In re THE OPTIONS
summary
The Options Clearing Corporation (OCC), a systemically important financial market utility, violated multiple SEC rules by failing to enforce adequate risk management, margin modeling, stress testing, cybersecurity controls, and rule change filings between 2012 and 2019, leading to a $15 million civil penalty, a cease-and-desist order, and mandatory remedial reforms.
paragraph
The Options Clearing Corporation (OCC) violated Rules 17Ad-22(b), (d), (e) and Regulation SCI by failing to establish and enforce proper risk management practices, including inaccurate margin calculations, inadequate stress testing, weak cybersecurity controls, and unapproved policy changes between 2012 and 2019. OCC also unlawfully implemented at least 18 core risk management policies without filing required rule changes under Section 19(b) of the Exchange Act, despite prior SEC warnings and deadlines for compliance. As a result, OCC consented to an SEC order imposing a $15 million civil penalty, a cease-and-desist order, and mandatory remedial actions including independent auditing, leadership restructuring, and creation of a Board-level Regulatory Committee.
narrative
The Options Clearing Corporation (OCC), the sole registered clearing agency for U.S. exchange-listed options and a designated Systemically Important Financial Market Utility (SIFMU), violated multiple SEC regulations between 2012 and 2019 by failing to establish, maintain, and enforce adequate risk management, margin modeling, stress testing, cybersecurity, and rule change filing procedures. Specifically, OCC neglected required daily and monthly stress tests, made improper margin calculations, failed to patch critical system vulnerabilities, and did not maintain proper network inventories—violating Regulation SCI’s November 2015 compliance deadline. Additionally, OCC implemented at least 18 core risk management policies without filing the required rule changes under Section 19(b) of the Exchange Act, undermining transparency and investor protection. Despite prior warnings from SEC staff and clear compliance deadlines for Rules 17Ad-22(b), (d), and (e), OCC delayed remediation until enforcement action was initiated. In settlement, OCC consented to an SEC order imposing a $15 million civil penalty and a cease-and-desist order, while agreeing to comprehensive remedial measures including the retention of an independent auditor, establishment of a Board-level Regulatory Committee composed solely of Public Directors, annual certifications, mandatory training, and submission of prioritized rule changes. OCC must also comply with a multi-phase audit schedule, implement all auditor recommendations, and provide ongoing compliance reporting to the SEC to restore confidence in its operations and safeguard the broader financial system.
Classified broker-dealer-fraud(confidence 95%). EDGAR detection: forms Form D· recall 29% / precision 9%. detection rule →
Statutes
15 U.S.C. 78q-1(b)15 U.S.C. 78q12 U.S.C. 5462(9)31 U.S.C. 3717SECTIONS 19(h) AND 21C OF THE SECURITIES EXCHANGE ACTSECTIONS 19(h) AND 21C OF THE SECURITIES EXCHANGE ACTRule 19b-4(c)Rule 19b-4Rule 19b-4(a)
Parties
Securities and Exchange CommissionTHE OPTIONS CLEARING CORPORATION
Keywords
occpolicies procedurescommissionexchangereasonably designedprocedures reasonablymaintain enforcead-clearingclearing agencyestablish implementimplement maintainshallpoliciesreasonably
Extracted insights
Entities 3
- organization Options Clearing Corporation
- agency Securities and Exchange Commission
- company the options clearing corporation
Triples 8
- Securities And Exchange Commission instituted Administrative And Cease-And-Desist Proceedings
- The Options Clearing Corporation submitted Offer Of Settlement
- Securities And Exchange Commission accepted Offer Of Settlement
- The Options Clearing Corporation consented Order Instituting Administrative And Cease-And-Desist Proceedings
- The Options Clearing Corporation failed To Comply With Certain Provisions Of The Statutes And Rules
- The Options Clearing Corporation serves as Sole Registered Clearing Agency For Exchange Listed Option Contracts
- The Options Clearing Corporation designated as Systemically Important Financial Market Utility
- Securities And Exchange Commission adopted Rules 17Ad-22(B) And (D)
PDF
Text layers
Extracted body text (61,038c)
-1-
UNITED STATES OF AMERICA
Before the
SECURITIES AND EXCHANGE COMMISSION
SECURITIES EXCHANGE ACT OF 1934
Release No. 86871 / September 4, 2019
ADMINISTRATIVE PROCEEDING
File No. 3-19416
In the Matter of
THE OPTIONS
CLEARING CORPORATION,
Respondent.
ORDER INSTITUTING ADMINISTRATIVE
AND CEASE-AND-DESIST PROCEEDINGS
PURSUANT TO SECTIONS 19(h) AND 21C
OF THE SECURITIES EXCHANGE ACT OF
1934, MAKING FINDINGS, AND
IMPOSING REMEDIAL SANCTIONS AND
A CEASE-AND-DESIST ORDER
I.
The Securities and Exchange Commission (“Commission”) deems it appropriate and in the
public interest that public administrative and cease-and-desist proceedings be, and hereby are,
instituted pursuant to Sections 19(h) and 21C of the Securities Exchange Act of 1934 (“Exchange
Act”) against The Options Clearing Corporation (“OCC” or “Respondent”).
II.
In anticipation of the institution of these proceedings, Respondent has submitted an Offer
of Settlement (the “Offer”) which the Commission has determined to accept. Solely for the
purpose of these proceedings and any other proceedings brought by or on behalf of the
Commission, or to which the Commission is a party, and without admitting or denying the findings
herein, except as to the Commission’s jurisdiction over it and the subject matter of these
proceedings, which are admitted, Respondent consents to the entry of this Order Instituting
Administrative and Cease-and-Desist Proceedings Pursuant to Sections 19(h) and 21C of the
Securities Exchange Act of 1934, Making Findings, and Imposing Remedial Sanctions and a
Cease-and-Desist Order (“Order”), as set forth below.
-2-
III.
On the basis of this Order and Respondent’s Offer, the Commission finds
1
that:
A. Summary
1. This matter concerns the failure by OCC to comply with certain provisions of the
statutes and rules applicable to registered clearing agencies. Registered clearing agencies, such as
OCC, are an essential part of the infrastructure of the U.S. securities markets and as such, they are
required to be structured to manage and reduce risk. In instances where registered clearing
agencies are not structured and operated appropriately, they can pose substantial risk to the
financial system as a whole.
2. OCC serves as the sole registered clearing agency for exchange listed option
contracts in the United States and has been designated as a systemically important financial market
utility (“SIFMU”) under Title VIII of the Dodd-Frank Wall Street Reform and Consumer
Protection Act of 2010 (“Dodd-Frank Act”). Disruption to OCC’s operations, or failure by OCC to
manage risk, could result in significant costs not only to OCC itself and its members, but also to
other market participants or the broader U.S. financial system.
3. As a registered clearing agency, OCC is a self-regulatory organization under the
Exchange Act. Self-regulatory organizations are charged with an important public trust to carry
out their self-regulatory responsibilities effectively and fairly, while fostering free and open
markets, protecting investors, and promoting the public trust.
4. The U.S. Congress and the Commission have established a legal framework to
facilitate the prompt and accurate clearance and settlement of securities transactions, having due
regard for, among other things, the public interest, the protection of investors, and the safeguarding
of securities and funds. Four groups of statutes, rules, and regulations are at issue in this matter.
5. In October 2012, the Commission adopted Rules 17Ad-22(b) and (d) under the
Exchange Act to “strengthen the substantive regulation of registered clearing agencies, promote the
safe and reliable operation of registered clearing agencies, and improve efficiency, transparency
and access to registered clearing agencies.”
2
Rules 17Ad-22(b) and (d) were first proposed in
March 2011. OCC was not required to comply until January 2, 2013.
6. In November 2014, the Commission adopted Regulation Systems, Compliance, and
Integrity under the Exchange Act (“Reg. SCI”) to “strengthen the technology infrastructure of U.S.
securities markets” and “reduce the occurrence of systems issues, improve resiliency when
1
The findings herein are made pursuant to OCC’s Offer of Settlement and are not binding
on any other person or entity in this or any other proceeding.
2
Standards for Covered Clearing Agencies, 81 Fed. Reg. 70786, 70788 (October 13, 2016)
(footnote omitted).
-3-
systems problems do occur, and enhance the Commission’s oversight and enforcement of
securities market technology infrastructure.”
3
Reg. SCI, which applies to registered clearing
agencies, was first proposed in June 2012. OCC was not required to comply until November 3,
2015.
7. In October 2016, the Commission adopted Rule 17Ad-22(e) under the Exchange
Act, which established enhanced standards for registered clearing agencies that meet the definition
of a “covered clearing agency.” OCC is a covered clearing agency for purposes of Rule 17Ad-
22(e). The Commission adopted Rule 17Ad-22(e) to “impos[e] consistent, higher minimum risk
management standards across all covered clearing agencies” and “further mitigate the potential for
moral hazard associated with risk management at a covered clearing agency.”
4
Rule 17Ad-22(e)
was first proposed in March 2014. OCC was not required to comply until April 11, 2017.
8. And finally, the rule filing and Commission approval requirements embodied in
Section 19(b) of the Exchange Act and Rule 19b-4(c) thereunder, which apply to all self-
regulatory organizations including registered clearing agencies, serve an important function in
keeping the public and a clearing agency’s members informed and involved in the operations of
the clearing agency and ensuring that the clearing agency’s rules are consistent with the
Exchange Act and the rules and regulations thereunder.
9. In connection with examinations of OCC before it was required to comply with the
Rule 17Ad-22(e) and Reg. SCI, the Commission staff notified OCC of material weaknesses with
its policies and procedures that, if not corrected before the required compliance dates, could result
in violations of Rule 17Ad-22(e) and Reg. SCI.
10. Nonetheless, despite the Commission staff’s advance warnings and ample time to
comply, OCC failed to come into compliance with Rules 17Ad-22(b), (d) and (e) and Reg. SCI by
the required compliance dates. Specifically, OCC failed to establish, implement, maintain and
enforce policies and procedures reasonably designed to:
a. review its risk-based margin models and the parameters for those models on
a monthly basis;
b. consider and produce margin levels commensurate with the risks and
particular attributes of each relevant product cleared by OCC;
c. effectively measure, monitor, and manage its credit exposure and liquidity
risk;
d. maintain a comprehensive risk management framework;
3
81 Fed. Reg. 70786, 70789.
4
81 Fed. Reg. 70786, 70850.
-4-
e. protect the security of certain of its information systems; and
f. provide for a well-founded, clear, transparent and enforceable legal
framework for every aspect of its activities.
OCC also failed to comply with Section 19(b) of the Exchange Act and Rule 19b-4(c) thereunder
by adopting and changing certain policies prior to obtaining Commission approval.
11. As a result of its conduct, OCC violated Section 17A(d)(1) of the Exchange Act
5
and Rules 17Ad-22(b)(2), 17Ad-22(d)(1), 17Ad-22(e)(1), 17Ad-22(e)(3)(i), 17Ad-22(e)(4)(iii) and
(vi), 17Ad-22(e)(6)(i), and 17Ad-22(e)(7)(i) and (vi) thereunder; Rules 1001(a)(1) and (2) of Reg.
SCI under the Exchange Act; and Section 19(b) of the Exchange Act and Rule 19b-4 thereunder.
B. Respondent
12. OCC is a Delaware corporation with its principal place of business in Chicago,
Illinois. OCC is the sole central counterparty for exchange listed option contracts in the United
States. The Commission granted full registration as a clearing agency to OCC pursuant to the
Exchange Act on September 23, 1983.
6
As a registered clearing agency, OCC is a self-regulatory
organization under the Exchange Act.
13. On July 18, 2012, the Financial Stability Oversight Council approved the
designation of OCC as a SIFMU pursuant to Section 804 of the Dodd-Frank Act. A financial
market utility is deemed to be systemically important if “the failure of or a disruption to the
functioning of such [financial market utility] could create or increase the risk of significant
liquidity or credit problems spreading among financial institutions or markets and thereby threaten
the stability” of the U.S. financial system.
7
For purposes of the Dodd-Frank Act, the Commission
is OCC’s supervisory agency. As such, the Commission is required by Section 807(a) of the
Dodd-Frank Act to examine OCC at least once annually. In addition, because it is a SIFMU, OCC
is a “covered clearing agency” subject to the Commission’s enhanced clearing agency standards set
forth in Exchange Act Rule 17Ad-22(e).
5
Section 17A(d)(1) of the Exchange Act prohibits registered clearing agencies from
engaging in any activity as a clearing agency in contravention of such rules and regulations
as the Commission may prescribe as necessary or appropriate in the public interest, for the
protection of investors, or otherwise in furtherance of the purposes of the Exchange Act.
6
Unless exempted, a clearing agency must register with the Commission pursuant to
Exchange Act Section 17A. 15 U.S.C. 78q-1(b)(1). Such registration requires
Commission determinations regarding the clearing agency and its rules. 15 U.S.C. 78q-
1(b)(3).
