Form SCI Form SCI

OMB APPROVAL

Securities and Exchange Commission
Washington, DC 20549
Form SCI
Page 1 of

3235-0703
OMB Number:
February 28, 2022
Expires:
Estimated average burden
per response:
25 Hrs.

File No. SCI-{name}-YYYY-###

SCI Notification and Reporting by: {SCI entity name}
Pursuant to Rules 1002 and 1003 of Regulation SCI under the Securities Exchange Act of 1934
 Initial
 Withdrawal
SECTION I:

Rule 1002 - Commission Notification of SCI Event

A. Submission Type (select one only)


Rule 1002(b)(1) Initial Notification of SCI event



Rule 1002(b)(2) Notification of SCI event



Rule 1002(b)(3) Update of SCI event: ####



Rule 1002(b)(4) Final Report of SCI Event



Rule 1002(b)(4) Interim Status Report of SCI event

If filing a Rule 1002(b)(1) or Rule 1002(b)(3) submission, please provide a brief description:

B. SCI Event Type(s) (select all that apply)


Systems compliance issue



Systems disruption



Systems intrusion

C. General Information Required for (b)(2) filings.
1) Has the Commission previously been notified of the SCI event pursuant to 1002(b)(1)? yes/no
2) Date/time SCI event occurred: mm/dd/yyyy hh:mm am/pm
3) Duration of SCI event: hh:mm, or days
4) Please provide the date and time when a responsible SCI personnel had reasonable basis to
conclude the SCI event occurred:
mm/dd/yyyy

hh:mm am/pm

5) Has the SCI event been resolved? yes/no
a) If yes, provide date and time of resolution:

mm/dd/yyyy

hh:mm am/pm

6) Is the investigation of the SCI event closed? yes/no
a) If yes, provide date of closure: mm/dd/yyyy
7) Estimated number of market participants potentially affected by the SCI event: ####
8) Is the SCI event a major SCI event (as defined in Rule 1000)? yes/no

SEC 2919 (9/15)

D. Information about impacted systems:
Name(s) of system(s):

Type(s) of system(s) impacted by the SCI event (check all that apply):


Trading



Clearance and settlement



Order routing



Market data



Market regulation



Market surveillance



Indirect SCI systems (please describe):

Are any critical SCI systems impacted by the SCI event (check all that apply)? Yes/No
1)

Systems that directly support functionality relating to:
 Clearance and settlement systems of clearing agencies
 Openings, reopenings, and closings on the primary listing market

2)

 Trading halts

 Initial public offerings

 The provision of consolidated market data

 Exclusively-listed securities



Systems that provide functionality to the securities markets for which the availability of alternatives

is significantly limited or nonexistent and without which there would be a material impact on fair and
orderly markets (please describe):

SECTION II: Periodic Reporting (select one only)
A. Quarterly Reports: For the quarter ended: mm/dd/yyyy
 Rule 1002(b)(5)(ii): Quarterly report of systems disruptions and systems intrusions with no or a
de minimis impact.
 Rule 1003(a)(1): Quarterly report of material systems changes
 Rule 1003(a)(2): Supplemental report of material systems changes
B. SCI Review Reports
 Rule 1003(b)(3): Report of SCI review, together with any response by senior management
Date of completion of SCI review: mm/dd/yyyy
Date of submission of SCI review to senior management: mm/dd/yyyy

SECTION III: Contact Information
Provide the following information of the person at the {SCI entity name} prepared to respond to questions
for this submission:
First Name:

Last Name:

Title:
E-Mail:
Telephone:

Fax:

Additional Contacts (Optional)
First Name:

Last Name:

Title:
E-Mail:
Telephone:

Fax:

First Name:

Last Name:

Title:
E-Mail:
Telephone:

Fax:

SECTION IV: Signature
Confidential treatment is requested pursuant to Rule 24b-2(g). Additionally, pursuant to the
requirements of the Securities Exchange Act of 1934, {SCI Entity name} has duly caused this
{notification}{report} to be signed on its behalf by the undersigned duly authorized officer:
Date:
By (Name)
“Digitally Sign and Lock Form”

