Reg. SCI and Form SCI Supporting Statement 2021

Reg. SCI and Form SCI Supporting Statement 2021.pdf

Regulation SCI and Form SCI

OMB: 3235-0703

⚠️ Notice: This form may be outdated. More recent filings and information on OMB 3235-0703 can be found here:

Document [pdf]

Download: pdf | pdf

SUPPORTING STATEMENT
for the Paperwork Reduction Act Information Collection Submission for
Regulation SCI
OMB Control No. 3235-0703

This submission is being made pursuant to the Paperwork Reduction Act of 1995, 44 U.S.C.
Section 3501 et seq.
A.

JUSTIFICATION
1.

Information Collection Necessity

Section 11A(a)(2) of the Securities Exchange Act of 1934 (“Exchange Act”),1 enacted as
part of the Securities Acts Amendments of 1975 (“1975 Amendments”),2 directs the
Commission, having due regard for the public interest, the protection of investors, and the
maintenance of fair and orderly markets, to use its authority under the Exchange Act to facilitate
the establishment of a national market system for securities in accordance with the Congressional
findings and objectives set forth in Section 11A(a)(1) of the Exchange Act.3 Among the findings
and objectives in Section 11A(a)(1) is that “[n]ew data processing and communications
techniques create the opportunity for more efficient and effective market operations”4 and “[i]t is
in the public interest and appropriate for the protection of investors and the maintenance of fair
and orderly markets to assure…the economically efficient execution of securities transactions.”5
In addition, Sections 6(b), 15A, and 17A(b)(3) of the Exchange Act impose obligations on
national securities exchanges, national securities associations, and clearing agencies,
respectively, to be “so organized” and “[have] the capacity to…carry out the purposes of [the
Exchange Act].”6
The U.S. securities markets have been transformed by regulatory and related
technological developments in recent years. They have, among other things, substantially
enhanced the speed, capacity, efficiency, and sophistication of the trading functions that are
available to market participants. At the same time, these technological advances generated an
increasing risk of operational problems with automated systems, including failures, disruptions,
delays, and intrusions. Given the speed and interconnected nature of the U.S. securities markets,
a seemingly minor systems problem at a single entity could quickly create losses and liability for
1

15 U.S.C. 78k-1(a)(2).

Pub. L. 94-29, 89 Stat. 97 (1975).

15 U.S.C. 78k-1(a)(1).

15 U.S.C. 78k-1(a)(1)(B).

15 U.S.C. 78k-1(a)(1)(C)(i).

See 15 U.S.C. 78f(b)(1), 78o-3(b)(2), 78q-1(b)(3), respectively. See also 15 U.S.C. 78b, and 15
U.S.C. 78s.

2
market participants, and spread rapidly across the national market system, potentially creating
widespread damage and harm to market participants, including investors.
In November 2014, the Commission adopted Regulation Systems Compliance and
Integrity (“Regulation SCI”)7 to require certain key market participants to, among other things:
(1) have comprehensive policies and procedures in place to help ensure the robustness and
resiliency of their technological systems, and also that their technological systems operate in
compliance with the federal securities laws and with their own rules; and (2) provide certain
notices and reports to the Commission to improve Commission oversight of securities market
infrastructure. Prior to the adoption of Regulation SCI, Commission oversight of the technology
of the U.S. securities markets was conducted primarily pursuant to a voluntary set of principles
articulated in the Commission’s ARP Policy Statements, applied through the Commission’s
Automation Review Policy inspection program (“ARP Inspection Program”). Regulation SCI
was adopted to update, formalize, and expand the Commission’s ARP Inspection Program, and,
with respect to SCI entities, to supersede and replace the Commission’s ARP Policy Statements,
as well as certain rules regarding systems capacity, integrity, and security in Rule 301(b)(6) of
Regulation ATS that relate to ATSs that trade NMS and non-NMS stocks.8
A confluence of factors contributed to the Commission’s adoption of Regulation SCI and
to the Commission’s determination that it was necessary and appropriate to address the
technological vulnerabilities, and improve Commission oversight, of the core technology of key
U.S. securities markets entities, including national securities exchanges and associations,
significant alternative trading systems, clearing agencies, and plan processors. These
considerations included: the evolution of the markets to become significantly more dependent
upon sophisticated, complex, and interconnected technology; the successes and limitations of the
ARP Inspection Program; a significant number of, and lessons learned from, systems issues at
exchanges and other trading venues; increased concerns over “single points of failure” in the
securities markets; and the views of a wide variety of commenters received in response to the
proposing release for Regulation SCI.9
The Commission acknowledged that the nature of technology and the level of
sophistication and automation of current market systems prevent any measure, regulatory or
otherwise, from completely eliminating all systems disruptions, intrusions, or other systems
issues. However, the Commission believed that the adoption of, and compliance by SCI entities
with Regulation SCI would advance the goals of the national market system by enhancing the
capacity, integrity, resiliency, availability, and security of the automated systems of entities
important to the functioning of the U.S. securities markets, as well as reinforce the requirement
that such systems operate in compliance with the Exchange Act and rules and regulations
7

Securities and Exchange Act Release No. 34-73639 (November 19, 2014), 79 FR 72251
(December 5, 2014).

See 17 CFR 242.301(b)(6)(i)(A) and 17 CFR 242.301(b)(6)(i)(B).

Securities Exchange Act Release No. 69077 (March 8, 2013), 78 FR 18083 (March 25, 2013)
(“SCI Proposal”).

3
thereunder, thus strengthening the infrastructure of the U.S. securities markets and improving its
resilience when technological issues arise. In this respect, Regulation SCI established an
updated and formalized regulatory framework, thereby helping to ensure more effective
Commission oversight of such systems.
As adopted, Rule 1001(a) requires each SCI entity to establish, maintain, and enforce
written policies and procedures for systems capacity, integrity, resiliency, availability, and
security. Rule 1001(b) requires each SCI entity to establish, maintain, and enforce written
policies and procedures to ensure that its SCI systems operate in a manner that complies with the
Exchange Act, the rules and regulations thereunder, and the SCI entity’s rules and governing
documents, as applicable. Rule 1001(c) requires each SCI entity to establish, maintain, and
enforce written policies and procedures for the identification, designation, and documentation of
responsible SCI personnel and escalation procedures. Rule 1002(a) requires each SCI entity to
begin to take appropriate corrective action upon any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred. Rule 1002(b) requires each SCI
entity to notify the Commission of certain SCI events. Rule 1002(c) requires each SCI entity,
with certain exceptions, to disseminate information about SCI events to affected members or
participants, and disseminate information about major SCI events to all members or participants.
Rule 1003(a) requires each SCI entity to notify the Commission of material systems changes
quarterly. Rule 1003(b) requires each SCI entity to conduct annual SCI reviews. Rule 1004
requires each SCI entity to designate certain members or participants for participation in
functional and performance testing of the SCI entity’s business continuity and disaster recovery
(“BC/DR”) plans, and to coordinate such testing with other SCI entities. Rules 1005 and 1007
set forth recordkeeping requirements for SCI entities. Rule 1006 requires, with certain
exceptions, that each SCI entity electronically file required notifications, reviews, descriptions,
analysis, or reports to the Commission on Form SCI.
The Commission estimates that there are currently 47 entities that meet the definition of
SCI entity and are subject to the collection of information requirements of Regulation SCI. Of
these 47 respondents, 35 will meet the definition of SCI SRO, 7 will meet the definition of SCI
ATS, 2 will meet the definition of plan processor, and 3 will meet the definition of exempt
clearing agency subject to ARP. The Commission estimates that approximately 2 entities will
become SCI entities each year, one of which will be an SRO. Accordingly, over the next three
years, the Commission estimates that there will be an average of approximately 49 SCI entities
each year.
In December 2020, the Commission adopted amendments to Reg. SCI in connection with
updates to the national market system for the collection, consolidation, and dissemination of
information with respect to quotations for and transactions in national market system (“NMS”)
stocks (“Infrastructure Rules” or “Infrastructure Amendments”). Specifically, the Commission
adopted a definition of “SCI competing consolidator” that will subject competing consolidators
to Regulation SCI, after a transition period, if they are above a specified consolidated market

4
data gross revenue threshold.10 The Infrastructure Amendments increased the number of
respondents to the collections of information in Regulation SCI, and as described below, some of
these respondents were estimated to incur no, or only part of, the estimated initial burdens
because they were already subject to Regulation SCI (i.e., as plan processors, SROs or affiliates
of SROs). The Commission submitted, and received approval for, a revision in connection with
the Regulation SCI Infrastructure Amendments that modified most of the information collections
in this OMB number (3235-0703).
The Commission is not modifying the burden hour or cost estimates per respondent. The
Commission is modifying the estimated number of respondents based on the current number of
SCI entities and maintaining its estimate that approximately 2 entities will become SCI entities
each year.
2.

Information Collection Purpose and Use
a. Policies and Procedures Required by Rule 1001

Rule 1001(a) helps to advance the goal of improving Commission review and oversight
of U.S. securities market infrastructure by requiring an SCI entity’s policies and procedures to be
reasonably designed to ensure its own operational capability, including the ability to maintain
effective operations, minimize or eliminate the effect of performance degradations, and have
sufficient backup and recovery capabilities. Because an SCI entity’s own operational capability
can have the potential to impact investors, the overall market, or the trading of individual
securities, the Commission believes that these policies and procedures will help promote the
maintenance of fair and orderly markets. Rule 1001(b) helps to prevent the occurrence of
systems compliance issues, and helps SCI entities to achieve operational compliance with the
Exchange Act, the rules and regulations thereunder, and their governing documents. Rule
1001(c) helps make it clear to all employees of the SCI entity who the designated responsible
SCI personnel are for purposes of the escalation procedures and so that Commission staff can
easily identify such responsible SCI personnel in the course of its inspections and examinations
and other interactions with SCI entities. The Commission also believes that escalation
procedures to quickly inform responsible SCI personnel of potential SCI events helps ensure that
the appropriate person(s) are provided notice of potential SCI events so that any appropriate
10

See Securities Exchange Act Release No. 34-90610 (December 9, 2020), 86 FR 18596
(April 9, 2021) (File No. S7-03-20) (“Infrastructure Adopting Release”). An “SCI
competing consolidator” is defined in Rule 1000 of Regulation SCI to mean “any
competing consolidator, as defined in §242.600 which during at least four of the
preceding six calendar months, accounted for five percent (5%) or more of consolidated
market data gross revenue paid to the effective national market system plan or plans
required under §242.603(b) for NMS stocks (1) listed on the New York Stock Exchange
LLC, (2) listed on The Nasdaq Stock Market LLC, or (3) listed on national securities
exchanges other than the New York Stock Exchange LLC or The Nasdaq Stock Market
LLC, as reported by such plan or plans pursuant to the terms thereof.”

5
actions can be taken in accordance with the requirements of Regulation SCI without unnecessary
delay.
b. Mandate Participation in Certain Testing Required by Rule 1004
Rule 1004 helps reduce the risks associated with an SCI entity’s decision to activate its
BC/DR plans and helps to ensure that such plans operate as intended, if activated. It also helps
an SCI entity to ensure that its efforts to develop effective BC/DR plans are not undermined by a
lack of participation by members or participants that the SCI entity believes are necessary to the
successful activation of such plans. Rule 1004 also assists the Commission in maintaining fair
and orderly markets in a BC/DR scenario following a wide-scale disruption.
c. SCI Event Notice Required by Rule 1002(b)
Rule 1002(b) fosters a system for comprehensive reporting of SCI events, which
enhances the Commission’s review and oversight of U.S. securities market infrastructure and
fosters cooperation between the Commission and SCI entities in responding to SCI events. The
Commission also believes that the aggregated data from the reporting of SCI events enhances its
ability to comprehensively analyze the nature and types of various SCI events and identify more
effectively areas of persistent or recurring problems across the systems of all SCI entities. The
information in the final report required under Rule 1002(b)(4) provides the Commission with a
comprehensive analysis to more fully understand and assess the impact caused by an SCI event.
The quarterly report required by Rule 1002(b)(5) achieves the goal of keeping Commission staff
informed regarding the nature and frequency of systems disruptions and systems intrusions that
arise but are reasonably estimated by the SCI entity to have a de minimis impact on the entity’s
operations or on market participants. Further, submission and review of regular reports
facilitates Commission staff comparisons among SCI entities and thereby permits the
Commission and its staff to have a more holistic view of the types of systems operations
challenges that were posed to SCI entities in the aggregate.
d. Dissemination of Information Required by Rule 1002(c)
Rule 1002(c) advances the Commission’s goal of promoting fair and orderly markets by
disseminating information about an SCI event to some or all of the SCI entity’s members or
participants, who can use such information to evaluate the event’s impact on their trading and
other activities and develop an appropriate response.
e. Material Systems Change Notice Required by Rule 1003(a)
Rule 1003(a) permits the Commission and its staff to have up-to-date information
regarding an SCI entity’s systems development progress and plans, and helps the Commission
with its oversight of U.S. securities market infrastructure.

