SEC fines OTC Link $575,000 over more than eight years of gaps in its systems-security rules

The Securities and Exchange Commission on Tuesday censured OTC Link LLC, the New York broker-dealer that operates the trading systems behind over-the-counter stocks, and ordered it to pay a $575,000 civil penalty for violating Regulation Systems Compliance and Integrity, known as Regulation SCI, according to an SEC press release. OTC Link agreed to the settled order, a censure and a cease-and-desist order without admitting or denying the findings.

What the SEC found

Regulation SCI requires the operators of key market systems to have written policies that keep those systems secure, available and resilient. According to the order, from August 2016 to March 2025 OTC Link did not establish, maintain and enforce required policies for OTC Link ATS, its alternative trading system for over-the-counter securities. The gaps covered system security, access control, and how software vulnerabilities are managed, tested and fixed.

The part the SEC stressed was the repetition. Examiners from its Division of Examinations looked at OTC Link ATS several times during that period and each time flagged policies the firm had not written, or had left in draft and not finalized or enforced. "OTC Link's continual failure to remediate deficiencies even after they were repeatedly flagged by Division of Examinations staff reflects a disregard for their findings," said Laura D'Allaird, chief of the Enforcement Division's Cyber and Emerging Technologies Unit.

The SEC release describes missing and unfinished policies. It does not describe an outage, a breach or any harm to trading.

The number behind the fine

OTC Link is run by OTC Markets Group (OTCM). In its second-quarter 2026 results, the company reported $34.8 million of gross revenue and $8.6 million of net income for the quarter. The $575,000 penalty equals about 7% of that one quarter's net income, or about 1.7% of the quarter's revenue, for a violation period that ran more than eight and a half years.

The same release shows why the systems matter more now than when the violations began. OTC Link revenue rose 27% from a year earlier, and average daily trades on OTC Link ECN and OTC Link NQB rose to about 95,000 from about 63,000. More trading runs through the same infrastructure the SEC says lacked finished security and vulnerability policies for years.

Who it matters to

For brokers and traders who route orders in over-the-counter names, the order does not change how the systems work day to day. What it does is put the SEC on record that it expects Regulation SCI findings to be fixed promptly, and that repeat exam findings will lead to penalties. D'Allaird's message was aimed at every firm under the rule: all SCI entities "are expected to take their regulatory responsibilities seriously and promptly fix issues when they're identified."

Sources: SEC press release 2026-91, OTC Markets Group Q2 2026 results. This is market information, not investment advice.