Title (

)

Exhibit 1:
Rule 1002(b)(2)
Notification of SCI Event
Add/Remove/View

Within 24 hours of any responsible SCI personnel having a reasonable basis to conclude
that the SCI event has occurred, the SCI entity shall submit a written notification pertaining
to such SCI event to the Commission, which shall be made on a good faith, best efforts basis
and include:
(a) a description of the SCI event, including the system(s) affected; and
(b) to the extent available as of the time of the notificat ion: the SCI entity’s current
assessment of the types and number of market participants potentially affected by
the SCI event; the potential impact of the SCI event on the market; a description of
the steps the SCI entity has taken, is taking, or plans to take, with respect to the
SCI event; the time the SCI event was resolved or timeframe within which the SCI
event is expected to be resolved; and any other pertinent information known by
the SCI entity about the SCI event.

Exhibit 2:
Rule 1002(b)(4)
Final or Interim Report of SCI
Event
Add/Remove/View

When submitting a final report pursuant to either Rule 1002(b)(4)(i)(A) or Rule
1002(b)(4)(i)(B)(2), the SCI entity shall include:
(a) a detailed description of: the SCI entity’s assessment of the types and number of
market participants affected by the SCI event; the SCI entity’s assessment of the
impact of the SCI event on the market; the steps the SCI entity has taken, is taking,
or plans to take, with respect to the SCI event; the time the SCI event was resolved;
the SCI entity’s rule(s) and/or governing document(s), as applicable, that relate to
the SCI event; and any other pertinent informat ion known by the SCI entity about
the SCI event;
(b) a copy of any information disseminated pursuant to Rule 1002(c) by the SCI entity
to date regarding the SCI event to any of its me mbers or participants; and
(c)

an analysis of parties that may have experienced a loss, whether monetary or
otherwise, due to the SCI event, the number of such parties, and an estimate of the
aggregate amount of such loss.

When submitting an interim report pursuant to Rule 1002(b)(4)(i)(B)(1), the SCI entity
shall include such information to the extent known at the time.
Exhibit 3:
Rule 1002(b)(5)(ii)
Quarterly Report of De
Minimis SCI Events
Add/Remove/View

Exhibit 4:
Rule 1003 (a)
Quarterly Report of Systems
Changes
Add/Remove/View

The SCI entity shall submit a report, within 30 calendar days after the end of each calendar
quarter, containing a summary description of systems disruptions and systems intrusions
that have had, or the SCI entity reasonably estimates would have, no or a de minimis impact
on the SCI entity’s operations or on market participants, including the SCI systems and, for
systems intrusions, indirect SCI systems, affected by such SCI events during the applicable
calendar quarter.
When submitting a report pursuant to Rule 1003(a)(1), the SCI entity shall provide a report,
within 30 calendar days after the end of each calendar quarter, describing completed,
ongoing, and planned material changes to its SCI systems and the security of indirect SCI
systems, during the prior, current, and subsequent calendar quarters, including the dates or
expected dates of commencement and completion. An SCI entity shall establish reasonable
written criteria for identifying a change to its SCI systems and the security of indirect SCI
systems as material and report such changes in accordance with such criteria.
When submitting a report pursuant to Rule 1003(a)(2), the SCI entity shall provide a
supplemental report of a material error in or material omission from a report previously
submitted under Rule 1003(a)(1).

Exhibit 5:
Rule 1003(b)(3)
Report of SCI review
Add/Remove/View
Exhibit 6:
Optional Attachments
Add/Remove/View

The SCI entity shall provide a report of the SCI review, together with any response by senior
manage ment, within 60 calendar days after its submission to senior management of the SCI
entity.
This exhibit may be used in order to attach other documents that the SCI entity may wish to
submit as part of a Rule 1002(b)(1) initial notification submission or Rule 1002(b)(3)
update submission.

GENERAL INSTRUCTIONS FOR FORM SCI
A.

