Regulatory and legal developments could also impact the fees we receive from market data and access and capacity, or our cost in providing such services. In the U.S., we are generally required to file with the SEC any changes to the fees that we charge for our securities market data products and access and capacity fees. In recent years, certain industry groups have objected to the ability of exchanges to charge for certain market data products. In addition, the SEC and some media have scrutinized market data and market access. As discussed above, the implementation of the new Market Data Infrastructure rules could cause Cboe’s equities exchanges, BZX, BYX, EDGX, and EDGA, to require additional resources to comply with or to challenge the new rules and they may have a material impact on our business, financial condition and operating results if, for example, there are lower SIP plan revenues or we must reduce the fees we charge for market data. See “Legal Proceedings” for more information.
In addition, as discussed above, the SEC issued a final Consolidated Data Plan Order that would require U.S. equities exchanges and FINRA to develop and file a new consolidated data plan. If the Consolidated Data Plan Order were to be implemented, it may have a negative impact on the market data fees we charge and there could be a negative impact on our revenues. See “Legal Proceedings” for more information.
We believe Cboe Europe Equities currently offers market data to customers on a non-discriminatory basis at a reasonable cost. As European regulators determine how market data should be disaggregated and what is a reasonable commercial basis for providing market data, it could affect our ability to offer market data products in the same manner that we do today thereby causing an adverse effect on our European market data revenues. While MiFID II and MiFIR aim to encourage a commercial solution to a consolidated tape in Europe, should this fail to materialize, policy makers might be encouraged to implement a mandatory solution that could impact our ability to develop our own commercial offering.
The technology upon which we rely, including those of our service providers, may be vulnerable to security risks, cybersecurity risks, insider threats, unauthorized disclosure of confidential information, operational disruptions, and other risks and events that could harm our business.
The secure and reliable operation of our technology, including our computer systems and communications networks, and those of our service providers and market participants, is a critical element of our operations. These systems and networks may be subject to various cybersecurity incidents, improper or inadvertent access to or disclosure of confidential, commercially sensitive, or personally identifiable information, data theft, corruption or destruction, cyber-attack, malware and other security problems, as well as acts of terrorism, natural disasters, human error, criminal insider activity, power loss and other events that are beyond our control. As previously disclosed, in 2018, we discovered and initiated an investigation of an internal theft of idled and deactivated computer servers and networking devices. We subsequently resolved the incident by, including, among other actions, terminating the employment of the responsible individual, reporting the matter to regulators and law enforcement, and improving our policies, procedures and controls over the physical security and protection of our computer systems and communications networks to help minimize the risk of reoccurrence.
We currently maintain policies, procedures and controls designed to protect the confidentiality, integrity, availability and reliability of our systems, networks and information more broadly, and to guard against cybersecurity incidents and unauthorized access. These policies, procedures and controls are subject to periodic monitoring, auditing, and evaluation practices, pursuant to our enterprise risk management program. Further, we developed and maintain cybersecurity and data privacy training programs for our employees and our third-party consultants who have access to our systems, which includes simulations, tabletop exercises, and response readiness tests. Independent third-party cybersecurity penetration assessments are also routinely performed. Collectively, these safeguards and measures may prove inadequate to prevent the attendant risk posed by cybersecurity incidents, subjecting us to contractual restrictions, liability and damages, loss of business, penalties, unfavorable publicity, and increased scrutiny by our regulators, and materially impacting our financial condition and operating results. We may be required to expend significant resources in the event of any real or threatened breaches in security or system failures, including to protect against threatened breaches, to alleviate harm caused by an actual breach, and to address any reputational harm or litigation or regulatory liability. Such harms also could cause us to lose market participants, experience lower trading volume, and negatively impact our competitive advantage and business, financial condition and operating results.
Additionally, as threats continue to evolve and increase, and as the regulatory environment related to information security, data collection and use, and privacy becomes increasingly rigorous, we may be required to devote significant additional resources to modify and enhance our security controls and to identify and remediate any security vulnerabilities, which could have an adverse effect on our business, financial condition and operating results.
