Self-Regulatory Organizations; Fixed Income Clearing Corporation; Order Approving the Proposed Rule Change Relating to Confidential Information, Market Disruption Events, and Other Changes

I. Introduction

On June 25, 2021, Fixed Income Clearing Corporation (“FICC”) filed with the Securities and Exchange Commission (“Commission”) proposed rule change SR-FICC-2021-004 (the “Proposed Rule Change”) pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 (“Act”) and Rule 19b-4 thereunder to amend FICC's Government Securities Division (“GSD”) rules and Mortgage-Backed Securities Division (“MBSD”) rules relating to confidentiality requirements, Market Disruption Events, and procedures for disconnecting a participant from FICC's network, among other changes. The Proposed Rule Change was published for comment in the Federal Register on July 13, 2021. The Commission received comments that it has considered with respect to the Proposed Rule Change. For the reasons discussed below, the Commission is approving the Proposed Rule Change.

II. Description of the proposed rule change

Pursuant to the Proposed Rule Change, FICC is proposing three main changes to its GSD Rulebook (“GSD Rules”) and its MBSD Clearing Rules (“MBSD Rules”) and MBSD Electronic Pool Notification (“EPN Rules”) (hereinafter collectively, “Rules”): (1) Standardizing the confidentiality requirement applicable to FICC with respect to its participants' information and adding confidentiality requirement applicable to participants with respect to FICC's information, (2) updating its GSD and MBSD Market Disruption and Force Majeure Rules (“Force Majeure Rule”) to authorize two additional officers to determine that a Market Disruption Event has occurred, and (3) adding a new GSD rule and MBSD rule setting forth the procedures under which FICC would be able to disconnect a participant from its network in certain circumstances (“Systems Disconnect Rule”). The Commission provides relevant background and describes each of these proposed changes in greater detail below.

A. Background

FICC plays a prominent role in the fixed income markets as the sole clearing agency in the United States acting as a central counterparty and provider of significant clearance and settlement services for cash settled U.S. treasury and agency securities and the non-private label mortgage-backed securities markets FICC. In light of FICC's critical role in the marketplace, FICC was designated a Systemically Important Financial Market Utility (“SIFMU”) under Title VIII of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010. Due to FICC's unique position in the marketplace, a failure or a disruption to FICC could, among other things, significantly disrupt settlement of securities transactions cleared by FICC and increase the risk of substantial liquidity problems spreading among financial institutions or markets, and thereby threaten the stability of the financial system in the United States.

FICC participants connect to FICC's systems, either directly through the Securely Managed and Reliable Technology (“SMART”) network or through a third party service provider or service bureau. FICC's parent company, The Depository Trust & Clearing Corporation (“DTCC”) manages the SMART network, which connects a nationwide complex of networks, processing centers, and control facilities.

B. Proposed Changes

1. Confidentiality Requirements

Confidentiality Requirements Applicable to FICC: FICC collects confidential information from its participants to assess whether each participant meets FICC's membership requirements either to gain or continue access to FICC's clearance and settlement services. In turn, FICC is required to maintain the confidentiality of any information furnished by its participants, including the books and records FICC has a right to inspect. Currently, FICC's Rules obligate FICC to hold participants' information in the same degree of confidence as may be required by law or the rules and regulations (hereinafter collectively, “regulations”) of the appropriate regulatory body having jurisdiction over the participant.

FICC states that its current Rules create ambiguity because FICC's obligations depend on each participant's regulatory requirements, which could lead to unequal treatment of participants and conflicts of law with FICC's regulatory requirements or with respect to a participant who is subject to multiple jurisdictions' regulations. FICC also states that applying different standards creates operational burdens because FICC must track the regulations applicable to each of its participants and must maintain the confidentiality of each participant's information to the same degree as required by the applicable regulations.

In order to clarify its confidentiality requirements and to enhance its operational efficiency, FICC proposes to revise its Rules to establish a standard, which will require FICC to hold participant confidential information to the same degree as FICC's regulatory requirements that relate to the confidentiality of records, and to remove the references to each participant's particular regulatory obligations. FICC represents that the proposed change would provide participants with similar protections because FICC believes its regulatory requirements are comparable to the regulations applicable to its participants and, therefore, would not result in changes to FICC's current practices or the protection offered to its participants' confidential information.