Use of the Form
Except with respect to notifications to the Commission made pursuant to Rule 1002(b)(1)

or updates to the Commission made pursuant to Rule 1002(b)(3), any notification, review,
description, analysis, or report required to be submitted pursuant to Regulation SCI under the
Securities Exchange Act of 1934 (“Act”) shall be filed in an electronic format through an
electronic form filing system (“EFFS”), a secure website operated by the Securities and
Exchange Commission (“Commission”). Documents attached as exhibits filed through the EFFS
system must be in a text-searchable format without the use of optical character recognition. If,
however, a portion of a Form SCI submission (e.g., an image or diagram) cannot be made
available in a text-searchable format, such portion may be submitted in a non-text searchable
format.
B.

Need for Careful Preparation of the Completed Form, Including Exhibits
This form, including the exhibits, is intended to elicit information necessary for

Commission staff to work with SCI self-regulatory organizations, SCI alternative trading
systems, plan processors, and exempt clearing agencies subject to ARP (collectively, “SCI
entities”) to ensure the capacity, integrity, resiliency, availability, security, and compliance of
their automated systems. An SCI entity must provide all the information required by the form,
including the exhibits, and must present the information in a clear and comprehensible manner.
A filing that is incomplete or similarly deficient may be returned to the SCI entity. Any filing so
returned shall for all purposes be deemed not to have been filed with the Commission. See also
Rule 0-3 under the Act (17 CFR 240.0-3).
C.

When to Use the Form
Form SCI is comprised of six types of required submissions to the Commission pursuant

to Rules 1002 and 1003. In addition, Form SCI permits SCI entities to submit to the

Commission two additional types of submissions pursuant to Rules 1002(b)(1) and 1002(b)(3);
however, SCI entities are not required to use Form SCI for these two types of submissions to the
Commission. In filling out Form SCI, an SCI entity shall select the type of filing and provide all
information required by Regulation SCI specific to that type of filing.
The first two types of required submissions relate to Commission notification of certain
SCI events:
(1) “Rule 1002(b)(2) Notification of SCI Event” submissions for notifications regarding
systems disruptions, systems compliance issues, or systems intrusions (collectively, “SCI
events”), other than any systems disruption or systems intrusion that has had, or the SCI entity
reasonably estimates would have, no or a de minimis impact on the SCI entity’s operations or on
market participants; and
(2) “Rule 1002(b)(4) Final or Interim Report of SCI Event” submissions, of which there
are two kinds (a final report under Rule 1002(b)(4)(i)(A) or Rule 1002(b)(4)(i)(B)(2); or an
interim status report under Rule 1002(b)(4)(i)(B)(1)).
The other four types of required submissions are periodic reports, and include:
(1) “Rule 1002(b)(5)(ii)” submissions for quarterly reports of systems disruptions and
systems intrusions which have had, or the SCI entity reasonably estimates would have, no or a de
minimis impact on the SCI entity’s operations or on market participants (“de minimis SCI
events”);
(2) “Rule 1003(a)(1)” submissions for quarterly reports of material systems changes;
(3) “Rule 1003(a)(2)” submissions for supplemental reports of material systems changes;
and
(4) “Rule 1003(b)(3)” submissions for reports of SCI reviews.
Required Submissions for SCI Events

