PRA submission supporting statement - Reg SCI 3-17-13 (Final)

SUPPORTING STATEMENT for the Paperwork Reduction Act Information Collection
Submission for Regulation SCI
This submission is being made pursuant to the Paperwork Reduction Act of 1995, 44 U.S.C.
Section 3501 et seq.
A.

JUSTIFICATION
1.

Necessity of Information Collection

Section 11A(a)(2) of the Securities Exchange Act of 1934 1 (“Exchange Act”) directs the
Commission, having due regard for the public interest, the protection of investors, and the
maintenance of fair and orderly markets, to use its authority under the Exchange Act to facilitate
the establishment of a national market system for securities in accordance with the Congressional
findings and objectives set forth in Section 11A(a)(1) of the Exchange Act. 2 Among the findings
and objectives in Section 11A(a)(1) is that “[n]ew data processing and communications
techniques create the opportunity for more efficient and effective market operations” 3 and “[i]t is
in the public interest and appropriate for the protection of investors and the maintenance of fair
and orderly markets to assure . . . the economically efficient execution of securities
transactions.” 4 In addition, Sections 6(b), 15A, and 17A(b)(3) of the Exchange Act impose
obligations on national securities exchanges, national securities associations, and clearing
agencies, respectively, to be “so organized” and “[have] the capacity to . . . carry out the
purposes of [the Exchange Act].” 5
For over two decades, Commission staff has worked with self-regulatory organizations
(“SROs”) to assess their automated systems under the Commission’s Automation Review Policy
(“ARP”) inspection program (“ARP Inspection Program”), a voluntary information technology
review program created in response to the October 1987 market break. 6 In 1989, the
Commission published ARP I, its first formal policy statement regarding steps that SROs should

1

15 U.S.C. 78k-1(a)(2).

2

15 U.S.C. 78k-1(a)(1).

3

See 15 U.S.C. 78k-1(a)(1)(B).

4

See 15 U.S.C. 78k-1(a)(1)(C)(i). Further, the Senate Committee Report accompanying
the Securities Acts Amendments of 1975 states that a paramount objective of a national
market system is “the maintenance of stable and orderly markets with maximum capacity
for absorbing trading imbalances without undue price movements.” Senate Comm. On
Banking, Housing and Urban Affairs, Report to accompany S. 249, Sen. Rep. 94-75, 94th
Cong., 1st Sess. at 7 (1975).

5

See 15 U.S.C. 78f(b)(1), 78o-3(b)(2), 78q-1(b)(3), respectively. See also 15 U.S.C. 78b
and 15 U.S.C. 78s.

6

See Securities Exchange Act Release No. 27445 (November 16, 1989), 54 FR 48703,
48706 (November 24, 1989) (“ARP I”).

2
take in connection with their automated systems. 7 In 1991, the Commission published ARP II,
in which the Commission further articulated its views on how SROs should conduct independent
reviews and how SROs should notify the Commission of material systems changes and
significant systems problems. 8
The current ARP Inspection Program was developed by Commission staff to implement
the ARP policy statements, and has garnered participation by all active registered clearing
agencies, all registered national securities exchanges, the Financial Industry Regulatory
Authority (“FINRA”), the only registered national securities association, one exempt clearing
agency, and one ATS. In 1998, the Commission adopted Regulation ATS which, among other
things, imposed by rule certain aspects of ARP I and ARP II on significant-volume ATSs. 9
Thereafter, administration of these aspects of Regulation ATS was incorporated into the ARP
Inspection Program.
Under the ARP Inspection Program, staff in the Commission’s Division of Trading and
Markets (“ARP staff”) conduct inspections of ARP entity systems, attend periodic technology
briefings presented by ARP entity staff, monitor the progress of planned significant system
changes, and respond to reports of system failures, disruptions, and other systems problems of
ARP entities. 10
Since the inception of the ARP Inspection Program, the securities markets have
experienced sweeping changes, evolving from a collection of relatively few, mostly manual
markets, to a larger number and broader variety of trading centers that are almost completely
automated, and dependent upon sophisticated technology and extremely fast and interconnected
systems. Regulatory developments also have impacted the structure of the markets. The
increase in the number of trading venues, the dispersal of trading volume, and the resulting
7

See id., at 48705-48706.

8

See Securities Exchange Act Release No. 29185 (May 9, 1991), 56 FR 22490, 22490-91
(May 15, 1991) (“ARP II” and, together with ARP I, the “ARP policy statements”). In
2001, Commission staff sent a letter to the SROs and other participants in the ARP
Inspection Program to clarify what should be considered a “significant system change”
and a “significant system outage” for purposes of reporting systems changes and
problems to Commission staff. Further, in 2009, Commission staff sent a letter to the
national securities exchanges and FINRA expressing the staff’s view that SROs are
obligated to ensure that their systems’ operations comply with the federal securities laws
and rules and the SRO’s rules, and that failure to satisfy this obligation could lead to
sanctions under Section 19(h)(1) of the Exchange Act.

9

See 17 CFR 242.301(b)(6).

10

ARP inspections are typically conducted independently from the inspections and
examinations of SROs, ATSs, and broker-dealers conducted by staff in the Commission’s
Office of Compliance Inspections and Examinations for compliance with the federal
securities laws and rules thereunder.

3
reliance on a variety of automated systems and intermarket linkages increased competition and
thus investor choice, but also have substantially heightened the potential for systems problems
originating from any number of sources to broadly affect the market.
While the Commission generally considers the ARP Inspection Program to have been
successful in improving the automated systems of the SROs and other entities participating in the
program over the past 20 years, the Commission is mindful of its limitations. For example,
because the ARP Inspection Program is established pursuant to Commission policy statements,
rather than Commission rules, the Commission’s ability to assure compliance with ARP
standards with certainty or adequate thoroughness is limited. In particular, the Commission may
not be able to fully address major or systemic market problems at all entities that would meet the
proposed definition of SCI entity. Further, the Government Accountability Office (“GAO”) has
identified the voluntary nature of the ARP Inspection Program as a limitation of the program and
recommended that the Commission make compliance with ARP guidelines mandatory. 11
The Commission believes that the continuing evolution of the securities markets to the
current state, where they have become almost entirely electronic and highly dependent on
sophisticated trading and other technology, has posed challenges for the ARP Inspection
Program. Accordingly, the Commission believes that the guidance in the ARP policy statements
should be updated, formalized, and clarified. Furthermore, given the importance of ensuring that
an SRO’s trading and other systems are operated in accordance with its rules, the Commission
believes that improvements in SRO procedures could help to ensure that such systems are
operating in compliance with relevant rules, and to promptly identify and address any instances
of non-compliance.
The Commission believes that recent events further highlight why rulemaking in this area
may be warranted. Recent events in the markets, including the problems experienced on May 6,
2010, 12 reports of cyber security and systems weaknesses at certain exchanges (NASDAQ 13 and
EDGX/EDGA 14), the problems associated with the Facebook 15 and BATS 16 initial public
11

See GAO, Financial Market Preparedness: Improvements Made, but More Action
Needed to Prepare for Wide-Scale Disasters, Report No. GAO-04-984 (September 27,
2004).

