Self-Regulatory Organizations; National Securities Clearing Corporation; Order Approving the Proposed Rule Change Relating to Confidential Information, Market Disruption Events, and Other Changes

I. Introduction

On June 25, 2021, National Securities Clearing Corporation (“NSCC”) filed with the Securities and Exchange Commission (“Commission”) proposed rule change SR-NSCC-2021-007 (the “Proposed Rule Change”) pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 (“Act”) and Rule 19b-4 thereunder to amend NSCC's rules relating to confidentiality requirements, Market Disruption Events, and procedures for disconnecting a participant from NSCC's network, among other changes. The Proposed Rule Change was published for comment in the Federal Register on July 13, 2021. The Commission received comments that it has considered with respect to the Proposed Rule Change. For the reasons discussed below, the Commission is approving the Proposed Rule Change.

II. Description of the Proposed Rule Change

Pursuant to the Proposed Rule Change, NSCC is proposing three main changes to its Rules & Procedures (“Rules”): (1) Standardizing the confidentiality requirement applicable to NSCC with respect to its participants' information and adding confidentiality requirement applicable to participants with respect to NSCC's information, (2) updating its Market Disruption and Force Majeure Rule (“Force Majeure Rule”) to authorize two additional officers to determine that a Market Disruption Event has occurred, and (3) adding a new rule setting forth the procedures under which NSCC would be able to disconnect a participant from its network in certain circumstances (“Systems Disconnect Rule”). The Commission provides relevant background and describes each of these proposed changes in greater detail below.

A. Background

NSCC provides clearance, settlement, risk management, central counterparty services, and a guarantee of completion for virtually all broker-to-broker trades involving equity securities, corporate and municipal debt securities, American depository receipts, exchange traded funds, and unit investment trusts. In light of NSCC's critical role in the marketplace, NSCC was designated a Systemically Important Financial Market Utility (“SIFMU”) under Title VIII of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010. Due to NSCC's unique position in the marketplace, a failure or a disruption to NSCC could, among other things, significantly disrupt settlement of securities transactions cleared by NSCC and increase the risk of substantial liquidity problems spreading among financial institutions or markets, and thereby threaten the stability of the financial system in the United States.

NSCC participants connect to NSCC's systems, either directly through the Securely Managed and Reliable Technology (“SMART”) network or through a third party service provider or service bureau. NSCC's parent company, The Depository Trust & Clearing Corporation (“DTCC”) manages the SMART network, which connects a nationwide complex of networks, processing centers, and control facilities.

B. Proposed Changes

1. Confidentiality Requirements

Confidentiality Requirements Applicable to NSCC: NSCC collects confidential information from its participants to assess whether each participant meets NSCC's membership requirements either to gain or continue access to NSCC's clearance and settlement services. In turn, NSCC is required to maintain the confidentiality of any information furnished by its participants. Currently, NSCC's Rules obligate NSCC to hold participants' information in the same degree of confidence as may be required by law or the rules and regulations (hereinafter collectively, “regulations”) of the appropriate regulatory body having jurisdiction over the participant.

NSCC states that its current Rules create ambiguity because NSCC's obligations depend on each participant's regulatory requirements, which could lead to unequal treatment of participants and conflicts of law with NSCC's regulatory requirements or with respect to a participant who is subject to multiple jurisdictions' regulations. NSCC also states that applying different standards creates operational burdens because NSCC must track the regulations applicable to each of its participants and must maintain the confidentiality of each participant's information to the same degree as required by the applicable regulations.

In order to clarify its confidentiality requirements and to enhance its operational efficiency, NSCC proposes to revise its Rules to establish a standard, which will require NSCC to hold participant confidential information to the same degree as NSCC's regulatory requirements that relate to the confidentiality of records, and to remove the references to each participant's particular regulatory obligations. NSCC represents that the proposed change would provide participants with similar protections because NSCC believes its regulatory requirements are comparable to the regulations applicable to its participants and, therefore, would not result in changes to NSCC's current practices or the protection offered to its participants' confidential information.

