Options Clearing Corporation Revises Its Cybersecurity Rulebook
Published Date: 10/23/2026
Notice
Summary
The Options Clearing Corporation (OCC) is updating its cybersecurity rules to better protect its systems and members. These changes let OCC act faster during big tech problems, require members to report issues more clearly, and give OCC more control over handling cyber incidents. This helps keep the whole system safer and stronger, with new rules rolling out soon and no extra costs for members.
Analyzed Economic Effects
5 provisions identified: 0 benefits, 5 costs, 0 mixed.
OCC Can Disconnect or Suspend Access
OCC may determine that a Clearing Member System Event qualifies as a "Major Clearing Member System Event" and, after declaration by two or more Designated Officers, may take actions including disconnecting or suspending transmissions/communications/access, forcing password resets, or requiring alternative transfer methods. OCC will promptly notify the Clearing Member of any disconnect or other material action, and the Clearing Member must continue to meet its obligations to OCC and cooperate fully.
Two‑Hour Cyber Incident Reporting Duty
If your firm is an OCC Clearing Member and it experiences a systems-related cyber incident connected to OCC, you must notify OCC in writing no later than two hours after you become aware (or should have become aware) of the incident. The notice must include, if known, legal entity names, contact persons with titles and primary email/phone (and backups if those are affected), and detailed event information (event type, effect, start/end/discovery dates, scope, and any public notices).
Reconnection Tests and External Audit Reports
If OCC takes action under the rule, your firm must submit a Reconnection Attestation and complete a Reconnection Checklist before OCC will reestablish connectivity. OCC may require an audit/report from a Third‑Party Cybersecurity Firm that meets OCC's definition (well‑known, experienced in financial‑sector cybersecurity, employs "Best Practices").
Biennial Cybersecurity Attestation by Senior Executive
Each Clearing Member must submit a Cybersecurity Confirmation attestation at least every two years and not later than 180 calendar days from the date OCC notifies the member that the attestation is required. The attestation must be signed by a senior executive authorized to attest to these matters.
OCC May Inform Third‑Party Providers
OCC has authority to inform, or require the Clearing Member to inform, the Clearing Member's Third‑Party Service Provider of a Clearing Member System Event if OCC determines doing so is necessary to protect OCC and other Clearing Members.
Personalized for You
How does this regulation affect your finances?
Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Key Dates
Department and Agencies
Related Federal Register Documents
2026-21037, Investment Company Cross Trading
The SEC wants to update the rules for cross trading, which is when investment companies trade securities with their affiliates. They’re making more types of securities eligible, tightening rules to protect investors, and requiring better reporting of these trades. If you’re involved in investment companies, watch out for these changes and get your comments in by December 14, 2026!
2026-20466, Adviser and Regulated Fund Custody Rules; Crypto Custody Rules
The SEC is updating rules for how investment advisers and funds handle crypto assets, making sure they keep these digital investments safe and properly reported. These changes affect advisers, funds, and anyone managing crypto securities, aiming to modernize rules and improve transparency. Comments on the proposal are open until December 7, 2026, so get ready to weigh in!
2026-19260, Rescission of Rule 14a-8's Federal Regulation of Shareholder Proposals and Amendments to Rule 14a-4
The SEC wants to stop its federal rule that controls how shareholders can make proposals at company meetings, letting state laws and company rules take over instead. They’re also changing rules so companies can sometimes vote on proposals not in their official materials—but shareholders can opt out if they want. This affects investors and companies, with comments open until November 20, 2026, and could shake up how shareholder voices are heard and counted.
2026-18424, Political Contributions by Certain Investment Advisers
The Securities and Exchange Commission (the "Commission" or the "SEC") is proposing to rescind the political contribution rule under the Investment Advisers Act of 1940 (the "Advisers Act"), which prohibits investment advisers from providing investment advisory services for compensation to a government client for two years after an adviser or any covered associate of the adviser makes a contribution to certain categories of elected officials or candidates, among other prohibitions. In the more than fifteen years since the rule was adopted, implementation challenges associated with the political contribution rule have resulted in a range of significant unintended consequences, including compliance practices among some investment advisers that may have had the effect of restricting all political contributions by the investment advisers and their employees. Market participants also have stated that the political contribution rule is burdensome, complex, and both lacks clarity and creates a de facto strict liability standard. The Commission is of the view that other existing requirements of the Advisers Act and its associated rules, including prohibitions on fraud, fiduciary duty requirements, the compliance rule, and the code of ethics rule (defined below), are likely sufficient to address pay-to-play practices while allowing an adviser the flexibility to implement an approach that is more appropriately tailored to its particular risks, rendering the political contribution rule unnecessary. The Commission also is proposing to amend the rule under the Advisers Act pertaining to books and records consistent with the proposed rescission.
2026-18190, Transfer Agent Rules
The U.S. Securities and Exchange Commission ("SEC" or "Commission") is proposing to adopt new rules, amend existing rules, amend the existing form for registration with the Commission as a transfer agent (Form TA-1) and the existing form for reporting activities of transfer agents (Form TA-2), and rescind an existing rule governing registered transfer agents. The proposals are designed to modernize the rules governing registered transfer agents.
2026-17183, Regulation Crypto Assets
The Securities and Exchange Commission ("Commission") is proposing new rules to create a tailored offering regime for certain investment contracts involving crypto assets. The proposed offering regime is intended to facilitate capital formation and accommodate innovation within the crypto asset markets while, at the same time, ensuring that investors are adequately protected and provided with the information they need to make informed investment decisions. The proposed rules would be set forth in a new regulation titled "Regulation Crypto Assets" and would include two exemptions from the registration requirements of section 5 of the Securities Act of 1933. The first exemption would permit offerings of up to $5 million during a four-year period. The second exemption would permit offerings of up to $75 million during each 12-month period. Under both exemptions, issuers would be required to make certain principles-based narrative disclosures available to their investors. In addition, issuers under the second exemption would be required to provide financial statements and would be subject to ongoing reporting requirements. Issuers that rely on these exemptions would remain subject to the antifraud and antimanipulation provisions of the Federal securities laws. The proposed rules also would include a conditional safe harbor from the term "investment contract" in the definitions of "security" in the Securities Act of 1933 and the Securities Exchange Act of 1934. If the conditions of that proposed safe harbor are satisfied, then a crypto asset would be deemed not to be subject to an investment contract for purposes of those definitions of "security."
Previous / Next Documents
Previous: 2026-21647, Agency Information Collection Activities; Renewal of a New Information Collection Request: Request for Revocation of Authority Granted
The Federal Motor Carrier Safety Administration (FMCSA) is renewing a form that lets motor carriers, freight forwarders, and property brokers voluntarily cancel their operating authority. This renewal keeps the process simple and quick, taking about 15 minutes per request, with no new fees or big changes. If you’re in the transportation business, you have until November 23, 2026, to share your thoughts on this renewal.
Next: 2026-21650, Self-Regulatory Organizations; New York Stock Exchange LLC; Notice of Filing of Proposed Rule Change To Amend Rule 7.10 (Clearly Erroneous Executions)
The New York Stock Exchange is updating its rule about fixing big trading mistakes to make it clearer and fairer. These changes affect traders by explaining how price limits work during different trading hours and improving how multi-stock errors are handled. The new rule also adds better coordination with other markets and removes outdated parts, aiming for smoother, quicker fixes without extra costs.