Confidentiality Requirements Applicable to Participants: FICC's Rules do not include obligations for its participants to protect confidential information furnished by FICC or its affiliates. However, FICC states that, in connection with the development of cyber and information security programs pursuant to applicable participant regulatory requirements, FICC and DTCC have received an increasing number of requests from participants for confidential information, such as information regarding DTCC's network operations, data security practices, and legal settlements. Additionally, FICC states that participants may request FICC or DTCC to disclose confidential information regarding its cyber threat indicators, sources of cyber threat information, or other information and actions taken following a cyber incident relating to a participant, FICC, or DTCC.

To facilitate information sharing by FICC while protecting the confidentiality of proprietary and confidential information FICC shares with its participants, FICC proposes to add participant confidentiality requirements to its Rules. The new provisions will require participants to maintain the confidentiality of information furnished by FICC through proper safeguards to prevent disclosure of such confidential information, except as necessary to perform its obligations under FICC's Rules or as otherwise required by applicable law. FICC proposes that participants be required to maintain the confidentiality of this information to the same extent and using the same means the participant uses to protect its own confidential information, but no less than a reasonable standard of care. FICC's proposal will also entitle FICC or DTCC to seek any temporary or permanent injunctive or other equitable relief in addition to any monetary damages under the Rules if a participant breaches its confidentiality requirements. Additionally, FICC's proposal will entitle FICC to impose other disciplinary proceedings or restrictions on access to services for a participant's failure to comply with its confidentiality requirements, consistent with the existing tools available to FICC regarding a participant's failure to comply with its Rules.

2. Market Disruption Event

FICC's Rules contain provisions that identify the events or circumstances that FICC would consider to be a Market Disruption Event, including, for example, events that lead to the suspension or limitation of trading or banking in the markets in which FICC operates, or the unavailability or failure of any material payment, bank transfer, wire or securities settlement systems. Upon the declaration of a Market Disruption Event, FICC's Rules provide FICC with tools to address such an event, such as suspending any or all services and taking, or requiring participants to take, any actions FICC considers appropriate to facilitate the continuation of FICC's services.

Currently, FICC's Board of Directors may declare a Market Disruption Event and may take any actions authorized by FICC's Rules to address the event. However, FICC's Rules also authorize certain officers to make an interim declaration of a Market Disruption Event, to allow FICC to prevent delays in addressing a Market Disruption Event if the Board of Directors is unable to convene. In the event of such an interim declaration, the Board of Directors must ratify, modify, or rescind the officer's determination as soon as practicable. Currently, the officers authorized to make such determination are the Chief Executive Officer, Chief Financial Officer, Group Chief Risk Officer, and General Counsel.

FICC proposes to add two additional officers of FICC, the Chief Information Officer and the Head of Clearing Agency Services, to the list of authorized officers that could make such an interim determination if the Board of Directors is unable to convene. FICC states these two officers, like the other officers currently provided in the Rules, maintain senior executive level positions at FICC, oversee divisions of FICC, and hold positions at FICC that would provide them a necessary global view into FICC's operations and systems to enable them to determine the existence of a Market Disruption Event. FICC states adding these two additional officers would facilitate FICC's ability to implement its emergency procedures in the event of a Market Disruption Event.

3. Systems Disconnect Rule

As mentioned above in Section II.A (Background), FICC's participants connect to FICC's systems, either through the DTCC-managed SMART network or through other electronic means, such as through a third party service provider or service bureau. FICC's Rules do not address FICC's ability to disconnect participant whose network connection risks harming FICC's systems. FICC's proposal will establish procedures under which FICC would be able to disconnect a participant from its network due to the risk of an imminent threat to FICC, participants, or other market participants.

