DGL FINAL REVISED 2019 SUPPORTING STATEMENT Rule 15c3-5

SUPPORTING STATEMENT
for the Paperwork Reduction Act Information Collection Submission for
Rule 15c3-5: Risk Management Controls for Brokers or Dealers with Market Access
A.

JUSTIFICATION
1.

Necessity of Information Collection

Rule 15c3-5 under the Securities Exchange Act of 1934 (“Exchange Act”)
requires brokers or dealers with access to trading directly on an exchange or alternative
trading system (“ATS”), including those providing sponsored or direct market access to
customers or other persons, to implement risk management controls and supervisory
procedures reasonably designed to manage the financial, regulatory, and other risks of
this business activity.
The rule requires brokers or dealers to establish, document, and maintain certain
risk management controls and supervisory procedures as well as regularly review such
controls and procedures, and document the review, and remediate issues discovered to
assure overall effectiveness of such controls and procedures. Each such broker or dealer
is required to preserve a copy of its supervisory procedures and a written description of
its risk management controls as part of its books and records in a manner consistent with
Rule 17a-4(e)(7) under the Exchange Act.1 Such regular review is required to be
conducted in accordance with written procedures and is required to be documented. The
broker or dealer is required to preserve a copy of such written procedures, and
documentation of each such review, as part of its books and records in a manner
consistent with Rule 17a-4(e)(7) under the Exchange Act, and Rule 17a-4(b) under the
Exchange Act, respectively.2
In addition, the Chief Executive Officer (or equivalent officer) is required to
certify annually that the broker or dealer’s risk management controls and supervisory
procedures comply with the rule, and that the broker-dealer conducted such review. Such
certifications are required to be preserved by the broker or dealer as part of its books and
records in a manner consistent with Rule 17a-4(b) under the Exchange Act.
1

See 17 CFR 240.17a-4(e)(7). Pursuant to Rule 17a-4(e)(7), every broker or dealer
subject to Rule 17a-3 is required to maintain and preserve in an easily accessible
place each compliance, supervisory, and procedures manual, including any
updates, modifications, and revisions to the manual, describing the policies and
practices of the broker or dealer with respect to compliance with applicable laws
and rules, and supervision of the activities of each natural person associated with
the broker or dealer until three years after the termination of the use of the
manual.

2

See 17 CFR 240.17a-4(b). Pursuant to Rule 17a-4(b), every broker or dealer
subject to Rule 17a-3 is required to preserve for a period of not less than three
years, the first two years in an easily accessible place, certain records of the
broker or dealer.

2.

Purpose and Use of the Information Collection

The rule seeks to ensure that broker-dealers, which under the current regulatory
structure are the only entities that may be members of exchanges or provide access to
trading in securities on an ATS to non-broker-dealers, and, as a practical matter,
constitute the majority of subscribers to ATSs, appropriately control the risks associated
with market access, so as not to jeopardize their own financial condition, that of other
market participants, the integrity of trading on the securities markets, and the stability of
the financial system.
3.

Consideration Given to Information Technology

Rule 15c3-5 requires a broker or dealer to apply the financial and regulatory
controls on an automated, pre-trade basis before orders route to an exchange or ATS.
The Commission believes that improvements in telecommunications and data processing
technology may reduce any burdens associated with Rule 15c3-5.
4.

Duplication

No duplication is apparent.
5.

Effect on Small Entities

A broker-dealer is a small business if its total capital (net worth plus subordinated
liabilities) on the last day of its most recent fiscal year was $500,000 or less, and is not
affiliated with any entity that is not a “small business.”3 Currently, most small brokers or
dealers, when accessing an exchange or ATS in the ordinary course of their business,
should already have risk management controls and supervisory procedures in place. In
many cases, the rule may be substantially satisfied by a small broker-dealer’s existing
financial and regulatory risk management controls and current supervisory procedures.
Further, staff discussions with various industry participants indicated that very few, if
any, small broker-dealers with market access provide other persons with “unfiltered”
access.4 Therefore, these brokers or dealers will likely only require limited updates to
their systems to meet the requisite risk management controls and other requirements in
the rule. The rule may impact small brokers or dealers that utilize risk management
technology provided by a vendor or some other third party; however, the requirement to
directly monitor the operation of the financial and regulatory risk management controls
3

17 CFR 240.0-10(c).

4

“Unfiltered” access is generally understood to be a subset of sponsored access
where pre-trade filters or controls are not applied to orders before such orders are
submitted to an exchange or ATS. The rule effectively prohibits any access to
trading on an exchange or ATS, whether sponsored or otherwise, where pre-trade
controls are not applied.

-2-

should not impose a significant cost or burden because the Commission understands that
such technology allows the broker or dealer to exclusively manage such controls.5
6.

