US exchanges, clearing agencies, large alternative trading systems and market data processors must keep their trading and settlement technology resilient and secure under SEC Regulation SCI, and they must tell the SEC about a systems intrusion immediately, not after an internal investigation has finished. Regulation Systems Compliance and Integrity (17 CFR 242.1000 to 242.1007) sets written policy requirements, a strict event notification sequence, quarterly reporting, an annual SCI review and business continuity testing with market participants. This guide explains who is covered, each obligation with its deadlines, the current status of the rule after the SEC withdrew its 2023 expansion proposal, how enforcement works, what the rule means for service accounts, API credentials and AI agents in SCI systems, and a practical compliance plan. It is for CISOs, technology risk and compliance teams at SCI entities and at the vendors that serve them. Regulatory text was checked on the eCFR on 27 October 2026 (eCFR shown as up to date as of 23 October 2026).
Key takeaways
- Five kinds of SCI entity. The rule covers SCI self-regulatory organisations (exchanges, registered clearing agencies, FINRA and the MSRB), SCI alternative trading systems above volume thresholds, plan processors, exempt clearing agencies subject to the Automation Review Policies, and SCI competing consolidators.
- The reporting clock starts early. Notification is due immediately once responsible SCI personnel have a reasonable basis to conclude an SCI event has occurred, with a written notice within 24 hours, and final reports within five business days of resolution.
- Intrusions count even into indirect systems. A systems intrusion is any unauthorised entry into SCI systems or indirect SCI systems, so a compromised corporate VPN can be reportable.
- Resilience goals are explicit. Business continuity plans must be designed for two-hour resumption of critical SCI systems and next business day resumption of trading after a wide-scale disruption, tested with designated members at least every 12 months.
- The 2023 expansion is gone, the 2014 rule stands. The SEC withdrew the April 2023 proposal to widen Regulation SCI, effective 17 June 2025; the rule in force is the 2014 framework as amended, including SCI competing consolidators.
Scope: who and what is covered
Entities
| SCI entity type | Definition in 17 CFR 242.1000 (summarised) |
|---|---|
| SCI self-regulatory organisation | Any national securities exchange, registered securities association, registered clearing agency or the Municipal Securities Rulemaking Board; excludes exchanges notice-registered under 15 U.S.C. 78f(g) and limited-purpose associations under 15 U.S.C. 78o-3(k) |
| SCI alternative trading system | An ATS that, in at least four of the preceding six calendar months, had 5% or more of average daily dollar volume in any single NMS stock and 0.25% or more in all NMS stocks, or 1% or more in all NMS stocks; or 5% or more in non-NMS equity securities reported to an SRO. Compliance begins six months after first meeting a threshold |
| Plan processor | As defined in 17 CFR 242.600, the processors of national market system plan data |
| Exempt clearing agency subject to ARP | An entity exempted from clearing agency registration whose exemption carries conditions relating to the SEC's Automation Review Policies |
| SCI competing consolidator | A competing consolidator that, in at least four of the preceding six months, accounted for 5% or more of consolidated market data gross revenue paid to the effective NMS plans for NMS stocks |
Broker-dealers are not SCI entities under the current rule. They are covered by other SEC and FINRA requirements; see the Financial Services Cyber Regulation Map.
Systems
- SCI systems: systems owned or operated by or on behalf of the entity that directly support trading, clearance and settlement, order routing, market data, market regulation or market surveillance.
- Critical SCI systems: those that directly support clearance and settlement at clearing agencies, openings, reopenings and closings on the primary listing market, trading halts, initial public offerings, plan processor market data and exclusively listed securities, plus systems with few or no alternatives whose loss would materially affect fair and orderly markets.
- Indirect SCI systems: systems of or operated for the entity that, if breached, would be reasonably likely to pose a security threat to SCI systems. Corporate networks, remote access gateways and identity providers that can reach SCI systems usually fall here.
"On behalf of" matters: systems run by a vendor for the entity are in scope, and the entity stays responsible.
Key obligations
Policies and procedures (242.1001)
- Capacity, integrity, resiliency, availability and security: written, enforced policies for SCI systems (and, for security, indirect SCI systems) covering capacity planning, periodic stress tests, current development and testing methods, regular reviews and testing including backup systems, business continuity and disaster recovery with geographically diverse backups, market data standards, and monitoring to identify potential SCI events.
- Recovery goals: the plans must be reasonably designed to achieve "next business day resumption of trading and two-hour resumption of critical SCI systems" after a wide-scale disruption.
- Industry standards safe harbour: policies consistent with current SCI industry standards, meaning widely available information technology practices issued by a credible US governmental body or recognised organisation, are deemed reasonably designed. Using them is not the only route to compliance. NIST publications such as the Cybersecurity Framework and SP 800-53 are the usual reference points.
- Systems compliance: policies ensuring SCI systems operate in line with the Exchange Act, SEC rules and the entity's own rules, including pre-implementation testing, change controls and functionality assessments. Personnel who reasonably perform their duties under these policies have a safe harbour from aiding or causing liability.