For 1002(b)(2) submissions, an SCI entity must notify the Commission using Form SCI
by selecting the appropriate box in Section I and filling out all information required by the form,
including Exhibit 1. 1002(b)(2) submissions must be submitted within 24 hours of any
responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred.
For 1002(b)(4) submissions, if an SCI event is resolved and the SCI entity’s investigation
of the SCI event is closed within 30 calendar days of the occurrence of the SCI event, an SCI
entity must file a final report under Rule 1002(b)(4)(i)(A) within five business days after the
resolution of the SCI event and closure of the investigation regarding the SCI event. However, if
an SCI event is not resolved or the SCI entity’s investigation of the SCI event is not closed
within 30 calendar days of the occurrence of the SCI event, an SCI entity must file an interim
status report under Rule 1002(b)(4)(i)(B)(1) within 30 calendar days after the occurrence of the
SCI event. For SCI events in which an interim status report is required to be filed, an SCI entity
must file a final report under Rule 1002(b)(4)(i)(B)(2) within five business days after the
resolution of the SCI event and closure of the investigation regarding the SCI event. For
1002(b)(4) submissions, an SCI entity must notify the Commission using Form SCI by selecting
the appropriate box in Section I and filling out all information required by the form, including
Exhibit 2.
Required Submissions for Periodic Reporting
For 1002(b)(5)(ii) submissions, an SCI entity must submit quarterly reports of systems
disruptions and systems intrusions which have had, or the SCI entity reasonably estimates would
have, no or a de minimis impact on the SCI entity’s operations or on market participants. The
SCI entity must select the appropriate box in Section II and fill out all information required by
the form, including Exhibit 3.

For 1003(a)(1) submissions, an SCI entity must submit its quarterly report of material
systems changes to the Commission using Form SCI. The SCI entity must select the appropriate
box in Section II and fill out all information required by the form, including Exhibit 4.
Filings made pursuant to Rule 1002(b)(5)(ii) and Rule 1003(a)(1) must be submitted to
the Commission within 30 calendar days after the end of each calendar quarter (i.e., March 31st,
June 30th, September 30th and December 31st) of each year.
For 1003(a)(2) submissions, an SCI entity must submit a supplemental report notifying
the Commission of a material error in or material omission from a report previously submitted
under Rule 1003(a). The SCI entity must select the appropriate box in Section II and fill out all
information required by the form, including Exhibit 4.
For 1003(b)(3) submissions, an SCI entity must submit its report of its SCI review,
together with any response by senior management, to the Commission using Form SCI. A
1003(b)(3) submission is required within 60 calendar days after the report of the SCI review has
been submitted to senior management of the SCI entity. The SCI entity must select the
appropriate box in Section II and fill out all information required by the form, including Exhibit
5.
Optional Submissions
An SCI entity may, but is not required to, use Form SCI to submit a notification pursuant
to Rule 1002(b)(1). If the SCI entity uses Form SCI to submit a notification pursuant to Rule
1002(b)(1), it must select the appropriate box in Section I and provide a short description of the
SCI event. Documents may also be attached as Exhibit 6 if the SCI entity chooses to do so. An
SCI entity may, but is not required to, use Form SCI to submit an update pursuant to Rule
1002(b)(3). Rule 1002(b)(3) requires an SCI entity to, until such time as the SCI event is
resolved and the SCI entity’s investigation of the SCI event is closed, provide updates pertaining
to such SCI event to the Commission on a regular basis, or at such frequency as reasonably

requested by a representative of the Commission, to correct any materially incorrect information
previously provided, or when new material information is discovered, including but not limited
to, any of the information listed in Rule 1002(b)(2)(ii). If the SCI entity uses Form SCI to
submit an update pursuant to Rule 1002(b)(3), it must select the appropriate box in Section I and
provide a short description of the SCI event. Documents may also be attached as Exhibit 6 if the
SCI entity chooses to do so.
D.

Documents Comprising the Completed Form
The completed form filed with the Commission shall consist of Form SCI, responses to all

applicable items, and any exhibits required in connection with the filing. Each filing shall be
marked on Form SCI with the initials of the SCI entity, the four-digit year, and the number of the
filing for the year (e.g., SCI Name-YYYY-XXX).
E.

Contact Information; Signature; and Filing of the Completed Form
Each time an SCI entity submits a filing to the Commission on Form SCI, the SCI entity

must provide the contact information required by Section III of Form SCI. Space for additional
contact information, if appropriate, is also provided.
All notifications and reports required to be submitted through Form SCI shall be filed
through the EFFS. In order to file Form SCI through the EFFS, SCI entities must request access
to the Commission’s External Application Server by completing a request for an external
account user ID and password. Initial requests will be received by contacting (202) 551-5777.
An e-mail will be sent to the requestor that will provide a link to a secure website where basic
profile information will be requested. A duly authorized individual of the SCI entity shall
electronically sign the completed Form SCI as indicated in Section IV of the form. In addition, a
duly authorized individual of the SCI entity shall manually sign one copy of the completed Form
SCI, and the manually signed signature page shall be preserved pursuant to the requirements of
Rule 1005.

