘‘Notice of Partial 

Amendment’’). OCC submitted Partial Amendment 

No. 1 in response to comments regarding the 

proposed definition of ‘‘Security Incident’’ for 

purposes of proposed Rule 213(d), the notification 

requirements and procedure in the event of a 

Security Incident, factors considered when 

determining whether to disconnect or reduce a 

clearing member’s access, and clarification related 

to reconnection. 

8Capitalized terms used but not defined herein 

have the meanings specified in OCC’s Rules and ByLaws, available at https://www.theocc.com/about/ 

publications/bylaws.jsp. 

market? What are commenters’ views on 

the extent to which that correlation 

provides evidence that the CME bitcoin 

futures market is ‘‘significant’’ related to 

spot bitcoin? 

III. Procedure: Request for Written 

Comments 

The Commission requests that 

interested persons provide written 

submissions of their views, data, and 

arguments with respect to the issues 

identified above, as well as any other 

concerns they may have with the 

proposal. In particular, the Commission 

invites the written views of interested 

persons concerning whether the 

proposal is consistent with Section 

6(b)(5) or any other provision of the Act, 

and the rules and regulations 

thereunder. Although there do not 

appear to be any issues relevant to 

approval or disapproval that would be 

facilitated by an oral presentation of 

views, data, and arguments, the 

Commission will consider, pursuant to 

Rule 19b–4, any request for an 

opportunity to make an oral 

presentation.28

Interested persons are invited to 

submit written data, views, and 

arguments regarding whether the 

proposed rule change should be 

approved or disapproved by December 

15, 2023. Any person who wishes to file 

a rebuttal to any other person’s 

submission must file that rebuttal by 

December 29, 2023. 

Comments may be submitted by any 

of the following methods: 

Electronic Comments 

• Use the Commission’s internet 

comment form (https://www.sec.gov/ 

rules/sro.shtml); or 

• Send an email to rule-comments@

sec.gov. Please include file number 

SR–CboeBZX–2023–058 on the 

subject line. 

Paper Comments 

• Send paper comments in triplicate 

to Secretary, Securities and Exchange 

Commission, 100 F Street NE, 

Washington, DC 20549–1090. 

All submissions should refer to file 

number SR–CboeBZX–2023–058. This 

file number should be included on the 

subject line if email is used. To help the 

Commission process and review your 

comments more efficiently, please use 

only one method. The Commission will 

post all comments on the Commission’s 

internet website (https://www.sec.gov/ 

rules/sro.shtml). Copies of the 

submission, all subsequent 

amendments, all written statements 

with respect to the proposed rule 

change that are filed with the 

Commission, and all written 

communications relating to the 

proposed rule change between the 

Commission and any person, other than 

those that may be withheld from the 

public in accordance with the 

provisions of 5 U.S.C. 552, will be 

available for website viewing and 

printing in the Commission’s Public 

Reference Room, 100 F Street NE, 

Washington, DC 20549, on official 

business days between the hours of 10 

a.m. and 3 p.m. Copies of the filing also 

will be available for inspection and 

copying at the principal office of the 

Exchange. Do not include personal 

identifiable information in submissions; 

you should submit only information 

that you wish to make available 

publicly. We may redact in part or 

withhold entirely from publication 

submitted material that is obscene or 

subject to copyright protection. All 

submissions should refer to file number 

SR–CboeBZX–2023–058 and should be 

submitted on or before December 15, 

2023. Rebuttal comments should be 

submitted by December 29, 2023. 

For the Commission, by the Division of 

Trading and Markets, pursuant to delegated 

authority.29

Sherry R. Haywood, 

Assistant Secretary. 

[FR Doc. 2023–25882 Filed 11–22–23; 8:45 am] 

BILLING CODE 8011–01–P 

SECURITIES AND EXCHANGE 

COMMISSION 

[Release No. 34–98979; File No. SR–OCC– 

2023–003] 

Self-Regulatory Organizations; The 

Options Clearing Corporation; Order 

Granting Approval of Proposed Rule 

Change, as Modified by Partial 

Amendment No. 1, Concerning 

Clearing Member Cybersecurity 

Obligations 

November 17, 2023. 

I. Introduction 

On March 21, 2023, the Options 

Clearing Corporation (‘‘OCC’’) filed with 

the Securities and Exchange 

Commission (‘‘Commission’’) the 

proposed rule change SR–OCC–2023– 

003 pursuant to Section 19(b) of the 

Securities Exchange Act of 1934 

(‘‘Exchange Act’’) 1 and Rule 19b–4 2

thereunder. The proposed rule change 

would amend certain provisions in 

OCC’s Rules relating to each Clearing 

Member’s obligation to address a 

‘‘Security Incident’’ (i.e., the occurrence 

of a cyber-related disruption or 

intrusion of a Clearing Member’s 

systems that is reasonably likely to pose 

an imminent risk or threat to OCC’s 

operations) of that Clearing Member. 

The proposed rule change was 

published for public comment in the 

Federal Register on April 5, 2023.3 The 

Commission has received comments 

regarding the proposed rule change.4

On May 18, 2023, pursuant to the 

Section 19(b)(2) of the Exchange Act,5

the Commission designated a longer 

period within which to approve, 

disapprove, or institute proceedings to 

determine whether to approve the 

proposed rule change.6 On May 24, 

2023, OCC filed Partial Amendment No. 

1 to the Notice of Filing.7 For the 

reasons discussed below, the 

Commission is approving the proposed 

rule change, as modified by Partial 

Amendment No. 1 (hereinafter, 

‘‘proposed rule change’’). 

II. Background 

Currently, the only OCC Rule 

governing a Clearing Member’s 

cybersecurity obligations to OCC is Rule 

219, titled ‘‘Cybersecurity 

Confirmation.’’ 8 It requires Clearing 

Members and applicants for clearing 

membership to submit to OCC a form 

called the ‘‘Cybersecurity Confirmation’’ 

at least every two years or as part of its 

application materials. Through the form, 


ddrumheller on DSK120RN23PROD with NOTICES1
82442 Federal Register / Vol. 88, No. 225 / Friday, November 24, 2023 / Notices 

9The renumbering follows proposed changes to 

OCC’s clearing membership standards, which 

includes removal of current Rules 213 through 218. 

See Securities Exchange Act Release No. 97150 

(Mar. 15, 2023), 88 FR 17046 (Mar. 21, 2023) (File 

No. SR–OCC–2023–002). 