Confidentiality Requirements Applicable to Participants: NSCC's Rules do not include obligations for its participants to protect confidential information furnished by NSCC or its affiliates. However, NSCC states that, in connection with the development of cyber and information security programs pursuant to applicable participant regulatory requirements, NSCC and DTCC have received an increasing number of requests from participants for confidential information, such as information regarding DTCC's network operations, data security practices, and legal settlements. Additionally, NSCC states that participants may request NSCC or DTCC to disclose confidential information regarding its cyber threat indicators, sources of cyber threat information, or other information and actions taken following a cyber incident relating to a participant, NSCC, or DTCC.

To facilitate information sharing by NSCC while protecting the confidentiality of proprietary and confidential information NSCC shares with its participants, NSCC proposes to add participant confidentiality requirements to its Rules. The new provisions will require participants to maintain the confidentiality of information furnished by NSCC through proper safeguards to prevent disclosure of such confidential information, except as necessary to perform its obligations under NSCC's Rules or as otherwise required by applicable law. NSCC proposes that participants be required to maintain the confidentiality of this information to the same extent and using the same means the participant uses to protect its own confidential information, but no less than a reasonable standard of care. NSCC's proposal will also entitle NSCC or DTCC to seek any temporary or permanent injunctive or other equitable relief in addition to any monetary damages under the Rules if a participant breaches its confidentiality requirements. Additionally, NSCC's proposal will entitle NSCC to impose other disciplinary proceedings or restrictions on access to services for a participant's failure to comply with its confidentiality requirements, consistent with the existing tools available to NSCC regarding a participant's failure to comply with its Rules.

2. Market Disruption Event

NSCC's Rules contain provisions that identify the events or circumstances that NSCC would consider to be a Market Disruption Event, including, for example, events that lead to the suspension or limitation of trading or banking in the markets in which NSCC operates, or the unavailability or failure of any material payment, bank transfer, wire or securities settlement systems. Upon the declaration of a Market Disruption Event, NSCC's Rules provide NSCC with tools to address such an event, such as suspending any or all services and taking, or requiring participants to take, any actions NSCC considers appropriate to facilitate the continuation of NSCC's services.

Currently, NSCC's Board of Directors may declare a Market Disruption Event and may take any actions authorized by NSCC's Rules to address the event. However, NSCC's Rules also authorize certain officers to make an interim declaration of a Market Disruption Event, to allow NSCC to prevent delays in addressing a Market Disruption Event if the Board of Directors is unable to convene. In the event of such an interim declaration, the Board of Directors must ratify, modify, or rescind the officer's determination as soon as practicable. Currently, the officers authorized to make such determination are the Chief Executive Officer, Chief Financial Officer, Group Chief Risk Officer, and General Counsel.

NSCC proposes to add two additional officers of NSCC, the Chief Information Officer and the Head of Clearing Agency Services, to the list of authorized officers that could make such an interim determination if the Board of Directors is unable to convene. NSCC states these two officers, like the other officers currently provided in the Rules, maintain senior executive level positions at NSCC, oversee divisions of NSCC, and hold positions at NSCC that would provide them a necessary global view into NSCC's operations and systems to enable them to determine the existence of a Market Disruption Event. NSCC states adding these two additional officers would facilitate NSCC's ability to implement its emergency procedures in the event of a Market Disruption Event.

3. Systems Disconnect Rule

As mentioned above in Section II.A (Background), NSCC's participants connect to NSCC's systems, either through the DTCC-managed SMART network or through other electronic means, such as through a third party service provider or service bureau. NSCC's Rules do not address NSCC's ability to disconnect a participant whose network connection risks harming NSCC's systems. NSCC's proposal will establish procedures under which NSCC would be able to disconnect a participant from its network due to the risk of an imminent threat to NSCC, participants, or other market participants.