F.

Withdrawals of Commission Notifications and Periodic Reports
If an SCI entity determines to withdraw a Form SCI, it must complete Page 1 of the Form

SCI and indicate by selecting the appropriate check box to withdraw the submission.
G.

Paperwork Reduction Act Disclosure
This collection of information will be reviewed by the Office of Management and Budget

in accordance with the clearance requirements of 44 U.S.C. 3507. An agency may not conduct
or sponsor, and a person is not required to respond to, a collection of information unless it
displays a currently valid control number. The Commission estimates that the average burden to
respond to Form SCI will be between one and 125 hours, depending upon the purpose for which
the form is being filed. Any member of the public may direct to the Commission any comments
concerning the accuracy of this burden estimate and any suggestions for reducing this burden.
Except with respect to notifications to the Commission made pursuant to Rule 1002(b)(1)
or updates to the Commission made pursuant to Rule 1002(b)(3), it is mandatory that an SCI
entity file all notifications, reviews, descriptions, analyses, and reports required by Regulation
SCI using Form SCI. The Commission will keep the information collected pursuant to Form SCI
confidential to the extent permitted by law. Subject to the provisions of the Freedom of
Information Act, 5 U.S.C. 522 (“FOIA”), and the Commission’s rules thereunder (17 CFR
200.80(b)(4)(iii)), the Commission does not generally publish or make available information
contained in any reports, summaries, analyses, letters, or memoranda arising out of, in
anticipation of, or in connection with an examination or inspection of the books and records of
any person or any other investigation.
H.

Exhibits

List of exhibits to be filed, as applicable:
Exhibit 1: Rule 1002(b)(2) – Notification of SCI Event. Within 24 hours of any responsible SCI
personnel having a reasonable basis to conclude that the SCI event has occurred, the SCI entity

shall submit a written notification pertaining to such SCI event to the Commission, which shall
be made on a good faith, best efforts basis and include: (a) a description of the SCI event,
including the system(s) affected; and (b) to the extent available as of the time of the notification:
the SCI entity’s current assessment of the types and number of market participants potentially
affected by the SCI event; the potential impact of the SCI event on the market; a description of
the steps the SCI entity has taken, is taking, or plans to take, with respect to the SCI event; the
time the SCI event was resolved or timeframe within which the SCI event is expected to be
resolved; and any other pertinent information known by the SCI entity about the SCI event.
Exhibit 2: Rule 1002(b)(4) – Final or Interim Report of SCI Event. When submitting a final
report pursuant to either Rule 1002(b)(4)(i)(A) or Rule 1002(b)(4)(i)(B)(2), the SCI entity shall
include: (a) a detailed description of: the SCI entity’s assessment of the types and number of
market participants affected by the SCI event; the SCI entity’s assessment of the impact of the
SCI event on the market; the steps the SCI entity has taken, is taking, or plans to take, with
respect to the SCI event; the time the SCI event was resolved; the SCI entity’s rule(s) and/or
governing document(s), as applicable, that relate to the SCI event; and any other pertinent
information known by the SCI entity about the SCI event; (b) a copy of any information
disseminated pursuant to Rule 1002(c) by the SCI entity to date regarding the SCI event to any
of its members or participants; and (c) an analysis of parties that may have experienced a loss,
whether monetary or otherwise, due to the SCI event, the number of such parties, and an estimate
of the aggregate amount of such loss. When submitting an interim report pursuant to Rule
1002(b)(4)(i)(B)(1), the SCI entity shall include such information to the extent known at the
time.
Exhibit 3: Rule 1002(b)(5)(ii) – Quarterly Report of De Minimis SCI Events. The SCI entity
shall submit a report, within 30 calendar days after the end of each calendar quarter, containing a
summary description of systems disruptions and systems intrusions that have had, or the SCI
entity reasonably estimates would have, no or a de minimis impact on the SCI entity’s operations