10Specifically, OCC would add the following 

headings: ‘‘Cybersecurity Confirmation 

Submission’’ to paragraph (a); ‘‘Representations in 

the Cybersecurity Confirmation’’ to paragraph (b); 

and ‘‘Execution of the Cybersecurity Confirmation’’ 

to paragraph (c). 

11 In response to public comment, OCC amended 

the proposed rule change to specify that a 

disruption or intrusion of a Clearing Member’s 

systems would only be deemed a Security Incident 

if it is ‘‘reasonably likely to pose an imminent risk 

or threat to OCC’s operations.’’ See Notice of Partial 

Amendment, 88 FR at 36352. 

12 In response to public comment, OCC added the 

non-exhaustive list of potential Security Incidents 

to clarify that the focus of the Rule would be on 

the potential impact on OCC of a disruption or 

intrusion. See Notice of Partial Amendment, 88 FR 

at 36352. 

13See Notice of Partial Amendment, 88 FR at 

36352. 

14 In response to public comment, OCC amended 

its proposed rule to specify that these are the types 

of factors OCC would consider when determining 

whether to disconnect a Clearing Member. See 

Notice of Partial Amendment, 88 FR at 36353. OCC 

also clarified its anticipation that not all Security 

Incident notifications will result in a Clearing 

Member disconnection. See id. at 36352. 

Clearing Members and applicants 

confirm that they maintain a 

comprehensive cybersecurity program 

that meets certain criteria (e.g., the 

cybersecurity program is approved by 

senior management, it is reviewed and 

updated periodically, the cybersecurity 

program is designed to protect the 

segment of the Clearing Member’s or 

applicant’s system that interacts with 

OCC, it includes a process for the 

Clearing Member to remediate cyber 

issues, etc.). However, current Rule 219 

does not require Clearing Members to 

notify OCC if they experience a 

cybersecurity incident that could impact 

OCC or otherwise address OCC’s 

processes, or the Clearing Member’s 

obligations with respect to OCC. 

The proposed rule change would 

renumber Rule 219 as Rule 213 and 

rename the rule ‘‘Cybersecurity 

Obligations’’ to reflect the expanded 

scope of the Rule.9 It also would add 

section headings to the Rule and replace 

references to ‘‘OCC’’ with references to 

‘‘the Corporation,’’ but otherwise would 

not change the provisions regarding the 

existing Cybersecurity Confirmation 

form that confirms the existence of a 

Clearing Member’s cybersecurity 

program.10

The substantive changes to the Rule 

would be the addition of two new 

subsections—(d) and (e)—titled 

‘‘Occurrence of a Security Incident’’ and 

‘‘Procedures for Connecting Following a 

Security Incident,’’ respectively. New 

subsection (d) would require a Clearing 

Member to immediately notify OCC if 

the member becomes aware or should be 

aware of a Security Incident (as defined 

in the Rule). It would also specify that 

OCC may take actions reasonably 

necessary to mitigate any effects on its 

operations following a Security 

Incident. New subsection (e) would 

require a Clearing Member wishing to 

reconnect its systems to OCC’s systems 

to provide OCC with a new form, titled 

‘‘Reconnection Attestation,’’ that 

describes the Security Incident and 

attests to certain security requirements, 

as well as an associated checklist, titled 

‘‘Reconnection Checklist,’’ that 

describes the affected Clearing 

Member’s remediation efforts and other 

key information. Each of these proposed 

changes is described in greater detail 

below. 

A. New Paragraph (d): Occurrence of a 

Security Incident 

Proposed Rule 213(d) would define a 

Security Incident as an incident that has 

occurred or is occurring involving a 

cyber-related disruption or intrusion of 

the Clearing Member’s system(s) that is 

reasonably likely to pose an imminent 

risk or threat to OCC’s operations.11 To 

provide guidance regarding the types of 

disruptions or intrusions that might be 

considered Security Incidents, the 

proposed rule includes a nonexhaustive list of examples. 

Specifically, a Security Incident may 

include any disruption or degradation of 

the normal operation of the Clearing 

Member’s systems or any unauthorized 

entry into the Clearing Member’s 

systems that would result in loss of 

OCC’s data or system integrity, an 

unauthorized disclosure of sensitive 

information related to OCC, or the 

inability of OCC to conduct essential 

clearance and settlement functions.12

Under the proposed rule, a Clearing 

Member would be required to 

immediately notify OCC if the member 

becomes aware or should be aware that 

there has been a Security Incident or 

that a Security Incident is occurring.13

The Clearing Member would also need 

to promptly confirm such notice in 

writing. 

The proposed rule would specify that, 

if OCC receives notice of a Security 

Incident from a Clearing Member or has 

a reasonable basis to believe a Security 

Incident has occurred or is occurring, 

OCC may take actions reasonably 

necessary to mitigate any effects to its 

operations, including disconnecting the 

Clearing Member’s access to OCC’s 

information and data systems or 

modifying the scope and specifications 

of such access. Finally, paragraph (d) of 

the proposed rule would provide a nonexhaustive list of factors OCC may 

consider in determining whether to 

modify a Clearing Member’s access to 

OCC’s information and data systems, up 

to and including disconnection, in 

response to a Security Incident. 

Specifically, among other factors, OCC 

may consider the potential loss of 

control by a Clearing Member of its 

internal system(s), the potential loss of 

OCC’s confidential data, the potential 

strain on or loss of OCC’s resources due 

to OCC’s inability to perform clearance 

and settlement functions, and the 

overall severity of the threat to the 

security and operations of OCC.14

Further, if the Corporation reasonably 

determines that disconnection of a 

Clearing Member is necessary, the 

Clearing Member must continue to meet 

its obligations to the Corporation, 

notwithstanding disconnection from the 

Corporation’s systems. 

