Joint Industry Plan; Order Approving the National Market System Plan Governing the Consolidated Audit Trail

 
CONTENT

Federal Register, Volume 81 Issue 226 (Wednesday, November 23, 2016)

Federal Register Volume 81, Number 226 (Wednesday, November 23, 2016)

Notices

Pages 84696-85035

From the Federal Register Online via the Government Publishing Office www.gpo.gov

FR Doc No: 2016-27919

Page 84695

Vol. 81

Wednesday,

No. 226

November 23, 2016

Part II

Book 2 of 2 Books

Pages 84695-85104

Securities and Exchange Commission

-----------------------------------------------------------------------

Joint Industry Plan; Order Approving the National Market System Plan Governing the Consolidated Audit Trail; Notice

Page 84696

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

Release No. 34-79318; File No. 4-698

Joint Industry Plan; Order Approving the National Market System Plan Governing the Consolidated Audit Trail

November 15, 2016.

SUPPLEMENTARY INFORMATION:

Table of Contents

Supplementary Information

  1. Introduction

  2. Background

  3. Description of the Proposed Plan

    1. LLC Agreement

    2. Participants

    3. Management

    4. Initial Plan Processor Selection

    5. Functions and Activities of the CAT System

    6. Financial Matters

    7. Amendments

    8. Compliance Rule Applicable to Industry Members

    9. Plan Appendices

    10. Reporting Procedures

    11. Timeliness of Data Reporting

    12. Uniform Format

    13. Symbology

    14. CAT-Reporter-ID

    15. Customer-ID

    16. Order Allocation Information

    17. Options Market Maker Quotes

    18. Primary Market Transactions, Debt Securities and Futures

    19. Error Rates

    20. Retirement of Existing Trade and Order Data Rules and Systems

    21. Regulatory Access

    22. Upgrades and New Functionalities

    23. Business Continuity and Disaster Recovery

    24. Records and Accounting and Dissolution and Termination of the Company

    25. Security of Data

    26. Governing or Constituent Documents

    27. Development and Implementation Phases

    28. Written Understanding or Agreements Relating To Interpretation of, or Participation in, the Plan

    29. Dispute Resolution

  4. Discussion and Commission Findings

    1. Definitions, Effectiveness of Agreement, and Participation (Articles I, II, and III)

    2. Management of the Company (Article IV)

      1. Operating Committee

      2. Advisory Committee

      3. Officers of the Company

      4. Additional Governance Provisions

    3. Plan Processor Selection (Article V)

    4. Functions and Activities of the CAT System (Article VI)

      1. Data Recording and Reporting Requirements

      2. Format

      3. Reporting Timelines

      4. Data Elements

      5. Symbology

      6. Security of CAT Data

      7. Personally Identifiable Information

      8. Implementation Schedule

      9. Retirement of Existing Trade and Order Data Rules and Systems

      10. Primary Market Transactions and Futures

      11. Error Rate

      12. Business Continuity and Disaster Recovery

      13. Business Clock Synchronization and Timestamp Granularity

      14. Upgrades and New Functionalities

      15. Technical Specifications

    5. Capital Accounts, Allocations of Income and Loss, and Distributions (Articles VII and VIII)

    6. Funding of the Company (Article XI)

      1. Funding Model Generally

      2. Funding Model's Allocation of Costs

      3. Message Traffic and Market Share Distinction

      4. Transparency and Alternatives to the Funding Model

      5. Miscellaneous

    7. Dispute Resolution

    8. Written Assessments, Audits and Reports

  5. Economic Analysis

    1. Introduction

    2. Summary of Expected Economic Effects

    3. Framework for Economic Analysis

      1. Economic Framework

      2. Existing Uncertainties

    4. Baseline

      1. Current State of Regulatory Activities

      2. Current State of Trade and Order Data

    5. Benefits

      1. Improvements in Data Qualities

      2. Improvements to Regulatory Activities

      3. Other Provisions of the CAT NMS Plan

    6. Costs

      1. Analysis of Expected Costs

      2. Aggregate Costs to Industry

      3. Further Analysis of Costs

      4. Expected Costs of Security Breaches

      5. Second Order Effects

    7. Efficiency, Competition, and Capital Formation

      1. Competition

      2. Efficiency

      3. Capital Formation

      4. Related Considerations Affecting Competition, Efficiency and Capital Formation

    8. Alternatives

      1. Timestamp Granularity

      2. Error Rate

      3. Error Correction Timeline

      4. Requiring Listing Exchange Symbology

      5. Clock Synchronization Logging Procedures

      6. Data Accessibility Standards

      7. Clock Synchronization Hours

      8. Primary Market Transactions

      9. Periodic Updates to Customer Information

      10. Bulk Data Downloads by CAT Reporters

      11. Alternatives to the CAT NMS Plan

      12. Alternatives Discussed in the CAT NMS Plan

  6. Paperwork Reduction Act

    1. Summary of Collection of Information Under Rule 613

      1. Central Repository

      2. Data Collection and Reporting

      3. Collection and Retention of National Best Bid and National Best Offer, Last Sale Data and Transaction Reports

      4. Surveillance

      5. Participant Rule Filings

      6. Document on Expansion to Other Securities

      7. Written Assessment of Operation of the Consolidated Audit Trail

    2. Proposed Use of Information

      1. Central Repository

      2. Data Collection and Reporting

      3. Collection and Retention of NBBO, Last Sale Data and Transaction Reports

      4. Surveillance

      5. Document on Expansion to Other Securities

      6. Written Assessment of Operation of the Consolidated Audit Trail

    3. Respondents

      1. National Securities Exchanges and National Securities Associations

      2. Members of National Securities Exchanges and National Securities Association

    4. Total Initial and Annual Reporting and Recordkeeping Burden

      1. Burden on National Securities Exchanges and National Securities Associations

      2. Burden on Members of National Securities Exchanges and National Securities Associations

    5. Summary of Collection of Information Under the CAT NMS Plan, as Amended by the Commission

      1. One-Time Reports

      2. Non-Report Commission-Created Information Collections

    6. Proposed Use of Information Under the CAT NMS Plan, as Amended by the Commission

      1. Independent Audit of Expenses Incurred Prior to the Effective Date

      2. Review of Clock Synchronization Standards

      3. Coordinated Surveillance Report

      4. Assessment of Industry Member Bulk Access to Reported Data

      5. Assessment of Errors in Customer Information Fields

      6. Report on Impact of Tiered Fees on Market Liquidity

      7. Assessment of Material Systems Change on Error Rate

      8. Financial Statements

      9. Background Checks

    7. Total Initial and Annual Reporting and Recordkeeping Burden of Information Collection Under the CAT NMS Plan, as Amended by the Commission

      1. Burden on National Securities Exchanges and National Securities Associations

      2. Request for Comment

    8. Collection of Information Is Mandatory

  7. Confidentiality

    1. Recordkeeping Requirements

  8. Conclusion

  9. Introduction

    On February 27, 2015, pursuant to Section 11A of the Securities Exchange Act of 1934 (``Exchange Act'' or ``Act'') \1\

    Page 84697

    and Rules 608 and 613 of Regulation NMS thereunder,\2\ BATS Exchange, Inc. (n/k/a Bats BZX Exchange, Inc.), BATS-Y Exchange, Inc. (n/k/a Bats BYX Exchange, Inc.), BOX Options Exchange LLC, C2 Options Exchange, Incorporated, Chicago Board Options Exchange, Incorporated, Chicago Stock Exchange, Inc., EDGA Exchange, Inc. (n/k/a Bats EDGA Exchange, Inc.), EDGX Exchange, Inc. (n/k/a Bats EDGX Exchange, Inc.), Financial Industry Regulatory Authority, Inc. (``FINRA''), International Securities Exchange, LLC, ISE Gemini, LLC, Miami International Securities Exchange LLC, NASDAQ OMX BX, Inc. (n/k/a NASDAQ BX, Inc.), NASDAQ OMX PHLX LLC (n/k/a NASDAQ PHLX LLC), The NASDAQ Stock Market LLC, National Stock Exchange, Inc., New York Stock Exchange LLC, NYSE MKT LLC, and NYSE Arca, Inc. (collectively, ``self-regulatory organizations'', ``SROs'' or ``Participants''), filed with the Securities and Exchange Commission (``Commission'' or ``SEC'') a National Market System (``NMS'') Plan Governing the Consolidated Audit Trail (the ``CAT NMS Plan,'' ``CAT Plan'' or ``Plan'').\3\ The SROs filed amendments to the CAT NMS Plan on December 24, 2015, and on February 8, 2016.\4\ The CAT NMS Plan, as amended, was published for comment in the Federal Register on May 17, 2016.\5\

    ---------------------------------------------------------------------------

    \1\ 15 U.S.C. 78k-1.

