What happened
On October 8, 2026, OCC filed proposed Rule 213 changes with the SEC. On October 20, 2026, the SEC dated Release No. 34-106703 for File No. SR-OCC-2026-010. On October 23, 2026, the proposal was published in the Federal Register for public comment. The notice is SEC Release No. 34-106703 and File No. SR-OCC-2026-010. The proposal is not an effective final rule.
The proposal would define a Major Clearing Member System Event and permit OCC to disconnect a clearing member or connected third-party service provider. It would strengthen cyber-event notification, clarify OCC’s authority to assess whether an event affects its systems and allow OCC to inform, or require a member to inform, an affected third-party provider. The proposal would let OCC determine impact rather than relying on the member’s assessment.
The proposal would add reporting, testing, approval and governance requirements for reconnection, including possible audit evidence from a Third-Party Cybersecurity Firm. No incident, victim or threat actor is alleged in the proposal. Attribution posture: No threat actor attribution applies because this is a proposed resilience and governance rule, not an incident determination. The cited source did not publish the actor-attribution detail described as Incident or actor evidence.
Why this matters now
The proposal shifts cyber-event authority towards the clearing house. A member’s internal conclusion about impact would not control OCC’s assessment, and OCC could disconnect a member or its connected provider when it determines a major system event threatens its systems. Financial institutions therefore need escalation paths that work before facts are complete.
Reconnection would become an assurance exercise rather than a purely technical restoration. The proposal contemplates reporting, testing, approval and governance requirements, including possible audit evidence from an independent cybersecurity firm. Existing incident playbooks may not produce that package quickly enough, particularly when the affected environment is operated by a third party.
The rule is proposed, not final, so immediate technology change is premature. The actionable Monday decision is to expose gaps in authority, contracts, isolation design and evidence production while legal and policy teams evaluate whether comments or implementation preparations are required.
The decision for security leaders
Commission a joint security, operations, legal and vendor-risk gap analysis. The review should identify who can notify OCC, who can authorise disconnection and what evidence is available before internal impact or materiality analysis concludes.
Test whether contracts with connected service providers permit rapid log access, containment, independent assessment and delivery of audit evidence. A provider’s standard incident report may not satisfy a clearing-house reconnection decision.
Model the business consequences of OCC-directed isolation. Recovery plans should address trading, settlement, customer communication and manual alternatives, with explicit authority for accepting operational risk during a cyber event.
Evidence of closure
- A signed gap analysis maps proposed Rule 213 requirements to accountable owners and existing controls.
- Provider contracts confirm forensic access, audit cooperation and isolation support.
- A tabletop produces an approved disconnection, notification and reconnection decision record.
- Recovery evidence identifies tested operational alternatives for an OCC-directed isolation.
The Security.io assessment
The proposal is significant because it treats interconnected cyber risk as a system-level resilience concern. OCC would gain clearer authority to act on its own assessment rather than waiting for a member to conclude that an event threatens clearing infrastructure.
No immediate compliance obligation arises from a proposed rule. Organisations should avoid presenting the requirements as final or assigning implementation deadlines that the cited documents do not establish. The correct near-term response is readiness analysis and participation in the regulatory process where appropriate.
The likely control gap is not detection technology. It is the ability to isolate a connection, obtain evidence from third parties and demonstrate that conditions for safe reconnection have been met. Institutions that pre-negotiate those rights and exercise the decision process are better positioned if the rule is approved.
Questions for the morning meeting
- Can the organisation isolate its OCC connection without creating uncontrolled trading or settlement consequences?
- Do third-party contracts provide rapid forensic access and audit evidence acceptable to OCC?
- Who has authority to notify OCC before internal materiality or impact analysis is complete?