7
12 U.S.C. 5462(9).
-5-
C. Facts
OCC Failed to Establish, Implement, Maintain, and Enforce Policies and
Procedures Reasonably Designed to Review Its Risk-Based Margin Models and the
Parameters for Those Models on a Monthly Basis
14. Exchange Act Rule 17Ad-22(b)(2) requires that a registered clearing agency
performing central counterparty services establish, implement, maintain, and enforce written
policies and procedures reasonably designed to “[u]se risk-based models and parameters to set
margin requirements and review such margin requirements and the related risk-based models and
parameters at least monthly.”
15. When proposing this rule, the Commission explained that “[m]arket conditions and
risks are constantly changing and therefore the models and parameters used by a clearing agency
providing [central counterparty] services to set margin may not accurately reflect the needs of a
clearing agency if they are permitted to remain static.” The Commission further noted that the one
month review period for risk-based margin models and parameters “would limit the potential that
such parameters or models will become stale.”
8
16. OCC was required to comply with Exchange Act Rule 17Ad-22(b)(2) by January 2,
2013. However, through at least April 2017, OCC failed to establish, implement, maintain, and
enforce policies and procedures reasonably designed to review its risk-based margin models and all
of the parameters for those models at least monthly.
OCC Failed to Establish, Implement, Maintain, and Enforce Policies and Procedures
Reasonably Designed to Consider and Produce Margin Levels Commensurate with the Risks
and Particular Attributes of Each Relevant Product Cleared by OCC
17. Exchange Act Rule 17Ad-22(e)(6)(i) requires that a covered clearing agency
performing central counterparty services establish, implement, maintain, and enforce policies and
procedures that are reasonably designed to cover its credit exposures to its participants by
establishing a risk-based margin system that, among other things, “[c]onsiders, and produces
margin levels commensurate with, the risks and particular attributes of each relevant product,
portfolio and market.”
18. Collection of margin is a critical component of a clearing agency’s risk
management in ensuring that it has sufficient financial resources in the case of a clearing member
default.
19. OCC was required to comply with Exchange Act Rule 17Ad-22(e)(6)(i) by April
11, 2017. However, to date, OCC has not established, implemented, maintained, or enforced
policies and procedures reasonably designed to consider and produce margin levels commensurate
8
Clearing Agency Standards for Operation and Governance, 76 Fed. Reg. 14471, 14478
(proposed March 16, 2011).
-6-
with the risks and particular attributes of each relevant product cleared by OCC. Specifically,
OCC’s margin model fails to consider the impact of market liquidation costs, including bid-ask
spreads and other transaction-based costs, as well as the potential market impact of liquidation
activity. OCC’s margin model also fails to consider specific wrong way risk
9
associated with
cleared securities which are related to clearing members.
OCC Failed to Establish, Implement, Maintain, and Enforce Policies and
Procedures Reasonably Designed to Cover Its Credit Exposure
20. Exchange Act Rule 17Ad-22(e)(4)(iii) requires that a covered clearing agency not
subject to Exchange Act Rule 17Ad-22(e)(4)(ii) establish, implement, maintain, and enforce
written policies and procedures reasonably designed to maintain “additional financial resources at
the minimum to enable it to cover a wide range of foreseeable stress scenarios.”
21. Exchange Act Rules 17Ad-22(e)(4)(vi)(A)-(D) further require that a covered
clearing agency establish, implement, maintain, and enforce written policies and procedures
reasonably designed to test the sufficiency of its total financial resources available to meet the
minimum requirements in Exchange Act Rule 17Ad-22(e)(4)(i) through (iii) by:
a. stress testing its total financial resources once each day using standard
predetermined parameters and assumptions;
b. comprehensively analyzing its stress testing scenarios, models, and
underlying parameters and assumptions on at least a monthly basis;
c. comprehensively analyzing its stress testing scenarios, models, parameters,
and assumptions more frequently than monthly during periods of stress
and/or volatility; and
d. reporting the results of its stress testing analyses to appropriate decision
makers.
22. The Commission adopted these rules to ensure that covered clearing agencies could
“rapidly identify any gaps in resources required to ensure [financial] stability.”
10
23. OCC was required to comply with Exchange Act Rules 17Ad-22(e)(4)(iii) and
17Ad-22(e)(4)(vi)(A)-(D) by April 11, 2017. Nonetheless, through at least September 4, 2018,
OCC failed to establish, implement, maintain, and enforce policies and procedures mandating that
OCC consider a wide range of foreseeable stress scenarios when determining the sufficiency of its
9
“Specific wrong-way risk arises at a [central counterparty] when an exposure to a
participant is highly likely to increase when the creditworthiness of that participant is
deteriorating.” 81 Fed. Reg. 70786, 70789n.317.
10
81 Fed. Reg. at 70869.
-7-
financial resources. Instead, OCC implemented policies and procedures that determine the
monthly sizing of its clearing fund based on a daily calculation of its stress testing exposures
utilizing only a limited number of scenarios.
24. In addition, through at least September 4, 2018, OCC failed to establish, implement,
maintain, and enforce policies and procedures reasonably designed to stress test its total financial
resources using a wide range of foreseeable stress scenarios once each day; analyze its stress
testing scenarios, models, parameters, and assumptions at least monthly; analyze its stress testing
scenarios, models, parameters, and assumptions more frequently than monthly during periods of
stress and/or volatility; and report the results of its stress testing analyses to appropriate decision
makers.
OCC Failed to Establish, Implement, Maintain, and Enforce Policies and Procedures
Reasonably Designed to Maintain Sufficient Liquid Resources
25. Exchange Act Rule 17Ad-22(e)(7)(i) requires that a covered clearing agency
establish, implement, maintain, and enforce written policies and procedures reasonably designed to
maintain “sufficient liquid resources at the minimum in all relevant currencies to effect same-day
and, where appropriate, intraday and multiday settlement of payment obligations with a high
degree of confidence under a wide range of foreseeable stress scenarios.”
26. Exchange Act Rules 17Ad-22(e)(7)(vi)(A)-(D) further require that a covered
clearing agency establish, implement, maintain, and enforce written policies and procedures
reasonably designed to determine the amount and regularly test the sufficiency of the liquid
resources held for purposes of meeting the minimum liquid resource requirement under Exchange
Act Rule 17Ad-22(e)(7)(i) by, at a minimum:
a. stress testing its liquidity resources once each day using standard
predetermined parameters and assumptions;
b. comprehensively analyzing its stress testing scenarios, models, and
underlying parameters and assumptions on at least a monthly basis;
c. comprehensively analyzing its stress testing scenarios, models, parameters,
and assumptions more frequently than monthly during periods of stress
and/or volatility; and
d. reporting the results of its stress testing analyses to appropriate decision
makers.
27. When adopting these rules, the Commission explained that “[m]arket participants
in centrally cleared and settled markets are often linked to one another through intermediation
chains in which one party may rely on proceeds from sales of cleared products to meet payment
obligations to another party. . . Therefore, the benefits related to liquidity risk management
-8-
generally flow from the reduced risk of systemic risk transmission by covered clearing agencies as
a result of liquidity shortfalls.”
11
28. OCC was required to comply with Exchange Act Rules 17Ad-22(e)(7)(i) and
17Ad-22(e)(7)(vi)(A)-(D) by April 11, 2017. However, to date, OCC has failed to establish,
implement, maintain, and enforce policies and procedures reasonably designed to consider a wide
range of foreseeable stress scenarios when determining the sufficiency of its liquid resources.
Instead, OCC has implemented policies and procedures which determine the size of its liquid
resources using scaled normal market conditions.
29. In addition, OCC has failed to establish, implement, maintain, and enforce policies
and procedures reasonably designed to stress test its total liquid resources using a wide range of
foreseeable stress scenarios once each day; analyze its stress testing scenarios, models, parameters,
and assumptions at least monthly; analyze its stress testing scenarios, models, parameters, and
assumptions more frequently than monthly during periods of stress and/or volatility; and report the
results of its stress testing analyses to appropriate decision makers.
30. Moreover, OCC has failed to establish, implement, maintain, and enforce policies
and procedures reasonably designed to include all known sources of possible liquidity obligations
in determining the liquidity required in the event of a clearing member default, such as certain
possible liquidity, payment, and delivery obligations relating to default auctions.
OCC Failed to Establish, Implement, Maintain, and Enforce Policies and Procedures
Reasonably Designed to Maintain a Comprehensive Risk Management Framework
31. Exchange Act Rule 17Ad-22(e)(3) requires that a covered clearing agency
establish, implement, maintain, and enforce written policies and procedures reasonably designed to
“maintain a sound risk management framework for comprehensively managing legal, credit,
liquidity, operational, general business, investment, custody, and other risks that arise in or are
borne by the covered clearing agency.”
32. Exchange Act Rule 17Ad-22(e)(3)(i) further requires that a covered clearing
agency’s risk management framework include “risk management policies, procedures, and systems
designed to identify, measure, monitor, and manage the range of risks that arise in or are borne by
the covered clearing agency, that are subject to review on a specified periodic basis and approved
by the board of directors annually.”
33. OCC was required to comply with Exchange Act Rule 17Ad-22(e)(3)(i) by April
11, 2017. However, OCC failed to establish, implement, maintain, and enforce policies and
procedures reasonably designed to manage the credit and liquidity risk that arises in or is borne by
OCC. Specifically, as described above, OCC, among other things, lacked policies and procedures
which provided for comprehensive stress testing of its financial and liquid resources under a wide
range of foreseeable stress scenarios.
11
81 Fed. Reg. at 70870.
-9-
34. OCC also failed to establish, implement, maintain, and enforce policies and
procedures reasonably designed to manage the operational risk that arises in or is borne by OCC.
Specifically, as described below, OCC’s policies and procedures were not reasonably designed to
ensure that its SCI systems and, for purposes of security standards, indirect SCI systems had
adequate levels of capacity, integrity, resiliency, availability, and security.
35. In addition, OCC failed to establish, implement, maintain, and enforce policies and
procedures reasonably designed to manage the legal risk that arises in or is borne by OCC.
Specifically, as described below, OCC’s policies and procedures were not reasonably designed to
provide for a well-founded, clear, transparent, and enforceable legal basis for each aspect of its
activities in all relevant jurisdictions because OCC failed to file proposed rules before adopting
certain policies and implemented certain policies prior to approval of the Commission.
OCC Failed to Obtain Commission Approval for
Proposed Rule Changes
36. Section 19(b)(1) of the Exchange Act requires that self-regulatory organizations,
such as registered clearing agencies, file with the Commission proposed rule changes
accompanied by a concise general statement of the basis and purpose of such proposed rule
change. Section 19(b)(1) further requires the Commission to publish notice of the proposed rule
change and provide interested persons an opportunity to submit written comments. Section
19(b)(1) prohibits a proposed rule change from taking effect unless approved by the Commission
or otherwise permitted in accordance with the provisions of Section 19(b).
37. Section 19(b)(1) defines “proposed rule change” as “any proposed rule or any
proposed change in, addition to, or deletion from the rules of the self-regulatory organization.”
Exchange Act Rule 19b-4(c) provides that “a stated policy, practice, or interpretation of the self-
regulatory organization shall be deemed to be a proposed rule change unless: (1) it is reasonably
and fairly implied by an existing rule; or (2) it is concerned solely with the administration of the
self-regulatory organization and is not a stated policy, practice or interpretation with respect to
the meaning, administration, or enforcement of an existing rule of the self-regulatory
organization.” Exchange Act Rule 19b-4(a)(6) defines “stated policy, practice, or interpretation”
to include “any material aspect of the operation of the facilities of the self-regulatory
organization.”
38. In October 2012, the Commission adopted Exchange Act Rule 17Ad-22(d)(1),
which requires that a registered clearing agency establish, implement, maintain, and enforce
written policies and procedures reasonably designed to “provide for a well-founded, transparent,
and enforceable legal framework for each aspect of its activities in all relevant jurisdictions.”
39. When adopting this rule, the Commission indicated that in order to provide a
transparent legal framework, written policies and procedures must, at a minimum, be clear,
internally consistent, readily accessible by the public, and address the significant aspects of the
-10-
clearing agency’s operations and risk management.
12
40. OCC failed to file with the Commission proposed rule changes before adopting
numerous policies. By December 2015, OCC had implemented at least eighteen policies that
addressed core risk management issues without filing proposed rule changes with the
Commission, including:
a. Legal Risk Policy;
b. Model Risk Management Policy;
c. Financial Resources Policy;
d. Risk Appetite Framework;
e. Enterprise Risk Management Framework;
f. Risk Universe;
g. Operational Risk Management;
h. Clearing Fund Policy;
i. Margin Policy;
j. Credit Risk Management Policy;
k. Liquidity Risk Management Policy;
l. Systems Incident Escalation Policy;
m. Default Management Policy;
n. Collateral Risk Management Policy;
o. Business Continuity Planning Policy;
p. Information Technology Risk Management Policy;
q. Vendor Risk Management Policy; and
r. Capital Requirements Policy.