    \2\ 17 CFR 242.608.

    \3\ See Letter from Participants to Brent J. Fields, Secretary, Commission, dated February 27, 2015. Pursuant to Rule 613, the SROs were required to file the CAT NMS Plan on or before April 28, 2013. At the SROs' request, the Commission granted exemptions to extend the deadline for filing the CAT NMS Plan to December 6, 2013, and then to September 30, 2014. See Securities Exchange Act Release Nos. 69060 (March 7, 2013), 78 FR 15771 (March 12, 2013); 71018 (December 6, 2013), 78 FR 75669 (December 12, 2013). The SROs filed the CAT NMS Plan on September 30, 2014 (the ``Initial CAT NMS Plan''). See Letter from the SROs, to Brent J. Fields, Secretary, Commission, dated September 30, 2014. The CAT NMS Plan filed on February 27, 2015, was an amendment to and replacement of the Initial CAT NMS Plan.

    \4\ On December 24, 2015, the SROs submitted an Amendment to the CAT NMS Plan. See Letter from Participants to Brent J. Fields, Secretary, Commission, dated December 23, 2015. On February 9, 2016, the Participants filed with the Commission an identical, but unmarked, version of the February 27, 2015 CAT NMS Plan, as modified by the December 24, 2015 Amendment, as well as a copy of the request for proposal issued by the Participants to solicit Bids from parties interested in serving as the Plan Processor for the consolidated audit trail. See Letter from Participants to Brent J. Fields, Secretary, Commission, dated February 8, 2016.

    \5\ The Commission voted to publish the February 9, 2016 version of the CAT NMS Plan for public comment on April 27, 2016, and this version of the Plan was published in the Federal Register on May 17, 2016. See Securities Exchange Act Release No. 77724, 81 FR 30614 (the ``Notice''). Unless the context otherwise requires, the ``CAT NMS Plan'' shall refer to the February 27, 2015 CAT NMS Plan, as modified by the December 24, 2015 Amendment and published for comment on May 17, 2016. The Commission notes that the application of ISE Mercury, LLC (``ISE Mercury'') for registration as a national securities exchange was granted on January 29, 2016. See Securities Exchange Act Release No. 76998 (January 29, 2016), 81 FR 6066 (February 4, 2016). In addition, the application of the Investors Exchange LLC (``IEX'') for registration as a national securities exchange was granted on June 17, 2016. See Securities Exchange Act Release No. 78101 (June 17, 2016), 81 FR 41142 (June 23, 2016). ISE Mercury and IEX will become Participants in the CAT NMS Plan and are thus accounted for as Participants for purposes of this Order.

    ---------------------------------------------------------------------------

    The Commission received 24 comment letters in response to the CAT NMS Plan.\6\ On July 29, 2016, the Commission extended the deadline for Commission action on the CAT NMS Plan and designated November 10, 2016 as the new date by which the Commission would be required to take action.\7\ On September 2, 2016, the Participants submitted a response to the comment letters that the Commission received in response to the CAT NMS Plan.\8\ The Participants submitted additional response letters on September 23, 2016 and October 7, 2016.\9\ On November 2 and 14, 2016, the Participants submitted additional letters.\10\ This Order approves the CAT NMS Plan, with limited changes as described in detail below. The Commission concludes that the Plan, as amended, is necessary and appropriate in the public interest, for the protection of investors and the maintenance of fair and orderly markets, to remove impediments to, and perfect the mechanism of a national market system, or is otherwise in furtherance of the purposes of the Act. A copy of the CAT NMS Plan, as adopted, is attached as Exhibit A hereto.

    ---------------------------------------------------------------------------

    \6\ See Letters to Brent J. Fields, Secretary, Commission, from Kathleen Weiss Hanley, Bolton-Perella Chair in Finance, Lehigh University, et al., dated July 12, 2016 (``Hanley Letter''); Courtney Doyle McGuinn, FIX Operations Director, FIX Trading Community, dated July 14, 2016 (``FIX Trading Letter''); Kelvin To, Founder and President, Data Boiler Technologies, LLC, dated July 15, 2016 (``Data Boiler Letter''); Richard Foster, Senior Vice President and Senior Counsel for Regulatory and Legal Affairs, Financial Services Roundtable, dated July 15, 2016 (``FSR Letter''); David T. Bellaire, Executive Vice President & General Counsel, Financial Services Institute, dated July 18, 2016 (``FSI Letter''); Stuart J. Kaswell, Executive Vice President & Managing Director, General Counsel, Managed Funds Association, dated July 18, 2016 (``MFA Letter''); David W. Blass, General Counsel, Investment Company Institute, dated July 18, 2016 (``ICI Letter''); Larry E. Thompson, Vice Chairman and General Counsel, Depository Trust & Clearing Corporation, dated July 18, 2016 (``DTCC Letter''); Manisha Kimmel, Chief Regulatory Officer, Wealth Management, Thomson Reuters, dated July 18, 2016 (``TR Letter''); Theodore R. Lazo, Managing Director and Associate General Counsel, and Ellen Greene, Managing Director, Financial Services Operations, Securities Industry and Financial Markets Association, dated July 18, 2016 (``SIFMA Letter''); Anonymous, received July 18, 2016 (``Anonymous Letter I''); Mary Lou Von Kaenel, Managing Director, Financial Information Forum, dated July 18, 2016 (``FIF Letter''); Marc R. Bryant, Senior Vice President, Deputy General Counsel, Fidelity Investments, dated July 18, 2016 (``Fidelity Letter''); Mark Husler, CEO, UnaVista, and Jonathan Jachym, Head of North America Regulatory Strategy & Government Relations, London Stock Exchange Group, dated July 18, 2016 (``UnaVista Letter''); Gary Stone, Chief Strategy Officer for Trading Solutions and Global Regulatory and Policy Group, Bloomberg, L.P., dated July 18, 2016 (``Bloomberg Letter''); Bonnie K. Wachtel, Wachtel Co Inc., dated July 18, 2016 (``Wachtel Letter''); Dennis M. Kelleher, President & CEO, Stephen W. Hall, Legal Director & Securities Specialist, Lev Bagramian, Senior Securities Policy Advisor, Better Markets, dated July 18, 2016 (``Better Markets Letter''); John A. McCarthy, General Counsel, KCG Holdings, Inc., dated July 20, 2016 (``KCG Letter''); Industry Members of the Development Advisory Group (``DAG'') (including Financial Information Forum, Securities Industry and Financial Markets Association and Securities Traders Association), dated July 20, 2016 (``DAG Letter''); Joanne Moffic-Silver, EVP, General Counsel & Corporate Secretary, Chicago Board Options Exchange, Incorporated, dated July 21, 2016 (``CBOE Letter''); Elizabeth K. King, NYSE Group, Inc., dated July 21, 2016 (``NYSE Letter''); James Toes, Securities President & CEO, Securities Traders Association, dated July 25, 2016 (``STA Letter''); Anonymous, received August 12, 2016 (``Anonymous Letter II''); Scott Garrett, Member of Congress, et al., dated October 14, 2016 (``Garrett Letter''). See Exhibit B for a citation key to the comment letters received by the Commission on the proposed CAT NMS Plan.

    \7\ See Securities Exchange Act Release No. 78441 (July 29, 2016), 81 FR 51527 (August 4, 2016).

    \8\ See Letter from Participants to Brent J. Fields, Secretary, Commission, dated September 2, 2016 (``Response Letter I'').

    \9\ See Letters from Participants to Brent J. Fields, Secretary, Commission, dated September 23, 2016 (``Response Letter II'') and October 7, 2016 (``Response Letter III'').

    \10\ See Letter from Participants to Brent J. Fields, Secretary, Commission, dated November 2, 2016 (``Participants' Letter I''); Letter from Participants to Brent J. Fields, Secretary, Commission, dated November 14, 2016 (``Participants' Letter II'').

    ---------------------------------------------------------------------------

  10. Background

    The Commission believes that the regulatory data infrastructure on which the SROs and the Commission currently must rely generally is outdated and inadequate to effectively oversee a complex, dispersed, and highly automated national market system. In performing their oversight responsibilities, regulators today must attempt to pull together disparate data from a variety of existing information systems lacking in completeness, accuracy, accessibility, and/or timeliness \11\--a model that neither

    Page 84698

    supports the efficient aggregation of data from multiple trading venues nor yields the type of complete and accurate market activity data needed for robust market oversight.

