Self-Regulatory Organizations; Depository Trust Company; Order Approving the Proposed Rule Change Relating to Confidential Information, Market Disruption Events, and Other Changes

I. Introduction

On June 25, 2021, Depository Trust Company (“DTC”) filed with the Securities and Exchange Commission (“Commission”) proposed rule change SR-DTC-2021-011 (the “Proposed Rule Change”) pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 (“Act”) and Rule 19b-4 thereunder to amend DTC's rules relating to confidentiality requirements, Market Disruption Events, and procedures for disconnecting a participant from DTC's network, among other changes. The Proposed Rule Change was published for comment in the Federal Register on July 13, 2021. The Commission received comments that it has considered with respect to the Proposed Rule Change. For the reasons discussed below, the Commission is approving the Proposed Rule Change.

II. Description of the Proposed Rule Change

Pursuant to the Proposed Rule Change, DTC is proposing three main changes to its Rules, Bylaws, and Organization Certificate(“Rules”): (1) Standardizing the confidentiality requirement applicable to DTC with respect to its participants' information and adding confidentiality requirement applicable to participants with respect to DTC's information, (2) updating its Market Disruption and Force Majeure Rule (“Force Majeure Rule”) to authorize two additional officers to determine that a Market Disruption Event has occurred, and (3) adding a new rule setting forth the procedures under which DTC would be able to disconnect a participant from its network in certain circumstances (“Systems Disconnect Rule”). The Commission provides relevant background and describes each of these proposed changes in greater detail below.

A. Background

DTC serves as the central securities depository for substantially all corporate and municipal debt and equity securities available for trading in the United States. DTC provides depository services and asset servicing for a wide range of security types such as money market instruments, equities, warrants, rights, corporate debt and notes, municipal bonds, government securities, asset-backed securities, and collateralized mortgage obligations. DTC's custodial services include the safekeeping, record keeping, book entry transfer, and pledge of securities among its Participants and Pledgees. DTC also provides services to securities issuers, such as maintaining current ownership records and distributing payments to shareholders. In light of DTC's critical role in the marketplace, DTC was designated a Systemically Important Financial Market Utility (“SIFMU”) under Title VIII of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010. Due to DTC's unique position in the marketplace, a failure or a disruption to DTC could, among other things, increase the risk of significant liquidity problems spreading among financial institutions or markets, and thereby threaten the stability of the financial system in the United States.

DTC participants connect to DTC's systems, either directly through the Securely Managed and Reliable Technology (“SMART”) network or through a third party service provider or service bureau. DTC's parent company, The Depository Trust & Clearing Corporation (“DTCC”) manages the SMART network, which connects a nationwide complex of networks, processing centers, and control facilities.

B. Proposed Changes

1. Confidentiality Requirements

Confidentiality Requirements Applicable to DTC: DTC collects confidential information from its participants to assess whether each participant meets DTC's membership requirements either to gain or continue access to DTC's depository, custodial and settlement services (hereinafter collectively, settlement services). In turn, DTC is required to maintain the confidentiality of any information furnished by its participants. Currently, DTC's Rules obligate DTC to hold participants' information in the same degree of confidence as may be required by law or the rules and regulations (hereinafter collectively, “regulations”) of the appropriate regulatory body having jurisdiction over the participant.

DTC states that its current Rules create ambiguity because DTC's obligations depend on each participant's regulatory requirements, which could lead to unequal treatment of participants and conflicts of law with DTC's regulatory requirements or with respect to a participant who is subject to multiple jurisdictions' regulations. DTC also states that applying different standards creates operational burdens because DTC must track the regulations applicable to each of its participants and must maintain the confidentiality of each participant's information to the same degree as required by the applicable regulations.

In order to clarify its confidentiality requirements and to enhance its operational efficiency, DTC proposes to revise its Rules to establish a standard, which will require DTC to hold participant confidential information to the same degree as DTC's regulatory requirements that relate to the confidentiality of records, and to remove the references to each participant's particular regulatory obligations. DTC represents that the proposed change would provide participants with similar protections because DTC believes its regulatory requirements are comparable to the regulations applicable to its participants and, therefore, would not result in changes to DTC's current practices or the protection offered to its participants' confidential information.