41. In October 2016, the Commission adopted Exchange Act Rule 17Ad-22(e)(1),
which requires that a covered clearing agency establish, implement, maintain, and enforce written
policies and procedures reasonably designed to provide for a well-founded, clear, transparent, and
enforceable legal basis for each aspect of its activities in all relevant jurisdictions. OCC was
required to comply with this rule by April 11, 2017.
42. OCC also implemented policies before obtaining Commission approval on
various other occasions. For example, in May 2017, OCC implemented revisions to the
following policies without prior approval of the Commission:
a. Counterparty Credit Risk Management Policy;
b. Default Management Policy;
c. Margin Policy;
d. Risk Management Framework Policy;
e. Collateral Risk Management Policy; and
f. Revised charter for OCC’s Board of Directors as well as charters for the
Board’s Audit Committee, Risk Committee, Compensation and Payment
12
Standards for Clearing Agencies, 77 Fed. Reg. 66220, 66246 (Nov. 2, 2012).
-11-
Committee, Governance and Nominating Committee, Risk Committee, and
Technology Committee.
13
OCC Failed to Establish, Maintain and Enforce Policies and Procedures Reasonably Designed
to Protect the Security of Certain OCC Information Systems
43. Rule 1001(a)(1) of Reg. SCI requires that an SCI entity such as a registered clearing
agency “establish, maintain, and enforce written policies and procedures reasonably designed to
ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have
levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI
entity’s operational capability and promote the maintenance of fair and orderly markets.”
44. Rule 1001(a)(2)(iv) of Reg. SCI requires that policies and procedures established
to comply with Rule 1001(a)(1) include, at a minimum, “[r]egular reviews and testing, as
applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to
internal and external threats, physical hazards, and natural or manmade disasters.”
45. Rule 1000 of Reg. SCI defines “SCI systems” as “all computer, network, electronic,
technical, automated or similar systems operated by or on behalf of [the entity] that, with respect to
securities, directly support trading, clearance and settlement, order routing, market data, market
regulation, or market surveillance.” Rule 1000 defines “indirect SCI systems” as “any systems of,
or operated by or on behalf of, [the entity] that if breached, would be reasonably likely to pose a
security threat to SCI systems.”
46. OCC failed to establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect
SCI systems had adequate levels of capacity, integrity, resiliency, availability, and security by
November 3, 2015, when OCC was required to comply with Reg. SCI. Certain of its policies and
procedures remain deficient through the present.
47. As of November 3, 2015 and continuing through various time periods thereafter,
OCC failed to establish, maintain, and enforce written policies and procedures that were
reasonably designed to:
a. consistently identify, prioritize, test, and implement vendor-issued patches;
b. secure certain data within cloud environments;
c. ensure that all network devices, including unused and test network devices,
were inventoried; and
d. ensure security threats would be promptly detected.
13
The Commission subsequently approved proposed rules relating to these policies and
charters.
-12-
D. Violations
48. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(b)(2), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to use risk-based models and parameters to set margin
requirements and review such margin requirements and the related risk-based models and
parameters at least monthly.
49. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(d)(1), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to provide for a well-founded, transparent, and
enforceable legal framework for each aspect of its activities in all relevant jurisdictions.
50. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(e)(1), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to provide for a well-founded, transparent, and
enforceable legal framework for each aspect of its activities in all relevant jurisdictions.
51. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(e)(3)(i), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to:
a. maintain a sound risk management framework for comprehensively
managing, among other things, legal, credit, liquidity, and operational risks
that arise or are borne by OCC; and
b. include as part of that framework risk management policies, procedures, and
systems designed to identify, measure, monitor, and manage the range of
risks that arise in or are borne by OCC, that are subject to review on a
specified periodic basis and approved by the board of directors annually.
52. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(e)(4)(iii), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to maintain additional financial resources at the
minimum to enable it to cover a wide range of foreseeable stress scenarios.
53. As a result of the conduct described above, OCC violated Exchange Act Rules
17Ad-22(e)(4)(vi)(A)-(D), which require that OCC establish, implement, maintain, and enforce
policies and procedures reasonably designed to test the sufficiency of its total financial resources to
meet the minimum requirements under Exchange Act Rules 17Ad-22(e)(4)(i) and (iii) by:
a. stress testing its total financial resources once each day using standard
predetermined parameters and assumptions;
b. comprehensively analyzing its stress testing scenarios, models, and
-13-
underlying parameters and assumptions on at least a monthly basis;
c. comprehensively analyzing its stress testing scenarios, models, parameters,
and assumptions more frequently than monthly during periods of stress
and/or volatility; and
d. reporting the results of its stress testing analyses to appropriate decision
makers.
54. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(e)(6)(i), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to cover its credit exposures to its participants by
establishing a risk-based margin system that considers, and produces margin levels commensurate
with, the risks and particular attributes of each relevant product, portfolio, and market.
55. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(e)(7)(i), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to maintain sufficient liquid resources at the
minimum in all relevant currencies to effect same-day, and where appropriate, intraday and
multiday settlement of payment obligations with a high degree of confidence under a wide range of
foreseeable stress scenarios.
56. As a result of the conduct described above, OCC violated Exchange Act Rules
17Ad-22(e)(7)(vi)(A)-(D), which require that OCC establish, implement, maintain, and enforce
written policies and procedures reasonably designed to determine the amount and regularly test the
sufficiency of the liquid resources held for purposes of meeting the minimum liquid resource
requirements in Exchange Act Rule 17Ad-22(e)(7)(i) by:
a. stress testing its liquidity resources once each day using standard
predetermined parameters and assumptions;
b. comprehensively analyzing its stress testing scenarios, models, and
underlying parameters and assumptions on at least a monthly basis;
c. comprehensively analyzing its stress testing scenarios, models, parameters,
and assumptions more frequently than monthly during periods of stress
and/or volatility; and
d. reporting the results of its stress testing analyses to appropriate decision
makers.
57. As a result of the conduct described above, OCC violated Section 17A(d)(1) of the
Exchange Act, which prohibits OCC from engaging in any activity in contravention of such rules
and regulations as the Commission may prescribe as necessary or appropriate, in the public
interest, for the protection of investors, or otherwise in furtherance of the purposes of the Exchange
Act.
-14-
58. As a result of the conduct described above, OCC violated Rule 1001(a)(1) of Reg.
SCI, which requires that OCC establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems and, for purposes of security standards,
indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security,
adequate to maintain the its operational capability and promote the maintenance of fair and
orderly markets.
59. As a result of the conduct described above, OCC violated Rule 1001(a)(2)(iv) of
Reg. SCI, which requires that OCC’s policies and procedures under Rule 1001(a)(1) of Reg. SCI
include regular reviews and testing, as applicable, of such systems, including backup systems, to
identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or
manmade disasters.
60. As a result of the conduct described above, OCC violated Section 19(b)(1) of the
Exchange Act and Rule 19b-4(c) thereunder, which require a self-regulatory organization to file
with the Commission stated policies, practices and interpretations that meet the definition of a
proposed rule change, and prohibit a proposed rule change from taking effect unless approved by
the Commission or otherwise permitted in accordance with Section 19(b)(1) of the Exchange Act.
E. Cooperation and Remediation
61. In determining to accept the Offer, the Commission has considered OCC’s
cooperation and remedial efforts, which include the following:
a. In October 2017, OCC’s Board of Directors (“the Board”) created the Ad Hoc
Regulatory Oversight Working Group (the “ROWG”) that includes all of OCC’s public directors
and meets at least monthly to assist OCC’s Board in overseeing OCC’s efforts to comply with its
ongoing regulatory obligations and to supervise OCC’s remediation and compliance efforts.
b. At the direction of its Executive Chairman and Board of Directors, OCC has
replaced many of its senior executives − including hiring a new Chief Executive Officer, Chief
Operating Officer, Head of Financial Risk Management, Chief Information Officer, Chief Security
Officer, and heads of control functions − and increased its expenditures and headcount in the areas
of risk management, compliance, legal, and information technology.
c. OCC developed remediation plans that have been provided to the staff of the
Commission. In addition, OCC filed proposed rule changes under Section 19(b) of the Exchange
Act, which were subsequently approved by the Commission, designed to:
i. enhance its Margin Policy (approved February 7, 2018);
ii. change its Daily Univariate methodology (approved May 24, 2018);
iii. incorporate stress testing into its clearing fund methodology (approved July
27, 2018);
-15-
iv. enhance its implied volatility model (approved December 20, 2018);
v. change its margin methodology for Volatility Indexes and Volatility Index
Futures (approved May 6, 2019); and
vi. incorporate liquidation costs in its margin methodology (approved June 17,
2019).
F. Undertakings
62. Within one (1) month of the date of this Order, OCC shall engage an independent
compliance auditor (“Auditor”), not unacceptable to the Commission staff. The Auditor shall be
recommended by the ROWG and shall be approved by the Board. OCC shall provide a copy of
the engagement letter detailing the scope of the Auditor’s responsibilities to the staff of the
Commission within three (3) business days of its execution.
63. As part of the engagement, OCC shall require the Auditor to:
a. assess OCC’s remediation of deficiencies identified in OCC’s July 23,
2018 Remediation Plan and deficiencies identified in the August 12, 2019
addendum to that plan (collectively “Deficiencies”);
b. audit OCC’s compliance with Exchange Act Rule 17Ad-22(b)(2) and
(e)(1-10, 12-13, 15-21, and 23) and Reg. SCI Rules 1001 and 1005; and
c. assess the hiring, qualifications, and training of OCC personnel
responsible for compliance with Exchange Act Rule 17Ad-22(b)(2) and
(e)(1-10, 12-13, 15-21, and 23) and Reg. SCI Rules 1001 and 1005,
including OCC’s compliance, internal audit, technology, and project
management personnel.
64. OCC shall require the Auditor to conduct two reviews, one audit, one
assessment, and prepare four reports, as described below.
65. OCC shall require the Auditor to commence an initial review of OCC’s
remediation of Deficiencies (the “Initial Review”) no later than sixty (60) calendar days from the
date of the engagement of the Auditor (unless otherwise agreed by OCC, the Auditor, and the
Commission staff). OCC shall require the Auditor to issue a written report (the “Initial Report”)
within one hundred eighty (180) calendar days of commencing the Initial Review setting forth
the Auditor’s findings and if necessary, making recommendations reasonably designed to
improve OCC’s remediation of Deficiencies. OCC shall require the Auditor to provide the report
to the Board and contemporaneously transmit a copy to Commission staff.
66. OCC shall adopt and implement all recommendations made by the Auditor in the
Initial Report, subject to Paragraph 67 below.
-16-
67. If OCC reasonably and in good faith determines that any of the Auditor’s
recommendations set forth in the Initial Report are unduly burdensome or impractical, or if OCC
determines that the objectives of the recommendations can be more effectively achieved through
another means, OCC may propose to the Auditor that a recommendation not be implemented or
propose an alternative reasonably designed to accomplish the same objectives, and shall notify
the Auditor of any such proposals within fourteen (14) calendar days of receipt of the report. If,
upon evaluating OCC’s proposal(s), the Auditor determines that any of the Auditor’s
recommendations should not be implemented or that a suggested alternative is reasonably
designed to accomplish, and is likely to result in, the same objectives as the recommendation in
question within the same timeframe, then the Auditor may withdraw the recommendation and/or
accept the proposed alternative and notify in writing the staff of the Commission within two (2)
business days of any such withdrawn recommendations and/or accepted alternatives, and OCC
shall adopt and implement the accepted alternative(s). If, upon evaluating OCC’s proposals, the
Auditor concludes that the Auditor’s recommendation should be implemented, the Auditor shall
notify OCC within fourteen (14) calendar days of receipt of the alternative proposal, and OCC
and the Auditor shall, within seven (7) business days of the Auditor’s notification, jointly confer
with the staff of the Commission to resolve the matter. In the event that, after conferring with the
Commission staff, OCC and the Auditor are unable to agree on an alternative proposal, OCC
shall adopt and implement the Auditor’s recommendation.
68. At the conclusion of the one-hundred twenty (120) calendar day period after the
issuance of the Initial Report, OCC shall require the Auditor to commence an interim review of
OCC’s implementation of the Auditor’s recommendations, if any, in the Initial Report (“Interim
Review”). Within sixty (60) calendar days of commencing the Interim Review, OCC shall
require the Auditor to submit to the Commission staff and OCC’s Board an interim report (the
“Interim Report”) setting forth the Auditor’s findings.
69. At the conclusion of the three-hundred sixty-five (365) calendar day period after
the issuance of the Initial Report (unless otherwise agreed by OCC, the Auditor and the
Commission staff), OCC shall require the Auditor to commence an audit of OCC’s compliance
with Exchange Act Rule 17Ad-22(b)(2) and (e)(1-10, 12-13, 15-21, and 23) and Reg. SCI Rules
1001 and 1005 (the “Audit”). At this time, OCC shall also require the Auditor to commence an
assessment of the hiring, qualifications, and training of OCC personnel responsible for
compliance with Exchange Act Rule 17Ad-22(b)(2) and (e)(1-10, 12-13, 15-21, and 23) and Reg.