6
f. SCI Review Required by Rule 1003(b)
The SCI reviews under Rule 1003(b) not only assist the Commission in improving its
oversight of the technology infrastructure of SCI entities, but also assist each SCI entity in
assessing the effectiveness of its information technology practices, helping to ensure compliance
with the safeguards provided by the requirements of Regulation SCI, identifying potential areas
of weakness that require additional or modified controls, and determining where to best devote
resources.
g. Access to EFFS
Rule 1006 provides a uniform manner in which the Commission receives—and SCI
entities provide—written notifications, reviews, descriptions, analyses, or reports made pursuant
to Regulation SCI. Rule 1006 therefore allows SCI entities to efficiently draft and file the
required reports on Form SCI, and the Commission to efficiently review, analyze, and respond to
the information provided. SCI entities submit Form SCI through the electronic form filing
system (“EFFS”), which is also used by SCI SROs to file Form 19b-4 filings. In order to access
EFFS, an SCI entity submits to the Commission an External Application User Authentication
Form (“EAUF”) to register each individual at the SCI entity who access the EFFS system on
behalf of the SCI entity. The information provided via EAUF is used by the Commission to
verify the identity of the individual submitting Form SCI on behalf of the SCI entity and provide
such individual access to the EFFS.
h. Corrective Action Required by Rule 1002(a)
Rule 1002(a) helps facilitate SCI entities’ responses to SCI events, including taking
appropriate steps necessary to remedy the problem or problems causing such SCI event and
mitigate the negative effects of the SCI event, if any, on market participants and the securities
markets more broadly.
i. Identification of Critical SCI Systems, Major SCI Events, De Minimis SCI events,
and Material Systems Changes
The requirement in Rule 1003(a) that each SCI entity establish written criteria for
identifying material systems changes helps the Commission ensure that it is kept apprised of the
systems changes that SCI entities believe to be material and aids the Commission and its staff in
understanding the operations and functionality of the systems of an SCI entity and any changes
to such systems.
The application of different requirements (e.g., Commission notification requirements
and information dissemination requirements) to critical SCI systems, major SCI events, and de
minimis SCI events, and the policies and procedures required by SCI entities to make these
determinations, helps to ensure that the Commission is kept apprised of SCI events, and that
relevant market participants have basic information about SCI events so that those notified can

7
better develop an appropriate response. These policies and procedures also assist SCI entities in
complying with the notification, dissemination and reporting requirements of Regulation SCI.
j. Recordkeeping Required by Rules 1005 and 1007
Rule 1005 assists the Commission in understanding whether an SCI entity is meeting its
obligations under Regulation SCI, assessing whether an SCI entity has appropriate policies and
procedures with respect to its technology systems, helping to identify the causes and
consequences of an SCI event, and understanding the types of material systems changes
occurring at an SCI entity. Rule 1005 also facilitates the Commission’s inspections and
examinations of SCI entities and assists it in evaluating an SCI entity’s compliance with
Regulation SCI. Moreover, having an SCI entity’s records available even after it has ceased to
do business or to be registered under the Exchange Act provides an additional tool to help the
Commission to reconstruct important market events and better understand the impact of such
events.
Rule 1007 helps ensure the Commission’s ability to obtain required records that are held
by a third party who may not otherwise have an obligation to make such records available to the
Commission.
3.

Consideration Given to Information Technology

With a few exceptions, Regulation SCI requires SCI entities to submit any notification,
review, description, analysis, or report to the Commission electronically on Form SCI.
Regulation SCI is designed to streamline the reporting processes and make the processes
efficient by specifying the information required to be provided and requiring SCI entities to
electronically file Form SCI. SCI entities submit Form SCI through the EFFS, which is also
used by SCI SROs to file Form 19b-4 filings.
4.

Duplication

Regulation SCI replaced the two ARP policy statements and related staff guidance.
However, although Regulation SCI codifies in a Commission rule many of the principles of the
ARP policy statements, the rule has a broader scope than those statements.
Regulation SCI also superseded and replaced aspects of the ARP policy statements
codified in Rule 301(b)(6) of Regulation ATS, applicable to significant-volume ATSs that trade
NMS stocks and non-NMS stocks. Because Regulation SCI replaced the ARP policy statements,
related staff guidance, and aspects of Rule 301(b)(6) applicable to significant-volume ATSs that
trade NMS stocks and non-NMS stocks, Regulation SCI does not duplicate any existing
information collection.
With regard to any FINRA rules applicable to ATSs, the Commission does not believe
that these rules provide a comprehensive regulatory scheme relating to the capacity, integrity,
resiliency, availability, and security of SCI systems comparable to Regulation SCI.

8
5.

Effect on Small Entities

Not applicable. None of the respondents subject to the information collection will be a
small entity.
6.

Consequences of Not Conducting Collection

The collection of information is designed to ensure that SCI entities operate with adequate
capacity, integrity, resiliency, availability, and security, and in compliance with the Exchange Act
and relevant rules. Any less frequent collection would deprive the Commission of timely
information regarding systems issues and systems changes at SCI entities and SCI entities’
compliance with Regulation SCI. Any less frequent collection also would deprive the Commission
and members or participants of SCI entities of timely information regarding the occurrence and
resolution of systems issues.
7.

Inconsistencies with Guidelines in 5 CFR 1320.5(d)(2)

Several provisions of Regulation SCI require respondents to report information to the
agency more often than quarterly. These provisions include Rules 1002(b), 1002(c), and Rule
1003(a), which generally involve the provision of certain types of notifications involving an SCI
event (e.g., a systems disruption, a systems intrusion, or a systems compliance issue), either to the
Commission or to a third party, and notification to the Commission of material systems changes.
Depending on the frequency of SCI events (with exceptions for certain SCI events), SCI entities
may be required to provide information to the Commission or disseminate information to their
members or participants more than once per quarter. However, the Commission believes that
timely and comprehensive reporting of SCI events to the Commission enhance its oversight of
U.S. securities market infrastructure and foster cooperation between the Commission and SCI
entities in responding to SCI events. For example, timely receipt of information regarding an
SCI event helps the Commission and its staff to quickly assess the nature and scope of that SCI
event, and potentially assist the SCI entity in identifying the appropriate response. Further, the
Commission believes the timely dissemination of information about certain SCI events to
member or participants of SCI entities helps members or participants to quickly assess the nature
and scope of those SCI events and whether and how they were affected by the events, and make
appropriate decisions based on those assessments.
In addition, SCI entities may be required to provide information to the Commission
regarding material systems changes more often than quarterly. In particular, although Rule
1003(a) requires quarterly reports of material systems changes, it also requires prompt
supplemental reports notifying the Commission of a material error in or material omission from a
previously submitted report. The Commission believes that it should, on an ongoing basis, have
complete and correct information regarding material systems changes at an SCI entity, rather
than waiting until the next quarterly report to receive corrected information.

9
Rule 1005(b) requires each SCI entity (other than an SCI SRO) to make, keep, and
preserve at least one copy of all documents relating to its compliance with Regulation SCI for a
period of not less than five years, the first two years in a place that is readily accessible to the
Commission or its representatives for inspection and examination. The Commission notes that
these recordkeeping time periods are consistent with those currently applicable to self-regulatory
organizations (including SCI SROs) under Rule 17a-1 under the Exchange Act.
Finally, information submitted to the Commission under Regulation SCI could include
proprietary trade secret or other confidential information. However, if a confidential treatment
request is properly made, the Commission will keep the information collected pursuant to Form
SCI confidential to the extent permitted by law.11
8.

Consultations Outside the Agency

The required Federal Register notice with a 60-day comment period soliciting comments
on this collection of information was published. No public comments were received.
9.

Payment or Gift

Not applicable.
10.

Confidentiality

The Commission expects that the written policies and procedures, processes, criteria,
standards, or other written documents developed or revised by SCI entities pursuant to
Regulation SCI will be retained by SCI entities in accordance with, and for the periods specified
in Exchange Act Rule 17a-1 and Rule 1005, as applicable. Should such documents be made
available for examination or inspection by the Commission and its representatives, they would be
kept confidential subject to the provisions of applicable law.12 In addition, the information
submitted to the Commission pursuant to Regulation SCI that is filed on Form SCI is treated as
confidential, subject to applicable law, including amended Rule 24b-2.13 The information
disseminated by SCI entities pursuant to Rule 1002(c) under Regulation SCI to their members or
participants is not confidential.

See, e.g., 15 U.S.C. 78x (governing the public availability of information obtained by the
Commission); 5 U.S.C. 552 et seq. (Freedom of Information Act); 17 CFR 240.24b-2.

Id.

10
11.

Sensitive Questions

No information of a sensitive nature will be required under this collection of information.
The agency has determined that neither a Privacy Impact Assessment (“PIA”) nor a System of
Records Notice (“SORN”) are required in connection with the collection of information.
12.

Information Collection Burden

Each of the individual information collections in Regulation SCI is described in the subsections below. The changes to the burdens that resulted from the recent Infrastructure
Amendments to Regulation SCI, and that were included in the previous revision, continue to be
discussed separately. This is due to the fact that the revisions were only recently approved and the
revised initial burdens have not yet been incurred because such entities are not yet required to
comply with the rule.
a. Policies and Procedures Required by Rule 1001(a)
Rule 1001(a) establishes recordkeeping burdens for SCI entities. However, certain
burdens will be different for current SCI entities and new SCI entities.
Rule 1001(a) requires each SCI entity to establish, maintain, and enforce written policies
and procedures reasonably designed to ensure that its SCI systems and, for purposes of security
standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and
security, adequate to maintain the SCI entity’s operational capability and promote the
maintenance of fair and orderly markets.
The Commission estimates that approximately 2 entities will become SCI entities each
year. A new SCI entity will require an average of 534 burden hours initially to develop and
draft the policies and procedures required by Rule 1001(a) (except for the policies and
procedures required by paragraph (a)(2)(vi) for standards that result in systems being designed,
developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful
collection, processing, and dissemination of market data, which is discussed below), or 1,06815
hours annually for all such SCI entities. With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator that is currently an SRO or affiliated
with an SRO16 will have 50% of the estimated initial burdens for a new SCI entity, which will
14

This estimate for new SCI entities does not include SCI competing consolidators under the
Infrastructure Rules. Competing consolidators that will become SCI entities are discussed
separately throughout this analysis.

534 hours × 2 new SCI entities = 1,068 hours.

Two of the seven SCI competing consolidators that are existing SIPs would be operating a
substantially similar business and performing a similar function in their new role as SCI
competing consolidators and therefore the Commission believes they would not have any material

11
require an average of 267 burden hours.17 Four SCI competing consolidators that are not already
subject to Regulation SCI willwill have the same burdens as other new SCI entities (534 hours),
or 2,136 hours annually for all such new SCI entities. The total average initial burden, including
the Infrastructure Rules, for all such SCI entities will be 3,471 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this initial recordkeeping burden will be $178,418 for each new SCI entity,18 or $356,836
for all such new SCI entities.19 With respect to the Infrastructure Rules, the Commission
estimates that one SCI competing consolidator will have 50% of the estimated average annual
internal cost of compliance for a new SCI entity, which will be $89,209. Four SCI competing
consolidators will have the same costs as other new SCI entities ($178,418), or $713,672 for all
such new SCI competing consolidators. The total annual internal cost of compliance associated
with this initial recordkeeping burden, including the Infrastructure Rules, for all such SCI entities
will be $1,159,717.
The Commission estimates that an SCI entity will require an average of 87 hours
annually to review and update such policies and procedures, or 4,263 hours annually for all such
SCI entities.20 With respect to the Infrastructure Rules, the Commission notes that two of the
seven SCI competing consolidators that are the existing SIPs will instead become SCI competing
consolidators and will have no additional burden (i.e., they have been included in the above
estimates). The remaining five SCI competing consolidators will have the same average ongoing
burden as other SCI entities (87 hours each annually), or 435 hours annually for all such SCI
competing consolidators. The total average annual ongoing burden, including the Infrastructure
Rules, for all SCI entities will be 4,698 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden will be $31,143 for each SCI entity,21 or $1,526,007 for
all such SCI entities.22 With respect to the Infrastructure Rules, the Commission notes that two
initial burdens to comply with the requirements of Regulation SCI.
17

Because the Commission is estimating a lower initial burden for this subset of SCI entities than
for other new SCI entities, the burden hours per respondent will reflect an average of the burden
estimates for all respondents.

(192 Compliance Manager hours x $307) + (192 Attorney hours x $412) + (60 Senior Systems
Analyst hours x $282) + (60 Operations Specialist hours x $135) + (20 Chief Compliance Officer
hours x $526) + (10 Director of Compliance hours x $483) = $178,418.

$178,418 x 2 = $356,836. See also supra note 14.

87 hours × 49 SCI entities = 4,263 hours.

(28 Compliance Manager hours x $307) + (28 Attorney hours x $412) + (8 Senior Systems
Analyst hours x $282) + (8 Operations Specialist hours x $135) + (10 Chief Compliance Officer
hours x $526) + (5 Director of Compliance hours x $483) = $31,143.

$31,143 x 49 = $1,526,007.

12
of the seven SCI competing consolidators that are the existing SIPs will instead become SCI
competing consolidators and will have no additional cost (i.e., they have been included in the
above estimates). The remaining five SCI competing consolidators will have the same average
annual internal cost of compliance as other SCI entities ($31,143 each), or $155,715 for all such
SCI competing consolidators. The total average internal cost of compliance, including the
Infrastructure Rules, for all such SCI entities will be $1,681,722.
With respect to the requirement in Rule 1001(a)(2)(vi) for policies and procedures that
provide for standards that result in systems being designed, developed, tested, maintained,
operated, and surveilled in a manner that facilitates the successful collection, processing, and
dissemination of market data, the Commission estimates that each new SCI entity will spend, on
average, 160 hours initially, or 320 hours annually for all new SCI entities.23 With respect to the
Infrastructure Rules, the Commission estimates that one SCI competing consolidator that is
currently an SRO or affiliated with an SRO24 will have 50% of the estimated initial burdens for a
new SCI entity, which will require an average of 80 burden hours. 25 Four SCI competing
consolidators that are not already subject to Regulation SCI will have the same burdens as other
new SCI entities (160 hours each), or 640 hours annually for all such new SCI entities. The total
average initial burden, including the Infrastructure Rules, for all such SCI entities will be 1,040
hours.
The Commission estimates that the average internal cost of compliance associated with
this initial recordkeeping burden will be $54,410 for each new SCI entity, 26 or $108,820
annually for all such new SCI entities.27 With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator will have 50% of the estimated
average annual internal cost of compliance for a new SCI entity, which will be $27,205. Four
SCI competing consolidators will have the same costs as other new SCI entities ($54,410) or
$217,640 for all such new SCI competing consolidators. The total annual internal cost of
compliance associated with this initial recordkeeping burden, including the Infrastructure Rules,
for all such SCI entities will be $353,665.

160 hours × 2 new SCI entities = 320 hours.

Two of the seven SCI competing consolidators that are existing SIPs would be operating a
substantially similar business and performing a similar function in their new role as competing
consolidators and therefore the Commission believes would not have an initial burden under Rule
1001(a)(2)(vi).

