[Senate Hearing 116-113]
[From the U.S. Government Publishing Office]
S. Hrg. 116-113
OVERSIGHT OF THE STATUS OF THE CONSOLIDATED AUDIT TRAIL
=======================================================================
HEARING
BEFORE THE
COMMITTEE ON
BANKING,HOUSING,AND URBAN AFFAIRS
UNITED STATES SENATE
ONE HUNDRED SIXTEENTH CONGRESS
FIRST SESSION
ON
EXAMINING THE EFFORTS TO IMPLEMENT THE CONSOLIDATED AUDIT TRAIL AND TO
REVIEW ELEMENTS OF THE CAT NATIONAL MARKET SYSTEM PLAN NECESSARY TO THE
MARKET REGULATORY FUNCTION
__________
OCTOBER 22, 2019
__________
Printed for the use of the Committee on Banking, Housing, and Urban
Affairs
Available at: https: //www.govinfo.gov /
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
__________
U.S. GOVERNMENT PUBLISHING OFFICE
39-415 PDF WASHINGTON : 2020
--------------------------------------------------------------------------------------
COMMITTEE ON BANKING, HOUSING, AND URBAN AFFAIRS
MIKE CRAPO, Idaho, Chairman
RICHARD C. SHELBY, Alabama SHERROD BROWN, Ohio
PATRICK J. TOOMEY, Pennsylvania JACK REED, Rhode Island
TIM SCOTT, South Carolina ROBERT MENENDEZ, New Jersey
BEN SASSE, Nebraska JON TESTER, Montana
TOM COTTON, Arkansas MARK R. WARNER, Virginia
MIKE ROUNDS, South Dakota ELIZABETH WARREN, Massachusetts
DAVID PERDUE, Georgia BRIAN SCHATZ, Hawaii
THOM TILLIS, North Carolina CHRIS VAN HOLLEN, Maryland
JOHN KENNEDY, Louisiana CATHERINE CORTEZ MASTO, Nevada
MARTHA MCSALLY, Arizona DOUG JONES, Alabama
JERRY MORAN, Kansas TINA SMITH, Minnesota
KEVIN CRAMER, North Dakota KYRSTEN SINEMA, Arizona
Gregg Richard, Staff Director
Laura Swanson, Democratic Staff Director
Jen Deci, Professional Staff Member
Elisha Tuku, Democratic Chief Counsel
Cameron Ricker, Chief Clerk
Shelvin Simmons, IT Director
Charles J. Moffat, Hearing Clerk
Jim Crowell, Editor
(ii)
C O N T E N T S
----------
TUESDAY, OCTOBER 22, 2019
Page
Opening statement of Chairman Crapo.............................. 1
Prepared statement........................................... 24
Opening statements, comments, or prepared statements of:
Senator Brown................................................ 2
Prepared statement....................................... 24
WITNESSES
Shelly Bohlin, President and COO, FINRA CAT LLC, Financial
Industry Regulatory Authority.................................. 4
Prepared statement........................................... 25
Responses to written questions of:
Senator Brown............................................ 39
Senator Sasse............................................ 40
Senator Kennedy.......................................... 40
Senator Warner........................................... 46
Senator Warren........................................... 48
Senator Cortez Masto..................................... 53
Senator Sinema........................................... 56
Judy McDonald, Chair, CAT NMS Plan Advisory Committee............ 5
Prepared statement........................................... 29
Responses to written questions of:
Senator Sasse............................................ 57
Senator Kennedy.......................................... 57
Senator Warner........................................... 58
Senator Cortez Masto..................................... 61
Senator Sinema........................................... 63
Michael J. Simon, Chairman, CAT NMS Plan Operating Committee..... 7
Prepared statement........................................... 30
Responses to written questions of:
Chairman Crapo........................................... 64
Senator Brown............................................ 66
Senator Sasse............................................ 68
Senator Warner........................................... 68
Senator Cortez Masto..................................... 74
Senator Sinema........................................... 78
Additional Material Supplied for the Record
Letter submitted by Better Markets............................... 80
(iii)
OVERSIGHT OF THE STATUS OF THE CONSOLIDATED AUDIT TRAIL
----------
TUESDAY, OCTOBER 22, 2019
U.S. Senate,
Committee on Banking, Housing, and Urban Affairs,
Washington, DC.
The Committee met at 10 a.m., in room SD-538, Dirksen
Senate Office Building, Hon. Mike Crapo, Chairman of the
Committee, presiding.
OPENING STATEMENT OF CHAIRMAN MIKE CRAPO
Chairman Crapo. Good morning. The Committee will come to
order.
Today's hearing will focus on oversight of the status of
the Consolidated Audit Trail, commonly referred to as the
``CAT''.
In 2010, in response to the flash crash and a number of
other market disruption events, the SEC proposed the creation
of a real-time tracking system to track securities orders
across all markets throughout the life cycle of the order--from
origination, to routing, to cancellation, modification, or
execution.
At the time, the SEC estimated the creation of the CAT
would cost $4 billion to launch and have an ongoing maintenance
cost of $2.1 billion.
In 2012, I wrote a letter requesting that the SEC consider
alternatives to establishing the CAT database, such as housing
it on FINRA's existing Order Audit Trail System, or OATS.
It has been 9 years since the SEC's initial proposal for
the CAT, and after multiple challenges and delays, it would
appear that we have arrived at a version of CAT that realizes
real-time, less accurate data is not necessary to the market
function and that slightly delayed, more accurate information
significantly reduces costs while still preserving the
functional improvements that CAT is intended to provide.
Further, the CAT now better leverages existing resources by
recently selecting a subsidiary of FINRA to be the plan
processor.
I continue to have concerns about the costs associated with
the build, the volume of the information collected and what
information will be collected, who has access to the
information collected, and how that information will be
secured.
Last year, Ranking Member Brown and I wrote a letter to SEC
Chairman Clayton that emphasized our bipartisan belief that
protecting individuals' personally identifiable information, or
PII, is paramount to the American people.
We have continued to seek a better understanding of what
type of PII is being collected, how that information is being
used, who can access it, and how that data will be secured and
protected.
Chairman Clayton's September 9th statement echoed this
sentiment regarding the importance of protecting information
collected and stored in the CAT, particularly Social Security
numbers, account numbers, and dates of birth.
Chairman Clayton stated that he believes ``the regulatory
objectives of the CAT can still be achieved without these most
sensitive pieces of investor information.''
Last week, the SROs officially requested a modification to
the CAT NMS Plan to exclude the collection of dates of birth,
Social Security numbers, individual taxpayer identification
numbers, and account numbers.
This request is long overdue, and I encourage the SEC to
grant this amendment which, I agree with the SROs, will reduce
the risk profile of the data collected and stored in the CAT
while still preserving the CAT's intended regulatory use.
In his September 9th statement, Chairman Clayton went on to
say that even if the SROs reduce the scope of the PII
collected, the nature of the data to be included in the CAT
``necessitates robust security protections.''
I could not agree more, and I look forward to hearing from
our witnesses on how they plan to address these important
issues from each of their unique roles in the creation of the
CAT.
I look forward to receiving an update from each of our
witnesses on outstanding issues and challenges that remain to
achieving an operational CAT.
Again I want to thank our witnesses for coming here and
taking your time and bringing us your expertise today.
Senator Brown.
OPENING STATEMENT OF SENATOR SHERROD BROWN
Senator Brown. Thank you, Mr. Chairman, and thanks to the
witnesses. Ms. Bohlin, Ms. McDonald, and Mr. Simon, thank you
for joining us.
We are just shy of 200 days from the 10th anniversary of
the 2010 flash crash. Although there has not been a market
disruption of that magnitude since, our markets have become
faster, more sophisticated, and more fragmented. In that time,
industry has spent billions on upgrading technology and
developing faster and smarter trading systems.
Yet the SEC, whom we all rely on to maintain fair, orderly,
and efficient markets, still lacks a comprehensive system that
would allow it to effectively oversee the securities markets to
protect Americans' college savings and retirement funds.
In an industry where cutting-edge technology is the name of
the game and trading firms erect competing microwave towers so
that computers in Chicago can communicate with computers on
Wall Street in milliseconds, the SEC still cobbles together
data from multiple sources in an attempt to have a complete
understanding of our markets.
This is why the SEC called on FINRA and the firms that run
our Nation's stock and options exchanges to build the
Consolidated Audit Trail, one system with a beginning-to-end
view of how trading happens, so we can prevent insider trading,
market manipulation, and other misconduct that cheats the
system.
When the effort began in 2012, it was a huge undertaking.
But 7 years later we are only at the first stage of data
reporting; many details need to be finalized. Under the current
timeline, the system will not be fully operational until 2022.
Some take issue with the SEC, or any Government agency,
having this much data and call the system a ``target for
hackers.''
I refuse to accept that we cannot both protect people's
personal information and go after criminals who take advantage
of the markets.
I know there are dozens of tech experts, data scientists,
and market veterans working on this. Just last week, the CAT
Operating Committee submitted to the SEC its proposal to
exclude Social Security numbers and other personal information
from the reported data.
This is just one of many creative solutions that balance
the need for oversight with protecting sensitive information.
I trust that the very capable minds at the exchanges,
FINRA, and the SEC can work out access to data concerns,
tracking the use of the audit trail, and how to keep
information secure to allow this long overdue oversight tool to
be completed.
The bottom line is if you are smart enough to have
information or strategies you think someone wants to steal,
then you are smart enough to help come up with ways to protect
them.
We cannot afford to wait.
Just last week, the SEC filed charges against 18 people,
most of them in China, who engaged in a 6-year market
manipulation scheme using dozens of accounts, across many
brokerage firms, that resulted in $31 million, at least, of
illicit profits.
While we will never know if the new system would have made
it easier to uncover those crimes, it is that kind of activity
the SEC should have the technology to uncover and detect.
We know the question is not if but when there will be
another crash or major disruption. Everyone--Congress, Main
Street, industry--will look to those represented by our
panelists today and the SEC to understand what happened, how it
will be fixed, and who was responsible. Not having an answer or
waiting 5 months for one will then be unacceptable.
If another flash crash occurs or the delays or
disagreements over what should be solvable questions continue,
you can expect to be back before this Committee. We are
expecting you all to cooperate and work diligently to finish
the CAT project.
There are not many things that SEC Chair Clayton and I
agree on, but finishing the Consolidated Audit Trail without
further delay is one of them.
Every day we wait creates more risks for our markets and
more opportunities for criminals to cheat our regulatory
system.
Thanks for joining us.
Chairman Crapo. Thank you, Senator Brown.
Today's witnesses are Ms. Shelly Bohlin, president and
chief operating officer of FINRA CAT; Ms. Judy McDonald, Chair
of the CAT NMS Plan Advisory Committee and associate director
of Susquehanna International Group; and Mr. Michael Simon,
Chair of the CAT NMS Plan Operating Committee and independent
senior adviser of Deloitte & Touche.
We welcome all of you with us, and I will ask you to give
your statements in the order I introduced you. Ms. Bohlin, you
may proceed.
STATEMENT OF SHELLY BOHLIN, PRESIDENT AND COO, FINRA CAT LLC,
FINANCIAL INDUSTRY REGULATORY AUTHORITY
Ms. Bohlin. Great. Thank you. Chairman Crapo, Ranking
Member Brown, and Members of the Committee, on behalf of FINRA
CAT, LLC, a subsidiary of FINRA, I would like to thank you for
the opportunity to testify today. I serve as the president and
chief operating officer of FINRA CAT, which was created to
focus solely on performing the functions of the plan processor
to build and operate CAT. FINRA CAT welcomes the Committee's
invitation to discuss specific details of our work as the plan
processor of the Consolidated Audit Trail, or CAT, since we
stepped into this role 6 months ago.
The CAT is designed to be a centralized source of
information on activity in the equities and listed options
markets. The SEC adopted Rule 613 in the wake of the 2010 flash
crash to create a comprehensive consolidated audit trail that
allows the SEC, FINRA, and the national securities exchanges to
efficiently and accurately track all activity in these
securities throughout the U.S. markets in order to facilitate
comprehensive market reconstructions, more robust market
surveillance, and better analytics to support policymaking.
Given the size and complexity of the financial markets, the
CAT must collect, process, and store a vast amount of data to
achieve this goal. This is a highly complex project that
requires deep technological expertise, sophisticated and
proactively evolving security, close regulatory coordination
with the SEC and the consortium of self-regulatory
organizations, or SROs, responsible for managing the CAT and
full-time engagement with broker-dealers that ultimately must
report data to the CAT.
FINRA CAT appreciates that there is interest in the CAT
from multiple perspectives, including how this system will
support use by market regulators and how the sensitive data
included in the CAT will be secured. FINRA CAT is fully
committed to serving these interests. FINRA CAT leadership and
staff have significant experience in developing audit trail
technology and utilizing it for regulatory purposes. In
addition, FINRA CAT has access to the full resources of FINRA
and its long, successful work in this area and the expertise of
the relevant exchanges. With this support, our work to build
the CAT is on schedule.
Since becoming the plan processor in April, FINRA CAT has
worked closely with the SRO consortium and SEC staff to
expeditiously put in place a solution for the first scheduled
phase of the CAT--specifically, the collection and processing
of order and trade data from the equities and options exchanges
and FINRA. FINRA CAT has used scalable technology to process,
on average, over 100 billion market records a day during this
period with no material operational issues or delays. We also
have been dedicating substantial resources to preparing for the
next phase, industry member reporting, which is scheduled to be
phased in from April 2020 to July 2022.
After a number of interim phases that will require the
reporting of increasingly complex order and trade information,
the final phase of industry member reporting calls for certain
customer and account information reporting to begin in July
2022.
To achieve our goals, FINRA CAT is involved in full-time
industry engagement through a variety of channels to ensure
that the industry has a voice in development of the CAT
particularly as it relates to industry member reporting
requirements. Technical reporting specifications and extensive
reporting guidance have been published to assist broker-dealers
in meeting their CAT reporting obligations.
In addition, each week FINRA CAT participates in a call
with SEC staff and the SRO consortium leadership team to
provide an update on project development and progress.
Finally, I can assure the Committee that the security of
customer account information and of all CAT data more broadly
is of the utmost priority to FINRA CAT, and that a strong data
security program has been put in place to meet the CAT NMS
Plan's stringent security requirements.
FINRA CAT is directly subject to SEC Regulation SCI. In
terms of FINRA CAT's overall information security program, we
are led by a CISO with over 20 years of experience working on
information security at FINRA, including as a security
architect and a security engineer.
FINRA CAT's security program aligns with the strictest
Government requirements of the National Institute and Standards
of Technology, including stringent third-party reviews of
critical security controls. The FINRA CAT security program also
includes significant layers of architectural-level and program-
level security controls. We are constantly evaluating evolving
threats and security control opportunities to ensure that the
CAT security posture remains strong.
In conclusion, thank you again for the opportunity to
appear today. The CAT is a major regulatory undertaking meant
to help the SEC, FINRA, and the exchanges better regulate our
securities markets. I am happy to answer any questions that you
may have.
Chairman Crapo. Thank you.
Ms. McDonald.
STATEMENT OF JUDY MCDONALD, CHAIR, CAT NMS PLAN ADVISORY
COMMITTEE
Ms. McDonald. My name is Judy McDonald. I am the head of
Regulatory Technology at Susquehanna International Group, a
global quantitative trading firm headquartered in Bala Cynwyd,
Pennsylvania. In my role at SIG, I have been evaluating the CAT
NMS Plan since its inception, and since February 2017, I have
served along with 13 other industry participants on the
Advisory Committee. Since March of 2019 I have served as the
Chair.
Today I can confidently state that the effort to deliver
CAT is moving forward in a very positive manner. Since February
2019, when FINRA CAT was selected as the new plan processor,
the SROS, FINRA CAT, and industry members have been in a
virtuous cycle of iterative deliverables and collaboration on
the Plan. FINRA CAT brings subject matter expertise, depth of
resources, and leadership to the effort.
The Advisory Committee is satisfied that the intermediate
milestones of the past year have been met and that significant
progress has been made toward the processing of SRO reporting
and the completion of industry member technical specifications.
However, there are a few areas of concern as the
implementation of CAT progresses.
First, data security. This is undoubtedly the most
significant concern as the CAT will gather and store an
unprecedented amount of information that previously has not
been centrally located nor specifically identifiable. The
concerns can be broken down into three categories: trading
records for institutions, personally identifiable information
for retail customers, and the security policies of regulators.
Trading Records. There is significant concern about the
security of the CAT data repository and the misuse of trading
records by those with ``authorized'' access. Trading records
will be less secure than PII and accessible by a broader set of
individuals. This highly proprietary information results from
significant investments, and broker-dealers are very concerned
that trading strategies could be reverse-engineered by
competitors, academics, or rogue actors. Further, SROs compete
with each other and BDs; this is beneficial to investors and
could be compromised with the misuse of data.
PII Data. We are encouraged by the progress to avoid the
collection of Social Security numbers and other sensitive PII
data. With this progress we believe some focus should be
shifted to address the retirement of the legacy Electronic Blue
Sheet system.
Security Policies. The Advisory Committee has little
insight into the security programs at regulators and whether
security policies and procedures have changed commensurate with
the increased value of the CAT data and the increased threat of
compromise. We cannot emphasize enough the harm that could come
from an external bad actor gaining access to trade information
once data is bulk downloaded from the central CAT repository.
In summary, I appreciate the critical nature of securing
CAT data. Two of the best ways to achieve data security are to
limit the number of people with access and to control the use
of data as tightly as possible. The Advisory Committee urges
reconsideration of allowing the 23 exchanges and the SEC to
bulk download CAT data.
Second, verbal and manual quotes. There is a significant
open issue with respect to the capture and reporting of verbal
and manual quotes. Human interaction with highly electronic
markets is a deeply challenging issue that affects a small but
very important part of the market and, if disrupted, could
dramatically reduce market liquidity particularly during
moments of extraordinary volatility. The Advisory Committee
recommends a stepwise approach for verbal and manual quotes.
Third, fees. Another area of concern is the lack of insight
into fees that may be applied to broker-dealers. The absence of
a fee schedule creates uncertainty around the effort and
unnecessarily challenges firms budgeting to comply with CAT.
Fourth, the SEC proposal for Financial Accountability
Milestones. The SEC proposal centers around the best practice
goals of increasing accountability and transparency of the CAT
project. While we are supportive of these goals, legitimate
unforeseen circumstances may occur where fixed deadlines work
against the collective best interest of the CAT implementation.
There must be some flexibility in place to address these
unforeseen situations.
In closing, I look forward to continuing my work on the CAT
project and will be happy to address any specific questions.
Chairman Crapo. Thank you.
Mr. Simon.
STATEMENT OF MICHAEL J. SIMON, CHAIR, CAT NMS PLAN OPERATING
COMMITTEE
Mr. Simon. Good morning. My name is Michael Simon, and I am
Chairman of the CAT Operating Committee. When completely
implemented, the CAT will receive and process multiple records
to create the entire life cycle of events from all of our
securities markets. Only the participants and the SEC will be
able to query the system and solely for regulatory purposes.
CAT is a massive undertaking. We currently receive, as
Shelly mentioned, over 105 billion records per day on average
and have processed the single-day peak of 182 billion records.
This does not even begin to reflect the volume of data we will
receive and store when broker-dealers begin submitting data.
Much of the interest in CAT has been on the inclusion of
personally identifiable information as well as on the security
and cost of the system. Before discussing these issues, I would
like to update you on our progress. You already heard the
reasons behind and history of the CAT. I will not repeat that.
During the plan review process, the participants conducted
a request for proposal and ultimately selected Thesys as the
CAT processor. Unfortunately, the relationship with Thesys did
not proceed as hoped, and earlier this year we selected FINRA
CAT to serve as the successor plan processor. With FINRA CAT
now in place, we continue to work diligently with the SEC staff
and the CAT Advisory Committee to build and operate the CAT
safely and efficiently.
The participants began submitting CAT data to the CAT last
November. FINRA CAT collects all the data from the
participants, validates and links all equity data, and is now
on target to validate and link all options data in February.
FINRA CAT also is on target to commence broker-dealer testing
next month and reporting in April. FINRA CAT has not
experienced any production outages or major operational issues.
As to PII, this has been a topic of interest and concern.
Rule 613 explicitly requires the CAT to be able to identify
underlying customers. Indeed, the plan requires the system to
include an individual's name, address, date of birth, an
individual taxpayer identification or Social Security number.
Due to the concerns of including PII in CAT, we have discussed
with the SEC and the industry how best to preserve the
regulatory benefits of the CAT while addressing legitimate
concerns related to the inclusion of sensitive information in
the system. Based on these discussions, as noted, last week we
requested that the SEC grant exemptions from relevant aspects
of the plan to eliminate Social Security numbers, dates of
birth, and account numbers from the CAT. We believe this will
reduce the risk profile of data collected and stored in the
CAT. Instead of collecting and storing Social Security numbers,
FINRA CAT would generate a unique identifier for a customer,
the so-called CCID. This would eliminate the inherent risk of
the CAT holding Social Security numbers.
Regardless of any exemptive relief, security will always be
a top priority in the CAT. To that end, we have instituted
safeguards to protect the system and the data within it. CAT
LLC has both a chief information security officer and chief
compliance officer who are fiduciaries of CAT LLC. The CAT CISO
creates and enforces controls to monitor and address data
security issues. The CISO also evaluates if the participants
have information security policies comparable to those of the
plan processor. The participants in FINRA CAT designed and
operate the system in accordance with stringent security
standards that Shelly mentioned. The plan processor and
independent third parties perform multiple layers of security
assessments. These assessments test that the security controls
are operating effectively and that the system is free of
significant vulnerabilities.
Regulators can access the system only over dedicated
private lines. The system is designed without any Internet-
based query function. The system also requires multifactor
authentication, strongly protecting against unauthorized
access. Moreover, the system and relevant personnel continually
monitor access and use of the system.
Last, cost. CAT requires a significant commitment of
capital, both human and financial. We estimate the CAT budget
to be upwards of $75 million a year, not including participant
or broker-dealer compliance costs. Even though Rule 613 and the
plan specifically provide for joint funding by the participants
and broker-dealers, to date the participants have borne all
costs. In 2017, the participants sought to implement the fee
structure in the approved plan, but ultimately withdrew the
filings when it became clear the SEC was going to disapprove
them. Because it remains both important and reasonable that
industry members contribute to funding the CAT, we are working
on an amended fee proposal.
In closing, we remain committed to meeting our obligation
to build and operate the CAT system and are making significant
progress in that regard. We will continue to take all necessary
precautions to safeguard the CAT system and the data within it.
Thank you for the opportunity to provide testimony today. I
am happy to take your questions.
Chairman Crapo. Thank you very much, Mr. Simon.
I will start out with--actually, this question is for each
of you. I would like you to be as brief as you can, however, so
I can get to some other questions. But one of the issues that I
am concerned about is given that it appears that the PII
information we have talked about already in the hearing is
going to be excluded from collection, can the data that is
collected be reverse-engineered in a way to identify the actual
users? And maybe I will start with you, Mr. Simon. You
mentioned that there is an identifier for each individual
called the ``CCID.''
Mr. Simon. CCID.
Chairman Crapo. OK. What is that?
Mr. Simon. The CAT customer ID. Shelly can get into some of
the specifics as to how it is generated, but it is important to
note that broker-dealers will not be sending Social Security
numbers to the CAT; the CAT will never receive or store them.
Rather, we have a multistep system in place that FINRA CAT will
be building so that the broker-dealers will be doing some
hashing or changes to the Social Security number coming in and
that will be the CCID that will be kept in the database. And,
Shelly, I think----
Chairman Crapo. Ms. Bohlin, could you address that and then
also address--to me that seems like it just begs for reverse
engineering.
Ms. Bohlin. So I will start out by saying that the CCID--
and as Mike described--is based on a Social Security number
that never leaves the broker-dealer. But the objective is to be
able to identify a single customer trading across all broker-
dealers. So that is one of the primary functions that CAT
brings that the regulators do not have the ability to do today.
But the CCID is only known by CAT. It is not returned to a
broker-dealer. No one outside of CAT will ever have access to
or know the CCID.
Further, the CCID as it comes into the customer and account
section of--the customer and account data is segregated from
the transaction data. The CCID, while it will have associated
with it customer information in the customer and account
database, it is not available to the transaction data. Only the
actual CCID number itself, not knowing who it is, whether it is
a natural person, an institution, anything else, only that is
available with the transaction data for regulators to run
queries against. So it is tightly controlled and not known
outside of CAT.
Chairman Crapo. Well, first, let me ask could CAT tell the
broker-dealers to give them the ID, the information later on? I
do not mean now. They are not collecting it now. But what if
they decided they wanted to have it? Could they just create it?
Ms. Bohlin. So to have the broker-dealer create the CCID I
think would be difficult because you have to have the same
identifier across every single broker-dealer. So CAT
originally, as Rule 613 was originally approved, had the
broker-dealers submitting a CCID that becomes difficult--it
gets very detailed very fast. I know we have limited time here.
I am happy to follow up on any of the details to this. But it
is designed so that the broker-dealer--each individual broker-
dealer does not have to have some uniform way to come up with
the same number to give CAT for the same----
Chairman Crapo. Well, I would like you to perhaps in
writing following the hearing give me a little better
explanation of this. Let me just give you a quick example. You
will recall when the CFPB got rolling really aggressively, it
decided it wanted to collect credit card transactions on
virtually everybody for everything. And we got into a fight
with the CFPB over that, and they finally said, ``Oh, well, we
are not collecting all of this PII,'' which goes way beyond the
PII that we are talking about right now. And it turns out, as
we explored that with them, that they basically just were not
collecting it, but they could easily, by flipping a switch,
pick it up.
Mr. Simon. I think it is important to note that when you
say will CAT be able to get the underlying information, CAT
will not be able to get the underlying information. Each of the
SROs themselves as a self-regulatory organization and as they
conduct their surveillance, at some point they will need to
know the underlying customer involved, and the SROs, as part of
their surveillance function, will have the ability to go back
to broker-dealers and to try to identify the person who they do
not know their specific identity from the CAT data, but that
will be something in the surveillance function of each of the
SROs and will not be a CAT function.
Chairman Crapo. All right. Thank you. I would like you, all
three, if you would, to fill in anything else you can for me
following this in your written responses to the Committee.
I only have 30 seconds left, so let me ask whoever would
like to jump in on this, who has access? There was a comment
about the fact that both of the exchanges have the ability to
download this data?
Mr. Simon. Yeah, I will handle that from the consortium
side.
Chairman Crapo. OK.
Mr. Simon. There are 23 SROs--23 exchanges plus FINRA as
the SROs, plus the SEC. Each of them have regulatory
responsibilities under the Federal securities laws. Each of
them will have the ability to access the database to conduct
their surveillance. They all conduct surveillance now, and they
will have access to the CAT database in whatever manner they
feel appropriate to discharge their regulatory
responsibilities.
There will be controls in place, as Shelly mentioned, as to
proper training and access and regulatory oversight over who
does have access and how they use it. But its stated purpose,
both in the rule and in the plan, is to help each of the
regulators discharge their regulatory obligations.
Chairman Crapo. All right. Thank you. I am going to
probably send some questions to you to further elaborate on
that.
Senator Brown.
Senator Brown. Thank you, Chairman.
Ms. Bohlin, please describe for us the market oversight and
enforcement benefits of the Consolidated Audit Trail for the
SEC and FINRA, and how does this improve on current systems?
Ms. Bohlin. So one of the biggest differences and
improvements over current systems, it will be all in a central
database that is reported by 8 a.m. on T+1. It will include
data including all the equities exchanges and options
exchanges. So today we have similar constructs in the equity
markets to what CAT ultimately is, but not the options market.
So bringing the options data in is a significant difference
from what we have today; in addition, having the CCID and the
ability to understand if the same entity is trading or trader
is trading across multiple broker-dealers. So those are two of
the biggest improvements and differences from what we have
today.
Senator Brown. Mr. Simon, do you want to add to that?