SCI Rules 1001 and 1005, including OCC’s compliance, internal audit, technology, and project
management personnel (the “Assessment”).
70. OCC shall require the Auditor in performing the Audit to develop a written plan
of sufficient scope and detail to achieve the audit objectives and to identify areas in need of
special consideration. OCC shall require the Auditor and other qualified persons retained by the
Auditor to exercise due professional care and independence. OCC shall require the Auditor to
formulate conclusions based on sufficient, competent evidential matter and consistent with
professional judgment.
71. OCC shall require the Auditor to issue a report (“the Audit Report”) regarding
-17-
OCC’s compliance with Exchange Act Rule 17Ad-22(b)(2) and (e)(1-10, 12-13, 15-21, and 23)
and Reg. SCI Rules 1001 and 1005 within one hundred-eighty (180) calendar days of
commencing the Audit. The Audit Report shall describe the purpose, scope, and nature of the
audit and identify any deficiencies or weaknesses detected during the audit. OCC shall require
the Auditor to provide the Audit Report to the Board and contemporaneously transmit a copy to
Commission staff.
72. Within forty-five (45) calendar days of receipt of the Audit Report, OCC shall
provide to the Auditor, the Board and the staff of the Commission a response (the “Response”)
that includes: (i) a statement of whether OCC reasonably and in good faith disagrees with any
identified deficiency and weakness and an explanation of the reasons for OCC’s disagreement;
(ii) a plan including deadlines for remediating within a reasonable time frame any deficiency and
weakness with which OCC does not disagree; and (iii) a description of the cause of any
deficiency and weakness with which OCC does not disagree.
73. For each deficiency and weakness with which OCC disagrees, OCC and the
Auditor, within forty-five (45) calendar days of the Auditor’s receipt of OCC’s Response, shall
jointly confer with the staff of the Commission to resolve the matter.
74. In the event that, after conferring with the Commission staff, OCC and the
Auditor are unable to reach an agreement within ten (10) calendar days, OCC shall, within ten
(10) calendar days of failing to reach such an agreement, prepare a plan including deadlines for
remediating within a reasonable time frame the deficiency and weakness as identified by the
Auditor and provide the plan to the Auditor and the staff of the Commission.
75. At the conclusion of the one-hundred fifty (150) calendar day period after the
issuance of the Audit Report, OCC shall require the Auditor to submit to the Commission staff
and OCC’s Board a final report (the “Final Report”) that provides:
a. a description of OCC’s remediation of the deficiencies and weaknesses
identified in the Audit Report for which OCC was required to prepare a
remediation plan under Paragraphs 72 and 74; and
b. its findings with regard to the Assessment.
76. When OCC has implemented all of the Auditor’s recommendations in the Initial
Report, remediated all Deficiencies, remediated all deficiencies and weaknesses identified in the
Audit Report for which OCC was required to prepare a remediation plan under Paragraphs 72 and
74, and is in compliance with Exchange Act Rule 17Ad-22(b)(2) and (e)(1-10, 12-13, 15-21, and
23) and Rules 1001 and 1005 of Reg. SCI, OCC shall require its principal executive officer to
certify as such in writing based on his or her knowledge after reasonable inquiry (“the First
Certification”). OCC shall provide the First Certification to the Board and the staff of the
Commission within (7) business days of its execution.
77. OCC shall cooperate fully with the Auditor, including:
-18-
a. providing the Auditor with prompt and full access to all files, books,
records, and personnel of OCC as reasonably requested for the above-
mentioned reviews, reports, and audits; and
b. obtaining the cooperation of OCC employees, agents, representatives, or
other persons under OCC’s control.
Nothing in the foregoing shall be deemed to require OCC to waive attorney-client privilege or
any other privileges with respect to privileged documents.
78. OCC shall require the Auditor to directly report to Commission staff on the
Auditor’s activities and promptly respond to any reasonable requests by the Commission staff,
including promptly responding to Commission staff questions and requests for relevant
documents.
79. To help ensure the independence of the Auditor, OCC shall not have the authority
to terminate the Auditor before the Auditor provides the Commission Staff and OCC’s Board
with the Final Report unless OCC obtains the prior written approval of Commission staff and
shall compensate the Auditor and persons engaged to assist the Auditor for services rendered
pursuant to this Order at their reasonable and customary rates.
80. OCC shall expend sufficient funds to permit the Auditor to discharge all of their
duties. OCC shall permit the Auditor to engage such assistance, including clerical, legal or expert
assistance, as reasonably necessary and at a reasonable cost, to carry out their activities, and the
cost, if any, of such assistance shall be borne exclusively by OCC.
81. OCC shall bear the full expense of carrying out these Undertakings, including the
costs of retaining the Auditor.
82. OCC shall require the Auditor to enter into agreements that provide that for the
period of engagement and for a period of two (2) years from completion of the Final Report, the
Auditor shall not, without the prior written consent of the Commission staff, enter into any
employment, consultant, attorney-client, auditing or other professional relationship with OCC, or
any of its present or former affiliates, directors, officers, employees, or agents acting in their
capacity as such (excluding exchanges and clearing members to the extent those entities could be
deemed affiliates or agents of OCC). The agreements will also provide that the Auditor will
require that any firm with which they are affiliated or of which they are a member, and any
person engaged to assist the Auditor in performance of their duties under this Order shall not,
without prior written consent of Commission staff, enter into any employment, consultant,
attorney-client, auditing or other professional relationship with OCC, or any of its present or
former affiliates, directors, officers, employees, or agents acting in their capacity as such for the
period of the engagement and for a period of two (2) years after the engagement (excluding
exchanges and clearing members to the extent those entities could be deemed affiliates or agents
of OCC). The agreements will also provide that the Auditor shall maintain the confidentiality of
any confidential information received in the course of their engagement.
-19-
83. Beginning one (1) year after the date of this Order, and continuing each year
thereafter for two (2) years (for a total of three (3) years), OCC shall require its principal
executive officer to certify, in writing that, based on his or her knowledge after reasonable
inquiry, the Respondent has taken reasonable steps to achieve compliance with Section 19(b) of
the Exchange Act. Each certification shall provide written evidence of compliance with this
Undertaking in the form of a narrative, and be supported by exhibits sufficient to demonstrate the
basis for the certification. Each certification, including any supporting documentation, shall be
provided promptly to the Board and Commission staff. Commission staff may make reasonable
requests for further evidence of compliance, and OCC agrees to provide evidence in response to
such requests.
84. Within one year of the date of this Order and continuing each year thereafter for
two (2) years (for a total of three (3) years), OCC shall provide annual compliance training to all
OCC officers and all non-clerical and non-administrative employees on the federal securities laws
and Commission rules and regulations applicable to OCC.
85. Within one year of the date of this Order and continuing each year thereafter for
two (2) years (for a total of three (3) years), OCC shall provide an annual regulatory compliance
report to the Board and to either the ROWG or the Board-level Regulatory Committee. OCC
shall also provide a copy of such report to the staff of the Commission within seven (7) business
days of providing it to the Board.
86. No later than six (6) months after the date of the Initial Report, OCC shall file a
proposed rule change for Commission review pursuant to Section 19(b) of the Exchange Act and
the rules and regulations thereunder reasonably designed to establish a Board-level Regulatory
Committee that:
a. operates separately from the current Audit Committee;
b. complements the work done by independent consultants on regulatory
compliance matters;
c. takes over and continues the work done by the current ROWG, including
but not limited to OCC’s efforts to demonstrate compliance with
applicable laws and regulations; and
d. is solely comprised of OCC’s Public Directors, as that term is defined in the
Board of Directors Charter and Corporate Governance Principles.
In the event that the proposed rule change is approved by the Commission, OCC shall not file
another proposed rule change that would eliminate or otherwise diminish the duties and
obligations of the Board-level Regulatory Committee for at least three (3) years from the date of
any such Commission approval.
87. Beginning with the date of this Order and continuing through the later of the date
of the First Certification or December 31, 2022, OCC shall provide to the Board and either the
-20-
ROWG or the Board-level Regulatory Committee:
a. copies of any deficiency letter received from the staff of the Commission’s
Office of Compliance, Inspections and Examinations (“Deficiency
Letter”) and a briefing on the Deficiency Letter within ten (10) business
days of receipt of a Deficiency Letter;
b. copies of any OCC response to a Deficiency Letter (“Response”) and a
briefing on the Response within ten (10) business days of sending a
Response; and
c. a briefing on OCC’s action plans, if any, in response to any deficiencies
identified in a Deficiency Letter within thirty (30) calendar days of
sending a Response.
For purposes of this paragraph, the required briefings can be provided in person, telephonically or
in writing, at the discretion of the Board-level Regulatory Committee, Board or ROWG.
88. OCC shall require its Chief Compliance Officer, or one of his or her deputies if
the Chief Compliance Officer is unable to attend, to attend all meetings of the ROWG and Board-
level Regulatory Committee.
89. Within fourteen (14) calendar days of the date of this Order and on the last
business day of each calendar quarter until the First Certification, OCC shall provide to the staff
of the Commission notices (“New Product Notices”) which identify all securities financial
products: (a) that are not option contracts based on the same underlying asset (excluding cases in
which the underlying asset changed due to a corporate action) and of the same type and style as
securities financial products for which OCC offers clearance and settlement services as of the
date of the New Product Notice; and (b) for which OCC has reason to believe will be listed for
trading on a participant exchange and for which, if so listed, OCC intends to offer clearance and
settlement services within the six (6) month period following the date of the New Product Notice.
90. OCC shall provide additional information related to the products listed in a New
Product Notice as the staff of the Commission may reasonably request.
91. OCC has established a prioritized, three-tiered list of planned filings under Section
19(b) of the Exchange Act and Section 806(e) of the Dodd-Frank Act, which is titled OCC
Prioritization of Advance Notice and Proposed Rule Change Filings dated August 14, 2019
(“Filing Priority Chart”). For sixteen (16) months from the date of this Order, OCC shall use its
best efforts to submit to the Commission filings included in Tiers 1 through 3 of the Filing
Priority Chart prior to any other filings. Further, OCC will prioritize the filings included in Tiers
1 through 3 of the Filing Priority Chart in the order set forth in the Filing Priority Chart, which
order shall be established and updated as appropriate in consultation with the staff of the Division
of Trading and Markets (“Division staff”). Nothing in this paragraph or Paragraph 92 alters
OCC’s legal obligations, including OCC’s ongoing obligation to respond to examination findings
of the staff of the Commission.
-21-
92. OCC may modify the Filing Priority Chart, including moving the order of filings,
moving filings among tiers, and adding or removing filings, with the agreement of Division Staff.
Such agreement shall not be unreasonably withheld. Notwithstanding the foregoing, if OCC
reasonably and in good faith determines that it is necessary to revise the Filing Priority Chart to
resolve the Deficiencies, comply with applicable law, or protect the public interest, then OCC
may make such a revision; provided however, that OCC shall use its best efforts to provide the
Division Staff with notice at least fourteen (14) days in advance of making such a revision and
consult with Division Staff regarding the appropriateness and timing of any such revision.
93. Within sixty (60) calendar days of completing all of the undertakings set forth in
Section III(F) of this Order, OCC shall certify in writing compliance with such undertakings
(“Second Certification”). The Second Certification shall identify the undertakings, provide
written evidence of compliance in the form of a narrative, and be supported by exhibits
reasonably sufficient to demonstrate compliance. Within one (1) business day of the execution of
the Second Certification, OCC shall provide it to Charles J. Kerstetter, Assistant Regional
Director, Chicago Regional Office with a copy to the Office of the Chief Counsel of the
Enforcement Division. The Commission staff may make reasonable requests for further evidence
of compliance, and OCC agrees to provide such evidence.
94. To the extent that OCC must file a proposed rule change with the Commission to
comply with any undertaking in this Order, such proposed rule change will be subject to all
relevant legal and regulatory requirements and processes, including, but not limited to Exchange
Act Section 19(b).
95. OCC agrees that the ROWG shall continue to exist until, at a minimum, the earlier
of either the establishment of the Board-level Regulatory Committee or five (5) years from the
date of this Order, and that the ROWG shall:
a. be comprised of only Public Directors as that term is defined in the Board
of Directors Charter and Corporate Governance Principles; and
b. not delegate its authority for the recommendations, approvals and actions
required in Section III(F) of this Order to any other entity or person.
IV.
In view of the foregoing, the Commission deems it appropriate, in the public interest, and
for the protection of investors to impose the sanctions agreed to in OCC’s Offer.
