3235-0703 (Reg. SCI and Form SCI) Supporting Statement Final Rule April 2021

3235-0703 (Reg. SCI and Form SCI) Supporting Statement Final Rule April 2021.pdf

Regulation SCI and Form SCI

OMB: 3235-0703

⚠️ Notice: This form may be outdated. More recent filings and information on OMB 3235-0703 can be found here:

Document [pdf]

Download: pdf | pdf

SUPPORTING STATEMENT
for the Paperwork Reduction Act Information Collection Submission for
Regulation SCI
3235-0703
Revision Due to Final Rule
This submission is being made pursuant to the Paperwork Reduction Act of 1995, 44 U.S.C.
Section 3501 et seq.
A.

JUSTIFICATION
1.

Information Collection Necessity

Section 11A(a)(2) of the Securities Exchange Act of 1934 (“Exchange Act”), 1 enacted as
part of the Securities Acts Amendments of 1975 (“1975 Amendments”), 2 directs the
Commission, having due regard for the public interest, the protection of investors, and the
maintenance of fair and orderly markets, to use its authority under the Exchange Act to facilitate
the establishment of a national market system for securities in accordance with the Congressional
findings and objectives set forth in Section 11A(a)(1) of the Exchange Act. 3 Among the findings
and objectives in Section 11A(a)(1) is that “[n]ew data processing and communications
techniques create the opportunity for more efficient and effective market operations” 4 and “[i]t is
in the public interest and appropriate for the protection of investors and the maintenance of fair
and orderly markets to assure…the economically efficient execution of securities transactions.” 5
In addition, Sections 6(b), 15A, and 17A(b)(3) of the Exchange Act impose obligations on
national securities exchanges, national securities associations, and clearing agencies,
respectively, to be “so organized” and “[have] the capacity to…carry out the purposes of [the
Exchange Act].” 6
The U.S. securities markets have been transformed by regulatory and related
technological developments in recent years. They have, among other things, substantially
enhanced the speed, capacity, efficiency, and sophistication of the trading functions that are
available to market participants. At the same time, these technological advances generated an
increasing risk of operational problems with automated systems, including failures, disruptions,
1

15 U.S.C. 78k-1(a)(2).

Pub. L. 94-29, 89 Stat. 97 (1975).

15 U.S.C. 78k-1(a)(1).

15 U.S.C. 78k-1(a)(1)(B).

15 U.S.C. 78k-1(a)(1)(C)(i).

See 15 U.S.C. 78f(b)(1), 78o-3(b)(2), 78q-1(b)(3), respectively. See also 15 U.S.C. 78b, and 15
U.S.C. 78s.

2
delays, and intrusions. Given the speed and interconnected nature of the U.S. securities markets,
a seemingly minor systems problem at a single entity could quickly create losses and liability for
market participants, and spread rapidly across the national market system, potentially creating
widespread damage and harm to market participants, including investors.
In November 2014, the Commission adopted Regulation Systems Compliance and
Integrity (“Regulation SCI”) 7 to require certain key market participants to, among other things:
(1) have comprehensive policies and procedures in place to help ensure the robustness and
resiliency of their technological systems, and also that their technological systems operate in
compliance with the federal securities laws and with their own rules; and (2) provide certain
notices and reports to the Commission to improve Commission oversight of securities market
infrastructure. Prior to the adoption of Regulation SCI, Commission oversight of the technology
of the U.S. securities markets was conducted primarily pursuant to a voluntary set of principles
articulated in the Commission’s ARP Policy Statements, applied through the Commission’s
Automation Review Policy inspection program (“ARP Inspection Program”). Regulation SCI
was adopted to update, formalize, and expand the Commission’s ARP Inspection Program, and,
with respect to SCI entities, to supersede and replace the Commission’s ARP Policy Statements,
as well as certain rules regarding systems capacity, integrity, and security in Rule 301(b)(6) of
Regulation ATS that relate to ATSs that trade NMS and non-NMS stocks. 8
A confluence of factors contributed to the Commission’s adoption of Regulation SCI and
to the Commission’s determination that it was necessary and appropriate to address the
technological vulnerabilities, and improve Commission oversight, of the core technology of key
U.S. securities markets entities, including national securities exchanges and associations,
significant alternative trading systems, clearing agencies, and plan processors. These
considerations included: the evolution of the markets to become significantly more dependent
upon sophisticated, complex, and interconnected technology; the successes and limitations of the
ARP Inspection Program; a significant number of, and lessons learned from, systems issues at
exchanges and other trading venues; increased concerns over “single points of failure” in the
securities markets; and the views of a wide variety of commenters received in response to the
proposing release for Regulation SCI. 9
The Commission acknowledged that the nature of technology and the level of
sophistication and automation of current market systems prevent any measure, regulatory or
otherwise, from completely eliminating all systems disruptions, intrusions, or other systems
issues. However, the Commission believed that the adoption of, and compliance by SCI entities
with Regulation SCI would advance the goals of the national market system by enhancing the
capacity, integrity, resiliency, availability, and security of the automated systems of entities
7

Securities and Exchange Act Release No. 34-73639 (November 19, 2014), 79 FR 72251
(December 5, 2014).

See 17 CFR 242.301(b)(6)(i)(A) and 17 CFR 242.301(b)(6)(i)(B).

Securities Exchange Act Release No. 69077 (March 8, 2013), 78 FR 18083 (March 25, 2013)
(“SCI Proposal”).

3
important to the functioning of the U.S. securities markets, as well as reinforce the requirement
that such systems operate in compliance with the Exchange Act and rules and regulations
thereunder, thus strengthening the infrastructure of the U.S. securities markets and improving its
resilience when technological issues arise. In this respect, Regulation SCI established an
updated and formalized regulatory framework, thereby helping to ensure more effective
Commission oversight of such systems.
As adopted, Rule 1001(a) requires each SCI entity to establish, maintain, and enforce
written policies and procedures for systems capacity, integrity, resiliency, availability, and
security. Rule 1001(b) requires each SCI entity to establish, maintain, and enforce written
policies and procedures to ensure that its SCI systems operate in a manner that complies with the
Exchange Act, the rules and regulations thereunder, and the SCI entity’s rules and governing
documents, as applicable. Rule 1001(c) requires each SCI entity to establish, maintain, and
enforce written policies and procedures for the identification, designation, and documentation of
responsible SCI personnel and escalation procedures. Rule 1002(a) requires each SCI entity to
begin to take appropriate corrective action upon any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred. Rule 1002(b) requires each SCI
entity to notify the Commission of certain SCI events. Rule 1002(c) requires each SCI entity,
with certain exceptions, to disseminate information about SCI events to affected members or
participants, and disseminate information about major SCI events to all members or participants.
Rule 1003(a) requires each SCI entity to notify the Commission of material systems changes
quarterly. Rule 1003(b) requires each SCI entity to conduct annual SCI reviews. Rule 1004
requires each SCI entity to designate certain members or participants for participation in
functional and performance testing of the SCI entity’s business continuity and disaster recovery
(“BC/DR”) plans, and to coordinate such testing with other SCI entities. Rules 1005 and 1007
set forth recordkeeping requirements for SCI entities. Rule 1006 requires, with certain
exceptions, that each SCI entity electronically file required notifications, reviews, descriptions,
analysis, or reports to the Commission on Form SCI.
The Commission estimates that there are currently 42 entities that meet the definition of
SCI entity and are subject to the collection of information requirements of Regulation SCI. Of
these 42 respondents, 32 would meet the definition of SCI SRO, 5 would meet the definition of
SCI ATS, 2 would meet the definition of plan processor, and 3 would meet the definition of
exempt clearing agency subject to ARP. The Commission estimates that approximately 2
entities will become SCI entities each year, one of which will be an SRO. Accordingly, over the
next three years, the Commission estimates that there will be an average of approximately 44
SCI entities each year.
Revision to the Information Collection
In February 2020, the Commission proposed to update the national market system for the
collection, consolidation, and dissemination of information with respect to quotations for and
transactions in national market system (“NMS”) stocks (“Infrastructure Proposal” or

4
“Proposal”). 10 Specifically, the Commission proposed to expand the content of the information
with respect to quotations for and transactions in NMS stocks that must be made available under
Regulation NMS and introduce a decentralized consolidation model whereby “competing
consolidators” would assume responsibility for the collection, consolidation, and dissemination
functions currently performed by the exclusive Securities Information Processors (“SIPs”).
Among other things, the Commission proposed to expand the definition of “SCI entity” to
include competing consolidators, so that all competing consolidators would be subject to
Regulation SCI.
The Commission adopted these amendments, with certain modifications, on December 9,
2020 (“Infrastructure Rules”). Specifically, the Commission adopted a definition of “SCI
competing consolidator” that will subject competing consolidators to Regulation SCI, after a
transition period, if they are above a specified consolidated market data gross revenue
threshold. 11 The modification from the Proposal to subject only certain competing consolidators,
rather than all competing consolidators, to Regulation SCI was based on the Commission’s
recognition of the more limited role that certain competing consolidators may play in the
securities markets and commenter concerns regarding the costs and potential barriers to entry
that could result from requiring compliance with all of the requirements of Regulation SCI for all
competing consolidators.
In the Infrastructure Proposal, the Commission estimated that, if adopted, there would be
12 competing consolidators who would be SCI entities. Of the 12 competing consolidators, the
Commission estimated that two would be the existing SIPs, which are currently subject to
Regulation SCI as plan processors. As such, the Commission believed that these entities would
have no material new initial burdens and that ongoing burden estimates discussed below for
other existing SCI entities would be applicable to these entities. The Commission believed that
four of the remaining 10 entities would be either an SRO currently subject to Regulation SCI or
an entity affiliated with an SCI SRO subject to Regulation SCI. The Commission believed that
these four entities, in their new( role as competing consolidators, would have 50 percent of the
estimated initial burdens of other new SCI entities, and the same estimated ongoing burdens for
all SCI entities. Of the remaining six competing consolidators, the Commission believed that
10

See Securities Exchange Act Release No. 34-88216 (February 14, 2020), 85 FR 16726
(March 24, 2020) (File No. S7-03-20) (“Proposing Release”).

See Securities Exchange Act Release No. 34-90610 (December 9, 2020), 86 FR 18596
(April 9, 2021) (File No. S7-03-20) (“Infrastructure Adopting Release”). An “SCI
competing consolidator” is defined in Rule 1000 of Regulation SCI to mean “any
competing consolidator, as defined in §242.600 which during at least four of the
preceding six calendar months, accounted for five percent (5%) or more of consolidated
market data gross revenue paid to the effective national market system plan or plans
required under §242.603(b) for NMS stocks (1) listed on the New York Stock Exchange
LLC, (2) listed on The Nasdaq Stock Market LLC, or (3) listed on national securities
exchanges other than the New York Stock Exchange LLC or The Nasdaq Stock Market
LLC, as reported by such plan or plans pursuant to the terms thereof.”

5
they would have the same estimated initial burdens as other new SCI entities and the same
estimated ongoing burdens as all other SCI entities.
The Commission is not revising the burden hour estimates per entity that it set forth in the
Infrastructure Proposal; however, it has revised its estimate of the number of competing
consolidators (i.e., respondents) that will be subject to the collection of information requirements
of Regulation SCI. Based on comments regarding the number of persons who could decide to
perform the functions of a competing consolidator, the Commission has adjusted its estimate
downward to eight such persons. In light of the reduction of the estimated competing
consolidators to eight, and the 5% revenue threshold that the Commission has adopted in the
definition of “SCI competing consolidator,” the Commission now estimates that seven
competing consolidators will meet this definition and be subject to the requirements of
Regulation SCI. Of the seven competing consolidators subject to the requirements of Regulation
SCI, the Commission believes: two may be the existing exclusive SIPs, which are currently
subject to Regulation SCI as plan processors; one may be an existing SCI SRO or entity
affiliated with an SCI SRO that is subject to Regulation SCI; and four may be entities not
currently subject to Regulation SCI, such as market data aggregation firms, broker-dealers that
currently aggregate market data for internal uses, and entities that would be entering the market
data aggregation business for the first time. However, the Commission is only revising the
estimated number of respondents; the estimated burdens per respondent are the same as
proposed.
2.

Information Collection Purpose and Use
a. Policies and Procedures Required by Rule 1001

Rule 1001(a) helps to advance the goal of improving Commission review and oversight
of U.S. securities market infrastructure by requiring an SCI entity’s policies and procedures to be
reasonably designed to ensure its own operational capability, including the ability to maintain
effective operations, minimize or eliminate the effect of performance degradations, and have
sufficient backup and recovery capabilities. Because an SCI entity’s own operational capability
can have the potential to impact investors, the overall market, or the trading of individual
securities, the Commission believes that these policies and procedures will help promote the
maintenance of fair and orderly markets. Rule 1001(b) helps to prevent the occurrence of
systems compliance issues, and helps SCI entities to achieve operational compliance with the
Exchange Act, the rules and regulations thereunder, and their governing documents. Rule
1001(c) helps make it clear to all employees of the SCI entity who the designated responsible
SCI personnel are for purposes of the escalation procedures and so that Commission staff can
easily identify such responsible SCI personnel in the course of its inspections and examinations
and other interactions with SCI entities. The Commission also believes that escalation
procedures to quickly inform responsible SCI personnel of potential SCI events helps ensure that
the appropriate person(s) are provided notice of potential SCI events so that any appropriate
actions can be taken in accordance with the requirements of Regulation SCI without unnecessary
delay.

