In the Matter of: 

UNITED STATES OF AMERICA 

Before the 

COMMODITY FUTURES TRADING COMMISSION 

) 

) 

) 

The Options Clearing Corporation, ) CFTC Docket No. 19-19 

) 

) 

Respondent. ) 

) 

_________________ ) 

ORDER INSTITUTING PROCEEDINGS PURSUANT TO 

SECTION 6(c) AND 6(d) OF THE COMMODITY EXCHANGE ACT, 

MAKING FINDINGS, AND IMPOSING REMEDIAL SANCTIONS 

I. 

The Commodity Futures Trading Commission ("Commission") has reason to believe that 

The Options Clearing Corporation ("OCC" or "Respondent") violated certain Core Principles 

that condition the registration of derivatives clearing organizations ("DCO") under Section 5b of 

the Commodity Exchange Act ("Act" or "CEA"), 7 U.S.C. § 7a-l (2012), and implementing 

provisions set forth in Part 39 of the Commission's Regulations ("Regulations"), 17 C.F.R. pt. 39 

(2019). Therefore, the Commission deems it appropriate and in the public interest that public 

administrative proceedings be, and hereby are, instituted to determine whether Respondent 

engaged in the violations set f01ih herein and to determine whether any order should be issued 

imposing remedial sanctions. 

II. 

In anticipation of the institution of an administrative proceeding, Respondent has 

submitted an Offer of Settlement ("Offer"), which the Commission has determined to accept. 

Without admitting or denying any of the findings or conclusions herein, Respondent consents to 

the entry of this Order Instituting Proceedings Pursuant to Section 6(c) and 6(d) of the Act, 

Making Findings, and Imposing Remedial Sanctions ("Order"), and acknowledges service of this 

Order. 1 

1 Respondent consents to the use of the findings of fact and conclusions oflaw in this Order in this proceeding and 

in any other proceeding brought by the Commission or to which the Commission is a party or claimant, and agrees 

that they shall be taken as true and correct and be given preclusive effect therein, without further proof. 

Respondent does not consent, however, to the use of this Order, or the findings or conclusions herein, as the sole 

basis for any other proceeding brought by the Commission or to which the Commission is a party or claimant, 

other than: a proceeding in bankruptcy or receivership; or a proceeding to enforce the terms of this Order. 

Respondent does not consent to the use of the Offer or this Order, or the findings or conclusions in this Order, by 

1 
III. 

The Commission finds the following: 

A. Summary 

Section 5b of the Act, 7 U.S.C. §7a-1 (2012), creates a regulatory regime for DCOs that 

is implemented by the Commission's Part 39 Regulations, 17 C.F.R. pt. 39 (2019) (collectively, 

"DCO Core Principles").2 

As a registered DCO, OCC is required to comply with the DCO Core Principles, which 

establish the standards for the operation of DCOs. The DCO Core Principles impose, among 

other things, requirements relating to the financial, operational and managerial resources of a 

DCO; risk management standards; rules and procedures relating to management of clearing 

member defaults; risk analysis and oversight of operations and automated systems; and 

clearinghouse governance standards. On the dates identified below, OCC failed to fully comply 

with the specified DCO Core Principles by failing to establish, implement, and enforce certain 

policies and procedures reasonably designed to (1) consider and produce margin levels 

commensurate with every potential risk and pmiicular attribute of each relevant product cleared 

by OCC; (2) effectively measure, monitor and manage its credit exposure and liquidity risk; and 

(3) protect the security of certain of its information systems. 

DCOs are an essential part of the U.S. futures and options markets and, as such, they are 

required to be structured to manage and reduce risk. In instances where a DCO is not structured 

and operated appropriately, it can pose a risk to the broader financial system. Disruption to 

OCC's operations, or failure by OCC to manage risk, could result in significant costs not only to 

OCC itself and its members, but also to other market participants. 

B. Respondent 

The Options Clearing Corporation is a Delaware corporation with its principal place of 

business in Chicago, Illinois. Since 2001, OCC has been registered with the Commission as a 

DCO for the clearing of futures contracts and options on futures contracts. Since 2008, OCC has 

been further authorized by the Commission to clear commodity options executed on a designated 

contract market in addition to futures contracts and options on futures contracts. 

any other party in any other proceeding. 