Accordingly, pursuant to Sections 19(h) and 21C of the Exchange Act, it is hereby
ORDERED that:
A. OCC cease and desist from committing or causing any violations and any future
violations of Section 17A(d)(1) of the Exchange Act and Rules 17Ad-22(b)(2), 17Ad-22(d)(1),
17Ad-22(e)(1), 17Ad-22(e)(3)(i), 17Ad-22(e)(4)(iii) and (vi), 17Ad-22(e)(6)(i), and 17Ad-
-22-
22(e)(7)(i) and (vi) thereunder; Rules 1001(a)(1) and (2) of Reg. SCI; and Section 19(b) of the
Exchange Act and Rule 19b-4 thereunder.
B. OCC is censured.
C. OCC shall, by December 31, 2019, pay a civil money penalty in the amount of $15
million to the Securities and Exchange Commission for transfer to the general fund of the United
States Treasury, subject to Exchange Act Section 21F(g)(3). If timely payment is not made as
specified above, additional interest shall accrue pursuant to 31 U.S.C. 3717.
D. Payment(s) referenced in Paragraph C of this section must be made in one of the
following ways:
1. OCC may transmit payment electronically to the Commission, which will
provide detailed ACH transfer/Fedwire instructions upon request;
2. OCC may make direct payment from a bank account via Pay.gov through
the SEC website at http://www.sec.gov/about/offices/ofm.htm; or
3. OCC may pay by certified check, bank cashier’s check, or United States
postal money order, made payable to the Securities and Exchange
Commission and hand-delivered or mailed to:
Enterprise Services Center
Accounts Receivable Branch
HQ Bldg., Room 181, AMZ-341
6500 South MacArthur Boulevard
Oklahoma City, OK 73169
Payments by check or money order must be accompanied by a cover letter identifying OCC as a
respondent in these proceedings, and the file number of these proceedings; a copy of the cover
letter and check or money order must be sent to Kathryn A. Pyszka, Associate Regional Director,
Chicago Regional Office, Securities and Exchange Commission, 175 W. Jackson Boulevard, Suite
1450, Chicago, IL 60604.
E. OCC shall comply with the undertakings enumerated in Section III(F) above.
By the Commission.
Vanessa A. Countryman
Secretary OCR text (62,072c · tika · 95% conf)
-1-
UNITED STATES OF AMERICA
Before the
SECURITIES AND EXCHANGE COMMISSION
SECURITIES EXCHANGE ACT OF 1934
Release No. 86871 / September 4, 2019
ADMINISTRATIVE PROCEEDING
File No. 3-19416
In the Matter of
THE OPTIONS
CLEARING CORPORATION,
Respondent.
ORDER INSTITUTING ADMINISTRATIVE
AND CEASE-AND-DESIST PROCEEDINGS
PURSUANT TO SECTIONS 19(h) AND 21C
OF THE SECURITIES EXCHANGE ACT OF
1934, MAKING FINDINGS, AND
IMPOSING REMEDIAL SANCTIONS AND
A CEASE-AND-DESIST ORDER
I.
The Securities and Exchange Commission (“Commission”) deems it appropriate and in the
public interest that public administrative and cease-and-desist proceedings be, and hereby are,
instituted pursuant to Sections 19(h) and 21C of the Securities Exchange Act of 1934 (“Exchange
Act”) against The Options Clearing Corporation (“OCC” or “Respondent”).
II.
In anticipation of the institution of these proceedings, Respondent has submitted an Offer
of Settlement (the “Offer”) which the Commission has determined to accept. Solely for the
purpose of these proceedings and any other proceedings brought by or on behalf of the
Commission, or to which the Commission is a party, and without admitting or denying the findings
herein, except as to the Commission’s jurisdiction over it and the subject matter of these
proceedings, which are admitted, Respondent consents to the entry of this Order Instituting
Administrative and Cease-and-Desist Proceedings Pursuant to Sections 19(h) and 21C of the
Securities Exchange Act of 1934, Making Findings, and Imposing Remedial Sanctions and a
Cease-and-Desist Order (“Order”), as set forth below.
-2-
III.
On the basis of this Order and Respondent’s Offer, the Commission finds1 that:
A. Summary
1. This matter concerns the failure by OCC to comply with certain provisions of the
statutes and rules applicable to registered clearing agencies. Registered clearing agencies, such as
OCC, are an essential part of the infrastructure of the U.S. securities markets and as such, they are
required to be structured to manage and reduce risk. In instances where registered clearing
agencies are not structured and operated appropriately, they can pose substantial risk to the
financial system as a whole.
2. OCC serves as the sole registered clearing agency for exchange listed option
contracts in the United States and has been designated as a systemically important financial market
utility (“SIFMU”) under Title VIII of the Dodd-Frank Wall Street Reform and Consumer
Protection Act of 2010 (“Dodd-Frank Act”). Disruption to OCC’s operations, or failure by OCC to
manage risk, could result in significant costs not only to OCC itself and its members, but also to
other market participants or the broader U.S. financial system.
3. As a registered clearing agency, OCC is a self-regulatory organization under the
Exchange Act. Self-regulatory organizations are charged with an important public trust to carry
out their self-regulatory responsibilities effectively and fairly, while fostering free and open
markets, protecting investors, and promoting the public trust.
4. The U.S. Congress and the Commission have established a legal framework to
facilitate the prompt and accurate clearance and settlement of securities transactions, having due
regard for, among other things, the public interest, the protection of investors, and the safeguarding
of securities and funds. Four groups of statutes, rules, and regulations are at issue in this matter.
5. In October 2012, the Commission adopted Rules 17Ad-22(b) and (d) under the
Exchange Act to “strengthen the substantive regulation of registered clearing agencies, promote the
safe and reliable operation of registered clearing agencies, and improve efficiency, transparency
and access to registered clearing agencies.”2 Rules 17Ad-22(b) and (d) were first proposed in
March 2011. OCC was not required to comply until January 2, 2013.
6. In November 2014, the Commission adopted Regulation Systems, Compliance, and
Integrity under the Exchange Act (“Reg. SCI”) to “strengthen the technology infrastructure of U.S.
securities markets” and “reduce the occurrence of systems issues, improve resiliency when
1 The findings herein are made pursuant to OCC’s Offer of Settlement and are not binding
on any other person or entity in this or any other proceeding.
2 Standards for Covered Clearing Agencies, 81 Fed. Reg. 70786, 70788 (October 13, 2016)
(footnote omitted).
-3-
systems problems do occur, and enhance the Commission’s oversight and enforcement of
securities market technology infrastructure.”3 Reg. SCI, which applies to registered clearing
agencies, was first proposed in June 2012. OCC was not required to comply until November 3,
2015.
7. In October 2016, the Commission adopted Rule 17Ad-22(e) under the Exchange
Act, which established enhanced standards for registered clearing agencies that meet the definition
of a “covered clearing agency.” OCC is a covered clearing agency for purposes of Rule 17Ad-
22(e). The Commission adopted Rule 17Ad-22(e) to “impos[e] consistent, higher minimum risk
management standards across all covered clearing agencies” and “further mitigate the potential for
moral hazard associated with risk management at a covered clearing agency.”4 Rule 17Ad-22(e)
was first proposed in March 2014. OCC was not required to comply until April 11, 2017.
8. And finally, the rule filing and Commission approval requirements embodied in
Section 19(b) of the Exchange Act and Rule 19b-4(c) thereunder, which apply to all self-
regulatory organizations including registered clearing agencies, serve an important function in
keeping the public and a clearing agency’s members informed and involved in the operations of
the clearing agency and ensuring that the clearing agency’s rules are consistent with the
Exchange Act and the rules and regulations thereunder.
9. In connection with examinations of OCC before it was required to comply with the
Rule 17Ad-22(e) and Reg. SCI, the Commission staff notified OCC of material weaknesses with
its policies and procedures that, if not corrected before the required compliance dates, could result
in violations of Rule 17Ad-22(e) and Reg. SCI.
10. Nonetheless, despite the Commission staff’s advance warnings and ample time to
comply, OCC failed to come into compliance with Rules 17Ad-22(b), (d) and (e) and Reg. SCI by
the required compliance dates. Specifically, OCC failed to establish, implement, maintain and
enforce policies and procedures reasonably designed to:
a. review its risk-based margin models and the parameters for those models on
a monthly basis;
b. consider and produce margin levels commensurate with the risks and
particular attributes of each relevant product cleared by OCC;
c. effectively measure, monitor, and manage its credit exposure and liquidity
risk;
d. maintain a comprehensive risk management framework;
3 81 Fed. Reg. 70786, 70789.
4 81 Fed. Reg. 70786, 70850.
-4-
e. protect the security of certain of its information systems; and
f. provide for a well-founded, clear, transparent and enforceable legal
framework for every aspect of its activities.
OCC also failed to comply with Section 19(b) of the Exchange Act and Rule 19b-4(c) thereunder
by adopting and changing certain policies prior to obtaining Commission approval.
11. As a result of its conduct, OCC violated Section 17A(d)(1) of the Exchange Act5
and Rules 17Ad-22(b)(2), 17Ad-22(d)(1), 17Ad-22(e)(1), 17Ad-22(e)(3)(i), 17Ad-22(e)(4)(iii) and
(vi), 17Ad-22(e)(6)(i), and 17Ad-22(e)(7)(i) and (vi) thereunder; Rules 1001(a)(1) and (2) of Reg.
SCI under the Exchange Act; and Section 19(b) of the Exchange Act and Rule 19b-4 thereunder.
B. Respondent
12. OCC is a Delaware corporation with its principal place of business in Chicago,
Illinois. OCC is the sole central counterparty for exchange listed option contracts in the United
States. The Commission granted full registration as a clearing agency to OCC pursuant to the
Exchange Act on September 23, 1983.6 As a registered clearing agency, OCC is a self-regulatory
organization under the Exchange Act.
13. On July 18, 2012, the Financial Stability Oversight Council approved the
designation of OCC as a SIFMU pursuant to Section 804 of the Dodd-Frank Act. A financial
market utility is deemed to be systemically important if “the failure of or a disruption to the
functioning of such [financial market utility] could create or increase the risk of significant
liquidity or credit problems spreading among financial institutions or markets and thereby threaten
the stability” of the U.S. financial system.7 For purposes of the Dodd-Frank Act, the Commission
is OCC’s supervisory agency. As such, the Commission is required by Section 807(a) of the
Dodd-Frank Act to examine OCC at least once annually. In addition, because it is a SIFMU, OCC
is a “covered clearing agency” subject to the Commission’s enhanced clearing agency standards set
forth in Exchange Act Rule 17Ad-22(e).
5 Section 17A(d)(1) of the Exchange Act prohibits registered clearing agencies from
engaging in any activity as a clearing agency in contravention of such rules and regulations
as the Commission may prescribe as necessary or appropriate in the public interest, for the
protection of investors, or otherwise in furtherance of the purposes of the Exchange Act.
6 Unless exempted, a clearing agency must register with the Commission pursuant to
Exchange Act Section 17A. 15 U.S.C. 78q-1(b)(1). Such registration requires
Commission determinations regarding the clearing agency and its rules. 15 U.S.C. 78q-
1(b)(3).
7 12 U.S.C. 5462(9).
-5-
C. Facts
OCC Failed to Establish, Implement, Maintain, and Enforce Policies and
Procedures Reasonably Designed to Review Its Risk-Based Margin Models and the
Parameters for Those Models on a Monthly Basis
14. Exchange Act Rule 17Ad-22(b)(2) requires that a registered clearing agency
performing central counterparty services establish, implement, maintain, and enforce written
policies and procedures reasonably designed to “[u]se risk-based models and parameters to set
margin requirements and review such margin requirements and the related risk-based models and
parameters at least monthly.”
15. When proposing this rule, the Commission explained that “[m]arket conditions and
risks are constantly changing and therefore the models and parameters used by a clearing agency
providing [central counterparty] services to set margin may not accurately reflect the needs of a
clearing agency if they are permitted to remain static.” The Commission further noted that the one
month review period for risk-based margin models and parameters “would limit the potential that
such parameters or models will become stale.”8
16. OCC was required to comply with Exchange Act Rule 17Ad-22(b)(2) by January 2,
2013. However, through at least April 2017, OCC failed to establish, implement, maintain, and
enforce policies and procedures reasonably designed to review its risk-based margin models and all
of the parameters for those models at least monthly.
OCC Failed to Establish, Implement, Maintain, and Enforce Policies and Procedures
Reasonably Designed to Consider and Produce Margin Levels Commensurate with the Risks
and Particular Attributes of Each Relevant Product Cleared by OCC
17. Exchange Act Rule 17Ad-22(e)(6)(i) requires that a covered clearing agency
performing central counterparty services establish, implement, maintain, and enforce policies and
procedures that are reasonably designed to cover its credit exposures to its participants by
establishing a risk-based margin system that, among other things, “[c]onsiders, and produces
margin levels commensurate with, the risks and particular attributes of each relevant product,
portfolio and market.”
18. Collection of margin is a critical component of a clearing agency’s risk
management in ensuring that it has sufficient financial resources in the case of a clearing member
default.
