Notice2022-15004
Self-Regulatory Organizations; Fixed Income Clearing Corporation; Order Approving a Proposed Rule Change To Require Applicants and Members To Maintain or Upgrade Their Network or Communications Technology
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
July 14, 2022
Issuing agencies
Securities and Exchange Commission
Full Text
<html>
<head>
<title>Federal Register, Volume 87 Issue 134 (Thursday, July 14, 2022)</title>
</head>
<body><pre>
[Federal Register Volume 87, Number 134 (Thursday, July 14, 2022)]
[Notices]
[Pages 42218-42221]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2022-15004]
=======================================================================
-----------------------------------------------------------------------
SECURITIES AND EXCHANGE COMMISSION
[Release No. 34-95233; File No. SR-FICC-2022-003]
Self-Regulatory Organizations; Fixed Income Clearing Corporation;
Order Approving a Proposed Rule Change To Require Applicants and
Members To Maintain or Upgrade Their Network or Communications
Technology
July 8, 2022.
I. Introduction
On May 20, 2022, Fixed Income Clearing Corporation (``FICC'') filed
with the Securities and Exchange Commission (``Commission'') proposed
rule change SR-FICC-2022-003 (``Proposed Rule Change'') pursuant to
Section 19(b)(1) of the Securities Exchange Act of 1934 (``Act'') \1\
and Rule 19b-4 thereunder.\2\ The Proposed Rule Change was published
for comment in the Federal Register on May 31, 2022.\3\ The Commission
did not receive any comment letters on the proposed rule change. For
the reasons discussed below, the Commission is approving the Proposed
Rule Change.
---------------------------------------------------------------------------
\1\ 15 U.S.C. 78s(b)(1).
\2\ 17 CFR 240.19b-4.
\3\ Securities Exchange Act Release No. 94972 (May 24, 2022), 87
FR 32489 (May 31, 2022) (SR-FICC-2022-003) (``Notice of Filing'').
---------------------------------------------------------------------------
II. Description of the Proposed Rule Change
A. Background
FICC proposes to modify its Government Securities Division Rulebook
(``GSD Rules''), Mortgage-Backed Securities Division Clearing Rules
(``MBSD Rules''), and Electronic Pool Notification Rules of MBSD (``EPN
Rules,'' and, together with the GSD Rules and the MBSD Rules, the
[[Page 42219]]
``Rules'') \4\ to require its Members and applicants for membership
(collectively, ``members'') to upgrade and maintain their network
technology, and communications technology or protocols, to meet
standards that FICC would identify and publish via Important Notice on
its website, as described more fully below.
---------------------------------------------------------------------------
\4\ FICC's Rules are available at https://www.dtcc.com/~/media/
Files/Downloads/legal/rules/ficc_gov_rules.pdf; https://
www.dtcc.com/~/media/Files/Downloads/legal/rules/
ficc_mbsd_rules.pdf; https://www.dtcc.com/~/media/Files/Downloads/
legal/rules/ficc_mbsd_epnrules.pdf.
---------------------------------------------------------------------------
FICC is made up of two divisions, the Government Securities
Division (FICC/GSD) and the Mortgage Backed Securities Division (FICC/
MBSD), each providing clearing services in a different portion of the
fixed income market.\5\ FICC/GSD provides clearing, settlement, risk
management, central counterparty services, and a guarantee of trade
completion for U.S. government and agency securities.\6\ FICC/MBSD
provides clearing, netting, settlement, risk management, and pool
notification services to major market participants trading in pass-
through MBS issued by the Ginnie Mae, Freddie Mac, and Fannie Mae.\7\
In light of its critical role in the marketplace, FICC was designated a
Systemically Important Financial Market Utility (``SIFMU'') under Title
VIII of the Dodd-Frank Wall Street Reform and Consumer Protection Act
of 2010.\8\ Due to FICC's unique position in the marketplace, a failure
or a disruption at FICC could, among other things, increase the risk of
significant liquidity problems spreading among financial institutions
or markets, and thereby threaten the stability of the financial system
in the United States.\9\
---------------------------------------------------------------------------
\5\ See Financial Stability Oversight Counsel 2012 Annual
Report, Appendix A (``FSOC 2012 Report''), available at <a href="http://www.treasury.gov/initiatives/fsoc/Documents/2012-20Annual-20Report.pdf">http://www.treasury.gov/initiatives/fsoc/Documents/2012-20Annual-20Report.pdf</a>.