Mr. Simon. I think that the main benefits are the first
name in CAT, consolidated. It will be the first time there will
be a Consolidated Audit Trail of all the information from all
the securities markets. Currently, as I mentioned before, each
of the SROs has the obligation to conduct surveillance and
regulation of their market, and they are doing it from separate
databases. This will be consolidated. This will be the first
time that we have end-user information although in a masked way
through the CCID, which will enhance regulation and let you
move a lot more quickly in your surveillance obligations. And,
third, it is the first time we are going to have the life cycle
of an entire order included in the system so that you can
follow an order from the time it is entered through execution
and clearing. So there will be a lot of benefits to the
regulators in how they use this data.
Senator Brown. Ms. Bohlin, you were at FINRA 10 years ago
when the flash crash disrupted our market and undermined
investor confidence. Comment on the impact that the flash crash
had on working families' confidence then and still what kind of
impact it had on their confidence in using the markets to save
and invest for their futures.
Ms. Bohlin. So that is definitely an issue that has, you
know, broad impacts. Being here representing FINRA CAT today,
that might be FINRA, the parent, and any of the other SROs
might be able to more elaborate on that a little bit more. But
having a market, knowing that the market can go down and so
much value can be lost in such a short period of time, I think
other steps have been taken in addition to CAT that prevent
those wild swings, so to speak, like marketwide circuit
breakers, limit up/limit down, things that have been put in
place to try to prevent----
Senator Brown. That is what you are saying from your
perspective. What are people that are trying to save for their
future, what impact did that have on their confidence back then
and what kind of residue of that still remains?
Ms. Bohlin. Just my personal view on it is that having
uncertainty about the erratic movements or the fact that stocks
could lose so much value in such a short period of time
obviously is a detriment or may discourage people from
investing. So having the tools in place to try to prevent these
types of wild swings or have the tools we need to make sure we
understood what happened is very important.
Senator Brown. The point of the question was just to
encourage you to think about--I mean, you seem to do your job
well. You care about this. You understand the complexities and
technicalities that probably most of us here do not. But I just
want you to be thinking what completion of this, 2022 you cited
earlier, what this means for the confidence of the investor
public and pretty shaken a decade ago, maybe pretty forgotten
now, but it cannot be forgotten by you, and that is the
importance of--that was the reason for the question.
Ms. Bohlin. Yes, absolutely. That is why I personally
believe CAT is so important, and I have spent a lot of years
and I very much believe in it.
Senator Brown. OK, good. The bottom line is that markets
work best when investors have confidence, as we know, and the
Consolidated Audit Trail gives the opportunity to catch bad
actors so working Americans can be confident they are not
investing in a rigged market.
Ms. Bohlin. Exactly.
Senator Brown. Mr. Chairman, I would like to submit a
written statement for the record from Better Markets.
Chairman Crapo. Without objection.
Senator Brown. Thank you.
Chairman Crapo. Senator Cotton.
Senator Cotton. Thank you, Mr. Chairman.
I will say I detected a note of skepticism in the
Chairman's questioning. I will say that I will go beyond a
note. I have been outright skeptical of the Consolidated Audit
Trail now for a long time. I have to say what I have heard
today just made me downright opposed to it. I have got real
reservations about this.
Mr. Simon, I want to start with you. You said that so you
have made the decision, as Mr. Clayton suggested in his recent
letter to us, that you will not include Social Security
numbers, account numbers, or dates of birth in the Consolidated
Audit Trail?
Mr. Simon. We have submitted an exemption request to the
SEC asking them to grant that exemption so that we will not
include that in the Consolidated Audit Trail. It is now in the
hands of the SEC whether or not to grant that exemption. We
have a fair level of confidence that he will grant the
exemption since we work closely with the staff of the
Commission, with Judy, with the Advisory Committee, and with
the industry generally on a means of dealing with sensitive
personal information that we think satisfies the needs and
interests of the Commission and of the industry as well as the
regulators.
Senator Cotton. And did I hear you say that 25 different
organizations are going to have access to this information?
Mr. Simon. There are 23 exchanges, there is FINRA, and
there is the SEC. However, there are only eight specific
organizations because multiple exchanges are owned by one
holding company.
Senator Cotton. Any idea of the number of people that will
have access to this information?
Mr. Simon. Shelly will be able to answer that because she
is going through the user authorizations and it will vary. Some
of the SRO groups will contract out. Some will have their
surveillance obligations. Some will have a significant number
of people. But I think it is really FINRA and the SEC that will
have the most people, and some of the exchange groups will also
have a significant number of people----
Senator Cotton. Ms. Bohlin, I am not looking for an exact
number. I would just like an order of magnitude. Are we talking
about dozens? Hundreds? Thousands?
Ms. Bohlin. So the plan has estimates of 3,000 users, and
under our contract we are having to build to ensure we can
support access by 3,000 users. That would be across the SEC----
Senator Cotton. So 3,000 users will have access to every
trade from every account from every broker for every retail
investor in America?
Ms. Bohlin. Yeah.
Senator Cotton. So you are building the CCID, you said, so
Social Security numbers do not have to be used, but you said
that would be based on the Social Security number at the
broker-dealer. I know you talked about how good the audit trail
security is going to be. How confident are you that all those
broker-dealers, many of whom are small businesses, have equally
good security in their databases?
Ms. Bohlin. They are all required as registered broker-
dealers to maintain adequate security programs themselves.
Senator Cotton. And the audit trail will not be able to get
access to the underlying data. Do we think that, say, China or
North Korea will be able to get access to that underlying data?
Ms. Bohlin. We are certainly designing it so that is not
the case.
Senator Cotton. But this is my point, and let me be clear.
You all inherited this. Chairman Clayton inherited this. So I
do not doubt your good intentions. I think, Ms. Bohlin, you
said that the security of this information is your highest
priority. You have ``a strong data security plan.'' I would
just point out that the Office of Personnel Management and the
SEC probably thought they had the strongest data security plan
as well, Government agencies that suffered massive hacks that
exposed the information of millions of Americans, to say
nothing of companies like Equifax and Sony and Target and
Marriott and Yahoo. And I could go on and on and on even
further.
There is huge costs to this program. Chairman Crapo
outlined a bunch of the financial costs, billions of dollars up
front and then continued in operating expenses, to say nothing
of the cost of the personally identifiable information. It is
not clear to me what benefit market participants and Americans
at large get from having this in place. I know that
Commissioner Peirce has recently written that the Enforcement
Division at the SEC does a pretty good job of tracking down
wrongdoers, and they could probably get almost all of the
benefit out of the audit trail if they focused on large
institutional investors as opposed to a single mom who is
trying to invest money to save for their kid's college. So I
just do not see where the benefits outweigh the costs. The game
is worth the candle; the juice is worth the squeeze. I
appreciate you are doing everything you can to try to protect
the information of individual users, but you are creating a
database that is so large and so valuable and so attractive, I
cannot imagine that at some point in the future this Committee
is going to be having an oversight hearing on how a breach of
that database occurred.
Chairman Crapo. Thank you, Senator Cotton.
Senator Warner.
Senator Warner. Well, thank you, Mr. Chairman, and I
appreciate you holding this hearing. I actually beg to differ
with my friend, the Senator from Arkansas. There clearly are
inherent challenges in this, but I would make the case that I
do not think we still, almost 10 years after the flash crash,
fully appreciate what led to the flash crash, the ability of a
series of--and I do not think we are looking so much at the
individual investor as we are looking at the ability to have
market manipulation oftentimes by a series of very
sophisticated investors who may be operating across a whole
series of exchanges simultaneously. So there are clearly risks,
Mr. Chairman, in this, but to not have the ability to
reconstruct in a kind of orderly fashion how these type of
market manipulations could take place--and, frankly, I think
the technology has gotten even better in terms of manipulation.
So I actually applaud Chairman Clayton. I think he has taken on
this challenge. I think it is kind of crazy that it has taken
us 9 years to get here, and I think there clearly are market
forces and market participants who want to do everything
possible to slow this process down because they do not want
this Consolidated Audit Trail. They do not want their
activities demonstrated to the marketplace.
Now, we are going to obviously continue, Ms. Bohlin, to
kind of follow your efforts. I actually wish--and I think we
can get to a good-faith way to resolve some of these issues. I
wish the SEC was here because I think the SEC--you know, we
need their voice in this hearing. I would hope at some point,
Mr. Chairman, you would consider bringing them into this
discussion in a formal way so we can press them in particular.
Mr. Simon, one of the first questions I have got for you
is, recognizing that the SROs are going to have this ability to
access the database, should we require the SROs some kind of
formal explanation process of why they are requesting
information? It would not be an absolute guarantee, but it
might--one of the things I am concerned about is not only the
ability to be hacked into, but could the SROs access this
information for their own financial interests? And can we put
some kind of at least presumption that they have to give us an
explanation why they are accessing the database?
Mr. Simon. Well, it is clear under the rule and the plan
that the SROs can access this data only for regulatory purposes
and only for their surveillance purposes. The SROs already have
regulatory and surveillance programs in place that are subject
to barriers from the business side of the organization, and
those will remain in place, and those are subject to review not
only by the SROs and their internal audit department, but by
the SEC and their inspections unit, and they are heavily
regulated. And I think it is fair to say that the SROs operate
with integrity in the regulatory system. And, as shown by the
Consolidated Audit Trail that you have--while you might have
the 24 different SROs, they are effectively competitors with
each other. They are acting cooperatively for the joint good of
the industry in developing the Consolidated Audit Trail. But
Shelly and FINRA CAT are developing specific functions within
the CAT system to oversee what the regulators are doing and
what types of queries they are looking at and will have
intelligence in the system to help ensure that they are being
used for appropriate purposes. And perhaps you can talk to that
for a second, Shelly.
Ms. Bohlin. Sure. So part of the security program is
logging of all access, logging and review, both automated and
manually, looking for atypical queries coming from a particular
regulatory user. Also from an----
Senator Warner. Should we ask that SRO to kind of give an
explanation of why they are making this request? I am not sure
I agree 100 percent, but I would ask you to consider--I have
only got 38 seconds left. You know, one of the things I have
seen on kind of the SEC's amended 613 rule that they can start
to charge fines or expenses if the participants do not meet
certain of the timelines on a going-forward basis.
Mr. Simon. Right.
Senator Warner. I do have a concern that there are going to
be folks in the market that will drag their feet because they
do not want the CAT. They are going to throw up a lot of
concerns, and there are legitimate concerns about PII. But they
are going to throw up a lot of smoke screens, dragging their
feet because they do not want this kind of exposure. How do we
hold them accountable? Do you think the amended 613 rule does
that?
Mr. Simon. I think that Rule 613 does it. I think everybody
is working cooperatively in order to build the CAT in a timely
and efficient manner. I think, as Judy mentioned, that the
industry is now on board with the timeline.
And just to your point before about coming up with reasons
for doing inquiries, from a regulatory standpoint, you see
abnormalities in trading, and you do not really know what you
are looking for, and it is very difficult to say, ``I am
looking specifically for an insider trading violation'' or
this. You need to be able to look at the data, to analyze the
data, to see when there are atypical patterns in there. So I
think it is very difficult up front to put in a reason why
you----
Senator Warner. And I did not get a chance to ask you, Ms.
McDonald, but maybe you could submit for me some of the--you do
not have a vote on the Operating Committee. Are there
structural governance changes we can do to, you know, improve
this process.
Senator Warner. I would simply say, Mr. Chairman, you raise
I think appropriate questions about PII. I think there is a way
we can sort through this. I think the net benefit for
protecting the system will be of enormous value for oversight.
And I frankly think that some of the folks who are part of the
market manipulators, they have gotten substantially better
since 2010. So I think we have got a healthy tension here, but
I look forward to working with you. And I appreciate the
Ranking Member's comments at the front end in terms of how long
this has taken, and I completely agree with his earlier
comments.
Thank you, Mr. Chairman.
Chairman Crapo. Thank you.
Senator Rounds.
Senator Rounds. Thank you, Mr. Chairman.
I am just curious. I am going to start with Ms. McDonald,
but if you want to defer, you may. I understand the concerns
that have been expressed here by those individuals who are
doing their best to find a way to limit the amount of insider
trading and the type of trading activities that would hurt
consumers who want to trust in a market.
I also understand the concerns of the loss of privacy, and
somewhere in the middle of this, we have to be able in an
oversight capacity to look at trying to resolve both issues.
Ms. McDonald, I had the impression that your organization
has tried to do this, but specifically, can you share with us
the security that you look at and the approaches that you have
taken to try to make sure that the information which is being
picked up will be secure? And what do you do to track down and
to find problems that may already exist within the system? What
are you doing to rule it out and to make sure that any system
operating even today has not been compromised?
Ms. McDonald. So as Shelly stated----
Senator Rounds. You may want to turn that on.
Ms. McDonald. So as Shelly stated, I think that broker-
dealers are subject to both review by FINRA as well as adhering
to best practices with regard to security practices. And so
many broker-dealers, including SIG, have a very large and
robust security program that follows along the same lines that
have been outlined here. So basics of things like account and
identity management, multifactor authentication, granular role-
based access controls, and----
Senator Rounds. May I just--look, I appreciate that, but I
guess what I a looking at, and maybe I am not explaining it
very well, we require people to follow speed limits, but the
way that we also enforce it is then to have a patrol officer on
patrol that is checking to make sure. Who is the patrol officer
in this particular case to make sure that the security
requirements are actually being followed up? What is the
follow-up that you are doing today to assure security as of
right now? And perhaps Mr. Simon would like to answer that. You
may defer if you want.
Ms. McDonald. Broker-dealers are subject to review by FINRA
specifically around security programs, and so over the years,
FINRA has conducted increasingly sophisticated security audits
of their broker-dealer community, and these are conducted by
security experts who dig deep into both the process and
procedures and personnel behind these security programs.
Senator Rounds. Thank you.
Mr. Simon.
Mr. Simon. I think what you are getting at is policing the
security in the CAT system and who is responsible for that. Who
is overseeing the system and ensuring that whatever controls we
put in there are operational, that they are robust, and that
they are working. And that is the obligation of the CAT
Operating Committee, of the consortium of the SROs.
As Shelly mentioned and as I mentioned, we have hired a
CISO, the chief information security officer. He will be the
person who has the ultimate responsibility to implement and
oversee the security in the system. The CISO is an employee of
FINRA CAT, but is an officer at the CAT LLC, so he is going to
be responsible for implementing the security.
In addition, the SROs, through the consortium, have what we
call a ``security working group'' that is compromised of CISOs
and security experts from all the SROs. The SEC is an active
participant in that, including the SEC's chief security
officer. So they all work together, oversee all the policies,
work with the CISO, come up with the policies, including the
policing of the system once it is up and running. And any of
those policies have to come up to the Operating Committee, and
they come up again and again as they are amended and put in
place for approval by the Operating Committee. And at the same
time, we work with Judy and the Advisory Committee and with
SIFMA and a group of CISOs of the industry to make sure that
they are comfortable with the security policies. But,
ultimately, the buck stops with the Operating Committee. They
have the responsibility, and they are aware of it and are
working actively to ensure the safety and soundness of the
system.
Senator Rounds. What percent of the system is actually
operational today? How far along in the process is it today?
Ms. Bohlin. In terms of percentagewise?
Senator Rounds. Yes.
Ms. Bohlin. This is just, you know, a total back-of-the-
envelope. I would say maybe 50 percent, because you have the
exchanges----
Senator Rounds. Fifty, 5-0?
Ms. Bohlin. 5-0. We have the exchanges and----
Senator Rounds. OK. The reason why I ask is right now--how
many incursions do you know of that are attempted per day
within this particular segment?
Ms. Bohlin. For what is operational in FINRA CAT today?
Senator Rounds. Yes.
Ms. Bohlin. How many attempted intrusions there are each
day?
Senator Rounds. On a daily basis.
Ms. Bohlin. I would have to go back and get that
information for you. I do not have that number. I do know we
monitor that just as FINRA parent monitors it as well, so I
could get that information for you.
Senator Rounds. Yeah, I think it would be good to know,
number one, the number of attempts and also the number that
have actually successfully stepped into it.
Ms. Bohlin. So no actual successful attempts since FINRA
CAT has been operational. And like I noted before, we are
directly--FINRA CAT itself is an SCI entity directly, subject
to SEC jurisdiction and Reg. SCI. We have to file any time we
were to have an intrusion that was successful.
Senator Rounds. Mr. Chairman, I know I am going over my
time, but I just want to make this--you are saying that you
have 50 percent of your system operational today, and that
while you know that there are incursions attempted, you are not
aware of a single incursion that has been found within your
system at this point?
Ms. Bohlin. That has been successful--and I am not
personally aware of any intrusions that have been attempted. I
am assuming that there probably are because it happens all the
time. But I would want to get that specific information for
you. I am not aware of any successful intrusions, and we have
not had any SCI events that we have had to file since we have
been operational.
Mr. Simon. If there was an intrusion, we would have known
on the Operating Committee and would have had to report it
immediately to the SEC and put our breach procedures in effect.
And I am fairly certain--we will double-check and confirm with
you--there have been no successful breaches into the system.
Senator Rounds. Yes, I apologize for taking the extra time,
Mr. Chairman, but I think this is really important. Number one,
if the Secretary of the Navy puts out a report showing that
within the Department of Defense we get incursions, and we find
some of them, and we know that they occur. To suggest that you
have 50 percent of this thing operational right now today and
you are not aware of any incursions to date----
Ms. Bohlin. That have been successful.
Senator Rounds. ----that have actually successfully
occurred within your system, that is pretty impressive or it--I
would like to get a confirmation on that before you say that
that is a fact. OK?
Ms. Bohlin. Absolutely.
Senator Rounds. All right. Thank you.
Mr. Simon. We will.
Senator Rounds. Thank you.
Chairman Crapo. Thank you.
Senator Cortez Masto.
Senator Cortez Masto. Thank you, and also thank you to the
Chairman and Ranking Member for this hearing, and I do want to
align myself with some of the comments that were made by my
colleague from Virginia, Senator Warner.
Let me jump on this issue really quickly because I think
there is this balance. We want to protect PII information, but
at the same time I think we want to also protect against market
manipulation. And so maybe getting in the weeds a little bit
more, Mr. Simon, I am assuming that you have a formal
cyberincident response plan or at least the committees are
coming up with that, and maybe you want to address that,
because that will, I hope, give us the information publicly at
some point in time--or maybe not--that you are being asked by
Senator Rounds. So does anybody want to address that with
respect to a formal plan?
Mr. Simon. Yes, we do, and I will defer to Shelly from
FINRA CAT who is developing that as the head of FINRA CAT.
Ms. Bohlin. Yes, we definitely have a formal cyberincident
response plan, a very detailed plan. We have worked with the
SROs closely, and their expertise, the expertise that we have
from FINRA parent, who has a very mature system in place and
has very mature cyberincident response plans. We are in the
business of managing sensitive data. And that includes having,
you know, available to us experts in cybersecurity breach
management; that includes containment, forensic analysis of
what happened, responses, any appropriate notifications. Of
course, each depends on the facts and circumstances of any
particular incident of what you may or may not have to disclose
or do. It is a total facts and circumstances basis.
Senator Cortez Masto. And as part of your security, you can
ensure that all CAT data is encrypted at rest and in flight as
well. Correct?
Ms. Bohlin. Yes, fully end-to-end encryption at motion and
at rest, absolutely.
Senator Cortez Masto. OK. Thank you.
Can I jump back to also the conversation regarding the May
6, 2010, flash crash? Let me just ask you this: If the
Consolidated Audit Trail process were in place in 2010, would
the exchanges themselves been able to identify the cause of
that crash? My understanding is it took at least 5 years to
really figure out the cause of that crash and later determine
that a U.K. trader was arrested for placing fake trades that
melted the market. If the CAT process were in place, would the
information you have been able to uncover identified much
earlier, sooner, quicker, however you want to say it, and
figured out what was going on there?
Mr. Simon. Yeah, I think it certainly would have been much
easier, and we would have had a better database. And going back
to what Senator Brown said in the beginning and the confidence
in the market, the integrity and confidence in the market is
critical. And one of the biggest issues with the flash crash
was not just that it happened but how long it took to figure
out what did happen.
Senator Cortez Masto. Right.
Mr. Simon. We will have much better tools that are
available to identify the underlying customer. But the biggest
negative and detriment that we have is it is limited to the
securities and the options market. To the extent that there are
futures markets and CFTC markets, regulated markets that are
involved, they are not yet included in the Consolidated Audit
Trail. It would be great from a customer protection and
confidence and integrity standpoint to be able to integrate the
U.S. futures markets into the Consolidated Audit Trail as well
and potentially at some point the non-U.S. markets since we are
in a global market, both with respect to products and with
respect to geography. But it will be a very important first
step in getting there.
Senator Cortez Masto. Thank you. And thank you again for
being here. I appreciate the conversation.
Chairman Crapo. Thank you.
Senator Kennedy.
Senator Kennedy. Mr. Simon, is this going to stop flash
crashes?
Mr. Simon. No.
Senator Kennedy. Is this going to stop manipulation?
Mr. Simon. No.
Senator Kennedy. What is this going to do then?
Mr. Simon. This is going to help the regulators police the
markets after there is a flash crash and after there is
manipulation, to bring the wrongdoers----
Senator Kennedy. How often do we have a flash crash?
Mr. Simon. I am aware of one.
Senator Kennedy. OK. We are going to spend $4 billion to
implement it? Is that the right number?
Mr. Simon. That is a number that the SEC used early on. I
do not believe that number is currently correct.
Senator Kennedy. The SEC says it is going to cost $4
billion. Do you know how long it would take me to count to $4
billion?
Mr. Simon. A long time.
Senator Kennedy. A hundred-and-28 years. I would not make
it. None of us would. And it is going to cost another $2.1
billion to keep it up?
Mr. Simon. That is not my current estimate as to what the
cost will be to build or to operate.
Senator Kennedy. Do you think it can be done cheaper?
Mr. Simon. Yes.
Senator Kennedy. How much?
Mr. Simon. The current operating budget for the CAT LLC,
for the Operating Committee itself, just for the build and
operation and the ancillary efforts, is approximately $60 to
$75 million a year for the foreseeable future.
Senator Kennedy. OK.
Mr. Simon. That does not include, to be----
Senator Kennedy. Well, I have got to move on. My briefing
here from the SEC says $2.1 billion, you know, $75 million, and
this is not going to stop flash crashes, and it is not going to
stop manipulation, but you are going to have all this
information.
Ms. Bohlin, what are you going to do with it? Where are you
going to store it?
Ms. Bohlin. So the data will be stored in FINRA CAT's cloud
environment.
Senator Kennedy. Who runs the cloud? Is that Amazon?
Ms. Bohlin. AWS, Amazon Web Services.
Senator Kennedy. OK. So how much will the contract with
Amazon be? Senator Brown is very interested in this.
Ms. Bohlin. The specifics of those contracts are
confidential. I am happy to go back, just I would want to
consult with counsel.
Senator Kennedy. Well, you are going to have to tell us to
appropriate the money, right?
Ms. Bohlin. So in terms of funding perhaps, I do not think
it is an appropriation that----
Mr. Simon. No, the funding is coming--to date, the SROs
have paid every penny for the CAT out of their own pocket.
Eventually, we would like the----
Senator Kennedy. Who are the SROs?
Mr. Simon. The exchanges, 23 registered national securities
exchanges----
Senator Kennedy. And they are not going to pass that cost
on? I mean, this is not free money, right? Somebody is going to
pay Amazon.
Mr. Simon. It is an operating cost that the SROs and with
the industry, once we get fees in place, we will share the cost
and it ultimately will be a cost center for the----
Senator Kennedy. This is my first impression. Look, freedom
is risk. You cannot regulate away every risk. It is not going
to stop manipulation. It is not going to stop a flash crash. It
is going to help you understand better what happened. You
cannot understand what happened now? You went back and figured
out what happened in the one and only flash crash we have had,
haven't you, Ms. Bohlin?
Ms. Bohlin. Eventually, after quite some time and effort.
Senator Kennedy. That did not cost $4 billion, did it?
Ms. Bohlin. Not that I am aware of, no.
Senator Kennedy. OK. I mean, this sounds like something
Facebook would ask for, or Google. OK? You say 3,000 people are
going to have access to this information. Does that include the
Chinese?
Ms. Bohlin. No. That is just regulators----
Senator Kennedy. Does that include the North Koreans?
Ms. Bohlin. No.
Senator Kennedy. Or Russia?
Ms. Bohlin. No.
Senator Kennedy. OK. So we do not know how many people are
going to really have access to this.
Ms. Bohlin. Well, all of the access is through private
lines. You have to have a private line connection, so the
interfaces are in no way exposed to the Internet.
Senator Kennedy. I mean, I am trying--this is the way I am
approaching it, and I am hurrying because I have to be on the
floor. This is $4 billion, $2 billion to maintain it. Haven't
you looked at the cost-benefit analysis? We are running $22
trillion in the hole and climbing. Since we have been talking,
we borrow $1 million a minute to operate this place, $1.4
billion a day. I mean, why do you want to do this? I understand
it will give you real-time data and you can go in there and
look faster. But $4 billion, $2 billion to maintain it? We run
the risk that your data could be compromised. Have you ever
heard the expression, ``The cure is worse than the disease''? I
mean, next you are going to want our DNA. I just do not get it.
And I understand you are taking out the personal information,
and I am not against the good work that the SEC does. I think
Jay Clayton, he is a rock-and-roll star. But I just do not get
it. I just do not get it. And my time has been gotten, so I
have got to go.
[Laughter.]
Chairman Crapo. Thank you, Senator Kennedy.
Senator Van Hollen.
Senator Van Hollen. Thank you, Mr. Chairman. Thank you and
the Ranking Member and the witnesses here, and sorry I am
running a little later, and I understand some of my questions
have been covered, so I will get to the point. But I will say
that, Ms. Bohlin, we are pleased to have FINRA in the State of
Maryland, so thank you for what you do there on the job.
I want to pick up on a question that I think Senator Cortez
Masto covered with respect to a futures contract--I think she
mentioned the flash crash--and the question about whether the
CAT system will be able to capture those future contracts,
whether that is the intention, and if so, what the timeline is.
And I am happy to take an answer from any of the witnesses
here.
Mr. Simon. Yes, I will be happy to answer on behalf of the
consortium. We are building the CAT system that the SEC has
mandated, and the SEC obviously has jurisdiction only over the
equities and the options markets, so they have mandated that we
build the CAT to cover those products.
They specifically have asked for comment and are looking at
the inclusion of futures contracts, which obviously will be
necessary for a comprehensive surveillance of the financial
markets generally. That is a possible next step. We do not have
the timeline for that. That would require obviously cooperation
between the CFTC and the SEC in the development of such a
project along with the oversight committees in Congress.
Senator Van Hollen. Thank you. I mean, you would agree if
we do not capture futures contracts, that would be a big hole
in the system?
Mr. Simon. Yes.
Senator Van Hollen. So we need one way or another to make
sure that is included, right?
Mr. Simon. Yes. Right now we have our hands full through
2022 and getting the equities and the options markets in there.
But that is certainly something that we would have to address
thereafter.
Senator Van Hollen. And with respect to the concerns some
of my colleagues have raised about data security, because I
understand this will contain the second largest amount of data
of any system in the world, certainly in the United States,
what measures are being taken now at the front end to make sure
that we address the ever changing and increasing threat of
cyberattacks?
Mr. Simon. Let me address that from one angle and then have
Shelly address it from another. I think the first thing we can
do from an Operating Committee and consortium of the SROs is
try to make the database less attractive to hackers, and that
is why we have put in the exemption not to include Social
Security or tax identification numbers in there, not include
date of birth, and other types of similar personally
identifiable information. So if that information is not there,
we think it is a much less attractive target for a hacker. But
notwithstanding the lack of PII in the system, we understand
that there still will be a lot of data in there that may be
attractive, so, therefore, we have worked with the CISO at
FINRA CAT, with the industry, with the SEC to make sure that we
have absolute state-of-the-art security measures in place. And,
Shelly, you can quickly summarize those.
Ms. Bohlin. Sure, absolutely. The way that we approach it,
first of all, I will say that data security, cybersecurity is
FINRA CAT's top priority. That is very much our focus. And at a
very high level, we approach it with three very fundamental
components: people, process, technology, you have to have the
right people with the right experience, number one, very
critical. So our CISO, over 20 years of experience. We have all
of the exchanges' expertise, their CISOs, the industry's
expertise, and FINRA parent's expertise. So we cannot stress
enough technology is incredibly important, end-to-end
encryption, private lines, the regulator can only access via a
private line, MFA--multifactor authentication, the encryption.