19. OCC was required to comply with Exchange Act Rule 17Ad-22(e)(6)(i) by April
11, 2017. However, to date, OCC has not established, implemented, maintained, or enforced
policies and procedures reasonably designed to consider and produce margin levels commensurate
8 Clearing Agency Standards for Operation and Governance, 76 Fed. Reg. 14471, 14478
(proposed March 16, 2011).
-6-
with the risks and particular attributes of each relevant product cleared by OCC. Specifically,
OCC’s margin model fails to consider the impact of market liquidation costs, including bid-ask
spreads and other transaction-based costs, as well as the potential market impact of liquidation
activity. OCC’s margin model also fails to consider specific wrong way risk9 associated with
cleared securities which are related to clearing members.
OCC Failed to Establish, Implement, Maintain, and Enforce Policies and
Procedures Reasonably Designed to Cover Its Credit Exposure
20. Exchange Act Rule 17Ad-22(e)(4)(iii) requires that a covered clearing agency not
subject to Exchange Act Rule 17Ad-22(e)(4)(ii) establish, implement, maintain, and enforce
written policies and procedures reasonably designed to maintain “additional financial resources at
the minimum to enable it to cover a wide range of foreseeable stress scenarios.”
21. Exchange Act Rules 17Ad-22(e)(4)(vi)(A)-(D) further require that a covered
clearing agency establish, implement, maintain, and enforce written policies and procedures
reasonably designed to test the sufficiency of its total financial resources available to meet the
minimum requirements in Exchange Act Rule 17Ad-22(e)(4)(i) through (iii) by:
a. stress testing its total financial resources once each day using standard
predetermined parameters and assumptions;
b. comprehensively analyzing its stress testing scenarios, models, and
underlying parameters and assumptions on at least a monthly basis;
c. comprehensively analyzing its stress testing scenarios, models, parameters,
and assumptions more frequently than monthly during periods of stress
and/or volatility; and
d. reporting the results of its stress testing analyses to appropriate decision
makers.
22. The Commission adopted these rules to ensure that covered clearing agencies could
“rapidly identify any gaps in resources required to ensure [financial] stability.”10
23. OCC was required to comply with Exchange Act Rules 17Ad-22(e)(4)(iii) and
17Ad-22(e)(4)(vi)(A)-(D) by April 11, 2017. Nonetheless, through at least September 4, 2018,
OCC failed to establish, implement, maintain, and enforce policies and procedures mandating that
OCC consider a wide range of foreseeable stress scenarios when determining the sufficiency of its
9 “Specific wrong-way risk arises at a [central counterparty] when an exposure to a
participant is highly likely to increase when the creditworthiness of that participant is
deteriorating.” 81 Fed. Reg. 70786, 70789n.317.
10 81 Fed. Reg. at 70869.
-7-
financial resources. Instead, OCC implemented policies and procedures that determine the
monthly sizing of its clearing fund based on a daily calculation of its stress testing exposures
utilizing only a limited number of scenarios.
24. In addition, through at least September 4, 2018, OCC failed to establish, implement,
maintain, and enforce policies and procedures reasonably designed to stress test its total financial
resources using a wide range of foreseeable stress scenarios once each day; analyze its stress
testing scenarios, models, parameters, and assumptions at least monthly; analyze its stress testing
scenarios, models, parameters, and assumptions more frequently than monthly during periods of
stress and/or volatility; and report the results of its stress testing analyses to appropriate decision
makers.
OCC Failed to Establish, Implement, Maintain, and Enforce Policies and Procedures
Reasonably Designed to Maintain Sufficient Liquid Resources
25. Exchange Act Rule 17Ad-22(e)(7)(i) requires that a covered clearing agency
establish, implement, maintain, and enforce written policies and procedures reasonably designed to
maintain “sufficient liquid resources at the minimum in all relevant currencies to effect same-day
and, where appropriate, intraday and multiday settlement of payment obligations with a high
degree of confidence under a wide range of foreseeable stress scenarios.”
26. Exchange Act Rules 17Ad-22(e)(7)(vi)(A)-(D) further require that a covered
clearing agency establish, implement, maintain, and enforce written policies and procedures
reasonably designed to determine the amount and regularly test the sufficiency of the liquid
resources held for purposes of meeting the minimum liquid resource requirement under Exchange
Act Rule 17Ad-22(e)(7)(i) by, at a minimum:
a. stress testing its liquidity resources once each day using standard
predetermined parameters and assumptions;
b. comprehensively analyzing its stress testing scenarios, models, and
underlying parameters and assumptions on at least a monthly basis;
c. comprehensively analyzing its stress testing scenarios, models, parameters,
and assumptions more frequently than monthly during periods of stress
and/or volatility; and
d. reporting the results of its stress testing analyses to appropriate decision
makers.
27. When adopting these rules, the Commission explained that “[m]arket participants
in centrally cleared and settled markets are often linked to one another through intermediation
chains in which one party may rely on proceeds from sales of cleared products to meet payment
obligations to another party. . . Therefore, the benefits related to liquidity risk management
-8-
generally flow from the reduced risk of systemic risk transmission by covered clearing agencies as
a result of liquidity shortfalls.”11
28. OCC was required to comply with Exchange Act Rules 17Ad-22(e)(7)(i) and
17Ad-22(e)(7)(vi)(A)-(D) by April 11, 2017. However, to date, OCC has failed to establish,
implement, maintain, and enforce policies and procedures reasonably designed to consider a wide
range of foreseeable stress scenarios when determining the sufficiency of its liquid resources.
Instead, OCC has implemented policies and procedures which determine the size of its liquid
resources using scaled normal market conditions.
29. In addition, OCC has failed to establish, implement, maintain, and enforce policies
and procedures reasonably designed to stress test its total liquid resources using a wide range of
foreseeable stress scenarios once each day; analyze its stress testing scenarios, models, parameters,
and assumptions at least monthly; analyze its stress testing scenarios, models, parameters, and
assumptions more frequently than monthly during periods of stress and/or volatility; and report the
results of its stress testing analyses to appropriate decision makers.
30. Moreover, OCC has failed to establish, implement, maintain, and enforce policies
and procedures reasonably designed to include all known sources of possible liquidity obligations
in determining the liquidity required in the event of a clearing member default, such as certain
possible liquidity, payment, and delivery obligations relating to default auctions.
OCC Failed to Establish, Implement, Maintain, and Enforce Policies and Procedures
Reasonably Designed to Maintain a Comprehensive Risk Management Framework
31. Exchange Act Rule 17Ad-22(e)(3) requires that a covered clearing agency
establish, implement, maintain, and enforce written policies and procedures reasonably designed to
“maintain a sound risk management framework for comprehensively managing legal, credit,
liquidity, operational, general business, investment, custody, and other risks that arise in or are
borne by the covered clearing agency.”
32. Exchange Act Rule 17Ad-22(e)(3)(i) further requires that a covered clearing
agency’s risk management framework include “risk management policies, procedures, and systems
designed to identify, measure, monitor, and manage the range of risks that arise in or are borne by
the covered clearing agency, that are subject to review on a specified periodic basis and approved
by the board of directors annually.”
33. OCC was required to comply with Exchange Act Rule 17Ad-22(e)(3)(i) by April
11, 2017. However, OCC failed to establish, implement, maintain, and enforce policies and
procedures reasonably designed to manage the credit and liquidity risk that arises in or is borne by
OCC. Specifically, as described above, OCC, among other things, lacked policies and procedures
which provided for comprehensive stress testing of its financial and liquid resources under a wide
range of foreseeable stress scenarios.
11 81 Fed. Reg. at 70870.
-9-
34. OCC also failed to establish, implement, maintain, and enforce policies and
procedures reasonably designed to manage the operational risk that arises in or is borne by OCC.
Specifically, as described below, OCC’s policies and procedures were not reasonably designed to
ensure that its SCI systems and, for purposes of security standards, indirect SCI systems had
adequate levels of capacity, integrity, resiliency, availability, and security.
35. In addition, OCC failed to establish, implement, maintain, and enforce policies and
procedures reasonably designed to manage the legal risk that arises in or is borne by OCC.
Specifically, as described below, OCC’s policies and procedures were not reasonably designed to
provide for a well-founded, clear, transparent, and enforceable legal basis for each aspect of its
activities in all relevant jurisdictions because OCC failed to file proposed rules before adopting
certain policies and implemented certain policies prior to approval of the Commission.
OCC Failed to Obtain Commission Approval for
Proposed Rule Changes
36. Section 19(b)(1) of the Exchange Act requires that self-regulatory organizations,
such as registered clearing agencies, file with the Commission proposed rule changes
accompanied by a concise general statement of the basis and purpose of such proposed rule
change. Section 19(b)(1) further requires the Commission to publish notice of the proposed rule
change and provide interested persons an opportunity to submit written comments. Section
19(b)(1) prohibits a proposed rule change from taking effect unless approved by the Commission
or otherwise permitted in accordance with the provisions of Section 19(b).
37. Section 19(b)(1) defines “proposed rule change” as “any proposed rule or any
proposed change in, addition to, or deletion from the rules of the self-regulatory organization.”
Exchange Act Rule 19b-4(c) provides that “a stated policy, practice, or interpretation of the self-
regulatory organization shall be deemed to be a proposed rule change unless: (1) it is reasonably
and fairly implied by an existing rule; or (2) it is concerned solely with the administration of the
self-regulatory organization and is not a stated policy, practice or interpretation with respect to
the meaning, administration, or enforcement of an existing rule of the self-regulatory
organization.” Exchange Act Rule 19b-4(a)(6) defines “stated policy, practice, or interpretation”
to include “any material aspect of the operation of the facilities of the self-regulatory
organization.”
38. In October 2012, the Commission adopted Exchange Act Rule 17Ad-22(d)(1),
which requires that a registered clearing agency establish, implement, maintain, and enforce
written policies and procedures reasonably designed to “provide for a well-founded, transparent,
and enforceable legal framework for each aspect of its activities in all relevant jurisdictions.”
39. When adopting this rule, the Commission indicated that in order to provide a
transparent legal framework, written policies and procedures must, at a minimum, be clear,
internally consistent, readily accessible by the public, and address the significant aspects of the
-10-
clearing agency’s operations and risk management.12
40. OCC failed to file with the Commission proposed rule changes before adopting
numerous policies. By December 2015, OCC had implemented at least eighteen policies that
addressed core risk management issues without filing proposed rule changes with the
Commission, including:
a. Legal Risk Policy;
b. Model Risk Management Policy;
c. Financial Resources Policy;
d. Risk Appetite Framework;
e. Enterprise Risk Management Framework;
f. Risk Universe;
g. Operational Risk Management;
h. Clearing Fund Policy;
i. Margin Policy;
j. Credit Risk Management Policy;
k. Liquidity Risk Management Policy;
l. Systems Incident Escalation Policy;
m. Default Management Policy;
n. Collateral Risk Management Policy;
o. Business Continuity Planning Policy;
p. Information Technology Risk Management Policy;
q. Vendor Risk Management Policy; and
r. Capital Requirements Policy.
41. In October 2016, the Commission adopted Exchange Act Rule 17Ad-22(e)(1),
which requires that a covered clearing agency establish, implement, maintain, and enforce written
policies and procedures reasonably designed to provide for a well-founded, clear, transparent, and
enforceable legal basis for each aspect of its activities in all relevant jurisdictions. OCC was
required to comply with this rule by April 11, 2017.
42. OCC also implemented policies before obtaining Commission approval on
various other occasions. For example, in May 2017, OCC implemented revisions to the
following policies without prior approval of the Commission:
a. Counterparty Credit Risk Management Policy;
b. Default Management Policy;
c. Margin Policy;
d. Risk Management Framework Policy;
e. Collateral Risk Management Policy; and
f. Revised charter for OCC’s Board of Directors as well as charters for the
Board’s Audit Committee, Risk Committee, Compensation and Payment
12 Standards for Clearing Agencies, 77 Fed. Reg. 66220, 66246 (Nov. 2, 2012).
-11-
Committee, Governance and Nominating Committee, Risk Committee, and
Technology Committee.13
OCC Failed to Establish, Maintain and Enforce Policies and Procedures Reasonably Designed
to Protect the Security of Certain OCC Information Systems
43. Rule 1001(a)(1) of Reg. SCI requires that an SCI entity such as a registered clearing
agency “establish, maintain, and enforce written policies and procedures reasonably designed to
ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have
levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI
entity’s operational capability and promote the maintenance of fair and orderly markets.”
44. Rule 1001(a)(2)(iv) of Reg. SCI requires that policies and procedures established
to comply with Rule 1001(a)(1) include, at a minimum, “[r]egular reviews and testing, as
applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to
internal and external threats, physical hazards, and natural or manmade disasters.”
45. Rule 1000 of Reg. SCI defines “SCI systems” as “all computer, network, electronic,
technical, automated or similar systems operated by or on behalf of [the entity] that, with respect to
securities, directly support trading, clearance and settlement, order routing, market data, market
regulation, or market surveillance.” Rule 1000 defines “indirect SCI systems” as “any systems of,
or operated by or on behalf of, [the entity] that if breached, would be reasonably likely to pose a
security threat to SCI systems.”
