2025 SUPPORTING STATEMENT Rule 15c3-5

SUPPORTING STATEMENT
for the Paperwork Reduction Act Information Collection Submission for
Rule 15c3-5: Risk Management Controls for Brokers or Dealers
with Market Access
OMB Control No. 3235-0673
A.

JUSTIFICATION
1.

Information Collection Necessity

Rule 15c3-5 under the Securities Exchange Act of 1934 (“Exchange Act”) requires
brokers or dealers with access to trading directly on an exchange or alternative trading system
(“ATS”), including those providing sponsored or direct market access to customers or other
persons, to implement risk management controls and supervisory procedures reasonably
designed to manage the financial, regulatory, and other risks of this business activity.
The rule requires brokers or dealers to establish, document, and maintain certain risk
management controls and supervisory procedures as well as regularly review such controls and
procedures, and document the review, and remediate issues discovered to assure overall
effectiveness of such controls and procedures. Each such broker or dealer is required to preserve
a copy of its supervisory procedures and a written description of its risk management controls as
part of its books and records in a manner consistent with Rule 17a-4(e)(7) under the Exchange
Act. 1 Such regular review is required to be conducted in accordance with written procedures and
is required to be documented. The broker or dealer is required to preserve a copy of such written
procedures, and documentation of each such review, as part of its books and records in a manner
consistent with Rule 17a-4(e)(7) under the Exchange Act, and Rule 17a-4(b) under the Exchange
Act, respectively. 2
In addition, the Chief Executive Officer (or equivalent officer) is required to certify
annually that the broker or dealer’s risk management controls and supervisory procedures
comply with the rule, and that the broker-dealer conducted such review. Such certifications are
required to be preserved by the broker or dealer as part of its books and records in a manner
consistent with Rule 17a-4(b) under the Exchange Act.

1

See 17 CFR 240.17a-4(e)(7). Pursuant to Rule 17a-4(e)(7), every broker or dealer subject to Rule 17a-3 is
required to maintain and preserve in an easily accessible place each compliance, supervisory, and
procedures manual, including any updates, modifications, and revisions to the manual, describing the
policies and practices of the broker or dealer with respect to compliance with applicable laws and rules, and
supervision of the activities of each natural person associated with the broker or dealer until three years
after the termination of the use of the manual.

2

See 17 CFR 240.17a-4(b). Pursuant to Rule 17a-4(b), every broker or dealer subject to Rule 17a-3 is
required to preserve for a period of not less than three years, the first two years in an easily accessible
place, certain records of the broker or dealer.

2.

Information Collection Purpose and Use

The rule seeks to ensure that broker-dealers, which under the current regulatory structure
are the only entities that may be members of exchanges or provide access to trading in securities
on an ATS to non-broker-dealers, and, as a practical matter, constitute the majority of
subscribers to ATSs, appropriately control the risks associated with market access, so as not to
jeopardize their own financial condition, that of other market participants, the integrity of trading
on the securities markets, and the stability of the financial system.
3.

Consideration Given to Information Technology

Rule 15c3-5 requires a broker or dealer to apply the financial and regulatory controls on
an automated, pre-trade basis before orders route to an exchange or ATS. The Commission
believes that improvements in telecommunications and data processing technology may reduce
any burdens associated with Rule 15c3-5.
4.

Duplication

No duplication is apparent.
5.

Effect on Small Entities

A broker-dealer is a small business if its total capital (net worth plus subordinated
liabilities) on the last day of its most recent fiscal year was $500,000 or less, and is not affiliated
with any entity that is not a “small business.” 3 Currently, most small brokers or dealers, when
accessing an exchange or ATS in the ordinary course of their business, should already have risk
management controls and supervisory procedures in place. In many cases, the rule may be
substantially satisfied by a small broker-dealer’s existing financial and regulatory risk
management controls and current supervisory procedures. Further, staff discussions with various
industry participants indicated that very few, if any, small broker-dealers with market access
provide other persons with “unfiltered” access. 4 Therefore, these brokers or dealers will likely
only require limited updates to their systems to meet the requisite risk management controls and
other requirements in the rule. The rule may impact small brokers or dealers that utilize risk
management technology provided by a vendor or some other third party; however, the
requirement to directly monitor the operation of the financial and regulatory risk management
controls should not impose a significant cost or burden because the Commission understands that
such technology allows the broker or dealer to exclusively manage such controls. 5

3

17 CFR 240.0-10(c).

4

“Unfiltered” access is generally understood to be a subset of sponsored access where pre-trade filters or
controls are not applied to orders before such orders are submitted to an exchange or ATS. The rule
effectively prohibits any access to trading on an exchange or ATS, whether sponsored or otherwise, where
pre-trade controls are not applied.

