OCC proposes expanded cybersecurity rules for clearing members

On October 8, 2026, the Options Clearing Corporation (OCC) filed a proposed amendment to its Rule 213 - Cybersecurity Obligations - with the Securities and Exchange Commission under File No. SR-OCC-2026-010. The notice, published in the Federal Register on October 20, 2026 (FR Doc No. 2026-21649), solicits comments on the changes, which would become binding on all OCC clearing members once the comment period closes.

The amendment introduces a "Major Clearing Member System Event" concept, authorizing OCC to disconnect a clearing member or its third-party service provider from OCC systems when necessary. It also revises the definition of a "Security Incident" to a "Clearing Member System Event" and requires clearing members to notify OCC within a specified timeframe, providing detailed information about the event. The proposal removes language that previously allowed members to assess the impact of an event on OCC systems and clarifies OCC's authority to evaluate and act on such incidents.

Additional provisions require a senior executive of each clearing member to sign a Cybersecurity Confirmation, mandate that OCC may require an audit report from a third-party cybersecurity firm before reconnection, and give OCC the authority to inform, or require the member to inform, the member's third-party service provider of the event. The rule also adds a defined-terms section expanding the scope of OCC's "Systems" to include communication channels such as FTP connections.

The OCC, designated a systemically important financial market utility in 2012, previously amended Rule 213 in November 2023 to establish notification and reconnection requirements. The current proposal builds on those changes, aligning OCC's cybersecurity obligations with recent amendments adopted by peer self-regulatory organizations. Comments must be submitted by the deadline indicated in the notice, after which the Commission will consider the proposed rule change.