6
b. Mandate Participation in Certain Testing Required by Rule 1004
Rule 1004 helps reduce the risks associated with an SCI entity’s decision to activate its
BC/DR plans and helps to ensure that such plans operate as intended, if activated. It also helps
an SCI entity to ensure that its efforts to develop effective BC/DR plans are not undermined by a
lack of participation by members or participants that the SCI entity believes are necessary to the
successful activation of such plans. Rule 1004 also assists the Commission in maintaining fair
and orderly markets in a BC/DR scenario following a wide-scale disruption.
c. SCI Event Notice Required by Rule 1002(b)
Rule 1002(b) fosters a system for comprehensive reporting of SCI events, which
enhances the Commission’s review and oversight of U.S. securities market infrastructure and
fosters cooperation between the Commission and SCI entities in responding to SCI events. The
Commission also believes that the aggregated data from the reporting of SCI events enhances its
ability to comprehensively analyze the nature and types of various SCI events and identify more
effectively areas of persistent or recurring problems across the systems of all SCI entities. The
information in the final report required under Rule 1002(b)(4) provides the Commission with a
comprehensive analysis to more fully understand and assess the impact caused by an SCI event.
The quarterly report required by Rule 1002(b)(5) achieves the goal of keeping Commission staff
informed regarding the nature and frequency of systems disruptions and systems intrusions that
arise but are reasonably estimated by the SCI entity to have a de minimis impact on the entity’s
operations or on market participants. Further, submission and review of regular reports
facilitates Commission staff comparisons among SCI entities and thereby permits the
Commission and its staff to have a more holistic view of the types of systems operations
challenges that were posed to SCI entities in the aggregate.
d. Dissemination of Information Required by Rule 1002(c)
Rule 1002(c) advances the Commission’s goal of promoting fair and orderly markets by
disseminating information about an SCI event to some or all of the SCI entity’s members or
participants, who can use such information to evaluate the event’s impact on their trading and
other activities and develop an appropriate response.
e. Material Systems Change Notice Required by Rule 1003(a)
Rule 1003(a) permits the Commission and its staff to have up-to-date information
regarding an SCI entity’s systems development progress and plans, and helps the Commission
with its oversight of U.S. securities market infrastructure.
f. SCI Review Required by Rule 1003(b)
The SCI reviews under Rule 1003(b) not only assist the Commission in improving its
oversight of the technology infrastructure of SCI entities, but also assist each SCI entity in
assessing the effectiveness of its information technology practices, helping to ensure compliance

7
with the safeguards provided by the requirements of Regulation SCI, identifying potential areas
of weakness that require additional or modified controls, and determining where to best devote
resources.
g. Access to EFFS
Rule 1006 provides a uniform manner in which the Commission receives—and SCI
entities provide—written notifications, reviews, descriptions, analyses, or reports made pursuant
to Regulation SCI. Rule 1006 therefore allows SCI entities to efficiently draft and file the
required reports on Form SCI, and the Commission to efficiently review, analyze, and respond to
the information provided. SCI entities submit Form SCI through the electronic form filing
system (“EFFS”), which is also used by SCI SROs to file Form 19b-4 filings. In order to access
EFFS, an SCI entity submits to the Commission an External Application User Authentication
Form (“EAUF”) to register each individual at the SCI entity who access the EFFS system on
behalf of the SCI entity. The information provided via EAUF is used by the Commission to
verify the identity of the individual submitting Form SCI on behalf of the SCI entity and provide
such individual access to the EFFS.
h. Corrective Action Required by Rule 1002(a)
Rule 1002(a) helps facilitate SCI entities’ responses to SCI events, including taking
appropriate steps necessary to remedy the problem or problems causing such SCI event and
mitigate the negative effects of the SCI event, if any, on market participants and the securities
markets more broadly.
i. Identification of Critical SCI Systems, Major SCI Events, De Minimis SCI events,
and Material Systems Changes
The requirement in Rule 1003(a) that each SCI entity establish written criteria for
identifying material systems changes helps the Commission ensure that it is kept apprised of the
systems changes that SCI entities believe to be material and aids the Commission and its staff in
understanding the operations and functionality of the systems of an SCI entity and any changes
to such systems.
The application of different requirements (e.g., Commission notification requirements
and information dissemination requirements) to critical SCI systems, major SCI events, and de
minimis SCI events, and the policies and procedures required by SCI entities to make these
determinations, helps to ensure that the Commission is kept apprised of SCI events, and that
relevant market participants have basic information about SCI events so that those notified can
better develop an appropriate response. These policies and procedures also assist SCI entities in
complying with the notification, dissemination and reporting requirements of Regulation SCI.
j. Recordkeeping Required by Rules 1005 and 1007
Rule 1005 assists the Commission in understanding whether an SCI entity is meeting its

8
obligations under Regulation SCI, assessing whether an SCI entity has appropriate policies and
procedures with respect to its technology systems, helping to identify the causes and
consequences of an SCI event, and understanding the types of material systems changes
occurring at an SCI entity. Rule 1005 also facilitates the Commission’s inspections and
examinations of SCI entities and assists it in evaluating an SCI entity’s compliance with
Regulation SCI. Moreover, having an SCI entity’s records available even after it has ceased to
do business or to be registered under the Exchange Act provides an additional tool to help the
Commission to reconstruct important market events and better understand the impact of such
events.
Rule 1007 helps ensure the Commission’s ability to obtain required records that are held
by a third party who may not otherwise have an obligation to make such records available to the
Commission.
3.

Consideration Given to Information Technology

With a few exceptions, Regulation SCI requires SCI entities to submit any notification,
review, description, analysis, or report to the Commission electronically on Form SCI.
Regulation SCI is designed to streamline the reporting processes and make the processes
efficient by specifying the information required to be provided and requiring SCI entities to
electronically file Form SCI. SCI entities submit Form SCI through the EFFS, which is also
used by SCI SROs to file Form 19b-4 filings.
4.

Duplication

Regulation SCI replaced the two ARP policy statements and related staff guidance.
However, although Regulation SCI codifies in a Commission rule many of the principles of the
ARP policy statements, the rule has a broader scope than those statements.
Regulation SCI also superseded and replaced aspects of the ARP policy statements
codified in Rule 301(b)(6) of Regulation ATS, applicable to significant-volume ATSs that trade
NMS stocks and non-NMS stocks. Because Regulation SCI replaced the ARP policy statements,
related staff guidance, and aspects of Rule 301(b)(6) applicable to significant-volume ATSs that
trade NMS stocks and non-NMS stocks, Regulation SCI does not duplicate any existing
information collection.
With regard to any FINRA rules applicable to ATSs, the Commission does not believe
that these rules provide a comprehensive regulatory scheme relating to the capacity, integrity,
resiliency, availability, and security of SCI systems comparable to Regulation SCI.
5.

Effect on Small Entities

Not applicable. None of the respondents subject to the information collection will be a
small entity.

9
6.

Consequences of Not Conducting Collection

The collection of information is designed to ensure that SCI entities operate with adequate
capacity, integrity, resiliency, availability, and security, and in compliance with the Exchange Act
and relevant rules. Any less frequent collection would deprive the Commission of timely
information regarding systems issues and systems changes at SCI entities and SCI entities’
compliance with Regulation SCI. Any less frequent collection also would deprive the Commission
and members or participants of SCI entities of timely information regarding the occurrence and
resolution of systems issues.
7.

Inconsistencies with Guidelines in 5 CFR 1320.5(d)(2)

Several provisions of Regulation SCI require respondents to report information to the
agency more often than quarterly. These provisions include Rules 1002(b), 1002(c), and Rule
1003(a), which generally involve the provision of certain types of notifications involving an SCI
event (e.g., a systems disruption, a systems intrusion, or a systems compliance issue), either to the
Commission or to a third party, and notification to the Commission of material systems changes.
Depending on the frequency of SCI events (with exceptions for certain SCI events), SCI entities
may be required to provide information to the Commission or disseminate information to their
members or participants more than once per quarter. However, the Commission believes that
timely and comprehensive reporting of SCI events to the Commission enhance its oversight of
U.S. securities market infrastructure and foster cooperation between the Commission and SCI
entities in responding to SCI events. For example, timely receipt of information regarding an
SCI event helps the Commission and its staff to quickly assess the nature and scope of that SCI
event, and potentially assist the SCI entity in identifying the appropriate response. Further, the
Commission believes the timely dissemination of information about certain SCI events to
member or participants of SCI entities helps members or participants to quickly assess the nature
and scope of those SCI events and whether and how they were affected by the events, and make
appropriate decisions based on those assessments.
In addition, SCI entities may be required to provide information to the Commission
regarding material systems changes more often than quarterly. In particular, although Rule
1003(a) requires quarterly reports of material systems changes, it also requires prompt
supplemental reports notifying the Commission of a material error in or material omission from a
previously submitted report. The Commission believes that it should, on an ongoing basis, have
complete and correct information regarding material systems changes at an SCI entity, rather
than waiting until the next quarterly report to receive corrected information.
Rule 1005(b) requires each SCI entity (other than an SCI SRO) to make, keep, and
preserve at least one copy of all documents relating to its compliance with Regulation SCI for a
period of not less than five years, the first two years in a place that is readily accessible to the
Commission or its representatives for inspection and examination. The Commission notes that
these recordkeeping time periods are consistent with those currently applicable to self-regulatory
organizations (including SCI SROs) under Rule 17a-1 under the Exchange Act.

10
Finally, information submitted to the Commission under Regulation SCI could include
proprietary trade secret or other confidential information. However, if a confidential treatment
request is properly made, the Commission will keep the information collected pursuant to Form
SCI confidential to the extent permitted by law. 12
8.

Consultations Outside the Agency

The Commission published a proposing release with respect to the Infrastruture Proposal
soliciting comments on the proposed amendments’ requirements and associated paperwork
burdens. 13 Comments on Commission releases are generally received from industry groups,
investors, and other market participants. In addition, the Commission and staff participated in
ongoing dialogue with representatives of various market participants through public conferences,
meetings, and informal exchanges. Any comments received on this proposed rulemaking were
posted on the Commission’s public website and made available through
www.sec.gov/rules/proposed.shtml. The Commission considered all comments received prior to
publishing the final rule, and explained in the Infrastructure Adopting Release how the final rule
responds to such comments, in accordance with 5 C.F.R. 1320.11(f).
In particular, as discussed in the Infrastructure Adopting Release, two commenters stated
that the Commission underestimated the costs of compliance with Regulation SCI. 14 One
commenter stated that such compliance would require the development of technology
environments for production, disaster recovery, development/quality assurance, and customer
testing, and as such, the initial costs would greatly exceed the Commission’s estimates, possibly
by three to four times the amount. 15 However, as the Commission explained in the
Infrastructure Adopting Release, competing consolidators may choose to develop four separate
environments in the interest of resiliency and redundancy as suggested by this commenter,
however, Regulation SCI does not prescribe this approach. While Regulation SCI does require
SCI entities to maintain business continuity and disaster recovery plans which would include the
development of technology environments for disaster recovery, the Commission included
paperwork burdens related to this requirement in its estimates. In contrast, non-production
systems are excluded from the scope of Regulation SCI16 and as such, burden estimates related
to such systems are excluded from the Commission’s burden estimates. Further, the
Commission believes that the burdens for competing consolidators that are subject to Regulation
SCI would be the same as those the Commission has previously estimated for other SCI entities
(or a percentage thereof if already an SCI entity or an affiliate thereof as described above), as the
12

See, e.g., 15 U.S.C. 78x (governing the public availability of information obtained by the
Commission); 5 U.S.C. 552 et seq. (Freedom of Information Act); 17 CFR 240.24b-2.

See Proposing Release, supra note 10.

See IDS Letter I at 13 and STANY Letter II at 6–7.

IDS Letter I at 13.

See SCI Adopting Release at 72273.

11
requirements are the same for all SCI entities. The Commission’s 2018 burden estimates were
based on the Commission’s experience over three years subsequent to Regulation SCI’s adoption
in 2014 including, for example, Commission staff’s experience in conducting examinations of
SCI entities and receiving and reviewing notifications and reports required by Regulation SCI.
For these reasons, the Commission does not agree with the assertions of this commenter that the
estimates of initial burdens were underestimated.
Another commenter stated that the Commission underestimated the ongoing cost of
compliance with Regulation SCI. 17 The estimate amounts cited by this commenter, however,
were of non-paperwork related costs and were given in regard to a potential alternative that the
Commission had considered of not extending all of the requirements of Regulation SCI to
competing consolidators, but instead only imposing a broad policies and procedures requirement.
Some commenters expressed concern that the costs of SCI compliance would be a barrier
to entry and could deter entities from seeking to become competing consolidators. 18 Similarly,
several commenters, although not citing Regulation SCI specifically, expressed general
skepticism about the ability to attract new entrants to register as competing consolidators, citing
among other factors, potential lack of economic incentives. As noted above, in response to these
comments, the Commission determined to adopt a defintion of “SCI competing consolidator” to
apply the requirements of Regulation SCI only to those competing consolidators who meet the
consolidated market data gross revenue threshold set forth in the definition. As noted above, as a
result of this change, as well as a revised estimate based on comments regarding the number of
persons who could decide to perform the functions of a competing consolidator, the Commission
has reduced its estimated number of respondents.
9.

Payment or Gift

Not applicable.
10.

Confidentiality

The Commission expects that the written policies and procedures, processes, criteria,
standards, or other written documents developed or revised by SCI entities pursuant to
Regulation SCI will be retained by SCI entities in accordance with, and for the periods specified
in Exchange Act Rule 17a-1 and Rule 1005, as applicable. Should such documents be made
available for examination or inspection by the Commission and its representatives, they would be

See STANY Letter II at 6–7.

See NYSE Letter II at 15; ACTIV Financial Letter at 2; IDS Letter I at 13; STANY
Letter II at 6–7; Angel Letter at 19–21. See also TD Ameritrade Letter at 13; Nasdaq
Letter III at 4.

12
kept confidential subject to the provisions of applicable law. 19 In addition, the information
submitted to the Commission pursuant to Regulation SCI that is filed on Form SCI is treated as
confidential, subject to applicable law, including amended Rule 24b-2. 20 The information
disseminated by SCI entities pursuant to Rule 1002(c) under Regulation SCI to their members or
participants is not confidential.
11.

Sensitive Questions

No information of a sensitive nature, including social security numbers, will be required
under this collection of information. The information collection collects basic Personally
Identifiable Information (PII) that may include name, telephone and fax number, email address, user
ID and job title. However, the agency has determined that the information collection does not
constitute a system of record for purposes of the Privacy Act, since the information is not retrieved
by a personal identifier. In accordance with Section 208 of the E-Government Act of 2002, the
agency has conducted a Privacy Impact Assessment (PIA) of the SRO Rule Tracking/Electronic
Form Filing System (SRTS/EFFS), in connection with this collection of information. The
SRTS/EFFS PIA, published on September 30, 2013, is also available at
https://www.sec.gov/privacy.
12.

Information Collection Burden
a. Policies and Procedures Required by Rule 1001(a)

Rule 1001(a) establishes recordkeeping burdens for SCI entities. However, certain
burdens will be different for current SCI entities and new SCI entities.
Rule 1001(a) requires each SCI entity to establish, maintain, and enforce written policies
and procedures reasonably designed to ensure that its SCI systems and, for purposes of security
standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and
security, adequate to maintain the SCI entity’s operational capability and promote the
maintenance of fair and orderly markets.
The Commission estimates that approximately 2 entities will become SCI entities each
year. A new SCI entity will require an average of 534 burden hours initially to develop and
draft the policies and procedures required by Rule 1001(a) (except for the policies and
procedures required by paragraph (a)(2)(vi) for standards that result in systems being designed,
developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful
21

Id.

This estimate for new SCI entities does not include SCI competing consolidators under the
Infrastructure Rules. Competing consolidators that would become SCI entities are discussed
separately throughout this analysis.