B. New Paragraph (e): Procedures for 

Connecting Following a Security 

Incident That Results in Disconnection 

Proposed Rule 213(e) would clarify 

the process for a Clearing Member to 

request reconnection to OCC’s systems 

following disconnection as a result of a 

Security Incident. In particular, the 

Clearing Member would need to 

complete and submit, upon OCC’s 

request, a new form referred to by OCC 

as the ‘‘Reconnection Attestation’’ and a 

related checklist referred to by OCC as 

the ‘‘Reconnection Checklist.’’ The 

Reconnection Attestation would include 

a text box for the Clearing Member to 

provide a narrative description of the 

Security Incident and five 

representations to which, by signing the 

form, the Clearing Member would be 

attesting. Specifically, by signing the 

Reconnection Attestation, the Clearing 

Member would be attesting that it has: 

• provided full, complete and 

accurate information in response to all 

requests made by OCC regarding the 

Security Incident, including all requests 

contained in the Reconnection 

Checklist, on a good faith, best efforts 

basis; 

• provided full, complete and 

accurate information regarding any OCC 

data or systems that were potentially 

compromised during the Security 

Incident, including any potential 

exposure of credentials used to access 

OCC’s systems, and will immediately 

notify OCC if it later becomes aware of 

a previously undetected or unreported 

compromise of OCC data or systems 

during the Security Incident; 


ddrumheller on DSK120RN23PROD with NOTICES1
Federal Register / Vol. 88, No. 225 / Friday, November 24, 2023 / Notices 82443 

15The proposed language would further specify 

that the Clearing Member has communicated the 

existence of Failed Controls to OCC and is 

remediating or has remediated all Failed Controls. 

16See proposed Rule 213(e)(1)(A) through (E). 

Further, each Reconnection Attestation must be 

provided in writing and signed by a designated 

senior executive of the Clearing Member. 

17The description of the checklist provided here 

is based on the Exhibit 3 to File No. SR–OCC–2023– 

003 provided by OCC at the time of filing. 

18These are the specific questions included in the 

Reconnection Checklist that OCC submitted as 

Exhibit 3 to the proposed rule change. See Exhibit 

3 to File No. SR OCC2023–003. However, proposed 

Rule 213(e)(2) specifies that the Reconnection 

Checklist may require ‘‘information including, but 

not limited to,’’ the 11 questions noted above. This 

is to account for the evolving nature of Security 

Incidents and provide OCC with flexibility to 

modify the specific information requirements if 

necessary. See Notice of Filing, 88 FR at 20196. 

19See Notice of Filing, 88 FR at 20196. 

20 Id. at 20197. 

21 Id. 

22 15 U.S.C. 78s(b)(2)(C). 

23Rule 700(b)(3), Commission Rules of Practice, 

17 CFR 201.700(b)(3). 

24 Id. 

25 Id. 26Susquehanna Int’l Group, LLP v. Securities and 

Exchange Commission, 866 F.3d 442, 447 (D.C. Cir. 

2017) (‘‘Susquehanna’’). 27 15 U.S.C. 78q–1(b)(3)(F). 

28 17 CFR 240.17Ad–22(e)(17)(i). 

29 15 U.S.C. 78q–1(b)(3)(F). 

• determined whether the Security 

Incident resulted, directly or indirectly, 

from any controls that failed or were 

circumvented by its employees, 

contractors or agents (‘‘Failed 

Controls’’); 15

• implemented, or will implement 

promptly, technical and operational 

changes, both preventative and 

detective, with the intent to prevent a 

recurrence of the Security Incident and 

has provided written summaries of such 

changes to OCC; and 

• complied and will continue to 

comply with all applicable laws in 

connection with its response to the 

Security Incident, including any 

notifications required to be provided to 

government agencies, OCC, and third 

parties.16

The associated Reconnection 

Checklist would include questions 

designed to elicit additional details 

regarding the Security Incident, 

including the potential cause of the 

incident, steps taken to contain it, the 

exposure and impact to OCC’s systems 

or data, the Clearing Member’s 

remediation efforts, and any other 

details relevant to the Clearing 

Member’s request to reconnect to OCC’s 

systems. The Reconnection Checklist 

would require the Clearing Member to 

respond to the following questions: 17

• was the disconnection the result of 

a cybersecurity-related incident; 

• describe the nature of the incident; 

• what steps were taken to contain 

the incident; 

• what OCC data, if any, was 

compromised during the incident; 

• what OCC systems, if any, were 

impacted during the incident; 

• was there any risk of exposure of 

credentials used to access OCC systems 

and, if so, were the credentials reissued; 

• which controls were circumvented 

or failed that led to the incident 

occurring; 

• what changes, preventative and 

detective, were implemented to prevent 

a reoccurrence; 

• how has data integrity been 

preserved and what data checks have 

been performed prior to reconnecting to 

and sending/receiving data to/from 

OCC; 

• have third-parties, including 

government agencies, been notified; and 

• any additional details relevant to 

reconnection.18

According to OCC, the Reconnection 

Attestation and Reconnection Checklist 

are designed to accomplish several 

goals. First, they are designed to enable 

OCC to determine whether the risk or 

threat to OCC has been mitigated 

sufficiently for OCC to resume 

connectivity to the Clearing Member.19

Second, they are designed to provide 

OCC with evidence related to a Clearing 

Member’s response to a Security 

Incident, including whether the 

Clearing Member has appropriate 

security requirements and carried out 

suitable remediation measures, to 

enable OCC to better understand and 

manage Security Incidents more 

broadly.20 Finally, they would better 

enable OCC to identify areas of interest, 

concern, or heightened risk by 

presenting information in a 

standardized format.21

III. Discussion and Commission 

Findings 

Section 19(b)(2)(C) of the Exchange 

Act directs the Commission to approve 

a proposed rule change of a selfregulatory organization if it finds that 

such proposed rule change is consistent 

with the requirements of the Exchange 

Act and the rules and regulations 

thereunder applicable to such 

organization.22 Under the Commission’s 

Rules of Practice, the ‘‘burden to 

demonstrate that a proposed rule change 

is consistent with the Exchange Act and 

the rules and regulations issued 

thereunder . . . is on the self-regulatory 

organization [‘SRO’] that proposed the 

rule change.’’ 23

The description of a proposed rule 

change, its purpose and operation, its 

effect, and a legal analysis of its 

consistency with applicable 

requirements must all be sufficiently 

detailed and specific to support an 

affirmative Commission finding,24 and 

any failure of an SRO to provide this 

information may result in the 

Commission not having a sufficient 

basis to make an affirmative finding that 

a proposed rule change is consistent 

with the Exchange Act and the 

applicable rules and regulations.25

Moreover, ‘‘unquestioning reliance’’ on 

an SRO’s representations in a proposed 

rule change is not sufficient to justify 

Commission approval of a proposed rule 

change.26

After carefully considering the 

proposed rule change, the Commission 

finds that the proposed rule change is 

consistent with the requirements of the 

Exchange Act and the rules and 

regulations thereunder applicable to 

OCC. More specifically, the Commission 

finds that the proposal is consistent 

with Section 17A(b)(3)(F) of the 

Exchange Act 27 and Rule 17Ad– 

22(e)(17)(i) 28 thereunder as described in 

detail below. 