    ---------------------------------------------------------------------------

    \11\ Completeness refers to whether a data source represents all market activity of interest to regulators, and whether the data is sufficiently detailed to provide the information regulators require. While current data sources provide the trade and order data required by existing rules and regulations, those sources generally do not provide all of the information of interest to regulators in one consolidated audit trail. Accuracy refers to whether the data about a particular order or trade is correct and reliable. Accessibility refers to how the data is stored, how practical it is to assemble, aggregate, and process the data, and whether all appropriate regulators could acquire the data they need. Timeliness refers to when the data is available to regulators and how long it would take to process before it could be used for regulatory analysis. See Adopting Release, infra note 14, at 45727.

    ---------------------------------------------------------------------------

    Currently, FINRA and the exchanges maintain their own separate audit trail systems for trading activity, which vary in scope, required data elements and format. In performing their market oversight responsibilities, SRO and Commission Staffs must rely heavily on data from these various SRO audit trails. However, each of these systems has shortcomings in completeness, accuracy, accessibility, or timeliness. Some of these shortcomings are a result of the disparate nature of the systems, which makes it impractical, for example, to follow orders through their entire lifecycle as they may be routed, aggregated, re-

    routed, and disaggregated across multiple markets. These systems also lack key information useful for regulatory oversight, such as the identity of the customers who originate orders, or that two sets of orders may have been originated by the same customer.\12\ Although SRO and Commission Staffs also have access to sources of market activity data other than SRO audit trails, these sources likewise suffer from their own drawbacks.\13\

    ---------------------------------------------------------------------------

    \12\ The Commission notes that the SROs have taken steps in recent years to update their audit trail requirements. For example, NYSE, NYSE Amex LLC (n/k/a ``NYSE MKT LLC'') (``NYSE Amex''), and NYSE ARCA, Inc. (``NYSE Arca'') have adopted audit trail rules that coordinate with FINRA's Order Audit Trail System (``OATS'') requirements. See Securities Exchange Act Release No. 65523 (October 7, 2011), 76 FR 64154 (October 17, 2011) (concerning NYSE); Securities Exchange Act Release No. 65524 (October 7, 2011), 76 FR 64151 (October 17, 2011) (concerning NYSE Amex); Securities Exchange Act Release No. 65544 (October 12, 2011), 76 FR 64406 (October 18, 2011) (concerning NYSE Arca). This allows the SROs to submit their data to FINRA pursuant to a Regulatory Service Agreement (``RSA''), which FINRA can then reformat and combine with OATS data. Despite these efforts, however, significant deficiencies remain. See Notice, supra note 5, at Section IV.D.2.b.

    \13\ See Notice, supra note 5, at Section IV.D.2.b (discussing the limitations of current trade and order data systems).

    ---------------------------------------------------------------------------

    Recognizing these shortcomings, on July 11, 2012, the Commission adopted Rule 613 of Regulation NMS under the Act,\14\ which requires the SROs to submit an NMS plan to create, implement, and maintain a consolidated audit trail (``CAT'') that would capture customer and order event information for orders in NMS securities, across all markets, from the time of order inception through routing, cancellation, modification, or execution in a single, consolidated data source.\15\ Specifically, Rule 613 requires the Participants to ``jointly file . . . a national market system plan to govern the creation, implementation, and maintenance of a consolidated audit trail and Central Repository.'' \16\ The purpose of the Plan, and the creation, implementation and maintenance of a comprehensive audit trail for the U.S. securities markets described therein, is to ``substantially enhance the ability of the SROs and the Commission to oversee today's securities markets and fulfill their responsibilities under the federal securities laws.'' \17\ As contemplated by Rule 613, the CAT ``will allow for the prompt and accurate recording of material information about all orders in NMS securities, including the identity of customers, as these orders are generated and then routed throughout the U.S. markets until execution, cancellation, or modification. This information will be consolidated and made readily available to regulators in a uniform electronic format.'' \18\

    ---------------------------------------------------------------------------

    \14\ See Securities Exchange Act Release No. 67457 (July 18, 2012), 77 FR 45722 (August 1, 2012) (``Adopting Release''); see also Securities Exchange Act Release No. 62174 (May 26, 2010), 75 FR 32556 (June 8, 2010) (``Proposing Release'').

    \15\ 17 CFR 242.613(a)(1), (c)(1), (c)(7).

    \16\ 17 CFR 242.613(a)(1).

    \17\ See Adopting Release, supra note 14, at 45726.

    \18\ Id. The Plan also includes certain recording and reporting obligations for OTC Equity Securities.

    ---------------------------------------------------------------------------

    The SROs filed the CAT NMS Plan pursuant to Rule 613,\19\ as modified by exemptive relief granted by the Commission, pursuant to Rule 0-12 under the Act,\20\ from certain requirements of Rule 613.\21\

    ---------------------------------------------------------------------------

    \19\ See supra note 4.

    \20\ 17 CFR 240.0-12.

    \21\ See Securities Exchange Act Release No. 77265 (March 1, 2016), 81 FR 11856 (March 7, 2016) (``Exemption Order''); Letter from Participants to Brent J. Fields, Secretary, Commission, dated January 30, 2015 (``Exemptive Request Letter''). Specifically, the SROs requested exemptive relief from the Rule's requirements related to: (i) The reporting of Options Market Maker quotations, as required under Rule 613(c)(7)(ii) and (iv); (ii) the reporting and use of the Customer-ID under Rule 613(c)(7)(i)(A), (iv)(F), (viii)(B) and 613(c)(8); (iii) the reporting of the CAT-Reporter-ID, as required under Rule 613(c)(7)(i)(C), (ii)(D), (ii)(E), (iii)(D), (iii)(E), (iv)(F), (v)(F), (vi)(B), and (c)(8); (iv) the linking of executions to specific subaccount allocations, as required under Rule 613(c)(7)(vi)(A); and (v) the timestamp granularity requirement of Rule 613(d)(3) for certain manual order events subject to reporting under Rule 613(c)(7)(i)(E), (ii)(C), (iii)(C) and (iv)(C). On April 3, 2015, the SROs filed a supplement related to the requested exemption for Rule 613(c)(7)(vi)(A). See Letter from Robert Colby, FINRA, on behalf of the SROs, to Brent J. Fields, Secretary, Commission, dated April 3, 2015 (``April 2015 Supplement''). This supplement provided examples of how the proposed relief related to allocations would operate. On September 2, 2015, the SROs filed a second supplement to the Exemptive Request Letter. See Letter from the SROs to Brent J. Fields, Secretary, Commission, dated September 2, 2015 (``September 2015 Supplement''). This supplement to the Exemptive Request Letter further addressed the use of an ``effective date'' in lieu of a ``date account opened.'' Unless the context otherwise requires, the ``Exemption Request'' shall refer to the Exemptive Request Letter, as supplemented by the April 2015 Supplement and the September 2015 Supplement.

    ---------------------------------------------------------------------------

    The CAT NMS Plan filed by the SROs incorporates the SROs' NMS plan approval process for reviewing, evaluating and ultimately selecting the Plan Processor,\22\ as set forth in a separate NMS plan submitted by the SROs and approved by the Commission (the ``Selection Plan'').\23\ On February 26, 2013, the Participants published a request for proposal (``RFP'') soliciting Bids from parties interested in serving as the Plan Processor.\24\ As of the publication date of this Order, the Participants, through the process described in the Selection Plan, have narrowed the pool of Bidders to three remaining Shortlisted Bidders.\25\

    ---------------------------------------------------------------------------

    \22\ As set forth in Section 1.1 of the CAT NMS Plan, supra note 5, the Plan Processor ``means the Initial Plan Processor or any other Person selected by the Operating Committee pursuant to SEC Rule 613 and Sections 4.3(b)(i) and 6.1 to perform the CAT processing functions required by SEC Rule 613 and set forth in the CAT NMS Plan.'' All capitalized terms not otherwise defined herein shall have the meaning ascribed to them in Rule 613, the Adopting Release, or the CAT NMS Plan, as applicable.