Confidentiality Requirements Applicable to Participants: DTC's Rules do not include obligations for its participants to protect confidential information furnished by DTC or its affiliates. However, DTC states that, in connection with the development of cyber and information security programs pursuant to applicable participant regulatory requirements, DTC and DTCC have received an increasing number of requests from participants for confidential information, such as information regarding DTCC's network operations, data security practices, and legal settlements. Additionally, DTC states that participants may request DTC or DTCC to disclose confidential information regarding its cyber threat indicators, sources of cyber threat information, or other information and actions taken following a cyber incident relating to a participant, DTC, or DTCC.

To facilitate information sharing by DTC while protecting the confidentiality of proprietary and confidential information DTC shares with its participants, DTC proposes to add participant confidentiality requirements to its Rules. The new provisions will require participants to maintain the confidentiality of information furnished by DTC through proper safeguards to prevent disclosure of such confidential information, except as necessary to perform its obligations under DTC's Rules or as otherwise required by applicable law. DTC proposes that participants be required to maintain the confidentiality of this information to the same extent and using the same means the participant uses to protect its own confidential information, but no less than a reasonable standard of care. DTC's proposal will also entitle DTC or DTCC to seek any temporary or permanent injunctive or other equitable relief in addition to any monetary damages under the Rules if a participant breaches its confidentiality requirements. Additionally, DTC's proposal will entitle DTC to impose other disciplinary proceedings or restrictions on access to services for a participant's failure to comply with its confidentiality requirements, consistent with the existing tools available to DTC regarding a participant's failure to comply with its Rules.

2. Market Disruption Event

DTC's Rules contain provisions that identify the events or circumstances that DTC would consider to be a Market Disruption Event, including, for example, events that lead to the suspension or limitation of trading or banking in the markets in which DTC operates, or the unavailability or failure of any material payment, bank transfer, wire or securities settlement systems. Upon the declaration of a Market Disruption Event, DTC's Rules provide DTC with tools to address such an event, such as suspending any or all services and taking, or requiring participants to take, any actions DTC considers appropriate to facilitate the continuation of DTC's services.

Currently, DTC's Board of Directors may declare a Market Disruption Event and may take any actions authorized by DTC's Rules to address the event. However, DTC's Rules also authorize certain officers to make an interim declaration of a Market Disruption Event, to allow DTC to prevent delays in addressing a Market Disruption Event if the Board of Directors is unable to convene. In the event of such an interim declaration, the Board of Directors must ratify, modify, or rescind the officer's determination as soon as practicable. Currently, the officers authorized to make such determination are the Chief Executive Officer, Chief Financial Officer, Group Chief Risk Officer, and General Counsel.

DTC proposes to add two additional officers of DTC, the Chief Information Officer and the Head of Clearing Agency Services, to the list of authorized officers that could make such an interim determination if the Board of Directors is unable to convene. DTC states these two officers, like the other officers currently provided in the Rules, maintain senior executive level positions at DTC, oversee divisions of DTC, and hold positions at DTC that would provide them a necessary global view into DTC's operations and systems to enable them to determine the existence of a Market Disruption Event. DTC states adding these two additional officers would facilitate DTC's ability to implement its emergency procedures in the event of a Market Disruption Event.

3. Systems Disconnect Rule

As mentioned above in Section II.A (Background), DTC's participants connect to DTC's systems, either through the DTCC-managed SMART network or through other electronic means, such as through a third party service provider or service bureau. DTC's Rules do not address DTC's ability to disconnect a participant whose network connection risks harming DTC's systems. DTC's proposal will establish procedures under which DTC would be able to disconnect a participant from its network due to the risk of an imminent threat to DTC, participants, or other market participants.