12

See Findings Regarding The Market Events Of May 6, 2010, Report Of The Staffs Of
The CFTC And SEC To The Joint Advisory Committee On Emerging Regulatory Issues,
September 30, 2010.

13

See announcement by Nasdaq OMX (February 5, 2011), available at:
http://www.nasdaq.com/includes/announcement-2-5-11.aspx (accessed May 20, 2011).
See also Devlin Barrett, “Hackers Penetrate NASDAQ Computers,” Wall St. J., February
5, 2011, at A1; Devlin Barrett et al., “NASDAQ Confirms Breach in Network,” Wall St.
J., February 7, 2011, at C1.

14

See Securities Exchange Act Release No. 65556, In the Matter of EDGX Exchange, Inc.,
EDGA Exchange, Inc. and Direct Edge ECN LLC (settled action: October 13, 2011),

4
offerings, technology issue at Knight Capital Group, 17 and, most recently, the two-day closure of
the markets in the wake of Superstorm Sandy, 18 among others, indicate that competition among
the markets has not sufficiently mitigated the occurrence of certain systems problems.
On October 2, 2012, the Commission conducted a roundtable entitled “Technology and
Trading: Promoting Stability in Today’s Markets” (“Roundtable”). The Roundtable examined
the relationship between the operational stability and integrity of the securities market and the
ways in which market participants design, implement, and manage complex and interconnected
trading technologies. 19 The Commission believes that the information presented at the
Roundtable and received from commenters highlights that quality standards, testing, and
improved error response mechanisms are among the issues needing very thoughtful and focused
attention in today’s securities markets.
The Commission is therefore proposing Regulation SCI, which would require an SCI
entity to: (1) establish, maintain, and enforce written policies and procedures reasonably
designed to ensure that certain systems have levels of capacity, integrity, resiliency, availability,
and security, adequate to maintain the SCI entity’s operational capability and promote the
maintenance of fair and orderly markets; (2) establish, maintain, and enforce written policies and
procedures reasonably designed to ensure that certain systems operate in the manner intended;
available at: http://www.sec.gov/litigation/admin/2011/34-65556.pdf; see also
Commission News Release, 2011-208, “SEC Sanctions Direct Edge Electronic
Exchanges and Orders Remedial Measures to Strengthen Systems and Controls” (October
13, 2011). EDGX, EDGA, and their affiliated routing broker, Direct Edge ECN LLC
(dba DE Route), consented to an Order Instituting Administrative and Cease-and-Desist
Proceedings Pursuant to Sections 19(h) and 21C of the Securities Exchange Act of 1934,
Making Findings, and Imposing Remedial Sanctions and a Cease-and-Desist Order.
15

See “Post-Mortem for NASDAQ issues related to the Facebook Inc. (FB) IPO Cross on
Friday, May 18, 2012” by NASDAQ, May 18, 2012, available at:
http://www.nasdaqtrader.com/TraderNews.aspx?id=ETA2012-20 (accessed July 2,
2012).

16

See “BATS BZX Exchange Post-Mortem” by BATS, March 23, 2012, available at:
www.batstrading.com/alerts (accessed July 2, 2012).

17

See Knight Capital Group Provides Update Regarding August 1st Disruption To Routing
In NYSE-listed Securities (August 2, 2012), available at:
http://www.knight.com/investorRelations/pressReleases.asp?compid=105070&releaseID
=1721599.

18

See, e.g., “A giant storm and the struggle over closing Wall Street,” October 31, 2012,
available at: http://www.reuters.com/article/2012/10/31/us-storm-sandy-nyse-insightidUSBRE89T0F920121031.

19

See Securities Exchange Act Release No. 67725 (August 24, 2012), 77 FR 52766
(August 30, 2012) (File No. 4-652).

5
(3) begin to take appropriate corrective action as soon as reasonably practicable upon any
responsible SCI personnel becoming aware of an SCI event; (4) provide immediate Commission
notification of certain SCI events (“immediate notification SCI events”) and written Commission
notification of all SCI events; (5) disseminate information to its members or participants relating
to certain SCI events (“dissemination SCI events”); (6) provide Commission notification of
planned material systems changes; (7) conduct an SCI review of its compliance with Regulation
SCI not less than once each calendar year and submit a report of the review to its senior
management; (8) provide to the Commission a report of the SCI review and any response by
senior management, as well as a semi-annual report on material systems changes; and (9) require
participation by designated members or participants in the testing of the operation of its business
continuity and disaster recovery plans and coordinate such testing on an industry- or sector-wide
basis with other SCI entities, as well as notify and update the Commission of its list of
designated members or participants and its standards for such designation. Proposed Regulation
SCI would further specify that records relating to the matters covered by Regulation SCI must be
made, kept, and preserved by SCI entities, and provided to Commission representatives upon
request. In addition, proposed Regulation SCI would specify that except with respect to
Commission notification of immediate notification SCI events and oral Commission notification
of material systems changes, any notification, review, description, analysis, or report to the
Commission required by Regulation SCI must be submitted electronically on Form SCI.
The Commission preliminarily estimates that there are currently 44 respondents that
would fall within the definition of SCI entity and be subject to the information collection
requirements of proposed Regulation SCI. Of these 44 respondents, the Commission
preliminarily estimates that 26 would fall within the definition of SCI SRO; 15 would fall within
the definition of SCI ATS; 2 would fall within the definition of plan processor, and 1 would fall
within the definition of exempt clearing agency subject to ARP. Also, of these 44 respondents,
the Commission preliminarily estimates that 29 currently participate in the ARP Inspection
Program, whereas 15 do not.
2.

Purpose and Use of the Information Collection

The proposed requirements that SCI entities establish certain written policies and
procedures with respect to certain systems, and that they require designated members or
participants to participate in the testing of their business continuity and disaster recovery plans,
would further the goals of the national market system and reinforce Exchange Act obligations by
requiring entities important to the functioning of the U.S. securities markets to carefully design,
develop, test, maintain, and surveil systems integral to their operations, and operate them in
compliance with relevant federal securities laws and the rules and regulations thereunder, as well
as their own rules and policies.
The information that would be collected pursuant to the proposed requirements for
notifications, disseminations of information, and reports would assist the Commission in its
oversight of SCI entities and the securities markets, help ensure the orderly operation of the U.S.
securities markets, and help protect investors and the public interest. In particular, the proposed
requirements that SCI entities notify the Commission of all SCI events, disseminate information