    \23\ See Securities Exchange Act Release Nos. 70892 (November 15, 2013), 78 FR 69910 (November 21, 2013) (``Selection Plan Notice''); 75192 (June 17, 2015), 80 FR 36028 (June 23, 2015) (Order Approving Amendment No. 1 to the Selection Plan); 75980 (September 24, 2015), 80 FR 58796 (September 30, 2015) (Order Approving Amendment No. 2 to the Selection Plan); 77917 (May 25, 2016), 81 FR 35072 (June 1, 2016) (Notice of Filing and Immediate Effectiveness of Amendment No. 3 to the Selection Plan); 78477 (August 4, 2016), 81 FR 52917 (August 10, 2016) (Notice of Filing and Immediate Effectiveness of Amendment No. 4 to the Selection Plan); see also Securities Exchange Act Release Nos. 71596 (February 21, 2014), 79 FR 11152 (February 27, 2014) (``Selection Plan Approval Order''); 74223 (February 6, 2015), 80 FR 7654 (February 11, 2015) (Notice of Amendment No. 1 to the Selection Plan); 75193 (June 17, 2015), 80 FR 36006 (June 23, 2015) (Notice of Amendment No. 2 to the Selection Plan).

    \24\ See Notice, supra note 5, at 30885-30952 for a complete version of the Consolidated Audit Trail National Market System Plan Request for Proposal (issued February 26, 2013, version 3.0 updated March 4, 2014). Other materials related to the RFP are available at http://catnmsplan.com/process/. Among other things, the RFP describes the technical, business, and operational requirements for CAT and outlines the information that must be submitted by Bidders in response to the RFP.

    \25\ ``Shortlisted Bidders'' were selected by the Selection Committee through the voting and scoring processes described in Section 5.2 of the CAT NMS Plan. See CAT NMS Plan, supra note 5, at Section 1.1; see also Section III.4, infra (describing the selection of the Plan Processor).

    ---------------------------------------------------------------------------

    The CAT NMS Plan also includes an economic analysis that, as required by Rule 613, was conducted by the SROs.

    Page 84699

    The Commission notes that, in the Adopting Release for Rule 613, the Commission considered the economic effects of the actions the SROs were required to undertake pursuant to Rule 613, specifically the requirement that the SROs develop an NMS plan, utilizing their own resources and undertaking their own research, that addresses the specific details, cost estimates, considerations, and other requirements of the Rule.\26\ The Commission noted in the Adopting Release that Rule 613 provided the SROs with ``flexibility in how they chose to meet the requirements of the adopted Rule,'' \27\ allowing the SROs to consider a number of different approaches in developing the CAT NMS Plan. The Commission also noted that ``the costs and benefits of creating a consolidated audit trail, and the consideration of specific costs as related to specific benefits, is more appropriately analyzed once the SROs narrow the expanded array of choices they have under the adopted Rule and develop a detailed NMS plan.'' \28\ Accordingly, the Commission required the SROs to conduct an economic analysis and deferred the Commission's own economic analysis of the actual creation, implementation, and maintenance of the CAT until after submission of the required NMS plan. In accordance with this approach, the Commission included its preliminary analysis and conclusions regarding the economic effects of the CAT NMS Plan when it published the CAT NMS Plan for public comment.

    ---------------------------------------------------------------------------

    \26\ See Adopting Release, supra note 14, at 45726.

    \27\ Id. at 45725.

    \28\ See Adopting Release, supra note 14, at 45725.

    ---------------------------------------------------------------------------

  11. Description of the Proposed Plan

    The Commission notes that this Section III describes the CAT NMS Plan, as filed by the Participants pursuant to Rule 613 and modified by the Exemption Order,\29\ that was published for public comment by the Commission.\30\ Section IV, below, discusses the comments received as well as amendments that the Commission is making to the Plan in light of some of the comments; these amendments are marked against the proposed Plan in Exhibit A to this Order.

    ---------------------------------------------------------------------------

    \29\ See Exemption Order, supra note 21.

    \30\ See Notice, supra note 5.

    ---------------------------------------------------------------------------

    1. LLC Agreement

    The Participants propose to conduct the activities related to the CAT in a Delaware limited liability company pursuant to a limited liability company agreement, entitled the Limited Liability Company Agreement (``LLC Agreement'') of CAT NMS, LLC (``Company'' or ``CAT LLC'').\31\ The Participants will jointly own on an equal basis the Company.\32\ The Company will create, implement and maintain the CAT.\33\ The LLC Agreement, itself, including its appendices, is the proposed Plan, which would be a national market system plan as defined in Rule 600(b)(43) of NMS.\34\

    ---------------------------------------------------------------------------

    \31\ Id.

    \32\ See CAT NMS Plan, supra note 5, at Section 3.2(d).

    \33\ Id. at Section 2.6.

    \34\ See Notice, supra note 5, at 30618.

    ---------------------------------------------------------------------------

    2. Participants

    Each national securities exchange and national securities association currently registered with the Commission would be a Participant in the Plan.\35\ The names and addresses of each Participant are set forth in Exhibit A to the Plan.\36\ Article III of the Plan provides that any entity approved by the Commission as a national securities exchange or national securities association under the Exchange Act after the Effective Date may become a Participant by submitting to the Company a completed application in the form provided by the Company and satisfying each of the following requirements: (1) Executing a counterpart of the LLC Agreement as then in effect; and (2) paying a fee to the Company in an amount determined by a Majority Vote \37\ of the Operating Committee as fairly and reasonably compensating the Company and the Participants for costs incurred in creating, implementing and maintaining the CAT (including such costs incurred in evaluating and selecting the Initial Plan Processor \38\ and any subsequent Plan Processor) and for costs the Company incurs in providing for the prospective Participant's participation in the Company, including after consideration of certain factors identified in Section 3.3(b) of the Agreement (``Participation Fee'').\39\ Amendment of the Plan reflecting the admission of a new Participant will be effective only when: (1) It is approved by the SEC in accordance with Rule 608 or otherwise becomes effective pursuant to Rule 608; and (2) the prospective Participant pays the Participation Fee.\40\

    ---------------------------------------------------------------------------

    \35\ Id.

    \36\ See CAT NMS Plan, supra note 5, at Section 3.1.

    \37\ ``Majority Vote'' means the affirmative vote of at least a majority of all of the members of the Operating Committee or any Subcommittee, as applicable, authorized to cast a vote with respect to a matter presented for a vote (whether or not such a member is present at any meeting at which a vote is taken) by the Operating Committee or any Subcommittee, as applicable (excluding, for the avoidance of doubt, any member of the Operating Committee or any Subcommittee, as applicable, that is recused or subject to a vote to recuse from such matter pursuant to Section 4.3(d) of the CAT NMS Plan). See CAT NMS Plan, supra note 5, at Section 1.1.

    \38\ The ``Initial Plan Processor'' means the first Plan Processor selected by the Operating Committee in accordance with Rule 613, Section 6.1 and the Selection Plan. See CAT NMS Plan, supra note 5, at Section 1.1.

    \39\ Id. at Section 3.3(a).

    \40\ Id. at Section 3.3(a)-(b).

    ---------------------------------------------------------------------------

    A number of factors are relevant to the determination of a Participation Fee.\41\ Such factors are: (1) The portion of costs previously paid by the Company for the development, expansion and maintenance of the CAT which, under generally accepted accounting principles (``GAAP''), would have been treated as capital expenditures and would have been amortized over the five years preceding the admission of the prospective Participant; (2) an assessment of costs incurred and to be incurred by the Company for modifying the CAT or any part thereof to accommodate the prospective Participant, which costs are not otherwise required to be paid or reimbursed by the prospective Participant; (3) Participation Fees paid by other Participants admitted as such after the Effective Date; (4) elapsed time from the Effective Date to the anticipated date of admittance of the prospective Participant; and (5) such other factors, if any, as may be determined to be appropriate by the Operating Committee and approved by the Commission.\42\ In the event that the Company and a prospective Participant do not agree on the amount of the Participation Fee, such amount will be subject to review by the SEC pursuant to Section 11A(b)(5) of the Exchange Act.\43\

    ---------------------------------------------------------------------------

    \41\ See Notice, supra note 5, at 30618.

    \42\ See CAT NMS Plan, supra note 5, at Section 3.3(b).

    \43\ Id.; see also Exchange Act Section 11A(b)(2), 15 U.S.C. 78k-l(b)(5) (which provides that a prohibition or limitation on access to services by a registered securities information processor must be reviewed by the Commission upon application by an aggrieved person).

    ---------------------------------------------------------------------------

    An applicant for participation in the Company may apply for limited access to the CAT System \44\ for planning and testing purposes pending its admission as a Participant by submitting to the Company a completed Application for Limited Access to the CAT System in a

    Page 84700

    form provided by the Company, accompanied by payment of a deposit in the amount established by the Company, which will be applied or refunded as described in such application.\45\ To be eligible to apply for such limited access, the applicant must have been approved by the SEC as a national securities exchange or national securities association under the Exchange Act but the applicant has not yet become a Participant of the Plan, or the SEC must have published such applicant's Form 1 Application or Form X-15AA-1 Application to become a national securities exchange or a national securities association, respectively.\46\

    ---------------------------------------------------------------------------

    \44\ ``CAT System'' means all data processing equipment, communications facilities, and other facilities, including equipment, utilized by the Company or any third parties acting on the Company's behalf in connection with operation of the CAT and any related information or relevant systems pursuant to the LLC Agreement. See CAT NMS Plan, supra note 5, at Section 1.1.