So it is really a multifaceted system that is part of everyday
culture.
Senator Van Hollen. Thank you. The last question I have got
relates to concerns that some people have expressed about
potential conflict of interest because this is--the SEC, of
course, has a mandate to protect the public. This is an entity
made up of, you know, members who are participating in the
market, for-profit companies, some of whom I understand have
been previously fined by the SEC. So what can you do to assure
the public that this system will be run to protect the public
interests and avoid conflict of interest which seem to be
embedded in the structure in some ways?
Mr. Simon. As you are well aware, the Nation's securities
markets are based on a system of self-regulation so that the
markets that are operating, the exchanges and FINRA that
operate markets in one way or another also are responsible for
the regulation of those markets. That will not change in CAT.
All CAT will do is, very important, provide better surveillance
tools for the SROs that are responsible for ensuring the
integrity of their market through their self-regulatory
operations. But understanding that with the greater amount of
data in there and the more possibility that there is a misuse,
clearly the SEC has stated in the rule and it stated in the
plan that the data in the system can be used only for
regulatory and surveillance purposes, and Shelly and the FINRA
CAT team are putting together surveillance of the system
itself, of its use, just to see atypical patterns of use of the
data, to try to identify places where regulators may be
misusing the data.
So we are aware of the concerns. It is nothing new to the
securities industry or to the SROs and is something we are able
to and think that we will be able to police.
Senator Van Hollen. I appreciate that, and there are some
reports that the industry is actively trying to slow down this
effort because it would result in greater transparency, even
under the current system. Can you comment on that at all?
Mr. Simon. I will start and then turn it to Judy. As Judy
mentioned in her opening statement, we have an Advisory
Committee, and we are working closely with SIFMA, and everybody
in the industry and the SROs, at FINRA CAT, at the SEC are
working in a coordinated, cooperative fashion to make the CAT
successful.
Ms. McDonald. So the industry has had unprecedented
involvement--and that goes from the participation in the
Advisory Committee to the participation in the industry working
group, and broker-dealers collectively have logged many
hundreds of hours in the course of explaining work flows,
reviewing specifications, bringing concerns to the table. We
are doing this so that there is efficient and accurate
collection of data. I do not know how much more the industry
could actually put into this effort to make it successful,
because at the end of the day we are required by the exchanges
to do the reporting to CAT.
Senator Van Hollen. OK.
Mr. Simon. This is a cost and not--this is an expense and
not an income center for the industry and for the SROs, but
notwithstanding that, there has been really, in my experience,
an unprecedented level of cooperation among everybody in the
industry to make this successful.
Senator Van Hollen. OK. Thank you. Thank you, Mr. Chairman.
Chairman Crapo. Thank you, and that concludes our questions
today. I want to again thank the panel for coming. As you can
see, there is a strong understanding of the importance and the
benefits of CAT. There is also a very high level of concern
about the data collection and privacy impacts here, which I
share on both sides. And so I think we are far from where I
have a comfort level, and I think that is true for a number of
Members of the Committee. But we understand and appreciate the
efforts that are being undertaken to address these issues. I am
sure you will receive some additional questions from the
Members of the Committee who were not able to stay or be here,
and I encourage you to respond to them quickly. For those
Senators who do wish to submit questions for the record, those
questions will be due by Tuesday, October 29th. And as I always
do, I encourage you as the witnesses to respond as quickly as
you can to those questions. With that, thank you again. This
hearing is adjourned.
[Whereupon, at 11:11 a.m., the hearing was adjourned.]
[Prepared statements, responses to written questions, and
additional material supplied for the record follow:]
PREPARED STATEMENT OF CHAIRMAN MIKE CRAPO
Today's hearing will focus on oversight of the status of the
Consolidated Audit Trail, commonly referred to as the ``CAT''.
In 2010, in response to the Flash Crash and a number of other
market disruption events, the SEC proposed the creation of a real-time
tracking system to track securities orders across all markets
throughout the life cycle of the order--from origination, to routing,
cancellation, modification, or execution.
At the time, the SEC estimated the creation of the CAT would cost
$4 billion to launch and have ongoing maintenance costs of $2.1
billion.
In 2012, I wrote a letter requesting that the SEC consider
alternatives to establishing the CAT database, such as housing it on
FINRA's existing Order Audit Trail System, or OATS.
It has been 9 years since the SEC's initial proposal for the CAT
and after multiple challenges and delays it would appear that we have
arrived at a version of CAT that realizes real-time, less accurate data
is not necessary to the market function and that slightly delayed, more
accurate information significantly reduces costs while still preserving
the functional improvements CAT is intended to provide. Further, the
CAT now better leverages existing resources by recently selecting a
subsidiary of FINRA to be the plan processor.
I continue to have concerns about the costs associated with the
build, the volume of the information collected, what information will
be collected, who has access to the information collected, and how the
information will be secured.
Last year, Ranking Member Brown and I wrote a letter to SEC
Chairman Clayton that emphasized our bipartisan belief that protecting
individuals' personally identifiable information, or PII, is paramount
to the American people.
We have continued to seek a better understanding of what type of
PII is being collected, how that information is being used, who can
access it and how the data is secured and protected.
Chairman Clayton's September 9th statement echoed this sentiment
regarding the importance of protecting information collected and stored
in the CAT, particularly Social Security numbers, account numbers, and
dates of birth.
Chairman Clayton stated that he believes ``the regulatory
objectives of the CAT can still be achieved without these most
sensitive pieces of investor information.''
Last week, the SROs officially requested a modification to the CAT
NMS Plan to exclude the collection of dates of birth, Social Security
numbers, individual taxpayer identification numbers, and account
numbers.
This request is long overdue and I encourage the SEC to grant this
amendment which, I agree with the SROs, will reduce the risk profile of
the data collected and stored in the CAT while still preserving the
CAT's intended regulatory use.
In his September 9th statement, Chairman Clayton went on to say
that even if the SROs reduce the scope of the PII collected, the nature
of the data to be included in the CAT ``necessitates robust security
protections.''
I could not agree more and look forward to hearing from our
witnesses on how they plan to address these important issues from each
of their unique roles in the creation of the CAT.
I look forward to receiving an update from each of our witnesses on
outstanding issues and challenges that remain to achieving an
operational CAT.
I thank the witnesses for their willingness to appear today.
______
PREPARED STATEMENT OF SENATOR SHERROD BROWN
Thank you, Chairman Crapo, and welcome to our witnesses.
We are just shy of 200 days from the 10th anniversary of the 2010
flash crash. Although there hasn't been a market disruption of that
magnitude since, our markets have become faster, more sophisticated,
and more fragmented. In that time, industry has spent untold billions
on upgrading technology and developing faster and smarter trading
systems.
Yet the SEC, who we all rely on to maintain fair, orderly, and
efficient markets, still lacks a comprehensive system that would allow
it to effectively oversee the securities markets to protect Americans'
college savings and retirement funds.
In an industry where cutting-edge technology is the name of the
game and trading firms erect competing microwave towers so that
computers in Chicago can communicate with computers near Wall Street in
milliseconds, the SEC still cobbles together data from multiple sources
in an attempt to have a complete understanding of our markets.
This is why the SEC called on FINRA and the firms that run our
Nation's stock and options exchanges to build the Consolidated Audit
Trail, or CAT, one system with a beginning-to-end view of how trading
happens, so we can prevent insider trading, market manipulation, and
other misconduct that cheats the system.
When the effort began in 2012, it was a huge undertaking. But, 7
years later we are only at the first stage of data reporting, and many
details need to be finalized. Under the current timeline, the system
will not be fully operational until 2022.
Some take issue with the SEC, or any Government agency, having this
much data and call the system a target for hackers.
I refuse to accept that we can't both protect people's personal
information, and go after criminals who take advantage of our markets.
I know there are dozens of technology experts, data scientists, and
market veterans working on this. Just last week, the CAT operating
committee submitted to the SEC its proposal to exclude Social Security
Numbers and other personal information from the reported data.
That is just one of many creative solutions that balance the need
for oversight with protecting sensitive information.
I trust the very capable minds at the exchanges, FINRA, and the SEC
can work out access to data concerns, tracking the use of the audit
trail, and how to keep information secure to allow this long overdue
oversight tool to be completed.
The bottom line is--if you are smart enough to have information or
strategies you think someone wants to steal, then you are smart enough
to help come up with ways to protect them.
And we can't afford to wait.
Just last week, the SEC filed charges against 18 people, most of
them in China, who engaged in a 6-year market manipulation scheme using
dozens of accounts, across many brokerage firms, that resulted in 31
million dollars of illicit profits.
While we'll never know if the new system would have made it easier
to uncover those crimes, it is that kind of activity that the SEC
should have the technology to uncover.
We also know that the question isn't if but when there will be
another crash or major disruption. Everyone--Main Street, industry, and
Congress--will look to those represented by our panelists today and the
SEC to understand what happened, how it will be fixed, and who was
responsible. Not having an answer, or waiting 5 months for one, will be
unacceptable.
If another flash crash happens, or the delays or disagreements over
what should be solvable questions continue, you can expect to be back
before this Committee. We are expecting you all to cooperate and work
diligently to finish the CAT project.
There are not many things that SEC Chair Clayton and I agree on,
but finishing the CAT without further delay is one of them.
Every day we wait creates more risks for our markets and more
opportunities for criminals to cheat our regulatory system.
Thank you, Mr. Chairman.
______
PREPARED STATEMENT OF SHELLY BOHLIN
President and COO, FINRA CAT LLC, Financial Industry Regulatory
Authority
October 22, 2019
Chairman Crapo, Ranking Member Brown, and Members of the Committee:
On behalf of FINRA CAT, LLC, a subsidiary of the Financial Industry
Regulatory Authority, or FINRA, I would like to thank you for the
opportunity to testify today. I serve as the President and Chief
Operating Officer of FINRA CAT, LLC, and I welcome the Committee's
invitation to discuss specific details of FINRA CAT's work as the Plan
Processor of the Consolidated Audit Trail, or CAT, since FINRA CAT
stepped into the role 6 months ago.
The CAT is designed to be a centralized source of information on
activity in the equities and listed options markets. The Securities and
Exchange Commission (SEC) adopted Rule 613 in the wake of the 2010
flash crash to require the CAT to be created. The SEC explained at the
time that the purpose of the CAT is to create a comprehensive
consolidated audit trail that allows regulators to efficiently and
accurately track all activity in these securities throughout the U.S.
markets to facilitate comprehensive market reconstructions, more robust
market surveillance, and better analytics to support policymaking. \1\
Given the size and complexity of the financial markets, the CAT must
collect, process, and store a vast amount of data to achieve this goal.
This is a highly complex project that requires deep technological
expertise, sophisticated and proactively evolving security, close
regulatory coordination with the SEC and the consortium of self-
regulatory organizations (SROs) responsible for managing the CAT (SRO
consortium), \2\ and full-time engagement with broker-dealers that
ultimately must report data to the CAT.
---------------------------------------------------------------------------
\1\ See Securities Exchange Act Release No. 67457 (July 18, 2012),
77 FR 45722 (August 1, 2012) (SEC adopting release for Rule 613 to
require the national securities exchanges and FINRA to file a national
market system (NMS) plan for the creation, implementation, and
maintenance of the CAT).
\2\ The 24 participants currently in the consortium are: BOX
Exchange LLC; Cboe BYX Exchange, Inc., Cboe BZX Exchange, Inc., Cboe
EDGA Exchange, Inc., Cboe EDGX Exchange, Inc., Cboe C2 Exchange, Inc.
and Cboe Exchange, Inc.; FINRA; Investors Exchange LLC; Long-Term Stock
Exchange, Inc.; Miami International Securities Exchange LLC, MIAX
Emerald, LLC, MIAX PEARL, LLC; NASDAQ BX, Inc., Nasdaq GEMX, LLC,
Nasdaq ISE, LLC, Nasdaq MRX, LLC, NASDAQ PHLX LLC, The NASDAQ Stock
Market LLC; and New York Stock Exchange LLC, NYSE American LLC, NYSE
Arca, Inc., NYSE Chicago, Inc. and NYSE National, Inc.
---------------------------------------------------------------------------
The CAT NMS Plan was filed with the SEC by the SRO consortium to
meet the SEC's Rule 613 requirements, and the Plan was approved by the
SEC on November 15, 2016. \3\ FINRA CAT began serving as the CAT Plan
Processor in April of this year after being selected by the SRO
consortium to build and operate the CAT system. Since our selection,
FINRA CAT has been performing these functions on a contract basis for
the SRO consortium, in accordance with the consortium's CAT NMS Plan.
---------------------------------------------------------------------------
\3\ See https://www.sec.gov/rules/sro/nms/2016/34-79318.pdf.
---------------------------------------------------------------------------
FINRA CAT appreciates that there is interest in the CAT from
multiple perspectives. The CAT is an important tool that must be built
properly so that the market regulators--including the SEC, FINRA, and
the national securities exchanges--can use it as intended to
efficiently and accurately track all activity in the U.S. securities
markets. In addition, given the importance of sensitive information to
the success of the CAT in achieving its goals, its security is of
paramount concern to the regulators, to industry members who will
report data to the CAT, to investors, and to the public.
FINRA CAT is fully committed to serving these interests. The
leadership and staff of FINRA CAT have significant experience in
developing audit trail technology and utilizing it for regulatory
purposes. In addition, FINRA CAT has access to the full resources of
FINRA and its long, successful work in this area, expertise that has
been valuable in the months since FINRA has been tasked with the
development of the CAT. With this support, FINRA CAT's work to build
the CAT is on schedule. FINRA CAT also is committed to receiving input
from all stakeholders so that it may serve its role most effectively.
Close engagement with the SROs, SEC, industry stakeholders, the public,
and Congress is critical to FINRA CAT's efforts and the efforts of the
SRO consortium.
Transition to FINRA CAT
After FINRA was selected by the SRO consortium to succeed the
former Plan Processor, FINRA CAT, a subsidiary of FINRA, was created to
focus solely on performing the functions of the Plan Processor. \4\
---------------------------------------------------------------------------
\4\ While FINRA is a member of the consortium, FINRA recused
itself and did not take part in the selection decision.
---------------------------------------------------------------------------
Importantly, FINRA CAT is a regulated entity. FINRA CAT is part of
FINRA's parent SRO umbrella and accordingly an ``SCI Entity.'' \5\ This
means that while FINRA CAT serves as a contractor for the SRO plan
participants and is not a CAT NMS Plan participant itself, FINRA CAT
nevertheless is subject directly to the SEC's jurisdiction, including
Regulation Systems Compliance and Integrity (Reg SCI). FINRA CAT's
status as an SCI Entity ensures direct accountability--both to the SRO
plan participants and to the SEC--for important issues like system
security, integrity, capacity, and business continuity.
---------------------------------------------------------------------------
\5\ See https://www.sec.gov/rules/sro/finra/2019/34-85764.pdf.
---------------------------------------------------------------------------
While FINRA CAT is part of FINRA's parent SRO umbrella and
supported by FINRA resources, FINRA CAT is a distinct corporate
subsidiary with controls in place to create sufficient separation from
FINRA operations where needed and appropriate. We have built out a
dedicated FINRA CAT operations staff led by me and a Chief Technology
Officer. We also hired, with the approval of the SRO consortium, a
Chief Information Security Officer (CISO) and a Chief Compliance
Officer (CCO). These officers are responsible, respectively, for FINRA
CAT's information technology security and governance and regulatory
compliance programs. These two positions also owe fiduciary duties to
the SRO consortium, as specified in the CAT NMS Plan. \6\
---------------------------------------------------------------------------
\6\ See Section 4.6(a) of the CAT NMS Plan, available at https://
catnmsplan.com/wp-content/uploads/2019/09/CAT-2.0-Consolidated-Audit-
Trail-LLC%20Plan-Executed-(175745081)-(1).pdf.
---------------------------------------------------------------------------
Since becoming the Plan Processor in April, FINRA CAT has worked
closely with the SRO consortium and SEC staff to expeditiously put in
place a solution for the first scheduled phase of the CAT--
specifically, the collection and processing of order and trade data
from the equities and options exchanges and FINRA. \7\ For equities,
FINRA CAT has been able to leverage existing data feeds the exchanges
currently provide to FINRA, and in June, FINRA CAT deployed a
significant technology release to ingest and validate newly reported
options data from the options exchanges. FINRA CAT has used scalable
technology to process, on average, over 100 billion market records a
day during this period with no material operational issues or delays.
---------------------------------------------------------------------------
\7\ For purposes of CAT reporting, FINRA data includes information
about activity in the over-the-counter markets reported to FINRA's
Trade Reporting Facilities, Alternative Display Facility, and Over-the-
Counter Reporting Facility. More information can be found on
www.finra.org.
---------------------------------------------------------------------------
This current quarter, FINRA CAT will be finishing the development
of analytical tools that allow the SEC and SRO plan participants, as
regulatory users of the CAT, to analyze and run complex queries on the
CAT data. In addition, these tools will include functionality that
allows regulatory users to see visual displays of the consolidated
equity market order book for any given period of time. An example of
this is the delivery of multifactor authentication, an important
security enhancement, months ahead of its originally planned
implementation date of May 2020.
Upcoming Milestones--Industry Member Reporting to CAT
At the same time that FINRA CAT has been working to implement the
first phase of CAT data reporting from plan participants, we also have
been dedicating substantial resources to preparing for the next stage-
industry member reporting, which is scheduled to be phased in from
April 2020 to July 2022. \8\
---------------------------------------------------------------------------
\8\ See https://catnmsplan.com/timelines/.
---------------------------------------------------------------------------
Looking ahead, large and small firms that currently report similar
audit trail data to FINRA's existing Order Audit Trail System (OATS)
will begin reporting equities data in April 2020, followed by large
firm reporting of options data in May 2020. Small firms that do not
currently report to OATS are scheduled to begin reporting in December
2021. Initially, industry member data will be limited to information
concerning order and trade events. After a number of interim phases
that will require the reporting of increasingly complex order and trade
information, the final phase of industry member reporting--as currently
contemplated by the SEC-approved CAT NMS Plan--calls for certain
customer and account information reporting beginning in July 2022.
Prior to each new reporting phase, there will be mandatory test periods
to promote compliance for the broker-dealers reporting data to the CAT.
FINRA CAT continually looks for opportunities to accelerate the
timeline where possible.
Achieving these reporting milestones requires significant effort
from all parties. FINRA CAT is involved in full-time industry
engagement through a variety of channels. FINRA CAT has worked with the
consortium and CAT stakeholders to publish lengthy guidance on a
variety of industry reporting scenarios, a schema for industry member
reporting, and final technical specifications for the initial industry
reporting phases. \9\ FINRA CAT and the SRO participants provide
frequent presentations to the industry, which are archived on the SRO
consortium's dedicated CAT NMS Plan website. \10\ FINRA CAT also
maintains a fully staffed Help Desk to maintain an open line of
communication.
---------------------------------------------------------------------------
\9\ See https://catnmsplan.com/technical-specifications/
index.html.
\10\ See https://catnmsplan.com/news-page/index.html.
---------------------------------------------------------------------------
Active broker-dealer participation and feedback is a critical part
of this engagement, as the success of CAT requires effective broker-
dealer implementation of the CAT reporting requirements. There are a
number of industry representatives involved in the governance of the
CAT NMS Plan through their participation on an advisory committee
established by the CAT NMS Plan. \11\ A group of industry
representatives join a weekly working group discussion that FINRA CAT
cochairs with the consortium to identify and resolve interpretive
questions. With the help of this weekly discussion forum, FINRA CAT and
the SRO consortium have published answers to numerous frequently asked
questions and continue to answer new questions regularly. \12\
---------------------------------------------------------------------------
\11\ See Section 4.13 of the CAT NMS Plan, available at https://
catnmsplan.com/wp-content/uploads/2019/09/CAT-2.0-Consolidated-Audit-
Trail-LLC%20Plan-Executed-(175745081)-(1).pdf.
\12\ See https://catnmsplan.com/faq/index.html.
---------------------------------------------------------------------------
Active SEC involvement is critical as well. Each week, FINRA CAT
hosts a call with SEC staff and the SRO plan participants to provide an
update on project development and progress. FINRA CAT appreciates the
time, investment, and insight provided by the SEC staff on all aspects
of the CAT, and FINRA CAT has been happy to report so far that its work
is on schedule.
FINRA CAT recognizes that challenges are sure to arise throughout
the industry phase-in. Prior to becoming the Chief Operating Officer of
FINRA CAT, I worked for 25 years with FINRA's market regulation
program, including on the successful multiphase implementation of
FINRA's OATS reporting requirements. Today, FINRA combines OATS data
with other regulatory data to process on average more than 78 billion
records a day. As I and my FINRA CAT colleagues draw on our extensive
prior experience with audit trail implementation, we welcome dialogue
with the industry and all CAT stakeholders, particularly as we
encounter new challenges unique to CAT reporting and prepare CAT to
support regulators' efforts to retire existing systems like OATS.
Security and Customer Identifying Information
Under the current CAT NMS plan approved by the SEC in 2016, \13\
industry members will be required to report certain customer
identifying information, including account numbers and some personally
identifying information, or PII. While we recognize the ongoing policy
discussions related to the necessity of specific elements of PII to the
success of the CAT, those requirements are ultimately matters the SRO
consortium and the SEC must determine. However, I can assure the
Committee that the security of PII, and of all CAT data more broadly,
is of the utmost priority to FINRA CAT, and I can address the data
security program that FINRA CAT has put in place to meet the CAT NMS
Plan's requirements.
---------------------------------------------------------------------------
\13\ See https://www.sec.gov/rules/sro/nms/2016/34-79318.pdf.
---------------------------------------------------------------------------
In terms of FINRA CAT's overall information security program, we
are led by a CISO who was approved by the SRO consortium who is also
its fiduciary. Our CISO has over 20 years' experience working on
information security at FINRA, including as a security architect and
security engineer. The CISO is supported by a dedicated team of
security analysts who ensure that security controls are effectively
implemented, monitor the security of the CAT System and respond to
anomalies, evaluate and approve access, enforce compliance with
security policies and standards including National Institute of
Standards and Technology (NIST) Special Publication (SP) 800-53, and
evaluate evolving threats and security control opportunities to ensure
that the CAT security posture remains strong. In addition, the FINRA
CAT security team is able to leverage the security expertise and
advanced technology solutions that FINRA has invested heavily in over
the years, including the people, process, and technologies it has
developed and deployed to operate a secure cloud environment that is
comparable in scale to the fully deployed CAT solution. As the SRO
consortium recently discussed in a presentation to the industry, the
FINRA CAT security program includes significant layers of
architectural-level security controls and program-level security
controls. \14\ Examples of architectural controls include secure
infrastructure for connecting to the CAT system and architectural
separation between transaction data and PII. Examples of program
controls include a full suite of information security policies,
procedures, and standards, as well as regularly scheduled independent
third-party system penetration testing, code reviews, and security
control validation.
---------------------------------------------------------------------------
\14\ See https://catnmsplan.com/news-page/cat-industry-webcast-
recording-08-28-19/.
---------------------------------------------------------------------------
The extensive FINRA CAT security policies address a range of issues
required by the CAT NMS Plan, including data storage and handling,
insider risk, data connectivity and transfer, incident management,
security logging and monitoring, and account management. FINRA CAT's
security program is based on work product developed by the FINRA CAT
CISO in coordination with a security working group made up of CISOs and
security experts from each of the SRO plan participants.
Each CAT System release is subject to the granting of an Authority
To Operate (or ATO) by the SRO consortium. To obtain an ATO from the
consortium, the CAT CISO presents a package of materials to the
security working group that demonstrates the strength of the CAT
System's security posture. This package includes the system security
plan, internal and third-party security testing reports, and an
independent validation and verification report confirming that security
controls are aligned with the NIST industry standards followed by the
Federal Government. \15\
---------------------------------------------------------------------------
\15\ See https://catnmsplan.com/news-page/cat-industry-webcast-
recording-08-28-19/.
---------------------------------------------------------------------------
FINRA CAT understands concerns that continue to be raised about the
inherent risk of handling CAT data, particularly PII. Even with the
enhanced architectural and program controls required by the plan for
PII--such as containing PII in its own separate system with restricted
access--there may be policy questions for the SEC and SRO consortium to
discuss about the costs and benefits of collecting and storing
sensitive personal data.
FINRA CAT's job is to support the regulators' decision making on
this issue. This includes making any modifications to the system design
to account for current discussions between the SEC, the SRO consortium,
and the industry. As SEC Chairman Clayton recently noted before the
House Financial Services Committee, the SROs are refining the details
of a recommendation to eliminate Social Security numbers, account
numbers, and dates of birth from the CAT, filing a request last week
with the SEC to formalize the modified approach. \16\ FINRA CAT
continues to work closely and productively with the SEC and the SROs to
ensure that it has the right technological solution in place for when
customer and account information reporting begins in July 2022.
---------------------------------------------------------------------------
\16\ See Letter from Michael Simon, CAT NMS Plan Operating
Committee Chair, to Vanessa Countryman, SEC, Request for Exemptive
Relief from Certain Provisions of the CAT NMS Plan related to Social
Security Numbers, Dates of Birth, and Account Numbers (Oct. 16, 2019),
available at https://www.catnmsplan.com/wp-content/uploads/2019/10/
CCID-and-PII-Exemptive-Request-Oct-16-2019.pdf.
---------------------------------------------------------------------------
Conclusion
Thank you again for the opportunity to appear today. The CAT is a
major regulatory undertaking meant to help the SEC, FINRA, and the
exchanges better regulate our securities markets. FINRA CAT recognizes
the role it must play as the CAT Plan Processor to make the CAT fully
operational and secure. We are on target to complete the build on time
and in line with the strict data security protocols established in the
SEC-approved CAT NMS Plan. We look forward to our continued
collaboration with Congress, the SRO consortium, the SEC, market
participants, stakeholders and the public as we work to achieve the
project's goals.
______
PREPARED STATEMENT OF JUDY MCDONALD
Chair, CAT NMS Plan Advisory Committee
October 22, 2019
My name is Judy McDonald, I am the head of Regulatory Technology at
Susquehanna International Group, LLP (SIG), a global quantitative
trading firm headquartered in Bala Cynwyd, PA. In my role at SIG I have
been evaluating the Consolidated Audit Trail (CAT) NMS Plan since its
inception and participated in the CAT Development Advisory Group prior
to the Plan Processor selection. Since February 2017, I have served
along with 13 other industry participants on the Advisory Committee,
and since March 2019 have served as the Chair of the Advisory
Committee.
Today I can confidently state that the effort to deliver CAT is
moving forward in a very positive manner. Since February 2019, when
FINRA CAT became the new Plan Processor, the Self Regulatory
Organizations (SROs), FINRA CAT and industry members have been in a
virtuous cycle of iterative deliverables and collaboration on the Plan.
FINRA CAT brings subject matter expertise, depth of resources, and
leadership to the effort. These capabilities have resulted in
improvements ranging from well written policies and procedures, to
capable project management, to delivery on portions of a large,
complex, distributed system.
The Advisory Committee is satisfied that the intermediate
milestones of the past year have been met and that significant progress
has been made toward processing SRO reporting and the completion of
industry member technical specifications for the first equity and
option reporting phases.
However, there are a few areas of concern as the implementation of
CAT progresses,
1. Data Security. This is undoubtedly the most significant concern
as the CAT will gather and store an unprecedented amount of information
that previously has not been centrally located nor specifically
identifiable. The concerns can be broken down into three categories:
(a) Trading records for institutions, (b) Personally Identifiable
Information (PII) for retail customers, and (c) the Security Policies
of the regulators:
Trading Records
There is significant concern about the security of the CAT data
repository and the misuse of trading records by those with
``authorized'' access. Trading records will be less secure than PII and
accessible by a broader set of individuals. This highly proprietary
information results from significant investments, and Broker-Dealers
(BDs) are very concerned that trading strategies could be reverse-
engineered by competitors, by academics, or by rogue actors. Further,
SROs compete with each other and BDs; this is beneficial to investors
and could be compromised with the misuse of data.