13
collection, processing, and dissemination of market data, which is discussed below), or 1,068 22
hours annually for all such SCI entities. With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator that is currently an SRO or affiliated
with an SRO 23 would have 50% of the estimated initial burdens for a new SCI entity, which will
require an average of 267 burden hours. 24 Four SCI competing consolidators that are not already
subject to Regulation SCI would have the same burdens as other new SCI entities (534 hours), or
2,136 hours annually for all such new SCI entities. The total average initial burden, including
the Infrastructure Rules, for all such SCI entities would be 3,471 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this initial recordkeeping burden would be $178,418 for each new SCI entity, 25 or $356,836
for all such new SCI entities. 26 With respect to the Infrastructure Rules, the Commission
estimates that one SCI competing consolidator would have 50% of the estimated average annual
internal cost of compliance for a new SCI entity, which would be $89,209. Four SCI competing
consolidators would have the same costs as other new SCI entities ($178,418), or $713,672 for
all such new SCI competing consolidators. The total annual internal cost of compliance
associated with this initial recordkeeping burden, including the Infrastructure Rules, for all such
SCI entities would be $1,159,717.
The Commission estimates that an SCI entity will require an average of 87 hours
annually to review and update such policies and procedures, or 3,828 hours annually for all such
SCI entities. 27 With respect to the Infrastructure Rules, the Commission notes that two of the
seven SCI competing consolidators that are the existing SIPs would instead become SCI
competing consolidators and would have no additional burden (i.e., they have been included in
the above estimates). The remaining five SCI competing consolidators would have the same
average ongoing burden as other SCI entities (87 hours each annually), or 435 hours annually for
all such SCI competing consolidators. The total average annual ongoing burden, including the
Infrastructure Rules, for all SCI entities would be 4,263 hours.
22

534 hours × 2 new SCI entities = 1,068 hours.

Two of the seven SCI competing consolidators that are existing SIPs would be operating a
substantially similar business and performing a similar function in their new role as SCI
competing consolidators and therefore the Commission believes they would not have any material
initial burdens to comply with the requirements of Regulation SCI.

Because the Commission is estimating a lower initial burden for this subset of SCI entities than
for other new SCI entities, the burden hours per respondent will reflect an average of the burden
estimates for all respondents.

(192 Compliance Manager hours x $307) + (192 Attorney hours x $412) + (60 Senior Systems
Analyst hours x $282) + (60 Operations Specialist hours x $135) + (20 Chief Compliance Officer
hours x $526) + (10 Director of Compliance hours x $483) = $178,418.

$178,418 x 2 = $356,836. See also supra note 21.

87 hours × 44 SCI entities = 3,828 hours.

14
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden would be $31,143 for each SCI entity, 28 or $1,370,292
for all such SCI entities. 29 With respect to the Infrastructure Rules, the Commission notes that
two of the seven SCI competing consolidators that are the existing SIPs would instead become
SCI competing consolidators and would have no additional cost (i.e., they have been included in
the above estimates). The remaining five SCI competing consolidators would have the same
average annual internal cost of compliance as other SCI entities ($31,143 each), or $155,715 for
all such SCI competing consolidators. The total average internal cost of compliance, including
the Infrastructure Rules, for all such SCI entities would be $1,526,007.
With respect to the requirement in Rule 1001(a)(2)(vi) for policies and procedures that
provide for standards that result in systems being designed, developed, tested, maintained,
operated, and surveilled in a manner that facilitates the successful collection, processing, and
dissemination of market data, the Commission estimates that each new SCI entity will spend, on
average, 160 hours initially, or 320 hours annually for all new SCI entities. 30 With respect to the
Infrastructure Rules, the Commission estimates that one SCI competing consolidator that is
currently an SRO or affiliated with an SRO 31 would have 50% of the estimated initial burdens
for a new SCI entity, which will require an average of 80 burden hours. 32 Four SCI competing
consolidators that are not already subject to Regulation SCI would have the same burdens as
other new SCI entities (160 hours each), or 640 hours annually for all such new SCI entities.
The total average initial burden, including the Infrastructure Rules, for all such SCI entities
would be 1,040 hours.
The Commission estimates that the average internal cost of compliance associated with
this initial recordkeeping burden would be $54,410 for each new SCI entity, 33 or $108,820

(28 Compliance Manager hours x $307) + (28 Attorney hours x $412) + (8 Senior Systems
Analyst hours x $282) + (8 Operations Specialist hours x $135) + (10 Chief Compliance Officer
hours x $526) + (5 Director of Compliance hours x $483) = $31,143.

$31,143 x 44 = $1,370,292.

160 hours × 2 new SCI entities = 320 hours.

Two of the seven SCI competing consolidators that are existing SIPs would be operating a
substantially similar business and performing a similar function in their new role as competing
consolidators and therefore the Commission believes would not have an initial burden under Rule
1001(a)(2)(vi).

(30 Compliance Attorney hours x $362) + (100 Senior Systems Analyst hours x $282) + (20
Chief Compliance Officer hours x $526) + (10 Director of Compliance hours x $483) = $54,410.

15
annually for all such new SCI entities. 34 With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator would have 50% of the estimated
average annual internal cost of compliance for a new SCI entity, which would be $27,205. Four
SCI competing consolidators would have the same costs as other new SCI entities ($54,410) or
$217,640for all such new SCI competing consolidators. The total annual internal cost of
compliance associated with this initial recordkeeping burden, including the Infrastructure Rules,
for all such SCI entities would be $353,665.
The Commission estimates that each SCI entity will spend, on average, 145 hours
annually to review and update such policies and procedures, or 6,380 hours annually, on average,
for all such SCI entities. 35 With respect to the Infrastructure Rules, the Commission notes that
two of the seven SCI competing consolidators that are the existing SIPs would have no
additional burden (i.e., they have been included in the above estimates). The remaining five SCI
competing consolidators would have the same average ongoing burden as other SCI entities (145
hours each annually), or 725 hours annually for all such SCI competing consolidators. The total
average ongoing burden, including the Infrastructure Rules, for all SCI entities would be 7,105
hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden would be $46,735 for each SCI entity, 36 or $2,056,340
annually for all such SCI entities. 37 With respect to the Infrastructure Rules, the Commission
notes that two of the seven SCI competing consolidators that are the existing SIPs would have no
additional cost (i.e., they have been included in the above estimates). The remaining five SCI
competing consolidators would have the same average annual internal cost of compliance as
other SCI entities ($46,735 each), or $233,675 for all such SCI competing consolidators. The
total average internal cost of compliance, including the Infrastructure Rules, would be
$2,290,015.
In summary, the Commission estimates that the total average annual initial recordkeeping
burden for complying with Rule 1001(a) for new SCI entities is 1,388 hours, or 694 hours per
new SCI entity, and the total average annual ongoing recordkeeping burden for SCI entities is
10,208 hours, or approximately 232 hours per SCI entity. The Commission estimates that the
total average annual initial recordkeeping burden for complying with Rule 1001(a) for SCI
competing consolidators is 3,123 hours, or approximately 625 hours per competing consolidator
(that is not currently a SIP), 38 and the total average annual ongoing recordkeeping burden for
34

$54,410 x 2 = $108,820.

145 hours × 44 SCI entities = 6,380 hours.

(30 Compliance Attorney hours x $362) + (100 Senior Systems Analyst hours x $282) + (10
Chief Compliance Officer hours x $526) + (5 Director of Compliance hours x $483) = $46,735.

$46,735 x 44 = $2,056,340.

This estimate is an average across five SCI competing consolidators, but as discussed

16
SCI competing consolidators is 1,160 hours, or approximately 232 hours per competing
consolidator.
The Commission estimates that:
• The total average annual initial recordkeeping burden for complying with
Rule 1001(a), including the Infrastructure Rules, is 4,511 hours, and
•

The total average annual ongoing recordkeeping burden for complying with
Rule 1001(a), including the Infrastructure Proposal, is 11,368 hours.
b. Policies and Procedures Required by Rule 1001(b)

Rule 1001(b) establishes recordkeeping burdens for all SCI entities. However, certain
burdens will be different for SCI entities that are SCI SROs and SCI entities that are not SCI
SROs.
Rule 1001(b) requires each SCI entity to establish, maintain, and enforce written policies
and procedures reasonably designed to ensure that its SCI systems operate in a manner that
complies with the Exchange Act and the rules and regulations thereunder and the entity’s rules
and governing documents, as applicable.
The Commission estimates that a new SCI entity will spend 270 hours initially to design
the systems compliance policies and procedures, or 540 hours annually for all new SCI entities. 39
With respect to the Infrastructure Rules, the Commission estimates that one SCI competing
consolidator that is currently an SRO or affiliated with an SRO would have 50% of the estimated
initial burdens for a new SCI entity, which will require an average of 135 burden hours. 40 Four
SCI competing consolidators that are not already subject to Regulation SCI would have the same
burdens as other new SCI entities (270 hours), or 1,080 hours annually for all such new SCI
entities. The total average initial burden, including the Infrastructure Rules, for all such SCI
entities would be would be 1,755 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this initial recordkeeping burden would be $101,580 for each new SCI entity, 41 or $203,160
above one of the expected SCI competing consolidators that is currently an SRO is
estimated to have only a 50% initial burden.
39

270 hours × 2 new SCI entities = 540 hours.

(40 Compliance Attorney hours x $362) + (200 Senior Systems Analyst hours x $282) + (20
Chief Compliance Officer hours x $526) + (10 Director of Compliance hours x $483) = $101,580.

17
annually for all such new SCI entities. 42 With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator would have 50% of the estimated
average annual internal cost of compliance for a new SCI entity, which would be $50,790.
FourSCI competing consolidators would have the same costs as other new SCI entities
($101,580), or $406,320 for all such new SCI competing consolidators. The total annual internal
cost of compliance associated with this initial recordkeeping burden, including the Infrastructure
Rules, for all such SCI entities would be $660,270.
The Commission estimates that each SCI SRO will spend, on average, 175 hours
annually to review and update such policies and procedures, or 5,775 hours for all SCI SROs. 43
The Commission estimates that each SCI entity that is not an SRO will spend, on average, 95
hours annually to review and update such policies and procedures, or 1,045 hours for all such
SCI entities. 44 With respect to the Infrastructure Rules, the Commission notes that two of the
seven SCI competing consolidators that are the existing SIPs would instead become SCI
competing consolidators and would have no additional burden (i.e., they have been included in
the above estimates). The Commission estimates that the remaining five SCI competing
consolidators would have the same burdens as each SCI entity that is not an SRO (hereafter, a
“non-SRO SCI entity’) (95 hours), 45 or 475 burden hours annually for all such SCI competing
consolidators. The total average annual ongoing burden, including the Infrastructure Rules, for
all SCI entities would be 7,295 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden would be $54,875 for each SCI SRO, 46 or $1,810,875
for all such SCI entities. 47 The Commission estimates that the average annual internal cost of
compliance associated with this ongoing recordkeeping burden would be $31,355 for each SCI
entity that is not an SRO, 48 or $344,905 for all such SCI entities. 49 With respect to the
Infrastructure Rules, the Commission notes that two of the seven SCI competing consolidators
that are the existing SIPs would instead become SCI competing consolidators and would have no
additional burden (i.e., they have been included in the above estimates). The Commission
42

$54,410 x 2 = $108,820.

175 hours × 33 SCI SROs = 5,775 hours.

95 hours × 11 non-SRO SCI entities = 1,045 hours.

Although one of the five competing consolidators is an SRO or affiliated with an SRO, the
Commission believes that SRO competing consolidators would have the same burdens as a non
SRO SCI entity for these particular ongoing burdens.

(26 Compliance Attorney hours x $362) + (134 Senior Systems Analyst hours x $282) + (10
Chief Compliance Officer hours x $526) + (5 Director of Compliance hours x $483) = $54,875.

$54,875 x 33 = $1,810,875.

(14 Compliance Attorney hours x $362) + (66 Senior Systems Analyst hours x $282) + (10 Chief
Compliance Officer hours x $526) + (5 Director of Compliance hours x $483) = $31,355.

$31,355 x 11 = $344,905.

18
estimates that the remaining five SCI competing consolidators would have the same average
internal cost of compliance as non-SRO SCI entities , ($31,355) or $156,775 burden hours
annually for all such SCI competing consolidators. The total average internal cost of
compliance, including the Infrastructure Rules, would be $2,312,555 for all SCI entities.
The Commission estimates that:
•

the total average annual initial recordkeeping burden for complying with
Rule 1001(b), including the Infrastructure Rules, is 1,755 hours;

•

the total average annual ongoing recordkeeping burden for complying with
Rule 1001(b) for SCI SROs is 5,775 hours; and

•

the total average annual ongoing recordkeeping burden for complying with
Rule 1001(b) for non-SRO SCI entities is 1,520 hours.
c. Policies and Procedures Required by Rule 1001(c)

Rule 1001(c) establishes recordkeeping burdens for all SCI entities.
Rule 1001(c) requires each SCI entity to establish, maintain, and enforce reasonably
designed written policies and procedures that include the criteria for identifying responsible SCI
personnel, the designation and documentation of responsible SCI personnel, and escalation
procedures to quickly inform responsible SCI personnel of potential SCI events.
The Commission estimates that each new SCI entity will require 114 hours initially to
establish the criteria for identifying responsible SCI personnel and the escalation procedures, or
228 hours for all new SCI entities. 50 With respect to the Infrastructure Rules, the Commission
estimates that one SCI competing consolidator that is currently an SRO or affiliated with an SRO
would have 50% of the estimated initial burdens for a new SCI entity, which will require an
average of 57 burden hours. Four SCI competing consolidators that are not already subject to
Regulation SCI would have the same burdens as other new SCI entities (114 hours), or 456 hours
annually for all such new SCI entities. 51 The total average initial burden, including the
Infrastructure Rules, for all such SCI entities would be 741 hours.
The Commission estimates that the average internal cost of compliance associated with
this initial recordkeeping burden would be $42,528 for each new SCI entity, 52 or $85,056 for all
50

114 hours × 2 new SCI entities = 228 hours.

(32 Compliance Manager hours x $307) + (32 Attorney hours x $412) + (10 Senior Systems
Analyst hours x $282) + (10 Operations Specialist hours x $135) + (20 Chief Compliance Officer

19
such new SCI entities. 53 With respect to the Infrastructure Rules, the Commission estimates that
one SCI competing consolidators would have 50% of the estimated average annual internal cost
of compliance for a new SCI entity, which would be $21,264. Four SCI competing consolidators
would have the same costs as other new SCI entities ($42,528), or $170,112 for all such new SCI
competing consolidators. The total annual internal cost of compliance with this initial
recordkeeping burden, including the Infrastructure Rules, for all such SCI entities would be
$276,432.
The Commission also estimates that, on average, each SCI entity will require 39 hours
annually to review and update the criteria and the escalation procedures, or 1,716 hours annually
for all SCI entities. 54 With respect to the Infrastructure Rules, the Commission estimates that
two of the seven SCI competing consolidators that are the existing SIPs would have no
additional burden (i.e., they have been included in the above estimates). The remaining five SCI
competing consolidators would have the same average ongoing burden as other SCI entities (39
hours each annually), or 195 hours annually for all such SCI competing consolidators. The total
average annual ongoing burden, including the Infrastructure Rules, for all SCI entities would be
1,911 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden would be $15,548 for each SCI entity, 55 or $684,112 for
all such SCI entities. 56 With respect to the Infrastructure Rules, the Commission estimates that
two of the seven SCI competing consolidators that are the existing SIPs would have no
additional cost (i.e., they have been included in the above estimates). The remaining five SCI
competing consolidators would have the same average annual internal cost of compliance as
other SCI entities ($15,548 each), or $77,740. The total average internal cost of compliance,
including the Infrastructure Rules, for all SCI entities would be $761,852.
The Commission estimates that:
•

The total average annual initial recordkeeping burden for complying
with Rule 1001(c), including the Infrastructure Proposal, is 741 hours,
and

•

The total average annual ongoing recordkeeping burden for complying
with Rule 1001(c), including the Infrastructure Proposal, is 1,911 hours.

hours x $526) + (10 Director of Compliance hours x $483) = $42,528.
53

$42,528 x 2 = $85,056.