    \45\ Id. at Section 3.3(c).

    \46\ Id.

    ---------------------------------------------------------------------------

    All Company Interests will have the same rights, powers, preferences and privileges and be subject to the same restrictions, qualifications and limitations.\47\ Once admitted, each Participant will be entitled to one vote on any matter presented to Participants for their consideration and to participate equally in any distribution made by the Company (other than a distribution made pursuant to Section 10.2 of the Plan).\48\ Each Participant will have a Company Interest equal to that of each other Participant.\49\

    ---------------------------------------------------------------------------

    \47\ Id. at Section 3.2(a).

    \48\ Id. at Sections 3.2(b), 10.2.

    \49\ Id. at Section 3.2(d).

    ---------------------------------------------------------------------------

    Article III also describes a Participant's ability to Transfer a Company Interest. A Participant may only Transfer any Company Interest to a national securities exchange or national securities association that succeeds to the business of such Participant as a result of a merger or consolidation with such Participant or the Transfer of all or substantially all of the assets or equity of such Participant (``Permitted Transferee'').\50\ A Participant may not Transfer any Company Interest to a Permitted Transferee unless: (1) Such Permitted Transferee executes a counterpart of the Plan; and (2) the amendment to the Plan reflecting the Transfer is approved by the SEC in accordance with Rule 608 or otherwise becomes effective pursuant to Rule 608.\51\

    ---------------------------------------------------------------------------

    \50\ Id. at Section 3.4(b).

    \51\ Id. at Section 3.4(c).

    ---------------------------------------------------------------------------

    In addition, Article III addresses the voluntary resignation and termination of participation in the Plan. Any Participant may voluntarily resign from the Company, and thereby withdraw from and terminate its right to any Company Interest, only if: (1) A Permitted Legal Basis \52\ for such action exists; and (2) such Participant provides to the Company and each other Participant no less than thirty days prior to the effective date of such action written notice specifying such Permitted Legal Basis, including appropriate documentation evidencing the existence of such Permitted Legal Basis, and, to the extent applicable, evidence reasonably satisfactory to the Company and other Participants that any orders or approvals required from the SEC in connection with such action have been obtained.\53\ A validly withdrawing Participant will have the rights and obligations discussed below with regard to termination of participation.\54\

    ---------------------------------------------------------------------------

    \52\ ``Permitted Legal Basis'' means the Participant has become exempt from, or otherwise has ceased to be subject to, Rule 613 or has arranged to comply with Rule 613 in some manner other than through participation in the LLC Agreement, in each instance subject to the approval of the Commission. See CAT NMS Plan, supra note 5, at Section 1.1.

    \53\ Id. at Section 3.6.

    \54\ Id. at Sections 3.6, 3.7.

    ---------------------------------------------------------------------------

    A Participant's participation in the Company, and its right to any Company Interest, will terminate as of the earliest of: (1) The effective date specified in a valid resignation notice; (2) such time as such Participant is no longer registered as a national securities exchange or national securities association; or (3) the date of termination for failure to pay fees.\55\ With regard to the payment of fees, each Participant is required to pay all fees or other amounts required to be paid under the Plan within thirty days after receipt of an invoice or other notice indicating payment is due (unless a longer payment period is otherwise indicated) (the ``Payment Date'').\56\ If a Participant fails to make such a required payment by the Payment Date, any balance in the Participant's Capital Account will be applied to the outstanding balance.\57\ If a balance still remains with respect to any such required payment, the Participant will pay interest on the outstanding balance from the Payment Date until such fee or amount is paid at a per annum rate equal to the lesser of: (1) The Prime Rate plus 300 basis points; or (2) the maximum rate permitted by applicable law.\58\ If any such remaining outstanding balance is not paid within thirty days after the Payment Date, the Participants will file an amendment to the Plan requesting the termination of the participation in the Company of such Participant, and its right to any Company Interest, with the SEC.\59\ Such amendment will be effective only when it is approved by the SEC in accordance with Rule 608 or otherwise becomes effective pursuant to Rule 608.\60\

    ---------------------------------------------------------------------------

    \55\ Id. at Section 3.7(a).

    \56\ Id. at Section 3.7(b).

    \57\ Id.

    \58\ Id.

    \59\ Id.

    \60\ Id.

    ---------------------------------------------------------------------------

    From and after the effective date of termination of a Participant's participation in the Company, profits and losses of the Company will cease to be allocated to the Capital Account of the Participant.\61\ A terminated Participant will be entitled to receive the balance in its Capital Account as of the effective date of termination adjusted for profits and losses through that date, payable within ninety days of the effective date of termination, and will remain liable for its proportionate share of costs and expenses allocated to it for the period during which it was a Participant, for obligations under Section 3.8(c) regarding the return of amounts previously distributed (if required by a court of competent jurisdiction), for its indemnification obligations pursuant to Section 4.1, and for obligations under Section 9.6 regarding confidentiality, but it will have no other obligations under the Plan following the effective date of termination.\62\ The Plan will be amended to reflect any termination of participation in the Company of a Participant, provided that such amendment will be effective only when it is approved by the SEC in accordance with Rule 608 or otherwise becomes effective pursuant to Rule 608.\63\

    ---------------------------------------------------------------------------

    \61\ Id. at Section 3.7(c).

    \62\ Id.

    \63\ Id.

    ---------------------------------------------------------------------------

    3. Management

    Article IV of the Plan establishes the overall governance structure for the management of the Company. Specifically, the Participants propose that the Company be managed by an Operating Committee.\64\

    ---------------------------------------------------------------------------

    \64\ The Operating Committee will manage the Company except for situations in which the approval of the Participants is required by the Plan or by non-waivable provisions of applicable law. See CAT NMS Plan, supra note 5, at Article IV.

    ---------------------------------------------------------------------------

    The Operating Committee will consist of one voting member representing each Participant and one alternate voting member representing each Participant who will have a right to vote only in the absence of the Participant's voting member of the Operating Committee.\65\ Each of the voting and alternate voting members of the Operating Committee will be appointed by the Participant that he or she represents, will serve at the will of the Participant appointing such member and will be subject to the confidentiality obligations of the

    Page 84701

    Participant that he or she represents as set forth in Section 9.6.\66\ One individual may serve as the voting member of the Operating Committee for multiple Affiliated Participants, and such individual will have the right to vote on behalf of each such Affiliated Participant.\67\

    ---------------------------------------------------------------------------

    \65\ Id. at Section 4.2(a).

    \66\ Id. at Sections 4.2(a), 9.6.

    \67\ Id. at Section 4.2(a). An ``Affiliated Participant'' means any Participant controlling, controlled by, or under common control with another Participant. Id. at Section 1.1.

    ---------------------------------------------------------------------------

    The Operating Committee will elect, by Majority Vote, one of its members to act as Chair for a term of two years.\68\ No Person may serve as Chair for more than two successive full terms, and no Person then appointed to the Operating Committee by a Participant that then serves, or whose Affiliate then serves, as the Plan Processor will be eligible to serve as the Chair.\69\ The Chair will preside at all meetings of the Operating Committee, designate a Person to act as Secretary, and perform such other duties and possess such other powers as the Operating Committee may from time to time prescribe.\70\ The Chair will not be entitled to a tie-breaking vote at any meeting of the Operating Committee.\71\

    ---------------------------------------------------------------------------

    \68\ Id. at Section 4.2(b).

    \69\ Id.

    \70\ Id.

    \71\ Id.

    ---------------------------------------------------------------------------

    Each of the members of the Operating Committee, including the Chair, will be authorized to cast one vote for each Participant that he or she represents on all matters voted upon by the Operating Committee.\72\ Action of the Operating Committee will be authorized by Majority Vote (except under certain designated circumstances), subject to the approval of the SEC whenever such approval is required under the Exchange Act and the rules thereunder.\73\ For example, the Plan specifically notes that a Majority Vote of the Operating Committee is required to: (1) Select the Chair; (2) select the members of the Advisory Committee (as described below); (3) interpret the Plan (unless otherwise noted therein); (4) approve any recommendation by the Chief Compliance Officer (``CCO'') pursuant to Section 6.2(a)(v)(A); (5) determine to hold an Executive Session of the Operating Committee; (6) determine the appropriate funding-related policies, procedures and practices consistent with Article XI; and (7) act upon any other matter specified elsewhere in the Plan (which includes the Appendices to the Plan) as requiring a vote, approval or other action of the Operating Committee (other than those matters expressly requiring a Supermajority Vote or a different vote of the Operating Committee).\74\

    ---------------------------------------------------------------------------

    \72\ Id. at Section 4.3(a).