PII Data
We are encouraged by the progress to avoid the collection of Social
Security numbers and other sensitive PII data. With this progress we
believe some focus should be shifted to address the retirement of the
legacy Electronic Blue Sheet (EBS) system, which currently collects PII
data and is less secure than CAT.
Security Policies
The Advisory Committee has little insight into the security
programs at the regulators and whether security policies and procedures
have changed commensurate with the increased value of the CAT data and
the increased threat of compromise. We cannot emphasize enough the harm
that could come from an external bad actor gaining access to trade
information once data is bulk downloaded from the central FINRA CAT
repository.
In summary, I appreciate the critical nature of securing CAT data.
Two of the best ways to achieve data security is to limit the number of
people with access and to control the use of the data as tightly as
possible. The Advisory Committee urges reconsideration of allowing the
22 exchanges and the SEC to bulk download CAT data.
2. Verbal and Manual Quotes. There is a significant open issue with
respect to the capture and reporting of verbal and manual quotes. Human
interaction with highly electronic markets is a deeply challenging
issue that affects a small but very important part of the market and if
disrupted, could dramatically reduce market liquidity particularly
during periods of extraordinary volatility. The Advisory Committee
recommends a stepwise approach for reporting verbal and manual quotes.
3. Fees. Another area of concern is the current lack of insight
into fees that may be applied to BDs. The absence of a fee schedule
creates uncertainty around the effort and unnecessarily challenges
firms budgeting to comply with CAT. It also raises the concern of
chasing more firms out of business and imposing yet another barrier to
entry, all to the detriment of market liquidity and competition.
4. The SEC Proposal for Financial Accountability Milestones. The
SEC proposal centers on the best-practice goals of increasing
accountability and transparency of the CAT project. While we are
supportive of these goals, legitimate unforeseen circumstances may
occur where fixed deadlines work against the collective best interest
of the CAT implementation. There must be some flexibility in place to
address unforeseen situations.
In closing, I look forward to continuing my work on the CAT project
and will be happy to address any specific questions you have.
______
PREPARED STATEMENT OF MICHAEL J. SIMON
Chairman, CAT NMS Plan Operating Committee
October 22, 2019
I. Introduction
Chairman Crapo, Ranking Member Brown, and Senators of the
Committee, thank you for the opportunity to testify before you today
about the progress made on developing the Consolidated Audit Trail
system (``CAT System'' or ``CAT''). As you are aware, the national
securities exchanges and the Financial Industry Regulatory Authority
(FINRA) (as the only national securities association) are developing
and operating the CAT System as Participants \1\ to the National Market
System (NMS) Plan Governing the CAT (the ``Plan''). \2\ The Securities
and Exchange Commission (``SEC'' or ``Commission'') mandated both the
Plan and the CAT System through adoption of Rule 613 of Regulation NMS.
\3\
---------------------------------------------------------------------------
\1\ The 24 Participants are: BOX Exchange LLC; Cboe BYX Exchange,
Inc., Cboe BZX Exchange, Inc., Cboe EDGA Exchange, Inc., Cboe EDGX
Exchange, Inc., Cboe C2 Exchange, Inc. and Cboe Exchange, Inc.; FINRA;
Investors' Exchange LLC IEX; Miami International Securities Exchange
LLC, Long-Term Stock Exchange, Inc.; MIAX Emerald, LLC, MIAX PEARL,
LLC; NASDAQ BX, Inc., Nasdaq GEMX, LLC, Nasdaq ISE, LLC, Nasdaq MRX,
LLC, NASDAQ PHLX LLC, The NASDAQ Stock Market LLC; and New York Stock
Exchange LLC, NYSE American LLC, NYSE Arca, Inc., NYSE Chicago, Inc.
and NYSE National, Inc.
\2\ National Market System Plan Governing the Consolidated Audit
Trail, Section 1.1 available at https://www.catnmsplan.com/wp-content/
uploads/2019/09/CAT-2.0-Consolidated-Audit-Trail-LLC%20Plan-Executed-
(175745081)-(1).pdf [hereinafter the ``Plan''].
\3\ Consolidated Audit Trail Adopting Release, Exchange Act
Release No. 67,457, 77 FR 45,722 (Aug. 1, 2012) [hereinafter ``Rule 613
Adopting Release''].
---------------------------------------------------------------------------
Described broadly, the CAT requires Participants, and will require
broker-dealers (Industry Members), to submit information to the CAT
System related to the inception, routing, cancellation, modification,
or execution of an order. \4\ When completely implemented, the CAT
System will receive, validate, and process such data to create life
cycles of orders across the markets. The Participants and the SEC will
use the CAT System solely for regulatory purposes, querying the CAT
System to facilitate their oversight of the securities markets and to
help them fulfill their obligations under the Federal securities laws.
As noted in Rule 613, the Commission expects the Participants and
Industry Members to share in the costs of the CAT, and the Plan
includes a funding model consistent with the cost-sharing requirement
of Rule 613. \5\
---------------------------------------------------------------------------
\4\ See generally Plan, supra note 2 (outlining the requirements
of the CAT System).
\5\ See Regulation NMS, 17 CFR 242.613(a)(1)(vii)(D) (2019).
---------------------------------------------------------------------------
There has been significant interest in the CAT. Understandably,
much of this interest has centered around the extent to which the
system will include personally identifiable information (PII), the
security of the system more generally, as well as the cost of the
system. Before discussing these issues, I'd like to provide a little
background on the CAT, tell you a little about the structure of the
project and my role, and give you an update on the progress of the CAT
System.
a. Background on CAT
By way of background, the Commission conceived of and ultimately
mandated the CAT System to more effectively and efficiently conduct
cross-market supervision of trading activity. \6\ The Commission has
explained that the regulatory data infrastructure the Commission, the
exchanges and FINRA currently rely on is outdated, inconsistent, and
inadequate to effectively oversee a complex, dispersed, and highly
automated national market system. \7\ Upon complete implementation, the
CAT system will provide a number of significant benefits, including:
(i) consolidated trading information across all markets and (ii) the
ability to identify the trading of specific end-customers.
---------------------------------------------------------------------------
\6\ See Rule 613 Adopting Release, supra note 3 at 45,723.
\7\ See id. at 45,723; Joint Industry Plan; Order Approving the
National Market System Plan Governing the Consolidated Audit Trail,
Exchange Act Release No. 79,318, 81 FR 84,696, at 84,697 (Nov. 23,
2016) [hereinafter ``CAT NMS Plan Adopting Release''].
---------------------------------------------------------------------------
One practical example of limitations of current regulatory data
relates to regulators' ability to reconstruct and analyze market
events. \8\ According to the Commission, the lack of direct access to
audit trail data resulted in the Commission's inability to quickly and
efficiently reconstruct market events during the financial crisis in
2008 and the ``Flash Crash'' \9\ in 2010. \10\ In proposing SEC Rule
613, the Commission noted that while the existing audit trail
information assisted the staffs of the SEC and the self-regulatory
organizations in their regulatory responsibility to surveil for
compliance with self-regulatory organization rules and the Federal
securities laws and regulations, it believed that existing audit trails
were limited in their scope and effectiveness in varying ways. \11\
---------------------------------------------------------------------------
\8\ See Consolidated Audit Trail Proposing Release, Exchange Act
Release No. 62,174, 75 FR 32,556, at 32,557 (June 8, 2010) [hereinafter
``Rule 613 Proposing Release''].
\9\ On May 6, 2010, the prices of many U.S.-based equity products
suddenly plummeted and recovered almost as quickly. This event is
referred to as the ``Flash Crash''. The Commission, along with the
Commodity Futures Trading Commission, undertook an analysis of the
Flash Crash. The Commission has explained that the available data
``hindered staff in determining what happened to liquidity before,
during, and after the Flash Crash. Two major problems were the
inability to identify and eliminate duplicate orders from the data and
the inability to accurately sequence events across the multiple data
sources.'' Rule 613 Adopting Release, supra note 3 at 45,732.
\10\ CAT NMS Plan Adopting Release, supra note 7 at 84,834 n.
2246.
\11\ See Rule 613 Proposing Release, supra note 8 at 32,563-568.
---------------------------------------------------------------------------
To address this need, in August, 2012, the Commission adopted Rule
613 \12\ requiring the Participants to submit an NMS plan to create,
implement, and maintain a consolidated audit trail for orders in NMS
Securities. \13\ The Commission mandated that the Plan address activity
across all markets, from the time of order inception through routing,
cancellation, modification, execution, and allocation, in accordance
with the requirements of Rule 613. In September, 2014, the Participants
submitted an initial proposed NMS plan to the Commission. \14\ Over the
course of more than 2 years, the Participants filed two amendments to
the initial NMS plan; upon publication, the SEC received dozens of
comment letters on the proposed NMS plan from across the industry, \15\
many of which focused on the security of the CAT System. In addition to
NMS Securities mandated by Rule 613, the Participants also determined
to include OTC Equity Securities (NMS Securities and OTC Equity
Securities collectively are ``Eligible Securities'') within the initial
scope of the CAT. \16\ The Participants proposed this to allow for a
more expanded audit trail and to facilitate an expedited retirement of
OATS (which applies to OTC Equity Securities as well as NMS stocks) as
duplicative to CAT. In November 2016, the Commission unanimously
approved the amended Plan developed by the Participants in accordance
with the requirements of Rule 613. \17\
---------------------------------------------------------------------------
\12\ See Rule 613 Adopting Release, supra note 3.
\13\ For purposes of the Plan, ``NMS Securities'' are defined as
``any security or class of securities for which transaction reports are
collected, processed, and made available pursuant to an effective
transaction reporting plan, or an effective national market system plan
for reporting transactions in Listed Options.'' See Plan, supra note 2
at Section 1.1.
\14\ See Initial National Market System Plan Governing the
Consolidated Audit Trail available at https://www.catnmsplan.com/wp-
content/uploads/2018/02/p600989.pdf. The Participants worked with the
Development Advisory Group (DAG), which consisted of broker-dealer
representatives, to solicit industry feedback when creating the Plan.
\15\ See Securities and Exchange Commission File No. 4-698
available at https://www.sec.gov/comments/4-698/4-698.shtml.
\16\ For purposes of the Plan, ``OTC Equity Securities'' are
defined as ``any equity security, other than an NMS Security, subject
to prompt last sale reporting rules of a registered national securities
association and reported to one of such association's equity trade
reporting facilities.'' See Plan, supra note 2 at Section 1.1.
\17\ See CAT NMS Plan Adopting Release, supra note 7.
---------------------------------------------------------------------------
When the CAT System is fully operational it will address the
regulatory need the Commission identified and facilitate multiple
Participants' ability to conduct their own market surveillance. In
particular, the more granular order attribution information that will
be available via CAT will help Participants make their surveillance
programs more efficient and effective. As Participants develop
regulatory systems that interact with CAT data, they may use CAT data
to supplement targeted queries of their own exchange data and/or to
build new exchange-specific surveillance to bolster regulation of
individual markets and across markets. For example, Participants will
more easily identify exchange-specific manipulative activity, such as
opening and closing cross-manipulation, using CAT data because a market
participant may be entering manipulative orders on one exchange that
are otherwise not visible to another exchange's surveillance systems.
The CAT presents new opportunities to increase both regulatory
effectiveness and efficiencies, and the Participants are committed to
using the CAT System to reduce regulatory inefficiencies, including
reducing regulatory duplication, in a manner that promotes the safety
of the markets and the quality and effectiveness of the Participants'
regulatory programs.
b. Structure of CAT Project
To understand my role on the CAT project, it may be helpful to
review the various stakeholders and contributors to the project.
Consolidated Audit Trail LLC (CAT LLC) is a consortium of national
securities exchanges and national securities associations. The
Operating Committee is comprised of representatives of each
Participant, serves as the governing body for CAT LLC and provides
review, guidance, oversight and decision-making authority for the
overall operations of the CAT System. The Operating Committee selects
the Plan Processor, which is responsible for implementing and operating
the CAT System. As mandated by Rule 613 and the Plan, the Operating
Committee receives industry perspective and guidance from the CAT LLC
Advisory Committee, which is a diverse group of industry
representatives (e.g., small, medium and large broker-dealers, floor
broker-dealers, proprietary trading firms clearing firms, service
bureaus, buy-side traders, academicians). There also are numerous
working groups with discreet responsibilities related to the CAT
project.
I have been involved with the CAT since the adoption of Rule 613,
first as an employee of a future Participant and, since 2017, as Chair
of the Operating Committee while also serving as an Independent Senior
Advisor to Deloitte. I can represent to you that the Participants have
been working, and continue to work, diligently and in good faith to
comply with their regulatory obligations to build and operate the CAT
in compliance with SEC Rule 613 and the Plan. In doing so, the
Participants are working closely with staff of the SEC to ensure the
CAT is designed and implemented in a manner consistent with regulatory
expectations and with the Advisory Committee to ensure that the CAT is
designed and implemented in a manner that is efficient and will benefit
the industry-at-large.
Throughout the process of creating and operating the CAT, the
Participants have been deliberate about ensuring that the CAT System
and the data within the system are secure. The Participants are
committed to developing and implementing a fully functional and secure
CAT System in accordance with the timeline developed by the
Participants and FINRA CAT, which was shared with the SEC.
II. Process of Developing and Implementing the CAT
In addition to developing the Plan that governs the overall
operation of the CAT System, the Participants went through a rigorous
process to identify a Plan Processor to develop, implement, and operate
the CAT System. Understanding that this would be a challenging effort,
the Participants began this undertaking well before the Commission
ultimately approved the Plan. Specifically, the Participants developed
a request for proposal (RFP) process and published a Proposed RFP
Concept Document for public comment to get feedback on the feasibility
and costs of implementing the CAT reporting requirements contemplated
by the Plan. Participants also published information on the anticipated
content and structure of the RFP so that interested bidders had the
opportunity to review the scope of information they would have to
provide in an RFP response. The Participants ultimately published an
RFP in February 2013.
In September 2013, the Participants filed a separate NMS plan with
the Commission, entitled the Plan Governing the Process of Selecting a
Plan Processor and Developing a Plan for the Consolidated Audit Trail
(Selection Plan). The Selection Plan governed how the Participants
would ultimately select the Plan Processor. The Commission approved the
Selection Plan in February 2014. \18\ Following the process outlined in
the Selection Plan, 10 entities submitted responses to the RFP. The
Participants heard oral presentations from all 10 entities and
identified three finalists. The majority of Participants ultimately
selected Thesys Technologies LLC (Thesys) in accordance with the voting
procedures for the selection of the initial Plan Processor under the
Selection Plan.
---------------------------------------------------------------------------
\18\ The Selection Plan was later incorporated into the Plan
approved by the Commission on November 15, 2016.
---------------------------------------------------------------------------
The relationship with Thesys did not progress in a satisfactory
manner. After working closely with Thesys in an attempt to overcome
what the Participants viewed as inadequacies in Thesys' performance as
Plan Processor, the Participants determined that Thesys could not
remedy those inadequacies in a timely and cost-effective manner.
Thereafter, the Participants determined to engage a new Plan Processor.
Because the Participants understood and appreciated the urgent need to
complete the CAT System, the Participants commenced an abbreviated
selection process, contacting the two other finalists from the initial
selection process. Earlier this year, the Participants selected FINRA,
operating through a subsidiary (FINRA CAT), to serve as the successor
Plan Processor. The Participants transitioned the project to FINRA CAT
in order to facilitate the timely development and implementation of the
CAT. Shortly thereafter, the Participants provided the Commission an
updated plan outlining the phased timeline for implementing the CAT
System.
III. Progress Update
Since transitioning the project to FINRA CAT, the Participants have
made substantial progress toward meeting their obligations to build and
operate the CAT. The Participants actually began submitting data to the
CAT in November 2018, when Thesys was the Plan Processor, and have
successfully submitted more than 13 trillion records to the CAT System
since transitioning to FINRA CAT. Since commencing operations as Plan
Processor, FINRA CAT has collected all data from the Participants,
validated and linked all equity exchange data, and is on target to
validate and link all options exchange data by February 2020. FINRA CAT
also has completed various releases related to Participant reporting in
a timely manner and has accelerated the delivery of multifactor
authentication--a key aspect of the security of the CAT System--by
several months from the planned date of May 2020. Since selecting FINRA
CAT as Plan Processor, there have been no production outages or major
operational issues with the first technical release.
The Participants also have made substantial progress with regard to
Industry Member CAT reporting (i.e., CAT reporting by broker-dealers),
which is scheduled to commence in April 2020. Industry Member
onboarding is in progress, and the Participants have finalized the
Technical Specifications for Industry Member reporting for the initial
two reporting phases. Additionally, FINRA CAT has finalized Industry
Member connectivity and completed Industry Member registration.
To place the progress made to date in perspective, it may be
helpful to provide a sense of the scope and magnitude of the CAT
project. The CAT System receives over 105 billion records per day on
average and has processed a peak of 182 billion records from
Participants alone on one day for options, Options Price Reporting
Authority, options national best bid and offer, and equities exchange
data. The Participants clearly have complied with the Commission's
charge to build a comprehensive system designed to be dependable,
robust, and scalable.
Importantly, this progress has come about not only through the
efforts of the Participants and the Plan Processor, but also due to the
enhanced involvement of Advisory Committee members and Industry Members
more broadly. The Participants and FINRA CAT have worked regularly and
productively with the Advisory Committee and industry associations,
such as the Securities Industry and Financial Markets Association
(SIFMA), Financial Information Forum, and the Securities Traders
Association, to gather, assess, and answer numerous interpretive
questions, publish Frequently Asked Questions (FAQs), assess timelines
for Industry Member technical specifications and reporting, and
otherwise develop a workable CAT. The Participants also met with the
Investment Company Institute on topics related to the CAT System. The
Commission staff, who regularly attend nearly all CAT meetings and
calls, also have played an important role in discussions related to the
development of the CAT. With the help of these various contributors,
the Participants have been able to make significant progress in
developing the CAT System and preparing the industry for a fully
functional CAT System by publishing or providing 247 pages of technical
specifications, 226 of FAQs, 10 workflow documents including a 367 page
Industry Member Reporting Scenarios document and a 22 page on-boarding
guide, and 24 webinars; and registering 1,530 Industry Members.
Beginning next month, the Participants and the Plan Processor will
work together, using a phased approach, to expeditiously achieve the
following milestones: (i) large Industry Member testing (December
2019), (ii) large Industry Member reporting (April 2020), (ii) small
Industry Member testing (December 2019), (iii) small Industry Member
reporting (December 2021), and (iv) customer account and customer
identifying information reporting by all firms (July 2022). \19\ The
Participants are working to achieve all milestones, i.e., achieve
complete implementation of the CAT System, by July 2022. \20\
---------------------------------------------------------------------------
\19\ Customer account and customer identifying information
reporting may be impacted by the Participants' request for exemptive
relief. See infra note 28 and accompanying text.
\20\ The phased implementation involves a more detailed breakdown
of the milestones, including milestones related to OATS reporting and
non-OATS reporting small Industry Members.
---------------------------------------------------------------------------
IV. PII
I would like to discuss personally identifiable information. As
noted earlier, the SEC has mandated that the CAT System be designed and
developed to comply with the requirements of SEC Rule 613 and the Plan.
Rule 613(c)(7)(i)(A) states that the Plan must require Participants and
Industry Members to record and electronically report to the CAT System
Customer-IDs for each order and each reportable event. \21\ Rule
613(j)(5) defines Customer-ID as ``a code that uniquely and
consistently identifies such customer for purposes of providing data''
to the CAT System. \22\ Rule 613 does not define what qualifies as
customer identifying information, but in proposing and adopting Rule
613, the SEC suggested that the CAT System ``be responsible for
assigning a unique customer identifier in response to an input by a
[regulator] of a customer's Social Security number or tax
identification number'' \23\ and noted its expectation that the
Participants ``establish a process by which [the Customer-IDs] are
reported to the [CAT System], and how this information is linked to the
name and address of customers as stored in the [CAT System].'' \24\
Accordingly, the Commission-approved Plan currently defines Customer
Identifying Information as ``information of sufficient detail to
identify a Customer, including, but not limited to, (a) with respect to
individuals: name, address, date of birth, individual tax payer
identification number (ITIN)/Social Security number (SSN), individual's
role in the account (e.g., primary holder, joint holder, guardian,
trustee, person with the power of attorney) . . . '' \25\
---------------------------------------------------------------------------
\21\ Regulation NMS, 17 CFR 242.613(c)(7)(i)(A) (2019).
\22\ Regulation NMS, 17 CFR 242.613(c)(7)(i)(A) 613(j)(5) (2019).
\23\ Rule 613 Proposing Release, supra note 8 at 32,573.
\24\ Rule 613 Adopting Release, supra note 3 at 45,757.
\25\ Plan, supra note 2 at Section 1.1.
---------------------------------------------------------------------------
It is important to note that the inclusion of PII has been a point
of contention since the inception of the CAT System. In fact, members
of Congress, the SEC, Participants and others in the industry have
raised security and privacy concerns related to the nature and volume
of information to be included in the CAT System, with particular focus
on the use and inclusion of customer identifying information. The
Commission made clear, however, that the utility of the CAT System
would be significantly degraded without a means to uniquely identify
underlying customers. \26\
---------------------------------------------------------------------------
\26\ See Rule 613 Adopting Release, supra note 3 at 45,756-758.
---------------------------------------------------------------------------
The need to balance facilitating effective regulation using the CAT
System against security concerns related to the breadth of sensitive
information that will be in the CAT System remains paramount.
Participants have been in discussions with the SEC and the industry on
how best to balance these competing concerns. To that end, the
Operating Committee formed a PII Working Group to research and
recommend potential alternatives regarding the handling of PII in the
CAT System.
After considering various alternatives over the course of 2018, the
PII Working Group, in consultation with SIFMA, recommended an approach
that would have avoided the need to have any PII in CAT. Industry
Members would have retained such information as they have to date, and
the SEC and Participants would have requested it from each broker-
dealer firm, as necessary, through the creation of a separate PII
request/response system. At the suggestion of the Commission staff--
which did not favor the approach proposed by the PII Working Group--the
PII Working Group had further discussions and ultimately recommended an
alternative approach to the Operating Committee.
Specifically, the Participants worked together with SIFMA to
develop what is now referred to as the CCID Alternative. Under this
alternative, the Plan Processor would generate a unique identifier for
a customer (the ``CAT Customer ID'' or ``CCID'') using a two-phase
transformation process that avoids the need to collect and maintain
SSNs in the CAT. In the first transformation phase, Industry Member CAT
Reporters would transform an SSN to an interim value. \27\ Industry
Members would submit this transformed value, and not the SSN, to the
CCID Subsystem operated by the CAT separate and apart from other
customer and account information. The CCID Subsystem would use the
transformed value to create a unique CCID for each customer. The
regulatory staffs of the Participants and the SEC would then use the
CCID in queries and analysis of CAT data.
---------------------------------------------------------------------------
\27\ Industry Members would continue to store individual customer
SSNs outside the CAT, as they do today. If a Participant's regulatory
staff or the SEC staff needs to obtain a customer SSN during an
investigation, the regulator would need to request that information
from the CAT Reporter. If, however, a Participant's regulatory staff or
the SEC staff has an SSN through other means, the regulator will have
the ability to use that SSN to query the CAT. Similar to the process
just described, the SSN would be transformed into the CCID, which, in
turn, may be used by the regulator in queries and analyses of CAT data.
Under this alternative, Industry Members would not maintain the
generated CCID.
---------------------------------------------------------------------------
The use of CCIDs would enhance the security of the CAT System while
preserving the regulatory benefits of the system. The CAT would not
collect or store any SSNs. Because the CAT System would only store
CCIDs, rather than SSNs, this alternative would eliminate the risk of
having a comprehensive aggregated source for all individual customer
SSNs. Instead, only Industry Members would continue to collect
individual customer SSNs, as they do currently. Moreover, the process
to create CCIDs using, in part, SSNs would be secure. The Participants
believe this will significantly reduce the risk that information in CAT
could be used to facilitate identity theft and do so in a manner that
does not compromise the regulatory benefits of the CAT.
The Participants recognize that eliminating the collection of SSNs
by the CAT for initial processing by the Plan Processor would cause CAT
Reporters to assume a critical role in the accurate generation of
CCIDs. This creates a risk to the integrity of the CCID values
ultimately assigned to customer records in the CAT that is beyond the
full control of the Plan Processor. The Plan Processor will consider
methods for detecting errors in the transformed values submitted by CAT
Reporters, some of which may be identified by functionality supporting
the error resolution for customer data requirement of the Plan.
Nevertheless, the Participants and the working group of Participant and
Industry Members that developed the CCID Alternative jointly believe
that the value of eliminating the need for CAT Reporters to transmit
SSNs to the CAT exceeds the potential increased risk to the integrity
of CCID assignments.
The Participants also have developed what is now referred to as the
Modified PII Approach that would eliminate dates of birth and account
numbers for natural persons in the CAT System (although year of birth
for customers would be collected and maintained in the CAT). Similar to
SSNs, the Participants believe that dates of birth and account numbers
are particularly sensitive from a security perspective and should not
be included in the CAT. The Participants believe that eliminating dates
of birth and account numbers from the CAT would further reduce the risk
profile of data collected and stored in the CAT by eliminating the PII
data elements that would support attempted identity theft without
compromising the regulatory benefits of the CAT.
To implement the CCID Alternative and the Modified PII Approach,
the Participants have requested exemptive relief from the Commission
from relevant aspects of the Plan. \28\
---------------------------------------------------------------------------
\28\ See Letter from Michael Simon, CAT NMS Plan Operating
Committee Chair, to Vanessa Countryman, SEC, Request for Exemptive
Relief from Certain Provisions of the CAT NMS Plan related to Social
Security Numbers, Dates of Birth and Account Numbers (Oct. 16, 2019)
available at https://www.catnmsplan.com/wp-content/uploads/2019/10/
CCID-and-PII-Exemptive-Request-Oct-16-2019.pdf.
---------------------------------------------------------------------------
V. Security
Since conceptualizing the Plan, the Participants have been mindful
of security concerns related to the CAT. Excluding SSNs, dates of birth
and account numbers from the CAT System will result in the CAT System
being a much less attractive target for cybercriminals. Nevertheless,
the security of the CAT System will remain a top priority. The
Participants have taken, and will continue to take, all appropriate
precautions to safeguard all data within the CAT System.
Understanding the importance of information security generally, CAT
LLC itself is structured in a manner to appropriately emphasize the
security of the CAT. For example, CAT LLC has both a Chief Information
Security Officer (CISO) and Chief Compliance Officer, both of whom are
fiduciaries of CAT LLC, and are responsible for ensuring compliance
with Plan requirements. \29\ Specifically, the CAT CISO is responsible
for creating and enforcing appropriate policies, procedures, and
control structures to monitor and address data security issues for the
Plan Processor and the CAT System. \30\ The CISO also is obligated to
review the Participants' information security policies and procedures
that are related to the CAT System to evaluate if the Participants that
access CAT data have an information security program comparable to the
Plan Processor's program. \31\ Additionally, the Operating Committee
established a Security Working Group, which is comprised of the CAT LLC
CISO as well as CISOs and security experts from each Participant.
Members of the working group collectively represent hundreds of years
of experience in the information security space. The SEC staff also has
served as an active observer to Security Working Group meetings.
---------------------------------------------------------------------------
\29\ See Plan, supra note 2 at Section 4.6.
\30\ See id. at Section 6.2.
\31\ See id. at Section 6.2.
---------------------------------------------------------------------------
In addition to structuring the oversight and responsibility of the
CAT System in a manner that focuses on security, the Participants have
designed the CAT System to meet stringent security standards. \32\ The
system is subject to the robust controls framework set forth in
National Institute of Standards and Technology (NIST) Special
Publication (SP) 800-53 including, among other things the establishment
of a System Security Plan and annual third-party independent
verification and validation. \33\ This is the same standard required
for Federal information systems under the Federal Information Security
Management Act. The Participants designed and built the CAT System with
both architectural-level and program-level controls. The SEC and
Participants can only query the CAT System via dedicated private
circuits between them and the CAT System, mitigating the risk of an
attack via the Internet. The CAT system further requires multifactor
authentication for regulatory use of the query tools, mitigating
insider risk at the regulators, as well as for access to the Industry
Member reporter portal. \34\ Additionally, the CAT System and relevant
personnel continuously monitor regulatory access and use of the system.