FICC's proposal will address FICC's authority to take certain actions upon the occurrence, and during the pendency, of a Major Event. A “Major Event” will be defined as the happening of one or more “Systems Disruptions” reasonably likely to have a significant impact on FICC's operations, including “DTCC Systems,” that affect the business, operations, safeguarding of securities or funds, or physical functions of FICC, its participants, or other market participants. “Systems Disruption” will, in turn, be defined as the unavailability, failure, malfunction, overload, or restriction (whether partial or total) of a DTCC Systems Participant's systems that disrupts or degrades the normal operation of such DTCC Systems Participant's systems; or anything that impacts or alters the normal communication or the files that are received, or information transmitted, to or from the DTCC Systems.

FICC's proposal would also provide governance procedures applicable to FICC's determination whether, and how, to implement the provisions of the Systems Disconnect rule. The same officers with delegated authority under the Force Majeure Rule may make a determination that a Major Event has occurred. As discussed in Section II.B.2 (Market Disruption Event) above, FICC states these officers maintain senior executive level positions at FICC, oversee divisions of FICC, and hold positions at FICC that would provide them a necessary global view into FICC's operations and systems to enable them to determine the existence of a Market Disruption Event, which would also enable them to determine the existence of a Major Event.

However, the proposed process for declaring a Major Event, by contrast, would start with a designated officer, whereas, for a Market Disruption Event, the officer would make an interim determination only if the Board of Directors were unable to timely convene. FICC states it designed the process in this way to improve its ability to respond quickly, efficiently, and effectively to a Major Event that arises abruptly. Following this determination, any management committee including all of the officers authorized to determine a Major Event would convene, and FICC would convene a Board of Directors meeting as soon as practicable thereafter, and in any event within five Business Days following such determination, to ratify, modify, or rescind the Officer Major Event Action.

In addition, the proposed rule will require participants to notify FICC immediately upon becoming aware of a Major Event, and, likewise, will require FICC to notify its participants promptly of any action FICC takes or intends to take with respect to a Major Event. Finally, the proposal will address certain miscellaneous related matters including: (i) A limitation of liability for any failure or delay in performance, in whole or in part of FICC's obligations under the Rules, arising out of or related to a Major Event, (ii) a statement that FICC's power to take any action pursuant to the Systems Disconnect Rule also includes the power to repeal, rescind, revoke, amend or vary such action, (iii) a statement that FICC's powers pursuant to the Systems Disconnect Rule shall be in addition to, and not in derogation of, authority granted elsewhere in the Rules to take action as specified therein, (iv) a requirement that participants shall keep any confidential information provided to them by FICC in connection with a Major Event confidential, and (v) a statement that in the event of any conflict between the provisions of the Systems Disconnect Rule and any other Rules or Procedures, the provisions of the Systems Disconnect Rule would prevail.

III. Discussion and Commission Findings

Section 19(b)(2)(C) of the Act directs the Commission to approve a proposed rule change of a self-regulatory organization if it finds that such proposed rule change is consistent with the requirements of the Act and the rules and regulations thereunder applicable to such organization. After careful consideration, the Commission finds that the Proposed Rule Change is consistent with the requirements of the Act and the rules and regulations applicable to FICC. In particular, the Commission finds that the Proposed Rule Change is consistent with Section 17A(b)(3)(F) of the Act and Rules 17Ad-22(e)(1), (e)(2), and (e)(17)(i) thereunder.

A. Consistency With Section 17A(b)(3)(F) of the Act

Section 17A(b)(3)(F) of the Exchange Act requires, in part, that the rules of a clearing agency, such as FICC, be designed, in part, to promote the prompt and accurate clearance and settlement of securities transactions and to assure the safeguarding of securities and funds which are in the custody or control of the clearing agency or for which it is responsible. The Commission finds that the Proposed Rule Change is consistent with Section 17A(b)(3)(F) of the Act for the reasons discussed below.

As described above in Section II.B.1 (Confidentiality Requirements), FICC proposes to revise its Rules to establish a standard relating to FICC's obligation to maintain the confidentiality of information it collects from participants to assess each participant's compliance with FICC's membership requirements. The Commission believes such a uniform standard will help FICC meet its obligations and will help each participant better understand FICC's obligations for maintaining the confidential information it shares with FICC, which, in turn, may facilitate the sharing of such information and improve FICC's ability to evaluate its participants' eligibility to access FICC's clearance and settlement services.

