Rule 18a-6 – Records to be preserved by certain security-based swap dealers and major security-based swap participants

Forms and Documents

Forms and supporting documents for this ICR

Document	Type	Status	Availability
3235-0751 Supporting Statement (2023 Cybersecurity Risk Management Proposal).pdf	Supporting Statement A	Uploaded 2023-06-22	Repair queued

IC Document Collections

Information collection document groups

IC ID	Collection	Type	Status	Form
260766	SBS Entities – Retention of written report documenting annual review		New
260765	SBS Entities – Retention of copy of any Form SCIR or immediate notice to the Commission		New
260764	SBS Entities – Retention of records documenting a cybersecurity incident		New
260763	SBS Entities – Retention of records documenting a Covered Entity's cybersecurity risk assessment		New
260762	SBS Entities – Retention of copy of any public disclosures		New
260761	SBS Entities - Retention of cybersecurity policies and procedures		New
258422	Rule 18a-6(b)(1)(i) - Risk Mitigation		Unchanged
258138	Alternative undertaking - Cloud Service Providers		Unchanged
258137	Alternative undertaking - SBS Entities		Unchanged
253938	18a-6(e ) - Audit Trail Alternative to WORM		Unchanged
253936	18a-6(e ) - Backup or Redundancy Alternative Recordkeeping Systems for SBS Entities		Unchanged
253935	18a-6(e)- Third Party or Designated Officer Undertaking		Unchanged
223096	Third-Party Custodians		Unchanged
223095	Bank SBSDs: Paragraphs (b)(2)(i) and (b)(2)(v)		Unchanged
223094	Bank SBSDs and bank MSBSPs: Paragraphs (a)(2), (b)(2)(i) (b)(2)(iv), (b(2)(vi)-(viii), (d)(1),(d)(2)(ii), (d)(3)(ii)		Unchanged
223093	ANC stand-alone SBSDs: Paragraph (b)(1)(x)		Unchanged
223092	Stand-alone SBSDs: Paragraphs (b)(1)(i), (a)(14), and (a)(16)		Unchanged
223091	Stand-alone SBSDs and stand-alone MSBSPs: Paragraphs (a)(1), (b)(1)(ii) (b)(1)(ix), (b)(1)(xi) (b)(1)(xiii), (c), (d)(1), (d)(2)(i), and (d)(3)(i)		Unchanged

ICR Details

OMB Control No: 3235-0751	ICR Reference No: 202306-3235-019
Status: Historical Inactive	Previous ICR Reference No: 202301-3235-028
Agency/Subagency: SEC	Agency Tracking No: TM-270-668
Title: Rule 18a-6 – Records to be preserved by certain security-based swap dealers and major security-based swap participants
Type of Information Collection: Revision of a currently approved collection	Common Form ICR:  No
Type of Review Request: Regular
OIRA Conclusion Action: Comment filed on proposed rule and continue	Conclusion Date: 08/15/2023
Retrieve Notice of Action (NOA)	Date Received in OIRA: 06/23/2023
Terms of Clearance: Pursuant to 5 CFR 1320.11(c), OMB files this comment on this information collection request (ICR). This OMB action is not an approval to conduct or sponsor an information collection under the Paperwork Reduction Act of 1995. This action has no effect on any current approvals. If OMB has assigned this ICR a new OMB Control Number, the OMB Control Number will not appear in the active inventory. For future submissions of this information collection, reference the OMB Control Number provided. The agency shall examine public comment in response to the NPRM and will describe in the supporting statement of its next collection any public comments received regarding the collection as well as why (or why it did not) incorporate the commenter’s recommendation. The next submission to OMB must include the draft final rule. SEC should double check consistency between all supporting statement and ROCIS hourly and cost burden in the final submission.

table that charts list comparision

	Inventory as of this Action	Requested	Previously Approved
Expiration Date	07/31/2024	07/31/2024	07/31/2024
Responses	164	0	164
Time Burden (Hours)	16,308	0	16,308
Cost Burden (Dollars)	1,335,072	0	1,335,072

---

Abstract: The SBS Recordkeeping Release adopted new Exchange Act Rule 18a-6 (in conjunction with the new Exchange Act Rule 18a-5) which establishes recordkeeping requirements applicable to stand-alone SBSDs, stand-alone MSBSPs, bank SBSDs, and bank MSBSPs. Rule 18a-6 is modeled on Exchange Act Rule 17a-4, which applies to broker-dealers, but Rule 18a-6 does not include a parallel requirement for every requirement in Rule 17a-4 because some of the requirements in Rule 17a-4 relate to activities that are not expected or permitted of stand-alone SBSDs, stand-alone MSBSPs, bank SBSDs, and bank MSBSPs. Proposed Partial Revision-- In March 2023, the Commission proposed amendments to the recordkeeping requirements of SBS Entities in Rule 18a-6 in connection with a proposed cybersecurity risk management rule (“Rule 10”). Rule 18a-6 would be amended to establish preservation and maintenance requirements for the written policy and procedures, annual reports, Parts I and II of proposed Form SCIR, and records required to be made pursuant to proposed Rule 10.