6
to members or participants, undertake and submit to the Commission an SCI review not less than
once each calendar year, and submit reports of material systems changes are designed to help
ensure compliance with the other provisions of proposed Regulation SCI and accountability of
SCI entities in the event of systems problems. Further, the Commission preliminarily believes
that the information dissemination requirement for dissemination SCI events would make
members or participants aware that their trading activity might have been or might be impacted
by the occurrence of a dissemination SCI event, so that they could consider that information in,
among other things, making trading decisions, seeking corrective action, or pursuing remedies.
The Commission also preliminarily believes that the prospect of disseminating information
regarding dissemination SCI events to members or participants would provide an incentive for
SCI entities to better focus on improving the integrity and compliance of their systems.
The proposed requirement that SCI entities begin to take appropriate corrective action
upon any responsible SCI personnel becoming aware of an SCI event would help ensure that SCI
entities dedicate adequate resources to timely address an SCI event and place an emphasis on
mitigating potential harm to investors and market integrity. The proposed threshold for
notification of certain SCI events to the Commission under proposed Rule 1000(b)(4)(i) would
help ensure that the Commission is made aware of significant SCI events when any responsible
SCI personnel becomes aware of such events. The proposed definition of dissemination SCI
event would help ensure that potentially impacted members or participants have information
about SCI events so that they might be able to better assess whether they should use the services
of an SCI entity.
The proposed recordkeeping requirements in Rules 1000(c) and (e) would assist
Commission staff during an examination of an SCI entity to assess its compliance with the
proposed rules. In addition, access to the records of SCI entities would help Commission staff to
carry out its oversight responsibilities of SCI entities and the securities markets. Further, the
proposed recordkeeping requirements would aid SCI entities and the Commission in
documenting, reviewing, and correcting any SCI event, as well as in identifying market
participants that may have been harmed by such an event.
3.

Consideration Given to Information Technology

Proposed Regulation SCI would require SCI entities to submit any written notification,
review, description, analysis, or report to the Commission electronically using proposed Form
SCI (except any written notification under proposed Rule 1000(b)(4)(i) relating to immediate
notification SCI events). Proposed Regulation SCI is designed to streamline the reporting
processes and make the processes efficient by specifying the information required to be provided
and requiring SCI entities to electronically file Form SCI.
The Commission’s proposal contemplates the use of an online filing system, similar to
the electronic Form 19b-4 filing system (“EFFS”), which is currently used by SROs to file
proposed rule changes electronically with the Commission pursuant to Section 19 of the
Exchange Act. The Commission is contemplating the use of such a system because SROs are
already familiar with the system.

7
4.

Duplication

Proposed Regulation SCI would replace the two ARP policy statements and related staff
guidance. However, as noted in Item 1 above, although proposed Regulation SCI would codify in a
Commission rule many of the principles of the ARP policy statements, the proposed rule would
have a broader scope than those statements.
In addition, pursuant to Rule 301(b)(6) of Regulation ATS, certain aspects of the ARP
policy statements apply mandatorily to significant-volume ATSs, as they are currently defined
under that rule. Because proposed Regulation SCI would duplicate the requirements under Rule
301(b)(6) of Regulation ATS, the Commission is proposing to delete that rule. 20
Because proposed Regulation SCI would replace the ARP policy statements and related
staff guidance, and the Commission is proposing to delete Rule 301(b)(6) of Regulation ATS,
proposed Regulation SCI would not duplicate any existing information collection.
5.

Effect on Small Entities

Not applicable. None of the respondents subject to the information collection will be a
small entity.
6.

Consequences of Not Conducting Collection

The collection of information is designed to ensure that SCI entities operate with adequate
capacity, integrity, resiliency, availability, and security, and in compliance with relevant laws and
rules. Any less frequent collection would deprive the Commission of timely information regarding
systems issues and systems changes at SCI entities and SCI entities’ compliance with proposed
Regulation SCI. Any less frequent collection also would deprive the Commission and the members
or participants of SCI entities of timely information regarding the occurrence and resolution of
systems issues.
7.

Inconsistencies with Guidelines in 5 CFR 1320.5(d)(2)

Several provisions of proposed Regulation SCI would require respondents to report
information to the agency more often than quarterly.
Depending on the frequency of SCI events, SCI entities may be required to provide
information to the Commission or disseminate information to their members or participants more
than once per quarter. However, the Commission believes that timely and comprehensive
reporting of SCI events to the Commission would facilitate its regulatory oversight of the
20

The Commission is separately submitting a PRA package for the proposed deletion of
Rule 301(b)(6) of Regulation ATS (OMB Control No. 3235-0509).

8
national securities markets. Specifically, timely receipt of information after a responsible SCI
personnel becomes aware of an SCI event will help the Commission and its staff to quickly
assess the nature and scope of that SCI event, and help the SCI entity identify the appropriate
response. The aggregated data that would result from the reporting of SCI events also would
permit the Commission to efficiently perform analysis on such data. This ability to more
efficiently analyze a comprehensive set of data would help the Commission carry out its
oversight responsibilities because it would help the Commission to identify more effectively, for
example, areas of persistent or recurring problems across the systems of all SCI entities. Further,
the Commission believes the timely dissemination of information about dissemination SCI
events to member or participants of SCI entities would aid market participants in determining
whether their trading activity might have been or might be impacted by the occurrence of an SCI
event at an SCI entity, so that they could consider that information in, among other things,
making trading decisions, seeking corrective action, or pursuing remedies. The Commission also
believes that the prospect of disseminating information about dissemination SCI events could
provide an incentive for SCI entities to better focus on improving the integrity and compliance of
their systems.
Depending on the frequency of material systems changes, SCI entities may be required to
provide disclosure to the Commission more than once per quarter. The Commission believes that
this requirement would help Commission staff to timely evaluate the issues raised by a planned
material systems change.
Proposed Rule 1000(c) would require SCI entities other than SCI SROs to make, keep,
and preserve at least one copy of all documents relating to its compliance with Regulation SCI
for a period of not less than five years, the first two years in a place that is readily accessible to
the Commission or its representatives for inspection and examination. The Commission notes
that the recordkeeping time periods are consistent with those applicable to SROs under Rule 17a1 under the Exchange Act.
8.

Consultations Outside the Agency

The Commission has issued a release soliciting public comment on the new collection of
information requirements and associated paperwork burdens. A copy of the release is
attached. Comments on releases are generally received from registrants, investors, and other
market participants. In addition, the Commission and staff participate in ongoing dialogue with
representatives of various market participants through public conferences, meetings, and
informal exchanges. Any comments received on this proposed rulemaking will be posted on the
Commission’s public website, and made available using the following
link http://sec.gov/comments/s7-01-13/s70113.shtml. The Commission will consider all
comments received prior to publishing the final rule, and will explain in any adopting release
how the final rule responds to such comments, in accordance with 5 CFR 1320.11(f).
9.

Payment or Gift

Not applicable.

9
10.

Confidentiality

To the extent the Commission receives confidential information pursuant to SCI entities’
submissions on proposed Form SCI, such information would be kept confidential, subject to the
provisions of applicable law (e.g., Freedom of Information Act, 5 U.S.C. 552).
11.

Sensitive Questions

Not applicable. No questions of a sensitive nature are involved.
12.

Burden of Information Collection
A.