\6\ Id.
\7\ Id.
\8\ 12 U.S.C. 5465(e)(1). See FSOC 2012 Report, supra note 5.
\9\ See FSOC 2012 Report, Appendix A, supra note 5.
---------------------------------------------------------------------------
FICC's Rules currently do not require, either as part of an
application for membership or as an ongoing membership requirement, any
level or version for network technology, such as a web browser or other
technology, or any level or version of communications technology or
protocols, such as email encryption, secure messaging, or file
transfers, that members may use to connect to or communicate with
FICC.\10\ Therefore, FICC currently maintains multiple network and
communications methods and protocols to interact with its members.\11\
This includes some outdated communication technologies in order to
support members that continue to use such older technologies.\12\ FICC
believes that continuing to use such outdated technologies could render
communications between FICC and some of its members vulnerable to cyber
risks.\13\ Additionally, members' use of outdated technology delays
FICC's implementation of its own internal system upgrades, which by
doing so, risks losing connectivity between FICC and a number of its
members.\14\ Finally, FICC states that it currently expends additional
resources, both in personnel and equipment, to maintain outdated
communications channels.\15\
---------------------------------------------------------------------------
\10\ Notice of Filing, supra note 3, at 32490.
\11\ Id.
\12\ Id.
\13\ Id.
\14\ Id.
\15\ Id.
---------------------------------------------------------------------------
To mitigate the foregoing security concerns and resource
inefficiencies, FICC proposes to require its members to upgrade and
maintain network technology, communication technology, and protocol
standards, in accordance with applicable technology standards that FICC
would identify and publish via Important Notice on its website from
time to time.\16\ FICC would base these requirements on standards set
forth by widely accepted organizations such as the National Institute
of Standards and Technology (``NIST'') and the internet Engineer Task
Force (``IETF'').\17\
---------------------------------------------------------------------------
\16\ Id., at 32490-91.
\17\ Id. NIST is part of the U.S. Department of Commerce. The
IETF is an open standards organization that develops and promotes
voluntary internet standards, in particular, the technical standards
that comprise the internet protocol suite (TCP/IP). For example,
NIST Special Publication 800-52 revision 2, specifies servers that
support government-only applications shall be configured to use
Transport Layer Security (``TLS'') 1.2 and should be configured to
use TLS 1.3 as well. See <a href="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf">https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf</a>. (TLS, the successor of the
now-deprecated Secure Sockets Layer (``SSL''), is a cryptographic
protocol designed to provide communications security over a computer
network.) These servers should not be configured to use TLS 1.1 and
shall not use TLS 1.0, SSL 3.0, or SSL 2.0. Additionally, the IETF
formally deprecated TLS versions 1.0 and 1.1 in March of 2021,
stating that ``[t]hese versions lack support for current and
recommended cryptographic algorithms and mechanisms, and various
government and industry profiles of applications using TLS now
mandate avoiding these old TLS versions. . . . Removing support for
older versions from implementations reduces the attack surface,
reduces opportunity for misconfiguration, and streamlines library
and product maintenance.'' See <a href="https://datatracker.ietf.org/doc/rfc8996/">https://datatracker.ietf.org/doc/rfc8996/</a>. FICC would also require members to discontinue using File
Transfer Protocol (``FTP''), which FICC believes to be an insecure
protocol because it transfers user authentication data (username and
password) and file data as plain-text (not encrypted) over the
network. Notice of Filing, supra note 3, at 32490-91.