2 See Commodity Futures Modernization Act of 2000, P.L. 106-554, 114 Stat. 2763, enacted December 21, 2000, as 

amended by the Dodd-Frank Wall Street Reform and Consumer Protection Act, P.L. 111-2013, 124 Stat. 1376, 

effective July 16, 2011; see also A New Regulatory Framework for Clearing Organizations, 66 Fed. Reg. 45,604 

(Oct. 29, 2001). 

2 
C. Facts 

1. Compliance with DCO Core Principles 

As a condition of registration, DCOs are obligated to comply with the DCO Core 

Principles established in Section Sb of the Act, as well as the implementing regulations 

promulgated by the Commission that are found in Part 39 of the Regulations. See CEA 

§ 5b(c)(2)(A)(i), 7 U.S.C. § 7a-l(c)(2)(A)(i) (2012). This Order addresses OCC's failure during 

certain periods to comply with Core Principles B, D, and I, found in Section 5b(c)(2)(B), (D), 

and (I) of the Act, 7 U.S.C. § 7a-l(c)(2)(B), (D), (I), and Regulations 39.1 l(a) and (c), 39.13(a), 

(b), (f), and (g)(l) and (2), and 39.18(b)(l) and (e)(l), 17 C.F.R. §§ 39.1 l(a), (c), 39.13(a), (b), 

(f), (g)(l)-(2), 39.18(b)(l), (e)(l) (2019). 

2. OCC Failed To Establish, Implement, Maintain, and Enforce Policies and 

Procedures Reasonably Designed To Require Review of Its Risk-Based 

Margin Models and the Parameters for Those Models on a Regular Basis 

DCO Core Principle D, Section 5b(c)(2)(D)(i) of the Act, requires that a DCO "shall 

ensure that [it] possesses the ability to manage the risks associated with discharging the 

responsibilities of the [DCO] through the use of appropriate tools and procedures." Core 

Principle D and Regulation 3 9 .13 ( f) and (g)( 1) further require that a DCO use margin 

requirements to cover its potential credit exposures to clearing members, and that each model 

and parameter used in setting such margin requirements be risk-based and reviewed on a regular 

basis. 

Through at least April 2017, OCC failed to fully establish, implement, maintain, and 

enforce policies and procedures reasonably designed to require review of its risk-based margin 

models and the parameters for those models on a regular basis. 

3. OCC Failed To Establish, Implement, Maintain, and Enforce Policies and 

Procedures Reasonably Designed To Consider and Produce Margin Levels 

Commensurate with the Risks and Attributes of Each Relevant Product 

Cleared by OCC 

Regulation 39.13(g)(2)(i) requires that a DCO "establish initial margin requirements that 

are commensurate with the risks of each product and portfolio, including any unusual 

characteristics of, or risk associated with, particular products or portfolios, including but not 

limited to jump-to-default risk or similar jump risk." 

To date, OCC has not fully established, implemented, maintained, or enforced policies 

and procedures reasonably designed to consider and produce margin levels commensurate with 

every potential risk and particular attribute of each relevant product and portfolio cleared by 

OCC. OCC's margin model fails to fully consider the impact of market liquidation costs, 

including bid-ask spreads and other transaction-based costs, as well as the potential market 

impact of liquidation activity. 

3 
4. OCC Failed To Establish, Implement, Maintain, and Enforce Policies and 

Procedures Reasonably Designed To Fully Stress Test Its Credit Exposure 

DCO Core Principle B, Section 5b(c)(2)(B)(i), requires that a DCO "shall have adequate 

financial, operational, and managerial resources, as determined by the Commission, to discharge 

each responsibility of the [DCO.]". Regulation 39.1 l(a) requires that a DCO "maintain financial 

resources sufficient to cover its exposures with a high degree of confidence and to enable it to 

perform its functions in compliance with the core principles set out in section 5b of the Act." 

Pursuant to Regulation 3 9 .11 ( c ), a DCO is required to perform, on a monthly basis, stress testing 

that will allow it to make a reasonable calculation of the necessary financial resources. Such 

stress testing must take into account both historical data and hypothetical scenarios. 

Notwithstanding this requirement, through at least September 4, 2018, OCC failed to 

fully establish, implement, maintain, and enforce policies and procedures requiring monthly 

stress testing of its financial resources. 