A. Consistency With Section 

17A(b)(3)(F) of the Exchange Act 

Section 17A(b)(3)(F) of the Exchange 

Act requires, among other things, that a 

clearing agency’s rules are designed to 

promote the prompt and accurate 

clearance and settlement of securities 

transactions.29 In addition to 

centralizing relevant information 

pertaining to Clearing Member Security 

Incidents in a single rule, the proposed 

rule change is designed to support 

OCC’s management of potential 

cybersecurity risks by enhancing OCC’s 

ability to identify and mitigate 

cybersecurity risks posed by a Security 

Incident experienced by one of OCC’s 

Clearing Members. It also is designed to 

standardize OCC’s cybersecurity risk 

management practices with respect to 

such Security Incidents. Among other 

things, the changes set forth Clearing 

Member obligations and the actions 

OCC may take if reasonably necessary to 

mitigate the effects of a Security 

Incident on its operations. As discussed 

further below, the changes also 

strengthen OCC’s ability to manage its 

cyber-related risks by requiring Clearing 

Members to immediately notify OCC if 

the Clearing Member becomes aware of 

or should be aware that there has been 

a Security Incident or one is occurring, 

and promptly confirm such a notice in 

writing. Taken together, the proposed 

changes should strengthen OCC’s 

cybersecurity risk management 

processes. By creating a consistent set of 

obligations on Clearing Members for 

identifying and reporting Security 


ddrumheller on DSK120RN23PROD with NOTICES1
82444 Federal Register / Vol. 88, No. 225 / Friday, November 24, 2023 / Notices 

30 17 CFR 240.17Ad–22(e)(17)(i). 

31See Standards for Covered Clearing Agencies, 

Securities Exchange Act Release No. 78961 (Sept. 

28, 2016), 81 FR 70786, 70838 (Oct. 13, 2016). 

32See letter from Howard Meyerson, Managing 

Director, Financial Information Forum (‘‘FIF’’), 

dated April 26, 2023, to Vanessa Countryman, 

Secretary, Commission (‘‘FIF Letter’’). 

33 Id. at 2–3. FIF stated that, as drafted, a Security 

Incident could include an incident that would not 

affect OCC systems and this approach appears to be 

overly broad with the risks identified in the 

proposed rule change, indicating that the reference 

to ‘‘disruption or degradation of a clearing 

member’s systems’’ in the proposed definition of 

Security Incident is ambiguous. Id. at 2. 

34 Id. at 4–5. 

35 Id. at 3. 

36 Id. at 5–6. 

37See Notice of Partial Amendment supra note 7. 

38 Id. 

39 Id. 

40 Id. 

41FIF Letter at 5. 

Incidents, OCC would enhance its 

ability to monitor, mitigate, and manage 

cybersecurity risks—such as 

unauthorized disclosure of sensitive 

information or a loss of data or system 

integrity—in the event a Clearing 

Member experiences a Security 

Incident. Because OCC’s information, 

data, and systems support and enable 

OCC’s ability to conduct essential 

clearance and settlement functions, 

enhancing OCC’s ability to limit the 

impact of a Security Incident at a 

Clearing Member promotes OCC’s 

ability to continue the prompt and 

accurate clearance and settlement of 

securities transactions. 

Accordingly, and for the reasons 

discussed below, the proposal is 

consistent with the requirements of 

Section 17A(b)(3)(F) of the Exchange 

Act. 

B. Consistency With Rule 17Ad– 

22(e)(17)(i) of the Exchange Act 

Rule 17Ad–22(e)(17)(i) requires that a 

covered clearing agency establish, 

implement, maintain and enforce 

written policies and procedures 

reasonably designed to manage the 

covered clearing agency’s operational 

risks by identifying the plausible 

sources of operational risk, both internal 

and external, and mitigating their 

impact through the use of appropriate 

systems, policies, procedures, and 

controls.30 In adopting Rule 17Ad– 

22(e)(17)(i), the Commission provided 

guidance, stating that a covered clearing 

agency generally should consider, 

among other things, whether it 

identifies, monitors, and manages the 

risks that key participants pose to its 

operations.31 To the extent they interact 

with OCC’s systems, Clearing Member 

systems may present operational risk to 

OCC. As described above, OCC proposes 

requiring members to report any cyberrelated disruption or intrusion that 

could pose a risk to OCC’s operations, 

such as a degradation of normal 

operations that would result in the 

inability of OCC to conduct essential 

clearance and settlement functions. OCC 

also proposes numerous protective 

measures, such as the ability to take 

reasonably necessary actions to mitigate 

the effects of a Security Incident on its 

operations, including disconnecting the 

Clearing Member’s access to OCC’s 

systems; the ability to consider a nonexhaustive list of factors to determine 

whether to modify a Clearing Member’s 

access to OCC’s systems in response to 

a Security Incident, up to and including 

disconnection; and the requirement for 

disconnected Clearing Members to 

complete a Reconnection Attestation 

and Reconnection Checklist that OCC 

would review and evaluate as part of a 

determination to reconnect the Clearing 

Member to OCC’s systems. Taken 

together, these proposals support OCC’s 

ability to effectively identify, monitor, 

and manage the risks that Clearing 

Members pose to OCC operations, and 

are therefore consistent with Rule 

17Ad–22(e)(17)(i). 