The CAT System logs every instance of access to the CAT central
repository and will maintain a full audit trail of access to customer
data. Additionally, the Operating Committee, the SEC, and Participants
will periodically receive and review a list of authorized users and
their most recent access; each user organization will regularly verify
that its list of authorized users and the roles they are assigned
remain accurate. \35\
---------------------------------------------------------------------------
\32\ See id. at Appendix D Section 4.2.
\33\ The application of NIST SP800-53 to the CAT is further
informed by ISO 27002, NIST Cybersecurity Framework.
\34\ See Plan, supra note 2 at Appendix D Section 4.1.4.
\35\ See id. at Appendix D Section 4.1.4.
---------------------------------------------------------------------------
The Participants have integrated security processes into the design
and development of the CAT System. Threat analysis drives security
requirements and design. Continuous automated testing along with
rigorous security assessment by an expert team of security engineers is
brought to bear during the design and build of the system. A highly
qualified third-party cybersecurity testing organization regularly
performs further security testing, including penetration testing and
code security assessment.
The overall CAT security program also is subject to regular third-
party review to verify that the program is operating in accordance with
its System Security Plan and with applicable standards. The Plan
Processor will continue to subject the CAT System to annual NIST SP
800-53 Independent Validation and Verification (IV&V). FINRA CAT
delivered Release 1 (June) on time and with no major security defects,
as confirmed by both internal and third-party security testing, as well
as the third-party security controls assessment, i.e., IV&V. FINRA CAT
is on schedule to deploy Release 2 in November with no major defects as
well; internal security testing is complete, third-party security
testing is nearly complete, and a new IV&V is in progress.
Finally, to keep Industry Members and other interested persons
apprised of CAT security efforts, in August, CAT LLC and FINRA CAT
hosted an industry webinar focusing on the security of CAT data. During
the webinar the Participants shared information about how the data
reported to the CAT System will be safeguarded to ensure the security
and confidentiality of the data.
VI. Costs
Developing and operating the CAT System in accordance with SEC Rule
613 and the Plan requires a significant commitment of capital--both
human and financial. In terms of human capital, all Participants have
contributed the time and expertise of numerous senior-level personnel
from their respective organizations. \36\ These individuals provide
expertise on technology and systems engineering, legal, regulatory and
compliance, data, and security issues. To date, the entirety of the
financial commitment to develop and operate the CAT System has been
borne by the Participants, notwithstanding that Rule 613 and the Plan
specifically contemplate the CAT being funded jointly by the
Participants and Industry Members.
---------------------------------------------------------------------------
\36\ See id. at Section 6.2(b)(vii).
---------------------------------------------------------------------------
To provide context, the cost associated with the CAT System
include: (i) fixed and variable costs for the Plan Processor to build
and operate the CAT; (ii) legal fees; (iii) consulting fees; (iv)
insurance; and (v) costs associated with engaging other vendors, like
financial administrators and auditors. Going forward, we estimate the
annual budget to operate the CAT System to be upwards of $75 million.
Note, this figure only reflects CAT LLC's direct costs. It does not
include the cost of compliance for Participants or Industry Members nor
the individual costs of the Participants, and CAT LLC is not in a
position to collect or estimate those costs.
Although the Participants have continued to independently fund the
CAT, they have attempted to implement fees applicable to both
Participants and Industry Members to fund the cost of the CAT as
contemplated by Rule 613 and the Plan. In 2017, the Participants filed
proposed rule changes and a Plan amendment to adopt a schedule to
establish fees for Participants and Industry Members, which would have
resulted in Industry Members helping fund the CAT. \37\ After receiving
comments to the proposed rule changes and the Participants responding
to the comments and filing amendments to the proposed rule changes, the
Participants withdrew their rule changes when it became clear that the
SEC was going to disapprove those fees, given it summarily abrogated
the Plan amendment that would have established Participant and Industry
Member fees. \38\
---------------------------------------------------------------------------
\37\ See, e.g., Notice of Filing and Immediate Effectiveness of a
Proposed Rule Change Related to Fees for Use on Bats EDGX Exchange,
Inc., Exchange Act Release No. 80,821, 82 FR 26,177 (June 6, 2017).
\38\ See Notice of Withdrawal of Proposed Rule Changes, as
Modified by Amendments, To Establish Fees for Industry Members To Fund
the Consolidated Audit Trail, Exchange Act Release No. 82,505, 83 FR
3,043 (Jan. 22, 2018).
---------------------------------------------------------------------------
There is still no fee structure in place and the Participants alone
continue to fund the CAT. It remains of critical importance that the
industry contributes to funding the development and implementation of
the CAT System. Not only is this a reasonable approach to financing
such a massive project, it is consistent with Rule 613 and the Plan
that the Commission approved. Accordingly, the Participants are working
on an amended fee proposal that they will submit to the Commission for
its review and approval.
Relatedly, the Commission recently issued proposed amendments to
the Plan that would add new sections to the Plan to govern the recovery
of any fees, costs, and expenses incurred by CAT LLC in connection with
the development, implementation and operation of the CAT System from
the effective date of the amendment until the Participants complete
implementation of the Plan. \39\ Specifically, Proposed Section 11.6
would require the Participants to meet four critical CAT implementation
milestones by certain dates to collect the full amount of any related
post amendment Industry Member fees established by the Operating
Committee or implemented by the Participants. If the Participants fail
to meet the target deadlines set forth in Proposed Section 11.6, they
would only be entitled to collect a portion of the relevant amount, as
determined by the amount of time by which the Participants have missed
the target deadlines.
---------------------------------------------------------------------------
\39\ See Proposed Amendments to the National Market System Plan
Governing the Consolidated Audit Trail, Exchange Act Release No.
86,901, 84 FR 48,458 (Sept. 13, 2019).
---------------------------------------------------------------------------
The Participants understand the Commission's concerns and ultimate
goal of providing financial incentives to complete the CAT in a timely
manner. The Participants are reviewing the details of the proposed
amendment and intend to provide a comment letter with considerations
for the SEC. These comments will be based on the Participants'
experience in designing and building the CAT System and will be aimed
at helping achieve the SEC's goals in an efficient manner.
VII. Conclusion
The Participants remain committed to meeting their obligation to
build and operate the CAT System and are making significant progress in
this regard. The Participants will continue to take all necessary
precautions to safeguard the data within the CAT System and to promote
the security of the system more generally. Thank you for the
opportunity to provide testimony on this matter.
RESPONSES TO WRITTEN QUESTIONS OF SENATOR BROWN
FROM SHELLY BOHLIN
Q.1. Please describe the FINRA CAT breach/intrusion
notification process, including the entities and organizations
that would be notified and the timetable for notification.
Please also describe any process for notification to investors,
or the public generally.
A.1. FINRA CAT has a sophisticated information security program
guided by CAT NMS Plan requirements and is working to support
the efforts of the consortium of self-regulatory organizations
(SRO) responsible for managing the CAT (known as CAT Plan
Participants or the SRO consortium) to limit the kinds of
sensitive retail investor information that would be reported to
the CAT. This program includes a formal and formally tested
incident response plan, consistent with guidance established by
the National Institute of Standards and Technology, and which
addresses notification requirements applicable to the
unauthorized access to CAT Data. These notifications are driven
by the facts and circumstances of any breach/intrusion. If
FINRA CAT becomes aware of actual (or potential) unauthorized
access to CAT Data, we, working with the SRO consortium, will
take all reasonable steps to investigate the incident and
mitigate any technical vulnerabilities identified from
unauthorized access to protect the integrity of the CAT system.
We will further work with the SRO consortium to report
unauthorized access to law enforcement, the SEC and other
authorities, and to notify customers or other parties as
required or as the consortium deems appropriate. Also, as an
``SCI Entity,'' FINRA CAT is subject directly to the SEC's
jurisdiction, including Regulation Systems Compliance and
Integrity (Reg SCI). FINRA CAT's status as an SCI Entity
ensures direct accountability, including cyberincident
reporting requirements.
Q.2. Please provide the available cost estimates for (i)
building the CAT system and (ii) annual operation of the CAT
system, specifying current cost and costs once it is fully
operational.
A.2. The SRO consortium is more appropriately able to provide
public information concerning costs, as specific details of the
financial terms of the contract between the SRO consortium and
FINRA CAT are confidential. We understand that they are
addressing cost-related questions in their answers to the
Committee.
Q.3. Please identify the private and Government organizations
and entities that would be necessary to involve in the
development and management of a CAT system that includes U.S.
futures data and activity.
A.3. While FINRA CAT has the systems capability to incorporate
futures data in the CAT system, any work towards that end would
necessarily only follow the legal and policy decisions made by
Federal regulators, including the CFTC and the SEC. There may
also be questions for the Federal regulators and Congress about
whether new legislative authority is needed. These regulators
would likely engage futures market participants, as well as
other public and private stakeholders, such as the National
Futures Association. Should policy makers decide to expand the
CAT to include futures data, FINRA CAT would work expeditiously
to support that regulatory objective.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR SASSE
FROM SHELLY BOHLIN
Q.1. Is FINRA tied in with the Financial Sector Information
Sharing and Analysis Center (FSISAC)?
If not, how are you obtaining cyberthreat information?
A.1. Yes.
Q.2. Would the Commission consider setting up a test bed and
proving to the Banking Committee Members that the ``SSN's would
be secure''?
A.2. While we are happy to provide information to and
coordinate demonstrations with your office and other Committee
Members, and to work with the various stakeholders to make that
happen, I will defer to the SEC on this particular question.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR KENNEDY
FROM SHELLY BOHLIN
Q.1. I would like to better understand the relationship between
FINRA and FINRA CAT.
Who will be required to conduct independent reviews of
FINRA's security controls?
A.1. FINRA and FINRA CAT, LLC are separate legal entities, run
independently of each other, although FINRA CAT does contract
with FINRA for some services. FINRA CAT, LLC is a subsidiary of
FINRA and was created to focus solely on performing the
functions of the CAT Plan Processor for the consortium of self-
regulatory organizations responsible for managing the CAT
(known as CAT Plan Participants or the SRO consortium). FINRA
CAT is part of FINRA's parent SRO umbrella and accordingly an
SCI Entity. This means that while FINRA CAT serves as a
contractor for the SRO consortium and is not a CAT NMS Plan
participant itself, FINRA CAT nevertheless is subject directly
to the SEC's jurisdiction, including compliance with Regulation
Systems Compliance and Integrity (Reg SCI). FINRA CAT's status
as an SCI Entity ensures direct accountability to the SEC-for
important issues like system security, integrity, capacity, and
business continuity. FINRA CAT's security controls are subject
to the oversight of the CAT Plan Participants, independent
third party assessments required pursuant to the Plan, and the
SEC.
Both FINRA and FINRA CAT have implemented controls to
prevent FINRA from having an advantage over other Plan
Participants in accessing CAT data or receiving services from
FINRA CAT.
Q.2. Who, in the public and private sector, will have access to
data from the CAT? Please list those entities.
A.2. CAT Data can only be accessed for regulatory purposes and
only by authorized regulatory users from the CAT Plan
Participants and the SEC. FINRA CAT has worked with the SRO
consortium to develop comprehensive data access controls that
meet regulatory requirements. In addition, as currently
designed, only a subset of those authorized regulatory users
will have permission to access and view Customer Account
Information and Customer Identifying Information, which is
stored and handled separately from the order and trade data.
Additional access controls are discussed below in Question
seven.
The 24 Participants of the CAT NMS Plan are: BOX Exchange
LLC; Cboe BYX Exchange, Inc., Cboe BZX Exchange, Inc., Cboe
EDGA Exchange, Inc., Cboe EDGX Exchange, Inc., Cboe C2
Exchange, Inc. and Cboe Exchange, Inc., Financial Industry
Regulatory Authority, Inc., Investors Exchange LLC, Long-Term
Stock Exchange, Inc., Miami International Securities Exchange
LLC, MIAX Emerald, LLC, MIAX PEARL, LLC, Nasdaq BX, Inc.,
Nasdaq GEMX, LLC, Nasdaq ISE, LLC, Nasdaq MRX, LLC, Nasdaq PHLX
LLC, The NASDAQ Stock Market LLC; and New York Stock Exchange
LLC, NYSE American LLC, NYSE Arca, Inc., NYSE Chicago, Inc. and
NYSE National, Inc. Some of these SRO Participants have the
same parent company. Those companies include the following: BOX
(Boston Options Exchange); Cboe; FINRA; IEX; LTSE; Nasdaq;
NYSE; and, MIAX.
Q.3. What are you doing to ensure a secure mechanism is
developed for the submission of data, its storage, and the
destruction of such data once it is no longer necessary?
A.3. In terms of FINRA CAT's overall information security
program, we are led by a CISO who was approved by the SRO
consortium and also has a fiduciary duty to the SRO consortium.
Our CISO has over 20 years' experience working on information
security at FINRA, including as a security architect and
security engineer. The CISO is supported by a dedicated team of
security analysts who ensure that security controls are
effectively implemented, monitor the security of the CAT System
and respond to anomalies, evaluate and approve access, enforce
compliance with security policies and standards including
National Institute of Standards and Technology (NIST) Special
Publication (SP) 800-53, and evaluate evolving threats and
security control opportunities to ensure that the CAT security
posture remains strong.
In addition, the FINRA CAT security team is able to
leverage the security expertise and advanced technology
solutions that FINRA has invested in heavily over the years,
including the people, process, and technologies it has
developed and deployed to operate a secure cloud environment
that is comparable in scale to the fully deployed CAT solution.
As the SRO consortium recently discussed in a presentation to
the industry (https://www.catnmsplan.com/wp-content/uploads/
2019/08/FINRA-CAT-Security-Approach-Overview--20190828.pdf),
the FINRA CAT security program includes significant layers of
architectural-level security controls and program-level
security controls. Examples of architectural controls include
secure infrastructure for connecting to the CAT system and
architectural separation between transaction data and customer
data. Examples of program controls include a full suite of
information security policies, procedures, and standards, as
well as regularly scheduled independent third-party system
penetration testing, code reviews, and security control
validation.
The extensive FINRA CAT security policies address a range
of issues required by the CAT NMS Plan, including data storage
and handling, insider risk, data connectivity and transfer,
incident management, security logging and monitoring, account
management, and data destruction. FINRA CAT's security program
is based on work product developed by the FINRA CAT CISO in
coordination with the SRO consortium's Security Working Group,
which is comprised of CISOs and security experts from each of
the CAT Plan Participants.
Each CAT System release is subject to the granting of an
Authority To Operate (or ATO) by the SRO consortium. To obtain
an ATO from the consortium, the CAT CISO must demonstrate the
strength of the CAT System's security posture to the Security
Working Group. This includes, among other things, system
security, internal and third-party security testing, and
independent validation confirming that security controls are
aligned with the NIST industry standards followed by the
Federal Government and that they have been effectively
implemented.
FINRA CAT understands concerns that continue to be raised
about the inherent risk of handling CAT data, particularly PII.
Even with the enhanced architectural and program controls
required by the plan for PII-such as containing PII in its own
separate system with restricted access-there may be policy
questions for the SEC and SRO consortium to discuss about the
costs and benefits of collecting and storing sensitive personal
data.
FINRA CAT's job is to support the regulators' decision
making on this issue. This includes making any modifications to
the system design to account for current discussions between
the SEC, the SRO consortium, and the industry. The SROs
recently requested exemptive relief to eliminate social
security numbers, account numbers, and dates of birth from the
CAT. You will find this request at the following link: https://
www.catnmsplan.com/wp-content/uploads/2019/10/CCID-and-PII-
Exemptive-Request-Oct-16-2019.pdf. FINRA CAT continues to work
closely and productively with the SEC and the SROs to ensure
that it has the right technological solution in place for when
customer and account information reporting begins in July 2022.
Q.4. What security protocols are in place, or will be followed
by the SROs and the SEC to mitigate the risk of a data breach?
A.4. FINRA CAT has a sophisticated information security program
guided by CAT NMS Plan requirements and is working to support
the consortium's efforts to limit the kinds of sensitive retail
investor information that would be reported to the CAT. FINRA
CAT has developed a System Security Plan (SSP), in accordance
with extensive NIST 800-series Special Publication guidance on
computer security, and follows this SSP to ensure that security
controls, including those used to prevent, detect, and mitigate
a data breach, are defined and effectively implemented. While
not public for security reasons, this SSP and its effective
implementation undergoes independent third-party evaluation on
an annual basis. The SSP includes incident response and breach
management controls. FINRA CAT is prepared for a variety of
scenarios and has established and tested processes and actions
in the event of unauthorized access to CAT data that vary
depending on the facts and circumstances of any breach/
intrusion. If FINRA CAT becomes aware of actual (or potential)
unauthorized access to CAT Data, we, working with the SRO
consortium, will take all reasonable steps to investigate the
incident and mitigate any technical vulnerabilities identified
from unauthorized access to protect the integrity of the CAT
system. We will further work with the SRO consortium to report
unauthorized access to law enforcement, the SEC and other
authorities and to notify customers or other parties as
required or as the consortium deems appropriate.
Q.5. Have you worked with those stakeholders supplying data to
the CAT to ensure they are comfortable with the levels of
security surrounding the system?
A.5. FINRA CAT has worked with the SRO consortium to conduct
substantial engagement with the reporting parties regarding
their reporting obligations and data security measures. With
respect to data security measures, the SRO consortium and the
Plan Processor have sought to provide reporting parties with
assurance that strong and appropriate security measures are in
place, while avoiding disclosure of sensitive information about
CAT security controls and processes that could be used in an
attempt to circumvent those controls if it fell into the wrong
hands. This assurance includes a robust program of regular
independent third-party assessments, including validation that
security controls are effectively implemented in accordance
with NIST SP800 series standards, as well as third-party
independent penetration testing and code security assessments.
Meetings are regularly held, and the CAT website
(catnmsplan.com) provides detailed, up-to-date information on
these and other communications, including CAT alerts, regular
podcasts, and engagement with compliance professionals at
firms. These relationships are important to communicating and
clarifying obligations, and to understanding the questions and
concerns of various stakeholders.
Q.6. Will you continue to engage with industry and stakeholders
on information security once the system is up and running?
A.6. FINRA CAT will continue to engage all stakeholders on this
important issue after the CAT is operational. The CAT is a
highly complex project that requires deep technological
expertise, proactively evolving security, close regulatory
coordination with the SEC and the SRO consortium, and full-time
engagement with broker-dealers that ultimately must report data
to the CAT. There are a number of industry representatives
involved in the governance of the CAT NMS Plan through their
participation on the Advisory Committee established by the CAT
NMS Plan.
The Advisory Committee established in the CAT NMS plan is
charged with advising the Participants on the implementation,
operation, and administration of the CAT. Under the Plan, the
Advisory Committee has the right to attend Operating Committee
and Subcommittee meetings generally and to submit its views
prior to a decision by the Operating Committee. The composition
of the Advisory Committee includes: (a) broker-dealers of
varying sizes and types of business, including a clearing firm;
(b) an individual who maintains a securities account; (c) an
academic; and (d) institutional investors. This kind of
stakeholder participation and feedback is and will continue to
be critical to FINRA CAT's efforts in all areas, including
information security.
Q.7. What protocols will FINRA CAT have to ensure staff that
have access to the CAT database, and potentially the ability to
extract this data, do not misuse it? Can you elaborate on any
access controls, limitations, and monitoring of the extractions
that will take place?
A.7. FINRA CAT has worked with the SRO consortium to develop
comprehensive data access controls that meet regulatory
requirements. For example, only authorized regulatory users
from the Participants and the SEC will have permission to
access CAT Data via the CAT System. And, as currently designed,
only a subset of those authorized regulatory users will have
permission to access and view Customer Account Information and
Customer Identifying Information, which is stored and handled
separately from the order and trade data. Authorized regulatory
users outside of the SEC must execute a Safeguard of
Information Affidavit provided by the Plan Processor, which
provides, among other things, that authorized regulatory users
must maintain the confidentiality and security of CAT Data and
to use CAT Data only for regulatory purposes. In addition,
authorized regulatory users outside of the SEC are required to
complete the CAT Security Awareness Training Course provided by
the Plan Processor. As the Plan Processor, however, FINRA CAT
does not have the authority to oversee or enforce restrictions
on the appropriate regulatory use of CAT data by those who
access it. The obligation to monitor and enforce restrictions
on the uses of and access to CAT data falls on each SRO that is
part of the CAT Plan for their respective employees and the SEC
for SEC staff. Also, the SEC is responsible for any training
for authorized regulatory users inside the agency. FINRA CAT
has also established monitoring controls at multiple system
layers (e.g., data storage, application front end) designed to
detect access anomalies. This includes the use of behavioral
analytics designed to recognize normal and abnormal access
patterns. All access to CAT Data is logged, in accordance with
the Plan and subject to this monitoring. Instances of potential
abnormal access will be flagged for the respective SRO or the
SEC to follow up on.
With respect to Plan Processor personnel, only those who
need access to CAT Data to fulfill their responsibilities for
delivery and operation of the CAT System are granted access to
CAT Data. That access must be justified to the satisfaction of
the CISO and CCO (who are fiduciaries to the SRO consortium)
and approved by them. This access is subject to periodic
review, as well as to monitoring that is attuned to the
restricted use patterns expected of these personnel.
Q.8. Cybersecurity is one of the greatest risks facing the
financial services industry and every sector of critical
infrastructure in the U.S. Currently, the CAT plan does not
require the plan processor to notify market participants of
cyberincidents that compromise their data.
What procedures will be followed to notify firms in the
event of a breach of CAT data?
A.8. FINRA CAT has a sophisticated information security program
guided by CAT NMS Plan requirements and is working to support
the consortium's efforts to limit the kinds of sensitive retail
investor information that would be reported to the CAT. We also
have notification processes in the event of unauthorized access
to CAT Data, but those vary depending on the facts and
circumstances of any breach/intrusion. If FINRA CAT becomes
aware of actual (or potential) unauthorized access to CAT Data,
we, working with the SRO consortium, will take all reasonable
steps to investigate the incident and mitigate any technical
vulnerabilities identified from unauthorized access to protect
the integrity of the CAT system. We will further work with the
SRO consortium to report unauthorized access to law
enforcement, the SEC and other authorities and to notify
customers or other parties as required or as the consortium
deems appropriate.
Q.9. Do you think such a notification requirement would be in
the best interests of all parties involved? SEC registrants are
required to have breach notification policies and procedures,
why not FINRA CAT?
A.9. While the response to any unauthorized access to CAT Data
will necessarily vary depending on the facts and circumstances
of the event, FINRA CAT, working with the SRO consortium,
developed a coordinated incident response framework. In the
event of an incident, FINRA CAT will investigate the incident.
We will further work with the SRO consortium to report
unauthorized access to law enforcement, the SEC and other
authorities and to notify customers or other parties as
required or as the consortium deems appropriate. In addition,
FINRA CAT, as an SCI entity under the SEC's Regulation SCI, has
an obligation to report to the SEC ``any unauthorized entry
into the SCI systems or indirect SCI systems of an SCI
entity''.
Q.10. I am concerned the CAT is a likely target for those who
wish to manipulate U.S. markets--are you confident the CAT
system and data included within will be adequately protected
from these threats?
A.10. I have confidence in our data security program, not only
in the systems we have in place, but also our team's ongoing
commitment to making data security central to our function. The
CAT system by its nature requires deep technological expertise,
proactively evolving security, close regulatory coordination
with the SEC and the SRO consortium, and full-time engagement
with broker-dealers that ultimately must report data to the
CAT.
FINRA CAT has policies, procedures, and a robust set of
other security controls to ensure the security and
confidentiality of information submitted to the CAT. Such
policies and procedures require information barriers between
regulatory and nonregulatory staff of the Participants with
regard to access and use of CAT Data, a mechanism to confirm
the identity of persons permitted to use CAT Data, and a
comprehensive information security program. Participant
information security policies and procedures are subject to
review by the CAT Chief Compliance Officer and Chief
Information Security Officer, with any deficiencies reportable
to the CAT LLC Operating Committee. FINRA CAT's security
program is aligned with NIST SP800-53--the Security and Privacy
Controls for Federal Information Systems and Organizations--and
undergoes regular third-party audits. In addition, we are
required to subject the CAT System to regular penetration
testing and code reviews by a qualified third-party security
assessor. This is on top of an extensive internal cybersecurity
program staffed by highly qualified cybersecurity personnel
that is integrated into the development and operations life
cycle of FINRA CAT. Among other benefits, this internal program
implements yet another layer of threat analysis, penetration
testing, and code assessment. In addition, FINRA's Internal
Audit Department will conduct reviews of various aspects of the
CAT system, procedures, and operation.
The CAT System is designed from the ground up with
structural controls that avoid exposure to certain common
threats. Notably, the CAT Regulator systems are designed
without Internet access. CAT Data is only accessible by
Participants and the SEC via private connectivity lines, with
their users subject to multifactor authentication. Monitoring
augmented by behavioral analytics is used to detect and quickly
respond to potential improper attempts to access CAT Data or
use the CAT System in an inappropriate manner. Industry
Members--which may only submit and correct data sent to the
CAT--are required to submit data either via private lines, AWS
PrivateLink or the CAT Secure Reporting Gateway; unlike
Participants and the SEC, Industry Members are not permitted to
query CAT Data. Reporting subsystems are architecturally
separate from query subsystems and the underlying CAT Data
repository; they are designed without the ability to read data
in the CAT, and to quickly move received data into the CAT to
greatly shield the reporting subsystem from being a viable
target for unauthorized access to CAT Data.
FINRA CAT's multifaceted cybersecurity program, with
architectural constraints such as private-line-only access,
along with multiple levels of complimentary and redundant
security testing by both Plan Processor security staff and
independent third parties justifies strong confidence that the
CAT system and included data are appropriately protected from
cybersecurity threats consistent with current standards.
Nevertheless, FINRA CAT is cognizant that its cybersecurity
framework must not be static; it must evolve as more effective
cybersecurity techniques and practices emerge.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR WARNER
FROM SHELLY BOHLIN
Q.1. Irrespective of how the PII issue is ultimately resolved
between the SEC and the consortium, do you have confidence that
the FINRA CAT's data security program and architecture has the
controls in place to keep whatever data is stored safe and
secure?
A.1. I have confidence in our data security program, not only
in the systems we have in place, but also our team's ongoing
commitment to making data security central to our function. The
CAT is a highly complex project that requires deep
technological expertise, proactively evolving security, close
regulatory coordination with the SEC and the consortium of
self-regulatory organizations responsible for managing the CAT
(known as CAT Plan Participants or the SRO consortium), and
full-time engagement with broker-dealers that ultimately must
report data to the CAT.
FINRA CAT has policies and procedures to ensure the
security and confidentiality of information submitted to the
CAT. Such policies and procedures require information barriers
between regulatory and nonregulatory staff of the Participants
with regard to access and use of CAT Data, a mechanism to
confirm the identity of persons permitted to use CAT Data, and
a comprehensive information security program. Participant
information security policies and procedures are subject to
review by the CAT Chief Compliance Officer and Chief
Information Security Officer, with any deficiencies reportable
to the CAT LLC Operating Committee. FINRA CAT's security
program is aligned with NIST SP800-53--the Security and Privacy
Controls for Federal Information Systems and Organizations--and
undergoes regular third-party audits. In addition, we are
required to subject the CAT System to regular penetration
testing and code reviews by a qualified third-party security
assessor. This is on top of an extensive internal cybersecurity
program staffed by highly qualified cybersecurity personnel
that is integrated into the development and operations life
cycle of FINRA CAT. Among other benefits, this internal program
implements yet another layer of threat analysis, penetration
testing, and code assessment.