DTC's proposal will address DTC's authority to take certain actions upon the occurrence, and during the pendency, of a Major Event. A “Major Event” will be defined as the happening of one or more “Systems Disruptions” reasonably likely to have a significant impact on DTC's operations, including “DTCC Systems,” that affect the business, operations, safeguarding of securities or funds, or physical functions of DTC, its participants, or other market participants. “Systems Disruption” will, in turn, be defined as the unavailability, failure, malfunction, overload, or restriction (whether partial or total) of a DTCC Systems Participant's systems that disrupts or degrades the normal operation of such DTCC Systems Participant's systems; or anything that impacts or alters the normal communication or the files that are received, or information transmitted, to or from the DTCC Systems.

DTC's proposal would also provide governance procedures applicable to DTC's determination whether, and how, to implement the provisions of the Systems Disconnect Rule. The same officers with delegated authority under the Force Majeure Rule may make a determination that a Major Event has occurred. As discussed in Section II.B.2 (Market Disruption Event) above, DTC states these officers maintain senior executive level positions at DTC, oversee divisions of DTC, and hold positions at DTC that would provide them a necessary global view into DTC's operations and systems to enable them to determine the existence of a Market Disruption Event, which would also enable them to determine the existence of a Major Event.

However, the proposed process for declaring a Major Event, by contrast, would start with a designated officer, whereas, for a Market Disruption Event, the officer would make an interim determination only if the Board of Directors were unable to timely convene. DTC states it designed the process in this way to improve its ability to respond quickly, efficiently, and effectively to a Major Event that arises abruptly. Following this determination, any management committee including all of the officers authorized to determine a Major Event would convene, and DTC would convene a Board of Directors meeting as soon as practicable thereafter, and in any event within five Business Days following such determination, to ratify, modify, or rescind the Officer Major Event Action.

In addition, the proposed rule will require participants to notify DTC immediately upon becoming aware of a Major Event, and, likewise, will require DTC to notify its participants promptly of any action DTC takes or intends to take with respect to a Major Event. Finally, the proposal will address certain miscellaneous related matters including: (i) A limitation of liability for any failure or delay in performance, in whole or in part of DTC's obligations under the Rules, arising out of or related to a Major Event, (ii) a statement that DTC's power to take any action pursuant to the Systems Disconnect Rule also includes the power to repeal, rescind, revoke, amend or vary such action, (iii) a statement that DTC's powers pursuant to the Systems Disconnect Rule shall be in addition to, and not in derogation of, authority granted elsewhere in the Rules to take action as specified therein, (iv) a requirement that participants shall keep any confidential information provided to them by DTC in connection with a Major Event confidential, and (v) a statement that in the event of any conflict between the provisions of the Systems Disconnect Rule and any other Rules or Procedures, the provisions of the Systems Disconnect Rule would prevail.

III. Discussion and Commission Findings

Section 19(b)(2)(C) of the Act directs the Commission to approve a proposed rule change of a self-regulatory organization if it finds that such proposed rule change is consistent with the requirements of the Act and the rules and regulations thereunder applicable to such organization. After careful consideration, the Commission finds that the Proposed Rule Change is consistent with the requirements of the Act and the rules and regulations applicable to DTC. In particular, the Commission finds that the Proposed Rule Change is consistent with Section 17A(b)(3)(F) of the Act and Rules 17Ad-22(e)(1), (e)(2), and (e)(17)(i) thereunder.

A. Consistency With Section 17A(b)(3)(F) of the Act

Section 17A(b)(3)(F) of the Exchange Act requires, in part, that the rules of a clearing agency, such as DTC, be designed, in part, to promote the prompt and accurate clearance and settlement of securities transactions and to assure the safeguarding of securities and funds which are in the custody or control of the clearing agency or for which it is responsible. The Commission finds that the Proposed Rule Change is consistent with Section 17A(b)(3)(F) of the Act for the reasons discussed below.

As described above in Section II.B.1 (Confidentiality Requirements), DTC proposes to revise its Rules to establish a standard relating to DTC's obligation to maintain the confidentiality of information it collects from participants to assess each participant's compliance with DTC's membership requirements. The Commission believes such a uniform standard will help DTC meet its obligations and will help each participant better understand DTC's obligations for maintaining the confidential information it shares with DTC, which, in turn, may facilitate the sharing of such information and improve DTC's ability to evaluate its participants' eligibility to access DTC's settlement services.