---------------------------------------------------------------------------
To implement the proposed changes, FICC would revise its Rules to
require members to maintain or upgrade their network technology,
communications technology, or protocols on the systems that connect to
FICC, to the version FICC requires, within the time period FICC
requires.\18\ Consistent with the guidance from NIST and other
standards organizations, FICC would require the use of TLS 1.2, Secure
FTP (``SFTP''), and other modern technology and communication standards
and protocols, by its members for communication with FICC.\19\ FICC
would publish such requirements via Important Notice on its
website.\20\ FICC also proposes to amend its Rules to provide that
failure to perform a necessary technology upgrade within the required
timeframe would subject members to a monetary fine.\21\
---------------------------------------------------------------------------
\18\ Notice of Filing, supra note 3, at 32490-91.
\19\ Id.
\20\ Id.
\21\ Notice of Filing, supra note 3, at 32490-91.
---------------------------------------------------------------------------
III. Discussion and Commission Findings
Section 19(b)(2)(C) of the Act \22\ directs the Commission to
approve a proposed rule change of a self-regulatory organization if it
finds that such proposed rule change is consistent with the
requirements of the Act and the rules and regulations thereunder
applicable to such organization. After careful consideration, the
Commission finds that the Proposed Rule Change is consistent with the
requirements of the Act and the rules and regulations applicable to
FICC. In particular, the Commission finds that the Proposed Rule Change
is consistent with Sections 17A(b)(3)(F) \23\ and (b)(3)(G) \24\ of the
Act and Rules 17Ad-22(e)(17) \25\ and (e)(21) \26\ thereunder.
---------------------------------------------------------------------------
\22\ 15 U.S.C. 78s(b)(2)(C).
\23\ 15 U.S.C. 78q-1(b)(3)(F).
\24\ 15 U.S.C. 78q-1(b)(3)(G).
\25\ 17 CFR 240.17Ad-22(e)(17)(i) and (ii).
\26\ 17 CFR 240.17Ad-22(e)(21)(iv).
---------------------------------------------------------------------------
A. Consistency With Section 17A(b)(3)(F) of the Act
Section 17A(b)(3)(F) of the Act requires that the rules of a
clearing agency be designed to, among other things, promote the prompt
and accurate clearance and settlement of securities transactions and
assure the safeguarding of securities and funds which are in the
custody or control of the clearing agency or for which it is
responsible.\27\
---------------------------------------------------------------------------
\27\ 15 U.S.C. 78q-1(b)(3)(F).
---------------------------------------------------------------------------
As described above, FICC proposes to require its members to upgrade
and maintain network technology, and
[[Page 42220]]
communication technology and protocol standards, that meet the
standards identified by FICC and published via Important Notice to
FICC's website from time to time. FICC would use standards set forth by
widely accepted organizations such as NIST and the IETF as the
requirements. The proposed requirements would enable FICC to avoid
communicating with its members using outdated technologies that present
security vulnerabilities to FICC. Specifically, as an initial matter,
the proposed requirements would enable FICC to discontinue using
communication technologies such as TLS 1.0, TLS 1.1, SSL 2.0, SSL 3.0,
and FTP, which have been deemed not secure by organizations such as
NIST and/or the IETF. Removing support for such outdated technologies
would reduce FICC's potential exposure to cyberattacks and other cyber
vulnerabilities.
If not adequately addressed, the risk of cyberattacks and other
cyber vulnerabilities could affect FICC's network and, in turn, FICC's
ability to clear and settle securities transactions, or to safeguard
the securities and funds which are in FICC's custody or control, or for
which it is responsible. FICC designed the proposed requirements for
members to upgrade their communications technology to address those
risks, as described above. Accordingly, the Commission finds the
proposed technology requirements on FICC's members would promote the
prompt and accurate clearance and settlement of securities transactions
and assure the safeguarding of securities and funds which are in the
custody or control of FICC or for which it is responsible, consistent
with the requirements of Section 17A(b)(3)(F) of the Act.\28\
---------------------------------------------------------------------------
\28\ Id.