Policies and Procedures Required by Proposed Rule 1000(b)(1)

Proposed Rule 1000(b)(1) would establish recordkeeping burdens for all 44 SCI entities.
However, certain burdens would be different for SCI entities that participate in the ARP
Inspection Program (29 SCI entities) and SCI entities that do not (15 SCI entities).
Proposed Rule 1000(b)(1) would require SCI entities to establish, maintain, and enforce
written policies and procedures reasonably designed to ensure that their SCI systems and, for
purposes of security standards, SCI security systems, have levels of capacity, integrity,
resiliency, availability and security, adequate to maintain the SCI entity’s operational capability
and promote the maintenance of fair and orderly markets.
With respect to proposed Rule 1000(b)(1) (except for policies and procedures for
standards that result in systems designed, developed, tested, maintained, operated, and surveilled
in a manner that facilitates the successful collection, processing, and dissemination of market
data, which are addressed below), the Commission preliminarily estimates that an SCI entity that
does not participate in the ARP Inspection Program (15 SCI entities in total) would require 210
hours initially to develop and draft such policies and procedures. The Commission preliminarily
estimates that an SCI entity that participates in the ARP Inspection Program (29 SCI entities in
total) would require 105 hours initially to develop and draft such policies and procedures. Thus,
the total initial recordkeeping burden to comply with proposed Rule 1000(b)(1) (except for
policies and procedures for standards that result in systems designed, developed, tested,
maintained, operated, and surveilled in a manner that facilitates the successful collection,
processing, and dissemination of market data) would be 6,195 hours (210 hours × 15 SCI entities
that do not participate in the ARP Inspection Program + 105 hours × 29 SCI entities that
participate in the ARP Inspection Program). The weighted average initial recordkeeping burden
to comply with proposed Rule 1000(b)(1) (except for policies and procedures for standards that
result in systems designed, developed, tested, maintained, operated, and surveilled in a manner
that facilitates the successful collection, processing, and dissemination of market data) would be
104.80 hours per SCI entity (6,195 hours ÷ 44 SCI entities).

10
With respect to proposed Rule 1000(b)(1) (except for policies and procedures for
standards that result in systems designed, developed, tested, maintained, operated, and surveilled
in a manner that facilitates the successful collection, processing, and dissemination of market
data), the Commission preliminarily estimates that an SCI entity that does not participate in the
ARP Inspection Program (15 SCI entities in total) would require 60 hours annually to review its
policies and procedures. The Commission preliminarily estimates that an SCI entity that
participates in the ARP Inspection Program (29 SCI entities in total) would require 30 hours
annually to review its policies and procedures. Thus, the total ongoing annual recordkeeping
burden to comply with proposed Rule 1000(b)(1) (except for policies and procedures for
standards that result in systems designed, developed, tested, maintained, operated, and surveilled
in a manner that facilitates the successful collection, processing, and dissemination of market
data) would be 1,770 hours (60 hours × 15 SCI entities that do not participate in the ARP
Inspection Program + 30 hours × 29 SCI entities that participate in the ARP Inspection
Program). The weighted average ongoing annual recordkeeping burden to comply with
proposed Rule 1000(b)(1) (except for policies and procedures for standards that result in systems
designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the
successful collection, processing, and dissemination of market data) would be 40.23 hours per
SCI entity (1,770 hours ÷ 44 SCI entities).
With respect to proposed Rule 1000(b)(1)(i)(F) (policies and procedures for standards
that result in systems designed, developed, tested, maintained, operated, and surveilled in a
manner that facilitates the successful collection, processing, and dissemination of market data),
the Commission preliminarily estimates that each SCI entity would spend 130 hours initially to
develop and draft the required policies and procedures, and 130 hours annually to review such
policies and procedures. Thus, the total initial and annual recordkeeping burden to comply with
proposed Rule 1000(b)(1)(i)(F) would be 5,720 hours (130 hours initially and annually × 44 SCI
entities).
The annualized recordkeeping burden for complying with proposed Rule 1000(b)(1)
would be 8,965 hours for all SCI entities (((6,195 + 5,720 hours for the first year) + (1,770 +
5,720 hours for the second year) + (1,770 + 5,720 hours for the third year)) ÷ 3 years), or 203.75
hours per SCI entity (8,965 hours ÷ 44 SCI entities).
B.

Policies and Procedures Required by Proposed Rule 1000(b)(2)

Proposed Rule 1000(b)(2)(i) would establish recordkeeping burdens for all 44 SCI
entities. However, certain burdens would be different for SCI entities that are SCI SROs (26 SCI
entities) and SCI entities that are not SCI SROs (18 SCI entities).
Proposed Rule 1000(b)(2)(i) would require SCI entities to establish, maintain, and
enforce written policies and procedures reasonably designed to ensure that their SCI systems
operate in the manner intended, including in a manner that complies with the federal securities
laws and rules and regulations thereunder, and the entities’ rules and governing documents, as
applicable. The Commission preliminarily believes that each SCI entity would elect to comply

11
with the safe harbor provisions in proposed Rules 1000(b)(2)(ii) and (iii) for purposes of
complying with proposed Rule 1000(b)(2).
The Commission preliminarily estimates that each SCI entity would require 180 hours
initially to design policies and procedures to ensure that they are in compliance with proposed
Rule 1000(b)(2). The total initial recordkeeping burden to comply with proposed Rule
1000(b)(2) would be 7,920 hours (180 hours × 44 SCI entities).
The Commission preliminarily estimates that each SCI SRO (26 SCI SROs in total)
would require 120 hours annually to review the policies and procedures and each of the other
SCI entities (18 SCI entities in total) would require 60 hours annually to review the policies and
procedures. The total ongoing annual recordkeeping burden to comply with proposed Rule
1000(b)(2) would be 4,200 hours (120 hours × 26 SCI SROs + 60 hours × 18 SCI entities other
than SCI SROs). With respect to all SCI entities, the weighted average ongoing annual
recordkeeping burden to comply with proposed Rule 1000(b)(2) would be 95.45 hours per SCI
entity (4,200 hours ÷ 44 SCI entities).
The annualized recordkeeping burden for complying with proposed Rule 1000(b)(2)
would be 5,440 hours ((7,920 hours for the first year + 4,200 hours for the second year + 4,200
hours for the third year) ÷ 3 years), or 123.64 hours per SCI entity (5,440 hours ÷ 44 SCI
entities).
C.

Mandate Participation in Certain Testing Required by Proposed Rule
1000(b)(9)

Proposed Rule 1000(b)(9) would establish recordkeeping and reporting burdens for SCI
entities that are not plan processors (42 SCI entities).
Proposed Rule 1000(b)(9)(i)-(ii) would require each SCI entity to require participation by
designated members or participants in the testing of its business continuity and disaster recovery
plans, including its backup systems, as well as to coordinate such testing on an industry- or
sector-wide basis with other SCI entities.
The Commission preliminarily estimates that each SCI entity (other than plan processors,
who would outsource this work) would spend approximately 130 hours initially to mandate
participation by designated members or participants in testing and to coordinate testing with
other SCI entities. The total initial recordkeeping burden to comply with proposed Rule
1000(b)(9)(i)-(ii) would be 5,460 hours (130 hours × 42 SCI entities other than plan processors).
The Commission preliminarily estimates that each SCI entity (other than plan processors,
who would outsource this work) would spend approximately 95 hours annually to review its
written rules or requirements related to testing and to coordinate testing with other SCI entities.
The total annual ongoing recordkeeping burden to comply with proposed Rule 1000(b)(9)(i)-(ii)
would be 3,990 hours (95 hours × 42 SCI entities other than plan processors).