- Responsible SCI personnel: policies to identify and document the senior managers responsible for each system and escalation procedures that alert them promptly to potential SCI events.
SCI events and reporting (242.1002)
An SCI event is a systems disruption, a systems compliance issue or a systems intrusion. A major SCI event is one with any impact on a critical SCI system or a significant impact on operations or market participants.
| Step | Deadline | Content |
|---|---|---|
| Corrective action | Begin once responsible SCI personnel have a reasonable basis to conclude an event occurred | Mitigate harm to investors and market integrity; resource the fix as soon as reasonably practicable |
| Initial notice to SEC | Immediately | Notification to Commission staff |
| Written notice | Within 24 hours | Good faith, best efforts description of the event and systems affected, and where available affected participants, market impact, response and expected resolution |
| Updates | Regularly, or when SEC staff reasonably request | Corrections and new material information until resolved and closed |
| Interim report | Within 30 calendar days of occurrence if not resolved | Information known so far |
| Final report | Within five business days after resolution and closure | Detailed impact, response, rules involved, copy of member communications, analysis of parties that may have suffered losses |
| De minimis events | Record all; quarterly report within 30 calendar days after quarter end | Summary of de minimis systems disruptions and systems intrusions |
Dissemination to members or participants: for disruptions and compliance issues, promptly share affected systems and a summary, then details and progress; for intrusions, promptly share a summary unless that would likely compromise security or an investigation, with the reasons documented. Major SCI events go to all members or participants. Events relating to market regulation or surveillance systems, and de minimis events, are exempt from dissemination.
Systems changes and SCI review (242.1003)
- Quarterly systems change report: within 30 calendar days after each quarter, report completed, ongoing and planned material changes to SCI systems and to the security of indirect SCI systems, using written materiality criteria.
- Annual SCI review: at least once each calendar year, a review by objective, experienced personnel including a risk assessment of SCI and indirect SCI systems and an assessment of internal controls (logical and physical security, development processes, IT governance).
- Penetration testing: penetration test reviews of the network, firewalls and production systems at least once every three years; assessments of market regulation and surveillance systems at a risk-based frequency of at least once every three years.
- Reporting the review: to senior management within 30 calendar days of completion, then with management's response to the SEC and the board within 60 calendar days after that.
Business continuity testing (242.1004)
Each entity must set standards for designating the members or participants it needs for orderly markets if its plans are activated, require them to take part in functional and performance testing of the plans and backup systems at least once every 12 months, and coordinate testing with other SCI entities across the industry or sector. See the Business Continuity and Disaster Recovery Guide.
Records and service bureaus (242.1005 to 242.1007)
Entities keep records of their compliance and file notices through Form SCI. Where a service bureau keeps records for the entity, the entity must obtain a written undertaking that the SEC may examine and receive them, and it remains responsible for the records.
Timeline and current status
| Date | Event |
|---|---|
| 19 November 2014 | SEC adopts Regulation SCI, replacing the voluntary Automation Review Policies for covered entities. Effective 60 days after Federal Register publication; compliance generally nine months after the effective date, and 21 months for coordinated industry testing |
| 2020 | Market data infrastructure rules add SCI competing consolidators to the definition of SCI entity |
| 14 April 2023 | Proposed amendments published (Release 34-97143, File S7-07-23) that would have widened scope and cyber requirements |
| 12 June 2025 | SEC withdraws 14 proposed rules, including the 2023 Regulation SCI proposal (88 FR 23146); effective 17 June 2025 (Release 34-103247) |
| October 2026 | eCFR text of 17 CFR 242.1000 to 242.1007 reflects the 2014 framework as amended |
The SEC said it does not intend to finalise the withdrawn proposals and would issue a new proposal if it acts in those areas again. Check the SEC rulemaking pages before relying on this status, because new proposals can appear.
Enforcement and penalties
Regulation SCI is a rule under the Securities Exchange Act of 1934 and is enforced by the SEC through examinations and enforcement actions, which can result in cease-and-desist orders, censures and civil money penalties. The most instructive recent case is cyber-specific.
- Intercontinental Exchange, May 2024: the SEC announced on 22 May 2024 that ICE agreed to pay a 10 million US dollar penalty and that nine subsidiaries, including the New York Stock Exchange and two clearing houses, violated Regulation SCI by failing to notify the SEC promptly of a cyber intrusion. In April 2021 a third party alerted ICE to a possible intrusion through a previously unknown vulnerability in its VPN. ICE found malicious code on a VPN device but did not tell the subsidiaries' legal and compliance staff for several days, against its own procedures, and the subsidiaries took four days to assess the impact before concluding it was de minimis. The respondents neither admitted nor denied the findings.
The lessons are concrete: an intrusion into an indirect SCI system can trigger the rule; the immediate notice is not deferred until impact is known, unless the entity concludes right away that the impact is de minimis; and a parent company's security team must have an escalation path to every subsidiary's responsible SCI personnel. See the Edge Device Compromise Investigation Playbook.