(30 Compliance Attorney hours x $362) + (100 Senior Systems Analyst hours x $282) + (20
Chief Compliance Officer hours x $526) + (10 Director of Compliance hours x $483) = $54,410.

$54,410 x 2 = $108,820.

13
The Commission estimates that each SCI entity will spend, on average, 145 hours
annually to review and update such policies and procedures, or 7,105 hours annually, on average,
for all such SCI entities.28 With respect to the Infrastructure Rules, the Commission notes that
two of the seven SCI competing consolidators that are the existing SIPs will have no additional
burden (i.e., they have been included in the above estimates). The remaining five SCI competing
consolidators will have the same average ongoing burden as other SCI entities (145 hours each
annually), or 725 hours annually for all such SCI competing consolidators. The total average
ongoing burden, including the Infrastructure Rules, for all SCI entities will be 7,830 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden will be $46,735 for each SCI entity, 29 or $2,290,015
annually for all such SCI entities.30 With respect to the Infrastructure Rules, the Commission
notes that two of the seven SCI competing consolidators that are the existing SIPs will have no
additional cost (i.e., they have been included in the above estimates). The remaining five SCI
competing consolidators will have the same average annual internal cost of compliance as other
SCI entities ($46,735 each), or $233,675 for all such SCI competing consolidators. The total
average internal cost of compliance, including the Infrastructure Rules, will be $2,523,690.
In summary, the Commission estimates that the total average annual initial recordkeeping
burden for complying with Rule 1001(a) for new SCI entities is 1,388 hours, or 694 hours per
new SCI entity, and the total average annual ongoing recordkeeping burden for SCI entities is
11,368 hours, or approximately 232 hours per SCI entity. The Commission estimates that the
total average annual initial recordkeeping burden for complying with Rule 1001(a) for SCI
competing consolidators is 3,123 hours, or approximately 625 hours per competing consolidator
(that is not currently a SIP),31 and the total average annual ongoing recordkeeping burden for SCI
competing consolidators is 1,160 hours, or approximately 232 hours per competing consolidator.
The Commission estimates that:
 The total average annual initial recordkeeping burden for complying with
Rule 1001(a), including the Infrastructure Rules, is 4,511 hours, and


The total average annual ongoing recordkeeping burden for complying with
Rule 1001(a), including the Infrastructure Rules, is 12,528 hours.

145 hours × 49 SCI entities = 7,105 hours.

(30 Compliance Attorney hours x $362) + (100 Senior Systems Analyst hours x $282) + (10
Chief Compliance Officer hours x $526) + (5 Director of Compliance hours x $483) = $46,735.

$46,735 x 49 = $2,290,015.

This estimate is an average across five SCI competing consolidators, but as discussed above one
of the expected SCI competing consolidators that is currently an SRO is estimated to have only a
50% initial burden.

14
b. Policies and Procedures Required by Rule 1001(b)
Rule 1001(b) establishes recordkeeping burdens for all SCI entities. However, certain
burdens will be different for SCI entities that are SCI SROs and SCI entities that are not SCI
SROs.
Rule 1001(b) requires each SCI entity to establish, maintain, and enforce written policies
and procedures reasonably designed to ensure that its SCI systems operate in a manner that
complies with the Exchange Act and the rules and regulations thereunder and the entity’s rules
and governing documents, as applicable.
The Commission estimates that a new SCI entity will spend 270 hours initially to design
the systems compliance policies and procedures, or 540 hours annually for all new SCI entities.32
With respect to the Infrastructure Rules, the Commission estimates that one SCI competing
consolidator that is currently an SRO or affiliated with an SRO will have 50% of the estimated
initial burdens for a new SCI entity, which will require an average of 135 burden hours.33 Four
SCI competing consolidators that are not already subject to Regulation SCI will have the same
burdens as other new SCI entities (270 hours), or 1,080 hours annually for all such new SCI
entities. The total average initial burden, including the Infrastructure Rules, for all such SCI
entities will be 1,755 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this initial recordkeeping burden will be $101,580 for each new SCI entity, 34 or $203,160
annually for all such new SCI entities.35 With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator will have 50% of the estimated
average annual internal cost of compliance for a new SCI entity, which will be $50,790. Four
SCI competing consolidators will have the same costs as other new SCI entities ($101,580), or
$406,320 for all such new SCI competing consolidators. The total annual internal cost of
compliance associated with this initial recordkeeping burden, including the Infrastructure Rules,
for all such SCI entities will be $660,270.
The Commission estimates that each SCI SRO will spend, on average, 175 hours
annually to review and update such policies and procedures, or 6,300 hours for all SCI SROs.36
32

270 hours × 2 new SCI entities = 540 hours.

(40 Compliance Attorney hours x $362) + (200 Senior Systems Analyst hours x $282) + (20
Chief Compliance Officer hours x $526) + (10 Director of Compliance hours x $483) = $101,580.

$54,410 x 2 = $108,820.

175 hours × 36 SCI SROs = 6,300 hours.

15
The Commission estimates that each SCI entity that is not an SRO will spend, on average, 95
hours annually to review and update such policies and procedures, or 1,235 hours for all such
SCI entities.37 With respect to the Infrastructure Rules, the Commission notes that two of the
seven SCI competing consolidators that are the existing SIPs will instead become SCI competing
consolidators and wi hallve no additional burden (i.e., they have been included in the above
estimates). The Commission estimates that the remaining five SCI competing consolidators will
have the same burdens as each SCI entity that is not an SRO (hereafter, a “non-SRO SCI entity’)
(95 hours),38 or 475 burden hours annually for all such SCI competing consolidators. The total
average annual ongoing burden, including the Infrastructure Rules, for all SCI entities will be
8,010 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden will be $54,875 for each SCI SRO, 39 or $1,975,500 for
all such SCI entities.40 The Commission estimates that the average annual internal cost of
compliance associated with this ongoing recordkeeping burden will be $31,355 for each SCI
entity that is not an SRO, 41 or $407,615 for all such SCI entities.42 With respect to the
Infrastructure Rules, the Commission notes that two of the seven SCI competing consolidators
that are the existing SIPs will instead become SCI competing consolidators and will have no
additional burden (i.e., they have been included in the above estimates). The Commission
estimates that the remaining five SCI competing consolidators will have the same average
internal cost of compliance as non-SRO SCI entities, ($31,355) or $156,775 burden hours
annually for all such SCI competing consolidators. The total average internal cost of
compliance, including the Infrastructure Rules, will be $2,539,890 for all SCI entities.
The Commission estimates that:


the total average annual initial recordkeeping burden for complying with
Rule 1001(b), including the Infrastructure Rules, is 1,755 hours;



the total average annual ongoing recordkeeping burden for complying with
Rule 1001(b) for SCI SROs is 6,300 hours; and

95 hours × 13 non-SRO SCI entities = 1,235 hours.

Although one of the five competing consolidators is an SRO or affiliated with an SRO, the
Commission believes that SRO competing consolidators would have the same burdens as a non
SRO SCI entity for these particular ongoing burdens.

(26 Compliance Attorney hours x $362) + (134 Senior Systems Analyst hours x $282) + (10
Chief Compliance Officer hours x $526) + (5 Director of Compliance hours x $483) = $54,875.

$54,875 x 36 = $1,975,500.

(14 Compliance Attorney hours x $362) + (66 Senior Systems Analyst hours x $282) + (10 Chief
Compliance Officer hours x $526) + (5 Director of Compliance hours x $483) = $31,355.

$31,355 x 13 = $407,615.

16


the total average annual ongoing recordkeeping burden for complying with
Rule 1001(b) for non-SRO SCI entities is 1,710 hours.
c. Policies and Procedures Required by Rule 1001(c)

Rule 1001(c) establishes recordkeeping burdens for all SCI entities.
Rule 1001(c) requires each SCI entity to establish, maintain, and enforce reasonably
designed written policies and procedures that include the criteria for identifying responsible SCI
personnel, the designation and documentation of responsible SCI personnel, and escalation
procedures to quickly inform responsible SCI personnel of potential SCI events.
The Commission estimates that each new SCI entity will require 114 hours initially to
establish the criteria for identifying responsible SCI personnel and the escalation procedures, or
228 hours for all new SCI entities.43 With respect to the Infrastructure Rules, the Commission
estimates that one SCI competing consolidator that is currently an SRO or affiliated with an SRO
will have 50% of the estimated initial burdens for a new SCI entity, which will require an
average of 57 burden hours. Four SCI competing consolidators that are not already subject to
Regulation SCI will have the same burdens as other new SCI entities (114 hours), or 456 hours
annually for all such new SCI entities.44 The total average initial burden, including the
Infrastructure Rules, for all such SCI entities will be 741 hours.
The Commission estimates that the average internal cost of compliance associated with
this initial recordkeeping burden will be $42,528 for each new SCI entity, 45 or $85,056 for all
such new SCI entities.46 With respect to the Infrastructure Rules, the Commission estimates that
one SCI competing consolidators will have 50% of the estimated average annual internal cost of
compliance for a new SCI entity, which will be $21,264. Four SCI competing consolidators will
have the same costs as other new SCI entities ($42,528), or $170,112 for all such new SCI
competing consolidators. The total annual internal cost of compliance with this initial
recordkeeping burden, including the Infrastructure Rules, for all such SCI entities will be
$276,432.

114 hours × 2 new SCI entities = 228 hours.

(32 Compliance Manager hours x $307) + (32 Attorney hours x $412) + (10 Senior Systems
Analyst hours x $282) + (10 Operations Specialist hours x $135) + (20 Chief Compliance Officer
hours x $526) + (10 Director of Compliance hours x $483) = $42,528.

$42,528 x 2 = $85,056.

17
The Commission also estimates that, on average, each SCI entity will require 39 hours
annually to review and update the criteria and the escalation procedures, or 1,911 hours annually
for all SCI entities.47 With respect to the Infrastructure Rules, the Commission estimates that
two of the seven SCI competing consolidators that are the existing SIPs will have no additional
burden (i.e., they have been included in the above estimates). The remaining five SCI competing
consolidators will have the same average ongoing burden as other SCI entities (39 hours each
annually), or 195 hours annually for all such SCI competing consolidators. The total average
annual ongoing burden, including the Infrastructure Rules, for all SCI entities will be 2,106
hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden will be $15,548 for each SCI entity, 48 or $761,852 for
all such SCI entities.49 With respect to the Infrastructure Rules, the Commission estimates that
two of the seven SCI competing consolidators that are the existing SIPs will have no additional
cost (i.e., they have been included in the above estimates). The remaining five SCI competing
consolidators will have the same average annual internal cost of compliance as other SCI entities
($15,548 each), or $77,740. The total average internal cost of compliance, including the
Infrastructure Rules, for all SCI entities will be $839,592.
The Commission estimates that:


The total average annual initial recordkeeping burden for complying
with Rule 1001(c), including the Infrastructure Rules, is 741 hours, and



The total average annual ongoing recordkeeping burden for complying
with Rule 1001(c), including the Infrastructure Rules, is 2,106 hours.

d. Mandate Participation in Certain Testing Required by Rule 1004
Rule 1004 establishes recordkeeping burdens for SCI entities that are not plan processors.
Rule 1004 requires each SCI entity to establish standards for the designation of certain
members or participants for BC/DR plan testing, to designate members or participants in
accordance with these standards, to require participation by designated members or participants
in such testing at least annually, and to coordinate such testing on an industry- or sector-wide
basis with other SCI entities.

39 hours × 49 SCI entities = 1,911 hours.

(9.5 Compliance Manager hours x $307) + (9.5 Attorney hours x $412) + (2.5 Senior Systems
Analyst hours x $282) + (2.5 Operations Specialist hours x $135) + (10 Chief Compliance Officer
hours x $526) + (5 Director of Compliance hours x $483) = $15,548.

$15,548 x 49 = $761,852.

18
The Commission estimates that the requirements under Rules 1004(a) (i.e., establishment
of standards for the designation of members and participants) and (c) (i.e., coordination of testing
on an industry- or sector-wide basis) will initially require 360 hours for each new SCI entity that
is not a plan processor,50 or 720 hours annually for all such SCI entities.51 With respect to the
Infrastructure Rules, the Commission estimates that three SCI competing consolidators that are
currently SIPs or SROs or affiliated with an SRO will have 50% of the estimated initial burdens
for a new SCI entity,52 which will require an average of 180 burden hours, or 540 burden hours
annually for all such SCI competing consolidators.53 Four SCI competing consolidators that are
not already subject to Regulation SCI will have the same burdens as other new SCI entities (360
hours), or 1,440 hours annually for all such new SCI entities. The total average initial burden,
including the Infrastructure Rules, for all such SCI entities will be 2,700 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this initial recordkeeping burden would be $107,298 for each new SCI entity that is not a
plan processor, 54 or $214,596 annually for all such entities.55 With respect to the Infrastructure
Rules, the Commission estimates that three SCI competing consolidators that are currently SIPs
or SROs or affiliated with an SRO will each have 50% of the estimated average annual internal
cost of compliance for a new SCI entity, which will be $53,649 for each such competing
consolidator, or $160,947 for all such SCI entities. Four competing consolidators will have the
same costs as other new SCI entities ($107,298), or $429,192 for all such new competing
consolidators. The total annual internal cost of compliance with this initial recordkeeping
burden, including the Infrastructure Rules, for all such SCI entities will be $804,735.
Further, the Commission estimates that the requirements under Rules 1004(a) and (c) will
require 135 hours annually for each SCI entity that is not a plan processor, or an average estimate

The estimate of 360 hours includes the burden for designating members or participants for
testing, as required by Rule 1004(b).

360 hours × 2 new SCI entities other than plan processors = 720 hours.

The Commission believes that for this particular burden, existing SIPs that become SCI
competing consolidators will have the same burdens as other SRO SCI entities and have not
otherwise been included in prior burden estimates, and so they have been added to this burden
estimate.

(40 Compliance Manager hours x $307) + (60 Attorney hours x $412) + (20 Assistant General
Counsel hours x $462) + (60 Senior Operations Manager hours x $362) + (140 Operations
Specialist hours x $135) + (26 Chief Compliance Officer hours x $526) + (14 Director of
Compliance hours x $483) = $107,298.

$107,298 x 2 = $214,596.

