SEC Grants No-Action Relief on CAT Data Collection
The SEC issued no-action relief from the requirement to report certain personally identifiable information ("PII")—names, addresses and years of birth—to the Consolidated Audit Trail ("CAT").
The decision follows from the Commission's 2020 order (the "PII Exemption Order") which conditioned the exemption of such information "on the implementation of an alternative method of generating unique customer identifiers through transformed SSNs,"—(i.e. "the CCID alternative"). The SEC stated that "consistent with the PII Exemption Order, the participants must continue to require Industry Members, through their CAT Compliance Rules, to report to the Central Repository other required information, including a transformed value for the SSN/ITIN and the Firm Designated ID ("FDID") for accounts for such natural persons."
In issuing the Order, the SEC considered the risks and "the increas[ing] sophistication of cybercriminals and bad actors," against the "technological advancements over the past few years" on processes for requesting names under the CCID Alternative. The SEC stated it is "committed to ensuring that it continues to strike an appropriate balance between the ability of regulators to efficiently identify market participants engaged in illegal trading activity and mitigating the risk of breaches to individual investors' PII in the CAT."
The SEC acknowledged that its Order will negatively impact regulatory efficiency, particularly for broker-dealers.
Commissioner Caroline A. Crenshaw criticized the decision and emphasized that the data is crucial for detecting fraud, ensuring market stability and responding effectively to crises like the 2010 Flash Crash. On the negative impact on regulatory efficiency, she said the Order "fails to grapple with the consequences of these diminished capabilities."