46. OCC failed to establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect
SCI systems had adequate levels of capacity, integrity, resiliency, availability, and security by
November 3, 2015, when OCC was required to comply with Reg. SCI. Certain of its policies and
procedures remain deficient through the present.
47. As of November 3, 2015 and continuing through various time periods thereafter,
OCC failed to establish, maintain, and enforce written policies and procedures that were
reasonably designed to:
a. consistently identify, prioritize, test, and implement vendor-issued patches;
b. secure certain data within cloud environments;
c. ensure that all network devices, including unused and test network devices,
were inventoried; and
d. ensure security threats would be promptly detected.
13 The Commission subsequently approved proposed rules relating to these policies and
charters.
-12-
D. Violations
48. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(b)(2), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to use risk-based models and parameters to set margin
requirements and review such margin requirements and the related risk-based models and
parameters at least monthly.
49. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(d)(1), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to provide for a well-founded, transparent, and
enforceable legal framework for each aspect of its activities in all relevant jurisdictions.
50. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(e)(1), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to provide for a well-founded, transparent, and
enforceable legal framework for each aspect of its activities in all relevant jurisdictions.
51. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(e)(3)(i), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to:
a. maintain a sound risk management framework for comprehensively
managing, among other things, legal, credit, liquidity, and operational risks
that arise or are borne by OCC; and
b. include as part of that framework risk management policies, procedures, and
systems designed to identify, measure, monitor, and manage the range of
risks that arise in or are borne by OCC, that are subject to review on a
specified periodic basis and approved by the board of directors annually.
52. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(e)(4)(iii), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to maintain additional financial resources at the
minimum to enable it to cover a wide range of foreseeable stress scenarios.
53. As a result of the conduct described above, OCC violated Exchange Act Rules
17Ad-22(e)(4)(vi)(A)-(D), which require that OCC establish, implement, maintain, and enforce
policies and procedures reasonably designed to test the sufficiency of its total financial resources to
meet the minimum requirements under Exchange Act Rules 17Ad-22(e)(4)(i) and (iii) by:
a. stress testing its total financial resources once each day using standard
predetermined parameters and assumptions;
b. comprehensively analyzing its stress testing scenarios, models, and
-13-
underlying parameters and assumptions on at least a monthly basis;
c. comprehensively analyzing its stress testing scenarios, models, parameters,
and assumptions more frequently than monthly during periods of stress
and/or volatility; and
d. reporting the results of its stress testing analyses to appropriate decision
makers.
54. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(e)(6)(i), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to cover its credit exposures to its participants by
establishing a risk-based margin system that considers, and produces margin levels commensurate
with, the risks and particular attributes of each relevant product, portfolio, and market.
55. As a result of the conduct described above, OCC violated Exchange Act Rule
17Ad-22(e)(7)(i), which requires that OCC establish, implement, maintain, and enforce written
policies and procedures reasonably designed to maintain sufficient liquid resources at the
minimum in all relevant currencies to effect same-day, and where appropriate, intraday and
multiday settlement of payment obligations with a high degree of confidence under a wide range of
foreseeable stress scenarios.
56. As a result of the conduct described above, OCC violated Exchange Act Rules
17Ad-22(e)(7)(vi)(A)-(D), which require that OCC establish, implement, maintain, and enforce
written policies and procedures reasonably designed to determine the amount and regularly test the
sufficiency of the liquid resources held for purposes of meeting the minimum liquid resource
requirements in Exchange Act Rule 17Ad-22(e)(7)(i) by:
a. stress testing its liquidity resources once each day using standard
predetermined parameters and assumptions;
b. comprehensively analyzing its stress testing scenarios, models, and
underlying parameters and assumptions on at least a monthly basis;
c. comprehensively analyzing its stress testing scenarios, models, parameters,
and assumptions more frequently than monthly during periods of stress
and/or volatility; and
d. reporting the results of its stress testing analyses to appropriate decision
makers.
57. As a result of the conduct described above, OCC violated Section 17A(d)(1) of the
Exchange Act, which prohibits OCC from engaging in any activity in contravention of such rules
and regulations as the Commission may prescribe as necessary or appropriate, in the public
interest, for the protection of investors, or otherwise in furtherance of the purposes of the Exchange
Act.
-14-
58. As a result of the conduct described above, OCC violated Rule 1001(a)(1) of Reg.
SCI, which requires that OCC establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems and, for purposes of security standards,
indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security,
adequate to maintain the its operational capability and promote the maintenance of fair and
orderly markets.
59. As a result of the conduct described above, OCC violated Rule 1001(a)(2)(iv) of
Reg. SCI, which requires that OCC’s policies and procedures under Rule 1001(a)(1) of Reg. SCI
include regular reviews and testing, as applicable, of such systems, including backup systems, to
identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or
manmade disasters.
60. As a result of the conduct described above, OCC violated Section 19(b)(1) of the
Exchange Act and Rule 19b-4(c) thereunder, which require a self-regulatory organization to file
with the Commission stated policies, practices and interpretations that meet the definition of a
proposed rule change, and prohibit a proposed rule change from taking effect unless approved by
the Commission or otherwise permitted in accordance with Section 19(b)(1) of the Exchange Act.
E. Cooperation and Remediation
61. In determining to accept the Offer, the Commission has considered OCC’s
cooperation and remedial efforts, which include the following:
a. In October 2017, OCC’s Board of Directors (“the Board”) created the Ad Hoc
Regulatory Oversight Working Group (the “ROWG”) that includes all of OCC’s public directors
and meets at least monthly to assist OCC’s Board in overseeing OCC’s efforts to comply with its
ongoing regulatory obligations and to supervise OCC’s remediation and compliance efforts.
b. At the direction of its Executive Chairman and Board of Directors, OCC has
replaced many of its senior executives − including hiring a new Chief Executive Officer, Chief
Operating Officer, Head of Financial Risk Management, Chief Information Officer, Chief Security
Officer, and heads of control functions − and increased its expenditures and headcount in the areas
of risk management, compliance, legal, and information technology.
c. OCC developed remediation plans that have been provided to the staff of the
Commission. In addition, OCC filed proposed rule changes under Section 19(b) of the Exchange
Act, which were subsequently approved by the Commission, designed to:
i. enhance its Margin Policy (approved February 7, 2018);
ii. change its Daily Univariate methodology (approved May 24, 2018);
iii. incorporate stress testing into its clearing fund methodology (approved July
27, 2018);
-15-
iv. enhance its implied volatility model (approved December 20, 2018);
v. change its margin methodology for Volatility Indexes and Volatility Index
Futures (approved May 6, 2019); and
vi. incorporate liquidation costs in its margin methodology (approved June 17,
2019).
F. Undertakings
62. Within one (1) month of the date of this Order, OCC shall engage an independent
compliance auditor (“Auditor”), not unacceptable to the Commission staff. The Auditor shall be
recommended by the ROWG and shall be approved by the Board. OCC shall provide a copy of
the engagement letter detailing the scope of the Auditor’s responsibilities to the staff of the
Commission within three (3) business days of its execution.
63. As part of the engagement, OCC shall require the Auditor to:
a. assess OCC’s remediation of deficiencies identified in OCC’s July 23,
2018 Remediation Plan and deficiencies identified in the August 12, 2019
addendum to that plan (collectively “Deficiencies”);
b. audit OCC’s compliance with Exchange Act Rule 17Ad-22(b)(2) and
(e)(1-10, 12-13, 15-21, and 23) and Reg. SCI Rules 1001 and 1005; and
c. assess the hiring, qualifications, and training of OCC personnel
responsible for compliance with Exchange Act Rule 17Ad-22(b)(2) and
(e)(1-10, 12-13, 15-21, and 23) and Reg. SCI Rules 1001 and 1005,
including OCC’s compliance, internal audit, technology, and project
management personnel.
64. OCC shall require the Auditor to conduct two reviews, one audit, one
assessment, and prepare four reports, as described below.
65. OCC shall require the Auditor to commence an initial review of OCC’s
remediation of Deficiencies (the “Initial Review”) no later than sixty (60) calendar days from the
date of the engagement of the Auditor (unless otherwise agreed by OCC, the Auditor, and the
Commission staff). OCC shall require the Auditor to issue a written report (the “Initial Report”)
within one hundred eighty (180) calendar days of commencing the Initial Review setting forth
the Auditor’s findings and if necessary, making recommendations reasonably designed to
improve OCC’s remediation of Deficiencies. OCC shall require the Auditor to provide the report
to the Board and contemporaneously transmit a copy to Commission staff.
66. OCC shall adopt and implement all recommendations made by the Auditor in the
Initial Report, subject to Paragraph 67 below.
-16-
67. If OCC reasonably and in good faith determines that any of the Auditor’s
recommendations set forth in the Initial Report are unduly burdensome or impractical, or if OCC
determines that the objectives of the recommendations can be more effectively achieved through
another means, OCC may propose to the Auditor that a recommendation not be implemented or
propose an alternative reasonably designed to accomplish the same objectives, and shall notify
the Auditor of any such proposals within fourteen (14) calendar days of receipt of the report. If,
upon evaluating OCC’s proposal(s), the Auditor determines that any of the Auditor’s
recommendations should not be implemented or that a suggested alternative is reasonably
designed to accomplish, and is likely to result in, the same objectives as the recommendation in
question within the same timeframe, then the Auditor may withdraw the recommendation and/or
accept the proposed alternative and notify in writing the staff of the Commission within two (2)
business days of any such withdrawn recommendations and/or accepted alternatives, and OCC
shall adopt and implement the accepted alternative(s). If, upon evaluating OCC’s proposals, the
Auditor concludes that the Auditor’s recommendation should be implemented, the Auditor shall
notify OCC within fourteen (14) calendar days of receipt of the alternative proposal, and OCC
and the Auditor shall, within seven (7) business days of the Auditor’s notification, jointly confer
with the staff of the Commission to resolve the matter. In the event that, after conferring with the
Commission staff, OCC and the Auditor are unable to agree on an alternative proposal, OCC
shall adopt and implement the Auditor’s recommendation.
68. At the conclusion of the one-hundred twenty (120) calendar day period after the
issuance of the Initial Report, OCC shall require the Auditor to commence an interim review of
OCC’s implementation of the Auditor’s recommendations, if any, in the Initial Report (“Interim
Review”). Within sixty (60) calendar days of commencing the Interim Review, OCC shall
require the Auditor to submit to the Commission staff and OCC’s Board an interim report (the
“Interim Report”) setting forth the Auditor’s findings.
69. At the conclusion of the three-hundred sixty-five (365) calendar day period after
the issuance of the Initial Report (unless otherwise agreed by OCC, the Auditor and the
Commission staff), OCC shall require the Auditor to commence an audit of OCC’s compliance
with Exchange Act Rule 17Ad-22(b)(2) and (e)(1-10, 12-13, 15-21, and 23) and Reg. SCI Rules
1001 and 1005 (the “Audit”). At this time, OCC shall also require the Auditor to commence an
assessment of the hiring, qualifications, and training of OCC personnel responsible for
compliance with Exchange Act Rule 17Ad-22(b)(2) and (e)(1-10, 12-13, 15-21, and 23) and Reg.
SCI Rules 1001 and 1005, including OCC’s compliance, internal audit, technology, and project
management personnel (the “Assessment”).
70. OCC shall require the Auditor in performing the Audit to develop a written plan
of sufficient scope and detail to achieve the audit objectives and to identify areas in need of
special consideration. OCC shall require the Auditor and other qualified persons retained by the
Auditor to exercise due professional care and independence. OCC shall require the Auditor to
formulate conclusions based on sufficient, competent evidential matter and consistent with
professional judgment.
71. OCC shall require the Auditor to issue a report (“the Audit Report”) regarding
-17-
OCC’s compliance with Exchange Act Rule 17Ad-22(b)(2) and (e)(1-10, 12-13, 15-21, and 23)
and Reg. SCI Rules 1001 and 1005 within one hundred-eighty (180) calendar days of
commencing the Audit. The Audit Report shall describe the purpose, scope, and nature of the
audit and identify any deficiencies or weaknesses detected during the audit. OCC shall require
the Auditor to provide the Audit Report to the Board and contemporaneously transmit a copy to
Commission staff.
72. Within forty-five (45) calendar days of receipt of the Audit Report, OCC shall
provide to the Auditor, the Board and the staff of the Commission a response (the “Response”)
that includes: (i) a statement of whether OCC reasonably and in good faith disagrees with any
identified deficiency and weakness and an explanation of the reasons for OCC’s disagreement;
(ii) a plan including deadlines for remediating within a reasonable time frame any deficiency and
weakness with which OCC does not disagree; and (iii) a description of the cause of any
deficiency and weakness with which OCC does not disagree.
73. For each deficiency and weakness with which OCC disagrees, OCC and the
Auditor, within forty-five (45) calendar days of the Auditor’s receipt of OCC’s Response, shall
jointly confer with the staff of the Commission to resolve the matter.
