SEC Issues Exemptive Relief from CAT Requirements

SEC staff issued no-action relief (see here and here) from Consolidated Audit Trail ("CAT") requirements in order to (i) enable broker-dealers to implement COVID-19 contingency plans, and (ii) limit the retail customer data that broker-dealers are required to report to the CAT. In a public statement, SEC Chair Jay Clayton said he directed SEC staff to identify measures to strengthen the security of CAT data.

As previously covered, the SEC adopted a national market system ("NMS") plan to create a comprehensive database for all trading activity in the U.S. equity and options markets, known as the CAT plan. The SEC stated that the CAT plan is intended to improve regulators' ability to conduct market research, market monitoring and market event reconstruction, and identify and investigate market misconduct.

Mr. Clayton stated that the SEC issued exemptive relief for self-regulatory organizations ("SROs") from:

• enforcing CAT implementation deadlines until May 20, 2020 to enable broker-dealers to focus their efforts on "critical operations" relating to COVID-19; and

• collecting the "most sensitive" retail customer data in the CAT, including a retail customer's (i) social security number or individual tax payer identification number, (ii) date of birth, or (iii) account numbers. Broker-dealers would instead be required to report a retail customer's name, address and birth year to the CAT.

Additionally, Mr. Clayton directed the SEC staff to prepare recommendations on measures to improve the security of CAT data. Specifically, Mr. Clayton asked SEC staff to:

• suggest alternatives to "bulk downloading" of data by SROs that would better protect CAT data;

• identify the risks of proliferating CAT data "across multiple environments";

• address potential data security issues concerning the use of CAT data for regulatory purposes;

• find methods to safeguard account information, while maintaining access to information for regulatory purposes;

• review the effectiveness of Plan Processor security decisions;

• allow for greater transparency concerning the security of CAT data, while protecting the CAT system from bad actors; and

• examine additional measures that would improve the security of CAT data, "both within and outside the CAT system."