A commenter opposed the proposal 

on a number of grounds.32 Specifically, 

the commenter expressed concerns 

about the proposed definition of 

Security Incident, stating that because 

the proposed definition applies to all of 

a Clearing Member’s systems and 

therefore could include an incident that 

would not affect OCC systems, the 

definition is inconsistent with the risks 

identified by OCC in the rule filing, 

other regulatory and SRO requirements, 

and is potentially beyond the scope of 

OCC’s authority.33 The commenter also 

stated that OCC’s proposed definition of 

Security Incident is inconsistent with 

other regulatory and SRO requirements 

because it does not require that a loss or 

harm has occurred and it does not 

require that a clearing member be aware 

of the incident.34 The commenter stated 

that the definition of Security Incident 

should be limited to an incident that 

could result in ‘‘loss of data or system 

integrity,’’ ‘‘unauthorized disclosure of 

sensitive information,’’ or ‘‘an inability 

[for the OCC] to conduct essential 

clearance and settlement functions.’’ 35

The commenter further requested 

clarification that the reference to 

‘‘disruption or degradation of a clearing 

member’s systems’’ in the proposed 

definition of Security Incident is limited 

to cyber-related disruptions or 

intrusions resulting from malicious 

third-party activity as opposed to, for 

example, a power outage.36

OCC responded by amending the 

proposed rule change in a number of 

ways.37 First, OCC amended the 

definition of Security Incident to limit 

it to a cyber-related disruption or 

intrusion of the Clearing Member’s 

systems that is reasonably likely to pose 

an imminent risk or threat to OCC’s 

operations.38 OCC further amended the 

definition of Security Incident to state 

that such an incident may include, but 

is not limited to, any disruption or 

degradation of the normal operation of 

the Clearing Member’s systems or any 

unauthorized entry into the Clearing 

Member’s systems that would result in 

loss of OCC’s data or system integrity, 

unauthorized disclosure of sensitive 

information related to OCC, or the 

inability of OCC to conduct essential 

clearance and settlement functions.39 In 

amending the Security Incident 

definition this way, OCC reasonably 

addressed the commenter’s concerns 

about the scope of the rule by clarifying 

that only occurrences that present 

certain risks or threats to OCC’s 

operations are considered Security 

Incidents, and provided examples to 

help illustrate the types of risks and 

threats to OCC’s operation that are 

covered by the rule. In response to the 

commenter’s concern that the proposed 

definition of Security Incident does not 

require that a clearing member be aware 

of the Incident, OCC also amended the 

proposed definition to require notice 

only if the Clearing Member becomes 

aware or should be aware that such an 

incident has occurred or is occurring.40

The commenter further stated that OCC 

‘‘should incorporate into the notice 

provision a [condition] that only 

requires reporting when a clearing 

member has a reasonable basis to 

conclude that a reportable cybersecurity 

incident has occurred or determines that 

a reportable cybersecurity incident has 

occurred.’’ 41 As noted, OCC amended 

the proposed definition to require 

reporting only where a Clearing Member 

becomes or should be aware of a 

Security Incident. The proposed rule 

change therefore would require Clearing 

Members to engage in reasonable 

diligence to obtain and report to OCC 

readily discoverable information about a 

Security Incident, consistent with the 

Clearing Member’s current obligation to 

maintain a comprehensive cybersecurity 

program that, among other things, is 

designed to protect the segment of the 

Clearing Member’s system that interacts 

with OCC, but it would not require 

reporting of a cybersecurity incident if 

the member could not reasonably be 

aware of such an incident. OCC’s 


ddrumheller on DSK120RN23PROD with NOTICES1
Federal Register / Vol. 88, No. 225 / Friday, November 24, 2023 / Notices 82445 

42 Id. at 5–6. 

43 Id. at 5. 

44See Notice of Partial Amendment, 88 FR at 

36352. 

45See id. 

46The clarification provided by OCC also 

addresses a commenter concern that the disclosure 

should ‘‘take into account the fact that target firms 

often have incomplete information about a 

cybersecurity incident and engage in an 

investigative process over a period of time.’’ FIF 

Letter at 7. OCC’s ability to follow up directly as 

needed ensures that Clearing Members will have an 

opportunity to provide additional information as 

facts develop. 

47 Id. at 6–7. 

48 Id. at 7. 

49See Notice of Partial Amendment supra note 7. 

50See Notice of Partial Amendment, 88 FR at 

36353. 

response reasonably balances the 

commenter’s concern about being 

required to report unknown information 

and OCC’s need to ensure that its 

Clearing Members are diligently 

monitoring their own systems so that 

OCC can identify, monitor, and manage 

the impact of a Security Incident at a 

Clearing Member on OCC’s systems and 

operations, as well as the listed options 

markets generally. 

A commenter stated that the content 

of the notification should be limited in 

scope given the requirement for 

‘‘immediate’’ notification, and 

recommended that OCC should provide 

more detail about the expected content 

in the notification.42 The commenter 

also expressed the view that the need 

for immediate written notice ‘‘does not 

provide a clearing member with the 

opportunity to evaluate the incident 

prior to reporting.’’ 43 OCC addressed 

these comments in the amendment by 

clarifying the notification requirements 

and procedure in the event of a Security 

Incident. Specifically, because there are 

‘‘innumerable circumstances that could 

lead to a Security Incident,’’ rather than 

requiring the notice to include specific, 

pre-determined content, OCC clarified 

that a Clearing Member can share 

information it believes is relevant, and 

that OCC can follow up directly as 

needed.44 OCC also noted that, given the 

urgency required to address a Security 

Incident quickly and remain functional 

as a systemically important financial 

market utility, OCC will provide a 

dedicated email address for Clearing 

Members to provide OCC with written 

notification (or confirmation) of a 

Security Incident.45 By clarifying that 

the notice is limited to information the 

affected Clearing Member believes is 

relevant and that OCC can follow up 

directly with the Clearing Member as 

needed, OCC’s response reasonably 

balances the commenter’s concern about 

the rule not specifying what information 

needs to be included in the notice and 

OCC’s need to identify, monitor, and 

manage the impact of a Security 

Incident at a Clearing Member on OCC’s 

systems and operations, as well as the 

listed options markets generally. 

Allowing Clearing Members to provide 

the information they believe is relevant 

together with OCC’s ability to gather 

additional information as necessary and 

appropriate helps ensure that OCC gets 

timely information on Security 

Incidents, which supports OCC’s ability 

to identify, monitor, and manage risks 

posed to its operations,46 consistent 

with the Commission’s guidance 

regarding Rule 17Ad–22(e)(17)(i). 