39 hours × 44 SCI entities = 1,716 hours.

(9.5 Compliance Manager hours x $307) + (9.5 Attorney hours x $412) + (2.5 Senior Systems
Analyst hours x $282) + (2.5 Operations Specialist hours x $135) + (10 Chief Compliance Officer
hours x $526) + (5 Director of Compliance hours x $483) = $15,548.

$15,548 x 44 = $684,112.

20
d. Mandate Participation in Certain Testing Required by Rule 1004
Rule 1004 establishes recordkeeping burdens for SCI entities that are not plan processors.
Rule 1004 requires each SCI entity to establish standards for the designation of certain
members or participants for BC/DR plan testing, to designate members or participants in
accordance with these standards, to require participation by designated members or participants
in such testing at least annually, and to coordinate such testing on an industry- or sector-wide
basis with other SCI entities.
The Commission estimates that the requirements under Rules 1004(a) (i.e., establishment
of standards for the designation of members and participants) and (c) (i.e., coordination of testing
on an industry- or sector-wide basis) will initially require 360 hours for each new SCI entity that
is not a plan processor, 57 or 720 hours annually for all such SCI entities. 58 With respect to the
Infrastructure Rules, the Commission estimates that three SCI competing consolidators that are
currently SIPs or SROs or affiliated with an SRO would have 50% of the estimated initial
burdens for a new SCI entity, 59 which will require an average of 180 burden hours, or 540
burden hours annually for all such SCI competing consolidators. 60 Four SCI competing
consolidators that are not already subject to Regulation SCI would have the same burdens as
other new SCI entities (360 hours), or 1,440 hours annually for all such new SCI entities. The
total average initial burden, including the Infrastructure Rules, for all such SCI entities would be
2,700 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this initial recordkeeping burden would be $107,298 for each new SCI entity that is not a

The estimate of 360 hours includes the burden for designating members or participants for
testing, as required by Rule 1004(b).

360 hours × 2 new SCI entities other than plan processors = 720 hours.

The Commission believes that for this particular burden, existing SIPs that become SCI
competing consolidators will have the same burdens as other SRO SCI entities and have not
otherwise been included in prior burden estimates, and so they have been added to this burden
estimate.

21
plan processor, 61 or $214,596 annually for all such entities. 62 With respect to the Infrastructure
Rules, the Commission estimates that three SCI competing consolidators that are currently SIPs
or SROs or affiliated with an SRO would each have 50% of the estimated average annual
internal cost of compliance for a new SCI entity, which would be $53,649 for each such
competing consolidator, or $160,947 for all such SCI entities. Four competing consolidators
would have the same costs as other new SCI entities ($107,298), or $429,192 for all such new
competing consolidators. The total annual internal cost of compliance with this initial
recordkeeping burden, including the Infrastructure Proposal, for all such SCI entities would be
$804,735.
Further, the Commission estimates that the requirements under Rules 1004(a) and (c) will
require 135 hours annually for each SCI entity that is not a plan processor, or an average estimate
of 5,670 hours annually for all such SCI entities. 63 With respect to the Infrastructure Rule, the
seven SCI competing consolidators 64 would have the same average ongoing burden as other SCI
entities (135 hours each annually), or 945 hours annually for all such competing consolidators.
The total average annual ongoing burden, including the Infrastructure Rules, for all SCI entities
would be 6,615 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden would be $35,925 for each SCI entity, 65 or $1,508,850
annually for all such entities. 66 With respect to the Infrastructure Rules, the seven SCI
competing consolidators would have the same average annual internal cost of compliance as
other SCI entities ($35,925), or $251,475. The total average internal cost of compliance,
including the Infrastructure Rules, for all SCI entities would be $1,760,325. Based on its
61

(40 Compliance Manager hours x $307) + (60 Attorney hours x $412) + (20 Assistant General
Counsel hours x $462) + (60 Senior Operations Manager hours x $362) + (140 Operations
Specialist hours x $135) + (26 Chief Compliance Officer hours x $526) + (14 Director of
Compliance hours x $483) = $107,298.

$107,298 x 2 = $214,596.

135 hours × 42 SCI entities other than plan processors = 5,670 hours. As noted in the SCI
Adopting Release, the Commission does not believe that there would be significant annual burden
under Rule 1004(a), as the Commission believes that designation standards will likely not change
substantially on an annual basis. See Regulation SCI Adopting Release, 79 FR 72380, FN. 1495.

The Commission notes that for this particular burden, existing SIPs that become SCI competing
consolidators have not otherwise been included in prior burden estimates, and the Commission
believes they will will have the same burdens as other SCI entities, and therefore they have been
added to this burden estimate.

(10 Compliance Manager hours x $307) + (15 Attorney hours x $412) + (5 Assistant General
Counsel hours x $462) + (20 Senior Operations Manager hours x $362) + (70 Operations
Specialist hours x $135) + (10 Chief Compliance Officer hours x $526) + (5 Director of
Compliance hours x $483) = $35,925.

$35,925 x 42 = $1,508,850.

22
experience with plan processors, the Commission believes that plan processors will outsource the
work related to compliance with Rule 1004 (and, accordingly, such outsourced costs have been
included in the response to Item 13).
In summary, the Commission estimates that:
•

The total average annual initial recordkeeping burden for complying with
Rule 1004(a) and (c), including the Infrastructure Proposal, is 2,700 hours,
and

•

The total average annual ongoing recordkeeping burden is 6,615 hours.

e. SCI Event Notice Required by Rule 1002(b)
Rule 1002(b) establishes reporting burdens for all SCI entities.
Rule 1002(b)(1) requires each SCI entity, upon any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred, to notify the Commission
immediately. Based on experience from the previous three years, the Commission staff
estimates that each SCI entity will submit, on average, 5 notifications per year pursuant to Rule
1002(b)(1). These notifications can be made orally or in writing, and the Commission estimates
that approximately one-fourth of these notifications will be submitted in writing (i.e.,
approximately 1 event per year for each SCI entity), and approximately three-fourths will be
provided orally (i.e., approximately 4 events per year for each SCI entity). The written
notifications may be submitted on Form SCI. The Commission estimates that each written
notification will require 2 hours and each oral notification will require 1.5 hours. The
Commission estimates that each SCI entity will require an average of 8 hours annually to comply
with Rule 1002(b)(1), 67 or, on average, 352 hours annually for all SCI entities. 68 With respect to
the Infrastructure Rules, the Commission notes that two of the seven SCI competing
consolidators that are the existing SIPs would have no additional burden (i.e., they have been
included in the above estimates). The remaining five SCI competing consolidators would have
the same average ongoing burden as other SCI entities (8 hours each annually) or 40 hours
annually for all such competing consolidators. The Commission estimates that the average
annual ongoing burden for complying with Rule 1002(b)(1), including the Infrastructure
Proposal, would be 392 hours for all SCI entities.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden for written notifications would be approximately $637 for
67

1 written notification each year × 2 hours per notification + 4 oral notifications each year × 1.5
hours per notification = 8 hours.

8 hours × 44 SCI entities = 352 hours.

23
each SCI entity, 69 and for oral notifications would be $1,827 for each SCI entity, 70 or, on
average, $108,394 annually for all such SCI entities for all notifications. 71 With respect to the
Infrastructure Rules, the Commission notes that two of the seven SCI competing consolidators
that are the existing SIPs would have no additional burden (i.e., they have been included in the
above estimates). The remaining five of the seven SCI competing consolidators would have the
same average annual internal cost of compliance as other SCI entities, or on average or $3,183
for written notifications 72 and $9,135 for oral notifications annually for all such SCI competing
consolidators, or on average, $12,318 for all such SCI competing consolidators . The total
average internal cost of compliance, including the Infrastructure Rules, for all SCI entities would
be $120,712.
Rule 1002(b)(2) requires each SCI entity, within 24 hours of any responsible SCI
personnel having a reasonable basis to conclude that the SCI event has occurred, to submit a
written notification to the Commission pertaining to the SCI event on a good faith, best efforts
basis. These notifications are required to be submitted on Form SCI. The Commission estimates
that each notification under Rule 1002(b)(2) will require 24 hours for each SCI entity. The
Commission estimates that each SCI entity will require an average of 120 hours annually to
comply with Rule 1002(b)(2), 73 or 5,280 hours annually for all SCI entities. 74 With respect to
the Infrastructure Rules, the Commission notes that two of the seven SCI competing
consolidators that are the existing SIPs would have no additional burden (i.e., they have been
included in the above estimates). The remaining five SCI competing consolidators would have
the same average ongoing burden as other SCI entities (120 hours each annually) or 600 hours
annually for all such competing consolidators. The Commission estimates that the total
average annual ongoing burden for complying with Rule 1002(b)(2), including the
Infrastructure Rules, for all SCI entities would be 5,880 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden would be $39,535 for each SCI entity, 75 or $1,739,540
69

(0.5 Compliance Manager hours x $307) + (0.5 Attorney hours x $412) + (0.5 Senior Systems
Analyst hours x $282) + (0.5 Senior Business Analyst hours x $272) = $636.50. $636.50 per
notification x 1 written notification each year = $636.50.

(0.25 Compliance Manager hours x $307) + (0.25 Attorney hours x $412) + (0.5 Senior Systems
Analyst hours x $282) + (0.5 Senior Business Analyst hours x $272) = $456.75. $456.75 per
notification x 4 oral notifications each year = $1,827.

$636.50 + $1,827 = $2,463.5. $2,463.5 x 44 = $108,394.

See supra note 69 (estimating $636.50 per SCI entity per year).

5 written notifications each year × 24 hours per notification = 120 hours.

120 hours × 44 SCI entities = 5,280 hours.

(5 Compliance Manager hours x $307) + (5 Attorney hours x $412) + (6 Senior Systems Analyst
hours x $282) + (1 Assistant General Counsel hour x $462) + (1 Chief Compliance Officer hour x
$526) + (6 Senior Business Analyst hours x $272) = $7,907. $7,907 per notification x 5

24
annually for all such entities. 76 With respect to the Infrastructure Rules, the Commission notes
that two of the seven SCI competing consolidators that are the existing SIPs would have no
additional burden (i.e., they have been included in the above estimates). The remaining five of
the seven SCI competing consolidators would have the same average annual internal cost of
compliance ($39,535 each), or $197,675 for all such competing consolidators. The total average
internal cost of compliance, including the Infrastructure Proposal, for all SCI entities would be
$1,937,215.
Rule 1002(b)(3) requires each SCI entity to provide updates to the Commission
pertaining to an SCI event on a regular basis, or at such frequency as reasonably requested by a
representative of the Commission, until the SCI event is resolved and the SCI entity’s
investigation of the SCI event is closed. These updates can be provided orally or in writing, and
the Commission estimates that, based on past experience, each SCI entity will submit 1 written
update and 1 oral update each year, for a total of 2 updates each year. The written updates may
be submitted on Form SCI. The Commission estimates that each written update will require 6
hours and each oral update will require 4.5 hours. The Commission estimates that each SCI
entity will require an average of 10.5 hours annually to comply with Rule 1002(b)(3), 77 or, on
average, 462 hours annually for all SCI entities. 78 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
would have no additional burden (i.e., they have been included in the above estimates). The
remaining five SCI competing consolidators would have the same average ongoing burden as
other SCI entities (10.5 hours each annually) or 52.5 hours annually for all such competing
consolidators. The Commission estimates that the average annual ongoing burden for
complying with Rule 1002(b)(3), including the Infrastructure Rules, would be 515 hours for
all SCI entities.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden for the written update would be $1,909.50 for each SCI
entity, 79 and for the oral update would be $1,370.25 for each SCI entity, 80 or $144,309 annually
for all such SCI entities for all notifications. 81 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
notifications each year = $39,535.
76

$39,535 x 44 = $1,739,540.

1 written updates each year × 6 hours per notification + 1 oral updates each year × 4.5 hours per
notification = 10.5 hours.

10.5 hours × 44 SCI entities = 462 hours.

(1.5 Compliance Manager hours x $307) + (1.5 Attorney hours x $412) + (1.5 Senior Systems
Analyst hours x $282) + (1.5 Senior Business Analyst hours x $272) = $1,909.50.

(0.75 Compliance Manager hours x $307) + (0.75 Attorney hours x $412) + (0.5 Senior Systems
Analyst hours x $282) + (0.5 Senior Business Analyst hours x $272) = $1,370.25.

$1909.50 + $1,370.25 = $3,279.75. $3,279.75 x 44 = $144,309.

25
would have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators would have the same average annual
internal cost of compliance as other SCI entities, or on average $1,909.50 for written
notifications and $1,370.25 for oral notifications for each competing consolidator, or $16,398.75
annually for all such competing consolidators. The total average internal cost of compliance,
including the Infrastructure Rules, for all SCI entities would be $160,707.75.
Rule 1002(b)(4) requires each SCI entity to submit written interim reports, as necessary,
and a written final report regarding an SCI event to the Commission. These reports are required
to be submitted on Form SCI. The Commission estimates that compliance with Rule 1002(b)(4)
for a particular SCI event will require 35 hours. Because the Commission estimates that each
SCI entity will experience an average of 5 SCI events each year that are not de minimis SCI
events, Rule 1002(b)(4) will result in 5 reporting requirements per SCI entity per year. The
Commission estimates that each SCI entity will require an average of 175 hours annually to
comply with Rule 1002(b)(4), 82 or 7,700 hours annually for all SCI entities. 83 With respect to
the Infrastructure Rules, the Commission notes that two of the seven SCI competing
consolidators that are the existing SIPs would have no additional burden (i.e., they have been
included in the above estimates). The remaining five SCI competing consolidators would have
the same average ongoing burden as other SCI entities (175 hours each annually) or 875 hours
annually for all such competing consolidators. The Commission estimates that the total
average annual ongoing burden for complying with Rule 1002(b)(4), including the
Infrastructure Rules, for all SCI entities would be 8,575 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden would be $61,065 for each SCI entity, 84 or, on average,
82

5 written notifications each year × 35 hours per notification = 175 hours.