    \73\ Id.

    \74\ Id.

    ---------------------------------------------------------------------------

    Article IV requires a Supermajority Vote \75\ of the Operating Committee, subject to the approval of the SEC when required, for the following: (1) Selecting a Plan Processor, other than the Initial Plan Processor selected in accordance with Article V of the Plan; (2) terminating the Plan Processor without cause in accordance with Section 6.1(q); (3) approving the Plan Processor's appointment or removal of the Chief Information Security Officer (``CISO''), CCO, or any Independent Auditor in accordance with Section 6.1(b); (4) entering into, modifying or terminating any Material Contract (if the Material Contract is with a Participant or an Affiliate of a Participant, such Participant and Affiliated Participant will be recused from any vote); (5) making any Material Systems Change; (6) approving the initial Technical Specifications or any Material Amendment to the Technical Specifications proposed by the Plan Processor; (7) amending the Technical Specifications on its own motion; and (8) acting upon any other matter specified elsewhere in the Plan (which includes the Appendices to the Plan) as requiring a vote, approval or other action of the Operating Committee by a Supermajority Vote.\76\

    ---------------------------------------------------------------------------

    \75\ ``Supermajority Vote'' means the affirmative vote of at least two-thirds of all of the members of the Operating Committee or any Subcommittee, as applicable, authorized to cast a vote with respect to a matter presented for a vote (whether or not such a member is present at any meeting at which a vote is taken) by the Operating Committee or any Subcommittee, as applicable (excluding, for the avoidance of doubt, any member of the Operating Committee or any Subcommittee, as applicable, that is recused or subject to a vote to recuse from such matter pursuant to Section 4.3(d)); provided that if two-thirds of all of such members authorized to cast a vote is not a whole number then that number shall be rounded up to the nearest whole number. Id. at Section 1.1.

    \76\ Id. at Section 4.3(b).

    ---------------------------------------------------------------------------

    A member of the Operating Committee or any Subcommittee thereof (as discussed below) shall recuse himself or herself from voting on any matter under consideration by the Operating Committee or such Subcommittee if such member determines that voting on such matter raises a Conflict of Interest.\77\ In addition, if the members of the Operating Committee or any Subcommittee (excluding the member thereof proposed to be recused) determine by Supermajority Vote that any member voting on a matter under consideration by the Operating Committee or such Subcommittee raises a Conflict of Interest, such member shall be recused from voting on such matter.\78\ No member of the Operating Committee or any Subcommittee will be automatically recused from voting on any matter except matters involving Material Contracts as discussed in the prior paragraph, as otherwise specified in the Plan, and as follows: (1) If a Participant is a Bidding Participant \79\ whose Bid remains under consideration, members appointed to the Operating Committee or any Subcommittee by such Participant or any of its Affiliated Participants will be recused from any vote concerning: (a) Whether another Bidder may revise its Bid; (b) the selection of a Bidder; or (c) any contract to which such Participant or any of its Affiliates would be a party in its capacity as Plan Processor; and (2) if a Participant is then serving as Plan Processor, is an Affiliate of the Person then serving as Plan Processor, or is an Affiliate of an entity that is a Material Subcontractor to the Plan Processor, then in each case members appointed to the Operating Committee or any Subcommittee by such Participant or any of its Affiliated Participants shall be recused from any vote concerning: (a) The proposed removal of such Plan Processor; or (b) any contract between the Company and such Plan Processor.\80\

    ---------------------------------------------------------------------------

    \77\ Id. at Section 4.3(d).

    \78\ Id.

    \79\ ``Bidding Participant'' means a Participant that: (a) Submits a Bid; (b) is an Affiliate of an entity that submits a Bid; or (c) is included, or is an Affiliate of an entity that is included, as a Material Subcontractor as part of a Bid. Id. at Section 1.1.

    \80\ Id. at Section 4.3(d).

    ---------------------------------------------------------------------------

    Article IV also addresses meetings of the Operating Committee.\81\ Meetings of the Operating Committee may be attended by each Participant's voting Representative and its alternate voting Representative and by a maximum of two nonvoting Representatives of each Participant, by members of the Advisory Committee, by the CCO, by other Representatives of the Company and the Plan Processor, by Representatives of the SEC and by such other Persons that the Operating Committee may invite to attend.\82\ The Operating Committee, however, may, where appropriate, determine to meet in Executive Session during which only voting members of the Operating Committee will be present.\83\ The Operating Committee,

    Page 84702

    however, may invite other Representatives of the Participants, of the Company, of the Plan Processor (including the CCO and the CISO) or the SEC, or such other Persons that the Operating Committee may invite to attend, to be present during an Executive Session.\84\ Any determination of the Operating Committee to meet in an Executive Session will be made upon a Majority Vote and will be reflected in the minutes of the meeting.\85\ In addition, any Person that is not a Participant but for which the SEC has published a Form 1 Application or Form X-15AA-1 to become a national securities exchange or national securities association, respectively, will be permitted to appoint one primary Representative and one alternate Representative to attend regularly scheduled Operating Committee meetings in the capacity of a non-voting observer, but will not be permitted to have any Representative attend a special meeting, emergency meeting or meeting held in Executive Session of the Operating Committee.\86\

    ---------------------------------------------------------------------------

    \81\ Article IV also addresses, among other things, different types of Operating Committee meetings (regular, special and emergency), frequency of such meetings, how to call such meetings, the location of the meetings, the role of the Chair, and notice regarding such meetings. Id. at Section 4.4.

    \82\ Id. at Section 4.4(a).

    \83\ Id.

    \84\ Id.

    \85\ Id.

    \86\ Id. at Section 4.4(b).

    ---------------------------------------------------------------------------

    The Operating Committee may, by Majority Vote, designate by resolution one or more Subcommittees it deems necessary or desirable in furtherance of the management of the business and affairs of the Company.\87\ For any Subcommittee, any member of the Operating Committee who wants to serve thereon may so serve.\88\ If Affiliated Participants have collectively appointed one member to the Operating Committee to represent them, then such Affiliated Participants may have only that member serve on the Subcommittee or may decide not to have only that collectively appointed member serve on the Subcommittee.\89\ Such member may designate an individual other than himself or herself who is also an employee of the Participant or Affiliated Participants that appointed such member to serve on a Subcommittee in lieu of the particular member.\90\ Subject to the requirements of the Plan and non-

    waivable provisions of Delaware law, a Subcommittee may exercise all the powers and authority of the Operating Committee in the management of the business and affairs of the Company as so specified in the resolution of the Operating Committee designating such Subcommittee.\91\

    ---------------------------------------------------------------------------

    \87\ Id. at Section 4.12(a).

    \88\ Id.

    \89\ Id.

    \90\ Id.

    \91\ Id.

    ---------------------------------------------------------------------------

    Article IV requires that the Operating Committee maintain a Compliance Subcommittee for the purpose of aiding the CCO as necessary, including with respect to issues involving: (1) The maintenance of the confidentiality of information submitted to the Plan Processor or Central Repository pursuant to Rule 613, applicable law, or the Plan by Participants and Industry Members; (2) the timeliness, accuracy, and completeness of information submitted pursuant to Rule 613, applicable law or the Plan by Participants and Industry Members; and (3) the manner and extent to which each Participant is meeting its obligations under Rule 613, Section 3.11, and as set forth elsewhere in the Plan and ensuring the consistency of the Plan's enforcement as to all Participants.\92\

    ---------------------------------------------------------------------------

    \92\ Id. at Section 4.12(b).

    ---------------------------------------------------------------------------

    Article IV also sets forth the requirements for the formation and functioning of an Advisory Committee, which will advise the Participants on the implementation, operation and administration of the Central Repository, including possible expansion of the Central Repository to other securities and other types of transactions.\93\

    ---------------------------------------------------------------------------

    \93\ Id. at Section 4.13(a), (d).