12
The annualized recordkeeping burden for complying with proposed Rule 1000(b)(9)(i)(ii) would be 4,480 hours ((5,460 hours for the first year + 3,990 hours for the second year +
3,990 hours for the third year) ÷ 3 years), or 106.67 hours per SCI entity (4,480 hours ÷ 42 SCI
entities other than plan processors).
Proposed Rule 1000(b)(9)(iii) would require each SCI entity to designate those members
or participants who must participate in the testing of its business continuity and disaster recovery
plans, as well as to notify the Commission of its list of designees and its standards for
designation.
The Commission preliminarily estimates that each SCI entity (other than plan processors,
who would outsource this work) would spend approximately 35 hours initially to establish and
submit to the Commission its standards for designation, as well as to determine, compile, and
submit its list of designees. The total initial reporting burden to comply with proposed Rule
1000(b)(9)(iii) would be 1,470 hours (35 hours × 42 SCI entities other than plan processors).
The Commission preliminarily estimates that each SCI entity (other than plan processors,
who would outsource this work) would spend approximately 3 hours annually to review the
designation standards, to review its list of designees, and to update prior Commission
notifications with respect to the standards for designation and the list of designees. The total
annual ongoing reporting burden to comply with proposed Rule 1000(b)(9)(iii) would be 126
hours (3 hours × 42 SCI entities other than plan processors).
The annualized reporting burden for complying with proposed Rule 1000(b)(9)(iii) would
be 574 hours ((1,470 hours for the first year + 126 hours for the second year + 126 hours for the
third year) ÷ 3 years), or 13.67 hours per SCI entity (574 hours ÷ 42 SCI entities other than plan
processors).
D.

Notice Required by Proposed Rule 1000(b)(4)

Proposed Rule 1000(b)(4) would establish reporting burdens for all 44 SCI entities.
Proposed Rule 1000(b)(4)(i) would require an SCI entity, upon any responsible SCI
personnel becoming aware of a systems disruption that the SCI entity reasonably estimates
would have a material impact on its operations or on market participants, any systems
compliance issue, or any systems intrusion (“immediate notification SCI event”), to notify the
Commission of such event. The Commission preliminarily estimates that each SCI entity would
experience 40 immediate notification SCI events per year, ten of which would be reported to the
Commission in writing (as opposed to orally). The Commission also preliminarily estimates that
each written notification would require 0.5 hour to prepare and submit. The total annual
reporting burden to comply with proposed Rule 1000(b)(4)(i) would be 220 hours for all SCI
entities (10 immediate notification SCI events × 0.5 hour per written notice × 44 SCI entities), or
5 hours per SCI entity (10 immediate notification SCI events × 0.5 hour per written notice).

13
Proposed Rule 1000(b)(4)(ii) would require an SCI entity, within 24 hours of any
responsible SCI personnel becoming aware of any SCI event, to submit a written notification
pertaining to such SCI event to the Commission. The Commission preliminarily estimates that
each SCI entity would experience 65 SCI events per year and that each initial notification would
require 20 hours. The total annual reporting burden to comply with proposed Rule 1000(b)(4)(ii)
would be 57,200 hours for all SCI entities (65 SCI events × 20 hours per notification × 44 SCI
entities), or 1,300 hours per SCI entity (65 SCI events × 20 hours per notification).
Proposed Rule 1000(b)(4)(iii) would require an SCI entity to provide to the Commission
written updates pertaining to SCI events on a regular basis, or at such frequency as reasonably
requested by a representative of the Commission, until the SCI event is resolved. The
Commission preliminarily estimates that each SCI entity would submit 5 updates each year and
each update would require 3 hours. The total annual reporting burden to comply with proposed
Rule 1000(b)(4)(iii) would be 660 hours for all SCI entities (5 updates × 3 hours per update × 44
SCI entities), or 15 hours per SCI entity (5 updates × 3 hours per update).
The total annual reporting burden to comply with proposed Rule 1000(b)(4) would be
58,080 hours for all SCI entities (220 hours to comply with proposed Rule 1000(b)(4)(i) +
57,200 hours to comply with proposed Rule 1000(b)(4)(ii) + 660 hours to comply with proposed
Rule 1000(b)(4)(iii)), or 1,320 hours per SCI entity (58,080 hours ÷ 44 SCI entities). Because
proposed Rule 1000(b)(4) would impose 80 reporting requirements per SCI entity per year (10
requirements under proposed Rule 1000(b)(4)(i) + 65 requirements under proposed Rule
1000(b)(4)(ii) + 5 requirements under proposed Rule 1000(b)(4)(iii)), each notification would
require an average of 16.5 hours per SCI entity (1,320 hours ÷ 80 requirements).
E.

Dissemination of Information Required by Proposed Rule 1000(b)(5)

Proposed Rule 1000(b)(5) would establish third party disclosure burdens for all 44 SCI
entities.
Proposed Rule 1000(b)(5)(i)(A) would require an SCI entity, promptly after any
responsible SCI personnel becomes aware of a dissemination SCI event other than a systems
intrusion, to disseminate to its members or participants certain information about the event. The
Commission preliminarily estimates that each SCI entity would experience 14 dissemination SCI
events each year other than systems intrusions, and that each dissemination of information would
require 3 hours to prepare and make available to members or participants. Thus, the total annual
third party disclosure burden to comply with proposed Rule 1000(b)(5)(i)(A) would be 1,848
hours for all SCI entities (14 dissemination SCI events other than systems intrusions × 3 hours
per dissemination × 44 SCI entities), or 42 hours per SCI entity (14 dissemination SCI events
other than systems intrusions × 3 hours per dissemination).
Proposed Rule 1000(b)(5)(i)(B) would require an SCI entity, when known, to disseminate
additional information to its members or participants regarding a dissemination SCI event. The
Commission preliminarily estimates that each SCI entity would make one such dissemination per
dissemination SCI event and that each dissemination would require 5 hours to prepare and make

