SEC wants updates to keep audit trail project on target

The SEC is looking to avoid further delays on its consolidated audit trail project with proposed guidance that would require participating U.S. exchanges to file and publish an implementation plan as well as quarterly progress reports.

CAT will be a single database for all equity and options trades executed on U.S. exchanges. It's intended to allow regulators to track illegal or manipulative trades and show a way to quickly determine what caused large, sudden losses in trading value, such as the flash crash of May 6, 2010. That event resulted in the loss of nearly $1 trillion in U.S. equity value in the Dow Jones industrial average in a little more than 30 minutes.

The project has been hit with several setbacks since the SEC approved creating it in 2012. Of note, the timeline for when broker-dealers will be required to submit data to the CAT on trades they execute on behalf of clients — including institutional investors — has been pushed back to April 2020 from previous deadlines of November 2019 and November 2017.

In September, the SEC proposed guidance that would require self-regulatory organizations, made up of exchanges and securities associations, to file and publish an implementation plan and quarterly progress reports.

"CAT needs to be implemented without further delays," said SEC Chairman Jay Clayton in a statement. "The proposed amendments are designed to bring greater transparency and accountability to the implementation of the CAT."

Jim Nevotti, Chicago-based president of Sterling Trading Tech, a provider of trading platforms, risk and compliance technology and trading infrastructure products for the global equities, equity options and futures markets, said shifting deadlines hurt business.

"You plan for a rollout, which means that you're allocating resources away from revenue-generating projects toward regulatory projects and then when it gets delayed it's frustrating," he said.

But despite past delays, the project is moving much smoother today and there is no reason for the added regulations on this front, said Jim Toes, president, Security Traders Association, New York.

"There's a disconnect from what we see — this process is moving along — to a reaction by the com- mission that doesn't seem like it's really matching what the situation is," Mr. Toes said. "They're kind of dropping the hammer here, asking for these quarterly updates and that's usually something a regulator or anyone does if they're not satisfied with the progress being done at that point in time. There was a time where the commission was not satisfied with how this was progressing…and they were well within the right for having that opinion, but that's like two years ago."

The SEC preliminarily estimates that each self-regulatory organization will incur one-time consultation costs of $8,200 for the implementation plan, and ongoing annual costs of $33,000 for quarterly progress reports until CAT is fully implemented, according to its proposal.

James C. Dolan, chief compliance officer at Luminex Trading & Analytics LLC, Boston, said after years of delays, the SEC simply wants to see the project completed. The SEC is trying to ensure that the self-regulatory groups don't get too comfortable, he said, "and they continue to keep the pedal to the metal to get this thing done," he said.

CAT NMS, which was formed by U.S. exchanges to establish a plan to implement the audit trail, changed the entity responsible for building the database earlier this year. The exchanges selected the Financial Industry Regulatory Authority as plan processor in February a few weeks after it cut ties with Thesys CAT LLC, which was created by capital markets technology provider Thesys Technologies LLC.

A spokesman for FINRA, which has since created FINRA CAT to build the audit trail, referred all questions to CAT NMS spokesmen, who denied comment for this story.

With FINRA on board, the project is in a much better spot than it was in recent years, Mr. Toes said. "We're not saying any of this is easy, but at least people feel like it's organized, issues are being identified, issues are being resolved, and communication has gotten much better from the CAT NMS working group," he said.

But while Mr. Toes doesn't think the SEC needs to implement quarterly reports, he is hoping the agency will issue guidance on what he calls regulatory duplication.

"Right now, the plan says all the SROs will have visibility into all the data and if ... there isn't (additional) action taken, then the obligation and the ability for one SRO to fine an entity for activity that's not being done on their particular SRO will exist," he said. "I don't think anybody wants that."

Mr. Nevotti said it's one of the plan's unintended consequences. "When the exchanges have access to significantly more information, how it's going to be used is a great question," he said. "What happens once everyone sees all this information and has access to more than they have now? I think it's a legitimate concern and a real unknown."

When fully implemented, the CAT will ingest more than 58 billion records a day and be the world's largest data repository of information on securities transactions, tracking all orders throughout their life cycles, according to a CAT NMS news release earlier this year.

In April, when broker-dealers are required to submit data to the CAT on trades they execute on behalf of clients, a much larger amount of information will be added to the audit trail that will specify how their clients trade equities and options. That huge data repository could attract the attention of cybercriminals, stakeholders warned at the CAT Industry Conference hosted by Securities Industry and Financial Markets Association and Deloitte LLP on Sept. 16.

"What I'm worried about is it's going to have the trading strategies of every investor, you're going to be able to see what the most sophisticated hedge fund in the world is doing," said Ronald J. Veith, a New York-based executive director at J.P. Morgan Chase & Co.

"Our institutional clients are probably more at risk from centralizing all this data, especially centralizing in a place that publicly well known that it's going to exist," Mr. Veith added.

Manisha Kimmel, senior policy adviser for regulatory reporting at the SEC, oversees the CAT project. "Every part of CAT implementation comes under scrutiny from a security perspective," she said at the CAT Industry Conference.

There have been calls from exchanges to request exemptive relief from the SEC to no longer require the CAT to keep Social Security numbers, dates of birth and account numbers of individual investors.

"We believe this will reduce the risk profile of the CAT significantly and make it a less attractive target and substantially reduce the potential for identity theft," said Soniya Shrivastav, a member of the CAT operating committee leadership team, during an August webinar in which CAT's robust cybersecurity plan was outlined.

Ms. Kimmel said at the conference that she believes the SEC "can accomplish the goals of CAT without the most sensitive pieces of data."