19
of 6,345 hours annually for all such SCI entities.56 With respect to the Infrastructure Rule, the
seven SCI competing consolidators57 will have the same average ongoing burden as other SCI
entities (135 hours each annually), or 945 hours annually for all such competing consolidators.
The total average annual ongoing burden, including the Infrastructure Rules, for all SCI entities
will be 7,290 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden will be $35,925 for each SCI entity, 58 or $1,688,475
annually for all such entities.59 With respect to the Infrastructure Rules, the seven SCI
competing consolidators will have the same average annual internal cost of compliance as other
SCI entities ($35,925), or $251,475. The total average internal cost of compliance, including the
Infrastructure Rules, for all SCI entities would be $1,939,950. Based on its experience with plan
processors, the Commission believes that plan processors will outsource the work related to
compliance with Rule 1004 (and, accordingly, such outsourced costs have been included in the
response to Item 13).
In summary, the Commission estimates that:


The total average annual initial recordkeeping burden for complying with
Rule 1004(a) and (c), including the Infrastructure Rules, is 2,700 hours, and



The total average annual ongoing recordkeeping burden is 7,290 hours.
e. SCI Event Notice Required by Rule 1002(b)

Rule 1002(b) establishes reporting burdens for all SCI entities.
Rule 1002(b)(1) requires each SCI entity, upon any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred, to notify the Commission
56

135 hours × 47 SCI entities other than plan processors = 6,345 hours. As noted in the SCI
Adopting Release, the Commission does not believe that there would be significant annual burden
under Rule 1004(a), as the Commission believes that designation standards will likely not change
substantially on an annual basis. See Regulation SCI Adopting Release, 79 FR 72380, FN. 1495.

The Commission notes that for this particular burden, existing SIPs that become SCI competing
consolidators have not otherwise been included in prior burden estimates, and the Commission
believes they will have the same burdens as other SCI entities, and therefore they have been
added to this burden estimate.

(10 Compliance Manager hours x $307) + (15 Attorney hours x $412) + (5 Assistant General
Counsel hours x $462) + (20 Senior Operations Manager hours x $362) + (70 Operations
Specialist hours x $135) + (10 Chief Compliance Officer hours x $526) + (5 Director of
Compliance hours x $483) = $35,925.

$35,925 x 47 = $1,688,475.

20
immediately. Based on Commission staff experience with SCI event notifications, the
Commission staff estimates that each SCI entity will submit, on average, 5 notifications per year
pursuant to Rule 1002(b)(1). These notifications can be made orally or in writing, and the
Commission estimates that approximately one-fourth of these notifications will be submitted in
writing (i.e., approximately 1 event per year for each SCI entity), and approximately threefourths will be provided orally (i.e., approximately 4 events per year for each SCI entity). The
written notifications may be submitted on Form SCI. The Commission estimates that each
written notification will require 2 hours and each oral notification will require 1.5 hours. The
Commission estimates that each SCI entity will require an average of 8 hours annually to comply
with Rule 1002(b)(1),60 or, on average, 392 hours annually for all SCI entities.61 With respect to
the Infrastructure Rules, the Commission notes that two of the seven SCI competing
consolidators that are the existing SIPs will have no additional burden (i.e., they have been
included in the above estimates). The remaining five SCI competing consolidators will have the
same average ongoing burden as other SCI entities (8 hours each annually) or 40 hours annually
for all such competing consolidators. The Commission estimates that the average annual
ongoing burden for complying with Rule 1002(b)(1), including the Infrastructure Rules,
will be 432 hours for all SCI entities.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden for written notifications will be approximately $637 for each
SCI entity,62 and for oral notifications will be $1,827 for each SCI entity,63 or, on average,
$120,712 annually for all such SCI entities for all notifications.64 With respect to the
Infrastructure Rules, the Commission notes that two of the seven SCI competing consolidators
that are the existing SIPs will have no additional burden (i.e., they have been included in the
above estimates). The remaining five of the seven SCI competing consolidators will have the
same average annual internal cost of compliance as other SCI entities, or on average or $3,183
for written notifications65 and $9,135 for oral notifications annually for all such SCI competing
consolidators, or on average, $12,318 for all such SCI competing consolidators. The total
average internal cost of compliance, including the Infrastructure Rules, for all SCI entities would
be $133,030.
60

1 written notification each year × 2 hours per notification + 4 oral notifications each year × 1.5
hours per notification = 8 hours.

8 hours × 49 SCI entities = 392 hours.

(0.5 Compliance Manager hours x $307) + (0.5 Attorney hours x $412) + (0.5 Senior Systems
Analyst hours x $282) + (0.5 Senior Business Analyst hours x $272) = $636.50. $636.50 per
notification x 1 written notification each year = $636.50.

(0.25 Compliance Manager hours x $307) + (0.25 Attorney hours x $412) + (0.5 Senior Systems
Analyst hours x $282) + (0.5 Senior Business Analyst hours x $272) = $456.75. $456.75 per
notification x 4 oral notifications each year = $1,827.

$636.50 + $1,827 = $2,463.5. $2,463.5 x 49 = $120,711.5.

See supra note 62 (estimating $636.50 per SCI entity per year).

21
Rule 1002(b)(2) requires each SCI entity, within 24 hours of any responsible SCI
personnel having a reasonable basis to conclude that the SCI event has occurred, to submit a
written notification to the Commission pertaining to the SCI event on a good faith, best efforts
basis. These notifications are required to be submitted on Form SCI. The Commission estimates
that each notification under Rule 1002(b)(2) will require 24 hours for each SCI entity. The
Commission estimates that each SCI entity will require an average of 120 hours annually to
comply with Rule 1002(b)(2),66 or 5,880 hours annually for all SCI entities.67 With respect to
the Infrastructure Rules, the Commission notes that two of the seven SCI competing
consolidators that are the existing SIPs will have no additional burden (i.e., they have been
included in the above estimates). The remaining five SCI competing consolidators will have the
same average ongoing burden as other SCI entities (120 hours each annually) or 600 hours
annually for all such competing consolidators. The Commission estimates that the total
average annual ongoing burden for complying with Rule 1002(b)(2), including the
Infrastructure Rules, for all SCI entities will be 6,480 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden will be $39,535 for each SCI entity,68 or $1,937,215 annually
for all such entities.69 With respect to the Infrastructure Rules, the Commission notes that two of
the seven SCI competing consolidators that are the existing SIPs will have no additional burden
(i.e., they have been included in the above estimates). The remaining five of the seven SCI
competing consolidators will have the same average annual internal cost of compliance ($39,535
each), or $197,675 for all such competing consolidators. The total average internal cost of
compliance, including the Infrastructure Rules, for all SCI entities will be $2,134,890.
Rule 1002(b)(3) requires each SCI entity to provide updates to the Commission
pertaining to an SCI event on a regular basis, or at such frequency as reasonably requested by a
representative of the Commission, until the SCI event is resolved and the SCI entity’s
investigation of the SCI event is closed. These updates can be provided orally or in writing, and
the Commission estimates that, based on past experience, each SCI entity will submit 1 written
update and 1 oral update each year, for a total of 2 updates each year. The written updates may
be submitted on Form SCI. The Commission estimates that each written update will require 6
hours and each oral update will require 4.5 hours. The Commission estimates that each SCI
entity will require an average of 10.5 hours annually to comply with Rule 1002(b)(3),70 or, on
66

5 written notifications each year × 24 hours per notification = 120 hours.

120 hours × 49 SCI entities = 5,880 hours.

(5 Compliance Manager hours x $307) + (5 Attorney hours x $412) + (6 Senior Systems Analyst
hours x $282) + (1 Assistant General Counsel hour x $462) + (1 Chief Compliance Officer hour x
$526) + (6 Senior Business Analyst hours x $272) = $7,907. $7,907 per notification x 5
notifications each year = $39,535.

$39,535 x 49 = $1,937,215.

1 written updates each year × 6 hours per notification + 1 oral updates each year × 4.5 hours per

22
average, 515 hours annually for all SCI entities.71 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
will have no additional burden (i.e., they have been included in the above estimates). The
remaining five SCI competing consolidators will have the same average ongoing burden as other
SCI entities (10.5 hours each annually) or 52.5 hours annually for all such competing
consolidators. The Commission estimates that the average annual ongoing burden for
complying with Rule 1002(b)(3), including the Infrastructure Rules, will be 567 hours for
all SCI entities.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden for the written update will be $1,909.50 for each SCI entity,72
and for the oral update will be $1,370.25 for each SCI entity,73 or $160,707.75 annually for all
such SCI entities for all notifications.74 With respect to the Infrastructure Rules, the Commission
notes that two of the seven SCI competing consolidators that are the existing SIPs will have no
additional burden (i.e., they have been included in the above estimates). The remaining five of
the seven SCI competing consolidators will have the same average annual internal cost of
compliance as other SCI entities, or on average $1,909.50 for written notifications and $1,370.25
for oral notifications for each competing consolidator, or $16,398.75 annually for all such
competing consolidators. The total average internal cost of compliance, including the
Infrastructure Rules, for all SCI entities will be $177,106.50.
Rule 1002(b)(4) requires each SCI entity to submit written interim reports, as necessary,
and a written final report regarding an SCI event to the Commission. These reports are required
to be submitted on Form SCI. The Commission estimates that compliance with Rule 1002(b)(4)
for a particular SCI event will require 35 hours. Because the Commission estimates that each
SCI entity will experience an average of 5 SCI events each year that are not de minimis SCI
events, Rule 1002(b)(4) will result in 5 reporting requirements per SCI entity per year. The
Commission estimates that each SCI entity will require an average of 175 hours annually to
comply with Rule 1002(b)(4),75 or 8,575 hours annually for all SCI entities.76 With respect to
notification = 10.5 hours.
71

10.5 hours × 49 SCI entities = 514.5 hours.

(1.5 Compliance Manager hours x $307) + (1.5 Attorney hours x $412) + (1.5 Senior Systems
Analyst hours x $282) + (1.5 Senior Business Analyst hours x $272) = $1,909.50.

(0.75 Compliance Manager hours x $307) + (0.75 Attorney hours x $412) + (0.5 Senior Systems
Analyst hours x $282) + (0.5 Senior Business Analyst hours x $272) = $1,370.25.

$1909.50 + $1,370.25 = $3,279.75. $3,279.75 x 49 = $160,707.75.

5 written notifications each year × 35 hours per notification = 175 hours.

175 hours × 49 SCI entities = 8,575 hours. The Commission notes that this reporting burden
estimate includes the reporting burden for submitting the one interim Commission notification
required under Rule 1002(b)(4)(i)(B) (if necessary). In particular, the Commission notes that the
interim notification requires SCI entities to include the same information as required to be

23
the Infrastructure Rules, the Commission notes that two of the seven SCI competing
consolidators that are the existing SIPs will have no additional burden (i.e., they have been
included in the above estimates). The remaining five SCI competing consolidators will have the
same average ongoing burden as other SCI entities (175 hours each annually) or 875 hours
annually for all such competing consolidators. The Commission estimates that the total
average annual ongoing burden for complying with Rule 1002(b)(4), including the
Infrastructure Rules, for all SCI entities will be 9,450 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden will be $61,065 for each SCI entity,77 or, on average,
$2,992,185 annually for all such SCI entities.78 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
will have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators will have the same average annual
internal cost of compliance as other SCI entities ($61,065 each), or on average, $305,325
annually for all such competing consolidators. The total average internal cost of compliance,
including the Infrastructure Rules, for all SCI entities will be $3,297,510.
Rule 1002(b)(5) requires each SCI entity to submit to the Commission quarterly reports
containing a summary description of any systems disruption or systems intrusion that has had, or
the SCI entity reasonably estimates will have, no or a de minimis impact on the SCI entity’s
operations or on market participants. These reports are required to be submitted on Form SCI.
The Commission estimates that the initial and ongoing reporting burden to comply with the
quarterly report requirement will be 40 hours per report per SCI entity, or 160 hours annually per
SCI entity,79 and, on average, 7,840 hours annually for all SCI entities.80 With respect to the
Infrastructure Rules, the Commission notes that two of the seven SCI competing consolidators
that are the existing SIPs will have no additional burden (i.e., they have been included in the
included in a final notification under Rule 1002(b)(4)(i)(A), except that SCI entities are only
required to provide the information to the extent known at the time of the interim notification. If
an SCI entity submits an interim notification, it is also required to submit a final notification,
which is required to include all of the remaining information that was not provided in the interim
notification. Because all SCI entities are required to provide the same amount of information in
total for a particular SCI event under Rule 1002(b)(4), regardless of whether they submit an
interim notification, the estimated burden for Rule 1002(b)(4) includes the burden for both the
interim notification (if necessary) and the final notification related to a particular SCI event.
77

(8 Compliance Manager hours x $307) + (8 Attorney hours x $412) + (7 Senior Systems Analyst
hours x $282) + (2 Assistant General Counsel hours x $462) + (1 General Counsel hour x $607) +
(2 Chief Compliance Officer hours x $526) + (7 Senior Business Analyst hours x $272) =
$12,213. $12,213 per notification x 5 notifications each year = $61,065.

$61,065 x 49 = $2,992,185.

40 hours × 4 reports each year = 160 hours.

160 hours × 49 SCI entities = 7,840 hours.