14
available. The total annual third party disclosure burden to comply with proposed Rule
1000(b)(5)(i)(B) would be 3,080 hours for all SCI entities (14 dissemination SCI events other
than systems intrusions × 1 dissemination per event × 5 hours per dissemination × 44 SCI
entities), or 70 hours per SCI entity (14 dissemination SCI events other than systems intrusions ×
1 dissemination per event × 5 hours per dissemination).
Proposed Rule 1000(b)(5)(i)(C) would require an SCI entity to provide regular updates to
its members or participants with respect to dissemination SCI events. The Commission
preliminarily estimates that each SCI entity would make one such dissemination per
dissemination SCI event and that each dissemination would require 1 hour to prepare and make
available to members or participants. The total annual third party disclosure burden to comply
with proposed Rule 1000(b)(5)(i)(C) would be 616 hours for all SCI entities (14 dissemination
SCI events other than systems intrusions × 1 dissemination per event × 1 hour per dissemination
× 44 SCI entities), or 14 hours per SCI entity (14 dissemination SCI events other than systems
intrusions × 1 dissemination per event × 1 hour per dissemination).
Under proposed Rule 1000(b)(5)(ii), an SCI entity would be required, promptly after any
responsible SCI personnel becomes aware of a systems intrusion, to disseminate to its members
or participants certain information about the systems intrusion, unless the SCI entity determines
that dissemination of such information would likely compromise the security of the SCI entity’s
SCI systems or SCI security systems, or an investigation of the systems intrusion, and documents
the reasons for such determination. The Commission preliminarily estimates that each SCI entity
would experience 1 systems intrusion per year, and that each dissemination would require 3
hours to prepare and make available. The annual third party disclosure burden to comply with
proposed Rule 1000(b)(5)(ii) would be 132 hours for all SCI entities (1 systems intrusion × 3
hours per dissemination × 44 SCI entities), or 3 hours per SCI entity (1 systems intrusion × 3
hours per dissemination).
The total annual third party disclosure burden to comply with proposed Rule 1000(b)(5)
would be 5,676 hours for all SCI entities (1,848 hours to comply with proposed Rule
1000(b)(5)(i)(A) + 3,080 hours to comply with proposed Rule 1000(b)(5)(i)(B) + 616 hours to
comply with proposed Rule 1000(b)(5)(i)(C) + 132 hours to comply with proposed Rule
1000(b)(5)(ii)), or 129 hours per SCI entity (5,676 hours ÷ 44 SCI entities). Because proposed
Rule 1000(b)(5) would impose 43 third party disclosure requirements per SCI entity per year (14
requirements under proposed Rule 1000(b)(5)(i)(A) + 14 requirements under proposed Rule
1000(b)(5)(i)(B) + 14 requirements under proposed Rule 1000(b)(5)(i)(C) + 1 requirement under
proposed Rule 1000(b)(5)(ii)), each requirement would require an average of 3 hours per SCI
entity (129 hours ÷ 43 requirements).
F.

Notice Required by Proposed Rule 1000(b)(6)

Proposed Rule 1000(b)(6) would establish reporting burdens for all 44 SCI entities.
However, certain burdens would be different for SCI entities that participate in the ARP
Inspection Program (29 SCI entities) and SCI entities that do not (15 SCI entities).

15
Proposed Rule 1000(b)(6) would require an SCI entity, absent exigent circumstances, to
notify the Commission at least 30 calendar days before the implementation of any planned
material systems change. If exigent circumstances exist, or if the information previously
provided to the Commission regarding any planned material systems change has become
materially inaccurate, an SCI entity would be required to notify the Commission, either orally or
in writing, with any oral notification to be memorialized within 24 hours after such oral
notification by a written notification, as early as reasonably practicable.
The Commission preliminarily estimates an average of 60 planned material systems
changes per SCI entity per year. 21 However, because participants in the ARP Inspection
Program already notify Commission staff of certain systems changes, the Commission
preliminarily estimates that each participant will notify the Commission of 30 additional planned
material systems changes each year. The Commission preliminarily estimates that each
notification would require an SCI entity 2 hours to prepare and submit. The total annual
reporting burden to comply with proposed Rule 1000(b)(6) would be 3,540 hours for all SCI
entities (60 planned material systems changes × 2 hours per notification × 15 SCI entities that do
not participate in the ARP Inspection Program + 30 additional planned material systems changes
× 2 hours per notification × 29 SCI entities that participate in the ARP Inspection Program), or
an average of 40.23 material systems changes per SCI entity ((60 planned material systems
changes × 15 SCI entities that do not participate in the ARP Inspection Program + 30 planned
material systems changes × 29 SCI entities that participate in the ARP Inspection Program) ÷ 44
SCI entities) and 80.45 hours per SCI entity (3,540 hours ÷ 44 SCI entities).
G.

SCI Review Required by Proposed Rule 1000(b)(7)

Proposed Rule 1000(b)(7) would establish recordkeeping burdens for all 44 SCI entities.
Proposed Rule 1000(b)(7) would require an SCI entity to conduct an SCI review of its
compliance with proposed Regulation SCI not less than once each calendar year, and submit a
report of the SCI review to senior management of the SCI entity for review no more than 30
calendar days after completion of such SCI review. The Commission preliminarily estimates
that each SCI entity would require 625 hours annually to conduct and submit the SCI review.
The total annual recordkeeping burden to comply with the SCI review requirement would be
27,500 hours (625 hours per SCI review × 44 SCI entities).
H.

Reports Required by Proposed Rule 1000(b)(8)

Proposed Rule 1000(b)(8) would establish reporting burdens for all 44 SCI entities.

21

This estimate includes instances where the information previously provided to the
Commission regarding any planned material systems change becomes materially
inaccurate.

16
Proposed Rule 1000(b)(8)(i) would require each SCI entity to submit to the Commission
a report of the SCI review required by proposed Rule 1000(b)(7), together with any response by
senior management of the SCI entity, within 60 calendar days after its submission to senior
management of the SCI entity. The Commission preliminarily estimates that each SCI entity
would require 1 hour to submit the SCI review. The total annual reporting burden to comply
with proposed Rule 1000(b)(8)(i) would be 44 hours (1 report × 1 hour per report × 44 SCI
entities).
Proposed Rule 1000(b)(8)(ii) would require each SCI entity to submit a report within 30
calendar days after the end of June and December of each year, containing a summary
description of the progress of any material systems changes during the six-month period ending
on June 30 or December 31, as the case may be, and the date, or expected date, of completion of
their implementation. The Commission preliminarily estimates that each SCI entity would
require 60 hours semi-annually, or 120 hours annually, to comply with proposed Rule
1000(b)(8)(ii). The total annual reporting burden to comply with proposed Rule 1000(b)(8)(ii)
would be 5,280 hours (120 hours × 44 SCI entities).
The total annual reporting burden to comply with proposed Rule 1000(b)(8) would be
5,324 hours (44 hours to comply with proposed Rule 1000(b)(8)(i) + 5,280 hours to comply with
proposed Rule 1000(b)(8)(ii)), or 121 hours per SCI entity (5,324 hours ÷ 44 SCI entities).
Because proposed Rule 1000(b)(8) would impose 3 reporting requirements per SCI entity per
year (1 requirement under proposed Rule 1000(b)(8)(i) + 2 requirements under proposed Rule
1000(b)(8)(ii)), each requirement would require an average of 40.33 hours per SCI entity (121
hours ÷ 3 reporting requirements).
I.