5

The Commission’s understanding is based on discussions with various industry participants.

2

6.

Consequences of Not Conducting Collection

The broker-dealer, as the member of the exchange or subscriber of the ATS, is
responsible for all trading that occurs under its market participant identifier (“MPID”) or other
market identifier. 6 If this information were not collected frequently, the Commission believes
that the broker-dealer would jeopardize not only its own financial viability, but also the stability
of the markets and, potentially, the financial system. The Commission believes that this
responsibility is too great to allow the requisite risk management controls to be monitored less
frequently.
7.

Inconsistencies with Guidelines in 5 CFR 1320.5(d)(2)

There are no special circumstances. This collection is consistent with the guidelines in 5
CFR 1320.5(d)(2).
8.

Consultations Outside the Agency

The required Federal Register notice with a 60-day comment period soliciting comments
on this collection of information was published. No public comments were received.
9.

Payment or Gift

Not applicable.
10.

Confidentiality

The information collection under Rule 15c3-5 is not confidential.
11.

Sensitive Questions

No information of a sensitive information will be required under this collection of
information. The information collection only requires the name, occupation, and job title of the
individual completing the form. The agency has determined that neither a PIA nor a SORN are
required in connection with the collection of information.
12.

Information Collection Burden

The “collection of information” contained in Rule 15c3-5 applies to approximately 500
brokers and dealers that have market access or provide a customer or any other person with
market access. Of these 500 brokers and dealers, the Commission estimates that there are 300
brokers or dealers that are members of an exchange. This estimate is based on broker-dealer
responses to FOCUS report filings with the Commission. The Commission estimates that the
remaining 200 broker-dealers are not exchange members but are broker-dealer operators of ATSs
that provide access to trading in securities to non-broker-dealers or are subscribers to ATSs.
6

See, e.g., NYSE IM-89-6 (January 25, 1989); and Securities Exchange Act Release No. 40354 (August 24,
1998), 63 FR 46264 (August 31, 1998) (NASD NTM- 98-66).

3

This estimate is based on a previous sampling of subscriber information contained in Exhibit A
to Form ATS-R filed with the Commission.
a.

Technology

To comply with Rule 15c3-5, a respondent must maintain its risk management system by
monitoring its effectiveness and updating its systems to address any issues detected. In addition,
a respondent is required to preserve a copy of its written description of its risk management
controls as part of its books and records in a manner consistent with Rule 17a-4(e)(7) under the
Exchange Act. The Commission estimates that the ongoing annualized burden for a potential
respondent to maintain its risk management system will be approximately 115 burden hours. 7
The Commission estimates the related internal compliance cost for this hour burden per
respondent at approximately $39,767 per year. 8 The Commission believes the ongoing burden
of complying with the rule’s collection of information will include, among other things, updating
systems to address any issues detected, updating risk management controls to reflect any change
in its business model, and documenting and preserving a broker-dealer’s written description of
its risk management controls. 9
b.

Legal and Compliance

Based on discussions with various industry participants and the Commission’s prior
experience with broker-dealers, the Commission estimates that a broker-dealer’s legal and
compliance burden of complying with Rule 15c3-5 will require approximately 45 hours per year.
7

Based on discussions with industry participants, the Commission estimates that a dedicated team of 1.5
people would be used for the ongoing maintenance of all technology systems. The team may include one
or more programmer analysts, senior programmers, or senior systems analysts. In-house system staff size
varies depending on, among other things, the business model of the broker or dealer. Each staff member
would work 160 hours per month, or 12 months × 160 hours = 1,920 hours per year. A team of 1.5 people
therefore would work 1,920 hours × 1.5 people = 2,880 hours per year. Based on discussions with industry
participants, the Commission estimates that 4% of the team’s total work time would be used for ongoing
risk management maintenance. Accordingly, the total number of burden hours for this task, per year, is
0.04 × 2,880 hours = 115.2 hours (approximately 115 hours).

8

The Commission estimates that the programmer analyst would work 40% of the total hours required for
ongoing maintenance, or 115 hours × 0.40 = 46 hours; the senior programmer would work 20% of the total
hours, or 115 hours × 0.20 = 23 hours; and the senior systems analyst would work 40% of the total hours,
or 115 hours × 0.40 = 46 hours. The total ongoing maintenance cost for staff is estimated to be 46 hours ×
$301 (hourly wage for a programmer analyst) ($13,846) + 23 hours × $415 (hourly wage for a senior
programmer) ($9,545) + 46 hours × $356 (hourly wage for a senior systems analyst) ($16,376) = $39,767.
The $301, $415, and $356 per hour estimates for a programmer analyst, senior programmer, and senior
systems analyst, respectively is from SIFMA’s Office Salaries in the Securities Industry 2013, modified by
Commission staff to account for an 1,800-hour work-year and inflation to March 2025, and multiplied by
5.35 to account for bonuses, firm size, employee benefits and overhead.