The CAT System is designed from the ground up with
structural controls that avoid exposure to certain common
threats. Notably, the CAT Regulator systems are designed
without Internet access. CAT Data is only accessible by
Participants and the SEC via private connectivity lines, with
their users subject to multifactor authentication. Monitoring
augmented by behavioral analytics is used to detect and quickly
respond to attempts to access CAT Data or use the CAT System in
an inappropriate manner. Industry Members--which may only
submit and correct data sent to the CAT--are required to submit
data either via private lines, AWS PrivateLink or the CAT
Secure Reporting Gateway; unlike Participants and the SEC,
Industry Members are not permitted to query CAT Data. Reporting
subsystems are architecturally separate from query subsystems
and the underlying CAT Data repository; they are designed
without the ability to read data in the CAT, and to quickly
move received data into the CAT to greatly shield the reporting
subsystem as a viable target for unauthorized access to CAT
Data.
FINRA CAT's multifaceted cybersecurity program, with
architectural constraints such as private-line-only access,
along with multiple levels of complimentary and redundant
security testing by both Plan Processor security staff and
independent third parties justifies strong confidence that the
CAT system and included data are appropriately protected from
cybersecurity threats consistent with current standards.
Nevertheless, FINRA CAT is cognizant that its cybersecurity
framework must not be static; it must evolve as more effective
cybersecurity techniques and practices emerge.
Q.2. What, in your view, were the causes for implementation
delays?
A.2. As the head of FINRA CAT, I can speak only to what has
happened since we took over as plan processor in April 2019. We
are currently on schedule and are confident in our ability to
meet the milestones moving forward.
Q.3. Please describe how a subsidiary of FINRA was selected
earlier this year to replace Thesys? Was there an open bidding
process? Were there other bidders?
A.3. FINRA provided bid information to the SRO consortium at
the consortium's request, and the SRO consortium's selection of
FINRA was announced on February 27, 2019. As part of the SRO
consortium, FINRA recused itself and did not take part in the
selection decision. After the selection, FINRA created FINRA
CAT as a separate and distinct subsidiary to focus solely on
performing the functions of the CAT Plan Processor. FINRA CAT
believes that the SRO consortium is best positioned to respond
to questions about other bidders and the operation of the
bidding process.
Q.4. How was the SEC engaged with CAT NMS as it began
experiencing significant delays?
A.4. FINRA CAT believes the SRO consortium is best positioned
to respond to questions about project development and
management before FINRA CAT assumed the role of Plan Processor.
FINRA CAT notes that since it became the CAT Plan Processor, it
has completed all deliverables according to schedule.
Q.5. What are SEC current authorities in compelling the
implementation of CAT?
A.5. The CAT NMS Plan was filed with the SEC by the SRO
consortium to meet requirements the SEC established when it
adopted Rule 613 of Regulation NMS. In its role as CAT Plan
Processor, FINRA CAT is committed to continuing to complete
work according to schedule. FINRA CAT is also a part of FINRA's
parent SRO umbrella, meaning FINRA CAT, as part the FINRA self-
regulatory organization, is subject directly to the SEC's
jurisdiction over SROs.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR WARREN
FROM SHELLY BOHLIN
Q.1. The Flash Crash on May 6, 2010, briefly erased about $1
trillion from our Nation's economy. In response, more than 2
years later, the Securities and Exchange Commission (SEC)
adopted a rule to create, implement, and maintain the
Consolidated Audit Trail (CAT) to monitor securities trades in
U.S. markets.
The CAT would be a real-time tracking system to enhance
regulators' efforts to oversee U.S. markets by collecting data
about securities quotes and orders and allow the SEC to
understand trading practices. Without the CAT and other tools
to more quickly analyze trading data, the SEC was unnecessarily
delayed in reporting on what caused the brief crash to U.S.
markets. \1\ Federal regulators took 7 months to analyze and
publicly report the causes of the Flash Crash, and it took an
additional 5 years to analyze and publicly report that a
London-based trader played a significant role in the crash. \2\
---------------------------------------------------------------------------
\1\ Reuters, ``Factbox: After the Flash Crash, Changes to U.S.
Markets'', Jonathan Spicer, September 1, 2011, https://www.reuters.com/
article/us-financial-regulation-algos-factbox/factbox-after-the-flash-
crash-changes-to-us-markets-idUSTRE7806QS20110901.
\2\ Reuters, ``SEC Urges Completion of Long-Delayed Trading
Database'', John McCrank, August 27, 2018, https://www.reuters.com/
article/us-usa-stocks-regulation-cat/sec-urges-completion-of-long-
delayed-trading-database-idUSKCNILC2FA.
---------------------------------------------------------------------------
What are the risks to the market if the SEC does not have
the tools to quickly, efficiently, and accurately track
information about trades in the event of another Flash Crash?
A.1. The CAT is intended to enhance the regulators' ability to
perform market analyses and market reconstruction. When the SEC
approved the CAT NMS Plan filed by the SRO consortium, it
discussed the benefits of such audit trail enhancements
including to conduct surveillance and market reconstruction. In
its role as CAT Plan Processor for the SRO consortium, FINRA
CAT is committed to providing a CAT solution that meets the
requirements of the CAT NMS Plan and supports the CAT's
intended regulatory uses.
Q.2. High-frequency trading, which allows for rapid buying and
selling based on computer formulas and complex algorithms, now
accounts for more than half of daily trading volume. \3\
---------------------------------------------------------------------------
\3\ CNBC, ``Just 10 Percent of Trading Is Regular Stock Picking,
JPMorgan Estimates'', Evelyn Cheng, June 14, 2017, https://
www.cnbc.com/2017/06/13/death-of-the-human-investor-just-10-percent-of-
trading-is-regular-stock-picking-jpmorgan-estimates.html.
---------------------------------------------------------------------------
What are the risks of not having a comprehensive regulatory
system, such as the proposed CAT, to oversee these frequent and
rapid securities trades?
A.2. The CAT NMS Plan includes a number of provisions designed
to promote the accuracy of linked and sequenced order activity
data. When the SEC approved the CAT NMS Plan filed by the SRO
consortium, it discussed the benefits of these provisions and
how they are designed to enhance the ability of regulators to
oversee trading activity in the equities and options markets.
In its role as the CAT Plan Processor for the SRO consortium,
FINRA CAT is committed to providing a CAT solution that meets
the requirements of the CAT NMS Plan and supports the CAT's
intended regulatory uses.
Q.3. In 2012, the SEC approved a rule to establish the CAT.
Nearly 10 years after the May 2010 Flash Crash, the CAT is
still not in place to protect the U.S. economy and people
across the country that would suffer from another major hit to
the market. The continued lack of real-time trade reporting and
monitoring of the securities market, however, remains a
significant vulnerability in our regulatory system.
Senator Brown's opening statement stated that, `` . . . the
SEC called on [the Financial Industry Regulatory Authority
(FINRA)] and the firms that run our Nation's stock and options
exchanges to build the Consolidated Audit Trail, or CAT, one
system with a beginning-to-end view of how trading happens, so
we can prevent insider trading, market manipulation, and other
misconduct that cheats the system.'' \4\
---------------------------------------------------------------------------
\4\ Opening statement of Ranking Member Sherrod Brown to the U.S.
Senate Committee on Banking, Housing, and Urban Affairs, October 22,
2019, https://www.banking.senate.2.ov/imo/media/doc/
Brown%20Statement%2010-22-192.pdf.
---------------------------------------------------------------------------
Please explain how the CAT would prevent these harmful and
illegal practices in U.S. securities trades.
A.3. When the SEC approved the CAT NMS Plan filed by the SRO
consortium, it discussed the intended use of CAT data to
enhance the ability of regulators to surveil the equities and
options markets, including for market manipulation, insider
trading and violations of trading rules, among other things.
Enhanced surveillance with CAT data will, in part, be achieved
by including more complete and aggregated information about the
full life cycle of orders and customer-identifying information.
The SEC noted its belief that enhanced surveillance may reduce
violative behavior through potential enforcement actions and
through deterrence if market participants believe violative
activities are more likely to be detected. In its role as the
CAT Plan Processor for the SRO consortium, FINRA CAT is
committed to providing a CAT solution that meets the
requirements of the CAT NMS Plan and supports the CAT's
intended regulatory uses.
Q.4. Despite the many benefits of the CAT, as described in your
written testimony and the testimonies of the other witnesses,
the securities industry and their lobbying groups have
repeatedly pushed to delay the implementation of the CAT by
arguing that collecting large amounts of trading data is unsafe
due to cybersecurity concerns. \5\ \6\
---------------------------------------------------------------------------
\5\ The Hill, Opinion, ``The National Security Risk No One Is
Talking About'', Christopher Iacovella, July 3, 2019, https://
thehill.com/opinion/cybersecurity/451403-the-national-security-risk-no-
one-is-talking-about.
\6\ SIFMA, ``Beware of CAT'', Randy Snook, November 30, 2017,
https://www.sifma.org/resources/news/beware-of-cat/.
---------------------------------------------------------------------------
You state in your written testimony, ``Given the size and
complexity of the financial markets, the CAT must collect,
process, and store a vast amount of data to achieve this
goal.'' \7\
---------------------------------------------------------------------------
\7\ Written testimony of Shelley Bohlin to the U.S. Senate
Committee on Banking, Housing, and Urban Affairs, October 22, 2019,
https://www.banking.senate.gov/imo/media/doc/Bohlin%20Testimony%2010-
22-192.pdf.
---------------------------------------------------------------------------
Please explain in detail why the CAT must collect and
maintain significant amounts of data on the entire life cycle
of securities orders.
A.4. The SEC-approved CAT NMS Plan includes discussion of the
surveillance and oversight benefits intended by Plan
requirements to track the entire life cycle of orders from
origination through routing, cancellation, modification, or
execution. This necessarily requires that the CAT collect and
maintain significant amounts of data. As the SEC noted in its
order adopting Rule 613, in analyzing the events of May 6,
2010, SEC staff were only able to create a comprehensive view
of the order books by acquiring, processing, and aggregating
four distinct data sets that each contained a subset of order
book information from each of the four exchanges that could
provide such information: Nasdaq ModelView, NYSE Openbook
Ultra, NYSE ARCABook, and BATS Exchange (citing to the final
joint report issued by the staffs of the CFTC and the SEC on
September 30, 2010). The SEC further noted that this required
the processing of an enormous volume of data. Since FINRA CAT
assumed the role of the CAT Plan Processor and began work on a
solution for the first scheduled phase of the CAT--the
collection and processing of order and trade data from the
equities and options exchanges and FINRA--it has used scalable
technology to process, on average, over 100 billion market
records a day.
Q.5. Please explain why the lack of this data would render the
CAT insufficient to protect the markets from disruptions, such
as the May 2010 Flash Crash.
A.5. If CAT does not contain order life cycles, the stated
objectives of CAT will not be achieved--better market
reconstruction, enhanced policymaking, and more robust
surveillance, among other things. All of these objectives,
which will be enhanced by the CAT, may contribute to better
market features and rules that could further minimize the risk
of another flash crash-type event, but the CAT itself will not
halt or prevent market activity. The SEC-approved CAT NMS Plan
includes a number of requirements to promote the complete,
accurate and timely consolidation of audit trail information to
serve these uses. In turn, the CAT is designed to better inform
policy decisions and generally improve oversight of the
securities markets. In its role as the CAT Plan Processor for
the SRO consortium, FINRA CAT is committed to providing a CAT
solution that meets the requirements of the CAT NMS Plan and
supports the CAT's intended regulatory uses.
Q.6. A July 2019 op-ed from the head of the securities
industry's lobbying organization argued that, ``The SEC has
been hacked before, and it knows the CAT will put the
[personally identifiable information (PII)] of millions of
American investors at risk.'' \8\ The consortium in place to
create and implement the CAT, however, recently published a
presentation with details regarding ongoing cybersecurity
protections. \9\
---------------------------------------------------------------------------
\8\ The Hill, Opinion, ``The National Security Risk No One Is
Talking About'', Christopher Iacovella, July 3, 2019, https://
thehill.com/opinion/cybersecurity/451403-the-national-security-risk-no-
one-is-talking-about.
\9\ CAT NMS Plan, ``CAT Security Overview: Safeguarding Data
Reported to CAT'', Accessed October 25, 2019, https://
www.catnmsplan.com/wp-content/uploads/2019/08/FINRA-CAT-Security-
Approach-Overview20190828.pdf.
---------------------------------------------------------------------------
Please explain in detail how the CAT would protect
sensitive personal data from data breaches or other
cybervulnerabilities. Please also explain how the consortium
creating and implementing the CAT would be held accountable for
cybervulnerabilities.
A.6. The security of PII, and of all CAT data more broadly, is
of the utmost priority to FINRA CAT. FINRA CAT has put in place
a robust data security program to meet the CAT NMS Plan's
requirements. This program is defined in an extensive System
Security Plan built in accordance with the NIST SP800 series
Special Publication with security controls specifically defined
in accordance with NIST SP800-53. While not public for security
reasons, this SSP is evaluated by an expert independent third-
party as an integral part of an annual Independent Verification
and Validation (IV&V) assessment that verifies that security
controls are well defined and effectively implemented. The SSP
includes incident response and breach management controls. As
the SRO consortium recently discussed in a presentation to the
industry, the FINRA CAT security program includes significant
layers of architectural-level security controls and program-
level security controls. Examples of architectural controls
include secure private-line-only infrastructure for connecting
to the CAT regulatory interfaces (designed without an Internet
interface) and architectural separation between transaction
data and PII. Examples of program controls include a full suite
of information security policies, procedures and standards, an
extensive cybersecurity program staffed by highly qualified
cybersecurity personnel that is integrated into the full
development and operations life cycle of FINRA CAT, and
regularly scheduled independent third-party system penetration
testing, code reviews, and security control validation. FINRA
CAT also is cognizant that its cybersecurity framework must not
be static; it must evolve as more effective cybersecurity
techniques and practices emerge.
FINRA CAT has notification processes in the event of
unauthorized access to CAT Data, but those vary depending on
the facts and circumstances of any breach/intrusion. If FINRA
CAT becomes aware of actual (or potential) unauthorized access
to CAT Data, we, working with the SRO consortium, will take all
reasonable steps to investigate the incident, mitigate any
technical vulnerabilities identified from unauthorized access
to protect the integrity of the CAT system. We also will work
with the SRO consortium to report unauthorized access to law
enforcement, the SEC and other authorities and to notify
customers as required or as the consortium deems appropriate.
As an ``SCI Entity,'' FINRA CAT is subject directly to the
SEC's jurisdiction, including Regulation Systems Compliance and
Integrity (Reg SCI). FINRA CAT's status as an SCI Entity
ensures direct accountability, including cyber incident
reporting requirements to the SEC, as well as important issues
like system security, integrity, capacity, and business
continuity.
Q.7. Please explain how Federal regulators will be able to
quickly and effectively detect and respond to malicious
cyberactivity targeting the CAT. Please also explain how
Federal regulators and the consortium would test and maintain
the CAT's cybersecurity mechanisms.
A.7. The FINRA CAT System Security Plan includes controls for
detecting and responding to malicious activity, including
monitoring controls at multiple system layers (e.g., data
storage, application front end) designed to detect access and
usage anomalies. This includes the use of behavioral analytics
designed to recognize normal and abnormal access patterns. All
access to CAT Data is logged, in accordance with the Plan and
subject to this monitoring. Should any such anomalies be
detected, they will be handled in accordance with the published
Information Security Incident Response Plan, which includes
notification of appropriate regulatory bodies, including the
SEC in accordance with Reg SCI.
With respect to testing and maintaining the CAT's
cybersecurity mechanisms, as required by the Plan, FINRA CAT
subjects itself to the following regular independent third-
party assessments:
Third-party security penetration testing and code
security assessments. These third-party assessments are
performed in addition to a robust suite of internal
security testing that is performed by highly qualified
security staff of the Plan Processor and embedded into
the system development life cycle.
An independent validation and verification (IV&V)
of the controls defined in the System Security Plan
(SSP). The SSP encompasses the hundreds of security
controls defined by NIST SP800-53. The design and
effective implementation of these controls is
independently validated by the IV&V. This is the same
set of security controls and independent validation
process required for Federal Systems under the Federal
Information Security Management Act.
Material security deficiencies identified by these
testing processes are presented to the consortium's
Operating Committee when it considers whether to grant
an Authorization To Operate (ATO) for each release. Any
security deficiencies identified by these testing
processes are presented to the consortium's Operating
Committee as part of the package of information it
considers in granting an Authorization To Operate (ATO)
for each release.
------
RESPONSES TO WRITTEN QUESTIONS OF
SENATOR CORTEZ MASTO FROM SHELLY BOHLIN
Q.1. Will the CAT help regulators, such as FINRA, SEC, FBI, and
the Department of Justice, catch short selling, spoofing, fake
trades, and wire fraud more quickly?
A.1. When the SEC approved the CAT NMS Plan filed by the SRO
consortium, it discussed the intended use of CAT data to
enhance the regulators' ability to surveil for market
manipulation, such as spoofing and other violations of trading
rules, which include rules concerning short sales. In its role
as the CAT Plan Processor for the consortium of self-regulatory
organizations responsible for managing the CAT (known as CAT
Plan Participants or the SRO consortium), FINRA CAT is
committed to providing a CAT solution that meets the
requirements of the CAT NMS Plan and supports the CAT's
intended regulatory uses.
Q.2. Could the CAT system help investigate who is making a
billion-dollar profit in trades made right before the Trump
administration makes a market-moving announcement?
A.2. One of the intended uses of the CAT discussed by the SEC
and the SRO consortium is the enhanced ability to identify
customers who originate orders. In its role as the CAT Plan
Processor for the SRO consortium, FINRA CAT is committed to
providing a CAT solution that meets the requirements of the CAT
NMS Plan and supports the CAT's intended regulatory uses.
Q.3. Will the CAT be able to help exchanges and regulators know
if brokers are being ``unduly influenced by fees and rebates''
rather than the best execution outcome for investors?
A.3. When the SEC approved the CAT NMS Plan, it noted its
belief that the Plan would facilitate enforcement of best
execution. In addition, when the SEC adopted its Transaction
Fee Pilot to study the effects that exchange transaction fee-
and-rebate pricing models may have on order routing behavior,
execution quality and market quality, it discussed the
potential for CAT data to be used to support the study. In its
role as the CAT Plan Processor for the SRO consortium, FINRA
CAT is committed to providing a CAT solution that meets the
requirements of the CAT NMS Plan and supports the CAT's
intended regulatory uses.
Q.4. Will the CAT help exchanges and regulators know if brokers
are routing the trading interests of mutual funds, pensions,
and endowments in a way that results in information leakage?
A.4. When the SEC approved the CAT NMS Plan, it noted its
belief that the Plan would facilitate enforcement of trading
rules. For example, the SEC-approved CAT NMS Plan is intended
to enhance regulators' ability to track the entire life cycle
of orders from origination through routing, cancellation,
modification, or execution. In its role as the CAT Plan
Processor for the SRO consortium, FINRA CAT is committed to
providing a CAT solution that meets the requirements of the CAT
NMS Plan and supports the CAT's intended regulatory uses.
Q.5. Will the CAT help exchanges and regulators identify
sophisticated market participants who use multiple brokers and
market centers to engage in disruptive trading?
A.5. When the SEC approved the CAT NMS Plan filed by the SRO
consortium, it discussed the intended use of CAT data to
enhance the regulators' ability to surveil for market
manipulation, including by conducting surveillance across
market centers and identifying activity originating from
multiple market participants. In its role as the CAT Plan
Processor for the SRO consortium, FINRA CAT is committed to
providing a CAT solution that meets the requirements of the CAT
NMS Plan and supports the CAT's intended regulatory uses.
Q.6. We have had a lot of discussion about how difficult it is
to identify the beneficial owners of firms. This secrecy can
lead to criminal activities. For example, Mr. Navinder Singh
Sarao (the individual who initiated the 2010 flash crash) was
not registered as a broker in the U.S. He used four firms to
place his trades.
Would CAT be able to find him or just his brokers?
A.6. The SEC adopted Rule 613 in the wake of the 2010 flash
crash to require the CAT to be created. The SEC explained at
the time that the purpose of the CAT is to create a
comprehensive consolidated audit trail that allows regulators
to efficiently and accurately track all activity in listed and
unlisted equity securities and listed options throughout the
U.S. markets to facilitate comprehensive market
reconstructions, more robust market surveillance, and better
analytics to support policymaking.
Any broker-dealer that is a member of a national securities
exchange or FINRA and receives and/or handles orders in NMS
Securities, which includes NMS stocks and Listed Options, and/
or unlisted OTC Equity Securities--regardless of whether they
operate in a foreign country--must report to CAT and satisfy
clock synchronization requirements. If a non-U.S. broker-dealer
routes an order to a U.S. broker-dealer, the receiving U.S.
broker-dealer is required to report the receipt of an order
from a non-U.S. broker-dealer in the same way as it would
report the receipt of an order from a Customer. Specifically,
the receiving U.S. broker-dealer would report the receipt of
this order as the original receipt of the order from the non-
U.S. broker-dealer, and the receiving U.S. broker-dealer also
would report the Firm Designated ID for the non-U.S. broker-
dealer. The U.S. broker-dealer would not report the ultimate
customer of the non-U.S. broker-dealer. However, CAT Plan
Participants and other regulators like the SEC could request
the identification of the ultimate customer at the non-U.S.
broker-dealer from the U.S. broker-dealer, and if necessary may
be able to request the information from foreign regulators.
Q.7. The system is only as good as the exchanges who report
concerns and ownership. How will you ensure that exchanges
fully comply with reporting?
A.7. FINRA CAT is required by the CAT NMS Plan to develop and
implement a comprehensive compliance program to monitor CAT
Reporters' adherence to SEC Rule 613. The CAT Plan Processor
must produce and provide reports to the SROs and the SEC
containing performance and comparison statistics, as needed, on
each CAT Reporters' compliance thresholds so that the
Participants or the SEC may take appropriate action if a
Participant fails to comply with its CAT reporting obligations.
Q.8. What are your views on including futures data and over-
the-counter equities in CAT?
A.8. While futures data could aid regulators in cross-market
surveillance, the current plans for the consolidated audit
trail (CAT) do not include this information. As a practical
matter, while FINRA CAT has the systems capability, knowledge,
and expertise to build out a system that could incorporate
futures data, any work towards that end would necessarily only
follow the legal and policy decisions made by Federal
regulators, including the CFTC and the SEC. The current CAT NMS
Plan already requires the reporting of over-the-counter
equities to CAT.
Q.9. What are your views on including initial public offering
data, clearing data, and other data into the CAT database?
A.9. FINRA CAT has the knowledge and expertise to build a
system that can gather other forms of data, but those are
policy decisions that would need to be made by others,
including the SEC and the SRO consortium. Currently, clearing
and IPO data is not within the scope of SEC Rule 613 or the CAT
NMS Plan. However, the SRO consortium filed a public written
assessment with the SEC concerning an expansion of the CAT to
include certain additional data, including information on
primary market transactions. You can find more information
about this issue at the following link: https://
www.catnmsplan.com/wp-content/uploads/2017/06/Expansion-Report-
Final-5.15.17.pdf.
Q.10. How is CAT Advisory Committee and Operating Committee
ensuring that CAT will remain technologically robust and
modern?
A.10. Pursuant to the CAT NMS Plan, the CCO's annual
assessment, which is provided to the SEC and the CAT NMS Plan
Operating Committee, must include ``an evaluation of potential
technology upgrades based on a review of technological
advancements over the preceding year, drawing on technological
expertise whether internal or external.'' For example, as cloud
technology evolves and advances, CAT will adapt accordingly. In
addition, the Plan Participants, with their own wealth of
technological expertise, are actively involved with making sure
that CAT remains technologically robust and modern. In
addition, unless a matter is discussed in executive session,
the Advisory Committee has an opportunity to comment on or ask
questions about relevant topics during Operating Committee
meetings, including the technology used to support the CAT.
Q.11. Assuming CAT is implemented in the next 3 years, what are
the upgrades that will need to take place to ensure CAT does
not fall behind the industry best practices?
A.11. FINRA CAT will continue to work with the industry and
other stakeholders to not only maintain state-of-the-art
technology and data security practices, but it will strive to
lead the industry and anticipate technological needs and
improvements. We will evolve as technology evolves. The
complexity of CAT requires deep technological expertise,
sophisticated and proactively evolving security, and close
coordination with all stakeholders. As an ``SCI Entity,'' FINRA
CAT is subject directly to the SEC's jurisdiction, including
compliance with Regulation Systems Compliance and Integrity
(Reg SCI). FINRA CAT's status as an SCI Entity ensures direct
accountability to the SEC--for important issues like system
security, integrity, capacity, and business continuity. We have
built out a dedicated FINRA CAT operations staff led by me and
a Chief Technology Officer. We also hired, with the approval of
the SRO consortium, a Chief Information Security Officer (CISO)
and a Chief Compliance Officer (CCO). These officers are
responsible, respectively, for FINRA CAT's information
technology security and governance and regulatory compliance
programs.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR SINEMA
FROM SHELLY BOHLIN
Q.1. Upon full implementation, the Consolidated Audit Trail
(CAT) system will be an unprecedented database, collecting 58
billion records and maintaining data on over 100 million
institutional and retail accounts on a daily basis. The CAT,
and all the unique customer data it holds, will also be
accessible to thousands of users. Therefore, while the CAT has
the potential to offer important oversight, it will also be a
prime target for cyberhacks. Under current CAT requirements,
what kind of personal information would be accessible to system
users? Is this information already being collected by other
audit trail systems?
A.1. Under the current CAT NMS Plan, industry members will be
required to report certain customer identifying information,
including account numbers and some personally identifying
information, or PII. The consortium of self-regulatory
organizations responsible for managing the CAT (known as CAT
Plan Participants or the SRO consortium) has filed requests
with the SEC to limit the Plan's PII collection requirements.
Specifically, under the SRO consortium's requests, the CAT
would not receive and store individuals' account numbers,
social security numbers or dates of birth. FINRA CAT notes that
any PII stored in the CAT is subject to heightened security
controls, such as architectural separation in a separate PII
subsystem with restricted user access. When the SEC approved
the CAT NMS Plan, it discussed the extent to which customer-
identifying information is included in existing audit trail
systems such as Electronic Blue Sheets.
Q.2. The Securities and Exchange Commission has been advised
that the CAT system should not collect Social Security numbers,
account numbers, and full dates of birth. Can regulators
properly conduct market analysis, investigations, and
enforcement if these pieces of information are not collected by
the CAT?
A.2. FINRA CAT recognizes the ongoing policy discussions
related to the necessity of specific elements of customer-
identifying information for the success of the CAT, which are
ultimately matters the SRO consortium and the SEC must
determine. FINRA CAT is committed to providing a CAT solution
that supports the regulators' decision making on this issue.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR SASSE
FROM JUDY MCDONALD
Q.1. Would the Commission consider setting up a test bed and
proving to the Banking Committee Members that the ``SSN's would
be secure''?
A.1. Provided the October 16, 2019, Request for Exemptive
Relief is accepted, SSNs will not be stored in the CAT Customer
and Account Information data repository. \1\ The only PII which
will be stored will be ``phone book'' type data: name, address,
year of birth, masked account number, account type, and the
individual's role in the account. I encourage the Banking
Committee to request to review the results of the third party
security reviews including the (1) Independent Verification and
Validation and (2) Penetration Testing results which should
provide reasonable assurances about the security of all PII
data.
---------------------------------------------------------------------------
\1\ https://www.catnmsplan.com/wp-content/uploads/2019/10/CCID-
and-PII-Exemptive-Request-Oct-16-2019.pdf
---------------------------------------------------------------------------
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR KENNEDY
FROM JUDY MCDONALD
Q.1. I am concerned the CAT is a likely target for those who
wish to manipulate U.S. markets--are you confident the CAT
system and data included within will be adequately protected
from these threats?
A.1. No, the AC shares your concerns with the vulnerability of
CAT data. Although FINRA CAT has very good security in the
FINRA CAT environment and has not only met the ``gold
standard'' of NIST SP800-53 but has exceeded this standard by
encrypting data at-rest and in-transit, establishing
independent third party verification and validation,
establishing independent penetration testing as well as
monitoring every query and command with behavioral-based
analysis for alerting. There is also considerable oversight of
these security efforts.
However, some significant concerns exist, specifically:
1. The bulk downloading of CAT data by 23 different
exchanges plus the SEC. Currently, each of the securities
regulators has unfettered access to bulk down load CAT data.