Requirement to Take Corrective Actions

Proposed Rule 1000(b)(3) would establish recordkeeping burdens for all 44 SCI entities.
Proposed Rule 1000(b)(3) would require each SCI entity, upon any responsible SCI
personnel becoming aware of an SCI event, to begin to take corrective action as soon as
reasonably practicable. While the Commission believes that all SCI entities already take
corrective actions in response to a systems issue, the Commission preliminarily believes that
proposed Rule 1000(b)(3) could result in SCI entities revising their policies regarding taking
corrective actions.
The Commission preliminarily estimates that each SCI entity would require 42 hours
initially to implement such a process, and 12 hours annually to review such process. The total
initial recordkeeping burden to implement the process would be 1,848 hours (42 hours × 44 SCI
entities). The total ongoing annual recordkeeping burden to review the process would be 528
hours (12 hours × 44 SCI entities). The annualized recordkeeping burden to comply with
proposed Rule 1000(b)(3) would be 968 hours ((1,848 hours for the first year + 528 hours for the
second year + 528 hours for the third year) ÷ 3 years), or 22 hours per SCI entity (968 hours ÷ 44
SCI entities).

17
J.

Requirement to Identify Immediate Notification SCI Events and
Dissemination SCI Events

The need to distinguish immediate notification SCI events and dissemination SCI events
from other SCI events will impose a recordkeeping burden on all 44 SCI entities to develop and
review a process to ensure that they can quickly and correctly make a determination of the
significance of an SCI event. However, certain burdens would be different for SCI entities that
participate in the ARP Inspection Program (29 SCI entities) and SCI entities that do not (15 SCI
entities).
The Commission preliminarily estimates that an SCI entity that does not participate in the
ARP Inspection Program (15 SCI entities in total) would require 42 hours to develop such a
process. The Commission preliminarily estimates that an SCI entity that participates in the ARP
Inspection Program (29 SCI entities in total) would require 21 hours to develop such a process.
The total initial recordkeeping burden to develop such a process would be 1,239 hours (42 hours
× 15 SCI entities that do not participate in the ARP Inspection Program + 21 hours × 29 SCI
entities that participate in the ARP Inspection Program). The weighted average initial
recordkeeping burden to develop such process would be 28.16 hours per SCI entity (1,239 hours
÷ 44 SCI entities).
The Commission preliminarily estimates that an SCI entity that does not participate in the
ARP Inspection Program (15 SCI entities in total) would require 12 hours annually to review
such process. The Commission preliminarily estimates that an SCI entity that participates in the
ARP Inspection Program (29 SCI entities in total) would require 6 hours to review the process.
The total ongoing annual recordkeeping burden to review the process would be 354 hours (12
hours × 15 SCI entities that do not participate in the ARP Inspection Program + 6 hours × 29 SCI
entities that participate in the ARP Inspection Program). The weighted average ongoing annual
recordkeeping burden to review such process would be 8.05 hours per SCI entity (354 hours ÷ 44
SCI entities).
The annualized recordkeeping burden for developing and reviewing a process to
determine the significance of SCI events would be 649 hours for all SCI entities ((1,239 hours
for the first year + 354 hours for the second year + 354 hours for the third year) ÷ 3 years), or
14.75 hours for each SCI entity (649 hours ÷ 44 SCI entities).
K.

Recordkeeping Requirements

The proposed recordkeeping requirement would establish recordkeeping burdens for SCI
entities other than SCI SROs (18 SCI entities).
The Commission preliminarily estimates that an SCI entity other than an SCI SRO would
require 25 hours annually to comply with the proposed recordkeeping requirement. In addition,
the Commission preliminarily estimates that each SCI entity other than an SCI SRO would
require 170 hours initially to set up or modify an existing recordkeeping system. The total initial
burden to comply with the proposed recordkeeping requirement would be 3,510 hours ((25 hours

18
+ 170 hours) × 18 SCI entities that are not SCI SROs). The total ongoing annual recordkeeping
burden to comply with the proposed recordkeeping requirement would be 450 hours (25 hours ×
18 SCI entities that are not SCI SROs). The annualized recordkeeping burden for all SCI entities
other than SCI SROs to comply with the proposed recordkeeping requirement would be 1,470
hours ((3,510 hours for the first year + 450 hours for the second year + 450 hours for the third
year) ÷ 3 years), or 81.67 hours per SCI entity that is not an SCI SRO (1,470 hours ÷ 18 SCI
entities that are not SCI SROs).
L.

Summary of Hourly Burdens

The table below summarizes the Commission’s preliminary estimate of the total hourly
burden for SCI entities under Regulation SCI.
Nature of Information Collection Burden

Annualized Hourly Burden Estimate

Policies and procedures required by proposed Rule
1000(b)(1)

8,965 (Recordkeeping)

Policies and procedures required by proposed Rule
1000(b)(2)

5,440 (Recordkeeping)

Mandatory participation in certain testing required by
proposed Rule 1000(b)(9)(i)-(ii)

4,480 (Recordkeeping)

Mandatory participation in certain testing required by
proposed Rule 1000(b)(9)(iii)

574 (Reporting)

Notice required by proposed Rule 1000(b)(4)

58,080 (Reporting)

Dissemination of information required by proposed
Rule 1000(b)(5)

5,676 (Third Party Disclosure)

Notice required by proposed Rule 1000(b)(6)

3,540 (Reporting)

SCI Review required by proposed Rule 1000(b)(7)

27,500 (Recordkeeping)

Reports required by proposed Rule 1000(b)(8)

5,324 (Reporting)

Requirement to take corrective actions

968 (Recordkeeping)

Requirement to identify immediate notification SCI
events and dissemination SCI events

649 (Recordkeeping)

Recordkeeping requirements

1,470 (Recordkeeping)

19
Nature of Information Collection Burden

Annualized Hourly Burden Estimate

TOTAL

122,666

13.

Costs to Respondents
A.

Policies and Procedures Required by Proposed Rule 1000(b)(1)

Proposed Rule 1000(b)(1) would impose recordkeeping costs for all 44 SCI entities. In
establishing, maintaining, and enforcing the policies and procedures required by proposed Rule
1000(b)(1), the Commission preliminarily believes that each SCI entity would seek outside legal
and/or consulting services in the initial preparation of such policies and procedures. The total
annualized cost of seeking outside legal and/or consulting services would be $293,333 for all
SCI entities ($20,000 cost for the first year × 44 SCI entities ÷ 3 years), or $6,666.67 per SCI
entity ($293,333 ÷ 44 SCI entities).
B.

Policies and Procedures Required by Proposed Rule 1000(b)(2)

Proposed Rule 1000(b)(2)(i) would impose recordkeeping costs for all 44 SCI entities. In
establishing, maintaining, and enforcing the policies and procedures required by proposed Rule
1000(b)(2)(i), the Commission preliminarily believes that each SCI entity would seek outside
legal and/or consulting services in the initial preparation of such policies and procedures. The
total annualized cost of seeking outside legal and/or consulting services would be $293,333
($20,000 cost for the first year × 44 SCI entities ÷ 3 years), or $6,666.67 per SCI entity
($293,333 ÷ 44 SCI entities).
C.