    ---------------------------------------------------------------------------

    Article IV describes the composition of the Advisory Committee. No member of the Advisory Committee may be employed by or affiliated with any Participant or any of its Affiliates or facilities.\94\ The Operating Committee will select one member from representatives of each of the following categories to serve on the Advisory Committee on behalf of himself or herself individually and not on behalf of the entity for which the individual is then currently employed: (1) A broker-dealer with no more than 150 Registered Persons; (2) a broker-

    dealer with at least 151 and no more than 499 Registered Persons; (3) a broker-dealer with 500 or more Registered Persons; (4) a broker-dealer with a substantial wholesale customer base; (5) a broker-dealer that is approved by a national securities exchange: (a) To effect transactions on an exchange as a specialist, market maker or floor broker; or (b) to act as an institutional broker on an exchange; (6) a proprietary-

    trading broker-dealer; (7) a clearing firm; (8) an individual who maintains a securities account with a registered broker or dealer but who otherwise has no material business relationship with a broker or dealer or with a Participant; (9) a member of academia with expertise in the securities industry or any other industry relevant to the operation of the CAT System; (10) an institutional investor trading on behalf of a public entity or entities; (11) an institutional investor trading on behalf of a private entity or entities; and (12) an individual with significant and reputable regulatory expertise.\95\ The individuals selected to represent categories (1) through (12) above must include, in the aggregate, representatives of no fewer than three broker-dealers that are active in the options business and representatives of no fewer than three broker-dealers that are active in the equities business.\96\ In addition, upon a change in employment of any such Advisory Committee member, a Majority Vote of the Operating Committee will be required for such member to be eligible to continue to serve on the Advisory Committee.\97\ Furthermore, the SEC's Chief Technology Officer (or the individual then currently employed in a comparable position providing equivalent services) will serve as an observer of the Advisory Committee (but not be a member).\98\ The members of the Advisory Committee will have a term of three years.\99\

    ---------------------------------------------------------------------------

    \94\ Id. at Section 4.13(b).

    \95\ Id.

    \96\ Id.

    \97\ Id.

    \98\ Id.

    \99\ Four of the initial twelve members of the Advisory Committee will have an initial term of one year, and another four of the initial twelve members of the Advisory Committee will have an initial term of two years. Id. at Section 4.13(c).

    ---------------------------------------------------------------------------

    Members of the Advisory Committee will have the right to attend meetings of the Operating Committee or any Subcommittee, to receive information concerning the operation of the Central Repository, and to submit their views to the Operating Committee or any Subcommittee on matters pursuant to the Plan prior to a decision by the Operating Committee on such matters.\100\ A member of the Advisory Committee will not have a right to vote on any matter considered by the Operating Committee or any Subcommittee.\101\ In addition, the Operating Committee or any Subcommittee may meet in Executive Session if the Operating Committee or Subcommittee determines by Majority Vote that such an Executive Session is advisable.\102\ The Operating Committee may solicit and consider views of other stakeholders on the operation of the Central Repository in addition to those of the Advisory Committee.\103\ Although members of the Advisory Committee

    Page 84703

    will have the right to receive information concerning the operation of the Central Repository, the Operating Committee retains the authority to determine the scope and content of information supplied to the Advisory Committee, which will be limited to that information that is necessary and appropriate for the Advisory Committee to fulfill its functions.\104\ Any information received by members of the Advisory Committee will remain confidential unless otherwise specified by the Operating Committee.\105\

    ---------------------------------------------------------------------------

    \100\ Id. at Section 4.13(d).

    \101\ Id.

    \102\ See Notice, supra note 5, at 30621 n.54.

    \103\ Id.

    \104\ See CAT NMS Plan, supra note 5, at Section 4.13(e).

    \105\ Id.

    ---------------------------------------------------------------------------

    Article IV also describes the appointment of Officers for the Company. Specifically, the CCO and the CISO, each of whom will be employed solely by the Plan Processor and neither of whom will be deemed or construed in any way to be an employee of the Company, will be Officers of the Company.\106\ Neither such Officer will receive or be entitled to any compensation from the Company or any Participant by virtue of his or her service in such capacity (other than if a Participant is then serving as the Plan Processor, compensation paid to such Officer as an employee of such Participant).\107\ Each such Officer will report directly to the Operating Committee.\108\ The CCO will work on a regular and frequent basis with the Compliance Subcommittee and/or other Subcommittees as may be determined by the Operating Committee.\109\ Except to the extent otherwise provided in the Plan, including Section 6.2, each such Officer will have such fiduciary and other duties with regard to the Plan Processor as imposed by the Plan Processor on such individual by virtue of his or her employment by the Plan Processor.\110\

    ---------------------------------------------------------------------------

    \106\ Id. at Section 4.6(a).

    \107\ Id.

    \108\ Id.

    \109\ Id.

    \110\ Id. at Sections 4.6(a), 6.2.

    ---------------------------------------------------------------------------

    In addition, the Plan Processor will inform the Operating Committee of the individual who has direct management responsibility for the Plan Processor's performance of its obligations with respect to the CAT.\111\ Subject to approval by the Operating Committee of such individual, the Operating Committee will appoint such individual as an Officer.\112\ In addition, the Operating Committee by Supermajority Vote may appoint other Officers as it shall from time to time deem necessary.\113\ Any Officer appointed pursuant to Section 4.6(b) will have only such duties and responsibilities as set forth in the Plan, or as the Operating Committee shall from time to time expressly determine.\114\ No such Officer shall have any authority to bind the Company (which authority is vested solely in the Operating Committee) or be an employee of the Company, unless in each case the Operating Committee, by Supermajority Vote, expressly determines otherwise.\115\ No person subject to a ``statutory disqualification'' (as defined in Section 3(a)(39) of the Exchange Act) may serve as an Officer.\116\ It is the intent of the Participants that the Company have no employees.\117\

    ---------------------------------------------------------------------------

    \111\ Id. at Section 4.6(b).

    \112\ Id.

    \113\ Id.

    \114\ Id.

    \115\ Id.

    \116\ Id. The Plan uses the term ``statutory disqualification'' as defined in Section 3(a)(39) of the Exchange Act, which addresses disqualification from membership or participation in, or association with a member of, an SRO. While Officers of the Plan are not persons associated with a member of an SRO, the Commission interprets this provision of the Plan to mean that no person that is subject to one of the statutory disqualifications set forth in Sections 3(a)(39)(A) through (F) of the Exchange Act may serve as Officer.

    \117\ See CAT NMS Plan, supra note 5, at Section 4.6(b).

    ---------------------------------------------------------------------------

    4. Initial Plan Processor Selection

    Article V of the Plan sets forth the process for the Participants' evaluation of Bids and the selection process for narrowing down the Bids and choosing the Initial Plan Processor.\118\ The initial steps in the evaluation and selection process were and will be performed pursuant to the Selection Plan; the final two rounds of evaluation and voting, as well as the final selection of the Initial Plan Processor, will be performed pursuant to the Plan.\119\

    ---------------------------------------------------------------------------

    \118\ The Plan Processor selection process set forth in the CAT NMS Plan is identical to the post-CAT NMS Plan approval selection process set forth in the Selection Plan. See Selection Plan, supra note 23.

    \119\ By its terms, the Selection Plan will terminate upon Commission approval of the Plan. Id.

    ---------------------------------------------------------------------------

    As discussed above, the Selection Committee has selected the Shortlisted Bids pursuant to the Selection Plan. After reviewing the Shortlisted Bids, the Participants have identified the optimal proposed solutions for the CAT and, to the extent possible, included such solutions in the Plan.\120\ The Selection Committee will determine, by majority vote, whether Shortlisted Bidders will have the opportunity to revise their Bids.\121\ To reduce potential conflicts of interest, no Bidding Participant may vote on whether a Shortlisted Bidder will be permitted to revise its Bid if a Bid submitted by or including the Participant or an Affiliate of the Participant is a Shortlisted Bid.\122\ The Selection Committee will review and evaluate all Shortlisted Bids, including any permitted revisions submitted by Shortlisted Bidders.\123\ In performing this review and evaluation, the Selection Committee may consult with the Advisory Committee and such other Persons as the Selection Committee deems appropriate, which may include the DAG until the Advisory Committee is formed.\124\

    ---------------------------------------------------------------------------

    \120\ As noted above, the Participants stated their belief that certain exemptive relief is necessary to include in the Plan all of the provisions the Participants believe are part of the optimal solution for the CAT. The Commission notes that the request for exemptive relief was granted on March 1, 2016. See Exemption Order, supra note 21.

    \121\ See CAT NMS Plan, supra note 5, at Section 5.2(c)(ii).

    \122\ Id. at Section 5.1(b)(ii).

    \123\ Id.

    \124\ Id.