Although the SRO's have always had to satisfy security
requirements, the AC has no insight into their security
programs and do not know if they meet the same standards or
practices as FINRA CAT, which is especially concerning in light
of the increased value of the CAT data and the increased
likelihood of compromise.
2. There will be up to 3,000 CAT individual users
(individual users) made up of (presumably) regulatory staff and
academics, which once again multiplies the risk of compromise.
\1\ These users may download CAT data to their respective PCs
without limitation. While oversight is required, the AC has no
insight into the criteria, quality, or frequency of that
oversight; nor does the AC have an understanding of the
protocols that would preclude any of the individual users from
misappropriating the CAT data. Likewise, the AC has no insight
into any protections of these entities from computer hacks or
other cyber threats, and ergo have no basis for confidence in
their security protocols. Additionally the only review SRO's
undergo prior to enabling their employee's access to the CAT
data is a security policy review by the FINRA CAT CISO. \2\ The
AC is concerned that even if the security policy is well
written, it does not provide assurance with respect to actual
implementation.
---------------------------------------------------------------------------
\1\ The CAT Plan does not limit access to regulatory staff, but
rather limits access to ``regulatory purposes'', which is an undefined
term. Accordingly, it is uncertain how each exchange may interpret the
scope of this limitation and therefore what personnel may have access.
\2\ The individual employees must sign A ``Safeguard of
Information'' Affidavit however, this is independent of any SRO
requirement.
---------------------------------------------------------------------------
3. Unlimited access of cross-market data. Historically, the
exchanges have always had access to the data in their own
markets and limited access to activities in other markets;
however, CAT will supply easy and very broad access to all
exchange and broker-dealer data at all times.
4. The CAT Reporter Agreement. Broker-dealers must sign the
CAT Reporter Agreement in order to access the CAT to report
transactions. This agreement contains provisions including
limiting the financial liability of CAT to $500 and maintaining
regulatory immunity for data breaches.
In light of these issues, two of the best ways to
strengthen data security is to (1) control the use of the data
as tightly as possible and (2) limit the number of people with
access to the data. The AC has developed, and continues to
refine, a number of security recommendations that have been
shared with the SEC and SROs including; establishing a secure
data reviewing environment, limits on bulk-downloading, and
improvements to cross-market data access policies and
procedures.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR WARNER
FROM JUDY MCDONALD
Q.1. You've raised concerns with allowing the exchanges to hold
CAT data. Given that our system currently gives SROs regulatory
authority, would restricting the exchanges' access to CAT data
limit the overall ability to identify bad conduct and
reconstruct market events?
A.1. The AC is concerned about the SROs having access to cross-
market data that is beyond what they would need to meet their
existing regulatory obligations. These obligations generally
include monitoring their member's activities, but not for each
of the 23 SROs to individually undertake cross-market
surveillance, since that is already covered by FINRA. I believe
the SROs can very effectively use CAT data to pursue issues and
alerts that arise in the course of monitoring the activities of
their members, including access to specific data of interest
about a member's activities on other exchanges. Targeted access
to cross-market data, instead of unrestricted access, will
ensure a more secure and properly used CAT.
The SEC has the expertise and experience to undertake
wholesale market reconstruction. The AC is not recommending any
restrictions on access by the SEC to any of the non-PII data in
CAT, with the caveat that the number of staff accessing the
system should be minimized to only those who are in fact
working on market reconstructions, rule proposals, or specific
exam/investigations matters, and that the nature of the queries
should be narrowly scoped to the set of data needed to complete
the task.
Q.2. What were the causes for implementation delays?
A.2. There are many reasons for the delay in CAT implementation
from the aggressive initial timeline to those enumerated in the
SRO's November 13, 2017, Request for Exemptive Relief. \1\
---------------------------------------------------------------------------
\1\ https://www.sec.gov/comments/4-698/4698-2681993-161486.pdf
Q.3. Please describe the background of how Thesys was selected
---------------------------------------------------------------------------
as the Plan Processor to build the CAT?
A.3. The selection of Thesys as the Plan Processor predates the
formation of the AC, so I cannot comment the background of how
Thesys was selected as the Plan Processor.
Q.4. What other bidders were short-listed? Why was Thesys
selected? Which exchanges voted for Thesys?
A.4. The bidding process predates the formation of the AC, so I
cannot comment on how Thesys was selected.
Q.5. Would you agree that a major part of the delay in the CAT
implementation occurred from the inability of Thesys to provide
a viable system after working on it nearly 2 years?
A.5. Yes, there are many reasons for the delay in CAT
implementation from the aggressive initial timeline to those
enumerated in the SRO's November 13, 2017, Request for
Exemptive Relief. \2\ Additional information can be provided by
other witnesses.
---------------------------------------------------------------------------
\2\ https://www.sec.gov/comments/4-698/4698-2681993-161486.pdf
Q.6. What did other participants propose to replace Thesys
before they were finally fired earlier this year? Why did the
exchanges keep them on the contract for as long as they did?
Were the exchanges in agreement on whether Thesys should be
retained?
A.6. I have no direct knowledge of these topics.
Q.7. Please describe how a subsidiary of FINRA was selected
earlier this year to replace Thesys? Was there an open bidding
process? Were there other bidders?
A.7. I have no direct knowledge of these topics.
Q.8. How was the SEC engaged with CAT NMS as it began
experiencing significant delays?
A.8. I have no direct knowledge of these interactions.
Q.9. What are SEC current authorities in compelling the
implementation of CAT?
A.9. I am unaware of any specific authorities.
Q.10. I understand that as a member of the Advisory Committee
you don't have a vote or seat at the operating committee.
Are there improvements that you would make to help the
operating committee run more effectively?
A.10. The CAT NMS Plan underlines the flaws inherent with the
governance model for NMS Plans. NMS Plans grant SRO's sole
authority as Operating Committee members to design, implement
and allocate costs without providing industry members any
representation on a decision-making body. This governance
structure limits transparency and creates perceived conflicts
of interest. The industry is limited to the AC which
participates in general Operating Committee meetings but does
not meet in executive sessions nor have a vote in any forum.
Additionally, the AC does not participate in all working
groups. The AC is not typically included in other meetings or
prior to the formation of a subcommittee working group.
Providing Broker-Dealers and Asset Management firms better
access to contribute their expertise and experience with voting
rights would lead to better outcomes.
Q.11. Do you think investors are adequately represented as part
of the governance process?
A.11. No, I think investors are under-represented in the
governance of this process.
Under the approved CAT NMS Plan, the AC is comprised of 14
members including one ``individual who maintains a securities
account with a registered broker or dealer but who otherwise
has no material business relationship with a broker or dealer
or with a participant'' as well as three persons selected to
``represent a registered investment company.'' These four AC
members are particularly focused on the interests of the
investing public.
Members of the AC represent the industry from various
perspectives; the AC is united on three common and deep
concerns--that is, data security, preventing the misuse of
information, and limiting costs which might be ultimately borne
by the investing public. Protection of personally identifiable
information (PII) and transactional data and minimizing costs
are the primary goals of all members of the AC, not just those
representing individual investors and investment companies.
The AC itself is restricted in its power and ability to be
effective. The AC provides as much input and feedback as the
current structure and practice allow; however, the AC has no
voting position on the Operating Committee, is excluded from
Executive Sessions, and is frequently provided information in
an untimely manner. Investors would be more fully represented
if the AC were permitted greater involvement in the governance
process.
Q.12. Can the SEC appoint or remove members of the operating
committee? Does the CAT NMS Plan or Rule 613 prohibit the SEC
from appointing or removing members of the operating committee?
A.12. No, CAT NMS Plan Section 4.2 provides for the composition
of the operating committee which does not include provisions
for appointment or removal of members by the SEC.
Q.13. Does Rule 613 prohibit the SEC from appointing
independent members to the operating committee?
A.13. The CAT NMS Plan does not have any provision that
provides for the SEC to appoint an independent member of the
operating committee.
Q.14. What, in your view, can independent members provide to
the operating committee? Are there benefits?
A.14. The Operating Committee is currently composed solely of
SRO representatives which are dominated by three large exchange
``families'' including ICE, Nasdaq, and CBOE. Each of these
SRO's have coaligned regulatory obligations and financial
interest in the operation and regulation conducted with CAT
data. Absent from this committee is any insight from the
thousands of broker-dealers, market makers, and asset managers
whose proprietary data will be submitted to CAT, who will be
subject to the reporting obligations of CAT, and who will in
time significantly fund the CAT.
------
RESPONSES TO WRITTEN QUESTIONS OF
SENATOR CORTEZ MASTO FROM JUDY MCDONALD
Q.1. Will the CAT help regulators, such as FINRA, SEC, FBI, and
the Department of Justice, catch short selling, spoofing, fake
trades, and wire fraud more quickly?
A.1. CAT data will be used by SEC and self-regulatory
organizations (SRO's) within the definition of Section 3(a)(26)
of the Exchange Act. The CAT data is intended to be used for,
``surveillance and regulatory purposes,'' a broad term that has
yet to be defined, and industry participants remained concerned
that SRO's can take an expansive view and use this data for
quasicommercial purposes. CAT data should enable regulatory
personnel to better identify anomalous trading activities
across multiple markets and accounts. Short selling, of course,
is not illegal, but CAT should allow regulators to better
identify manipulative strategies that involve short selling. It
is unclear if CAT data would help in identifying wire fraud.
Q.2. Could the CAT system help investigate who is making a
billion-dollar profit in trades made right before the Trump
administration makes a market-moving announcement?
A.2. CAT data and analysis tools are intended to help
regulators identify anomalous trading patterns which occur
prior to an event and assist regulators more quickly to
identify both the beneficial owners of those trades and persons
with the authority to trade.
Q.3. Will the CAT be able to help exchanges and regulators know
if brokers are being ``unduly influenced by fees and rebates''
rather than the best execution outcome for investors?
A.3. CAT data and analysis tools provided with CAT should, in
addition to existing public disclosure of executing and routing
practices reports which are already required under Rule 605 and
606 of Regulation NMS, help regulators identify patterns of
order routing.
Q.4. Will the CAT help exchanges and regulators know if brokers
are routing the trading interests of mutual funds, pensions,
and endowments in a way that results in information leakage?
A.4. CAT data and analysis tools are intended to help
regulators identify order routing patterns which could be
indicative of information leakage, when combined with other
information such as financial news.
Q.5. Will the CAT help exchanges and regulators identify
sophisticated market participants who use multiple brokers and
market centers to engage in disruptive trading?
A.5. Market participants may use multiple brokers and trade
across market centers for a number of legitimate reasons,
however, one of the most significant characteristics that
differentiates CAT from existing regulatory systems is that CAT
will enable regulators to identify an individual or entity's
trading patterns across multiple broker-dealers and market
centers. All trading activity will be tracked to the individual
or entity with a common CAT Customer ID(s).
Q.6. We have had a lot of discussion about how difficult it is
to identify the beneficial owners of firms. This secrecy can
lead to criminal activities. For example, Mr. Navinder Singh
Sarao (the individual who initiated the 2010 flash crash) was
not registered as a broker in the U.S. He used four firms to
place his trades.
Would CAT be able to find him or just his brokers?
A.6. The CAT Customer and Account Information combined with the
CAT Customer ID allows for the identification of the accounts
of U.S. citizens across broker-dealers and the beneficial
owners of those accounts. However if the beneficial owner is
not a U.S. citizen, the account can only be identified to the
broker-dealer.
Q.7. The system is only as good as the exchanges who report
concerns and ownership. How will you ensure that exchanges
fully comply with reporting?
A.7. The SEC and SRO's are responsible for ensuring compliance
with CAT reporting. The Advisory Committee (AC) has no power to
enforce exchange compliance with reporting and is limited to
providing comments on policies and procedures which could help
motivate compliance and detect lack of compliance.
Q.8. What are your views on including futures data and over-
the-counter equities in CAT?
A.8. OTC equities will be included in CAT data. Futures are (1)
a different asset class, (2) traded with different participants
and for different reason than equities and options, and (3) are
regulated by the CFTC rather than the SEC. Including futures in
CAT would require significant input from not only financial
services firms with CAT obligations, but also end-users
including energy producers, agricultural, and other commodities
participants. While including futures data in CAT would provide
a more robust picture of some cross-asset class trading such as
the SPY (the S&P 500 Depository Receipt) vs. S&P 500 e-mini
contract at the Chicago Mercantile Exchange, a significant
study of the need for futures data in CAT as well as the
expected outcome of including futures in CAT should commence
prior to any further action.
Q.9. What are your views on including initial public offering
data, clearing data, and other data into the CAT database?
A.9. IPO data would provide regulatory value, however it would
be a very expensive effort in light of the current business
practices related to an IPO which are extremely manual,
unstructured, and highly variable with each offering. Any
reporting requirements are likely to change business practices.
I suggest performing a thorough analysis prior to publishing a
rule proposal and then taking an iterative approach, starting
with the very basic reporting requirements and gradually
increasing if additional information is needed and additional
value is anticipated. Many of these ideas are more fully
expressed in the October 28, 2019, Financial Information Forum
comment letter. \1\
---------------------------------------------------------------------------
\1\ https://fif.com/comment-letters
---------------------------------------------------------------------------
Clearing data will have little regulatory value for CAT
once allocation reporting into CAT is complete in April 2021
for equities and December 2021 for options. CAT data will
provide regulators with access to account information including
the account owner of the order when it was placed, the
beneficial owner of where the equities or options are held,
fill reports, and final allocation instructions.
Q.10. How is CAT Advisory Committee and Operating Committee
ensuring that CAT will remain technologically robust and
modern?
A.10. The AC is very active and provides extensive technical
feedback at the level of standards, procedures and practices
and insight based on the experiences of the relative firms;
however the AC is limited in that it can only offer comments,
opinions, and suggestions and thus far, has not been consulted
on technology specifics such as architecture, tools, or
specific technical approaches.
Q.11. Assuming CAT is implemented in the next 3 years, what are
the upgrades that will need to take place to ensure CAT does
not fall behind the industry best practices?
A.11. The AC anticipates working with CAT LLC and the SRO's to
ensure that CAT maintains industry best practices as it relates
to (1) data security including adherence to industry standards,
(2) experimentation and utilization of emerging technology, and
(3) capacity and performance planning.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR SINEMA
FROM JUDY MCDONALD
Q.1. Upon full implementation, the Consolidated Audit Trail
(CAT) system will be an unprecedented database, collecting 58
billion records and maintaining data on over 100 million
institutional and retail accounts on a daily basis. The CAT,
and all the unique customer data it holds, will also be
accessible to thousands of users. Therefore, while the CAT has
the potential to offer important oversight, it will also be a
prime target for cyberhacks. Under current CAT requirements,
what kind of personal information would be accessible to system
users? Is this information already being collected by other
audit trail systems?
A.1. Provided the October 16, 2019, Request for Exemptive
Relief is accepted, SSNs will not be stored in the CAT Customer
and Account Information data repository. \1\ The only PII which
will be stored will be ``phone book'' type data: name, address,
year of birth, masked account number, account type, and the
individual's role in the account. Currently this information
can only be obtained on an ad hoc basis through the use of the
Electronic Blue Sheet System.
---------------------------------------------------------------------------
\1\ https://www.catnmsplan.com/wp-content/uploads/2019/10/CCID-
and-PII-Exemptive-Request-Oct-16-2019.pdf
---------------------------------------------------------------------------
In addition to PII, the CAT will also expose the valuable
intellectual property of individual investors and trading firms
by assembling in one place the details of all trading activity
which were previously stored in disparate locations; this data
could be exploited by a bad actor.
Q.2. The Securities and Exchange Commission has been advised
that the CAT system should not collect Social Security numbers,
account numbers, and full dates of birth. Can regulators
properly conduct market analysis, investigations, and
enforcement if these pieces of information are not collected by
the CAT?
A.2. Yes, through the use of the CAT Customer Identifier and
the Customer and Account Information data repository, the
regulators should be able to conduct market analysis,
investigations, and enforcement. This is the primary goal of
the approach which underlies the Exemptive relief request. This
approach has been broadly supported in an informal nature by
industry members and regulators and was a result of many months
of collaboration amongst regulators and industry members.
------
RESPONSES TO WRITTEN QUESTIONS OF CHAIRMAN CRAPO
FROM MICHAEL J. SIMON
Q.1. Early estimates for the creation of a ``real-time'' CAT
would cost $4 billion to launch and have ongoing maintenance
costs of $2.1 billion. What are the current cost estimates for
initial launch costs and what are the cost estimates for
ongoing maintenance for the ``next-day'' CAT approach?
A.1. The Consolidated Audit Trail, LLC (CAT LLC) \1\ operates
pursuant to a budget that the Operating Committee approves on a
quarterly basis. Based on the most recent CAT LLC budget, the
current annualized cost for building and operating the CAT is
approximately $60 million for calendar year 2019. The budget
does not distinguish between build and operating costs. While
the 2020 CAT LLC budget is under development, current estimates
are that the annualized costs will be between $60 and $75
million.
---------------------------------------------------------------------------
\1\ Note, CAT NMS, LLC is the predecessor to CAT LLC.
---------------------------------------------------------------------------
Under current budgetary projections, the FINRA CAT build
costs will peak next year, and then decrease over the next few
years as FINRA CAT finishes the build. On the other hand, the
FINRA CAT costs to operate the CAT will increase substantially
in the coming years, particularly beginning in 2021 as we
approach full CAT functionality. We also expect legal and
consulting costs to decrease as the CAT moves from development
to operation. The bottom line is that the total cost to operate
the CAT is uncertain, but unlikely to increase above $75
million annually in the near future.
There are a number of assumptions and qualifications to
these projections. First, these are the costs solely borne by
CAT LLC regarding the build and operation of the CAT. Thus,
these costs do not include the costs to the Participants and
the industry members to prepare for, and comply with, CAT
requirements. Second, a number of FINRA CAT costs are variable.
Those include the costs of cloud hosting and the customer/
account database. Thus, any estimates of such costs at this
time is somewhat speculative. Finally, FINRA CAT costs could
change based on changes to the current design and operation of
the CAT system, effectuated through the change request process.
Any such change request could add additional costs both to the
development of the CAT and the ongoing costs of operating the
CAT.
Q.2. As the CAT is currently designed, more than 20 SROs and
the SEC would be allowed to download bulk data from CAT into
their systems. In such an arrangement, there is a grave
increase in the likelihood that sensitive information stored in
CAT will be compromised.
Can you explain why the transmission and downloading of
bulk data is currently allowed under the plan? Would a
limitation on downloading of bulk data affect the regulatory
function of the CAT?
A.2. SEC Rule 613 requires that the Participants address data
extraction in the CAT NMS Plan. \2\ Pursuant to this
requirement, the CAT NMS Plan filed with and approved by the
Commission describes the methods by which Participants may
extract data from the CAT system, including via user-defined
direct queries and bulk extracts. \3\ Importantly, the CAT NMS
Plan permits the bulk extract of transaction data only;
Customer Account Information, Customer Identifying Information
and other personally identifiable information (PII) (as defined
in the Plan) may not be subject to bulk extraction. In
addition, Rule 613 and the CAT NMS Plan both require that
Participants develop and implement surveillance systems, or
enhance their existing surveillance systems, to make use of CAT
Data. \4\ As discussed in the Commission's order approving the
CAT NMS Plan, the Participants ``believe that permitting
regulators to download/order transaction data from the Central
Repository for regulatory use (i.e., ``bulk data extracts'') is
important for their regulatory purposes, and that eliminating
or limiting bulk data extracts of transaction data from the CAT
may significantly and adversely impact the Participants'
ability to effectively conduct surveillance of their markets
using CAT Data.'' \5\
---------------------------------------------------------------------------
\2\ See Regulation NMS, 17 CFR 242.613(a)(1)(i), (iii) (2019).
\3\ See National Market System Plan Governing the Consolidated
Audit Trail, Section 6.10(c)(i)(B) available at https://
www.catnmsplan.com/wp-content/uploads/2019/09/CAT-2.0-Consolidated-
Audit-Trail-LLC%20Plan-Executed-(175745081)-(1).pdf [hereinafter the
``CAT NMS Plan'']. See also id. at Appendix D, Section 8.2.2 (``The
Central Repository must provide for direct queries, bulk extraction,
and download of data for all regulatory users. Both the user-defined
direct queries and bulk extracts will be used by regulators to deliver
large sets of data that can then be used in internal surveillance or
market analysis applications.'').
\4\ See Regulation NMS, 17 CFR 242.613(f) (2019); and CAT NMS
Plan, supra note 3 at Appendix D, Section 6.10(a).
\5\ See Joint Industry Plan; Order approving the National Market
System Plan Governing the Consolidated Audit Trail, Exchange Act
Release No. 79318 (Nov. 15, 2016), 81 FR 84696, 84757 (Nov. 23, 2018)
[hereinafter, ``Plan Adopting Release''].
---------------------------------------------------------------------------
The Participants are focused on the security of CAT Data,
including with respect to bulk extracts. Access to CAT Data,
via bulk extract or otherwise, will be subject to the CAT
security protocols. For instance, only authorized regulatory
users with appropriate permissions will be able to access and
extract CAT Data, and all CAT Data returned shall be encrypted.
\6\ Additionally, the CAT system requires multifactor
authentication for regulatory use of the query tools,
mitigating insider risk at the regulators, as well as for
access to the Industry Member reporter portal. \7\
---------------------------------------------------------------------------
\6\ CAT NMS Plan, supra note 3 at Section 6.10(c)(ii).
\7\ See id. at Appendix D, Section 4.1.4.
---------------------------------------------------------------------------
Access and the ability to extract PII is subject to
additional safeguards. All PII collected by the CAT must be
stored separately from transaction data and will not be
eligible for bulk extract. \8\ Regulatory users must have
special entitlements (beyond entitlements to transactional CAT
Data) to access PII data. \9\
---------------------------------------------------------------------------
\8\ See id. at Appendix D, Section 4.1.6.
\9\ See id.
---------------------------------------------------------------------------
Additionally, to balance security considerations and
potential risks related to the bulk extraction of CAT Data, CAT
LLC authorized FINRA CAT to develop and implement a secure
analytics workspace (SAW), which the Participants and the SEC
may use to analyze CAT Data and run their surveillance
protocols. Development of the SAW is underway, and
implementation is expected in the fall of 2020. Until SAW is
operational, the Participants' use of CAT Data must necessarily
take place outside of the SAW. Temporary and persistent copies
of CAT Data may exist in an Amazon Web Services (AWS)
environment protected by security controls, policies, and
practices consistent with the CAT system itself. Small subsets
of CAT Data may be extracted in support of regulatory and
surveillance activities.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR BROWN
FROM MICHAEL J. SIMON
Q.1. Please describe the FINRA CAT breach/intrusion
notification process, including the entities and organizations
that would be notified and the timetable for notification.
Please also describe any process for notification to investors,
or the public generally.
A.1. As required by the Plan, the CAT has a sophisticated
information security program, which includes an incident
response plan consistent with National Institute of Standards
and Technology guidance. The actions taken in the event of
unauthorized access to CAT Data will depend on the
circumstances. If FINRA CAT becomes aware of actual (or
potential) unauthorized access to CAT Data, FINRA CAT will work
with the Participants and will take all reasonable steps to
investigate the incident and mitigate any identified technical
vulnerabilities to protect the integrity of the CAT system. CAT
LLC will report unauthorized access to law enforcement, the
SEC, and other authorities as required or appropriate. This
process may result in the use of, among other things, forensic
services, breach notification services, and/or identity/fraud
monitoring.
Q.2. Please provide the available cost estimates for (i)
building the CAT system and (ii) annual operation of the CAT
system, specifying current cost and costs once it is fully
operational.
A.2. As noted in the answer to Chairman Crapo, CAT LLC operates
pursuant to a budget that the Operating Committee approves on a
quarterly basis. Based on the 2019 CAT LLC budget and actuals
to date, the current annualized cost for building and operating
the CAT is approximately $60 million. The budget does not
distinguish between build and operating costs. While the 2020
CAT LLC budget is under development, current estimates are that
the annualized costs will be between $60 and $75 million.
Under current budgetary projections, the FINRA CAT build
costs will peak next year, and then decrease over the next few
years as FINRA CAT finishes the build. On the other hand, the
FINRA CAT costs to operate the CAT will increase substantially
in the coming years, particularly beginning in 2021. We also
expect legal and consulting costs to decrease as the CAT moves
from development to operation. The bottom line is that the
total cost to operate the CAT is uncertain, but unlikely to
increase above $75 million annually in the near future.
There are a number of assumptions and qualifications to
these projections. First, these are the costs solely borne by
CAT LLC regarding the build and operation of the CAT. Thus,
these costs do not include the costs to the Participants and
the industry members to prepare for, and comply with, CAT
requirements. Second, a number of FINRA CAT costs are variable.
These include the costs of cloud hosting and the customer/
account database. Thus, any estimates of such costs at this
time is somewhat speculative. Finally, FINRA CAT costs could
change based on changes to the CAT system, effectuated through
the change request process. Any such change request could add
additional costs both to the development of the CAT and the
ongoing costs of operating the CAT.
Q.3. Please identify the private and Government organizations
and entities that would be necessary to involve in the
development and management of a CAT system that includes U.S.
futures data and activity.
A.3. A more complete assessment would be necessary to
definitively respond to this question, particularly the type
and number of the products underlying the futures contracts.
For futures based on single securities, or narrow-based
security indices (e.g., nine or fewer securities), the
Securities Exchange Commission and the Commodity Futures
Trading Commission (CFTC) share jurisdiction. But for futures
contracts based on broad-based security indices or commodities,
the CFTC is the oversight authority. Based on the nature of the
instrument, the Participants believe that if the CAT NMS Plan
were amended so that the CAT system included U.S. futures data
and activity, the following private and Government
organizations and entities, in addition to the SEC and current
Plan Participants, likely would need to be involved: (i) the
CFTC, (ii) the National Futures Association, (iii) relevant
designated contract markets, (iv) relevant futures commission
merchants, (v) relevant broker-dealers, (vi) relevant
derivatives clearing organizations, (vii) the Futures Industry
Association, and (viii) relevant introducing brokers.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR SASSE
FROM MICHAEL J. SIMON
Q.1. In your testimony, you discuss the PII Working Group and
how their initial recommendation was an approach that would
have avoided the need to have any PII in the CAT.
Can you tell me why the Commission staff denied this
initial approach?
How were the options presented by the working group
evaluated?
A.1. The PII Working Group worked closely with SIFMA and the
CISOs of each Participant to develop an approach that would
have eliminated the need to maintain any PII in the CAT system.
Commission staff was invited to all discussions on this topic.
The approach would have involved the creation of a new request
and response system that would allow regulators to request PII
from Industry Member CAT Reporters rather than having such data
included in the CAT. Commission staff requested that the PII
Working Group develop another approach. The Participants are
not in a position to know why the Commission staff preferred
the development of an alternative to the initial recommendation
of the PII Working Group.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR WARNER
FROM MICHAEL J. SIMON
Q.1. One of the concerns we've heard time and time again
regarding the CAT is that it presents a privacy and
cybersecurity risk. I know that the SEC has been working
diligently on the PII issue and that the Exchanges have
proposed ``CAT Customer IDs'' as an alternative approach to
Social Security numbers.
Would you agree that the data security question can be a
very solvable issue as long as all parties work constructively
and in good faith?
A.1. The security of CAT Data is and will remain a top priority
of the Participants. While all systems are subject to ongoing
security risks, the Participants have taken, and will continue
to take, all appropriate precautions to safeguard all data
within the CAT system. The Participants believe that data
security and associated risks can be managed effectively with
the assistance and good faith effort of all parties.
Q.2. My goal is to have an effective CAT up and running as soon
as possible. Given the long history of delays and challenges
with its implementation, I wonder if there should be some
reforms to the operating committee so that it runs more
efficiently.
What were the causes for implementation delays?
A.2. The CAT is an extremely complex project. Rule 613 required
the Participants to select a Plan Processor, contract with that
entity and build, test and implement Participant reporting to
the CAT within a year.