A commenter stated that OCC should 

enumerate threshold conditions that 

must be satisfied before OCC could 

disconnect or modify a Clearing 

Member’s access.47 The commenter 

further requested clarification on the 

relationship between the proposed 

Security Incident notifications and the 

proposed disconnection and 

reconnection process.48 In response, as 

noted above, OCC amended the 

definition of Security Incident to limit 

it to a cyber-related disruption or 

intrusion of the Clearing Member’s 

systems that is reasonably likely to pose 

an imminent risk or threat to OCC’s 

operations.49 OCC also stated that 

because there are ‘‘innumerable 

circumstances that could lead to a 

Security Incident,’’ such a 

determination would require an 

evaluation of the specific facts and 

circumstances related to the Security 

Incident, and amended the proposed 

rule to include a non-exhaustive list of 

factors OCC will consider when making 

a disconnection determination.50

Specifically, as amended, the rule 

provides that OCC may consider any 

one or more of the following in 

determining whether or not to 

disconnect a member: the potential loss 

of control by a Clearing Member of its 

internal system(s), the potential loss of 

OCC’s confidential data, the potential 

strain on or loss of OCC’s resources due 

to OCC’s inability to perform clearance 

and settlement functions, and the 

overall severity of the threat to OCC’s 

security and operations. By amending 

the definition of a Security Incident in 

this way, OCC identified the threshold 

condition that must be satisfied before 

OCC could disconnect or modify a 

Clearing Member’s access in response to 

a Security Incident. Specifically, unless 

the Clearing Member experiences a 

cyber-related disruption or intrusion of 

the Clearing Member’s system that is 

reasonably likely to pose an imminent 

risk or threat to OCC’s operations, OCC 

would not have a basis under the 

proposed rule to disconnect or modify 

a Clearing Member’s access to OCC 

systems. Further, disconnection or 

modification of a Clearing Member’s 

access to OCC’s systems is not an 

automatic consequence in the event a 

Clearing Member notifies OCC of a 

Security Incident. OCC stated that it 

believes that not all Security Incident 

notifications will result in a Clearing 

Member disconnection, and the 

proposed rule does not mandate 

disconnection in response to a Security 

Incident. Rather, disconnection or 

modification of access are among the 

various mitigation actions that OCC may 

take if it determines that it is reasonably 

necessary to do so to mitigate a Security 

Incident’s effects on its operations. In 

addition, OCC’s non-exhaustive list of 

factors provides examples of specific 

risks or threats to OCC’s operations that 

OCC would consider as factors in 

making a disconnection determination, 

and that are consistent with the 

Commission’s guidance related to Rule 

17Ad–22(e)(17)(i). Given the extensive 

variety and rapidly evolving nature of 

cyber-related threats, it is reasonable for 

OCC to balance its need to evaluate the 

specific facts and circumstances of each 

cyber-related incident at a Clearing 

Member and the desire of Clearing 

Members to know in advance the 

specific conditions that could result in 

a disconnection or modification of its 

access to OCC’s systems. OCC’s 

proposed approach of defining a single, 

specific threshold condition—namely, a 

cyber-related disruption or intrusion of 

the Clearing Member’s system 

reasonably likely to pose an imminent 

risk or threat to OCC’s operations— 

while providing an illustrative list of 

factors OCC will consider as it makes a 

disconnection determination, strikes 

this balance. 

By making these amendments, OCC 

also clarified the connection between a 

Security Incident notification and the 

proposed disconnection and 

reconnection process. If OCC 

determines that disconnection is 

reasonably necessary to mitigate any 

effects to its operations, the process for 

the affected Clearing Member to 

reconnect to OCC’s systems following 

the disconnection are set forth in 

paragraph (e) of proposed rule 213, 

‘‘Procedures for Connecting Following a 

Security Incident.’’ Additionally, OCC 

amended the proposed rule to require a 

Clearing Member to complete the 

Reconnection Attestation and 

Reconnection Checklist only in the 

event that OCC disconnected the 

Clearing Member that has reported a 


ddrumheller on DSK120RN23PROD with NOTICES1
82446 Federal Register / Vol. 88, No. 225 / Friday, November 24, 2023 / Notices 

51 Id. 

52FIF Letter at 8. 

53 Id. 

54 Id. at 7–8. For example, the commenter 

expressed concern that the level of detail required 

by the proposed rule change could provide a 

roadmap for malicious actors who wish to gain 

access to OCC’s systems or could present thirdparty litigation risk to the Clearing Member. 

55 Id. at 6. 

56See OCC Rule 305(b). 

57See OCC Rule 306A(1). 

58FIF Letter at 6. 

59See, e.g., OCC Rules 207 (Submission to and 

Retrieval of Items to and from the Corporation) and 

306A (Event-Based Reporting). 

60FIF Letter at 7. The commenter stated that 

many clearing members would be subject to 

numerous governmental and third-party 

notification requirements in the event of a 

cybersecurity incident and expressed confusion 

regarding why OCC would require an attestation 

relating to a clearing member’s notification to other 

regulators and third-parties if the clearing member 

has provided all required notifications to the OCC. 

Id. The commenter also stated that any required 

attestation should be to the knowledge of the 

attesting executive. The proposed rule change states 

explicitly that the representations in the 

Reconnection Attestation would be made ‘‘on a 

good faith, best efforts basis,’’ which necessarily 

means the attestation would be to the knowledge of 

the attesting executive. See proposed Rule 

213(e)(1)(A). 

61See OCC Rule 306A (Event-Based Reporting). 

62See letter from Melissa MacGregor, Managing 

Director, Deputy General Counsel & Corporate 

Secretary, SIFMA, dated April 25, 2023, to Vanessa 

Countryman, Secretary, Commission, (‘‘SIFMA 

Letter’’) available at https://www.sec.gov/ 

comments/sr-occ-2023-003/srocc2023003- 

20164982-334488.pdf. A similar perspective was 

provided by a second commenter. See FIF Letter at 

8–9; see also Securities Exchange Act Release Nos. 

97141 (Mar. 15, 2022), 88 FR 20616 (Apr. 6, 2023); 

97142 (Mar. 15, 2022), 88 FR 20212 (Apr. 5, 2023); 

97143 (Mar. 15, 2023), 88 FR 23146 (Apr. 14, 2023); 

97144 (Mar. 15, 2023), 88 FR 16921 (Mar. 21, 2023); 

94382 (Mar. 9, 2022), 87 FR 16590 (Mar. 23, 2022). 

63SIFMA Letter at 2. SIFMA does not state how 

the proposed rule change interconnects or conflicts 

with the Commission’s proposed rules. 

64 Id. This concern was echoed in a letter from the 

FIF. See FIF Letter (stating that OCC should 

withdraw the proposed rule change and resubmit 

after the comment periods for the Commission’s 

proposals have expired). 

Security Incident.51 The information 

provided in the Reconnection 

Attestation and Reconnection Checklist 

would help OCC determine whether the 

risk to OCC has been mitigated 

sufficiently for OCC to resume 

connectivity to the Clearing Member. 

Taken together, these changes as well 

would allow OCC to identify and 

mitigate operational risks presented by 

its Clearing Members and secure its 

environment more effectively against 

potential vulnerabilities. 

