You May Be Exempt From Reg SCI, But You Still Need SCI!

Reg SCI Regulatory Background

On November 19, 2014 the Securities and Exchange Commission (SEC) voted to adopt new rules designed to strengthen the technology infrastructure of the US securities markets, requiring entities to have comprehensive policies and procedures in place for market impacting technologies. These Regulations for Systems Compliance and Integrity (Reg SCI) also offer guidance to take corrective actions when system issues or planned changes occur, provide notifications and status reports to the SEC, inform members and participants about system issues/changes, conduct business continuity testing and conduct annual reviews of their systems. Compliance with these rules became effective in August 2015. Alternative Trading Systems (ATS) newly meeting the volume thresholds in the rules for the first time are allowed an additional six months from the time the ATS first meets the thresholds. Entities must also comply with the sector-wide testing requirement.

Protection, Continuity and Growth

Ensuring that your technology systems, and the policies, procedures, supervisory responsibilities and risk controls surrounding it are robust and ready for the new rules is paramount for the protection, continuity and growth of your business. There is every indication from industry experts and from the SEC leadership themselves that they plan to continue to drive this down to firms with direct market access and higher trading volumes, and that if left uncontrolled, could potentially disrupt market activities. In order to ensure your firm is prepared, your firm should:

Perform a Technology Controls Assessment 

Identify where improvements may be needed.

Establish a Technology Controls Roadmap

Create a comprehensive plan to continue driving toward a ‘best in class’ application controls management program

Review Your Firm’s Software Development Lifecycle (SDLC) Management Processes

• Application Governance
• Roles and Responsibilities – Business, IT, Operations, Risk, Compliance, Legal & Internal Audit, etc.
• Risk and Issue Management processes
• Regulatory Compliance – Rule 15c3-5 (Market Access) certification, 3012 Review/Testing and Regulatory Reporting
• Software Design and Development procedures and code versioning controls
• Quality Assurance: all phases of testing, defect/enhancement management and change control processes
• Release Management & Post-release Monitoring
• Incident Management and Technical/User Support
• Change Management and Implementation Processes
• Information & Data Security, Cyber Security and Data Management
• Business Continuity and Disaster Recovery Policies, Procedures and Testing
• Performance and Capacity Management
• Application Access Management, Monitoring and Controls

Reg SCI Compliance and Technology Experts

Oyster Consulting’s experts have years of industry-specific technology experience, enabling them to perform a comprehensive technology controls review to help your firm stay ahead of the regulatory curve. Oyster will analyze your firm’s existing policies and procedures and supervisory responsibilities, and provide a report assessing strengths and weaknesses in the systems’ environment, process and potential resource risks. The analysis will include specific recommendations, and provide a tactical plan to implement them. Oyster does not have a one-size-fits-all approach to application controls and governance of systems. Our consultants can quickly assess which areas of your firm’s IT management controls need the most attention, and provide your firm with specific recommendations for enhancements to achieve industry best practices.