SEC delays CAT deadline so firms can focus on business continuity

Broker-dealers that have spent months preparing to report data to the SEC's consolidated audit trail next month now have a reprieve of sorts, with the SEC allowing firms to focus more of their time and energy on the COVID-19-induced market mayhem.

On March 17, the Securities and Exchange Commission released a no-action letter saying staff will not enforce CAT implementation deadlines, the next of which is April 20 when broker-dealers are required to submit data to the CAT on trades they execute on behalf of clients — including institutional investors. The letter applies through May 20 but could be extended.

"To allow firms to maintain focus on operational readiness and reduce operational risk, we are issuing this no-action letter so that personnel who are working on CAT matters but are important to maintaining critical operations and implementing business continuity plans can focus their attention on those immediate needs," Brett Redfearn, the SEC's trading and markets division director, wrote in the letter to the CAT NMS operating committee. CAT NMS is the group formed by U.S. exchanges to establish a plan to implement the consolidated audit trail.

Any "member of a national securities exchange or national securities association that handles orders or quotes in NMS equity securities, (over-the-counter) equity securities or listed options" must register for the CAT along with any third-party CAT reporting agent that "is or will be authorized to submit data to the CAT on behalf of an industry member," according to information on the CAT NMS website.

For industry members that have completed the required production readiness certifications and are ready to begin reporting as of April 20, the CAT will be ready to accept CAT reports as previously scheduled, the CAT NMS operating committee said in a statement acknowledging the SEC's no-action letter. The committee also said that completion of production readiness testing and certification generally should occur 14 calendar days prior to reporting.

Kenneth E. Bentsen Jr., president and CEO of the Securities Industry and Financial Markets Association in Washington, said in a statement that he appreciated the SEC's decision because it will "allow industry members to focus resources on market stability and business continuity planning."

For months, myriad tests have been conducted in preparation of the April 20 deadline. It's a massive undertaking that requires time and resources and the testing process has been going smoothly, sources said.

Jim Nevotti, Chicago-based president of Sterling Trading Tech, a provider of trading platforms, risk and compliance technology and trading infrastructure products for the global equities, equity options and futures markets, had mixed emotions about the implementation delay.

"It's disappointing for us from a high level because we're ready and this is something we've worked toward," Mr. Nevotti said. "But the flip side is, everyone needs to focus on their core business right now and continuing to operate in this world of uncertainty and market volatility."

COVID-19 has no impact on FINRA CAT LLC's readiness or operations, a spokesman said in an email. The exchanges selected the Financial Industry Regulatory Authority as plan processor in February 2019, which then created FINRA CAT to build the audit trail.

Ellen Greene, New York-based managing director of equity and options market structure at SIFMA, said the recent market volatility and increase in the number of employees working remotely has had an impact on firms. "I think everyone is so focused on the market right now that large scale implementation projects like CAT become more challenging," she said.

Before the pandemic, CAT's cybersecurity was one of the major concerns for stakeholders. The huge data repository could attract the attention of cybercriminals, industry members said.

When fully implemented, the CAT will ingest more than 58 billion records a day and be the world's largest data repository on securities transactions, tracking all orders throughout their life cycles, according to a 2019 CAT NMS news release.

CAT will be a single database for all equity and options trades executed on U.S. exchanges. It's intended to allow regulators to track illegal or manipulative trades and show a way to quickly determine what caused large, sudden losses in trading value, such as the flash crash of May 6, 2010. That event resulted in the loss of nearly $1 trillion in U.S. equity value in the Dow Jones Industrial Average in a little more than 30 minutes.

After calls from industry members, trade groups, elected officials and a formal request from the exchanges in January, the SEC on March 17 issued relief exempting the self-regulatory organizations, or SROs, made up of exchanges and securities associations, from collecting or retaining certain retail customer data, including individual Social Security numbers or individual taxpayer identification numbers, dates of birth and account numbers. Instead of including these most sensitive pieces of personally identifiable information in the CAT, broker-dealers are required to report an account holder's name, address and birth year.

"Given the limitation of personally identifiable information to 'phone book'-type information, I believe this represents an important step in significantly reducing the risk of retail investor identity theft associated with the CAT," SEC Chairman Jay Clayton said in a statement.

Peter Gargone, founder and CEO of n-Tier Financial Services LLC, a New York-based technology company that helps institutions minimize risks and costs associated with regulatory reporting, said similar data has been collected under other regulatory systems, like FINRA's Order Audit Trail System, but having the data in one central location does make the CAT "a target."

Mr. Clayton on March 17 also asked SEC staff to prepare a recommendation on improving data security requirements in the CAT NMS plan, including exploring whether there are alternatives to "bulk downloading" data by each SRO that would better secure CAT data.

Allowing data to be bulk downloaded outside the CAT would increase the likelihood of a data breach, Ms. Greene said. It's one of the reasons SIFMA takes issue with the current CAT reporter agreement, which industry members must sign before connecting to the CAT.

If there is a breach involving bulk downloaded data, "we think that should be the responsibility of that exchange, but the current CAT reporter agreement would absolve the SROs and their staffs from liability under these circumstances," Ms. Greene said.

"From a practical standpoint, that's something the industry finds to be unacceptable."

Separately, as the CAT has been built out, the SROs have been unable to collect fees from industry members, but will once reporting begins and a fee schedule is approved by the SEC.

The CAT NMS operating committee must propose a fee schedule, which will then be subject to a notice and comment period and SEC approval.

Jim Toes, president of the Security Traders Association, New York, said the SROs "have been the ones laying out the money on what's being done, so in fairness to the SROs they do need to be recouping some of these costs. But he's concerned "with how much time is going to be afforded the industry to comment."