175 hours × 44 SCI entities = 7,700 hours. The Commission notes that this reporting burden
estimate includes the reporting burden for submitting the one interim Commission notification
required under Rule 1002(b)(4)(i)(B) (if necessary). In particular, the Commission notes that the
interim notification requires SCI entities to include the same information as required to be
included in a final notification under Rule 1002(b)(4)(i)(A), except that SCI entities are only
required to provide the information to the extent known at the time of the interim notification. If
an SCI entity submits an interim notification, it is also required to submit a final notification,
which is required to include all of the remaining information that was not provided in the interim
notification. Because all SCI entities are required to provide the same amount of information in
total for a particular SCI event under Rule 1002(b)(4), regardless of whether they submit an
interim notification, the estimated burden for Rule 1002(b)(4) includes the burden for both the
interim notification (if necessary) and the final notification related to a particular SCI event.

(8 Compliance Manager hours x $307) + (8 Attorney hours x $412) + (7 Senior Systems Analyst
hours x $282) + (2 Assistant General Counsel hours x $462) + (1 General Counsel hour x $607) +
(2 Chief Compliance Officer hours x $526) + (7 Senior Business Analyst hours x $272) =
$12,213. $12,213 per notification x 5 notifications each year = $61,065.

26
$2,686,860 annually for all such SCI entities. 85 With respect to the Infrastructure Proposal, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
would have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators would have the same average annual
internal cost of compliance as other SCI entities ($61,065 each), or on average, $305,325
annually for all such competing consolidators. The total average internal cost of compliance,
including the Infrastructure Proposal, for all SCI entities would be $2,992,185.
Rule 1002(b)(5) requires each SCI entity to submit to the Commission quarterly reports
containing a summary description of any systems disruption or systems intrusion that has had, or
the SCI entity reasonably estimates would have, no or a de minimis impact on the SCI entity’s
operations or on market participants. These reports are required to be submitted on Form SCI.
The Commission estimates that the initial and ongoing reporting burden to comply with the
quarterly report requirement will be 40 hours per report per SCI entity, or 160 hours annually per
SCI entity, 86 and, on average, 7,040 hours annually for all SCI entities. 87 With respect to the
Infrastructure Rules, the Commission notes that two of the seven SCI competing consolidators
that are the existing SIPs would have no additional burden (i.e., they have been included in the
above estimates). The remaining five SCI competing consolidators would have the same average
ongoing burden as other SCI entities (160 hours each annually) or 800 hours annually for all
such competing consolidators. The Commission estimates that the total average annual
ongoing burden for complying with Rule 1002(b)(5), including the Infrastructure Rules, for
all SCI entities would be 7,840 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden would be $54,062 for each SCI entity, 88 or $2,378,728
annually for all such SCI entities. 89 With respect to the Infrastructure Rules, the Commission
notes that two of the seven SCI competing consolidators that are the existing SIPs would have no
additional burden (i.e., they have been included in the above estimates). The remaining five of
the seven SCI competing consolidators would have the same average annual internal cost of
compliance as other SCI entities ($54,062 each), or on average, $270,310 annually for all such
competing consolidators. The total average internal cost of compliance, including the
Infrastructure Rules, for all SCI entities would be $2,649,038.

$61,065 x 44 = $2,686,860.

40 hours × 4 reports each year = 160 hours.

160 hours × 44 SCI entities = 7,040 hours.

(7.5 Compliance Manager hours x $307) + (7.5 Attorney hours x $412) + (10 Senior Systems
Analyst hours x $282) + (2 Assistant General Counsel hours x $462) + (1 General Counsel hour x
$607) + (2 Chief Compliance Officer hours x $526) + (10 Senior Business Analyst hours x $272)
= $13,515.50. $13,515.50 per report x 4 reports each year = $54,062.

$54,062 x 44 = $2,378,728.

27
In summary, the Commission estimates that the total reporting burden for complying with
Rule 1002(b) is 20,834 hours per year, 90 or 473.50 hours per SCI entity. 91 With respect to the
Infrastructure Rules, the total reporting burden for the five competing consolidators will be
2,367.5 hours. The total reporting burden for all SCI entities will be 23,201.5 hours.
f. Dissemination of Information Required by Rule 1002(c)
Rule 1002(c) establishes third party disclosure burdens for all SCI entities.
Rule 1002(c)(1)(i) requires each SCI entity, promptly after any responsible SCI personnel
has a reasonable basis to conclude that an SCI event (other than a systems intrusion) has
occurred, to disseminate certain information to its members or participants. The Commission
estimates that each SCI entity will disseminate information regarding 3 SCI events each year
under Rule 1002(c)(1)(i). The Commission estimates that each information dissemination under
Rule 1002(c)(1)(i) will require 7 hours. Thus, the total annual third party disclosure burden to
comply with Rule 1002(c)(1)(i) will be 21 hours per SCI entity, 92 or, on average, 924 hours
annually for all SCI entities. 93 With respect to the Infrastructure Rules, the Commission notes
that two of the seven SCI competing consolidators that are the existing SIPs would have no
additional burden (i.e., they have been included in the above estimates). The remaining five SCI
competing consolidators would have the same burden as other SCI entities (21 hours each
annually), or 105 hours annually for all such competing consolidators. The Commission
estimates that the total average annual burden for complying with Rule 1002(c)(1)(i),
including the Infrastructure Rules, for all SCI entities would be 1,029 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden would be approximately $13,733 for each SCI entity, 94 or, on
average, $604,230 annually for all such SCI entities. With respect to the Infrastructure Proposal,
the Commission notes that two of the seven SCI competing consolidators that are the existing
SIPs would have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators would have the same average annual
internal cost of compliance as other SCI entities ($13,733 each), or on average, $68,665 annually
90

352 hours (Rule 1002(b)(1)) + 5,280 hours (Rule 1002(b)(2)) + 462 hours (Rule 1002(b)(3)) +
7,700 hours (Rule 1002(b)(4)) + 7,040 hours (Rule 1002(b)(5)) = 20,834 hours per year.

20,834 hours ÷ 44 SCI entities = 473.5 hours per SCI entity.

3 information disseminations each year × 7 hours per dissemination = 21 hours.

21 hours × 44 SCI entities = 924 hours.

(1 Compliance Manager hours x $307) + (2.67 Attorney hours x $412) + (1 Senior Systems
Analyst hours x $282) + (0.5 General Counsel hour x $607) + (0.5 Director of Compliance hours
x $483) + (0.5 Chief Compliance Officer hours x $526) + (.5 Corporate Communications
Manager hours x $337) + (.33 Webmasters hours x $246) = $2,746.50. $2,746.50 per notification
x 5 notifications each year = $13,732.50.

28
for all such competing consolidators. The total average internal cost of compliance, including
the Infrastructure Rules, for all SCI entities would be $672,895.
Rule 1002(c)(1)(ii) requires each SCI entity, when known, to promptly disseminate
additional information about an SCI event (other than a systems intrusion) to its members or
participants. Rule 1002(c)(1)(iii) requires each SCI entity to provide to its members or
participants regular updates of any information required to be disseminated under Rules
1002(c)(1)(i) and (ii) until the SCI event is resolved. The Commission estimates that each SCI
entity will disseminate 3 updates for each SCI event under Rules 1002(c)(1)(ii) and (iii), or 9
updates each year. 95 The Commission estimates that each update under Rules 1002(c)(1)(ii) and
(iii) will require 13 hours. Thus, the total annual third party disclosure burden to comply with
Rules 1002(c)(1)(ii) and (iii) will be 117 hours per SCI entity, 96 or, on average, 5,148 hours
annually for all SCI entities. 97 With respect to the Infrastructure Rules, the Commission notes
that two of the seven SCI competing consolidators that are the existing SIPs would have no
additional burden (i.e., they have been included in the above estimates). The remaining five SCI
competing consolidators would have the same burden as other SCI entities (117 hours each
annually), or 585 hours annually for all such competing consolidators. The Commission
estimates that the total average annual burden for complying with Rule 1002(c)(1)(ii),
including the Infrastructure Rules, for all SCI entities would be 5,733 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden would be $46,224 for each SCI entity, 98 or, on average,
$2,033,856 annually for all such SCI entities. 99 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
would have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators would have the same average annual
internal cost of compliance as other SCI entities ($46,224 each), or on average, $231,120
annually for all such competing consolidators. The total average internal cost of compliance,
including the Infrastructure Proposal, for all SCI entities would be $2,264,976.
Rule 1002(c)(2) requires each SCI entity to disseminate certain information regarding a
systems intrusion to its members or participants, and provides an exception when the SCI entity
95

3 SCI events × 3 updates per SCI event = 9 updates.

9 updates each year × 13 hours per update = 117 hours.

117 hours × 44 SCI entities = 5,148 hours.

(2 Compliance Manager hours x $307) + (4.67 Attorney hours x $412) + (2 Senior Systems
Analyst hours x $282) + (1 General Counsel hour x $607) + (1 Director of Compliance hours x
$483) + (1 Chief Compliance Officer hours x $526) + (1 Corporate Communications Manager
hours x $337) + (.33 Webmasters hours x $246) = $5,136. $5,136 per update x 9 notifications
each year = $46,224.

$46,224 x 44 = $2,033,856.

29
determines that dissemination of such information would likely compromise the security of its
SCI systems or indirect SCI systems, or an investigation of the systems intrusion, and documents
the reasons for such determination. The Commission estimates that each SCI entity will
disseminate information regarding 1 systems intrusion each year under Rule 1002(c)(2). The
Commission estimates that each dissemination under Rule 1002(c)(2) will require 10 hours.
Thus, the total annual third party disclosure burden to comply with Rule 1002(c)(2) will be 10
hours per SCI entity, or, on average, 440 hours for all SCI entities. 100 With respect to the
Infrastructure Rules, the Commission notes that two of the seven SCI competing consolidators
that are the existing SIPs would have no additional burden (i.e., they have been included in the
above estimates). The remaining five SCI competing consolidators would have the same burden
as other SCI entities (10 hours each), or 50 hours annually for all such competing consolidators.
The Commission estimates that the total average annual burden for complying with Rule
1002(c)(2), including the Infrastructure Rules, for all SCI entities would be 490 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden would be approximately $3,941 for each SCI entity, 101 or
$173,415 annually for all such SCI entities. 102 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
would have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators would have the same average annual
internal cost of compliance as other SCI entities ($3,941 each), or on average, $19,706 annually
for all such competing consolidators. The total average internal cost of compliance, including
the Infrastructure Rules, for all SCI entities would be $193,121.
In summary, the total annual third party disclosure burden to comply with Rule 1002(c)
will be, on average, 6,512 hours for all SCI entities, 103 or 148 hours annually per SCI entity. 104
With respect to the Infrastructure Rules, the total burden will be, on average, 740 hours for the
five SCI competing consolidators (not including the current SIPs which are included in the prior
estimate). The total average annual burden would be 7,252 hours for all SCI entities.
g. Material Systems Change Notice Required by Rule 1003(a)

100

10 hours × 44 SCI entities = 440 hours.

101

(1.5 Compliance Manager hours x $307) + (3.67 Attorney hours x $412) + (1.5 Senior Systems
Analyst hours x $282) + (0.75 General Counsel hour x $607) + (0.75 Director of Compliance
hours x $483) + (0.75 Chief Compliance Officer hours x $526) + (0.75 Corporate
Communications Manager hours x $337) + (.33 Webmasters hours x $246) = $3,941.25.

102

$3,941.25 x 44 = $173,415.

103

924 hours (Rule 1002(c)(1)(i)) + 5,148 hours (Rules 1002(c)(1)(ii) and (iii)) + 440 hours (Rule
1002(c)(2)) = 6,512 hours.

104

6,512 hours ÷ 44 SCI entities = 148 hours per SCI entity.

30
Rule 1003(a) establishes reporting burdens for all SCI entities.
Rule 1003(a)(1) requires each SCI entity to submit to the Commission quarterly reports
describing completed, ongoing, and planned material changes to its SCI systems and security of
indirect SCI systems during the prior, current, and subsequent calendar quarters. These reports
are required to be submitted on Form SCI. The Commission estimates that the reporting burden
to comply with the quarterly reporting requirement will be 125 hours per report per SCI entity, or
500 hours annually per SCI entity105 and an average of 22,000 hours annually for all SCI
entities. 106 With respect to the Infrastructure Rules, the Commission notes that two of the seven
SCI competing consolidators that are the existing SIPs would have no additional burden (i.e.,
they have been included in the above estimates). The remaining five SCI competing
consolidators would have the same burden as other SCI entities (500 hours each annually), or
2,500 hours annually for all such competing consolidators. The Commission estimates that the
total average annual burden for complying with Rule 1003(a)(1), including the
Infrastructure Rules, for all SCI entities would be 24,500 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden for quarterly reports would be $149,330 for each SCI
entity, 107 or $6,570,520 for all such SCI entities. 108 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
would have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators would have the same average annual
internal cost of compliance as other SCI entities ($149,330 each), or on average, $746,650
annually for all such competing consolidators. The total average internal cost of compliance,
including the Infrastructure Proposal, for all SCI entities would be $7,317,170.
Rule 1003(a)(2) requires each SCI entity to promptly submit a supplemental report
notifying the Commission of a material error in or material omission from a report previously
submitted under Rule 1003(a)(1). These reports are required to be submitted on Form SCI. The
Commission estimates that each SCI entity will submit 1 supplemental report each year. The
Commission estimates that the reporting burden to comply with the supplemental report
requirement will be 15 hours per report per SCI entity, and, on average, 660 hours annually for
all SCI entities. 109 With respect to the Infrastructure Rules, the Commission notes that two of the
seven SCI competing consolidators that are the existing SIPs would have no additional burden
105

125 hours × 4 reports each year = 500 hours.

106

500 hours × 44 SCI entities = 22,000 hours.

107

(7.5 Compliance Manager hours x $307) + (7.5 Attorney hours x $412) + (5 Chief Compliance
Officer hours x $526) + (75 Senior Systems Analyst hours x $282) + (30 Senior Business Analyst
hours x $272) = $37,332.50. $37,332.50 per report x 4 reports each year = $149,330.

108

$149,330 x 44 = $6,570,520.

109

15 hours × 44 SCI entities = 660 hours.

