The SEC's $10 Million ICE Settlement: Four Days Under Regulation SCI
Updated October 2026. First published June 2024.
On May 22, 2024, Intercontinental Exchange (ICE) agreed to pay a $10 million penalty to settle SEC charges that it caused nine of its subsidiaries, including the New York Stock Exchange, to miss a notice deadline under Regulation Systems Compliance and Integrity (Regulation SCI). The subject was a 2021 intrusion into one of ICE's VPN devices. ICE and the subsidiaries neither admitted nor denied the findings.
The SEC's order didn't dispute ICE's conclusion that the intrusion was de minimis, and it describes no harm to anyone. The case turns on the four days between the moment ICE knew and the moment the people responsible for telling the SEC found out. This post replaces our earlier posts on the case, two of which got the facts wrong: the intrusion had nothing to do with EDGAR, and it happened in 2021, not 2018.
What Happened, Day by Day
The SEC's order lays out the timeline.
| Date | What happened |
|---|---|
| Thursday, April 15, 2021 | A third party tells ICE that two ICE IP addresses are associated with a VPN device that may have been compromised by a known threat actor. ICE's security team logs it as Severity 5, the lowest rating. |
| Friday, April 16 | ICE confirms malicious webshell code on one of its VPN concentrators, a device the order treats as an indirect SCI system for every subsidiary. The team raises the incident to Severity 3, takes the device offline, and hires an outside forensic firm. Senior executives and board members are briefed as the work continues. |
| Tuesday, April 20 | After finding that the attacker took VPN configuration data and some user metadata, the team raises the incident to Severity 2. Legal and compliance staff at the nine subsidiaries hear about it for the first time. The same day, they decide it is de minimis and log it for the quarterly report. |
| Thursday, April 22 | SEC staff, reviewing reports of the same vulnerability, contact ICE on their own to ask whether it was affected. |
What Regulation SCI Required
Under Rule 1002(b), an SCI entity must notify the SEC immediately once its responsible personnel have a reasonable basis to conclude that an SCI event has occurred, and must follow with a written notice within 24 hours. A systems intrusion, defined in Rule 1000 as "any unauthorized entry into the SCI systems or indirect SCI systems," is one kind of SCI event. The one way out is Rule 1002(b)(5): an event the entity reasonably estimates had no or a de minimis impact goes into a quarterly report instead.
The order's point is about timing. That de minimis judgment has to be made when the entity concludes the event happened. ICE had a reasonable basis on April 16. The people who owned the reporting decision weren't in the room until April 20.
Why the Escalation Failed
ICE had a written plan, and the plan contradicted itself. Its cyber incident response plan said "any systems intrusion events are to be considered as potential immediately reportable SCI events," and that subsidiary compliance staff should be told as quickly as possible. But the email alerts that actually reached subsidiary legal and compliance staff went out only at Severity 2 or higher. A medium-severity intrusion went to the CISO, the security team, and ICE's Global Security Council, which included senior management and ICE's legal and privacy teams. It didn't go to the subsidiaries' compliance officers, who held the reporting obligation.
So the alert routing followed severity, while the rule followed the type of event. That mismatch is the part of this case that applies to firms nowhere near Regulation SCI.
The Dissent
Commissioners Hester Peirce and Mark Uyeda objected in a joint statement, "Forget about Collaborating—Stop, Pay-Up, and Listen," calling the penalty disproportionate for a late report of an intrusion the order itself didn't dispute was de minimis. The SEC's enforcement director at the time, Gurbir Grewal, took the opposite view in the press release: "every second counts and four days can be an eternity."
Both points can be true. The penalty was large for the harm, and the reporting design was still broken. The SEC's leadership changed in 2025. Commissioner Uyeda served as acting chair early in the year, and Paul Atkins became chair later that year, so the dissent may say more about how today's Commission weighs a case like this than the order does. The design problem doesn't depend on who is chair.
Who Regulation SCI Covers, and What Covers Everyone Else
Regulation SCI applies to SCI entities: exchanges and other SCI self-regulatory organizations, alternative trading systems above the rule's volume thresholds, plan processors, certain exempt clearing agencies, and SCI competing consolidators. One of the nine ICE subsidiaries, Archipelago Trading Services, is a broker-dealer. It was covered because it operates Global OTC, an ATS subject to Regulation SCI. Most broker-dealers aren't covered. The SEC proposed in 2023 to bring certain broker-dealers in, and it withdrew that proposal on June 12, 2025, along with its proposed cybersecurity rule for broker-dealers.
What does cover every broker-dealer is the amended Regulation S-P. It requires an incident response program, notice to affected customers no later than 30 days after you become aware of unauthorized access to sensitive customer information, and procedures that make service providers tell you within 72 hours of a breach in their systems. Larger firms had to comply by December 3, 2025, and smaller firms by June 3, 2026. Those are clocks, and an escalation path built like ICE's would miss them in the same way. Our post on settlement instruction fraud under T+1 covers the Regulation S-P changes in more detail.
What to Check in Your Own Plan
- Find every regulatory clock your incident plan has to meet: Regulation S-P customer notice, state breach laws, Regulation SCI if it applies, and your contracts with counterparties.
- Tie each clock to a type of event, such as unauthorized access to a system that holds customer information. A severity score can shape the response, but it shouldn't decide who gets told.
- Name the compliance person who gets told about every confirmed intrusion, whatever its rating, and say so in writing.
- Record the time someone first had a reasonable basis to conclude the event happened. Every deadline counts from there.
- Run a tabletop exercise where the intrusion looks minor on day one. That's the case that slips.