---

Authorizing Statute(s): PL: Pub.L. 111 - 203 764 Name of Law: Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010
   US Code: 15 USC 78o-10 Name of Law: Securities Exchange Act of 1934
  

Citations for New Statutory Requirements: PL: Pub.L. 111 - 203 764 Name of Law: Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

---

Associated Rulemaking Information
RIN:	Stage of Rulemaking:	Federal Register Citation:	Date:
3235-AN15	Proposed rulemaking	88 FR 20212	04/05/2023

---

Federal Register Notices & Comments

Did the Agency receive public comments on this ICR? No

---

Number of Information Collection (IC) in this ICR: 18

table that charts list of burden

IC Title	Form No.	Form Name
18a-6(e ) - Audit Trail Alternative to WORM
18a-6(e ) - Backup or Redundancy Alternative Recordkeeping Systems for SBS Entities
18a-6(e)- Third Party or Designated Officer Undertaking
ANC stand-alone SBSDs: Paragraph (b)(1)(x)
Alternative undertaking - Cloud Service Providers
Alternative undertaking - SBS Entities
Bank SBSDs and bank MSBSPs: Paragraphs (a)(2), (b)(2)(i) (b)(2)(iv), (b(2)(vi)-(viii), (d)(1),(d)(2)(ii), (d)(3)(ii)
Bank SBSDs: Paragraphs (b)(2)(i) and (b)(2)(v)
Rule 18a-6(b)(1)(i) - Risk Mitigation
SBS Entities - Retention of cybersecurity policies and procedures
SBS Entities – Retention of copy of any Form SCIR or immediate notice to the Commission
SBS Entities – Retention of copy of any public disclosures
SBS Entities – Retention of records documenting a Covered Entity's cybersecurity risk assessment
SBS Entities – Retention of records documenting a cybersecurity incident
SBS Entities – Retention of written report documenting annual review
Stand-alone SBSDs and stand-alone MSBSPs: Paragraphs (a)(1), (b)(1)(ii) (b)(1)(ix), (b)(1)(xi) (b)(1)(xiii), (c), (d)(1), (d)(2)(i), and (d)(3)(i)
Stand-alone SBSDs: Paragraphs (b)(1)(i), (a)(14), and (a)(16)
Third-Party Custodians

---

Burden increases because of Program Change due to Agency Discretion: Yes

Burden Increase Due to: Changing Regulations

Burden decreases because of Program Change due to Agency Discretion: No

Burden Reduction Due to:

Short Statement: The Commission recently proposed new recordkeeping requirements in connection with a cybersecurity proposal. This proposed revision would add new ICs to this ICR, but would not modify any of the existing ICs. The rule amendments and proposed information collection revisions are discussed in more detail in the attached supporting statement.

---

Annual Cost to Federal Government:

Does this IC contain surveys, censuses, or employ statistical methods? No

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination.     No

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination.     No

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? No

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? Yes

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? No

Is this ICR related to the Pandemic Response? No

---

Common Form ICR:  No

---

On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).

The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:

(a) It is necessary for the proper performance of agency functions;

(b) It avoids unnecessary duplication;

(c) It reduces burden on small entities;

(d) It uses plain, coherent, and unambiguous language that is understandable to respondents;

(e) Its implementation will be consistent and compatible with current reporting and recordkeeping practices;

(f) It indicates the retention periods for recordkeeping requirements;

(g) It informs respondents of the information called for under 5 CFR 1320.8 (b)(3) about:

(i) Why the information is being collected;

(ii) Use of information;

(iii) Burden estimate;

(iv) Nature of response (voluntary, required for a benefit, or mandatory);

(v) Nature and extent of confidentiality; and

(vi) Need to display currently valid OMB control number;

(h) It was developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected.

(i) It uses effective and efficient statistical survey methodology (if applicable); and

(j) It makes appropriate use of information technology.

If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.

Certification Date: 06/23/2023

---