NSCC's proposal will address NSCC's authority to take certain actions upon the occurrence, and during the pendency, of a Major Event. A “Major Event” will be defined as the happening of one or more “Systems Disruptions” reasonably likely to have a significant impact on NSCC's operations, including “DTCC Systems,” that affect the business, operations, safeguarding of securities or funds, or physical functions of NSCC, its participants, or other market participants. “Systems Disruption” will, in turn, be defined as the unavailability, failure, malfunction, overload, or restriction (whether partial or total) of a DTCC Systems Participant's systems that disrupts or degrades the normal operation of such DTCC Systems Participant's systems; or anything that impacts or alters the normal communication or the files that are received, or information transmitted, to or from the DTCC Systems.

NSCC's proposal would also provide governance procedures applicable to NSCC's determination whether, and how, to implement the provisions of the Systems Disconnect Rule. The same officers with delegated authority under the Force Majeure Rule may make a determination that a Major Event has occurred. As discussed in Section II.B.2 (Market Disruption Event) above, NSCC states these officers maintain senior executive level positions at NSCC, oversee divisions of NSCC, and hold positions at NSCC that would provide them a necessary global view into NSCC's operations and systems to enable them to determine the existence of a Market Disruption Event, which would also enable them to determine the existence of a Major Event.

However, the proposed process for declaring a Major Event, by contrast, would start with a designated officer, whereas, for a Market Disruption Event, the officer would make an interim determination only if the Board of Directors were unable to timely convene. NSCC states it designed the process in this way to improve its ability to respond quickly, efficiently, and effectively to a Major Event that arises abruptly. Following this determination, any management committee including all of the officers authorized to determine a Major Event would convene, and NSCC would convene a Board of Directors meeting as soon as practicable thereafter, and in any event within five Business Days following such determination, to ratify, modify, or rescind the Officer Major Event Action.

In addition, the proposed rule will require participants to notify NSCC immediately upon becoming aware of a Major Event, and, likewise, will require NSCC to notify its participants promptly of any action NSCC takes or intends to take with respect to a Major Event. Finally, the proposal will address certain miscellaneous related matters including: (i) A limitation of liability for any failure or delay in performance, in whole or in part of NSCC's obligations under the Rules, arising out of or related to a Major Event, (ii) a statement that NSCC's power to take any action pursuant to the Systems Disconnect Rule also includes the power to repeal, rescind, revoke, amend or vary such action, (iii) a statement that NSCC's powers pursuant to the Systems Disconnect Rule shall be in addition to, and not in derogation of, authority granted elsewhere in the Rules to take action as specified therein, (iv) a requirement that participants shall keep any confidential information provided to them by NSCC in connection with a Major Event confidential, and (v) a statement that in the event of any conflict between the provisions of the Systems Disconnect Rule and any other Rules or Procedures, the provisions of the Systems Disconnect Rule would prevail.

III. Discussion and Commission Findings

Section 19(b)(2)(C) of the Act directs the Commission to approve a proposed rule change of a self-regulatory organization if it finds that such proposed rule change is consistent with the requirements of the Act and the rules and regulations thereunder applicable to such organization. After careful consideration, the Commission finds that the Proposed Rule Change is consistent with the requirements of the Act and the rules and regulations applicable to NSCC. In particular, the Commission finds that the Proposed Rule Change is consistent with Section 17A(b)(3)(F) of the Act and Rules 17Ad-22(e)(1), (e)(2), and (e)(17)(i) thereunder.

A. Consistency With Section 17A(b)(3)(F) of the Act

Section 17A(b)(3)(F) of the Exchange Act requires, in part, that the rules of a clearing agency, such as NSCC, be designed, in part, to promote the prompt and accurate clearance and settlement of securities transactions and to assure the safeguarding of securities and funds which are in the custody or control of the clearing agency or for which it is responsible. The Commission finds that the Proposed Rule Change is consistent with Section 17A(b)(3)(F) of the Act for the reasons discussed below.

As described above in Section II.B.1 (Confidentiality Requirements), NSCC proposes to revise its Rules to establish a standard relating to NSCC's obligation to maintain the confidentiality of information it collects from participants to assess each participant's compliance with NSCC's membership requirements. The Commission believes such a uniform standard will help NSCC meet its obligations and will help each participant better understand NSCC's obligations for maintaining the confidential information it shares with NSCC, which, in turn, may facilitate the sharing of such information and improve NSCC's ability to evaluate its participants' eligibility to access NSCC's clearance and settlement services.

