Grygo is CCO for FTF.
SIFMA and key securities exchanges/self-regulatory organizations (SROs) have settled a big disagreement over the liability for data breaches that may occur via the Consolidated Audit Trail (CAT) big data market surveillance initiative.
As envisioned, the CAT data repository of securities transaction data would enable regulatory surveillance via “an extensive audit trail that will capture customer and order event information for orders in exchange-listed securities across all U.S. markets, from the time of order inception through routing, cancellation, modification or execution, in a single, consolidated source,” according to CAT LLC officials.
However, the CAT initiative has hit several stones in the road since its inception. Most recently, due to the COVID-19 pandemic, broker-dealers and SROs have gotten the SEC to grant deadline extensions for the reporting chores of the CAT effort.
And, in the meantime, SIFMA, a major trade association for the securities industry, raised the issue last month about the limited liability that SROs/exchanges would bear if there was a data breach via the massive CAT data repository process.
The nitty-gritty of liability was spelled out via the CAT Reporter Agreement (CRA) that broker-dealers must sign before they can access the CAT database. Basically, the SROs wanted to be liable for only $500.00 per sell-side firm reporting transaction information to the CAT database; the reporting firm would be liable for the rest, if there was a security breach and legal action.
Kenneth E. Bentsen, Jr
On April 22, Kenneth E. Bentsen, Jr., SIFMA president and CEO, argued that “broker-dealers should not bear the liability of a breach in the CAT database, over which they have no control. SIFMA’s guiding principle is ‘they who hold the data bear the liability.’ The liability for any CAT breach should rest with the SROs as they hold, maintain and control the data.”
The SROs were “improperly” denying broker-dealers who resisted the CRA “the ability to report data in compliance with the law,” according to SIFMA, which then asked the SEC to “set aside the SRO denial of access and stay the application of the reporting agreement.”
This, SIFMA argued, would allow broker-dealers to do their CAT reporting while the merits of the CRA would be reviewed.
The SROs were not having it.
CAT LLC filed its own motion with the SEC, asking the regulator to “deny SIFMA’s extraordinary and unprecedented request for a stay of CAT LLC and SRO actions that are entirely consistent with the Exchange Act and the CAT NMS Plan particularly because SIFMA’s challenge is unlikely to prevail and it has not articulated any harm (let alone irreparable harm).”
The SROs argued further that a stay would harm and impede “the orderly implementation” of the CAT system, which, as noted, has already had a tempestuous journey up to this point.
Pages and pages of legal gobbledygook and about a month later, SIFMA on May 13 announced a settlement via Bentsen.
“Under the settlement, the SROs agreed to remove the language from the CAT Reporter Agreement limiting SRO liability for a breach of the CAT database,” according to Bentsen.
“The SROs further agreed not to impose any limitation of liability language in the Reporter Agreement without first proposing a rule and going through the formal public notice, comment and approval process with the SEC. … With today’s settlement we have accomplished all that we sought by filing the Section 19(d) application,” Bentsen concludes.
If the settlement holds, the matter will not have to be decided by the SEC, which declined to comment for this story. But it’s probably prudent to avoid saying that all’s well that ends well when it comes to the CAT saga.
So, what can be said is that the new milestones for CAT reporting in 2020 are: on June 22: initial equities reporting begins for large broker-dealers and small broker-dealers that report to FINRA’s Order Audit Trail System (OATS); and on July 20: initial options reporting begins for large broker-dealers.
For next year, the deadline is Dec. 13, 2021 for full equities and options reporting for large and small broker-dealers. Beyond that, July 11, 2022 is the start date for full customer and account reporting for large and small broker-dealers.
We will keep you posted.
Need a Reprint?