31
(i.e., they have been included in the above estimates). The remaining five SCI competing
consolidators would have the same burden as other SCI entities (15 hours each annually), or 75
hours annually for all such competing consolidators. The Commission estimates that the total
average annual burden for complying with Rule 1003(a)(2), including the Infrastructure
Rules, for all SCI entities would be 735 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden for supplemental reports would be $4,754 for each SCI
entity, 110 or, on average, $209,176 annually for all such SCI entities. 111 With respect to the
Infrastructure Proposal, the Commission notes that two of the seven SCI competing
consolidators that are the existing SIPs would have no additional burden (i.e., they have been
included in the above estimates). The remaining five of the seven SCI competing consolidators
would have the same average annual internal cost of compliance as other SCI entities ($4,754
each), or on average, $23,770 annually for all such competing consolidators. The total average
internal cost of compliance, including the Infrastructure Rules, for all SCI entities would be
$232,946.
In summary, the Commission estimates that the total reporting burden for complying with
Rule 1003(a) is, on average, 22,660 hours per year, 112 or 515 hours annually per SCI entity. 113
With respect to the Infrastructure Rules, the total reporting burden will be, on average, 2,575
hours for the five SCI competing consolidators (not including the current SIPs which are
included in the prior estimate). The total average annual burden would be 25,235 hours for all
SCI entities.
h. SCI Review Required by Rule 1003(b)
Rule 1003(b) establishes recordkeeping and reporting burdens for all SCI entities.
Rule 1003(b)(1) requires each SCI entity to conduct an SCI review of its compliance with
Regulation SCI not less than once each calendar year, with an exception for penetration test
reviews, which are required to be conducted not less than once every three years. Rule
1003(b)(1) also provides an exception for assessments of SCI systems directly supporting market
regulation or market surveillance, which are required to be conducted at a frequency based on the
risk assessment conducted as part of the SCI review, but in no case less than once every three
years. Rule 1003(b)(2) requires each SCI entity to submit a report of the SCI review to senior
110

(2 Compliance Manager hours x $307) + (2 Attorney hours x $412) + (1 Chief Compliance
Officer hours x $526) + (7 Senior Systems Analyst hours x $282) + (3 Senior Business Analyst
hours x $272) = $4,754.

111

$4,754 x 44 = $209,176.

112

22,000 hours for Rule 1003(a)(1) + 660 hours for Rule 1003(a)(2) = 22,660 hours.

113

22,660 hours ÷ 44 SCI entities = 515 hours per SCI entity.

32
management no more than 30 calendar days after completion of the review. The Commission
estimates that the annual recordkeeping burden of conducting an SCI review and submitting the
SCI review to senior management of the SCI entity for review will be approximately 690 hours
for each SCI entity, and, on average, 30,360 hours annually for all SCI entities. 114 With respect
to the Infrastructure Rules, the Commission notes that two of the seven SCI competing
consolidators that are the existing SIPs would have no additional burden (i.e., they have been
included in the above estimates). The remaining five SCI competing consolidators would have
the same burden as other SCI entities (690 hours each annually), or 3,450 hours annually for all
such competing consolidators. The Commission estimates that the total average annual
burden for complying with Rules 1003(b)(1) and 1003(b)(2), including the Infrastructure
Rules, for all SCI entities would be 33,810 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden would be $221,015 for each SCI entity, 115 or $9,724,660
annually for all such SCI entities. 116 With respect to the Infrastructure Rules, the Commission
notes that two of the seven SCI competing consolidators that are the existing SIPs would have no
additional burden (i.e., they have been included in the above estimates). The remaining five of
the seven SCI competing consolidators would have the same average annual internal cost of
compliance as other SCI entities ($221,015 each), or on average, $1,105,075 annually for all
such competing consolidators. The total average internal cost of compliance, including the
Infrastructure Rules, for all SCI entities would be $10,829,735.
Rule 1003(b)(3) requires each SCI entity to submit the report of the SCI review to the
Commission and to its board of directors or the equivalent of such board, together with any
response by senior management, within 60 calendar days after its submission to senior
management. These reports are required to be submitted on Form SCI. The Commission
estimates that each SCI entity will require approximately 1 hour per year to submit the report of
the SCI review and any response by senior management to the Commission and to its board of
directors or the equivalent of such board, for a reporting burden of approximately 44 hours
annually for all SCI entities. 117 With respect to the Infrastructure Rules, the Commission notes
that two of the seven SCI competing consolidators that are the existing SIPs would have no
additional burden (i.e., they have been included in the above estimates). The remaining five SCI
competing consolidators would have the same burden as other SCI entities (1 hour each
annually), or 5 hours annually for all such competing consolidators. The Commission estimates
114

690 hours × 44 SCI entities = 30,360 hours.

115

(35 Compliance Manager hours x $307) + (80 Attorney hours x $412) + (375 Senior Systems
Analyst hours x $282) + (5 General Counsel hours x $607) + (5 Director of Compliance hours x
$483) + (20 Chief Compliance Officer hours x $526) + (170 Internal Audit Manager hours x
$327) = $221,015.

116

$221,015 x 44 = $9,724,660.

117

1 hour × 44 SCI entities = 44 hours.

33
that the total average annual burden for complying with Rule 1003(b)(3), including the
Infrastructure Rules, for all SCI entities would be 49 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden would be $412 for each SCI entity, 118 or $18,128 annually for
all such SCI entities. 119 With respect to the Infrastructure Rules, the Commission notes that two
of the seven SCI competing consolidators that are the existing SIPs would have no additional
burden (i.e., they have been included in the above estimates). The remaining five of the seven
SCIcompeting consolidators would have the same average annual internal cost of compliance as
other SCI entities ($412 each), or on average, $2,060 annually for all such competing
consolidators. The total average internal cost of compliance, including the Infrastructure Rules,
for all SCI entities would be $20,188.
i. Access to EFFS
Rule 1006 requires each SCI entity, with a few exceptions, to file any notification,
review, description, analysis, or report to the Commission required under Regulation SCI
electronically on Form SCI. SCI entities submit Form SCI through the EFFS, which is also used
by SCI SROs to file Form 19b-4 filings. Access to EFFS establishes reporting burdens for all
SCI entities.
An SCI entity will submit to the Commission an EAUF to register each individual at the
SCI entity who will access the EFFS system on behalf of the SCI entity. The Commission is
including in its burden estimates the reporting burden for completing the EAUF for each
individual at an SCI entity that will request access to EFFS. The Commission estimates that
initially, on average, two individuals at each SCI entity will request access to EFFS through the
EAUF, and each EAUF will require 0.15 hours to complete and submit. Therefore, each new
SCI entity will initially require 0.3 hours to complete the requisite EAUFs, 120 or 0.6 hours
annually for all new SCI entities. 121 With respect to the Infrastructure Rules, the Commission
estimates that one SCI competing consolidator that is currently an SRO or affiliated with an SRO
would each have 50% of the estimated initial burdens for a new SCI entity, which will require an
average of 0.15 burden hours. 122 Four SCI competing consolidators that are not already subject
to Regulation SCI would have the same burdens as other new SCI entities (0.3 hours each), or
1.2 hours annually for all such new SCI entities. This averages out to .125 hours per response,
118

1 Attorney hour x $412 = $412.

119

$412 x 44 = $18,128.

120

0.15 hours per EAUF × 2 individuals = 0.3 hours per SCI entity.

121

0.30 hours × 2 new SCI entities = 0.6 hours.

122

34
with 12 respondents and 2 responses per respondent. The Commission estimates that the total
average initial burden for access to EFFS, including the Infrastructure Rules, for all such
SCI entities would be 1.95 hours.
The Commission estimates that the average cost associated with this initial burden would
be $124 for each new SCI entity, 123 or $248 annually for all such new SCI entities. 124 With
respect to the Infrastructure Rules, the Commission estimates that one SCI competing
consolidator would have 50% of the estimated average annual internal cost of compliance for a
new SCI entity, which would be $62. Four SCI competing consolidators would have the same
costs as other new SCI entities ($124 each), or $496 for all such new competing consolidators.
The total annual internal cost of compliance associated with this initial recordkeeping burden,
including the Infrastructure Rules, for all such SCI entities would be $806.
The Commission also estimates that annually, on average, one individual at each SCI
entity will request access to EFFS through EAUF. Therefore, the ongoing burden to complete
the EAUF will be 0.15 hours annually per SCI entity, 125 or, on average, 6.6 hours annually for all
SCI entities. 126 With respect to the Infrastructure Rules, the Commission notes that two of the
seven SCI competing consolidators that are the existing SIPs would have no additional burden
(i.e., they have been included in the above estimates). The remaining five SCI competing
consolidators would have the same burden as other SCI entities (.15 hours each annually), or .75
hours annually for all such SCI competing consolidators. The Commission estimates that the
total average annual burden for access to EFFS, including the Infrastructure Rules, for all
SCI entities would be 7.35 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing burden would be $62 for each SCI entity, 127 or $2,728 annually for all such
SCI entities. 128 With respect to the Infrastructure Rules, the Commission notes that two of the
seven SCI competing consolidators that are the existing SIPs would have no additional burden
(i.e., they have been included in the above estimates). The remaining five of the seven SCI
competing consolidators would have the same average annual internal cost of compliance as
other SCI entities ($62 each), or on average, $310 annually for all such competing consolidators.
The total average internal cost of compliance, including the Infrastructure Rules, for all SCI
entities would be $3,038.

123

0.3 Attorney hour x $412 = $124.

124

$124 x 2 = $248.

125

0.15 hours per EAUF × 1 individual = 0.15 hours per SCI entity.

126

0.15 hours × 44 SCI entities = 6.6 hours.

127

0.15 Attorney hour x $412 = $62.

128

$62 x 44 = $2,728.

35
j. Corrective Action Required by Rule 1002(a)
Rule 1002(a) establishes recordkeeping burdens for all SCI entities.
Rule 1002(a) requires each SCI entity, upon any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred, to begin to take appropriate
corrective action. The Commission believes that Rule 1002(a) will likely result in SCI entities
developing and revising their processes for corrective action. The Commission estimates that the
initial recordkeeping burden to implement such a process will be 114 hours per new SCI entity,
or 228 hours annually for all new SCI entities. 129 With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator that iscurrently an SRO or affiliated
with an SRO would have 50% of the estimated initial burdens for a new SCI entity, which will
require an average of 57 burden hours. 130 Four SCI competing consolidators that are not already
subject to Regulation SCI would have the same burdens as other new SCI entities (114 hours), or
456 hours annually for all such new SCI entities. The Commission estimates that the total
average initial burden for complying with Rule 1002(a), including the Infrastructure Rules,
for all such SCI entities would be 741 hours.
The Commission estimates that the average internal cost of compliance associated with
this initial recordkeeping burden would be $42,528 for each new SCI entity, 131 or $85,056
annually for all such new SCI entities. 132 With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidators would have 50% of the estimated
average annual internal cost of compliance for a new SCI entity, which would be $21,264 for
such competing consolidator. Four SCI competing consolidators would have the same costs as
other new SCI entities ($42,528), or $170,112 for all such new competing consolidators. The
total annual internal cost of compliance associated with this initial recordkeeping burden,
including the Infrastructure Rules, for all such SCI entities would be $276,432.
The Commission also estimates that the ongoing recordkeeping burden to review such
process will be 39 hours annually per SCI entity, or 1,716 hours annually for all SCI entities. 133
With respect to the Infrastructure Rules, the Commission notes that two of the seven SCI
competing consolidators that are the existing SIPs would have no additional burden (i.e., they
129

114 hours × 2 new SCI entities = 228 hours.

130

131

(32 Compliance Manager hours x $307) + (32 Attorney hours x $412) + (10 Senior Systems
Analyst hours x $282) + (10 Operations Specialist hours x $135) + (20 Chief Compliance Officer
hours x $526) + (10 Director of Compliance hours x $483) = $42,528.

132

$42,528 x 2 = $85,056.

133

39 hours × 44 SCI entities = 1,716 hours.

36
have been included in the above estimates). The remaining five SCI competing consolidators
would have the same average ongoing burden as other SCI entities (39 hours each annually), or
195 hours annually for all such competing consolidators. The Commission estimates that the
total average annual ongoing burden for complying with Rule 1002(a), including the
Infrastructure Rules, for all SCI entities would be 1,911 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden would be $15,397 for each SCI entity, 134 or $677,468
for all such SCI entities. 135 With respect to the Infrastructure Rules, the Commission notes that
one of the seven SCI competing consolidators that are the existing SIPs would have no additional
burden (i.e., they have been included in the above estimates). The remaining five of the seven
SCI competing consolidators would have the same average annual internal cost of compliance as
other SCI entities ($15,397 each), or on average, $76,985 annually for all such competing
consolidators. The total average internal cost of compliance, including the Infrastructure Rules,
of for all SCI entities would be $754,453.
k. Identification of Critical SCI Systems, Major SCI Events, De Minimis SCI
Events, and Material Systems Changes
Identification of critical SCI systems, major SCI events, de minimis SCI events, and
material systems changes establishes recordkeeping burdens for all SCI entities.
Rule 1003(a)(1) requires each SCI entity to establish reasonable written criteria for
identifying a change to its SCI systems and the security of indirect SCI systems as material.
The Commission estimates that each new SCI entity will initially require 114 hours to
establish the criteria for identifying material systems changes, or 228 hours annually for all such
SCI entities. 136 With respect to the Infrastructure Rule, the Commission estimates that one SCI
competing consolidator that is currently an SRO or affiliated with an SRO would each have 50%
of the estimated initial burdens for a new SCI entity, which will require an average of 57 burden
hours. 137 Four SCI SCI competing consolidators that are not already subject to Regulation SCI
would have the same burdens as other new SCI entities (114 hours), or 456 hours annually for all
such new SCI entities. The total average initial burden, including the Infrastructure Rules, for all
such SCI entities would be 741hours.
134

(9 Compliance Manager hours x $307) + (9 Attorney hours x $412) + (3 Senior Systems Analyst
hours x $282) + (3 Operations Specialist hours x $135) + (10 Chief Compliance Officer hours x
$526) + (5 Director of Compliance hours x $483) = $15,397.

135

$15,397 x 44 = $677,468.

136

114 hours × 2 new SCI entities = 456 hours.

137

37
The Commission estimates that the average annual internal cost of compliance associated
with this initial recordkeeping burden would be $42,528 for each new SCI entity, 138 or $85,056
annually for all such new SCI entities. 139 With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator would have 50% of the estimated
average annual internal cost of compliance for a new SCI entity, which would be $21,264. Four
SCI competing consolidators would have the same costs as other new SCI entities ($42,528), or
$170,112 for all such new competing consolidators. The total annual internal cost of compliance
associated with this initial recordkeeping burden, including the Infrastructure Rules, for all such
SCI entities would be $276,432.
The Commission estimates that each SCI entity will require approximately 27 hours
annually to review and update the criteria, or, on average, 1,188 hours annually for all such SCI
entities. 140 With respect to the Infrastructure Rules, the Commission notes that two of the seven
SCI competing consolidators that are the existing SIPs would have no additional burden (i.e.,
they have been included in the above estimates). The remaining five SCI competing
consolidators would have the same average ongoing burden as other SCI entities (27 hours each
annually), or 135 hours annually for all such competing consolidators. The total average annual
ongoing burden, including the Infrastructure Rules, for all SCI entities 1,323 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden would be $11,536 for each SCI entity, 141 or $507,548
annually for all such SCI entities. 142 With respect to the Infrastructure Rules, the Commission
notes that two of the seven SCI competing consolidators that are the existing SIPs would have no
additional burden (i.e., they have been included in the above estimates). The remaining five of
the ten SCI competing consolidators would have the same average annual internal cost of
compliance as other SCI entities ($11,536 each), or on average, $57,680 annually for all such
competing consolidators. The total average internal cost of compliance, including the
Infrastructure Rules, for all SCI entities would be $565,228.
Regulation SCI also requires SCI entities to identify certain types of events and systems.
The Commission believes that the identification of critical SCI systems, major SCI events, and
138

139

$42,528 x 2 = $85,056.