9

For the purposes of calculating the PRA burden, it is assumed that all broker-dealers under the rule will
perform their technology development and maintenance in-house. However, a portion of these brokerdealers may decide to forego internal technology development and instead opt to outsource it to a thirdparty technology provider or service bureau. Alternatively, a portion of the broker-dealers may choose to
forego both in-house and outsourced technology development, and instead purchase a technology solution
directly from a third-party technology provider or service bureau.

4

Specifically, compliance attorneys who review, document, and update written compliance
policies and procedures are expected to require an estimated 20 hours per year; a compliance
manager who reviews, documents, and updates written compliance policies and procedures is
expected to require 20 hours per year; and the Chief Executive Officer, who certifies the policies
and procedures, is expected to require another 5 hours per year. The Commission estimates the
related internal compliance cost for this hour burden per respondent at approximately $31,900
per year. 10
c.

Total Burden

The ongoing annual aggregate information collection burden per broker-dealer would be
160 hours (115 hours (for technology) + 45 hours (for legal and compliance) = 160 hours).
Under the rule, the total annualized burden for all respondents would be approximately 80,000
hours (160 hours per broker-dealer × 500 brokers and dealers = 80,000 hours). The Commission
estimates the related total internal compliance cost for this hour burden at approximately
$35,833,500 per year (($39,767 for technology + $31,900 for legal and compliance) × 500
brokers and dealers = $35,833,500).
Rule

Burden
Type

Rule 15c3-5
(Market Access
Rule)

Periodic
500
Reporting

13.

Number of
Respondents

Number of
Annual
Responses
Per
Respondent
1

Time Per
Response
(Hours)
160

Total
Burden to
Respondents
Per Burden
Type Hours)
80,000

Costs to Respondents

For hardware and software expenses, the Commission estimates that the average ongoing
external cost would be approximately $20,500 per broker-dealer. 11 For hardware and software
expenses, the total annualized external cost for all respondents would be $10,250,000 ($20,500

10

The total ongoing legal and compliance cost is estimated to be 20 hours × $457 (hourly wage for a
compliance attorney) ($9,140) + 20 hours × $388 (hourly wage for a compliance manager) ($7,760) + 5
hours × $3,000 (hourly wage for the Chief Executive Officer) ($15,000) = $31,900.
The $457 and $388 per hour estimates for a compliance attorney and compliance manager, respectively, is
from SIFMA’s Office Salaries in the Securities Industry 2013, modified by Commission staff to account
for an 1,800-hour work-year and inflation to March 2025, and multiplied by 5.35 to account for bonuses,
firm size, employee benefits and overhead. The $3,000 per hour figure for a broker-dealer Chief Executive
Officer is an estimation based on the median CEO compensation of US exchange-traded broker-dealers that
did not report investment banking revenues for 2014, provided by SNL (now S&P Global Market
Intelligence) and adjusted for inflation and divided by 1800 hours per work-year.

11

Industry sources estimate that for ongoing maintenance, hardware would cost $8,900 on average and
software would cost $11,600 on average. The total average hardware and software cost for ongoing
maintenance would be $8,900 + $ 11,600 = $20,500.

5

per broker-dealer × 500 brokers and dealers = $10,250,000). The estimates of the annual burdens
are based on discussions with potential respondents.
Rule

Cost Type

Rule
15c3-5
(Market
Access
Rule)

Hardware
and
software
expenses

14.

Number of
Respondents
500

Annual Cost Per
Respondent
$20,500

Total Cost to
Respondents
$10,250,000

Costs to Federal Government

There will be no additional costs to the Federal Government.
15.

Changes in Burden

The estimates of burden under Rule 15c3-5 have decreased since the prior submission.
The total estimated hourly burden of compliance with the rule has been reduced from 83,200
hours to 80,000 hours, and the estimated dollar cost expenses have been reduced from
$10,660,000 to $10,250,000, in each case because the Commission has reduced its estimate of
the number of broker-dealers with market access from 520 to 500, based on a reduction of the
estimated number of broker-dealers with market access as a member of an exchange.
16.

Information Collection Planned for Statistical Purposes

Not applicable. The information collection is not used for statistical purposes.
17.

Approval to Omit OMB Expiration Date

The Commission is not seeking approval to omit the expiration date.
18.

Exceptions to Certification for Paperwork Reduction Act Submissions

This collection complies with the requirements in 5 CFR 1320.9.
B.

COLLECTIONS OF INFORMATION EMPLOYING STATISTICAL METHODS
This collection does not involve statistical methods.

6