Consequences of Not Conducting Collection

The broker-dealer, as the member of the exchange or subscriber of the ATS, is
responsible for all trading that occurs under its market participant identifier (“MPID”) or
other market identifier.6 If this information were not collected frequently, the
Commission believes that the broker-dealer would jeopardize not only its own financial
viability, but also the stability of the markets and, potentially, the financial system. The
Commission believes that this responsibility is too great to allow the requisite risk
management controls to be monitored less frequently.
7.

Inconsistencies with Guidelines in 5 CFR 1320.5(d)(2)

There are no special circumstances. This collection is consistent with the
guidelines in 5 CFR 1320.5(d)(2).
8.

Consultations Outside the Agency

The required Federal Register notice with a 60-day comment period soliciting
comments on this collection of information was published. No public comments were
received.
9.

Payment or Gift

Not applicable.
10.

Confidentiality

The information collection under Rule 15c3-5 is not confidential.
11.

Sensitive Questions

Rule 15c3-5 requires a broker-dealer to annually certify that their risk
management controls and supervisory procedures comply with the Rule, but this
certification is not reported to the Commission (except in the case of an examination).
No information of a sensitive nature, including social security numbers, will be required
under this collection of information. The agency has determined that a system of records
5

The Commission’s understanding is based on discussions with various industry
participants.

6

See, e.g., NYSE IM-89-6 (January 25, 1989); and Securities Exchange Act
Release No. 40354 (August 24, 1998), 63 FR 46264 (August 31, 1998) (NASD
NTM- 98-66).

-3-

notice (SORN) and privacy impact assessment (PIA) are not required in connection with
the collection of information.
12.

Information Collection Burden

The “collection of information” contained in Rule 15c3-5 applies to
approximately 570 brokers and dealers that have market access or provide a customer or
any other person with market access. Of these 570 brokers and dealers, the Commission
estimates that there are 370 brokers or dealers that are members of an exchange. This
estimate is based on broker-dealer responses to FOCUS report filings with the
Commission. The Commission estimates that the remaining 200 broker-dealers are not
exchange members but are broker-dealer operators of ATSs that provide access to trading
in securities to non-broker-dealers or are subscribers to ATSs. This estimate is based on
a sampling of subscriber information contained in Exhibit A to Form ATS-R filed with
the Commission.
a.

Technology

To comply with Rule 15c3-5, a respondent must maintain its risk management
system by monitoring its effectiveness and updating its systems to address any issues
detected. In addition, a respondent is required to preserve a copy of its written
description of its risk management controls as part of its books and records in a manner
consistent with Rule 17a-4(e)(7) under the Exchange Act. The Commission estimates
that the ongoing annualized burden for a potential respondent to maintain its risk
management system will be approximately 115 burden hours.7 The Commission
estimates the related internal compliance cost for this hour burden per respondent at
approximately $31,717 per year.8 The Commission believes the ongoing burden of
7

Based on discussions with industry participants, the Commission estimates that a
dedicated team of 1.5 people would be used for the ongoing maintenance of all
technology systems. The team may include one or more programmer analysts,
senior programmers, or senior systems analysts. In-house system staff size varies
depending on, among other things, the business model of the broker or dealer.
Each staff member would work 160 hours per month, or 12 months × 160 hours =
1,920 hours per year. A team of 1.5 people therefore would work 1,920 hours ×
1.5 people = 2,880 hours per year. Based on discussions with industry
participants, the Commission estimates that 4% of the team’s total work time
would be used for ongoing risk management maintenance. Accordingly, the total
number of burden hours for this task, per year, is 0.04 × 2,880 hours = 115.2
hours (approximately 115 hours).

8

The Commission estimates that the programmer analyst would work 40% of the
total hours required for ongoing maintenance, or 115 hours × 0.40 = 46 hours; the
senior programmer would work 20% of the total hours, or 115 hours × 0.20 = 23
hours; and the senior systems analyst would work 40% of the total hours, or 115
hours × 0.40 = 46 hours. The total ongoing maintenance cost for staff is
estimated to be 46 hours × $240 (hourly wage for a programmer analyst) + 23
-4-

complying with the rule’s collection of information will include, among other things,
updating systems to address any issues detected, updating risk management controls to
reflect any change in its business model, and documenting and preserving a brokerdealer’s written description of its risk management controls.9
b.