140

27 hours × 44 SCI entities = 1,188 hours.

141

(4.5 Compliance Manager hours x $307) + (4.5 Attorney hours x $412) + (1.5 Senior Systems
Analyst hours x $282) + (1.5 Operations Specialist hours x $135) + (10 Chief Compliance Officer
hours x $526) + (5 Director of Compliance hours x $483) = $11,536.

142

$11,536 x 44 = $507,584.

38
de minimis SCI events will impose an initial one-time implementation burden on new SCI
entities in developing processes to quickly and correctly identify the nature of a system or event.
The identification of these systems and events may also impose periodic burdens on SCI entities
in reviewing and updating the processes.
The Commission estimates that each new SCI entity will require 198 hours initially to
establish the criteria for identifying certain systems and events, or 396 hours annually for all such
SCI entities. 143 With respect to the Infrastructure Rules, the Commission estimates that one SCI
competing consolidator that is currently an SRO or affiliated with an SRO would have 50% of
the estimated initial burdens for a new SCI entity, which will require an average of 99 burden
hours. 144 Four SCI competing consolidators that are not already subject to Regulation SCI
would have the same burdens as other new SCI entities (198 hours), or 792 hours annually for all
such new SCI entities. The total average initial burden, including the Infrastructure Proposal, for
all such SCI entities would be 1,287 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this initial recordkeeping burden would be $69,706 for each new SCI entity, 145 or $139,412
annually for all such new SCI entities. 146 With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator would have 50% of the estimated
average annual internal cost of compliance for a new SCI entity, which would be $34,853. Four
SCI competing consolidators would have the same costs as other new SCI entities ($69,706), or
$278,824 for all such new competing consolidators. The total annual internal cost of compliance
associated with this initial recordkeeping burden, including the Infrastructure Rules, for all such
SCI entities would be $453,089.
The Commission estimates that each SCI entity will require 39 hours annually to review
and update such criteria, or, on average, 1,716 hours annually for all SCI entities. 147 With
respect to the Infrastructure Rules, the Commission notes that two of the seven SCI competing
consolidators that are the existing SIPs would have no additional burden (i.e., they have been
included in the above estimates). The remaining five competing consolidators would have the
same average ongoing burden as other SCI entities (39 hours each annually), or 195 hours
annually for all such competing consolidators. The total average annual ongoing burden,
143

198 hours × 2 new SCI entities = 396 hours.

144

145

(64 Compliance Manager hours x $307) + (64 Attorney hours x $412) + (20 Senior Systems
Analyst hours x $282) + (20 Operations Specialist hours x $135) + (20 Chief Compliance Officer
hours x $526) + (10 Director of Compliance hours x $483) = $69,706.

146

$69,706 x 2 = $139,412.

147

39 hours × 44 SCI entities = 1,716 hours.

39
including the Infrastructure Rules, for all SCI entities would be 1,911 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden would be $15,397 for each SCI entity, 148 or, on average,
$677,468 annually for all such SCI entities. 149 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
would have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators would have the same average annual
internal cost of compliance as other SCI entities ($15,397 each), or on average, $76,985 annually
for all such competing consolidators. The total average internal cost of compliance, including
the Infrastructure Rules, for all SCI entities would be $754,453.
The Commission estimates that:
•

The total average annual initial recordkeeping burden related to establishing
criteria for identifying material systems changes, and certain systems and
events, including the Infrastructure Rules, is 2,028 hours, and

•

The total average annual ongoing recordkeeping burden related to
establishing criteria for identifying material systems changes, and certain
systems and events, including the Infrastructure Rules, is 3,234 hours.
l. Recordkeeping Required by Rules 1005 and 1007

The recordkeeping requirements establish recordkeeping burdens for SCI entities other
than SCI SROs.
The Commission estimates that, for each new SCI entity other than an SCI SRO, setting
up or modifying a recordkeeping system to comply with Rule 1005 will create an initial burden
of 170 hours, or 170 hours annually for all new SCI entities other than SCI SROs. 150 With
respect to the Infrastructure Rules, the Commission estimates that one competing consolidators
that is currently an SRO or affiliated with an SRO would have 50% of the estimated initial
burdens for a new non-SRO SCI entity, which will require an average of 85 burden hours. 151
148

149

$15,397 x 44 = $677,468.

150

170 hours × 1 new non-SRO SCI entities = 170 hours.

151

Although one of the five SCI competing consolidators is an SRO or affiliated with an SRO, the
Commission believes that this competing consolidator would have the same burdens as a nonSRO SCI entity for these particular ongoing burdens. Because the Commission is estimating a

40
Four SCI competing consolidators that are not already subject to Regulation SCI would have the
same burdens as other new non-SRO SCI entities (170 hours), or 680 hours annually for all such
new SCI entities. The Commission estimates that the total average initial burden for
complying with Rules 1005 and 1007, including the Infrastructure Rules, for all such SCI
entities would be 935 hours.
The Commission estimates that the annual internal cost of compliance associated with
this initial recordkeeping burden would be $11,730 for each new SCI entity that is not an
SRO. 152 With respect to the Infrastructure Rules, the Commission estimates that one SCI
competing consolidator that is currently an SROs or affiliated with an SRO wouldhave 50% of
the estimated initial burdens for a new non-SRO SCI entity, which would be$5,865. Four SCI
competing consolidators that are not already subject to Regulation SCI would have the same
burdens as other new non-SRO SCI entities ($11,730), or $46,920 hours annually for all such
new SCI entities. The total annual internal cost of compliance associated with this initial
recordkeeping burden, including the Infrastructure Rules, for all such SCI entities would be
$64,515.
The Commission also estimates that the burden to make, keep, and preserve records
relating to compliance with Regulation SCI, as required by Rule 1005(b), will be approximately
25 hours annually per SCI entity that is not an SCI SRO. Therefore, the Commission estimates a
total annual burden of 275 hours for all such SCI entities. 153 With respect to the Infrastructure
Rules, the Commission notes that two of the seven SCI competing consolidators that are the
existing SIPs would have no additional burden (i.e., they have been included in the above
estimates). The remaining five SCI competing consolidators would have the same burdens as
non-SRO SCI entities (25 hours), 154 or 125 burden hours annually for all such competing
consolidators. The Commission estimates that the total average annual ongoing burden for
complying with Rules 1005 and 1007, including the Infrastructure Rules, for all such SCI
entities would be 400 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden would be $1,725 for each SCI entity that is not an
SRO, 155 and, on average, $18,975 annually for all such SCI entities. 156 With respect to the
Infrastructure Rules, the Commission notes that two of the seven SCI competing consolidators
lower initial burden for this subset of SCI entities than for other new SCI entities, the burden
hours per respondent will reflect an average of the burden estimates for all respondents.
152

170 Compliance Clerk hours x $69 per hour = $11,730.

153

25 hours × 11 non-SRO SCI entities = 275 hours.

154

155

25 Compliance Clerk hours x $69 per hour = $1,725.

156

$1,725 x 11 non-SRO SCI entities = $18,975.

41
that are the existing SIPs would have no additional burden (i.e., they have been included in the
above estimates). The remaining five SCI SCI competing consolidators would have the same
average internal cost of compliance as non-SRO SCI entities, ($1,725) or $8,625 annually for all
such competing consolidators. The total annual internal cost of compliance associated with this
ongoing recordkeeping burden, including the Infrastructure Rules, for all such SCI entities would
be $27,600.
m. Summary of Hourly Burdens
The table below summarizes the Commission’s estimate of the total hourly burden and
total internal costs of compliance for SCI entities under Regulation SCI.
Nature of Information
Collection Burden

Annualized Aggregate
Hourly Burden Estimate

Annualized Internal Cost
of Compliance Estimate

Policies and procedures required
by Rule 1001(a) – initial burden

4,511 (Recordkeeping)

$1,512,382 (Recordkeeping)

Policies and procedures required
by Rule 1001(a) – ongoing
burden

11,368 (Recordkeeping)

$3,816,022 (Recordkeeping)

Policies and procedures required
by Rule 1001(b) – initial burden

1,755 (Recordkeeping)

$660,270 (Recordkeeping)

Policies and procedures required
by Rule 1001(b) – ongoing
burden – SCI SRO

5,775 (Recordkeeping)

$1,810,875
(Recordkeeping)

Policies and procedures required
by Rule 1001(b) – ongoing
burden –non-SRO SCI entity

1,520 (Recordkeeping)

$501,680 (Recordkeeping)

Policies and procedures required
by Rule 1001(c) – initial burden

741 (Recordkeeping)

$276,432 (Recordkeeping)

Policies and procedures required
by Rule 1001(c) – ongoing
burden

1,911 (Recordkeeping)

$
(Recordkeeping)

Mandate participation in certain
testing required by Rule 1004 –
initial burden

2,700 (Recordkeeping)

$804,735 (Recordkeeping)

42
Nature of Information
Collection Burden

Annualized Aggregate
Hourly Burden Estimate

Annualized Internal Cost
of Compliance Estimate

Mandate participation in certain
testing required by Rule 1004–
ongoing burden

6,615 (Recordkeeping)

$1,760,325(Recordkeeping)

SCI event notice required by
Rule 1002(b)(1)

392 (Reporting)

$120,712 (Reporting)

SCI event notice required by
Rule 1002(b)(2)

5,880 (Reporting)

$1,937,215 (Reporting)

SCI event notice required by
Rule 1002(b)(3)

515 (Reporting)

$160,707.75 (Reporting)

SCI event notice required by
Rule 1002(b)(4)

8,575 (Reporting)

$2,992,185 (Reporting)

SCI event notice required by
Rule 1002(b)(5)

7,840 (Reporting)

$2,649,038 (Reporting)

Dissemination of information
required by Rule 1002(c)(1)(i)

1,029 (Third Party
Disclosure)

$672,895 (Third Party
Disclosure)

Dissemination of information
required by Rule 1002(c)(1)(ii)

5,733 (Third Party
Disclosure)

$2,264,976 (Third Party
Disclosure)

Dissemination of information
required by Rule 1002(c)(2)

490 (Third Party
Disclosure)

$193,121 (Third Party
Disclosure)

Material systems change notice
required by Rule 1003(a)(1)

24,500 (Reporting)

$7,317,170 (Reporting)

Material systems change notice
required by Rule 1003(a)(2)

735 (Reporting)

$232,946 (Reporting)

SCI review required by Rules
1003(b)(1) and (b)(2)

33,810 (Recordkeeping)

$10,829,735
(Recordkeeping)

SCI review required by Rule
1003(b)(3)

49 (Reporting)

$20,188 (Reporting)

43
Nature of Information
Collection Burden

Annualized Aggregate
Hourly Burden Estimate

Annualized Internal Cost
of Compliance Estimate

Access to EFFS – new entities

1.95 (Reporting)

$806 (Reporting)

Access to EFFS – existing
entities

7.35 (Reporting)

$3,038 (Reporting)

Corrective action required by
Rule 1002(a) – initial burden

741 (Recordkeeping)

$276,432 (Reporting)

Corrective action required by
Rule 1002(a) – ongoing burden

1,911 (Recordkeeping)

$754,453 (Reporting)

Identification of critical SCI
systems, major SCI events, de
minimis SCI events, and material
systems changes – initial burden

2,028 (Recordkeeping)

$729,521 (Recordkeeping)

Identification of critical SCI
systems, major SCI events, de
minimis SCI events, and material
systems changes – ongoing
burden

3,234 (Recordkeeping)

$1,319,681 (Recordkeeping)

Recordkeeping required by Rules
1005 and 1007 – initial burden

935 (Recordkeeping)

$64,515 (Recordkeeping)

Recordkeeping required by Rules
1005 and 1007 – ongoing burden

400 (Recordkeeping)

$27,600 (Recordkeeping)

13.

Costs to Respondents

a. Policies and Procedures Required by Rule 1001(a)
Rule 1001(a) imposes recordkeeping costs for SCI entities. In establishing, maintaining,
and enforcing the policies and procedures required by Rule 1001(a), the Commission believes
that each new SCI entity will seek outside legal and/or consulting services in the initial
preparation of such policies and procedures. The total annualized recordkeeping cost of seeking
outside legal and/or consulting services will be $94,000 for all new SCI entities 157 ($47,000 for
157

See supra note 21.

44
the first year × 2 new SCI entities), or $47,000 per new SCI entity. With respect to the
Infrastructure Rules, the Commission estimates that one SCI competing consolidator that is
currently an SRO or affiliated with an SRO would have 50% of the estimated annualized
recordkeeping cost for a new SCI entity, which would be $23,500. 158 Four SCI competing
consolidators would have the same costs as other new SCI entities ($47,000), or $188,000 for all
such new competing consolidators. The total annualized recordkeeping cost, including the
Infrastructure Rules, for all such SCI entities would be $305,500.
b. Policies and Procedures Required by Rule 1001(b)
Rule 1001(b) imposes recordkeeping costs for SCI entities. In establishing, maintaining,
and enforcing the policies and procedures required by Rule 1001(b), the Commission believes
that each new SCI entity will seek outside legal and/or consulting services in the initial
preparation of such policies and procedures. The total annualized cost of seeking outside legal
and/or consulting services will be $54,000 ($27,000 for the first year × 2 new SCI entities), or
$27,000 per new SCI entity. With respect to the Infrastructure Rules, the Commission estimates
that one competing consolidator that is currently an SRO or affiliated with an SRO would have
50% of the estimated annualized cost for a new SCI entity, which would be $13,500. Four
competing consolidators would have the same costs as other new SCI entities ($27,000), or
$108,000 for all such new competing consolidators. 159 The total annualized recordkeeping
cost, including the Infrastructure Rules, for all such SCI entities would be $175,500.
c. Policies and Procedures Required by Rule 1001(c)
The Commission does not expect SCI entities to incur any external PRA costs in
connection with the policies and procedures required under Rule 1001(c).
d. Mandate Participation in Certain Testing Required by Rule 1004
Rule 1004 imposes recordkeeping costs for SCI entities that are plan processors (2
SCI entities). In complying with Rule 1004, the Commission believes that plan processors will
seek outside legal services. The Commission estimates that the total annual ongoing
recordkeeping cost of seeking outside legal services for compliance with Rule 1004 will be
$108,000 ($54,000 × 2 plan processors) or $54,000 per plan processor.
e. SCI Event Notice Required by Rule 1002(b)
158

Because the Commission is estimating a lower initial cost for this subset of SCI entities than for
other new SCI entities, the cost per respondent will reflect an average of the cost estimates for all
respondents.