A commenter stated that the 

Reconnection Checklist appears to be a 

security incident notification form 

rather than a checklist for 

reconnection.52 As discussed above, the 

Reconnection Checklist is only required 

in the event that a Clearing Member is 

disconnected from OCC’s systems as the 

result of a Security Incident. The 

checklist includes information such as 

the nature of the incident, the steps 

taken to contain the incident, and any 

OCC data that was compromised during 

the incident, all of which is used by 

OCC to determine whether the risk to 

OCC posed by the Security Incident has 

been mitigated sufficiently to resume 

the Clearing Member’s connectivity. The 

commenter also stated that the proposed 

rule should establish a clear process for 

reconnection, including the process and 

timing for OCC to decide on a 

reconnection request and the process for 

OCC to communicate its 

determination.53 As noted above, the 

process for reconnection is set forth in 

paragraph (e) of proposed Rule 213. In 

addition, although the proposed rule 

does not mandate the specific timing for 

OCC to make a reconnection 

determination, the information provided 

to OCC by the Reconnection Attestation 

and Reconnection Checklist is designed 

to facilitate OCC’s reconnection 

determinations, which should help 

expedite the process. Given the 

innumerable circumstances that could 

lead to a Security Incident and a 

resulting disconnection, the proposed 

rule strikes a reasonable balance 

between OCC’s need to ensure that the 

operational risks presented by a 

Security Incident at a Clearing Member 

have been sufficiently mitigated before 

reconnecting to OCC’s systems and the 

Clearing Member’s desire to reconnect 

as quickly as possible. 

A commenter expressed concern that 

the information required to be disclosed 

in Reconnection Checklist and 

Attestation is too detailed and could 

either provide a roadmap to malicious 

actors or subject the Clearing Member to 

third-party litigation risk.54 The 

commenter also requested clarification 

on the protection of information 

reported by Clearing Members to OCC.55

Any information disclosed to OCC in a 

Reconnection Checklist and Attestation 

would be kept confidential by OCC and 

would not be made publicly available, 

including to third parties and potential 

malicious actors, and therefore would 

not, by virtue of being provided to OCC, 

provide a roadmap to malicious actors 

or subject the reporting Clearing 

Member to third-party litigation risk. 

Further, OCC routinely receives, and is 

responsible for the protection of, 

confidential information related to its 

Clearing Members. For example, OCC 

routinely receives and protects 

confidential and sensitive information 

related Clearing Members’ risk 

management practices,56 as well as 

information related to any financial or 

operational difficulty reported by 

Clearing Members to any regulatory 

organization.57

The commenter also stated that OCC 

should provide an exception to 

disclosure when law enforcement 

directs the member not to disclose.58

However, the lack of the type of law 

enforcement exception suggested by the 

commenter is consistent with the 

Exchange Act. For example, OCC’s 

current rules, as approved by the 

Commission, include various reporting 

and disclosure requirements, none of 

which provide the type of explicit law 

enforcement exception suggested by the 

commenter.59

The commenter also questioned 

whether the Clearing Members should 

be required to provide evidence of 

regulatory compliance to other 

government agencies and third 

parties.60 OCC’s current rules, as 

approved by the Commission, require 

Clearing Members to notify OCC if the 

Clearing Member is required to notify 

any regulatory organization of any 

operational difficulty affecting the 

Clearing Member, or of any failure by 

the Clearing Member to be in 

compliance with the operational 

responsibility rules of any regulatory 

organization.61 Thus, a Clearing 

Member that experiences a Security 

Incident that subjects the Clearing 

Member to a regulatory notification 

requirement is already required, under 

existing OCC Rules, to notify OCC that 

it complied with that requirement. The 

proposed rule change does not create a 

new obligation for Clearing Members to 

notify OCC of regulatory notices to 

regulatory organizations; it merely 

specifies when a notification to OCC in 

connection with a Security Incident 

must be provided. 

Finally, a commenter referenced a 

number of cybersecurity-related rule 

proposals recently published by the 

Commission and stated that the 

proposed rule change should be delayed 

at least until the Commission finalizes 

all the currently proposed cybersecurity 

rulemaking to ensure that investors are 

protected from cyber threats and 

unnecessary additional burdens are not 

placed on OCC Clearing Members.62

The commenter states further that the 

proposed rule change interconnects and 

may overlap with four different rules 

proposed by the Commission,63 and 

requests that the Commission extend the 

period for comment on the proposed 

rule change to allow time to analyze the 

proposed rule change alongside the 

rules proposed by the Commission.64


ddrumheller on DSK120RN23PROD with NOTICES1
Federal Register / Vol. 88, No. 225 / Friday, November 24, 2023 / Notices 82447 

65See, e.g., 15 U.S.C. 78s(b)(2)(A)(ii) (allowing the 

Commission to extend the period for review by not 

more than 45 days if the Commission determines 

that a longer period is appropriate and publishes 

the reasons for such determination). 

66 15 U.S.C. 78s(b)(2)(C). 

67 17 CFR 240.17Ad–22(e)(17)(i). 

68 In approving this proposed rule change, the 

Commission has considered the proposed rules’ 

impact on efficiency, competition, and capital 

formation. See 15 U.S.C. 78c(f). 

69 15 U.S.C. 78s(b)(2). 

70 17 CFR 200.30–3(a)(12). 

1 15 U.S.C. 78s(b)(1). 

2 17 CFR 240.19b–4. 

3See Exchange Act Release No. 97237 (Mar. 31, 

2023), 88 FR 20568, 20568 (Apr. 6, 2023) (File No. 

SR–FINRA–2023–006 (‘‘Notice’’) (citing FINRA 

Rules 3110(c)(1)(C) and 3110.13), https://

www.govinfo.gov/content/pkg/FR-2023-04-06/pdf/ 

2023-07145.pdf. 

4See id. 

5 Id. 

6See letter from Sarah Kwak, Associate General 

Counsel, Office of General Counsel, FINRA, to 

Daniel Fisher, Branch Chief, Division of Trading 

and Markets, Commission, dated May 16, 2023, 

https://www.finra.org/sites/default/files/2023-05/srfinra-2023-006-extension-no-1.pdf. 

7The comment letters are available at https://

www.sec.gov/comments/sr-finra-2023-006/ 

srfinra2023006.htm. 

8See Amendment No. 1, https://www.finra.org/ 

sites/default/files/2023-07/sr-2023-006-amendmentNo1.pdf. 