Also, as described above in Section II.B.1 (Confidentiality Requirements), FICC proposes to add participant confidentiality requirements to its Rules to ensure participants maintain the confidentiality of information FICC shares, which participants may then use to determine whether to participate in FICC's clearance and settlement services by understanding FICC system requirements and FICC system safeguards. The Commission believes participant confidentiality requirements will help each participant better understand its rights and obligations for maintaining the confidential information FICC shares, which, in turn, may facilitate participant compliance. Therefore, the Commission believes the proposed changes to FICC and participant confidentiality requirements are consistent with promoting the prompt and accurate clearance and settlement of securities transactions by FICC.

As described above in Section II.B.2 (Market Disruption Event) and Section II.B.3 (Systems Disconnect Rule), risks, threats, and potential vulnerabilities due to a Market Disruption Event or a Major Event could impede FICC's ability to provide its clearance and settlement services. FICC proposes to add two officers authorized to make an interim determination that a Market Disruption Event has occurred if the Board of Directors is unable to timely convene. The Commission believes the proposed change will improve FICC's ability to respond quickly to a Market Disruption Event, which could help FICC mitigate the impact of such event on FICC, its participants, and the broader market.

Additionally, as described above in Section II.B.3 (Systems Disconnect Rule), FICC proposes to add the Systems Disconnect Rule, which will set forth the procedures under which FICC would be authorized, upon the occurrence of a Major Event (as defined in the proposed rules), to take certain actions, including disconnecting a participant from FICC's systems, suspending data transmissions between FICC and the participant, and requiring the participant to take other actions necessary to protect FICC and its participants. The Commission believes the proposed Systems Disconnect Rule will enable FICC to respond quickly to a potential cyber threat or other network disruption, which could help FICC prevent the spread of a participant's systems disruptions to FICC, its participants, and other market participants that could otherwise cause losses to FICC or its participants.

One commenter suggests certain revisions to the definition of Major Event so that certain terms in the Systems Disconnect Rule are consistent with the definition of Market Disruption Event in the Force Majeure Rule. The Commission disagrees. Consistency between the Systems Disconnect Rule and the Force Majeure Rule is not necessary because FICC designed the Systems Disconnect Rule for a different purpose. Although both rules relate to events that, if left unaddressed, could affect FICC's ability to provide clearance and settlement services, the Force Majeure Rule is designed to cover events caused by external forces that impact FICC and its participants, whereas the Systems Disconnect Rule is designed only to cover disruptions to a participant's computer systems or network that could flow through to FICC systems. Therefore, differences between the two rules do not raise consistency concerns, because of their different purposes.

Therefore, for the reasons described above, the Commission believes the proposed changes relating to a Market Disruption Event or a Major Event will help promote the prompt and accurate clearance and settlement of securities transactions and with assuring FICC safeguards securities and funds that are in its custody or control or for which it is responsible. Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Section 17A(b)(3)(F) of the Act.

B. Consistency With Rule 17Ad-22(e)(1)

Rule 17Ad-22(e)(1) under the Exchange Act requires that a covered clearing agency establish, implement, maintain and enforce written policies and procedures reasonably designed to provide for a well-founded, clear, transparent and enforceable legal basis for each aspect of its activities in all relevant jurisdictions. The Commission finds that the Proposed Rule Change is consistent with Rule 17Ad-22(e)(1) of the Exchange Act for the reasons discussed below.

As described above in Sections II.B.1 (Confidentiality Requirements) and II.B.2 (Market Disruption Event), FICC proposes to establish a consistent standard for its obligation to maintain the confidentiality of information it collects from its participants and to establish participant confidentiality requirements. The Commission believes a consistent standard for FICC's confidentiality requirements will provide for clear and transparent standard rules for participants, rather than maintaining potentially different confidentiality standards for participants based on the various, unrelated regulatory bodies governing those participants. Additionally, the Commission believes that imposing specific legal standards applicable to both FICC and its participants to follow will provide for a well-founded legal basis for the sharing and maintaining of confidential information between FICC and its participants.

Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Rule 17Ad-22(e)(1) of the Exchange Act.

C. Consistency With Rule 17Ad-22(e)(2)

Rule 17Ad-22(e)(2) under the Exchange Act requires, in part, that a covered clearing agency establish, implement, maintain and enforce written policies and procedures reasonably designed to provide for governance arrangements that are clear and transparent and that specify clear and direct lines of responsibility. The Commission finds that the Proposed Rule Change is consistent with Rule 17Ad-22(e)(2) of the Exchange Act for the reasons discussed below.

The Commission believes FICC's proposal, as described above in Section II.B.2 (Market Disruption Event), to add two officers authorized to make an interim determination of a Market Disruption Event if the Board of Directors is unable to convene in a timely manner provides for governance arrangements that are clear and transparent and that provide clear and direct lines of responsibility. Likewise, the Commission believes FICC's proposal to identify the officers authorized to make an interim determination of a Major Event, which will then be ratified, modified, or rescinded by the management committee and the Board of Directors will provide for clear and transparent governance procedures and will specify clear and direct lines of responsibility. Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Rule 17Ad-22(e)(2) of the Exchange Act.

D. Consistency With Rule 17Ad-22(e)(17)(i)

Rule 17Ad-22(e)(17)(i) under the Exchange Act requires that a covered clearing agency establish, implement, maintain and enforce written policies and procedures reasonably designed to manage the covered clearing agency's operational risks by identifying the plausible sources of operational risk, both internal and external, and mitigating their impact through the use of appropriate systems, policies, procedures, and controls. The Commission finds that the Proposed Rule Change is consistent with Rule 17Ad-22(e)(17)(i) of the Exchange Act for the reasons discussed below.

The Commission believes FICC's proposal, as described above in Section II.B.2 (Market Disruption Event), to add two officers authorized to make an interim determination of a Market Disruption Event could help FICC mitigate the impact of a Market Disruption Event by ensuring FICC can respond quickly to such event if the Board of Directors were unable to convene in a timely manner. Likewise, the Commission believes the proposed Systems Disconnect Rule, as described in Section II.B.3 above, provides a rules-based process that will enable FICC to identify potential cyber threats or other network disruptions, which could help FICC prevent the spread of a participant's systems disruptions to FICC, its participants, and other market participants that could otherwise cause losses to FICC or its participants.

One commenter suggests revising the definition of Major Event to be consistent with the definition of Market Disruption Event in the Force Majeure Rule. The commenter further argues the impact to FICC covered by the definition of Major Event should be limited to “DTCC Systems” (as defined in the proposed rule) to ensure the scope of the proposed rule is limited to technical systems. The Commission disagrees. As noted above, the purposes of both the Force Majeure Rule and the Systems Disconnect Rule are different. The Force Majeure Rule is designed to cover events external to FICC and its participants that materially impact, or are likely to materially impact, FICC's ability to provide its clearance and settlement services. The Systems Disconnect Rule, by contrast, is designed to cover a participant's systems or network disruption, which through its connection to FICC, is reasonably likely to have a significant impact on FICC's systems. The differences between the rules' purposes support the need for differing standards. Furthermore, the Commission notes the reference to “including DTCC Systems” in the proposed definition of Major Event takes into account how FICC's operations, i.e., its clearance and settlement services, work, in that they utilize DTCC Systems. Consequently, the commenter's proposed revisions are not necessary.

Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Rule 17Ad-22(e)(17)(i) of the Exchange Act.

IV. Conclusion

On the basis of the foregoing, the Commission finds that the Proposed Rule Change is consistent with the requirements of the Act and in particular with the requirements of Section 17A of the Act and the rules and regulations promulgated thereunder.

It is therefore ordered, pursuant to Section 19(b)(2) of the Act that Proposed Rule Change SR-FICC-2021-004, be, and hereby is, approved.