Virus Prompts SEC To Ease Deadlines For Delayed Audit Trail

By Tom Zanki
Law360 is providing free access to its coronavirus coverage to make sure all members of the legal community have accurate information in this time of uncertainty and change. Use the form below to sign up for any of our weekly newsletters. Signing up for any of our section newsletters will opt you in to the weekly Coronavirus briefing.

Sign up for our Public Policy newsletter

You must correct or enter the following before you can sign up:

Select more newsletters to receive for free [+] Show less [-]

Thank You!



Law360 (March 18, 2020, 7:45 PM EDT) -- The U.S. Securities and Exchange Commission is extending a deadline for stock exchanges and other entities to enforce compliance rules involving a market surveillance project known as the "consolidated audit trail," noting the massive stress on market participants caused by the coronavirus pandemic.

The SEC this week issued a no-action letter notifying self-regulatory organizations that they have until at least May 20 before they are required to begin enforcing compliance rules related to the CAT. Certain market participants were operating under an April 20 deadline. The SEC also on Tuesday issued relief that exempts self-regulatory organizations from collecting certain customer data as a way of minimizing potentially damaging data breaches or identity theft.

The consolidated audit trail, or CAT, is a massive database that will track real-time trading in the securities market. The project, which has been riddled with delays for years, is intended to help regulators prevent future market shocks like the May 6, 2010, "flash crash," a brief but deep plunge in which the stock market lost about $1 trillion in wealth before recovering in 36 minutes.

A consortium of self-regulatory organizations, including stock and options exchanges and the Financial Industry Regulatory Authority, that oversee the CAT will be responsible for tracking every trade in the U.S. equities and options markets by collecting certain data from their members, such as broker-dealers.

According to SEC Chairman Jay Clayton, the self-regulatory organizations and broker-dealers have made progress regarding testing procedures since December. But Clayton noted the new coronavirus outbreak is stressing information technology systems and consuming resources of market participants who are developing business continuity plans to manage fallout.

Clayton said SEC staff issued its no-action letter "to allow firms to maintain focus on operational readiness and reduce operational risk," according to a statement Tuesday. The SEC Division of Trading and Markets' no-action letter assures that regulators won't take action against the self-regulatory organizations for not enforcing CAT compliance rules on their members through May 20. The deadline could be extended, according to the SEC letter issued Monday.

The consortium overseeing the project issued a statement on Tuesday notifying its members that the CAT will be ready to accept data by April 20 if the members have completed readiness testing. The consortium also noted that members should complete readiness testing and obtain necessary certifications two weeks before they begin reporting to the CAT, meaning April 6 for those ready to begin reporting on April 20, or May 6 for those who plan to report on May 20. 

The CAT project has experienced years of delays since it was approved by the SEC in 2016. Broker-dealers were scheduled to start reporting to the CAT in November 2018, but Clayton said the self-regulatory organizations weren't able to establish an operational CAT by then.

While providing temporary relief, Clayton said the SEC "remains committed to establishing a fully operational CAT."

"It is important that CAT implementation becomes a reality. A critical step towards doing so is ensuring the protection of sensitive information submitted to the CAT, particularly retail investors' personally identifiable information," Clayton said. "This issue has been, and will remain, of paramount importance."

The SEC also on Tuesday issued relief that exempts self-regulatory organizations from collecting certain customer data, including social security numbers or individual taxpayer identification numbers, dates of birth and other account numbers. Clayton said the relief is aimed at minimizing the potential for data breaches and identity theft while still allowing the CAT to fulfill its function.

The regulatory relief is the latest of several announcements the SEC has made to indicate flexibility since the coronavirus outbreak. The agency has extended filing deadlines regarding certain disclosures for companies affected by the coronavirus as well as relaxed rules for in-person events by allowing companies to change their annual meetings to virtual gatherings.

--Editing by Amy Rowe.

For a reprint of this article, please contact reprints@law360.com.

Hello! I'm Law360's automated support bot.

How can I help you today?

For example, you can type:
  • I forgot my password
  • I took a free trial but didn't get a verification email
  • How do I sign up for a newsletter?
Ask a question!