24
above estimates). The remaining five SCI competing consolidators will have the same average
ongoing burden as other SCI entities (160 hours each annually) or 800 hours annually for all
such competing consolidators. The Commission estimates that the total average annual
ongoing burden for complying with Rule 1002(b)(5), including the Infrastructure Rules, for
all SCI entities will be 8,640 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden will be $54,062 for each SCI entity,81 or $2,649,038 annually
for all such SCI entities.82 With respect to the Infrastructure Rules, the Commission notes that
two of the seven SCI competing consolidators that are the existing SIPs will have no additional
burden (i.e., they have been included in the above estimates). The remaining five of the seven
SCI competing consolidators will have the same average annual internal cost of compliance as
other SCI entities ($54,062 each), or on average, $270,310 annually for all such competing
consolidators. The total average internal cost of compliance, including the Infrastructure Rules,
for all SCI entities will be $2,919,348.
In summary, the Commission estimates that the total reporting burden for all SCI entities
complying with Rule 1002(b) is 23,202 hours per year,83 or 473.50 hours per SCI entity.84 With
respect to the Infrastructure Rules, the total reporting burden for the five competing consolidators
will be 2,367.5 hours. The total reporting burden for all SCI entities will be 25,569.5 hours.
f. Dissemination of Information Required by Rule 1002(c)
Rule 1002(c) establishes third party disclosure burdens for all SCI entities.
Rule 1002(c)(1)(i) requires each SCI entity, promptly after any responsible SCI personnel
has a reasonable basis to conclude that an SCI event (other than a systems intrusion) has
occurred, to disseminate certain information to its members or participants. The Commission
estimates that each SCI entity will disseminate information regarding 3 SCI events each year
under Rule 1002(c)(1)(i). The Commission estimates that each information dissemination under
Rule 1002(c)(1)(i) will require 7 hours. Thus, the total annual third party disclosure burden to
comply with Rule 1002(c)(1)(i) will be 21 hours per SCI entity,85 or, on average, 1,029 hours
81

(7.5 Compliance Manager hours x $307) + (7.5 Attorney hours x $412) + (10 Senior Systems
Analyst hours x $282) + (2 Assistant General Counsel hours x $462) + (1 General Counsel hour x
$607) + (2 Chief Compliance Officer hours x $526) + (10 Senior Business Analyst hours x $272)
= $13,515.50. $13,515.50 per report x 4 reports each year = $54,062.

$54,062 x 49 = $2,649,038.

392 hours (Rule 1002(b)(1)) + 5,880 hours (Rule 1002(b)(2)) + 515 hours (Rule 1002(b)(3)) +
8,575 hours (Rule 1002(b)(4)) + 7,840 hours (Rule 1002(b)(5)) = 23,202 hours per year.

23,202 hours ÷ 49 SCI entities = 473.5 hours per SCI entity.

3 information disseminations each year × 7 hours per dissemination = 21 hours.

25
annually for all SCI entities.86 With respect to the Infrastructure Rules, the Commission notes
that two of the seven SCI competing consolidators that are the existing SIPs will have no
additional burden (i.e., they have been included in the above estimates). The remaining five SCI
competing consolidators will have the same burden as other SCI entities (21 hours each
annually), or 105 hours annually for all such competing consolidators. The Commission
estimates that the total average annual burden for complying with Rule 1002(c)(1)(i),
including the Infrastructure Rules, for all SCI entities will be 1,134 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden will be approximately $13,733 for each SCI entity,87 or, on
average, $672,892.5 annually for all such SCI entities.88 With respect to the Infrastructure Rules,
the Commission notes that two of the seven SCI competing consolidators that are the existing
SIPs will have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators will have the same average annual
internal cost of compliance as other SCI entities ($13,733 each), or on average, $68,665 annually
for all such competing consolidators. The total average internal cost of compliance, including
the Infrastructure Rules, for all SCI entities will be $741,557.50.
Rule 1002(c)(1)(ii) requires each SCI entity, when known, to promptly disseminate
additional information about an SCI event (other than a systems intrusion) to its members or
participants. Rule 1002(c)(1)(iii) requires each SCI entity to provide to its members or
participants regular updates of any information required to be disseminated under Rules
1002(c)(1)(i) and (ii) until the SCI event is resolved. The Commission estimates that each SCI
entity will disseminate 3 updates for each SCI event under Rules 1002(c)(1)(ii) and (iii), or 9
updates each year.89 The Commission estimates that each update under Rules 1002(c)(1)(ii) and
(iii) will require 13 hours. Thus, the total annual third party disclosure burden to comply with
Rules 1002(c)(1)(ii) and (iii) will be 117 hours per SCI entity,90 or, on average, 5,733 hours
annually for all SCI entities.91 With respect to the Infrastructure Rules, the Commission notes
that two of the seven SCI competing consolidators that are the existing SIPs will have no
additional burden (i.e., they have been included in the above estimates). The remaining five SCI
competing consolidators will have the same burden as other SCI entities (117 hours each
86

21 hours × 49 SCI entities = 1,029 hours.

(1 Compliance Manager hours x $307) + (2.67 Attorney hours x $412) + (1 Senior Systems
Analyst hours x $282) + (0.5 General Counsel hour x $607) + (0.5 Director of Compliance hours
x $483) + (0.5 Chief Compliance Officer hours x $526) + (.5 Corporate Communications
Manager hours x $337) + (.33 Webmasters hours x $246) = $2,746.50. $2,746.50 per notification
x 5 notifications each year = $13,732.50.

$13,732.5 × 49 = $672,892.5.

3 SCI events × 3 updates per SCI event = 9 updates.

9 updates each year × 13 hours per update = 117 hours.

117 hours × 49 SCI entities = 5,733 hours.

26
annually), or 585 hours annually for all such competing consolidators. The Commission
estimates that the total average annual burden for complying with Rule 1002(c)(1)(ii),
including the Infrastructure Rules, for all SCI entities will be 6,318 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden will be $46,224 for each SCI entity,92 or, on average,
$2,264,976 annually for all such SCI entities.93 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
will have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators will have the same average annual
internal cost of compliance as other SCI entities ($46,224 each), or on average, $231,120
annually for all such competing consolidators. The total average internal cost of compliance,
including the Infrastructure Rules, for all SCI entities will be $2,496,096.
Rule 1002(c)(2) requires each SCI entity to disseminate certain information regarding a
systems intrusion to its members or participants, and provides an exception when the SCI entity
determines that dissemination of such information will likely compromise the security of its SCI
systems or indirect SCI systems, or an investigation of the systems intrusion, and documents the
reasons for such determination. The Commission estimates that each SCI entity will disseminate
information regarding 1 systems intrusion each year under Rule 1002(c)(2). The Commission
estimates that each dissemination under Rule 1002(c)(2) will require 10 hours. Thus, the total
annual third party disclosure burden to comply with Rule 1002(c)(2) will be 10 hours per SCI
entity, or, on average, 490 hours for all SCI entities.94 With respect to the Infrastructure Rules,
the Commission notes that two of the seven SCI competing consolidators that are the existing
SIPs will have no additional burden (i.e., they have been included in the above estimates). The
remaining five SCI competing consolidators will have the same burden as other SCI entities (10
hours each), or 50 hours annually for all such competing consolidators. The Commission
estimates that the total average annual burden for complying with Rule 1002(c)(2),
including the Infrastructure Rules, for all SCI entities will be 540 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden will be approximately $3,941 for each SCI entity,95 or
92

(2 Compliance Manager hours x $307) + (4.67 Attorney hours x $412) + (2 Senior Systems
Analyst hours x $282) + (1 General Counsel hour x $607) + (1 Director of Compliance hours x
$483) + (1 Chief Compliance Officer hours x $526) + (1 Corporate Communications Manager
hours x $337) + (.33 Webmasters hours x $246) = $5,136. $5,136 per update x 9 notifications
each year = $46,224.

$46,224 x 49 = $2,264,976.

10 hours × 49 SCI entities = 490 hours.

(1.5 Compliance Manager hours x $307) + (3.67 Attorney hours x $412) + (1.5 Senior Systems
Analyst hours x $282) + (0.75 General Counsel hour x $607) + (0.75 Director of Compliance
hours x $483) + (0.75 Chief Compliance Officer hours x $526) + (0.75 Corporate

27
$193,121.25 annually for all such SCI entities.96 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
will have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators will have the same average annual
internal cost of compliance as other SCI entities ($3,941 each), or on average, $19,706 annually
for all such competing consolidators. The total average internal cost of compliance, including
the Infrastructure Rules, for all SCI entities will be $212,827.25.
In summary, the total annual third party disclosure burden to comply with Rule 1002(c)
will be, on average, 7,252 hours for all SCI entities,97 or 148 hours annually per SCI entity.98
With respect to the Infrastructure Rules, the total burden will be, on average, 740 hours for the
five SCI competing consolidators (not including the current SIPs which are included in the prior
estimate). The total average annual burden will be 7,992 hours for all SCI entities.
g. Material Systems Change Notice Required by Rule 1003(a)
Rule 1003(a) establishes reporting burdens for all SCI entities.
Rule 1003(a)(1) requires each SCI entity to submit to the Commission quarterly reports
describing completed, ongoing, and planned material changes to its SCI systems and security of
indirect SCI systems during the prior, current, and subsequent calendar quarters. These reports
are required to be submitted on Form SCI. The Commission estimates that the reporting burden
to comply with the quarterly reporting requirement will be 125 hours per report per SCI entity, or
500 hours annually per SCI entity99 and an average of 24,500 hours annually for all SCI
entities.100 With respect to the Infrastructure Rules, the Commission notes that two of the seven
SCI competing consolidators that are the existing SIPs will have no additional burden (i.e., they
have been included in the above estimates). The remaining five SCI competing consolidators
will have the same burden as other SCI entities (500 hours each annually), or 2,500 hours
annually for all such competing consolidators. The Commission estimates that the total
average annual burden for complying with Rule 1003(a)(1), including the Infrastructure
Rules, for all SCI entities will be 27,000 hours.

Communications Manager hours x $337) + (.33 Webmasters hours x $246) = $3,941.25.
96

$3,941.25 x 49 = $193,121.25.

1,029 hours (Rule 1002(c)(1)(i)) + 5,733 hours (Rules 1002(c)(1)(ii) and (iii)) + 490 hours (Rule
1002(c)(2)) = 7,252 hours.

7,252 hours ÷ 49 SCI entities = 148 hours per SCI entity.

125 hours × 4 reports each year = 500 hours.

100

500 hours × 49 SCI entities = 24,500 hours.

28
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden for quarterly reports will be $149,330 for each SCI entity,101
or $7,317,170 for all such SCI entities.102 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
will have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators will have the same average annual
internal cost of compliance as other SCI entities ($149,330 each), or on average, $746,650
annually for all such competing consolidators. The total average internal cost of compliance,
including the Infrastructure Rules, for all SCI entities will be $8,063,820.
Rule 1003(a)(2) requires each SCI entity to promptly submit a supplemental report
notifying the Commission of a material error in or material omission from a report previously
submitted under Rule 1003(a)(1). These reports are required to be submitted on Form SCI. The
Commission estimates that each SCI entity will submit 1 supplemental report each year. The
Commission estimates that the reporting burden to comply with the supplemental report
requirement will be 15 hours per report per SCI entity, and, on average, 735 hours annually for
all SCI entities.103 With respect to the Infrastructure Rules, the Commission notes that two of the
seven SCI competing consolidators that are the existing SIPs will have no additional burden (i.e.,
they have been included in the above estimates). The remaining five SCI competing
consolidators will have the same burden as other SCI entities (15 hours each annually), or 75
hours annually for all such competing consolidators. The Commission estimates that the total
average annual burden for complying with Rule 1003(a)(2), including the Infrastructure
Rules, for all SCI entities will be 810 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden for supplemental reports will be $4,754 for each SCI
entity,104 or, on average, $232,946 annually for all such SCI entities.105 With respect to the
Infrastructure Rules, the Commission notes that two of the seven SCI competing consolidators
that are the existing SIPs will have no additional burden (i.e., they have been included in the
above estimates). The remaining five of the seven SCI competing consolidators will have the
same average annual internal cost of compliance as other SCI entities ($4,754 each), or on

101

(7.5 Compliance Manager hours x $307) + (7.5 Attorney hours x $412) + (5 Chief Compliance
Officer hours x $526) + (75 Senior Systems Analyst hours x $282) + (30 Senior Business Analyst
hours x $272) = $37,332.50. $37,332.50 per report x 4 reports each year = $149,330.

102

$149,330 x 49 = $7,317,170.

103

15 hours × 49 SCI entities = 735 hours.

104

(2 Compliance Manager hours x $307) + (2 Attorney hours x $412) + (1 Chief Compliance
Officer hours x $526) + (7 Senior Systems Analyst hours x $282) + (3 Senior Business Analyst
hours x $272) = $4,754.

105

$4,754 x 49 = $232,946.

29
average, $23,770 annually for all such competing consolidators. The total average internal cost
of compliance, including the Infrastructure Rules, for all SCI entities will be $256,716.
In summary, the Commission estimates that the total reporting burden for complying with
Rule 1003(a) is, on average, 25,235 hours per year,106 or 515 hours annually per SCI entity.107
With respect to the Infrastructure Rules, the total reporting burden will be, on average, 2,575
hours for the five SCI competing consolidators (not including the current SIPs which are
included in the prior estimate). The total average annual burden will be 27,810 hours for all SCI
entities.
h. SCI Review Required by Rule 1003(b)
Rule 1003(b) establishes recordkeeping and reporting burdens for all SCI entities.
Rule 1003(b)(1) requires each SCI entity to conduct an SCI review of its compliance with
Regulation SCI not less than once each calendar year, with an exception for penetration test
reviews, which are required to be conducted not less than once every three years. Rule
1003(b)(1) also provides an exception for assessments of SCI systems directly supporting market
regulation or market surveillance, which are required to be conducted at a frequency based on the
risk assessment conducted as part of the SCI review, but in no case less than once every three
years. Rule 1003(b)(2) requires each SCI entity to submit a report of the SCI review to senior
management no more than 30 calendar days after completion of the review. The Commission
estimates that the annual recordkeeping burden of conducting an SCI review and submitting the
SCI review to senior management of the SCI entity for review will be approximately 690 hours
for each SCI entity, and, on average, 33,810 hours annually for all SCI entities.108 With respect
to the Infrastructure Rules, the Commission notes that two of the seven SCI competing
consolidators that are the existing SIPs will have no additional burden (i.e., they have been
included in the above estimates). The remaining five SCI competing consolidators will have the
same burden as other SCI entities (690 hours each annually), or 3,450 hours annually for all such
competing consolidators. The Commission estimates that the total average annual burden
for complying with Rules 1003(b)(1) and 1003(b)(2), including the Infrastructure Rules, for
all SCI entities will be 37,260 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden will be $221,015 for each SCI entity,109 or $10,829,735

106

24,500 hours for Rule 1003(a)(1) + 735 hours for Rule 1003(a)(2) = 25,235 hours.