Recognizing the challenges of the timetable, the
Participants proposed, and the SEC approved, a supplemental
national market system plan to provide for the selection of a
Plan Processor while the SEC considered adoption of the overall
CAT NMS Plan. Pursuant to the Selection Plan, \1\ the
Participants were able to choose a Plan Processor (Thesys
Technologies LLC) within approximately 2 months of SEC approval
of the CAT NMS Plan, and complete the Plan Processor Agreement
within another few months. \2\
---------------------------------------------------------------------------
\1\ See Plan Governing the Process of Selecting a Plan Processor
and Developing a Plan for the Consolidated Audit Trail, which was
incorporated as Article V of the CAT NMS Plan approved by the
Commission on November 15, 2016.
\2\ Thesys Technologies LLC was selected by CAT NMS LLC to be the
Plan Processor for the CAT. Thesys Technologies established its
subsidiary, Thesys CAT (TCAT) to serve as the Plan Processor.
---------------------------------------------------------------------------
Notwithstanding the relatively prompt selection of a Plan
Processor, TCAT ultimately proved unable to build the system
required under the CAT NMS Plan and the Plan Processor
Agreement between the parties. The Participants worked in good
faith with TCAT to begin operation of the CAT one year later
than required under the CAT NMS Plan and Rule 613. However,
TCAT proved unable to deliver a compliant system even with the
additional year for development.
After TCAT failed to deliver a contract-compliant system in
the timeframes required and demanded significant payments in
excess of the contract requirements, among other things, the
Participants decided to terminate the Plan Processor Agreement
for default and change Plan Processors, selecting and
contracting with FINRA CAT. While this initially added time to
the development of the CAT, the Participants believe that
changing processors when they did actually will result in a
fully functional CAT in a shorter time frame than if they had
continued the project with TCAT as processor.
Q.3. Please describe the background for how Thesys was selected
as the Plan Processor to build the CAT?
A.3. As noted in response to Question 2, the Participants
selected Thesys Technologies LLC, which ultimately formed TCAT,
as the Plan Processor pursuant to the provisions of the CAT NMS
Plan and the supplemental Selection Plan discussed above.
Technical and legal/regulatory experts from the Participants,
working with outside consultants and legal advisors, developed
detailed requirements for the operation of the CAT. The
Participants then issued a request for proposal (RFP) for the
Plan Processor. Ten entities submitted responses to the RFP.
The Participants provided each applicant with the opportunity
to make an oral presentation to the Participants group. From
those 10 applicants the Participants selected three finalists
and sought additional information from each finalist. The
Participants ultimately selected TCAT as the Plan Processor.
Q.4. What other bidders were short-listed? Why was Thesys
selected? Which exchanges voted for Thesys?
A.4. The other two finalists for Plan Processor were FINRA and
Sungard/Fidelity National Information Services Inc. (Sungard/
FIS). Sungard/FIS withdrew from consideration before the final
Participant vote for Plan Processor. The Participants then
conducted a vote between FINRA and Thesys, and each Participant
voted pursuant to their own selection criteria. The vote was
via closed ballot and the only result announced was that Thesys
won the vote; there was no announcement as to how each
Participant voted.
Q.5. Would you agree that a major part of the delay in the CAT
implementation occurred from the inability of Thesys to provide
a viable system after working on it nearly 2 years?
A.5. Yes. Please see the response to Question 2, above.
Q.6. What did other participants propose to replace Thesys
before they were finally fired earlier this year? Why did the
exchanges keep them on the contract for as long as they did?
Were the exchanges in agreement on whether Thesys should be
retained?
A.6. When it became clear to the Participants that TCAT would
be unable on its own to build the CAT system that the CAT NMS
Plan requires, the Participants first considered providing
supplemental support to TCAT, either from the Participants
themselves or from a third party. However, it soon became clear
that even with support, TCAT would not be able to build a
compliant CAT system in a timely and cost-efficient manner. In
light of TCAT's failure to deliver a contract-compliant system
in the timeframes required (and other defaults), the
Participants decided to terminate the Plan Processor Agreement
for default and replace TCAT. The Participants' decision to
terminate TCAT for default was unanimous.
The Participants kept TCAT on contract as long as they did
because they understood that changing processors necessarily
would add time to the project. Thus, the Participants worked in
good faith with TCAT as long as they could to try to remedy the
defects in the deliverables and to address concerns with future
deliverables. It was only after receiving, testing, and
attempting to remedy the defects in TCAT's system, as well as
other defaults by TCAT including its extracontractual payment
demands, that the Participants concluded that TCAT could not
meet the requirements of its Plan Processor Agreement and was,
in any event, unwilling to do so on the agreed-upon terms and
conditions. Upon reaching that conclusion the Participants
promptly terminated the TCAT Plan Processor agreement for
default.
Q.7. Please describe how a subsidiary of FINRA was selected
earlier this year to replace Thesys? Was there an open bidding
process? Were there other bidders?
A.7. The Participants followed the requirements in the CAT NMS
Plan in selecting a successor Plan Processor. Specifically,
under Section 6.1(t) of the CAT NMS Plan, CAT NMS, LLC formed a
Selection Committee and established a process to evaluate and
review bids. That process, which took into account the
applicable time constraints, was to contact FINRA and FIS, the
two other finalists in the initial process, to gauge their
interest in bidding on the CAT project. Both entities submitted
proposals. FINRA proposed specifics as to how they would build
a system compliant with the CAT NMS Plan, together with a cost
proposal. FIS proposed an interim step in which CAT NMS, LLC
would hire them as consultants to review the system to
determine how best they could provide services moving forward.
Based on these proposals, the Selection Committee recommended
FINRA to the Operating Committee, which voted to approve FINRA
as the Plan Processor. Note, FINRA recused itself and did not
take part in the selection decision.
Q.8. How was the SEC engaged with CAT NMS as it began
experiencing significant delays?
A.8. The SEC and its staff have been engaged with CAT LLC \3\
and the Participants throughout the entire life of the project.
When the problems with TCAT became apparent, Chairman Clayton
convened a meeting of the presidents or CEOs of the
Participants on April 9, 2018, to express his concerns with the
delays in the project. Brett Redfearn, Director of the Division
of Trading and Markets also communicated the importance of
getting the project back on track.
---------------------------------------------------------------------------
\3\ Note, CAT NMS, LLC is the predecessor to CAT LLC.
---------------------------------------------------------------------------
In response to the requests of Chairman Clayton and the
staff, the Participants submitted a comprehensive Master Plan
to the staff that included all material steps to implement all
phases of the project. The Participants also created a
Leadership Team of four Participant representatives to help
streamline decision making on day-to-day issues that did not
raise policymaking concerns.
More fundamentally, the SEC has been actively monitoring
all CAT activities. The SEC staff participates in Operating
Committee, Compliance Committee and most working group calls,
including the Security Working Group. In January of this year
Chairman Clayton hired Manisha Kimmel as Senior Policy Advisor
for Regulatory Reporting to coordinate the SEC's oversight of
the creation and implementation of the CAT. Ms. Kimmel
previously was the Chair of the CAT Advisory Committee and,
among other things, holds weekly calls with the CAT Leadership
Team. The staff of the Division of Trading and Markets works
closely with Ms. Kimmel in overseeing CAT matters.
Q.9. What are SEC current authorities in compelling the
implementation of CAT?
A.9. The SEC compels the implementation of the CAT through Rule
613, and the CAT NMS Plan adopted under that rule, and via its
oversight role over the Participants. The SEC has not amended
Rule 613 since its adoption. With respect to the CAT NMS Plan,
the SEC recently has proposed amendments to the CAT NMS Plan
regarding transparency and cost recovery.
Q.10. What is the SEC's typical engagement with the operating
committee?
A.10. As provided under Section 4.4 of the CAT NMS Plan, the
SEC staff may attend, and does attend, all Operating Committee
meetings, including both regular and executive sessions. In
addition, as noted above, the SEC staff also participate in
Compliance Committee and most working group calls. While most
interaction between the SEC and the Participants is informal,
the SEC conducts all formal communications with the Operating
Committee through letters and other communications.
Q.11. Has the SEC attended any of the operating committee
meetings?
Does the SEC have access to the meeting transcripts?
A.11. As noted above, the SEC staff attends Operating Committee
meetings. The Operating Committee does not record or otherwise
transcribe its meetings. However, the Operating Committee does
draft minutes of its meetings, and the SEC staff receives those
minutes.
Q.12. Does the CAT NMS Plan or Rule 613 prohibit the SEC from
appointing or removing members of the operating committee?
A.12. There is no provision in either Rule 613 or the CAT NMS
Plan giving the SEC the authority either to appoint or remove
members of the Operating Committee. Rule 613 broadly addresses
some operational and administrative requirements related to the
CAT, such as requiring the CAT NMS Plan to include provisions
related to the fair representation of Participants, the
administration of the CAT NMS Plan and an Advisory Committee.
However, Rule 613 does not otherwise dictate the specific
manner in which the Participants would govern CAT LLC. In
implementing Rule 613, the Participants provided in the CAT NMS
Plan for the governance of CAT LLC through an Operating
Committee. The CAT NMS Plan specifies that each Participant
appoints one voting member, plus an alternate, to the Operating
Committee. The SEC approved those provisions in approving the
CAT NMS Plan.
Q.13. Does Rule 613 prohibit the SEC from appointing other
independent members to the operating committee?
A.13. As noted in the answer to the previous question, Rule 613
does not grant the SEC the ability to appoint members of the
Operating Committee. The CAT NMS Plan controls the composition
of the Operating Committee and it does not include any
provision regard the appointment of independent members to the
committee.
Q.14. What, in your view, can independent members provide to
the operating committee? Are there benefits?
A.14. Rule 613 specifically requires the Participants establish
an Advisory Committee ``to advise the plan sponsors on the
implementation, operation, and administration of the central
repository.'' The Participants implemented that provision in
the CAT NMS Plan by providing for an Advisory Committee
consisting of 14 representatives from the industry, academia
and the public. Under Rule 613, Advisory Committee members
``have the right to attend any meetings of the plan sponsors
[other than in executive session], to receive information
concerning the operation of the central repository, and to
provide their views to the plan sponsors.'' The CAT NMS Plan
and Commission guidance acknowledge the need for appropriate
limitations on the role of the Advisory Committee. In excluding
Advisory Committee members from executive session meetings, for
example, the Commission explained that ``meet[ing] in
[E]xecutive [S]ession without members of the Advisory Committee
appropriately balances the need to provide a mechanism for
industry input into the operation of the central repository,
against the regulatory imperative that the operations and
decisions regarding the consolidated audit trail be made by
[Participant]s who have a statutory obligation to regulate the
securities markets, rather than by members of the
[Participant]s, who have no corresponding statutory obligation
to oversee the securities markets.'' \4\
---------------------------------------------------------------------------
\4\ Plan Adopting Release, supra note 5 at 84732-3.
---------------------------------------------------------------------------
Thus, the Participants, which, as self-regulatory
organizations, have the regulatory obligation to develop and
implement the CAT, have voting membership on the Operating
Committee. The independent members of the Advisory Committee
have a vehicle to provide their views to the Operating
Committee in a structured manner. The Participants believe that
this establishes the appropriate balance in the governance and
oversight of the CAT.
Q.15. As we look forward, assuming CAT is implemented in the
next 3 years, what are the upgrades that will need to take
place to ensure CAT does not fall behind the industry best
practices?
A.15. As required by Rule 613 and the CAT NMS Plan, the CAT
system is designed to be flexible, scalable, and
technologically robust and modern. Rule 613(a)(1)(v) requires
that the CAT be flexible and scalable, including the capacity
``to efficiently incorporate, in a cost-effective manner,
improvements in technology, additional capacity, additional
order data, information about additional securities or
transactions, changes in regulatory requirements, and other
developments.'' The CAT NMS Plan also requires that the CAT be
flexible and scalable, and that it ``employ[s] optimal
technology for supporting (1) scalability to increase capacity
to handle a significant increase in the volume of data
reported, (2) adaptability to support future technology
developments and new requirements, and (3) maintenance and
upgrades to ensure that technology is kept current, supported,
and operational.'' \5\ The CAT system has been designed with
these requirements in mind.
---------------------------------------------------------------------------
\5\ CAT NMS Plan, supra note 3 at Appendix C-Section 5(a). The CAT
NMS Plan further requires: ``Participants will provide metrics and
forecasted growth to facilitate Central Repository capacity planning.
The Plan Processor will maintain records of usage statistics to
identify trends and processing peaks. The Central Repository's capacity
levels will be determined by the Operating Committee and used to
monitor resources, including CPU power, memory, storage, and network
capacity.'' Id. As a baseline, the CAT must have capacity requirements
``based on twice (2X) the historical peaks for the most recent 6 years,
and the Plan Processor must be prepared to handle peaks in volume that
could exceed this baseline for short periods.'' Id. at Appendix D,
Section 1.1. Note that Appendix D includes additional information on
the technical architecture of the CAT.
---------------------------------------------------------------------------
The Operating Committee has the responsibility to ensure
that CAT remains technologically robust and modern. In doing
so, the Operating Committee works closely with the Advisory
Committee, FINRA CAT, the technology staffs of the
Participants, industry organizations (such as Securities
Industry and Financial Markets Association (SIFMA) and
Financial Information Forum (FIF)) and the SEC. To oversee
these efforts, the Operating Committee has established a
Technology Working Group that works closely with FINRA CAT to
oversee the technological development and operation of the CAT.
Furthermore, the CAT NMS Plan requires the Plan Processor to
engage an Independent Auditor to conduct an annual audit of the
Plan Processor's policies, procedures and control structures.
Through these vehicles, the various groups can make
recommendations to the Operating Committee to help ensure that
CAT remains technologically robust and modern.
Finally, the CCO's annual written assessment must consider,
among other things, ``an evaluation of potential technology
upgrades based on a review of technological advancements over
the preceding year, drawing on technological expertise whether
internal or external.'' \6\ Based on his review, the CCO may
recommend potential technology upgrades to the Operating
Committee. Thus, in addition to being designed in a manner that
is intended to be flexible, scalable, and technically robust,
the technology used in the CAT is separately assessed at least
annually.
---------------------------------------------------------------------------
\6\ Id. at Section 6.6(b)(ii)(B)(1).
---------------------------------------------------------------------------
------
RESPONSES TO WRITTEN QUESTIONS OF
SENATOR CORTEZ MASTO FROM MICHAEL J. SIMON
Q.1. Will the CAT help regulators, such as FINRA, SEC, FBI, and
the Department of Justice, catch short selling, spoofing, fake
trades, and wire fraud more quickly?
A.1. The CAT system is designed to make data available to the
SEC and Participants to perform surveillance or analyses, or
for other purposes as part of their regulatory or oversight
responsibilities. The CAT system will facilitate the ability of
regulators to surveil for suspicious activity. The data that
will be available in the CAT system may assist the SEC and
Participants in more quickly identifying manipulative activity,
including manipulative short selling, spoofing, and fake
trades, for example. Although the FBI and Department of Justice
will not have access to the CAT system or the data within it,
the FBI and Department of Justice may benefit from such
information to the extent either body is engaged in a joint
investigation with a regulator with such access, e.g., a joint
investigation with the SEC.
Q.2. Could the CAT system help investigate who is making a
billion-dollar profit in trades made right before the Trump
administration makes a market-moving announcement?
A.2. As noted in response to Question 1, the CAT system is
designed to make data available to the SEC and Participants to
perform surveillance or analyses, or for other purposes as part
of their regulatory or oversight responsibilities. The data
that will be available in the CAT system may assist the SEC and
Participants in more quickly identifying various forms of
potentially suspicious trading activity.
Q.3. Will the CAT be able to help exchanges and regulators know
if brokers are being ``unduly influenced by fees and rebates''
rather than the best execution outcome for investors?
A.3. Both SEC Rule 613 and the CAT NMS Plan expressly require
that the Participants and their employees use CAT Data only for
surveillance and regulatory purposes. \1\ In Particular,
Appendix D of the CAT NMS Plan states: ``The Plan Processor
must provide Participants' regulatory staff and the SEC with
access to all CAT Data for regulatory purposes only.
Participants' regulatory staff and the SEC will access CAT Data
to perform functions, including economic analyses, market
structure analyses, market surveillance, investigations, and
examinations.'' \2\ In light of this permitted use of CAT Data,
the Participants believe that CAT Data can be used to conduct
economic and market structure analyses that may assist
regulators in studying many issues including, for example, fees
and rebates.
---------------------------------------------------------------------------
\1\ Regulation NMS, 17 CFR 242.613(e)(4)(i)(A) (2019); CAT NMS
Plan, supra note 3 at Section 6.5(g), Appendix C-Section 4(b), and
Appendix D-Section 8.1.
\2\ CAT NMS Plan, supra note 3 at Appendix D-Section 8.1.
Q.4. Will the CAT help exchanges and regulators know if brokers
are routing the trading interests of mutual funds, pensions,
---------------------------------------------------------------------------
and endowments in a way that results in information leakage?
A.4. As designed, the CAT system will include detailed
information with respect to the handling of orders. For
example, CAT Reporters will be required to provide information
with respect to the routing of orders within an individual
reporting firm as well as between reporting firms. In addition,
CAT Reporters will be required to record the identification of
information barriers for certain order events, including when
an order is received or originated, transmitted to a department
within a firm, and when it is modified. Thus, while the ability
to identify information leakage will vary based on the facts
and circumstances in any instance, CAT will provide regulators
with the complete life cycle of an order, which will help in
examinations or investigations related to the appropriate
handling of orders.
Q.5. Will the CAT help exchanges and regulators identify
sophisticated market participants who use multiple brokers and
market centers to engage in disruptive trading?
A.5. As discussed in the response to Question 3 above, the
Participants must use CAT Data only for regulatory purposes,
including economic analyses, market structure analyses, market
surveillance, investigations, and examinations. In practice,
the CAT will allow Participants and the SEC to investigate,
among other things, potentially suspicious trading activity
that may be dispersed across broker-dealers and market centers.
Q.6. We have had a lot of discussion about how difficult it is
to identify the beneficial owners of firms. This secrecy can
lead to criminal activities. For example, Mr. Navinder Singh
Sarao (the individual who initiated the 2010 flash crash) was
not registered as a broker in the U.S. He used four firms to
place his trades.
Would CAT be able to find him or just his brokers?
A.6. While the CAT system is designed to have information on
U.S. broker-dealers and their customers, it will not have
information on foreign customers in all instances. For example,
a U.S. broker-dealer receiving an order is required to report
the receipt of the order and the Firm Designated ID (i.e.,
trading account information) of the customer. Where a U.S.
broker-dealer receives an order from a foreign broker-dealer,
the U.S. broker-dealer reporting information to the CAT system
is required to report the foreign broker-dealer involved in the
trade rather than the ultimate customer of such foreign broker-
dealer (whose identity may not be known to the U.S. broker-
dealer).
Q.7. The system is only as good as the exchanges who report
concerns and ownership. How will you ensure that exchanges
fully comply with reporting?
A.7. Under Rule 613 and the CAT NMS Plan, the national
securities and options exchanges have a regulatory obligation
to report data to the CAT system and the SEC will be able to
examine the exchanges' compliance with Rule 613 and the CAT NMS
Plan. The SEC also is able to enforce compliance with Rule
613's and the CAT NMS Plan's reporting obligations. In addition
to being subject to the SEC's examination and enforcement
authority, the Plan Processor must provide the Operating
Committee with reporting metrics related to Participant
performance. These metrics will assist the Operating Committee
in identifying and addressing potential Participant reporting
issues. Note, the SEC also will receive these metrics.
Q.8. What are your views on including futures data and over-
the-counter equities in CAT?
A.8. The reporting requirements of the CAT NMS Plan apply to
all ``Eligible Securities,'' which includes all NMS Securities
and all OTC Equity Securities. \3\ The CAT NMS Plan currently
does not apply to futures or other products that are not NMS
Securities or OTC Equity Securities. \4\
---------------------------------------------------------------------------
\3\ See id. at Section 1.1.
\4\ On May 15, 2017, the Participants filed with the Commission a
report discussing the potential expansion of the CAT to include primary
market transactions in securities that are not NMS Securities or OTC
Equity Securities, and debt securities. See Discussion of the Potential
Expansion of the Consolidated Audit Trail pursuant to Section 6.11 of
the CAT NMS Plan (May 15, 2017), available at https://catnmsplan.com/
wp-content/uploads/2017/06/Expansion-Report-Final-5.15.17.pdf. At the
time, the Participants declined to expand the scope of the CAT and
explained:
As a result of their analysis, the Participants believe that it
would be premature to expand the CAT to include such transactions at
this time. The Participants believe that further consideration of
whether to include such transactions should be based on data derived
from Participants' and Industry Members' actual experience with CAT
reporting, as well as a consideration of the costs required to build
systems to enable CAT reporting.
---------------------------------------------------------------------------
The Participants believe that they must gain experience
with CAT reporting and CAT Data before determining to
potentially expand the scope of the CAT. Note that any
expansion of the CAT would be subject to public notice and
comment, and Commission approval. Separately, each year the
Chief Compliance Officer of CAT LLC (CCO) is required to
complete a written assessment of the Plan Processor's
performance, which typically includes, among other things, a
consideration of whether the CCO believes that the CAT should
be expanded to include additional data elements or products.
\5\
---------------------------------------------------------------------------
\5\ See CAT NMS Plan, supra note 3 at Section 6.6(b).
Q.9. What are your views on including initial public offering
---------------------------------------------------------------------------
data, clearing data, and other data into the CAT database?
A.9. As discussed in the response to Question 8 (including
footnote 4), the Participants believe that they must gain
experience with CAT reporting and CAT Data before determining
to potentially expand the scope of the CAT. Note that any
expansion of the CAT would be subject to public notice and
comment, and Commission approval.
Q.10. How is CAT Advisory Committee and Operating Committee
ensuring that CAT will remain technologically robust and
modern?
A.10. As required by Rule 613 and the CAT NMS Plan, the CAT
system is designed to be flexible, scalable, and
technologically robust and modern. Rule 613(a)(1)(v) requires
that the CAT be flexible and scalable, including the capacity
``to efficiently incorporate, in a cost-effective manner,
improvements in technology, additional capacity, additional
order data, information about additional securities or
transactions, changes in regulatory requirements, and other
developments.'' The CAT NMS Plan also requires that the CAT be
flexible and scalable, and that it ``employ[s] optimal
technology for supporting (1) scalability to increase capacity
to handle a significant increase in the volume of data
reported, (2) adaptability to support future technology
developments and new requirements and (3) maintenance and
upgrades to ensure that technology is kept current, supported
and operational.'' \6\ The CAT system has been designed with
these requirements in mind.
---------------------------------------------------------------------------
\6\ Id. at Appendix C-Section 5(a). The CAT NMS Plan further
requires: ``Participants will provide metrics and forecasted growth to
facilitate Central Repository capacity planning. The Plan Processor
will maintain records of usage statistics to identify trends and
processing peaks. The Central Repository's capacity levels will be
determined by the Operating Committee and used to monitor resources,
including CPU power, memory, storage, and network capacity.'' Id. As a
baseline, the CAT must have capacity requirements ``based on twice (2X)
the historical peaks for the most recent 6 years, and the Plan
Processor must be prepared to handle peaks in volume that could exceed
this baseline for short periods.'' Id. at Appendix D, Section 1.1. Note
that Appendix D includes additional information on the technical
architecture of the CAT.
---------------------------------------------------------------------------
The Operating Committee has the responsibility to ensure
that CAT remains technologically robust and modern. In doing
so, the Operating Committee works closely with the Advisory
Committee, FINRA CAT, the technology staffs of the
Participants, industry organizations (such as Securities
Industry and Financial Markets Association (SIFMA) and
Financial Information Forum (FIF)) and the SEC. To oversee
these efforts, the Operating Committee has established a
Technology Working Group that works closely with FINRA CAT to
oversee the technological development and operation of the CAT.
Furthermore, the CAT NMS Plan requires the Plan Processor to
engage an Independent Auditor to conduct an annual audit of the
Plan Processor's policies, procedures and control structures.
Through these vehicles, the various groups can make
recommendations to the Operating Committee to help ensure that
CAT remains technologically robust and modern.
Finally, the CCO's annual written assessment, discussed in
the response to Question 8, must consider, among other things,
``an evaluation of potential technology upgrades based on a
review of technological advancements over the preceding year,
drawing on technological expertise whether internal or
external.'' \7\ Based on his review, the CCO may recommend
potential technology upgrades to the Operating Committee. Thus,
in addition to being designed in a manner that is intended to
be flexible, scalable, and technically robust, the technology
used in the CAT is separately assessed at least annually.
---------------------------------------------------------------------------
\7\ Id. at Section 6.6(b)(ii)(B)(1).
Q.11. Assuming CAT is implemented in the next 3 years, what are
the upgrades that will need to take place to ensure CAT does
---------------------------------------------------------------------------
not fall behind the industry best practices?
A.11. Please see the response to Question 10 above, which
discusses measures designed to ensure that the CAT remains
flexible, scalable, and technically robust and modern going
forward.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR SINEMA
FROM MICHAEL J. SIMON
Q.1. Upon full implementation, the Consolidated Audit Trail
(CAT) system will be an unprecedented database, collecting 58
billion records and maintaining data on over 100 million
institutional and retail accounts on a daily basis. The CAT,
and all the unique customer data it holds, will also be
accessible to thousands of users. Therefore, while the CAT has
the potential to offer important oversight, it will also be a
prime target for cyberhacks. Under current CAT requirements,
what kind of personal information would be accessible to system
users? Is this information already being collected by other
audit trail systems?
A.1. Under Rule 613, and in addition to certain transaction
data, Participants and broker-dealers must record and
electronically report Customer Identifying Information and
Customer Account Information to the CAT system. \1\ Currently,
the Commission-approved CAT NMS Plan defines Customer
Identifying Information as ``information of sufficient detail
to identify a Customer, including, but not limited to, (a) with
respect to individuals: name, address, date of birth,
individual tax payer identification number (ITIN)/social
security number (SSN), individual's role in the account (e.g.,
primary holder, joint holder, guardian, trustee, person with
the power of attorney).'' \2\ Rule 613(j)(4) and the CAT NMS
Plan generally define Customer Account Information as ``account
number, account type, customer type, date account opened, and
large trader identifier (if applicable).'' \3\ Pursuant to the
CAT NMS Plan, Customer Identifying Information and Customer
Account Information are segregated from other general
transaction data. \4\ Additionally, the SEC and the
Participants cannot bulk extract such information and
regulatory users must have special entitlements to access such
data. \5\ As mentioned during testimony, the Participants have
requested exemptive relief from the Commission from relevant
aspects of the CAT NMS Plan to eliminate the requirement that
CAT LLC collect and retain SSNs, dates of birth, and account
numbers.
---------------------------------------------------------------------------
\1\ Regulation NMS, 17 CFR 242.613(c)(7)(i)(A) (2019).
\2\ CAT NMS Plan, supra note 3 at Section 1.1.
\3\ Regulation NMS, 17 CFR 242.613(j)(5) (2019); CAT NMS Plan,
supra note 3 at Section 1.1.
\4\ CAT NMS Plan, supra note 3 at Appendix D-Section 4.1.6.
\5\ Id.
---------------------------------------------------------------------------
Currently, broker-dealers are required to provide this type
of information, except for date of birth, to the SEC or a
Participant in response to an electronic blue sheet (EBS)
request from the requesting regulator.
Q.2. The Securities and Exchange Commission has been advised
that the CAT system should not collect Social Security numbers,
account numbers, and full dates of birth. Can regulators
properly conduct market analysis, investigations, and
enforcement if these pieces of information are not collected by
the CAT?
A.2. Yes. The Participants believe that the proposed
alternative to collecting SSNs, account numbers, and full dates
of birth will enhance the security of the CAT system while
preserving the regulatory benefits of the CAT. Under the
proposed alternative, regulators would continue to have the
capability to create a reliable and accurate CAT Customer ID
(CCID) that is unique for each customer, and to use the unique
CCID to track orders from any customer throughout the order's
life cycle, regardless of what brokerage account was used to
enter the order. This approach would eliminate the risk of
having a comprehensive aggregated source for all individual
customer SSNs without having an adverse impact on the effective
use of the CAT by regulators, including the ability of
regulators to identify customers and their related trading
activity.
Additional Material Supplied for the Record
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
[all]