Also, as described above in Section II.B.1 (Confidentiality Requirements), DTC proposes to add participant confidentiality requirements to its Rules to ensure participants maintain the confidentiality of information DTC shares, which participants may then use to determine whether to participate in DTC's settlement services by understanding DTC system requirements and DTC system safeguards. The Commission believes participant confidentiality requirements will help each participant better understand its rights and obligations for maintaining the confidential information DTC shares, which, in turn, may facilitate participant compliance. Therefore, the Commission believes the proposed changes to DTC and participant confidentiality requirements are consistent with promoting the prompt and accurate settlement of securities transactions by DTC.

As described above in Section II.B.2 (Market Disruption Event) and Section II.B.3 (Systems Disconnect Rule), risks, threats, and potential vulnerabilities due to a Market Disruption Event or a Major Event could impede DTC's ability to provide its settlement services. DTC proposes to add two officers authorized to make an interim determination that a Market Disruption Event has occurred if the Board of Directors is unable to timely convene. The Commission believes the proposed change will improve DTC's ability to respond quickly to a Market Disruption Event, which could help DTC mitigate the impact of such event on DTC, its participants, and the broader market.

Additionally, as described above in Section II.B.3 (Systems Disconnect Rule), DTC proposes to add the Systems Disconnect Rule, which will set forth the procedures under which DTC would be authorized, upon the occurrence of a Major Event (as defined in the proposed rules), to take certain actions, including disconnecting a participant from DTC's systems, suspending data transmissions between DTC and the participant, and requiring the participant to take other actions necessary to protect DTC and its participants. The Commission believes the proposed Systems Disconnect Rule will enable DTC to respond quickly to a potential cyber threat or other network disruption, which could help DTC prevent the spread of a participant's systems disruptions to DTC, its participants, and other market participants that could otherwise cause losses to DTC or its participants.

One commenter suggests certain revisions to the definition of Major Event so that certain terms in the Systems Disconnect Rule are consistent with the definition of Market Disruption Event in the Force Majeure Rule. The Commission disagrees. Consistency between the Systems Disconnect Rule and Force Majeure Rule is not necessary because DTC designed the Systems Disconnect Rule for a different purpose. Although both rules relate to events that, if left unaddressed, could affect DTC's ability to provide settlement services, the Force Majeure Rule is designed to cover events caused by external forces that impact DTC and its participants, whereas the Systems Disconnect Rule is designed only to cover disruptions to participant's computer systems or network that could flow through to DTC systems. Therefore, differences between the two rules do not raise consistency concerns, because of their different purposes.

Therefore, for the reasons described above, the Commission believes the proposed changes relating to a Market Disruption Event or a Major Event will help promote the prompt and accurate clearance and settlement of securities transactions and with assuring DTC safeguards securities and funds that are in its custody or control or for which it is responsible. Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Section 17A(b)(3)(F) of the Act.

B. Consistency With Rule 17Ad-22(e)(1)

Rule 17Ad-22(e)(1) under the Exchange Act requires that a covered clearing agency establish, implement, maintain and enforce written policies and procedures reasonably designed to provide for a well-founded, clear, transparent and enforceable legal basis for each aspect of its activities in all relevant jurisdictions. The Commission finds that the Proposed Rule Change is consistent with Rule 17Ad-22(e)(1) of the Exchange Act for the reasons discussed below.

As described above in Sections II.B.1 (Confidentiality Requirements) and II.B.2 (Market Disruption Event), DTC proposes to establish a consistent standard for its obligation to maintain the confidentiality of information it collects from its participants and to establish participant confidentiality requirements. The Commission believes a consistent standard for DTC's confidentiality requirements will provide for clear and transparent standard rules for participants, rather than maintaining potentially different confidentiality standards for participants based on the various, unrelated regulatory bodies governing those participants. Additionally, the Commission believes that imposing specific legal standards applicable to both DTC and its participants to follow will provide for a well-founded legal basis for the sharing and maintaining of confidential information between DTC and its participants.

Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Rule 17Ad-22(e)(1) of the Exchange Act.

C. Consistency With Rule 17Ad-22(e)(2)

Rule 17Ad-22(e)(2) under the Exchange Act requires, in part, that a covered clearing agency establish, implement, maintain and enforce written policies and procedures reasonably designed to provide for governance arrangements that are clear and transparent and that specify clear and direct lines of responsibility. The Commission finds that the Proposed Rule Change is consistent with Rule 17Ad-22(e)(2) of the Exchange Act for the reasons discussed below.

The Commission believes DTC's proposal, as described above in Section II.B.2 (Market Disruption Event), to add two officers authorized to make an interim determination of a Market Disruption Event if the Board of Directors is unable to convene in a timely manner provides for governance arrangements that are clear and transparent and that provide clear and direct lines of responsibility. Likewise, the Commission believes DTC's proposal to identify the officers authorized to make an interim determination of a Major Event, which will then be ratified, modified, or rescinded by the management committee and the Board of Directors will provide for clear and transparent governance procedures and will specify clear and direct lines of responsibility. Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Rule 17Ad-22(e)(2) of the Exchange Act.

D. Consistency With Rule 17Ad-22(e)(17)(i)

Rule 17Ad-22(e)(17)(i) under the Exchange Act requires that a covered clearing agency establish, implement, maintain and enforce written policies and procedures reasonably designed to manage the covered clearing agency's operational risks by identifying the plausible sources of operational risk, both internal and external, and mitigating their impact through the use of appropriate systems, policies, procedures, and controls. The Commission finds that the Proposed Rule Change is consistent with Rule 17Ad-22(e)(17)(i) of the Exchange Act for the reasons discussed below.

The Commission believes DTC's proposal, as described above in Section II.B.2 (Market Disruption Event), to add two officers authorized to make an interim determination of a Market Disruption Event could help DTC mitigate the impact of a Market Disruption Event by ensuring DTC can respond quickly to such event if the Board of Directors were unable to convene in a timely manner. Likewise, the Commission believes the proposed Systems Disconnect Rule, as described in Section II.B.3 above, provides a rules-based process that will enable DTC to identify potential cyber threats or other network disruptions, which could help DTC prevent the spread of a participant's systems disruptions to DTC, its participants, and other market participants that could otherwise cause losses to DTC or its participants.

One commenter suggests revising the definition of Major Event to be consistent with the definition of Market Disruption Event in the Force Majeure Rule. The commenter further argues the impact to DTC covered by the definition of Major Event should be limited to “DTCC Systems” (as defined in the proposed rule) to ensure the scope of the proposed rule is limited to technical systems. The Commission disagrees. As noted above, the purposes of both the Force Majeure Rule and the Systems Disconnect Rule are different. The Force Majeure Rule is designed to cover events external to DTC and its participants that materially impact, or are likely to materially impact, DTC's ability to provide its settlement services. The Systems Disconnect Rule, by contrast, is designed to cover a participant's systems or network disruption, which through its connection to DTC, is reasonably likely to have a significant impact on DTC's systems. The differences between the rules' purposes support the need for differing standards. Furthermore, the Commission notes the reference to “including DTCC Systems” in the proposed definition of Major Event takes into account how DTC's operations, i.e., its settlement services, work, in that they utilize DTCC Systems. Consequently, the commenter's proposed revisions are not necessary.

Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Rule 17Ad-22(e)(17)(i) of the Exchange Act.

IV. Conclusion

On the basis of the foregoing, the Commission finds that the Proposed Rule Change is consistent with the requirements of the Act and in particular with the requirements of Section 17A of the Act and the rules and regulations promulgated thereunder.

It is therefore ordered, pursuant to Section 19(b)(2) of the Act that Proposed Rule Change SR-DTC-2021-011, be, and hereby is, approved .