or on market participants, including the SCI systems and, for systems intrusions, indirect SCI
systems, affected by such SCI events during the applicable calendar quarter.
Exhibit 4: Rule 1003(a) – Quarterly Report of Systems Changes. When submitting a report
pursuant to Rule 1003(a)(1), the SCI entity shall provide a report, within 30 calendar days after
the end of each calendar quarter, describing completed, ongoing, and planned material changes
to its SCI systems and the security of indirect SCI systems, during the prior, current, and
subsequent calendar quarters, including the dates or expected dates of commencement and
completion. An SCI entity shall establish reasonable written criteria for identifying a change to
its SCI systems and the security of indirect SCI systems as material and report such changes in
accordance with such criteria. When submitting a report pursuant to Rule 1003(a)(2), the SCI
entity shall provide a supplemental report of a material error in or material omission from a
report previously submitted under Rule 1003(a); provided, however, that a supplemental report is
not required if information regarding a material systems change is or will be provided as part of a
notification made pursuant to Rule 1002(b).
Exhibit 5: Rule 1003(b)(3) – Report of SCI Review. The SCI entity shall provide a report of the
SCI review, together with any response by senior management, within 60 calendar days after its
submission to senior management of the SCI entity.
Exhibit 6: Optional Attachments. This exhibit may be used in order to attach other documents
that the SCI entity may wish to submit as part of a Rule 1002(b)(1) initial notification submission
or Rule 1002(b)(3) update submission.
I.

Explanation of Terms

Critical SCI systems means any SCI systems of, or operated by or on behalf of, an SCI entity
that: (1) directly support functionality relating to: (i) clearance and settlement systems of
clearing agencies; (ii) openings, reopenings, and closings on the primary listing market; (iii)
trading halts; (iv) initial public offerings; (v) the provision of consolidated market data; or (vi)

exclusively-listed securities; or (2) provide functionality to the securities markets for which the
availability of alternatives is significantly limited or nonexistent and without which there would
be a material impact on fair and orderly markets.
Indirect SCI systems means any systems of, or operated by or on behalf of, an SCI entity that, if
breached, would be reasonably likely to pose a security threat to SCI systems.
Major SCI event means an SCI event that has had, or the SCI entity reasonably estimates would
have: (1) any impact on a critical SCI system; or (2) a significant impact on the SCI entity’s
operations or on market participants.
Responsible SCI personnel means, for a particular SCI system or indirect SCI system impacted
by an SCI event, such senior manager(s) of the SCI entity having responsibility for such system,
and their designee(s).
SCI entity means an SCI self-regulatory organization, SCI alternative trading system, plan
processor, or exempt clearing agency subject to ARP.
SCI event means an event at an SCI entity that constitutes: (1) a systems disruption; (2) a
systems compliance issue; or (3) a systems intrusion.
SCI review means a review, following established procedures and standards, that is performed
by objective personnel having appropriate experience to conduct reviews of SCI systems and
indirect SCI systems, and which review contains: (1) a risk assessment with respect to such
systems of an SCI entity; and (2) an assessment of internal control design and effectiveness of its
SCI systems and indirect SCI systems to include logical and physical security controls,
development processes, and information technology governance, consistent with industry
standards.
SCI systems means all computer, network, electronic, technical, automated, or similar systems
of, or operated by or on behalf of, an SCI entity that, with respect to securities, directly support

trading, clearance and settlement, order routing, market data, market regulation, or market
surveillance.
Systems Compliance Issue means an event at an SCI entity that has caused any SCI system of
such entity to operate in a manner that does not comply with the Act and the rules and
regulations thereunder or the entity’s rules or governing documents, as applicable.
Systems Disruption means an event in an SCI entity’s SCI systems that disrupts, or significantly
degrades, the normal operation of an SCI system.
Systems Intrusion means any unauthorized entry into the SCI systems or indirect SCI systems
of an SCI entity.