---------------------------------------------------------------------------
B. Consistency With Section 17A(b)(3)(G) of the Act
Section 17A(b)(3)(G) of the Act requires the rules of a clearing
agency to provide that its participants shall be appropriately
disciplined for violation of any provision of the rules of the clearing
agency by fine or other fitting sanction.\29\ As noted above, FICC
proposes to require its members to upgrade and maintain network
technology, communication technology, and protocol standards, in
accordance with applicable technology standards that FICC would
identify and publish via Important Notice on its website. The proposed
requirements would enable FICC to avoid communicating with its members
using outdated technologies that present security vulnerabilities to
FICC. If not adequately addressed, such vulnerabilities could affect
FICC's network and its ability to operate. FICC also proposes to amend
its Rules to provide that failure to perform a necessary technology
upgrade within the required timeframe would subject members to a
monetary fine. Because the proposed monetary fine should incentivize
FICC's members to upgrade and maintain secure communications
technology, thereby reducing FICC's operational risks, the Commission
finds the proposed rule change is consistent with the requirements of
Section 17A(b)(3)(G) of the Act.\30\
---------------------------------------------------------------------------
\29\ 15 U.S.C. 78q-1(b)(3)(G).
\30\ Id. Additionally, by including the monetary fine provision
in its Rules, FICC would enable its members to better identify and
evaluate the material costs they might incur by participating in
FICC, consistent with Rule 17Ad-22(e)(23)(ii). under the Act, which
requires a covered clearing agency to establish, implement,
maintain, and enforce written policies and procedures reasonably
designed to provide sufficient information to enable participants to
identify and evaluate the risks, fees, and other material costs they
incur by participating in the covered clearing agency. See 17 CFR
240.17Ad-22(e)(23)(ii).
---------------------------------------------------------------------------
C. Consistency With Rule 17Ad-22(e)(17) Under the Act
Rule 17Ad-22(e)(17)(i) under the Act requires that each covered
clearing agency establish, implement, maintain and enforce written
policies and procedures reasonably designed to manage the covered
clearing agency's operational risks by identifying the plausible
sources of operational risk, both internal and external, and mitigating
their impact through the use of appropriate systems, policies,
procedures, and controls.\31\ FICC's operational risks include cyber
risks to its electronic systems.
---------------------------------------------------------------------------
\31\ 17 CFR 240.17Ad-22(e)(17)(i).
---------------------------------------------------------------------------
As described above, FICC and its members connect electronically to
communicate with one another. However, FICC's Rules currently do not
require any level or version for network technology, such as a web
browser or other technology, or any level or version of communications
technology or protocols, such as email encryption, secure messaging, or
file transfers, that members may use to connect to or communicate with
FICC. As a result, FICC maintains some outdated communication
technologies in order to support members that continue to use such
older technologies. Continuing to use such outdated technologies could
render communications between FICC and some of its members vulnerable
to cyber risks.
To mitigate the foregoing cyber risks, FICC proposes to require its
members to upgrade and maintain network technology, and communication
technology and protocol standards that meet the standards identified by
FICC from time to time. The proposed technology requirements should
reduce FICC's cyber risk by requiring members to upgrade and maintain
communications technology based on standards set forth by widely
accepted organizations such as NIST and the IETF, thereby decreasing
the operational risks presented to FICC. Because the proposed
technology requirements would help FICC mitigate plausible sources of
external operational risk, the Commission finds the proposed changes
are consistent with the requirements of Rule 17Ad-22(e)(17)(i) under
the Act.\32\
---------------------------------------------------------------------------
\32\ Id.
---------------------------------------------------------------------------
Rule 17Ad-22(e)(17)(ii) under the Act requires that each covered
clearing agency establish, implement, maintain and enforce written
policies and procedures reasonably designed to manage the covered
clearing agency's operational risks by ensuring, in part, that systems
have a high degree of security, resiliency, and operational
reliability.\33\ As noted above, FICC's operational risks include cyber
risks.
---------------------------------------------------------------------------
\33\ 17 CFR 240.17Ad-22(e)(17)(ii).