107

25,235 hours ÷ 49 SCI entities = 515 hours per SCI entity.

108

690 hours × 49 SCI entities = 33,810 hours.

109

(35 Compliance Manager hours x $307) + (80 Attorney hours x $412) + (375 Senior Systems
Analyst hours x $282) + (5 General Counsel hours x $607) + (5 Director of Compliance hours x
$483) + (20 Chief Compliance Officer hours x $526) + (170 Internal Audit Manager hours x

30
annually for all such SCI entities.110 With respect to the Infrastructure Rules, the Commission
notes that two of the seven SCI competing consolidators that are the existing SIPs will have no
additional burden (i.e., they have been included in the above estimates). The remaining five of
the seven SCI competing consolidators will have the same average annual internal cost of
compliance as other SCI entities ($221,015 each), or on average, $1,105,075 annually for all
such competing consolidators. The total average internal cost of compliance, including the
Infrastructure Rules, for all SCI entities will be $11,934,810.
Rule 1003(b)(3) requires each SCI entity to submit the report of the SCI review to the
Commission and to its board of directors or the equivalent of such board, together with any
response by senior management, within 60 calendar days after its submission to senior
management. These reports are required to be submitted on Form SCI. The Commission
estimates that each SCI entity will require approximately 1 hour per year to submit the report of
the SCI review and any response by senior management to the Commission and to its board of
directors or the equivalent of such board, for a reporting burden of approximately 49 hours
annually for all SCI entities.111 With respect to the Infrastructure Rules, the Commission notes
that two of the seven SCI competing consolidators that are the existing SIPs will have no
additional burden (i.e., they have been included in the above estimates). The remaining five SCI
competing consolidators will have the same burden as other SCI entities (1 hour each annually),
or 5 hours annually for all such competing consolidators. The Commission estimates that the
total average annual burden for complying with Rule 1003(b)(3), including the
Infrastructure Rules, for all SCI entities will be 54 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing reporting burden will be $412 for each SCI entity,112 or $20,188annually for all
such SCI entities.113 With respect to the Infrastructure Rules, the Commission notes that two of
the seven SCI competing consolidators that are the existing SIPs will have no additional burden
(i.e., they have been included in the above estimates). The remaining five of the seven
SCIcompeting consolidators will have the same average annual internal cost of compliance as
other SCI entities ($412 each), or on average, $2,060 annually for all such competing
consolidators. The total average internal cost of compliance, including the Infrastructure Rules,
for all SCI entities will be $22,248.
i. Access to EFFS
Rule 1006 requires each SCI entity, with a few exceptions, to file any notification,
review, description, analysis, or report to the Commission required under Regulation SCI
$327) = $221,015.
110

$221,015 x 49 = $10,829,735.

111

1 hour × 49 SCI entities = 49 hours.

112

1 Attorney hour x $412 = $412.

113

$412 x 49 = $20,188.

31
electronically on Form SCI. SCI entities submit Form SCI through the EFFS, which is also used
by SCI SROs to file Form 19b-4 filings. Access to EFFS establishes reporting burdens for all
SCI entities.
An SCI entity will submit to the Commission an EAUF to register each individual at the
SCI entity who will access the EFFS system on behalf of the SCI entity. The Commission is
including in its burden estimates the reporting burden for completing the EAUF for each
individual at an SCI entity that will request access to EFFS. The Commission estimates that
initially, on average, two individuals at each SCI entity will request access to EFFS through the
EAUF, and each EAUF will require 0.15 hours to complete and submit. Therefore, each new
SCI entity will initially require 0.3 hours to complete the requisite EAUFs,114 or 0.6 hours
annually for all new SCI entities.115 With respect to the Infrastructure Rules, the Commission
estimates that one SCI competing consolidator that is currently an SRO or affiliated with an SRO
will each have 50% of the estimated initial burdens for a new SCI entity, which will require an
average of 0.15 burden hours.116 Four SCI competing consolidators that are not already subject
to Regulation SCI will have the same burdens as other new SCI entities (0.3 hours each), or 1.2
hours annually for all such new SCI entities. This averages out to .139 hours per response, with
7 respondents and 2 responses per respondent. The Commission estimates that the total
average initial burden for access to EFFS, including the Infrastructure Rules, for all such
SCI entities will be 1.95 hours.
The Commission estimates that the average cost associated with this initial burden will be
$124 for each new SCI entity,117 or $248 annually for all such new SCI entities.118 With respect
to the Infrastructure Rules, the Commission estimates that one SCI competing consolidator will
have 50% of the estimated average annual internal cost of compliance for a new SCI entity,
which will be $62. Four SCI competing consolidators will have the same costs as other new SCI
entities ($124 each), or $496 for all such new competing consolidators. The total annual internal
cost of compliance associated with this initial recordkeeping burden, including the Infrastructure
Rules, for all such SCI entities will be $806.
The Commission also estimates that annually, on average, one individual at each SCI
entity will request access to EFFS through EAUF. Therefore, the ongoing burden to complete
the EAUF will be 0.15 hours annually per SCI entity,119 or, on average, 7.35 hours annually for
114

0.15 hours per EAUF × 2 individuals = 0.3 hours per SCI entity.

115

0.30 hours × 2 new SCI entities = 0.6 hours.

116

117

0.3 Attorney hour x $412 = $124.

118

$124 x 2 = $248.

119

0.15 hours per EAUF × 1 individual = 0.15 hours per SCI entity.

32
all SCI entities. 120 With respect to the Infrastructure Rules, the Commission notes that two of
the seven SCI competing consolidators that are the existing SIPs will have no additional burden
(i.e., they have been included in the above estimates). The remaining five SCI competing
consolidators will have the same burden as other SCI entities (.15 hours each annually), or .75
hours annually for all such SCI competing consolidators. The Commission estimates that the
total average annual burden for access to EFFS, including the Infrastructure Rules, for all
SCI entities will be 8.1 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing burden will be $62 for each SCI entity,121 or $3,038 annually for all such SCI
entities.122 With respect to the Infrastructure Rules, the Commission notes that two of the seven
SCI competing consolidators that are the existing SIPs will have no additional burden (i.e., they
have been included in the above estimates). The remaining five of the seven SCI competing
consolidators will have the same average annual internal cost of compliance as other SCI entities
($62 each), or on average, $310 annually for all such competing consolidators. The total average
internal cost of compliance, including the Infrastructure Rules, for all SCI entities will be $3,348.
j. Corrective Action Required by Rule 1002(a)
Rule 1002(a) establishes recordkeeping burdens for all SCI entities.
Rule 1002(a) requires each SCI entity, upon any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred, to begin to take appropriate
corrective action. The Commission believes that Rule 1002(a) will likely result in SCI entities
developing and revising their processes for corrective action. The Commission estimates that the
initial recordkeeping burden to implement such a process will be 114 hours per new SCI entity,
or 228 hours annually for all new SCI entities.123 With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator that iscurrently an SRO or affiliated
with an SRO will have 50% of the estimated initial burdens for a new SCI entity, which will
require an average of 57 burden hours.124 Four SCI competing consolidators that are not already
subject to Regulation SCI will have the same burdens as other new SCI entities (114 hours), or
456 hours annually for all such new SCI entities. The Commission estimates that the total
average initial burden for complying with Rule 1002(a), including the Infrastructure Rules,
for all such SCI entities will be 741 hours.
120

0.15 hours × 49 SCI entities = 7.35 hours.

121

0.15 Attorney hour x $412 = $62.

122

$62 x 49 = $3,038.

123

114 hours × 2 new SCI entities = 228 hours.

124

33
The Commission estimates that the average internal cost of compliance associated with
this initial recordkeeping burden will be $42,528 for each new SCI entity, 125 or $85,056 annually
for all such new SCI entities.126 With respect to the Infrastructure Rules, the Commission
estimates that one SCI competing consolidators will have 50% of the estimated average annual
internal cost of compliance for a new SCI entity, which will be $21,264 for such competing
consolidator. Four SCI competing consolidators will have the same costs as other new SCI
entities ($42,528), or $170,112 for all such new competing consolidators. The total annual
internal cost of compliance associated with this initial recordkeeping burden, including the
Infrastructure Rules, for all such SCI entities will be $276,432.
The Commission also estimates that the ongoing recordkeeping burden to review such
process will be 39 hours annually per SCI entity, or 1,911 hours annually for all SCI entities.127
With respect to the Infrastructure Rules, the Commission notes that two of the seven SCI
competing consolidators that are the existing SIPs will have no additional burden (i.e., they have
been included in the above estimates). The remaining five SCI competing consolidators will
have the same average ongoing burden as other SCI entities (39 hours each annually), or 195
hours annually for all such competing consolidators. The Commission estimates that the total
average annual ongoing burden for complying with Rule 1002(a), including the
Infrastructure Rules, for all SCI entities will be 2,106 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden will be $15,397 for each SCI entity, 128 or $754,453 for
all such SCI entities.129 With respect to the Infrastructure Rules, the Commission notes that one
of the seven SCI competing consolidators that are the existing SIPs will have no additional
burden (i.e., they have been included in the above estimates). The remaining five of the seven
SCI competing consolidators will have the same average annual internal cost of compliance as
other SCI entities ($15,397 each), or on average, $76,985 annually for all such competing
consolidators. The total average internal cost of compliance, including the Infrastructure Rules,
of for all SCI entities will be $831,438.

125

126

$42,528 x 2 = $85,056.

127

39 hours × 49 SCI entities = 1,911 hours.

128

(9 Compliance Manager hours x $307) + (9 Attorney hours x $412) + (3 Senior Systems Analyst
hours x $282) + (3 Operations Specialist hours x $135) + (10 Chief Compliance Officer hours x
$526) + (5 Director of Compliance hours x $483) = $15,397.

129

$15,397 x 49 = $754,453.

34
k. Identification of Critical SCI Systems, Major SCI Events, De Minimis SCI
Events, and Material Systems Changes
Identification of critical SCI systems, major SCI events, de minimis SCI events, and
material systems changes establishes recordkeeping burdens for all SCI entities.
Rule 1003(a)(1) requires each SCI entity to establish reasonable written criteria for
identifying a change to its SCI systems and the security of indirect SCI systems as material.
The Commission estimates that each new SCI entity will initially require 114 hours to
establish the criteria for identifying material systems changes, or 228 hours annually for all such
SCI entities.130 With respect to the Infrastructure Rule, the Commission estimates that one SCI
competing consolidator that is currently an SRO or affiliated with an SRO will each have 50% of
the estimated initial burdens for a new SCI entity, which will require an average of 57 burden
hours.131 Four SCI SCI competing consolidators that are not already subject to Regulation SCI
will have the same burdens as other new SCI entities (114 hours), or 456 hours annually for all
such new SCI entities. The total average initial burden, including the Infrastructure Rules, for all
such SCI entities will be 741 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this initial recordkeeping burden will be $42,528 for each new SCI entity, 132 or $85,056
annually for all such new SCI entities.133 With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator will have 50% of the estimated
average annual internal cost of compliance for a new SCI entity, which will be $21,264. Four
SCI competing consolidators will have the same costs as other new SCI entities ($42,528), or
$170,112 for all such new competing consolidators. The total annual internal cost of compliance
associated with this initial recordkeeping burden, including the Infrastructure Rules, for all such
SCI entities will be $276,432.
The Commission estimates that each SCI entity will require approximately 27 hours
annually to review and update the criteria, or, on average, 1,323 hours annually for all such SCI
entities.134 With respect to the Infrastructure Rules, the Commission notes that two of the seven
130

114 hours × 2 new SCI entities = 456 hours.

131

132

133

$42,528 x 2 = $85,056.

134

27 hours × 49 SCI entities = 1,323 hours.

35
SCI competing consolidators that are the existing SIPs will have no additional burden (i.e., they
have been included in the above estimates). The remaining five SCI competing consolidators
will have the same average ongoing burden as other SCI entities (27 hours each annually), or 135
hours annually for all such competing consolidators. The total average annual ongoing burden,
including the Infrastructure Rules, for all SCI entities 1,458 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden will be $11,536 for each SCI entity, 135 or $565,264
annually for all such SCI entities.136 With respect to the Infrastructure Rules, the Commission
notes that two of the seven SCI competing consolidators that are the existing SIPs will have no
additional burden (i.e., they have been included in the above estimates). The remaining five of
the ten SCI competing consolidators will have the same average annual internal cost of
compliance as other SCI entities ($11,536 each), or on average, $57,680 annually for all such
competing consolidators. The total average internal cost of compliance, including the
Infrastructure Rules, for all SCI entities will be $622,944.
Regulation SCI also requires SCI entities to identify certain types of events and systems.
The Commission believes that the identification of critical SCI systems, major SCI events, and
de minimis SCI events will impose an initial one-time implementation burden on new SCI
entities in developing processes to quickly and correctly identify the nature of a system or event.
The identification of these systems and events may also impose periodic burdens on SCI entities
in reviewing and updating the processes.
The Commission estimates that each new SCI entity will require 198 hours initially to
establish the criteria for identifying certain systems and events, or 396 hours annually for all such
SCI entities.137 With respect to the Infrastructure Rules, the Commission estimates that one SCI
competing consolidator that is currently an SRO or affiliated with an SRO will have 50% of the
estimated initial burdens for a new SCI entity, which will require an average of 99 burden
hours.138 Four SCI competing consolidators that are not already subject to Regulation SCI will
have the same burdens as other new SCI entities (198 hours), or 792 hours annually for all such
new SCI entities. The total average initial burden, including the Infrastructure Rules, for all such
SCI entities will be 1,287 hours.

135

(4.5 Compliance Manager hours x $307) + (4.5 Attorney hours x $412) + (1.5 Senior Systems
Analyst hours x $282) + (1.5 Operations Specialist hours x $135) + (10 Chief Compliance Officer
hours x $526) + (5 Director of Compliance hours x $483) = $11,536.

136

$11,536 x 49 = $565,264.

137

198 hours × 2 new SCI entities = 396 hours.