159

45
Rule 1002(b) imposes reporting costs for SCI entities. The Commission estimates that
while SCI entities will handle internally most of the work associated with Rule 1002(b), SCI
entities will seek outside legal advice in the preparation of certain Commission notifications.
The total annual reporting cost of seeking outside legal advice will be $255,200 for all SCI
entities ($5,800 × 44 SCI entities). Because Rule 1002(b) will impose approximately 21
reporting requirements per SCI entity per year, each requirement will require an average of
$276.19. 160 With respect to the Infrastructure Rules, the total annual reporting cost of seeking
outside legal advice for five of the seven SCI competing consolidators will be $29,000 ($5,800 x
5 competing consolidators). 161 The total annual reporting cost, including the Infrastructure
Proposal, for all SCI entities would be $284,200.
The Commission estimates the following cost burdens for each paragraph of Rule
1002(b):
•

SCI event notice required by Rule 1002(b)(1): $67,667;

•

SCI event notice required by Rule 1002(b)(2): $67,667;

•

SCI event notice required by Rule 1002(b)(3): $27,067;

•

SCI event notice required by Rule 1002(b)(4): $67,667; and

•

SCI event notice required by Rule 1002(b)(5): $54,133.

f. Dissemination of Information Required by Rule 1002(c)
Rule 1002(c) imposes third party disclosure costs for SCI entities. The Commission
believes SCI entities will seek outside legal advice in the preparation of the information
dissemination under Rule 1002(c). The total annual third party disclosure cost of seeking outside
legal advice will be $146,080 ($3,320 per SCI entity per year × 44 SCI entities). Because Rule
1002(c) will impose approximately 13 third party disclosure requirements per SCI entity per
year, each requirement will require an average of $255.38. 162 With respect to the Infrastructure
Rules, the total annual reporting cost of seeking outside legal advice for five of the seven
competing consolidators will be $16,600 ($3,320 x 5 SCI competing consolidators). 163 The total
160

$5,800 per SCI entity ÷ 21 requirements = $276.19 per requirement per SCI entity.

161

As discussed above, two of the seven SCI competing consolidators that are the existing
SIPs would have no additional burden (i.e., they have been included in the above
estimates of other SCI entities).

162

$3,320 per SCI entity ÷ 13 requirements = $255.38 per requirement per SCI entity.

163

46
annual reporting cost, including the Infrastructure Proposal, for all SCI entities would be
approximately $162,680.
The Commission estimates the following cost burdens for each paragraph of Rule
1002(c):
•

Dissemination of information required by Rule 1002(c)(1)(i): $37,541;

•

Dissemination of information required by Rule 1002(c)(1)(ii): $112,623; and

•

Dissemination of information required by Rule 1002(c)(2)(2): $12,513.

g. Material Systems Change Notice Required by Rule 1003(a)
The Commission does not expect SCI entities to incur any external PRA costs in
connection with the reports required under Rule 1003(a).
h. SCI Review Required by Rule 1003(b)
Rule 1003(b) imposes recordkeeping costs for SCI entities. The Commission estimates
that while SCI entities will handle internally some or most of the work associated with
compliance with Rule 1003(b), SCI entities will outsource some of the work associated with an
SCI review. The total annual recordkeeping cost of outsourcing will be $2,200,000 ($50,000 ×
44 SCI entities). With respect to the Infrastructure Rules, the total annual recordkeeping cost of
outsourcing for five of the seven competing consolidators will be $250,000 ($50,000 x 5 SCI
competing consolidators). 164 The total annual recordkeeping cost, including the
Infrastructure Rules, for all SCI entities would be $2,450,000.
i. Access to EFFS
As noted above, Rule 1006 requires each SCI entity, with a few exceptions, to file any
notification, review, description, analysis, or report to the Commission required under
Regulation SCI electronically on Form SCI. Obtaining the ability for an individual to
electronically sign a Form SCI imposes reporting costs for SCI entities. The Commission
estimates that each SCI entity will designate two individuals to sign Form SCI each year, and
each such individual must obtain a digital ID at the cost of approximately $25 each year.
Therefore, each SCI entity will require $50 annually to obtain digital IDs, 165 or $2,200 for all

164

As discussed above, two of the seven SCI competing consolidators that are the existing SIPs
would have no additional burden (i.e., they have been included in the above estimates of other
SCI entities).

165

$25 per digital ID × 2 individuals = $50.

47
SCI entities. 166 With respect to the Infrastructure Rules, the Commission estimates that the
total cost annually to obtain digital IDs for five of the seven SCI competing consolidators would
be $250. 167 The total annual cost, including the Infrastructure Proposal, for all SCI entities
would be $2,450.
j. Corrective Action Required by Rule 1002(a)
The Commission does not expect SCI entities to incur any external PRA costs in
connection with the requirement to take corrective actions under Rule 1002(a).
k. Identification of Critical SCI Systems, Major SCI Events, De Minimis SCI events, and
Material Systems Changes
The Commission does not expect SCI entities to incur any external PRA costs in
connection with the identification of critical SCI systems, major SCI events, de minimis SCI
events, and material systems changes.
l. Recordkeeping Required by Rules 1005 and 1007
The recordkeeping requirements impose recordkeeping costs for SCI entities other than
SCI SROs. The Commission estimates that a new SCI entity other than an SCI SRO will incur a
one-time recordkeeping cost of $900 to set up or modify an existing recordkeeping system to
comply with the recordkeeping requirements. 168 In addition, with respect to the Infrastructure
Rules, the Commission estimates that five of the seven SCI competing consolidators would have
the same recordkeeping cost as non-SRO SCI entities, ($900) or $4,500 annually for all such
competing consolidators. 169 The total recordkeeping cost, including the Infrastructure Rules,
would be $5,400 for all SCI entities.
m. Summary of Cost Burdens
The table below summarizes the Commission’s estimate of the total cost burden for SCI
entities under Regulation SCI.
Nature of Information Collection Burden

Burden Estimate in Dollars

Policies and procedures required by Rule 1001(a)

$305,500 (Recordkeeping)

166

$50 per SCI entity × 44 SCI entities = $2,200.

167

As discussed above, two of the seven SCI competing consolidators that are the existing SIPs
would have no additional burden (i.e., they have been included in the above estimates of other
SCI entities).

168

See supra note Error! Bookmark not defined. (estimating 1 new non-SRO SCI entity per year).

169

See supra note 154.

48
Nature of Information Collection Burden

Burden Estimate in Dollars

Policies and procedures required by Rule 1001(b)

$175,500 (Recordkeeping)

Mandate participation in certain testing required by
Rule 1004

$108,000 (Recordkeeping)

SCI event notice required by Rule 1002(b)
- This requirement is broken out into the
following individual ICs:
Paragraph (b)(1):
Paragraph (b)(2):
Paragraph (b)(3):
Paragraph (b)(4):
Paragraph (b)(5):

$284,200 (Sum Total) (Reporting)

Dissemination of information required by Rule
1002(c)
- This requirement is broken out into the
following ICs:
Paragraph (c)(1)(i):
Paragraph (c)(1)(ii):
Paragraph (c)(2):

$162,680 (Sum Total) (Third Party
Disclosure)

SCI review required by Rules 1003(b)(1) and (b)(2)

$2,450,000 (Recordkeeping)

Access to EFFS

$2,450 (Reporting)

Recordkeeping required by Rules 1005 and 1007 –
initial burden

$5,400 (Recordkeeping)

14.

$67,667
$67,667
$27,067
$67,667
$54,133

$37,541
$112,623
$12,513

Costs to Federal Government

The Commission expects to incur ongoing maintenance costs. Third party contractors will
perform most of the work except for some testing and project management, which will be
performed by Commission staff. The Commission estimates that the total costs for these third party
contractors will be $180,000 annually.

49
In addition, the Commission believes that the costs to the federal government associated
with Regulation SCI reflect the resources, both human and technological, of the Technology
Controls Program.
15.

Changes in Burden

The estimated burdens have been adjusted to reflect a new category of SCI entities, SCI
competing consolidators, as proposed and adopted through the Infrastructure Rules. As described
above, the Commission’s estimate of the number of competing consolidators that will be subject to
Regulation SCI has been reduced from the Infrastructure Proposal and, therefore, the burden
estimates have been reduced from the Infrastructure Proposal to the adoption of the Infrastructure
Rules. As such, the chart below reflects both the estimates from the Infrastructure Proposal and the
final Infrastructure Rules.
The Commission has revised its burden estimates for the collections of information, as
summarized in this chart:

Name of
Information
Collection

Policies and
procedures
required by
Rule 1001(a)
– initial
burden
Policies and
procedures
required by
Rule 1001(a)
– ongoing
burden
Policies and
procedures
required by
Rule 1001(b)
– initial
burden
Policies and
procedures
required by

Annual
Industry
Burden
Hours or
Cost
Previously
Approved
(2018
Extension)

Change in
Burden Hours
or Cost
(Previously
Approved vs.
Proposal)

Change in
Burden Hours
or Cost
(Previously
Approved vs.
Final Rule)

Reason
for
Change

Annual
Industry
Burden Hours
or Cost
(Proposal)

Annual
Industry
Burden Hours
or Cost (Final
Rule)

6,940/
$470,000

4,511/
$305,500

1,388/
$94,000

5,552/
$376,000

3,123/
$211,500

Amendment
to the rule

12,528

11,368

10,208

2,320

1,160

Amendment
to the rule

2,700/
$270,000

1,755/
$175,500

540/
$54,000

2,160/
$216,000

1,215/
$121,500

Amendment
to the rule

5,775

50
Rule 1001(b)
– ongoing
burden – SCI
SRO
Policies and
procedures
required by
Rule 1001(b)
– ongoing
burden –
non-SCI SRO
entity
Policies and
procedures
required by
Rule 1001(c)
– initial
burden
Policies and
procedures
required by
Rule 1001(c)
– ongoing
burden
Mandate
participation
in certain
testing
required by
Rule 1004 –
initial burden
Mandate
participation
in certain
testing
required by
Rule 1004–
ongoing
burden
SCI event
notice
required by
170

5,775

1,995

1,520

1,045

950

475

Amendment
to the rule

1,140

741

228

912

513

Amendment
to the rule

2,106

1,911

1,716

390

195

Amendment
to the rule

3,960

2,700

720

3,240

1,980

=Amendment
to the rule

7,290/
$108,000

6,615/
$108,000

5,670/
$108,000

1,620/
$0

945/
$0

Amendment
to the rule

432/
$313,200 170

392/

352/
$255,200

80/
$58,000

40/
$29,000

Amendment
to the rule

This estimate reflects the total reporting costs for complying with all of Rule 1002(b), including
subparagraphs (b)(1) through (b)(5).

51
Rule
1002(b)(1)
SCI event
notice
required by
Rule
1002(b)(2)
SCI event
notice
required by
Rule
1002(b)(3)
SCI event
notice
required by
Rule
1002(b)(4)
SCI event
notice
required by
Rule
1002(b)(5)
Dissemination
of information
required by
Rule
1002(c)(1)(i)
Dissemination
of information
required by
Rule
1002(c)(1)(ii)
Dissemination
of information
required by
Rule
1002(c)(2)

$284,200 171

6,480

5,880

5,280

1,200

600

Amendment
to the rule

567

514.5

462

105

52.5

Amendment
to the rule

9,450

8,575

7,700

1,750

875

Amendment
to the rule

8,640

7,840

7,040

1,600

800

Amendment
to the rule

1,134/
$179,280 172

1,029
$162,680 173

924/
$146,080

210/
$33,200

105/
$129,480

Amendment
to the rule

6,318

5,733

5,148

1,170

585

Amendment
to the rule

540

490

440

100

Amendment
to the rule

171

This estimate reflects the total reporting costs for complying with all of Rule 1002(b), including
subparagraphs (b)(1) through (b)(5).

172

This estimate reflects the total reporting costs for complying with all of Rule 1002(c), including
subparagraphs (c)(1) through (c)(2).

173

This estimate reflects the total reporting costs for complying with all of Rule 1002(c), including
subparagraphs (c)(1) through (c)(2).

52
Material
systems
change notice
required by
Rule
1003(a)(1)
Material
systems
change notice
required by
Rule
1003(a)(2)
SCI review
required by
Rules
1003(b)(1)
and (b)(2)
SCI review
required by
Rule
1003(b)(3)
Access to
EFFS – new
entities
Access to
EFFS –
existing
entities
Corrective
action
required by
Rule 1002(a)
– initial
burden
Corrective
action
required by
Rule 1002(a)
– ongoing
burden
Identification
of critical
SCI systems,
major SCI
events, de

27,000

24,500

22,000

5,000

2,500

Amendment
to the rule

810

735

660

150

Amendment
to the rule

37,260/
$2,700,000

33,810/
$2,450,000

30,360/
$2,200,000

6,900/
$500,000

3,450/
$250,000

Amendment
to the rule

1.95

0.6

2.4

1.35

Amendment
to the rule

8.1/
$2,700

7.35/
$2,450

6.6/
$2,200

1.5/
$500

0.75/
$250

Amendment
to the rule

1,140

741

228

912

513

Amendment
to the rule

2,106

1,911

1,716

390

195

Amendment
to the rule

3,120

2,028

624

2,496

1,404

Amendment
to the rule

53
minimis SCI
events, and
material
systems
changes –
initial burden
Identification
of critical
SCI systems,
major SCI
events, de
minimis SCI
events, and
material
systems
changes –
ongoing
burden
Recordkeepin
g required by
Rules 1005
and 1007 –
initial burden
Recordkeepin
g required by
Rules 1005
and 1007 –
ongoing
burden

16.

3,564

3,234

2,904

660

330

Amendment
to the rule

1,539/
$11,700

935/

275

$5,400

$90

1,264/
$11,610

660/
$5,310

Amendment
to the rule

400

170

405

230

Amendment
to the rule

575

Information Collections Planned for Statistical Purposes

Not applicable. The information collections above are not planned for statistical purposes.
17.

Approval to Omit OMB Expiration Date

We request authorization to omit the expiration date on the electronic version of the form.
Including the expiration date on the electronic version of the form will result in increased costs,
because the need to make changes to the form may not follow the application’s scheduled version
release dates. The OMB control number will be displayed.
18.

Exceptions to Certification for Paperwork Reduction Act Submissions

This collection complies with the requirements in 5 CFR 1320.9.

54
B.

COLLECTION OF INFORMATION EMPLOYING STATISTICAL METHODS
This collection does not involve statistical methods.

File Type	application/pdf
Author	Liu, David
File Modified	2021-04-14
File Created	2021-04-14