5. OCC Failed To Establish, Implement, Maintain, and Enforce Policies and 

Procedures Reasonably Designed To Fully Maintain a Comprehensive Risk 

Management Framework 

Pursuant to DCO Core Principle D, Section 5b(c)(2)(D)(i) of the Act, and Regulation 

39.13(a), a DCO must ensure that it "possesses the ability to manage the risks associated with 

discharging the responsibilities of the [DCO] through the use of appropriate tools and 

procedures." Regulation 3 9 .13 (b) requires that a DCO "establish and maintain written policies, 

procedures, and controls, approved by its board of directors, which establish an appropriate risk 

management framework that, at a minimum, clearly identifies and documents the range of risks 

to which the [DCO] is exposed, addresses the monitoring and management of the entirety of 

those risks, and provides a mechanism for internal audit. The risk management framework shall 

be regularly reviewed and updated as necessary." 

Notwithstanding these requirements, to date, OCC has failed to fully establish, 

implement, maintain, and enforce policies and procedures reasonably designed to manage the 

credit and liquidity risks associated with discharging its responsibilities as a DCO. OCC further 

failed to establish, implement, maintain, and enforce policies and procedures reasonably 

designed to manage its operational risks. 

6. OCC Lacked Adequate Policies and Procedures Reasonably Designed To 

Fully Protect the Security of Certain OCC Information Systems 

Pursuant to DCO Core Principle I, Section 5b(c)(2)(I)(i) of the Act, and Regulation 

39.18(b)(l), a DCO must establish and maintain a program of risk analysis and oversight to 

identify and minimize sources of operational risk through the development of appropriate 

controls and procedures, and automated systems, that are reliable, secure, and have adequate 

scalable capacity. 

Regulation 39.18(b)(2)(iv) requires that a DCO's program ofrisk analysis and oversight 

4 
with respect to its operations and automated systems must address the following element: 

"Systems operations, including, but not limited to, system maintenance; configuration 

management (including, baseline configuration, configuration change and patch management, 

least functionality, inventory of authorized and unauthorized devices and software); event and 

problem response and management; and any other elements of system operations included in 

generally accepted best practices." 

Regulation 39.18( e )(1) requires that a DCO "conduct regular, periodic, and objective 

testing and review of: (i) [i]ts automated systems to ensure that they are reliable, secure, and 

have adequate scalable capacity."3 

As of November 3, 2015, and continuing through various time periods thereafter, OCC 

failed to fully establish and maintain a program of risk analysis and oversight reasonably 

designed to ensure that its automated systems are reliable, secure, and have adequate scalable 

capacity. Among other things, OCC has failed to establish and maintain policies and procedures 

that were reasonably designed to: 

a. consistently identify, prioritize, test, and implement vendor-issued 

patches; 

b. ensure that all network devices, including unused and test network 

devices, were inventoried; and 

c. ensure security threats would be promptly detected. 

IV. 

FINDINGS OF VIOLATIONS 

Based on the foregoing, the Commission finds that Respondent violated Section 

5b(c)(2)(B), (D), and (I) of the Act, 7 U.S.C. § 7a-l(c)(2)(B), (D), (I) (2012), and Regulations 

39.1 l(a) and (c), 39.13(a), (b), (f), and (g)(l) and (2), and 39.18(b)(l) and (e)(l), 17 C.F.R. 

§§ 39.1 l(a), (c), 39.13(a), (b), (f), (g)(l)-(2), 39.18(b)(l), (e)(l) (2019). 

V. 

OFFER OF SETTLEMENT 

Respondent, without admitting or denying the findings or conclusions herein, has 

submitted the Offer in which it: 

3 Prior to 2018, these requirements were found in Regulation 39.180)(1), 17 C.F.R. § 39.180)(1) (2014). 

5 
A. Acknowledges service of this Order; 

B. Admits the jurisdiction of the Commission with respect to this Order only and for 

any action or proceeding brought or authorized by the Commission based on 

violation of or enforcement of this Order; 

C. Waives: 

1. the filing and service of a complaint and notice of hearing; 

2. a hearing; 

3. all post-hearing procedures; 

4. judicial review by any court; 

5. any and all objections to the participation by any member of the 

Commission's staff in the Commission's consideration of the Offer; 

6. any and all claims that it may possess under the Equal Access to Justice 

Act, 5 U.S.C. § 504 (2012) and 28 U.S.C. § 2412 (2012), and/or the rules 

promulgated by the Commission in conformity therewith, Part 148 of the 

Regulations, 17 C.F.R. pt. 148 (2019), relating to, or arising from, this 

proceeding; 