138

36
The Commission estimates that the average annual internal cost of compliance associated
with this initial recordkeeping burden will be $69,706 for each new SCI entity, 139 or $139,412
annually for all such new SCI entities.140 With respect to the Infrastructure Rules, the
Commission estimates that one SCI competing consolidator will have 50% of the estimated
average annual internal cost of compliance for a new SCI entity, which will be $34,853. Four
SCI competing consolidators will have the same costs as other new SCI entities ($69,706), or
$278,824 for all such new competing consolidators. The total annual internal cost of compliance
associated with this initial recordkeeping burden, including the Infrastructure Rules, for all such
SCI entities will be $453,089.
The Commission estimates that each SCI entity will require 39 hours annually to review
and update such criteria, or, on average, 1,911 hours annually for all SCI entities.141 With
respect to the Infrastructure Rules, the Commission notes that two of the seven SCI competing
consolidators that are the existing SIPs will have no additional burden (i.e., they have been
included in the above estimates). The remaining five competing consolidators will have the
same average ongoing burden as other SCI entities (39 hours each annually), or 195 hours
annually for all such competing consolidators. The total average annual ongoing burden,
including the Infrastructure Rules, for all SCI entities will be 2,106 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden will be $15,397 for each SCI entity, 142 or, on average,
$754,453 annually for all such SCI entities.143 With respect to the Infrastructure Rules, the
Commission notes that two of the seven SCI competing consolidators that are the existing SIPs
will have no additional burden (i.e., they have been included in the above estimates). The
remaining five of the seven SCI competing consolidators will have the same average annual
internal cost of compliance as other SCI entities ($15,397 each), or on average, $76,985 annually
for all such competing consolidators. The total average internal cost of compliance, including
the Infrastructure Rules, for all SCI entities will be $831,438.

139

(64 Compliance Manager hours x $307) + (64 Attorney hours x $412) + (20 Senior Systems
Analyst hours x $282) + (20 Operations Specialist hours x $135) + (20 Chief Compliance Officer
hours x $526) + (10 Director of Compliance hours x $483) = $69,706.

140

$69,706 x 2 = $139,412.

141

39 hours × 49 SCI entities = 1,911 hours.

142

143

$15,397 x 49 = $754,453.

37
The Commission estimates that:


The total average annual initial recordkeeping burden related to establishing
criteria for identifying material systems changes, and certain systems and
events, including the Infrastructure Rules, is 2,028 hours, and



The total average annual ongoing recordkeeping burden related to
establishing criteria for identifying material systems changes, and certain
systems and events, including the Infrastructure Rules, is 3,564 hours.
l. Recordkeeping Required by Rules 1005 and 1007

The recordkeeping requirements establish recordkeeping burdens for SCI entities other
than SCI SROs.
The Commission estimates that, for each new SCI entity other than an SCI SRO, setting
up or modifying a recordkeeping system to comply with Rule 1005 will create an initial burden
of 170 hours, or 170 hours annually for all new SCI entities other than SCI SROs.144 With
respect to the Infrastructure Rules, the Commission estimates that one competing consolidator
that is currently an SRO or affiliated with an SRO will have 50% of the estimated initial burdens
for a new non-SRO SCI entity, which will require an average of 85 burden hours.145 Four SCI
competing consolidators that are not already subject to Regulation SCI will have the same
burdens as other new non-SRO SCI entities (170 hours), or 680 hours annually for all such new
SCI entities. The Commission estimates that the total average initial burden for complying
with Rules 1005 and 1007, including the Infrastructure Rules, for all such SCI entities will
be 935 hours.
The Commission estimates that the annual internal cost of compliance associated with
this initial recordkeeping burden will be $11,730 for each new SCI entity that is not an SRO.146
With respect to the Infrastructure Rules, the Commission estimates that one SCI competing
consolidator that is currently an SROs or affiliated with an SRO will have 50% of the estimated
initial burdens for a new non-SRO SCI entity, which will be $5,865. Four SCI competing
consolidators that are not already subject to Regulation SCI will have the same burdens as other
new non-SRO SCI entities ($11,730), or $46,920 hours annually for all such new SCI entities.

144

170 hours × 1 new non-SRO SCI entities = 170 hours.

145

Although one of the five SCI competing consolidators is an SRO or affiliated with an SRO, the
Commission believes that this competing consolidator would have the same burdens as a nonSRO SCI entity for these particular ongoing burdens. Because the Commission is estimating a
lower initial burden for this subset of SCI entities than for other new SCI entities, the burden
hours per respondent will reflect an average of the burden estimates for all respondents.

146

170 Compliance Clerk hours x $69 per hour = $11,730.

38
The total annual internal cost of compliance associated with this initial recordkeeping burden,
including the Infrastructure Rules, for all such SCI entities will be $64,515.
The Commission also estimates that the burden to make, keep, and preserve records
relating to compliance with Regulation SCI, as required by Rule 1005(b), will be approximately
25 hours annually per SCI entity that is not an SCI SRO. Therefore, the Commission estimates a
total annual burden of 325 hours for all such SCI entities.147 With respect to the Infrastructure
Rules, the Commission notes that two of the seven SCI competing consolidators that are the
existing SIPs will have no additional burden (i.e., they have been included in the above
estimates). The remaining five SCI competing consolidators will have the same burdens as
non-SRO SCI entities (25 hours), 148 or 125 burden hours annually for all such competing
consolidators. The Commission estimates that the total average annual ongoing burden for
complying with Rules 1005 and 1007, including the Infrastructure Rules, for all such SCI
entities will be 450 hours.
The Commission estimates that the average annual internal cost of compliance associated
with this ongoing recordkeeping burden will be $1,725 for each SCI entity that is not an SRO,149
and, on average, $22,425 annually for all such SCI entities.150 With respect to the Infrastructure
Rules, the Commission notes that two of the seven SCI competing consolidators that are the
existing SIPs will have no additional burden (i.e., they have been included in the above
estimates). The remaining five SCI SCI competing consolidators will have the same average
internal cost of compliance as non-SRO SCI entities, ($1,725) or $8,625 annually for all such
competing consolidators. The total annual internal cost of compliance associated with this
ongoing recordkeeping burden, including the Infrastructure Rules, for all such SCI entities will
be $31,050.

147

25 hours × 13 non-SRO SCI entities = 325 hours.

148

149

25 Compliance Clerk hours x $69 per hour = $1,725.

150

$1,725 x 13 non-SRO SCI entities = $22,425.

39
m. Summary of Hourly Burdens
The table below summarizes the Commission’s estimate of the total hourly burden and
total internal costs of compliance for SCI entities under Regulation SCI.
IC

Nature of Information
Collection Burden

Annualized
Aggregate Hourly
Burden Estimate
4,511
(Recordkeeping)

Annualized Internal Cost
of Compliance Estimate

Policies and procedures required
by Rule 1001(a) – initial burden

Policies and procedures required
by Rule 1001(a) – ongoing
burden

12,528
(Recordkeeping)

$4,205,412 (Recordkeeping)

Policies and procedures required
by Rule 1001(b) – initial burden

1,755
(Recordkeeping)

$660,270 (Recordkeeping)

Policies and procedures required
by Rule 1001(b) – ongoing
burden – SCI SRO

6,300
(Recordkeeping)

$1,975,500
(Recordkeeping)

Policies and procedures required
by Rule 1001(b) – ongoing
burden –non-SRO SCI entity

1,710
(Recordkeeping)

$564,390 (Recordkeeping)

Policies and procedures required
by Rule 1001(c) – initial burden

741 (Recordkeeping)

$276,432 (Recordkeeping)

Policies and procedures required
by Rule 1001(c) – ongoing
burden

2,106
(Recordkeeping)

$839,592
(Recordkeeping)

Mandate participation in certain
testing required by Rule 1004 –
initial burden

2,700
(Recordkeeping)

$804,735 (Recordkeeping)

Mandate participation in certain
testing required by Rule 1004–
ongoing burden

7,290
(Recordkeeping)

$1,939,950(Recordkeeping)

SCI event notice required by
Rule 1002(b)(1)

432 (Reporting)

$133,030 (Reporting)

$1,513,382 (Recordkeeping)

40
IC

Nature of Information
Collection Burden

Annualized
Aggregate Hourly
Burden Estimate
6,480 (Reporting)

Annualized Internal Cost
of Compliance Estimate

SCI event notice required by
Rule 1002(b)(2)

SCI event notice required by
Rule 1002(b)(3)

567 (Reporting)

$177,106.50 (Reporting)

SCI event notice required by
Rule 1002(b)(4)

9,450 (Reporting)

$3,297,510 (Reporting)

SCI event notice required by
Rule 1002(b)(5)

8,640 (Reporting)

$2,919,348 (Reporting)

Dissemination of information
required by Rule 1002(c)(1)(i)

1,134 (Third Party
Disclosure)

$741,557.50 (Third Party
Disclosure)

Dissemination of information
required by Rule 1002(c)(1)(ii)

6,318 (Third Party
Disclosure)

$2,496,096 (Third Party
Disclosure)

Dissemination of information
required by Rule 1002(c)(2)

540 (Third Party
Disclosure)

$212,827.25 (Third Party
Disclosure)

Material systems change notice
required by Rule 1003(a)(1)

27,000 (Reporting)

$8,063,820 (Reporting)

Material systems change notice
required by Rule 1003(a)(2)

810 (Reporting)

$256,716 (Reporting)

SCI review required by Rules
1003(b)(1) and (b)(2)

37,260
(Recordkeeping)

$11,934,810
(Recordkeeping)

SCI review required by Rule
1003(b)(3)

54 (Reporting)

$22,248 (Reporting)

Access to EFFS – new entities

1.95 (Reporting)

$806 (Reporting)

Access to EFFS – existing
entities

8.1 (Reporting)

$3,348 (Reporting)

Corrective action required by
Rule 1002(a) – initial burden

741 (Recordkeeping)

$276,432 (Reporting)

$2,134,890 (Reporting)

41
IC

Nature of Information
Collection Burden

Annualized
Aggregate Hourly
Burden Estimate
2,106
(Recordkeeping)

Annualized Internal Cost
of Compliance Estimate

Corrective action required by
Rule 1002(a) – ongoing burden

Identification of critical SCI
systems, major SCI events, de
minimis SCI events, and
material systems changes –
initial burden

2,028
(Recordkeeping)

$729,521 (Recordkeeping)

Identification of critical SCI
systems, major SCI events, de
minimis SCI events, and
material systems changes –
ongoing burden

3,564
(Recordkeeping)

$1,454,382 (Recordkeeping)

Recordkeeping required by
Rules 1005 and 1007 – initial
burden

935 (Recordkeeping)

$64,515 (Recordkeeping)

Recordkeeping required by
Rules 1005 and 1007 – ongoing
burden

450 (Recordkeeping)

$31,050 (Recordkeeping)

13.

$831,438 (Reporting)

Costs to Respondents

Each of the individual information collections in Regulation SCI is described in the subsections below. NOTE: consistent with Item 12 above, the changes to the burdens that resulted
from the recent Infrastructure amendments to Regulation SCI are discussed separately.
a. Policies and Procedures Required by Rule 1001(a)
Rule 1001(a) imposes recordkeeping costs for SCI entities. In establishing, maintaining,
and enforcing the policies and procedures required by Rule 1001(a), the Commission believes
that each new SCI entity will seek outside legal and/or consulting services in the initial
preparation of such policies and procedures. The total annualized recordkeeping cost of seeking
outside legal and/or consulting services will be $94,000 for all new SCI entities151 ($47,000 for
the first year × 2 new SCI entities), or $47,000 per new SCI entity. With respect to the
151

See supra note 14.

42
Infrastructure Rules, the Commission estimates that one SCI competing consolidator that is
currently an SRO or affiliated with an SRO will have 50% of the estimated annualized
recordkeeping cost for a new SCI entity, which will be $23,500.152 Four SCI competing
consolidators will have the same costs as other new SCI entities ($47,000), or $188,000 for all
such new competing consolidators. The total annualized recordkeeping cost, including the
Infrastructure Rules, for all such SCI entities will be $305,500.
b. Policies and Procedures Required by Rule 1001(b)
Rule 1001(b) imposes recordkeeping costs for SCI entities. In establishing, maintaining,
and enforcing the policies and procedures required by Rule 1001(b), the Commission believes
that each new SCI entity will seek outside legal and/or consulting services in the initial
preparation of such policies and procedures. The total annualized cost of seeking outside legal
and/or consulting services will be $54,000 ($27,000 for the first year × 2 new SCI entities), or
$27,000 per new SCI entity. With respect to the Infrastructure Rules, the Commission estimates
that one competing consolidator that is currently an SRO or affiliated with an SRO will have
50% of the estimated annualized cost for a new SCI entity, which will be $13,500. Four
competing consolidators will have the same costs as other new SCI entities ($27,000), or
$108,000 for all such new competing consolidators.153 The total annualized recordkeeping
cost, including the Infrastructure Rules, for all such SCI entities will be $175,500.
c. Policies and Procedures Required by Rule 1001(c)
The Commission does not expect SCI entities to incur any external PRA costs in
connection with the policies and procedures required under Rule 1001(c).
d. Mandate Participation in Certain Testing Required by Rule 1004
Rule 1004 imposes recordkeeping costs for SCI entities that are plan processors (2 SCI
entities). In complying with Rule 1004, the Commission believes that plan processors will seek
outside legal services. The Commission estimates that the total annual ongoing
recordkeeping cost of seeking outside legal services for compliance with Rule 1004 will be
$108,000 ($54,000 × 2 plan processors) or $54,000 per plan processor.

152

Because the Commission is estimating a lower initial cost for this subset of SCI entities than for
other new SCI entities, the cost per respondent will reflect an average of the cost estimates for all
respondents.