---------------------------------------------------------------------------
As described above, FICC's Rules currently do not require any level
or version for network technology, such as a web browser or other
technology, or any level or version of communications technology or
protocols, such as email encryption, secure messaging, or file
transfers, that members may use to connect to or communicate with FICC.
FICC designed the proposed technology requirements to reduce cyber
risks by requiring its members to upgrade and maintain communications
technology based on standards set forth by widely accepted
organizations such as NIST and the IETF. Requiring FICC's members to
use only secure communications technology would reduce FICC's cyber
risks and thereby strengthen the security, resiliency, and operational
reliability of FICC's network and other systems. Because the proposed
technology requirements would enhance FICC's ability to ensure that its
systems have a high degree of security, resiliency, and operational
reliability, the Commission finds the Proposed Rule Change is
consistent with the requirements of Rule 17Ad-22(e)(17)(ii) under the
Act.\34\
---------------------------------------------------------------------------
\34\ Id.
---------------------------------------------------------------------------
[[Page 42221]]
D. Consistency With Rule 17Ad-22(e)(21) Under the Act
Rule 17Ad-22(e)(21)(iv) under the Act requires that each covered
clearing agency establish, implement, maintain and enforce written
policies and procedures reasonably designed to have the covered
clearing agency's management regularly review the efficiency and
effectiveness of its use of technology and communication
procedures.\35\
---------------------------------------------------------------------------
\35\ 17 CFR 240.17Ad-22(e)(21)(iv).
---------------------------------------------------------------------------
As mentioned above, FICC maintains multiple network and
communication methods to interact with its members, including certain
outdated communication technologies necessary to support members that
continue to use such older technologies. FICC believes that continuing
to use such outdated technologies could render communications between
FICC and some of its members vulnerable to cyber risks. Additionally,
members' use of outdated technology delays FICC's implementation of its
own internal system upgrades, which by doing so, risks losing
connectivity between FICC and a number of its members. Finally, FICC
states that it currently expends unnecessary resources to maintain
outdated communications channels. In other words, FICC has subjected
its network communication methods to review for efficiency and
effectiveness. As a result, to enhance the efficiency and effectiveness
of its technology and communication procedures, FICC proposes to
require its members to upgrade and maintain network technology,
communication technology, and protocol standards, in accordance with
applicable technology standards that FICC would identify and publish
via Important Notice on its website. Because the Proposed Rule Change
is an outgrowth of FICC's review of the efficiency and effectiveness of
its technology and communication procedures, the Commission finds the
Proposed Rule Change is consistent with the requirements of Rule 17Ad-
22(e)(21)(iv) under the Act.\36\
---------------------------------------------------------------------------
\36\ Id.
---------------------------------------------------------------------------
IV. Conclusion
On the basis of the foregoing, the Commission finds that the
Proposed Rule Change is consistent with the requirements of the Act and
in particular with the requirements of Section 17A of the Act \37\ and
the rules and regulations promulgated thereunder.
---------------------------------------------------------------------------
\37\ 15 U.S.C. 78q-1.
---------------------------------------------------------------------------
It is therefore ordered, pursuant to Section 19(b)(2) of the Act
\38\ that Proposed Rule Change SR-FICC-2022-003, be, and hereby is,
approved.\39\
---------------------------------------------------------------------------
\38\ 15 U.S.C. 78s(b)(2).
\39\ In approving the Proposed Rule Change, the Commission
considered the proposals' impact on efficiency, competition, and
capital formation. 15 U.S.C. 78c(f).
For the Commission, by the Division of Trading and Markets,
pursuant to delegated authority.\40\
---------------------------------------------------------------------------
\40\ 17 CFR 200.30-3(a)(12).
---------------------------------------------------------------------------
J. Matthew DeLesDernier,
Assistant Secretary.
[FR Doc. 2022-15004 Filed 7-13-22; 8:45 am]
BILLING CODE 8011-01-P
</pre></body>
</html>Indexed from Federal Register on July 14, 2022.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.