SIFMA Urges SEC to Impose Liability on SROs for Security Breaches in CAT

In a comment letter, SIFMA argued that self-regulatory organizations ("SROs") that control the Consolidated Audit Trail ("CAT") should be subject to full liability for damages that result from data breaches that might occur when an SRO uses the CAT for commercial purposes.

SIFMA urged the SEC to reject the SROs' attempts to limit their liability or potential payments for damages. SIFMA cautioned that any limitation on the SROs' liability would dis-incentivize the organizations from investing in appropriate security measures. SIFMA suggested that SROs are telling industry members and the SEC that the CAT system is protected from data breaches, but are unwilling to be held responsible for such breaches.