Mandatory Participation in Certain Testing Required by Proposed Rule
1000(b)(9)

Proposed Rule 1000(b)(9) would impose recordkeeping and reporting costs for SCI
entities that are plan processors (2 SCI entities). In complying with the mandatory testing
participation requirements under proposed Rule 1000(b)(9), the Commission preliminarily
believes that plan processors would seek outside legal services.
The Commission preliminarily estimates that the total initial recordkeeping cost of
seeking outside legal services for compliance with proposed Rule 1000(b)(9)(i)-(ii) would be
$104,000 for all plan processors ($52,000 × 2 plan processors). The Commission preliminarily
estimates that the total annual ongoing recordkeeping cost of seeking outside legal services for
compliance with proposed Rule 1000(b)(9)(i)-(ii) would be $76,000 ($38,000 × 2 plan
processors). The total annualized recordkeeping cost for complying with proposed Rule
1000(b)(9)(i)-(ii) would be $85,333.33 (($104,000 for the first year + $76,000 for the second
year + $76,000 for the third year) ÷ 3 years), or $42,666.67 per plan processor ($85,333.33 ÷ 2
plan processors).

20
The Commission preliminarily estimates that the total initial reporting cost of seeking
outside legal services for compliance with proposed Rule 1000(b)(9)(iii) would be $28,000 for
all plan processors ($14,000 × 2 plan processors). The Commission preliminarily estimates that
the total annual ongoing reporting cost of seeking outside legal services for compliance with
proposed Rule 1000(b)(9)(iii) would be $2,400 for all plan processors ($1,200 × 2 plan
processors). The total annualized reporting cost for complying with proposed Rule
1000(b)(9)(iii) would be $10,933.33 (($28,000 for the first year + $2,400 for the second year +
$2,400 for the third year) ÷ 3 years), or $5,466.67 per plan processor ($10,933.33 ÷ 2 plan
processors).
D.

Notice Required by Proposed Rule 1000(b)(4)

The Commission preliminarily does not expect SCI entities to incur any additional PRA
costs in connection with Commission notification of SCI events.
E.

Dissemination of Information Required by Proposed Rule 1000(b)(5)

Proposed Rule 1000(b)(5) would impose third party disclosure costs for all 44 SCI
entities. In complying with the information dissemination requirements under proposed Rule
1000(b)(5), the Commission believes SCI entities would seek outside legal advice in the
preparation of the information dissemination. The total annual cost of seeking outside legal
advice would be $660,000 ($15,000 per SCI entity per year × 44 SCI entities). As noted above,
because proposed Rule 1000(b)(5) would impose 43 third party disclosure requirements per SCI
entity per year, each notification would require an average of $348.84 per SCI entity ($15,000 ÷
43 requirements).
F.

Notice Required by Proposed Rule 1000(b)(6)

The Commission preliminarily does not expect SCI entities to incur any additional PRA
costs in connection with Commission notification of material systems changes.
G.

SCI Review Required by Proposed Rule 1000(b)(7)

The Commission preliminarily does not expect SCI entities to incur any additional PRA
costs in connection with SCI reviews.
H.

Reports Required by Proposed Rule 1000(b)(8)

The Commission preliminarily does not expect SCI entities to incur any additional PRA
costs in connection with the submission of reports required by proposed Rule 1000(b)(8).
I.

Requirement to Take Corrective Actions

21
The Commission preliminarily does not expect SCI entities to incur any additional PRA
costs in connection with the requirement to take corrective actions.
J.

Requirement to Identify Immediate Notification SCI Events and
Dissemination SCI Events

The Commission preliminarily does not expect SCI entities to incur any additional PRA
costs in connection with the determination of the significance of SCI events.
K.

Recordkeeping Requirements

The proposed recordkeeping requirement would impose recordkeeping costs for SCI
entities other than SCI SROs (18 SCI entities). The Commission preliminarily estimates that an
SCI entity other than an SCI SRO would incur a one-time cost of $900 to set up or modify an
existing recordkeeping system to comply with the proposed recordkeeping requirements. For
SCI entities other than SCI SROs, the total annualized cost for complying with the recordkeeping
requirement would be $5,400 ($900 in information technology costs × 18 SCI entities that are
not SCI SROs ÷ 3 years), or $300 per SCI entity that is not a SCI SRO ($5,400 ÷ 18 SCI entities
that are not SCI SROs).
L.

Summary of Cost Burdens

The table below summarizes the Commission’s preliminary estimate of the cost burdens
for SCI entities under Regulation SCI.
Nature of Information Collection Burden

Burden Estimate in Dollars

Policies and procedures required by proposed Rule $293,333 (Recordkeeping)
1000(b)(1)
Policies and procedures required by proposed Rule $293,333 (Recordkeeping)
1000(b)(2)
Mandatory participation in certain testing required
by proposed Rule 1000(b)(9)(i)-(ii)

$85,333.33 (Recordkeeping)

Mandatory participation in certain testing required
by proposed Rule 1000(b)(9)(iii)

$10,933.33 (Reporting)

Dissemination of information required by
proposed Rule 1000(b)(5)

$660,000 (Third Party Disclosure)

22
Nature of Information Collection Burden

Burden Estimate in Dollars

Recordkeeping Requirements

$5,400 (Recordkeeping)

TOTAL

$1,348,333

14.

Cost to Federal Government

The Commission will incur one-time costs related to programming, testing, and deployment
in order to establish an electronic system for Form SCI. The Commission will also incur ongoing
maintenance costs. Third party contractors will perform most of the work except for some testing
and project management, which will be performed by Commission staff. The Commission
preliminarily estimates that the total costs to establish such a system will be $900,000 initially and
$180,000 annually thereafter, or $420,000 per year annualized over three years (($900,000 for the
first year + $180,000 for the second year + $180,000 for the third year) ÷ 3 years).
While the scope of Regulation SCI is broader than the scope of the ARP Inspection
Program, the Commission believes that the resources currently devoted to the ARP Inspection
Program can be repurposed to meet many of the demands of Regulation SCI. The Commission
recognizes, however that Regulation SCI will potentially require additional technology and human
resources.
15.

Changes in Burden

Not applicable. The Commission is proposing Regulation SCI for the first time.
16.

Information Collections Planned for Statistical Purposes

Not applicable. The information collections above are not planned for statistical purposes.
17.

OMB Expiration Date Display Approval

We request authorization to omit the expiration date on the electronic version of Form
SCI, although the OMB control number will be displayed. Including the expiration date on the
electronic version of the form will result in increased costs, because the need to make changes to
the form may not follow the application’s scheduled version release dates.
18.

Exceptions to Certification for Paperwork Reduction Act Submissions

This collection complies with the requirements in 5 CFR 1320.9.
B.

Collection of Information Employing Statistical Methods
This collection does not involve statistical methods.