Also, as described above in Section II.B.1 (Confidentiality Requirements), NSCC proposes to add participant confidentiality requirements to its Rules to ensure participants maintain the confidentiality of information NSCC shares, which participants may then use to determine whether to participate in NSCC's clearance and settlement services by understanding NSCC system requirements and NSCC system safeguards. The Commission believes participant confidentiality requirements will help each participant better understand its rights and obligations for maintaining the confidential information NSCC shares, which, in turn, may facilitate participant compliance. Therefore, the Commission believes the proposed changes to NSCC and participant confidentiality requirements are consistent with promoting the prompt and accurate clearance and settlement of securities transactions by NSCC.

As described above in Section II.B.2 (Market Disruption Event) and Section II.B.3 (Systems Disconnect Rule), risks, threats, and potential vulnerabilities due to a Market Disruption Event or a Major Event could impede NSCC's ability to provide its clearance and settlement services. NSCC proposes to add two officers authorized to make an interim determination that a Market Disruption Event has occurred if the Board of Directors is unable to timely convene. The Commission believes the proposed change will improve NSCC's ability to respond quickly to a Market Disruption Event, which could help NSCC mitigate the impact of such event on NSCC, its participants, and the broader market.

Additionally, as described above in Section II.B.3 (Systems Disconnect Rule), NSCC proposes to add the Systems Disconnect Rule, which will set forth the procedures under which NSCC would be authorized, upon the occurrence of a Major Event (as defined in the proposed rules), to take certain actions, including disconnecting a participant from NSCC's systems, suspending data transmissions between NSCC and the participant, and requiring the participant to take other actions necessary to protect NSCC and its participants. The Commission believes the proposed Systems Disconnect Rule will enable NSCC to respond quickly to a potential cyber threat or other network disruption, which could help NSCC prevent the spread of a participant's systems disruptions to NSCC, its participants, and other market participants that could otherwise cause losses to NSCC or its participants.

One commenter suggests certain revisions to the definition of Major Event so that certain terms in the Systems Disconnect Rule are consistent with the definition of Market Disruption Event in the Force Majeure Rule. The Commission disagrees. Consistency between the Systems Disconnect Rule and Force Majeure Rule is not necessary because NSCC designed the Systems Disconnect Rule for a different purpose. Although both rules relate to events that, if left unaddressed, could affect NSCC's ability to provide clearance and settlement services, the Force Majeure Rule is designed to cover events caused by external forces that impact NSCC and its participants, whereas the Systems Disconnect Rule is designed only to cover disruptions to participant's computer systems or network that could flow through to NSCC systems. Therefore, differences between the two rules do not raise consistency concerns, because of their different purposes.

Therefore, for the reasons described above, the Commission believes the proposed changes relating to a Market Disruption Event or a Major Event will help promote the prompt and accurate clearance and settlement of securities transactions and with assuring NSCC safeguards securities and funds that are in its custody or control or for which it is responsible. Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Section 17A(b)(3)(F) of the Act.

B. Consistency With Rule 17Ad-22(e)(1)

Rule 17Ad-22(e)(1) under the Exchange Act requires that a covered clearing agency establish, implement, maintain and enforce written policies and procedures reasonably designed to provide for a well-founded, clear, transparent and enforceable legal basis for each aspect of its activities in all relevant jurisdictions. The Commission finds that the Proposed Rule Change is consistent with Rule 17Ad-22(e)(1) of the Exchange Act for the reasons discussed below.

As described above in Sections II.B.1 (Confidentiality Requirements) and II.B.2 (Market Disruption Event), NSCC proposes to establish a consistent standard for its obligation to maintain the confidentiality of information it collects from its participants and to establish participant confidentiality requirements. The Commission believes a consistent standard for NSCC's confidentiality requirements will provide for clear and transparent standard rules for participants, rather than maintaining potentially different confidentiality standards for participants based on the various, unrelated regulatory bodies governing those participants. Additionally, the Commission believes that imposing specific legal standards applicable to both NSCC and its participants to follow will provide for a well-founded legal basis for the sharing and maintaining of confidential information between NSCC and its participants.

Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Rule 17Ad-22(e)(1) of the Exchange Act.

C. Consistency With Rule 17Ad-22(e)(2)

Rule 17Ad-22(e)(2) under the Exchange Act requires, in part, that a covered clearing agency establish, implement, maintain and enforce written policies and procedures reasonably designed to provide for governance arrangements that are clear and transparent and that specify clear and direct lines of responsibility. The Commission finds that the Proposed Rule Change is consistent with Rule 17Ad-22(e)(2) of the Exchange Act for the reasons discussed below.

The Commission believes NSCC's proposal, as described above in Section II.B.2 (Market Disruption Event), to add two officers authorized to make an interim determination of a Market Disruption Event if the Board of Directors is unable to convene in a timely manner provides for governance arrangements that are clear and transparent and that provide clear and direct lines of responsibility. Likewise, the Commission believes NSCC's proposal to identify the officers authorized to make an interim determination of a Major Event, which will then be ratified, modified, or rescinded by the management committee and the Board of Directors will provide for clear and transparent governance procedures and will specify clear and direct lines of responsibility. Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Rule 17Ad-22(e)(2) of the Exchange Act.

D. Consistency With Rule 17Ad-22(e)(17)(i)

Rule 17Ad-22(e)(17)(i) under the Exchange Act requires that a covered clearing agency establish, implement, maintain and enforce written policies and procedures reasonably designed to manage the covered clearing agency's operational risks by identifying the plausible sources of operational risk, both internal and external, and mitigating their impact through the use of appropriate systems, policies, procedures, and controls. The Commission finds that the Proposed Rule Change is consistent with Rule 17Ad-22(e)(17)(i) of the Exchange Act for the reasons discussed below.

The Commission believes NSCC's proposal, as described above in Section II.B.2 (Market Disruption Event), to add two officers authorized to make an interim determination of a Market Disruption Event could help NSCC mitigate the impact of a Market Disruption Event by ensuring NSCC can respond quickly to such event if the Board of Directors were unable to convene in a timely manner. Likewise, the Commission believes the proposed Systems Disconnect Rule, as described in Section II.B.3 above, provides a rules-based process that will enable NSCC to identify potential cyber threats or other network disruptions, which could help NSCC prevent the spread of a participant's systems disruptions to NSCC, its participants, and other market participants that could otherwise cause losses to NSCC or its participants.

One commenter suggests revising the definition of Major Event to be consistent with the definition of Market Disruption Event in the Force Majeure Rule. The commenter further argues the impact to NSCC covered by the definition of Major Event should be limited to “DTCC Systems” (as defined in the proposed rule) to ensure the scope of the proposed rule is limited to technical systems. The Commission disagrees. As noted above, the purposes of both the Force Majeure Rule and the Systems Disconnect Rule are different. The Force Majeure Rule is designed to cover events external to NSCC and its participants that materially impact, or are likely to materially impact, NSCC's ability to provide its clearance and settlement services. The Systems Disconnect Rule, by contrast, is designed to cover a participant's systems or network disruption, which through its connection to NSCC, is reasonably likely to have a significant impact on NSCC's systems. The differences between the rules' purposes support the need for differing standards. Furthermore, the Commission notes the reference to “including DTCC Systems” in the proposed definition of Major Event takes into account how NSCC's operations, i.e., its clearance and settlement services, work, in that they utilize DTCC Systems. Consequently, the commenter's proposed revisions are not necessary.

Accordingly, the Commission finds that the implementation of the Proposed Rule Change is consistent with Rule 17Ad-22(e)(17)(i) of the Exchange Act.

IV. Conclusion

On the basis of the foregoing, the Commission finds that the Proposed Rule Change is consistent with the requirements of the Act and in particular with the requirements of Section 17A of the Act and the rules and regulations promulgated thereunder.

It is therefore ordered, pursuant to Section 19(b)(2) of the Act that Proposed Rule Change SR-NSCC-2021-007, be, and hereby is, approved .