153

43
e. SCI Event Notice Required by Rule 1002(b)
Rule 1002(b) imposes reporting costs for SCI entities. The Commission estimates that
while SCI entities will handle internally most of the work associated with Rule 1002(b), SCI
entities will seek outside legal advice in the preparation of certain Commission notifications.
The total annual reporting cost of seeking outside legal advice will be $284,200 for all SCI
entities ($5,800 × 49 SCI entities). Because Rule 1002(b) will impose approximately 21
reporting requirements per SCI entity per year, each requirement will require an average of
$276.19.154 With respect to the Infrastructure Rules, the total annual reporting cost of seeking
outside legal advice for five of the seven SCI competing consolidators will be $29,000 ($5,800 x
5 competing consolidators).155 The total annual reporting cost, including the Infrastructure
Rules, for all SCI entities will be $313,200.
The Commission estimates the following cost burdens for each paragraph of Rule
1002(b):


SCI event notice required by Rule 1002(b)(1): $74,571;156



SCI event notice required by Rule 1002(b)(2): $74,571;157



SCI event notice required by Rule 1002(b)(3): $29,829;158



SCI event notice required by Rule 1002(b)(4): $74,571;159 and



SCI event notice required by Rule 1002(b)(5): $59,657.160

154

$5,800 per SCI entity ÷ 21 requirements = $276.1905 per requirement per SCI entity.

155

As discussed above, two of the seven SCI competing consolidators that are the existing
SIPs would have no additional burden (i.e., they have been included in the above
estimates of other SCI entities).

156

$276.1905 per requirement per SCI entity * 5 requirements * 54 (49 SCI entities + 5 SCI
competing consolidators) = $74,571.44.

157

$276.1905 per requirement per SCI entity * 5 requirements * 54 (49 SCI entities + 5 SCI
competing consolidators) = $74,571.44.

158

$276.1905 per requirement per SCI entity * 2 requirements * 54 (49 SCI entities + 5 SCI
competing consolidators) = $29,828.57.

159

$276.1905 per requirement per SCI entity * 5 requirements * 54 (49 SCI entities + 5 SCI
competing consolidators) = $74,571.44.

160

$276.1905 per requirement per SCI entity * 4 requirements * 54 (49 SCI entities + 5 SCI
competing consolidators) = $59,657.15.

44
f. Dissemination of Information Required by Rule 1002(c)
Rule 1002(c) imposes third party disclosure costs for SCI entities. The Commission
believes SCI entities will seek outside legal advice in the preparation of the information
dissemination under Rule 1002(c). The total annual third party disclosure cost of seeking outside
legal advice will be $162,680 ($3,320 per SCI entity per year × 49 SCI entities). Because Rule
1002(c) will impose approximately 13 third party disclosure requirements per SCI entity per
year, each requirement will require an average of $255.38.161 With respect to the Infrastructure
Rules, the total annual reporting cost of seeking outside legal advice for five of the seven
competing consolidators will be $16,600 ($3,320 x 5 SCI competing consolidators).162 The total
annual reporting cost, including the Infrastructure Rules, for all SCI entities will be
approximately $179,280.
The Commission estimates the following cost burdens for each paragraph of Rule
1002(c):


Dissemination of information required by Rule 1002(c)(1)(i): $41,372;163



Dissemination of information required by Rule 1002(c)(1)(ii): $124,117;164
and



Dissemination of information required by Rule 1002(c)(2): $13,791.165

g. Material Systems Change Notice Required by Rule 1003(a)
The Commission does not expect SCI entities to incur any external PRA costs in
connection with the reports required under Rule 1003(a).

161

$3,320 per SCI entity ÷ 13 requirements = $255.385 per requirement per SCI entity.

162

163

$255.385 per requirement per SCI entity * 3 requirements * 54 (49 SCI entities + 5 SCI
competing consolidators) = $41,372.37.

164

$255.385 per requirement per SCI entity * 9 requirements * 54 (49 SCI entities + 5 SCI
competing consolidators) = $124,117.11.

165

$255.385 per requirement per SCI entity * 1 requirement * 54 (49 SCI entities + 5 SCI
competing consolidators) = $13,790.79.

45
h. SCI Review Required by Rule 1003(b)
Rule 1003(b) imposes recordkeeping costs for SCI entities. The Commission estimates
that while SCI entities will handle internally some or most of the work associated with
compliance with Rule 1003(b), SCI entities will outsource some of the work associated with an
SCI review. The total annual recordkeeping cost of outsourcing will be $2,450,000 ($50,000 ×
49 SCI entities). With respect to the Infrastructure Rules, the total annual recordkeeping cost of
outsourcing for five of the seven competing consolidators will be $250,000 ($50,000 x 5 SCI
competing consolidators).166 The total annual recordkeeping cost, including the
Infrastructure Rules, for all SCI entities will be $2,700,000.
i. Access to EFFS
As noted above, Rule 1006 requires each SCI entity, with a few exceptions, to file any
notification, review, description, analysis, or report to the Commission required under
Regulation SCI electronically on Form SCI. Obtaining the ability for an individual to
electronically sign a Form SCI imposes reporting costs for SCI entities. The Commission
estimates that each SCI entity will designate two individuals to sign Form SCI each year, and
each such individual must obtain a digital ID at the cost of approximately $25 each year.
Therefore, each SCI entity will require $50 annually to obtain digital IDs, 167 or $2,450 for all
SCI entities.168 With respect to the Infrastructure Rules, the Commission estimates that the total
cost annually to obtain digital IDs for five of the seven SCI competing consolidators will be
$250.169 The total annual cost, including the Infrastructure Rules, for all SCI entities will be
$2,700.
j. Corrective Action Required by Rule 1002(a)
The Commission does not expect SCI entities to incur any external PRA costs in
connection with the requirement to take corrective actions under Rule 1002(a).

166

As discussed above, two of the seven SCI competing consolidators that are the existing SIPs
would have no additional burden (i.e., they have been included in the above estimates of other
SCI entities).

167

$25 per digital ID × 2 individuals = $50.

168

$50 per SCI entity × 49 SCI entities = $2,450.

169

As discussed above, two of the seven SCI competing consolidators that are the existing SIPs
would have no additional burden (i.e., they have been included in the above estimates of other
SCI entities).

46
k. Identification of Critical SCI Systems, Major SCI Events, De Minimis SCI events, and
Material Systems Changes
The Commission does not expect SCI entities to incur any external PRA costs in
connection with the identification of critical SCI systems, major SCI events, de minimis SCI
events, and material systems changes.
l. Recordkeeping Required by Rules 1005 and 1007
The recordkeeping requirements impose recordkeeping costs for SCI entities other than
SCI SROs. The Commission estimates that a new SCI entity other than an SCI SRO will incur a
one-time recordkeeping cost of $900 to set up or modify an existing recordkeeping system to
comply with the recordkeeping requirements.170 In addition, with respect to the Infrastructure
Rules, the Commission estimates that five of the seven SCI competing consolidators will have
the same recordkeeping cost as non-SRO SCI entities, ($900) or $4,500 annually for all such
competing consolidators.171 The total recordkeeping cost, including the Infrastructure Rules,
will be $5,400 for all SCI entities.
m. Summary of Cost Burdens
The table below summarizes the Commission’s estimate of the total cost burden for SCI
entities under Regulation SCI.
IC

Nature of Information
Collection Burden

Burden Estimate in Dollars

Policies and procedures
required by Rule 1001(a)

$305,500 (Recordkeeping)

Policies and procedures
required by Rule 1001(b)

$175,500 (Recordkeeping)

Mandate participation in
$108,000 (Recordkeeping)
certain testing required by Rule
1004
SCI event notice required by
Rule 1002(b)
- This requirement is
broken out into the
following individual ICs:

$313,200 (Sum Total) (Reporting)

170

See supra note Error! Bookmark not defined. (estimating 1 new non-SRO SCI entity per year).

171

See supra note 148.

47
IC

Nature of Information
Collection Burden

10
11
12
13
14

15
16
17

20
31
28

Burden Estimate in Dollars

Paragraph (b)(1):
Paragraph (b)(2):
Paragraph (b)(3):
Paragraph (b)(4):
Paragraph (b)(5):

$74,571
$74,571
$29,829
$74,571
$59,657

Dissemination of information
$179,280 (Sum Total) (Third Party Disclosure)
required by Rule 1002(c)
- This requirement is
broken out into the
following ICs:
Paragraph (c)(1)(i):
$41,372
Paragraph (c)(1)(ii):
$124,115
Paragraph (c)(2):
$13,791

SCI review required by Rules
1003(b)(1) and (b)(2)
Access to EFFS

$2,700,000 (Recordkeeping)

Recordkeeping required by
Rules 1005 and 1007 – initial
burden

$5,400 (Recordkeeping)

14.

$2,700 (Reporting)

Costs to Federal Government

The Commission expects to incur ongoing maintenance costs. Third party contractors will
perform most of the work except for some testing and project management, which will be
performed by Commission staff. The Commission estimates that the total costs for these third party
contractors will be $180,000 annually.
In addition, the Commission believes that the costs to the federal government associated
with Regulation SCI reflect the resources, both human and technological, of the Technology
Controls Program.
15.

Changes in Burden

The estimated burdens have been adjusted due to modifying the estimated number of
respondents based on the current number of SCI entities. The Commission is not modifying its
estimate that approximately 2 entities will become SCI entities each year.

48
The Commission has revised its burden estimates for the collections of information, as
summarized in this chart:

Name of
Information
Collection

Policies and
procedures
required by Rule
1001(a) – initial
burden
Policies and
procedures
required by Rule
1001(a) – ongoing
burden
Policies and
procedures
required by Rule
1001(b) – initial
burden
Policies and
procedures
required by Rule
1001(b) – ongoing
burden – SCI
SRO
Policies and
procedures
required by Rule
1001(b) – ongoing
burden – non-SCI
SRO entity
Policies and
procedures
required by Rule
1001(c) – initial
burden

Annual Industry
Burden Hours
or Cost (2021
Extension)

Annual Industry
Burden Hours or
Cost Previously
Approved (2021
Revision Due to
Infrastructure
Final Rule)

Change in Burden
Hours or Cost
(2021 Extension vs.
2021 Revision)

4,511/
$$305,500

4,511/
$305,500

12,528

11,368

1,160

1,755/
$175,500

5,775
6,300

1,710

741

1,520

741

Reason for
Change

Update to estimated
number of SCI entities

525

Update to estimated
number of SCI entities

190

Update to estimated
number of SCI entities

49
7

Policies and
procedures
required by Rule
1001(c) – ongoing
burden
Mandate
participation in
certain testing
required by Rule
1004 – initial
burden
Mandate
participation in
certain testing
required by Rule
1004– ongoing
burden
Mandate
participation in
certain testing
required by Rule
1004

2,106

1,911

195

2,700

7,290

$108,000

6,615

$108,000

675

Update to estimated
number of SCI entities

SCI event notice
required by Rule
1002(b)(1)

432/
$313,200172

392/
$284,200173

40/
$29,000

Update to estimated
number of SCI entities

SCI event notice
required by Rule
1002(b)(2)

6,480

5,880

600

Update to estimated
number of SCI entities

567

515

Update to estimated
number of SCI entities

9,450

8,575

875

Update to estimated
number of SCI entities

SCI event notice
required by Rule
1002(b)(3)
SCI event notice
required by Rule
1002(b)(4)

172

This estimate reflects the total reporting costs for complying with all of Rule 1002(b), including
subparagraphs (b)(1) through (b)(5).

173

This estimate reflects the total reporting costs for complying with all of Rule 1002(b), including
subparagraphs (b)(1) through (b)(5).

50
14

31
24

SCI event notice
required by Rule
1002(b)(5)
Dissemination of
information required
by Rule
1002(c)(1)(i)
Dissemination of
information required
by Rule
1002(c)(1)(ii)
Dissemination of
information required
by Rule 1002(c)(2)

Material systems
change notice
required by Rule
1003(a)(1)
Material systems
change notice
required by Rule
1003(a)(2)
SCI review
required by Rules
1003(b)(1) and
(b)(2)
SCI review
required by Rule
1003(b)(3)
Access to EFFS –
new entities
Access to EFFS –
existing entities
Access to EFFS
Corrective action
required by Rule

8,640

7,840

800

Update to estimated
number of SCI entities

1,134/
$179,280174

1,029
$162,680175

105/
$16,600

Update to estimated
number of SCI entities

6,318

5,733

585

Update to estimated
number of SCI entities

540

490

Update to estimated
number of SCI entities

27,000

24,500

2,500

Update to estimated
number of SCI entities

810

735

Update to estimated
number of SCI entities

37,260/
$2,700,000

33,810/
$2,450,000

3,450/
$250,000

Update to estimated
number of SCI entities

1.95

8.1

0.75

Update to estimated
number of SCI entities

$250

Update to estimated
number of SCI entities

7.35
$2,700
741

2,450
741

174

This estimate reflects the total reporting costs for complying with all of Rule 1002(c), including
subparagraphs (c)(1) through (c)(2).

175

This estimate reflects the total reporting costs for complying with all of Rule 1002(c), including
subparagraphs (c)(1) through (c)(2).

51
1002(a) – initial
burden
25

Corrective action
required by Rule
1002(a) – ongoing
burden
Identification of
critical SCI
systems, major
SCI events, de
minimis SCI
events, and
material systems
changes – initial
burden
Identification of
critical SCI
systems, major
SCI events, de
minimis SCI
events, and
material systems
changes –
ongoing burden
Recordkeeping
required by Rules
1005 and 1007 –
initial burden
Recordkeeping
required by Rules
1005 and 1007 –
ongoing burden

Total

16.

Update to estimated
number of SCI entities

2,106

1,911

195

2,028

3,564

3,234

330

Update to estimated
number of SCI entities

935/
$5,400

935/

Update to estimated
number of SCI entities

450

$5,400

400

135,702/
$3,493,730

12,727.75/
$295,580

Information Collections Planned for Statistical Purposes

Not applicable. The information collections above are not planned for statistical purposes.

52
17.

Approval to Omit OMB Expiration Date

We request authorization to omit the expiration date on the electronic version of the form.
Including the expiration date on the electronic version of the form will result in increased costs,
because the need to make changes to the form may not follow the application’s scheduled version
release dates. The OMB control number will be displayed.
18.

Exceptions to Certification for Paperwork Reduction Act Submissions

This collection complies with the requirements in 5 CFR 1320.9.
B.

COLLECTION OF INFORMATION EMPLOYING STATISTICAL METHODS
This collection does not involve statistical methods.

File Type	application/pdf
File Modified	2021-11-10
File Created	2021-11-10