7. any and all claims that it may possess under the Small Business 

Regulatory Enforcement Fairness Act of 1996, Pub. L. No. 104-121, 

§§ 201-253, tit. II, 110 Stat. 847, 857-74 (codified as amended at 

28 U.S.C. § 2412 and in scattered sections of 5 U.S.C. and 15 U.S.C.), 

relating to, or arising from, this proceeding; and 

8. any claims of Double Jeopardy based on the institution of this proceeding 

or the entry in this proceeding of any order imposing a civil monetary 

penalty or any other relief, including this Order; 

D. Stipulates that the record basis on which this Order is entered shall consist solely 

of the findings contained in this Order to which Respondent has consented in the 

Offer; and 

E. Consents, solely on the basis of the Offer, to the Commission's entry of this Order 

that: 

1. makes findings by the Commission that Respondent violated Section 

5b(c)(2)(B), (D), and (I) of the Act, 7 U.S.C. § 7a-l(c)(2)(B), (D), (I) 

(2012), and Regulations 39.1 l(a) and (c), 39.13(a), (b), (f), and (g)(l) and 

(2), and 39.18(b)(l) and (e)(l), 17 C.F.R. §§ 39.1 l(a), (c), 39.13(a), (b), 

(f), (g)(l)-(2), 39.18(b)(l), (e)(l) (2019); 

6 
2. orders Respondent to cease and desist from violating Section Sb( c )(2)(B), 

(D), and (I) of the Act, and Regulations 39.1 l(a) and (c), 39.13(a), (b), (f), 

and (g)(l) and (2), and 39.lS(b)(l) and (e)(l); 

3. orders Respondent to pay a civil monetary penalty in the amount of $5 

million U.S. dollars ($5,000,000) plus post-judgment interest; and 

4. orders Respondent and its successors and assigns to comply with the 

conditions and undertakings consented to in the Offer and as set forth in 

Paii VII of this Order. 

Upon consideration, the Commission has determined to accept the Offer. 

VI. 

COOPERATION AND REMEDIATION 

In determining to accept the Offer, the Commission has also considered OCC's 

cooperation and remedial efforts, which include the following: 

a. OCC developed remediation plans to bring OCC into compliance with DCO 

Core Principles and Regulations. Among other things, OCC has: 

1. Incorporated stress testing into its clearing fund methodology; 

11. Enhanced its margin policy; 

111. Changed its daily univariate methodology; 

IV. Enhanced its implied volatility model; 

v. Changed its margin methodology for Volatility Indexes and Volatility 

Index Futures; 

v1. Self-certified a rule change to incorporate liquidation costs in its margin 

methodology; and 

VIL Further developed its policies and procedures related to its system 

safeguards and the security of its information systems. 

b. At the direction of its Executive Chairman and the Board of Directors ("Board"), 

OCC has replaced many of its senior executives -- including hiring a new Chief 

Executive Officer, Chief Operating Officer, Head of Financial Risk 

Management, Chief Information Officer, Chief Security Officer, and heads of 

control functions - and increased its expenditures and headcount in the areas of 

risk management, compliance, legal, and information technology. 

7 
c. In October 2017, OCC's Board created the Ad Hoc Regulatory Oversight 

Working Group ("ROWG") that includes all of OCC's public directors and 

meets at least monthly to assist OCC's Board in overseeing OCC's efforts to 

comply with its ongoing regulatory obligations and to supervise OCC's 

remediation and compliance efforts. 

VII. 

UNDERTAKINGS 

As noted above, Respondent represents that it has already undertaken and continues to 

undertake extensive remedial measures relating to its margin models, credit exposure, liquidity 

risk, and the security of its infonnation systems. To the extent it has not already done so, 

Respondent undertakes that: 

1. It will implement internal controls, policies and procedures reasonably designed 

to comply with DCO Core Principles and Regulations. 

2. Its remediation efforts will include the retention of a qualified independent third 

party compliance auditor ("Auditor") to plan and conduct an audit of OCC's policies and 

procedures to determine whether they are reasonably designed to: 

a. require review of risk-based margin models and the parameters for those 

models; 

b. stress test its credit exposure; 

c. manage its credit, liquidity, and operational risks; 

d. identify, prioritize, test, and implement vendor-issued patches; 

e. inventory all network devices; and 

f. promptly detect security threats. 