9Exchange Act Release No. 97839 (July 5, 2023), 

88 FR 44173 (July 11, 2023) (File No. SR–FINRA– 

2023–006), https://www.govinfo.gov/content/pkg/ 

FR-2023-07-11/pdf/2023-14523.pdf. 

10See letter from Sarah Kwak, Associate General 

Counsel, Office of General Counsel, FINRA, to 

Vanessa Countryman, Secretary, Commission, dated 

July 25, 2023 (‘‘FINRA Response I’’), https://

www.sec.gov/comments/sr-finra-2023-006/ 

srfinra2023006-235699-491502.pdf. 

11See Amendment No. 2, https://www.finra.org/ 

sites/default/files/2023-09/SR-FINRA-2023-006- 

Amendment-2.pdf; letter from Kosha Dalal, Vice 

President and Associate General Counsel, Office of 

General Counsel, FINRA, to Vanessa Countryman, 

Secretary, Commission, dated Sept. 14, 2023 

(‘‘FINRA Response II’’), https://www.sec.gov/ 

comments/sr-finra-2023-006/srfinra2023006- 

259039-608182.pdf. 

12See letter from Sarah Kwak, Associate General 

Counsel, Office of General Counsel, FINRA, to 

Daniel Fisher, Branch Chief, Division of Trading 

and Markets, Commission, dated Sept. 22, 2023, 

https://www.finra.org/sites/default/files/2023-09/srfinra-2023-006-ext2.pdf. 

Under the Exchange Act and relevant 

rules thereunder, SROs, including OCC, 

determine for themselves when to file a 

proposed rule change. The Exchange 

Act defines the process and time within 

which the Commission may act,65 and 

Section 19(b)(2)(C) of the Exchange Act 

requires the Commission to approve a 

proposed rule change of a SRO if it finds 

that such change is consistent with the 

Exchange Act and rules and regulations 

thereunder that are applicable to the 

SRO.66 Concerns regarding rules 

proposed by the Commission may be 

presented as comments to such rules so 

that the Commission may consider them 

in determining what, if any, final rule it 

will adopt. 

Based on the foregoing, the 

Commission finds that the proposed 

rule change is consistent with the 

requirements of Rule 17Ad–22(e)(17)(i) 

under the Exchange Act.67

IV. Conclusion 

On the basis of the foregoing, the 

Commission finds that the proposed 

rule change, as modified by Partial 

Amendment No. 1, is consistent with 

the requirements of the Exchange Act, 

and in particular, the requirements of 

Section 17A of the Exchange Act 68 and 

the rules and regulations thereunder. 

It is therefore ordered, pursuant to 

Section 19(b)(2) of the Exchange Act,69

that the proposed rule change (SR– 

OCC–2023–003), as modified by Partial 

Amendment No. 1, be, and hereby is, 

approved. 

For the Commission, by the Division of 

Trading and Markets, pursuant to delegated 

authority.70

Sherry R. Haywood, 

Assistant Secretary. 

[FR Doc. 2023–25883 Filed 11–22–23; 8:45 am] 

BILLING CODE 8011–01–P 

SECURITIES AND EXCHANGE 

COMMISSION 

[Release No. 34–98980; File No. SR–FINRA– 

2023–006] 

Self-Regulatory Organizations; 

Financial Industry Regulatory 

Authority, Inc.; Notice of Filing of 

Amendment No. 2 and Order Granting 

Accelerated Approval of a Proposed 

Rule Change, as Modified by 

Amendment Nos. 1 and 2, To Adopt 

Supplementary Material .19 

(Residential Supervisory Location) 

Under FINRA Rule 3110 (Supervision) 

November 17, 2023. 

I. Introduction 

On March 29, 2023, the Financial 

Industry Regulatory Authority, Inc. 

(‘‘FINRA’’) filed with the Securities and 

Exchange Commission (‘‘SEC’’ or 

‘‘Commission’’), pursuant to Section 

19(b)(1) of the Securities Exchange Act 

of 1934 (‘‘Exchange Act’’) 1 and Rule 

19b–4 thereunder,2 a proposed rule 

change (SR–FINRA–2023–006) to adopt 

new Supplementary Material .19 

(Residential Supervisory Location) 

under FINRA Rule 3110 (Supervision). 

The proposed rule change, as modified 

by Amendment Nos. 1 and 2 

(hereinafter, the ‘‘proposed rule change’’ 

unless otherwise specified), would treat 

a private residence in which an 

associated person engages in specified 

supervisory activities, subject to certain 

safeguards and limitations, as a nonbranch location.3 Treated as non-branch 

locations, these newly defined 

Residential Supervisory Locations 

(‘‘RSLs’’) would be subject to 

inspections on a regular periodic 

schedule (presumed to be at least every 

three years) instead of the annual 

inspection currently required for 

‘‘offices of supervisory jurisdiction’’ 

(‘‘OSJs’’) and ‘‘supervisory branch 

offices.’’ 4

The proposed rule change was 

published for public comment in the 

Federal Register on April 6, 2023.5 On 

May 16, 2023, FINRA consented to an 

extension of the time period in which 

the Commission must approve the 

proposed rule change, disapprove the 

proposed rule change, or institute 

proceedings to determine whether to 

approve or disapprove the proposed 

rule change to July 5, 2023.6 The 

Commission received thirteen comment 

letters in response to the Notice.7

On July 3, 2023, FINRA filed an 

amendment to the proposed rule change 

(‘‘Amendment No. 1’’).8 On July 5, 2023, 

the Commission published a notice of 

filing of Amendment No. 1 and an order 

instituting proceedings to determine 

whether to approve or disapprove the 

proposed rule change, as modified by 

Amendment No. 1.9 On July 25, 2023, 

FINRA responded to the comment 

letters received in response to the 

Notice.10 The Commission received 

twelve comment letters in response to 

the notice of Amendment No. 1 and 

order instituting proceedings. 

On September 14, 2023, FINRA 

responded to the comment letters 

received in response to the notice of 

Amendment No. 1 and order instituting 

proceedings, and it filed an amendment 

to the proposed rule change 

(‘‘Amendment No. 2’’).11 On September 

22, 2023, FINRA consented to an 

extension of the time period in which 

the Commission must approve or 

disapprove the proposed rule change to 

December 2, 2023.12 The Commission is 

publishing this order to provide notice 

of the filing of, and to solicit comments 

on, Amendment No. 2 from interested 

persons and is approving the proposed 


ddrumheller on DSK120RN23PROD with NOTICES1