The U.S. Securities and Exchange Commission censured OTC Link LLC on 22 September 2026, issued a cease-and-desist order and imposed a $575,000 civil penalty. The settled action concerns governance and written-control failures under Regulation Systems Compliance and Integrity, not a finding that a particular trade failed, investors lost money or the platform suffered a cyberattack.
OTC Link LLC is an indirect wholly owned subsidiary of OTC Markets Group Inc. The SEC says it operates five alternative trading systems, including OTC Link ATS, an infrastructure venue for over-the-counter securities and an “SCI entity” during the relevant period.
What the SEC found
From August 2016 through March 2025, the SEC order finds, OTC Link lacked, failed to maintain or did not enforce required policies covering account management and access control, network-device configuration, data-loss prevention, and application-vulnerability testing and remediation.
Examination staff repeatedly identified missing or draft controls. The order gives one specific example: an access-control policy first cited as a draft in a fiscal-2016 examination was cited again in 2019 and 2022 and had still not been formally established as of fiscal 2023.
The Commission found violations of Regulation SCI Rules 1001(a)(1), (a)(2) and (a)(3), covering core systems policies, minimum control areas, periodic effectiveness reviews and prompt remediation. Without admitting the findings, OTC Link accepted the Commission’s jurisdiction, the censure, cease-and-desist order and penalty.
What the order does not establish
The public record does not find a specific outage, hacked account, distorted quote, failed execution or customer loss. Regulation SCI is designed to protect the capacity, integrity, resiliency, availability and security of critical market systems. Here, the sanction rests on governance and remediation deficiencies.
This is a completed SEC settlement rather than a pending allegation, but the respondent did not admit the order’s findings. It would therefore be inaccurate to recast the case as fraud, a data breach or proof of investor harm.
Remediation and practical impact
The order records that OTC Link retained third-party compliance consultants in 2024. Since March 2025 it has established additional policies involving vulnerability management, account and access control, and network-device configuration. The SEC nevertheless concluded that the earlier repeated delay warranted enforcement.
For brokers and infrastructure operators, the lesson is that technical controls must be finalized in written policy, tested, reviewed and supported by evidence that examination findings are closed promptly. For traders, the order is a reason to understand which quotation and execution systems sit behind a broker, not a basis to assume that OTC trading or customer funds are currently impaired.
TraderVote view
The case matters beyond the size of the fine. In automated markets, operational resilience depends on governance, ownership, testing and remediation as much as on equipment. The SEC’s focus on policies left in draft form for years signals that infrastructure compliance is a continuing control process, not a one-time document exercise.
Sources
SEC Release 2026-91, published 22 September and accessed 23 September 2026: https://www.sec.gov/newsroom/press-releases/2026-91-sec-censures-otc-link-llc-repeated-compliance-failures-related-regulation-sci
SEC settled order, Exchange Act Release No. 106458, published 22 September and accessed 23 September 2026: https://www.sec.gov/files/litigation/admin/2026/34-106458.pdf
OTC Markets Group 2025 Annual Report, published March and accessed 23 September 2026: https://www.otcmarkets.com/file/company/financial-report/530624/content
Written independently by Hengyuan from public information verifiable as of 23 September 2026. This article is not investment or legal advice.
Discussion
Comments (0)
Sign in to join the discussion.
Sign inNo published comments yet. Start the discussion.