3. Within six (6) months of completion of the audit, Respondent shall make a 

report ("Final Report") to the Commission, through the Division, concerning its remediation 

efforts prior to and since the entry of this Order. The Final Report shall contain a certification 

from a representative of Respondent's Executive Management that, to the best of its knowledge 

and based upon reasonable inquiry, Respondent has complied with the undertakings set forth 

above, and that it has established policies, procedures, and controls reasonably designed to 

satisfy the DCO Core Principles and Regulations. 

VIII. 

ORDER 

Accordingly, IT IS HEREBY ORDERED THAT: 

A. Respondent shall cease and desist from violating Section 5b(c)(2)(B), (D), and (I) 

of the Act, 7 U.S.C. § 7a-l(c)(2)(B), (D), (I) (2012), and Regulations 39.1 l(a) and 

8 
(c), 39.13(a), (b), (f), (g)(l) and (2), and 39.18(b)(l), and (e)(l), 17 C.F.R. 

§§ 39.1 l(a), (c), 39.13(a), (b), (f), (g)(l)-(2), 39.18(b)(l), (e)(l) (2019). 

B. Respondent shall pay a civil monetary penalty in the amount of $5 million U.S. 

dollars ($5,000,000) ("CMP Obligation") by December 31, 2019. If the CMP 

Obligation is not paid in full by December 31, 2019, then post-judgment interest 

shall accrue on the CMP Obligation beginning on the date of entry of this Order 

and shall be determined by using the Treasury Bill rate prevailing on the date the 

payment installment became due pursuant to 28 U.S.C. § 1961 (2012). 

Respondent shall pay the CMP Obligation and any post-judgment interest by 

electronic funds transfer, U.S. postal money order, certified check, bank cashier's 

check, or bank money order. If payment is to be made other than by electronic 

funds transfer, the payment shall be made payable to the Commodity Futures 

Trading Commission, and sent to the address below: 

MMAC/ESC/AMK326 

Commodity Futures Trading Commission 

Division of Enforcement 

6500 S. MacArthur Blvd. 

HQ Room 181 

Oklahoma City, OK 73169 

( 405) 954-7262 office 

( 405) 954-1620 fax 

9-AM C-AR-CFTC(a),faa. gov 

If payment is to be made by electronic transfer, Respondent shall contact Marie 

Thorn or her successor at the above address to receive payment instructions and 

shall fully comply with those instructions. Respondent shall accompany payment 

of the CMP Obligation with a cover letter that identifies Respondent and the name 

and docket number of this proceeding. Respondent shall simultaneously transmit 

copies of the cover letter and the form of payment to the Chief Financial Officer, 

Commodity Futures Trading Commission, Three Lafayette Centre, 115 5 21 st 

Street, NW, Washington, D.C. 20581. 

9 
C. Respondent and its successors and assigns shall comply with the following 

conditions and undertaking set forth in the Off er: 

1. COOPERATION WITH THE COMMISSION 

In this action, and in any investigation or other action instituted by the 

Commission related to the subject matter of this action, Respondent shall 

cooperate fully and expeditiously with the Commission, including the Division of 

Enforcement, in this action, and in any current or future Commission 

investigation or action related thereto. 

2. PUBLIC STATEMENTS 

Respondent agrees that neither it nor any of its successors, assigns, agents, or 

employees under its authority or control shall take any action or make any public 

statement denying, directly or indirectly, any findings or conclusions in this 

Order, or creating, or tending to create, the impression that this Order is without a 

factual basis; provided, however, that nothing in this provision shall affect 

Respondent's: (i) testimonial obligations; or (ii) its right to take positions in other 

proceedings to which the Commission is not a party. Respondent and its 

successors and assigns shall undertake all steps necessary to ensure that all of its 

agents and and/or employees under its authority or control understand and comply 

with this agreement. 

3. PARTIAL SATISFACTION: 

Respondent understands and agrees that any acceptance by the Commission of 

partial payment of Respondent's civil monetary payment obligations shall not be 

deemed a waiver of its obligation to make further payments pursuant to this 

Order, or a waiver of the Commission's right to seek to compel payment of any 

remaining balance. 

The provisions of this Order shall be effective on this date. 

By the Commission: 

Dated: September 4, 2019 

10 

Christopner J. Ki patrick 

Secretary of the Commission 

Commodity Futures Trading Commission