74. In the event that, after conferring with the Commission staff, OCC and the
Auditor are unable to reach an agreement within ten (10) calendar days, OCC shall, within ten
(10) calendar days of failing to reach such an agreement, prepare a plan including deadlines for
remediating within a reasonable time frame the deficiency and weakness as identified by the
Auditor and provide the plan to the Auditor and the staff of the Commission.
75. At the conclusion of the one-hundred fifty (150) calendar day period after the
issuance of the Audit Report, OCC shall require the Auditor to submit to the Commission staff
and OCC’s Board a final report (the “Final Report”) that provides:
a. a description of OCC’s remediation of the deficiencies and weaknesses
identified in the Audit Report for which OCC was required to prepare a
remediation plan under Paragraphs 72 and 74; and
b. its findings with regard to the Assessment.
76. When OCC has implemented all of the Auditor’s recommendations in the Initial
Report, remediated all Deficiencies, remediated all deficiencies and weaknesses identified in the
Audit Report for which OCC was required to prepare a remediation plan under Paragraphs 72 and
74, and is in compliance with Exchange Act Rule 17Ad-22(b)(2) and (e)(1-10, 12-13, 15-21, and
23) and Rules 1001 and 1005 of Reg. SCI, OCC shall require its principal executive officer to
certify as such in writing based on his or her knowledge after reasonable inquiry (“the First
Certification”). OCC shall provide the First Certification to the Board and the staff of the
Commission within (7) business days of its execution.
77. OCC shall cooperate fully with the Auditor, including:
-18-
a. providing the Auditor with prompt and full access to all files, books,
records, and personnel of OCC as reasonably requested for the above-
mentioned reviews, reports, and audits; and
b. obtaining the cooperation of OCC employees, agents, representatives, or
other persons under OCC’s control.
Nothing in the foregoing shall be deemed to require OCC to waive attorney-client privilege or
any other privileges with respect to privileged documents.
78. OCC shall require the Auditor to directly report to Commission staff on the
Auditor’s activities and promptly respond to any reasonable requests by the Commission staff,
including promptly responding to Commission staff questions and requests for relevant
documents.
79. To help ensure the independence of the Auditor, OCC shall not have the authority
to terminate the Auditor before the Auditor provides the Commission Staff and OCC’s Board
with the Final Report unless OCC obtains the prior written approval of Commission staff and
shall compensate the Auditor and persons engaged to assist the Auditor for services rendered
pursuant to this Order at their reasonable and customary rates.
80. OCC shall expend sufficient funds to permit the Auditor to discharge all of their
duties. OCC shall permit the Auditor to engage such assistance, including clerical, legal or expert
assistance, as reasonably necessary and at a reasonable cost, to carry out their activities, and the
cost, if any, of such assistance shall be borne exclusively by OCC.
81. OCC shall bear the full expense of carrying out these Undertakings, including the
costs of retaining the Auditor.
82. OCC shall require the Auditor to enter into agreements that provide that for the
period of engagement and for a period of two (2) years from completion of the Final Report, the
Auditor shall not, without the prior written consent of the Commission staff, enter into any
employment, consultant, attorney-client, auditing or other professional relationship with OCC, or
any of its present or former affiliates, directors, officers, employees, or agents acting in their
capacity as such (excluding exchanges and clearing members to the extent those entities could be
deemed affiliates or agents of OCC). The agreements will also provide that the Auditor will
require that any firm with which they are affiliated or of which they are a member, and any
person engaged to assist the Auditor in performance of their duties under this Order shall not,
without prior written consent of Commission staff, enter into any employment, consultant,
attorney-client, auditing or other professional relationship with OCC, or any of its present or
former affiliates, directors, officers, employees, or agents acting in their capacity as such for the
period of the engagement and for a period of two (2) years after the engagement (excluding
exchanges and clearing members to the extent those entities could be deemed affiliates or agents
of OCC). The agreements will also provide that the Auditor shall maintain the confidentiality of
any confidential information received in the course of their engagement.
-19-
83. Beginning one (1) year after the date of this Order, and continuing each year
thereafter for two (2) years (for a total of three (3) years), OCC shall require its principal
executive officer to certify, in writing that, based on his or her knowledge after reasonable
inquiry, the Respondent has taken reasonable steps to achieve compliance with Section 19(b) of
the Exchange Act. Each certification shall provide written evidence of compliance with this
Undertaking in the form of a narrative, and be supported by exhibits sufficient to demonstrate the
basis for the certification. Each certification, including any supporting documentation, shall be
provided promptly to the Board and Commission staff. Commission staff may make reasonable
requests for further evidence of compliance, and OCC agrees to provide evidence in response to
such requests.
84. Within one year of the date of this Order and continuing each year thereafter for
two (2) years (for a total of three (3) years), OCC shall provide annual compliance training to all
OCC officers and all non-clerical and non-administrative employees on the federal securities laws
and Commission rules and regulations applicable to OCC.
85. Within one year of the date of this Order and continuing each year thereafter for
two (2) years (for a total of three (3) years), OCC shall provide an annual regulatory compliance
report to the Board and to either the ROWG or the Board-level Regulatory Committee. OCC
shall also provide a copy of such report to the staff of the Commission within seven (7) business
days of providing it to the Board.
86. No later than six (6) months after the date of the Initial Report, OCC shall file a
proposed rule change for Commission review pursuant to Section 19(b) of the Exchange Act and
the rules and regulations thereunder reasonably designed to establish a Board-level Regulatory
Committee that:
a. operates separately from the current Audit Committee;
b. complements the work done by independent consultants on regulatory
compliance matters;
c. takes over and continues the work done by the current ROWG, including
but not limited to OCC’s efforts to demonstrate compliance with
applicable laws and regulations; and
d. is solely comprised of OCC’s Public Directors, as that term is defined in the
Board of Directors Charter and Corporate Governance Principles.
In the event that the proposed rule change is approved by the Commission, OCC shall not file
another proposed rule change that would eliminate or otherwise diminish the duties and
obligations of the Board-level Regulatory Committee for at least three (3) years from the date of
any such Commission approval.
87. Beginning with the date of this Order and continuing through the later of the date
of the First Certification or December 31, 2022, OCC shall provide to the Board and either the
-20-
ROWG or the Board-level Regulatory Committee:
a. copies of any deficiency letter received from the staff of the Commission’s
Office of Compliance, Inspections and Examinations (“Deficiency
Letter”) and a briefing on the Deficiency Letter within ten (10) business
days of receipt of a Deficiency Letter;
b. copies of any OCC response to a Deficiency Letter (“Response”) and a
briefing on the Response within ten (10) business days of sending a
Response; and
c. a briefing on OCC’s action plans, if any, in response to any deficiencies
identified in a Deficiency Letter within thirty (30) calendar days of
sending a Response.
For purposes of this paragraph, the required briefings can be provided in person, telephonically or
in writing, at the discretion of the Board-level Regulatory Committee, Board or ROWG.
88. OCC shall require its Chief Compliance Officer, or one of his or her deputies if
the Chief Compliance Officer is unable to attend, to attend all meetings of the ROWG and Board-
level Regulatory Committee.
89. Within fourteen (14) calendar days of the date of this Order and on the last
business day of each calendar quarter until the First Certification, OCC shall provide to the staff
of the Commission notices (“New Product Notices”) which identify all securities financial
products: (a) that are not option contracts based on the same underlying asset (excluding cases in
which the underlying asset changed due to a corporate action) and of the same type and style as
securities financial products for which OCC offers clearance and settlement services as of the
date of the New Product Notice; and (b) for which OCC has reason to believe will be listed for
trading on a participant exchange and for which, if so listed, OCC intends to offer clearance and
settlement services within the six (6) month period following the date of the New Product Notice.
90. OCC shall provide additional information related to the products listed in a New
Product Notice as the staff of the Commission may reasonably request.
91. OCC has established a prioritized, three-tiered list of planned filings under Section
19(b) of the Exchange Act and Section 806(e) of the Dodd-Frank Act, which is titled OCC
Prioritization of Advance Notice and Proposed Rule Change Filings dated August 14, 2019
(“Filing Priority Chart”). For sixteen (16) months from the date of this Order, OCC shall use its
best efforts to submit to the Commission filings included in Tiers 1 through 3 of the Filing
Priority Chart prior to any other filings. Further, OCC will prioritize the filings included in Tiers
1 through 3 of the Filing Priority Chart in the order set forth in the Filing Priority Chart, which
order shall be established and updated as appropriate in consultation with the staff of the Division
of Trading and Markets (“Division staff”). Nothing in this paragraph or Paragraph 92 alters
OCC’s legal obligations, including OCC’s ongoing obligation to respond to examination findings
of the staff of the Commission. -21-
92. OCC may modify the Filing Priority Chart, including moving the order of filings,
moving filings among tiers, and adding or removing filings, with the agreement of Division Staff.
Such agreement shall not be unreasonably withheld. Notwithstanding the foregoing, if OCC
reasonably and in good faith determines that it is necessary to revise the Filing Priority Chart to
resolve the Deficiencies, comply with applicable law, or protect the public interest, then OCC
may make such a revision; provided however, that OCC shall use its best efforts to provide the
Division Staff with notice at least fourteen (14) days in advance of making such a revision and
consult with Division Staff regarding the appropriateness and timing of any such revision.
93. Within sixty (60) calendar days of completing all of the undertakings set forth in
Section III(F) of this Order, OCC shall certify in writing compliance with such undertakings
(“Second Certification”). The Second Certification shall identify the undertakings, provide
written evidence of compliance in the form of a narrative, and be supported by exhibits
reasonably sufficient to demonstrate compliance. Within one (1) business day of the execution of
the Second Certification, OCC shall provide it to Charles J. Kerstetter, Assistant Regional
Director, Chicago Regional Office with a copy to the Office of the Chief Counsel of the
Enforcement Division. The Commission staff may make reasonable requests for further evidence
of compliance, and OCC agrees to provide such evidence.
94. To the extent that OCC must file a proposed rule change with the Commission to
comply with any undertaking in this Order, such proposed rule change will be subject to all
relevant legal and regulatory requirements and processes, including, but not limited to Exchange
Act Section 19(b).
95. OCC agrees that the ROWG shall continue to exist until, at a minimum, the earlier
of either the establishment of the Board-level Regulatory Committee or five (5) years from the
date of this Order, and that the ROWG shall:
a. be comprised of only Public Directors as that term is defined in the Board
of Directors Charter and Corporate Governance Principles; and
b. not delegate its authority for the recommendations, approvals and actions
required in Section III(F) of this Order to any other entity or person.
IV.
In view of the foregoing, the Commission deems it appropriate, in the public interest, and
for the protection of investors to impose the sanctions agreed to in OCC’s Offer.
Accordingly, pursuant to Sections 19(h) and 21C of the Exchange Act, it is hereby
ORDERED that:
A. OCC cease and desist from committing or causing any violations and any future
violations of Section 17A(d)(1) of the Exchange Act and Rules 17Ad-22(b)(2), 17Ad-22(d)(1),
17Ad-22(e)(1), 17Ad-22(e)(3)(i), 17Ad-22(e)(4)(iii) and (vi), 17Ad-22(e)(6)(i), and 17Ad-
-22-
22(e)(7)(i) and (vi) thereunder; Rules 1001(a)(1) and (2) of Reg. SCI; and Section 19(b) of the
Exchange Act and Rule 19b-4 thereunder.
B. OCC is censured.
C. OCC shall, by December 31, 2019, pay a civil money penalty in the amount of $15
million to the Securities and Exchange Commission for transfer to the general fund of the United
States Treasury, subject to Exchange Act Section 21F(g)(3). If timely payment is not made as
specified above, additional interest shall accrue pursuant to 31 U.S.C. 3717.
D. Payment(s) referenced in Paragraph C of this section must be made in one of the
following ways:
1. OCC may transmit payment electronically to the Commission, which will
provide detailed ACH transfer/Fedwire instructions upon request;
2. OCC may make direct payment from a bank account via Pay.gov through
the SEC website at http://www.sec.gov/about/offices/ofm.htm; or
3. OCC may pay by certified check, bank cashier’s check, or United States
postal money order, made payable to the Securities and Exchange
Commission and hand-delivered or mailed to:
Enterprise Services Center
Accounts Receivable Branch
HQ Bldg., Room 181, AMZ-341
6500 South MacArthur Boulevard
Oklahoma City, OK 73169
Payments by check or money order must be accompanied by a cover letter identifying OCC as a
respondent in these proceedings, and the file number of these proceedings; a copy of the cover
letter and check or money order must be sent to Kathryn A. Pyszka, Associate Regional Director,
Chicago Regional Office, Securities and Exchange Commission, 175 W. Jackson Boulevard, Suite
1450, Chicago, IL 60604.
E. OCC shall comply with the undertakings enumerated in Section III(F) above.
By the Commission.
Vanessa A. Countryman
Secretary
http://www.sec.gov/about/offices/ofm.htm