Legal and Compliance

Based on discussions with various industry participants and the Commission’s
prior experience with broker-dealers, the Commission estimates that a broker-dealer’s
legal and compliance burden of complying with Rule 15c3-5 will require approximately
45 hours per year. Specifically, compliance attorneys who review, document, and update
written compliance policies and procedures are expected to require an estimated 20 hours
per year; a compliance manager who reviews, documents, and updates written
compliance policies and procedures is expected to require 20 hours per year; and the
Chief Executive Officer, who certifies the policies and procedures, is expected to require
another 5 hours per year. The Commission estimates the related internal compliance cost
for this hour burden per respondent at approximately $25,645 per year.10
hours × $331 (hourly wage for a senior programmer) + 46 hours × $284 (hourly
wage for a senior systems analyst) = $31,717.
The $240, $331, and $284 per hour estimates for a programmer analyst, senior
programmer, and senior systems analyst, respectively is from SIFMA’s Office
Salaries in the Securities Industry 2013, modified by Commission staff to account
for an 1,800-hour work-year and inflation, and multiplied by 5.35 to account for
bonuses, firm size, employee benefits and overhead.
9

For the purposes of calculating the PRA burden, it is assumed that all brokerdealers under the rule will perform their technology development and
maintenance in-house. However, a portion of these broker-dealers may decide to
forego internal technology development and instead opt to outsource it to a thirdparty technology provider or service bureau. Alternatively, a portion of the
broker-dealers may choose to forego both in-house and outsourced technology
development, and instead purchase a technology solution directly from a thirdparty technology provider or service bureau.

10

The total ongoing legal and compliance cost is estimated to be 20 hours × $364
(hourly wage for a compliance attorney) + 20 hours × $309 (hourly wage for a
compliance manager) + 5 hours × $2,437 (hourly wage for the Chief Executive
Officer) = $25,645.
The $364 and $309 per hour estimates for a compliance attorney and compliance
manager, respectively, is from SIFMA’s Office Salaries in the Securities Industry
2013, modified by Commission staff to account for an 1,800-hour work-year and
inflation, and multiplied by 5.35 to account for bonuses, firm size, employee
benefits and overhead. The $2,437 per hour figure for a broker-dealer Chief
Executive Officer comes from the median CEO compensation of US exchangetraded broker-dealers that did not report investment banking revenues for 2014,
provided by SNL (now S&P Global Market Intelligence) and adjusted for
-5-

c.

Total Burden

The ongoing annual aggregate information collection burden per broker-dealer
would be 160 hours (115 hours (for technology) + 45 hours (for legal and compliance) =
160 hours). Under the rule, the total annualized burden for all respondents would be
approximately 91,200 hours (160 hours per broker-dealer × 570 brokers and dealers =
91,200 hours). The Commission estimates the related total internal compliance cost for
this hour burden at approximately $32,696,340 per year (($31,717 for technology +
$25,645 for legal and compliance) × 570 brokers and dealers = $32,696,340).
Rule

Burden
Type

Rule 15c3-5
(Market
Access Rule)

Periodic
570
Reporting

13.

Number of
Respondents

Number of
Annual
Responses
Per
Respondent
1

Time Per
Response
(Hours)
160

Total
Burden to
Respondents
Per Burden
Type Hours)
91,200

Costs to Respondents

For hardware and software expenses, the Commission estimates that the average
ongoing external cost would be approximately $20,500 per broker-dealer.11 For
hardware and software expenses, the total annualized external cost for all respondents
would be $11,685,000 ($20,500 per broker-dealer × 570 brokers and dealers =
$11,685,000). The estimates of the annual burdens are based on discussions with
potential respondents.
Rule

Cost Type

Rule
15c3-5
(Market
Access
Rule)

Hardware
and
software
expenses

Number of
Respondents
570

Annual Cost Per
Respondent
$20,500

Total Cost to
Respondents
$11,685,000

inflation and divided by 1800 hours per work-year. This data is available at:
https://www.snl.com/InteractiveX/Article.aspx?cdid=A-33301532-13622.
11

Industry sources estimate that for ongoing maintenance, hardware would cost
$8,900 on average and software would cost $11,600 on average. The total
average hardware and software cost for ongoing maintenance would be $8,900 +
$ 11,600 = $20,500.

-6-

14.

Costs to Federal Government

There will be no additional costs to the Federal Government.
15.

Changes in Burden

The estimates of burden under Rule 15c3-5 have decreased since the prior
submission. The total estimated hourly burden of compliance with the rule has been
reduced from 102,400 hours to 91,200 hours, and the estimated dollar cost expenses have
been reduced from $13,120,000 to $11,685,000, in each case because the Commission
has reduced its estimate of the number of broker-dealers with market access.
16.

Information Collection Planned for Statistical Purposes

Not applicable. The information collection is not used for statistical purposes.
17.

Approval to Omit OMB Expiration Date

The Commission is not seeking approval to omit the expiration date.
18.

Exceptions to Certification for Paperwork Reduction Act Submissions

This collection complies with the requirements in 5 CFR 1320.9.
B.

COLLECTIONS OF INFORMATION EMPLOYING STATISTICAL
METHODS
This collection does not involve statistical methods.

-7-