What it means for AI agents and non-human identities
Regulation SCI does not mention non-human identities or AI, but its definitions catch them. Any automated actor that can change or reach an SCI system is part of the security, change control and intrusion picture.
- Service accounts and API credentials as intrusion paths: unauthorised use of a stolen API key, certificate or service account token to reach an SCI or indirect SCI system is a systems intrusion. Inventory these credentials per system and include them in the annual SCI review risk assessment. See the Non-Human Identity (NHI) Guide.
- Automation and systems compliance: deployment pipelines, scripts and bots that push configuration to matching engines or market data systems are subject to the pre-implementation testing and change control policies in 242.1001(b). A pipeline credential that bypasses change control is a compliance gap.
- AI agents in operations: an AI agent used for surveillance triage, incident response or code changes on SCI systems needs its own identity, least privilege, logging and human approval for changes, so its actions can be reconstructed for the final report and the SCI review. See the AI Agents in Financial Services Security Guide.
- Vendors operating systems on your behalf: vendor-held credentials into SCI systems belong in the SCI review, and contracts should require the vendor to report intrusions fast enough for you to meet the immediate notice duty.
- Material systems changes: introducing an AI component or a new machine-to-machine integration into an SCI system may be a material change for the quarterly report under your criteria.
Compliance steps
- Confirm status and scope: determine whether each legal entity is an SCI entity (track ATS volume tests monthly) and record the decision.
- Classify systems: build and maintain the inventory of SCI, critical SCI and indirect SCI systems, including vendor-operated systems and the identity infrastructure that can reach them.
- Name responsible SCI personnel: designate senior managers per system and wire security alerts to them, including from group-level SOCs and subsidiaries.
- Write the event playbook: define "reasonable basis to conclude", the de minimis assessment, who makes the immediate call to SEC staff, the 24 hour notice template and the dissemination decision tree. Rehearse with a tabletop that starts with a VPN zero-day.
- Adopt an industry standard: map policies to NIST CSF 2.0 and SP 800-53 Rev. 5 to use the safe harbour and make the SCI review repeatable.
- Run the change process: set written materiality criteria and route every change, including automated and AI-assisted ones, through testing and approval; collect data for the quarterly report.
- Plan the SCI review: schedule the annual review with objective personnel, penetration testing on a cycle of three years or shorter, and the 30 and 60 day report deadlines.
- Test continuity with participants: designate members, run the annual functional and performance tests and join industry-wide exercises; measure against the two-hour and next business day goals.
- Bind vendors: obtain service bureau undertakings, intrusion notification terms and access to evidence.
Framework mapping
| Regulation SCI requirement | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Security and monitoring policies (242.1001(a)) | SI-4 System Monitoring; RA-3 Risk Assessment | DE.CM-01 |
| BC/DR plans and testing (242.1001(a)(2)(v), 242.1004) | CP-2 Contingency Plan; CP-4 Contingency Plan Testing | ID.IM-02 |
| Systems compliance and change control (242.1001(b), 242.1003(a)) | CM-3 Configuration Change Control | PR.PS-01 (configuration management) |
| Event notification and dissemination (242.1002) | IR-6 Incident Reporting | RS.CO-02 |
| SCI review and penetration testing (242.1003(b)) | CA-8 Penetration Testing; RA-3 | ID.IM-02 |
| Machine and vendor access to SCI systems | SR-6 Supplier Assessments and Reviews | PR.AA-01; PR.AA-05; GV.SC-05 |
Practitioner checklist
- Record which entities are SCI entities and monitor ATS volume thresholds each month.
- Maintain a system inventory marking SCI, critical SCI and indirect SCI systems, including vendor-run systems.
- Map every service account, API key, certificate and AI agent with access to SCI systems to an owner.
- Give the security operations centre a direct escalation path to responsible SCI personnel in every subsidiary.
- Pre-draft the 24 hour written notice and the member dissemination notice.
- Document each de minimis decision with evidence and include it in the quarterly report.
- Schedule the annual SCI review, the penetration test cycle and the 30 and 60 day reporting dates.
- Run BC/DR tests with designated members at least every 12 months against the two-hour and next business day goals.
- Check the SEC rulemaking pages each quarter for new Regulation SCI proposals.
Standards and references
- eCFR: 17 CFR 242.1000 Definitions (Regulation SCI)
- eCFR: 17 CFR 242.1001 Obligations related to policies and procedures of SCI entities
- eCFR: 17 CFR 242.1002 Obligations related to SCI events
- eCFR: 17 CFR 242.1003 Obligations related to systems changes; SCI review
- SEC: SEC Adopts Rules to Improve Systems Compliance and Integrity
- SEC: Withdrawal of Proposed Regulatory Actions (Release 34-103247)
- SEC: Intercontinental Exchange to pay 10 million dollars for failing to inform SEC of cyber intrusion
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Financial Services Cyber Regulation Map · SEC Cybersecurity Disclosure Rules Guide · Cyber Incident Reporting Requirements Map · Threat Actors Targeting Financial Services Guide. This guide summarises SEC Regulation SCI and is not legal advice.