Three SEC examination cycles identified compliance problems at a major over-the-counter trading operator. The public record does not explain why years passed before enforcement followed.
The Securities and Exchange Commission censured OTC Link LLC on Tuesday and ordered the broker-dealer to pay a $575,000 civil penalty for repeated failures involving technology and security requirements under Regulation Systems Compliance and Integrity, better known as Regulation SCI.
The penalty is straightforward.
The timeline is considerably less so.
According to the SEC’s September 22 administrative order, the agency identified a deficiency involving OTC Link ATS’s access-control policy during a fiscal year 2016 examination.
SEC examiners returned in 2019.
The problem was cited again.
They returned again in 2022.
It was cited again.
And according to the SEC, as of fiscal year 2023, the access-control policy “had still not been formally established.”
That leaves an obvious question: What happened during those seven years?
The SEC isn’t saying.
A Rule Requiring “Prompt Action”
OTC Link is a registered broker-dealer and a subsidiary of OTC Markets Group. It operates alternative trading systems used by broker-dealers to execute or facilitate transactions in securities that trade outside national securities exchanges.
Because of its role in the market, OTC Link ATS is subject to Regulation SCI, a regulatory framework covering the technological infrastructure of important securities-market entities.
Among other requirements, Regulation SCI requires covered entities to maintain policies and procedures governing their technological systems, conduct periodic reviews and take “prompt action” to remedy identified deficiencies.
According to Tuesday’s SEC order, OTC Link’s problems went well beyond one unfinished document.
The Commission identified deficiencies involving account management and access controls, network-device security configuration, data-loss prevention, application vulnerability management, and vulnerability testing and remediation.
But the access-control policy provides perhaps the clearest illustration of the timeline.
The SEC says the policy was deficient during its FY2016 examination because it remained in draft form.
A subsequent examination resulted in another deficiency letter in 2019.
Another examination produced another deficiency letter in 2022.
By FY2023, according to the Commission, the policy still had not been formally established.
If federal regulatory examinations came with punch cards, OTC Link was getting close to a free one.
Then Came the Consultants
The chronology finally begins moving faster in 2024.
According to the SEC, OTC Link retained third-party compliance consultants that year to evaluate its Regulation SCI program and recommend improvements.
Beginning in March 2025, the company established additional policies covering areas including application vulnerability management, account management and access control, and network-device configuration management.
The SEC ultimately found that OTC Link willfully violated several provisions of Regulation SCI. The company agreed to a censure, a cease-and-desist order and the $575,000 penalty without admitting the Commission’s findings, except as to jurisdiction.
But this was not OTC Link’s first recent encounter with SEC enforcement.
In August 2024, the SEC charged OTC Link with separate anti-money-laundering compliance failures.
In that case, the SEC found that from March 2020 through May 2023, OTC Link failed to implement reasonably designed policies and procedures for monitoring transactions on its trading platforms for suspicious activity.
The result was remarkable: OTC Link did not file a single Suspicious Activity Report during that period, despite its three platforms facilitating tens of thousands of OTC transactions daily.
OTC Link paid $1.19 million to settle that matter. The SEC said that investigation also grew out of an examination conducted by its Division of Examinations.
The two cases involve different regulations and different compliance failures. There is no evidence in the public record establishing that one caused or contributed to the other.
Their timelines nevertheless overlap.
Three Examinations, One Unanswered Question
The SEC’s latest order establishes that its examiners repeatedly found problems at OTC Link.
What it does not explain is what happened after they found them.
Bureaucracy Times contacted the SEC’s Office of Public Affairs on September 22 seeking the dates of the deficiency letters associated with the 2016, 2019 and 2022 examinations.
We also asked whether OTC Link submitted remediation plans after those examinations, whether the SEC ever considered the deficiencies resolved, whether remediation deadlines were established, when examiners determined previously identified deficiencies remained unaddressed, and when the matter was referred or otherwise escalated to the Division of Enforcement.
We specifically asked how the seven-year history of the access-control policy squared with Regulation SCI’s requirement for “prompt action” to remedy deficiencies.
The SEC declined to answer.
“Attributable to an SEC spokesperson, we decline comment beyond our public filings including our press release which we issued today,” SEC Public Affairs Specialist David Ausiello told Bureaucracy Times.
That leaves the Commission’s own enforcement order to tell the story.
FY2016: deficiency identified.
2019: cited again.
2022: cited again.
FY2023: still not formally established.
2024: outside consultants brought in.
March 2025: additional policies established.
September 2026: enforcement action announced.
None of that absolves OTC Link of the violations described by the SEC. The Commission’s order places responsibility on the company for maintaining the required policies and promptly correcting deficiencies.
But regulatory oversight is also supposed to do something after regulators repeatedly discover that a regulated entity has not fixed a previously identified problem.
The SEC has now documented three examination cycles and years of unresolved deficiencies at an operator of important securities-market infrastructure.
What remains missing from the public record is what the regulator did about those findings along the way.
For now, the SEC has declined to fill in that part of the timeline.
Sources: SEC Administrative Order, In the Matter of OTC Link LLC, Release No. 34-106458 (September 22, 2026); SEC press release, OTC Link AML enforcement action (August 2024).