    ---------------------------------------------------------------------------

    After receipt of any permitted revisions, the Selection Committee will select the Initial Plan Processor from the Shortlisted Bids in two rounds of voting where each Participant has one vote via its Voting Senior Officer in each round.\125\ No Bidding Participant, however, will be entitled to vote in any round if the Participant's Bid, a Bid submitted by an Affiliate of the Participant, or a Bid including the Participant or an Affiliate of the Participant is considered in such round.\126\ In the first round, each Voting Senior Officer, subject to the recusal provision in Section 5.2(e)(ii), will select a first and second choice, with the first choice receiving two points and the second choice receiving one point.\127\ The two Shortlisted Bids receiving the highest cumulative scores in the first round will advance to the second round.\128\ In the event of a tie, the tie will be broken by assigning one point per vote to the tied Shortlisted Bids, and the Shortlisted Bid with the most votes will advance.\129\ If this procedure fails to break the tie, a revote will be taken on the tied Bids with each vote

    Page 84704

    receiving one point.\130\ If the tie persists, the Participants will identify areas for discussion, and revotes will be taken until the tie is broken.\131\

    ---------------------------------------------------------------------------

    \125\ See Notice, supra note 5, at 30623. If the proposed amendment to the Selection Plan is approved, the Selection Committee may determine to narrow the number of Shortlisted Bids prior to the two rounds of voting. Id. at 30623 n.58.

    \126\ This recusal provision is included in the Plan, as well as in an amendment to the Selection Plan. See Order Approving Amendment No. 2 to the Selection Plan, supra note 23.

    \127\ See CAT NMS Plan, supra note 5, at Section 5.2(e)(iii)(A).

    \128\ Id. at Section 5.2(e)(iii)(C). Each round of voting throughout the Plan is independent of other rounds. See Notice, supra note 5, at 30623 n.60.

    \129\ See CAT NMS Plan, supra note 5, at Section 5.2(e)(iii)(D).

    \130\ Id.

    \131\ Id.

    ---------------------------------------------------------------------------

    Once two Shortlisted Bids have been chosen, the Voting Senior Officers of the Participants (other than those subject to recusal) will vote for a single Shortlisted Bid from the final two to determine the Initial Plan Processor.\132\ If the tie persists, the Participants will identify areas for discussion and, following these discussions, revotes will be taken until the tie is broken.\133\ As set forth in Article VI of the Plan, following the selection of the Initial Plan Processor, the Participants will file with the Commission a statement identifying the Initial Plan Processor and including the information required by Rule 608.\134\

    ---------------------------------------------------------------------------

    \132\ Id. at Section 5.2(e)(iii)(E).

    \133\ Id.

    \134\ Id. at Section 6.7(a)(i).

    ---------------------------------------------------------------------------

    5. Functions and Activities of the CAT System

    1. Plan Processor

      Article VI describes the responsibilities of the selected Plan Processor. The Company, under the direction of the Operating Committee, will enter into one or more agreements with the Plan Processor obligating the Plan Processor to perform the functions and duties contemplated by the Plan to be performed by the Plan Processor, as well as such other functions and duties the Operating Committee deems necessary or appropriate.\135\

      ---------------------------------------------------------------------------

      \135\ Id. at Section 6.1(a).

      ---------------------------------------------------------------------------

      As set forth in the Plan, the Plan Processor is required to develop and, with the prior approval of the Operating Committee, implement policies, procedures, and control structures related to the CAT System that are consistent with Rule 613(e)(4), Appendix C and Appendix D.\136\ The Plan Processor will: (1) Comply with applicable provisions of 15 U.S. Code Sec. 78u-6 (Securities Whistleblower Incentives and Protection) and the recordkeeping requirements of Rule 613(e)(8); (2) consistent with Appendix D, Central Repository Requirements, ensure the effective management and operation of the Central Repository; (3) consistent with Appendix D, Data Management, ensure the accuracy of the consolidation of the CAT Data \137\ reported to the Central Repository; and (4) consistent with Appendix D, Upgrade Process and Development of New Functionality, design and implement appropriate policies and procedures governing the determination to develop new functionality for the CAT including, among other requirements, a mechanism by which changes can be suggested by Advisory Committee members, Participants, or the Commission.\138\ Such policies and procedures also shall: (1) Provide for the escalation of reviews of proposed technological changes and upgrades to the Operating Committee; and (2) address the handling of surveillance, including coordinated, Rule 17d-2 under the Exchange Act or Regulatory Surveillance Agreement(s) (``RSA'') surveillance queries and requests for data.\139\ Any policy, procedure or standard (and any material modification or amendment thereto) applicable primarily to the performance of the Plan Processor's duties as the Plan Processor (excluding any policies, procedures or standards generally applicable to the Plan Processor's operations and employees) will become effective only upon approval by the Operating Committee.\140\ The Plan Processor also will, subject to the prior approval of the Operating Committee, establish appropriate procedures for escalation of matters to the Operating Committee.\141\ In addition to other policies, procedures and standards generally applicable to the Plan Processor's employees and contractors, the Plan Processor will have hiring standards and will conduct and enforce background checks (e.g., fingerprint-based) for all of its employees and contractors to ensure the protection, safeguarding and security of the facilities, systems, networks, equipment and data of the CAT System, and will have an insider and external threat policy to detect, monitor and remedy cyber and other threats.\142\

      ---------------------------------------------------------------------------

      \136\ Id. at Section 6.1(d).

      \137\ ``CAT Data'' means data derived from Participant Data, Industry Member Data, SIP Data, and such other data as the Operating Committee may designate as ``CAT Data'' from time to time. Id. at Section 1.1.

      \138\ Id. at Section 6.1(d).

      \139\ Id.

      \140\ Id. at Section 6.1(e).

      \141\ Id. at Section 6.1(f).

      \142\ Id. at Section 6.1(g).

      ---------------------------------------------------------------------------

      The Plan Processor will enter into appropriate Service Level Agreements (``SLAs'') governing the performance of the Central Repository, as generally described in Appendix D, Functionality of the CAT System, with the prior approval of the Operating Committee.\143\ The Plan Processor in conjunction with the Operating Committee will regularly review and, as necessary, update the SLAs, in accordance with the terms of the SLAs.\144\ As further contemplated in Appendix C, System Service Level Agreements (SLAs), and in Appendix D, System SLAs, the Plan Processor may enter into appropriate service level agreements with third parties applicable to the Plan Processor's functions related to the CAT System (``Other SLAs''), with the prior approval of the Operating Committee.\145\ The CCO and/or the Independent Auditor will, in conjunction with the Plan Processor, and as necessary the Operating Committee, regularly review and, as necessary, update the Other SLAs, in accordance with the terms of the applicable Other SLA.\146\ In addition, the Plan Processor: (1) Will, on an ongoing basis and consistent with any applicable policies and procedures, evaluate and implement potential system changes and upgrades to maintain and improve the normal day-to-day operating function of the CAT System; \147\ (2) in consultation with the Operating Committee, will, on an as needed basis and consistent with any applicable operational and escalation policies and procedures, implement such material system changes and upgrades as may be required to ensure effective functioning of the CAT System; \148\ and (3) in consultation with the Operating Committee, will, on an as needed basis, implement system changes and upgrades to the CAT System to ensure compliance with applicable laws, regulations or rules (including those promulgated by the SEC or any Participant).\149\ Furthermore, the Plan Processor will develop and, with the prior approval of the Operating Committee, implement a securities trading policy, as well as necessary procedures, control structures and tools to enforce this policy.\150\

      ---------------------------------------------------------------------------

      \143\ Id. at Section 6.1(h).

      \144\ Id.

      \145\ Id.

      \146\ Id.

      \147\ Id. at Section 6.1(i).

      \148\ Id. at Section 6.1(j).

      \149\ Id. at Section 6.1(k).

      \150\ Id. at Section 6.1(l).

      ---------------------------------------------------------------------------

      In addition, the Plan Processor will provide the Operating Committee regular reports on the CAT System's operation and maintenance.\151\ Furthermore, upon request of the Operating Committee or any Subcommittee, the Plan Processor will attend any meetings of the Operating Committee or such Subcommittee.\152\

      ---------------------------------------------------------------------------

      \151\ Id. at Section 6.1(o).

      \152\ Id. at Section 6.1(p).

      ---------------------------------------------------------------------------

      The Plan Processor may appoint such officers of the Plan Processor as it deems necessary and appropriate to perform its functions under the Plan and Rule 613.\153\ The Plan Processor, however, will be required to appoint, at a

      Page 84705

      minimum, the CCO, the CISO, and the Independent Auditor.\154\ The Operating Committee, by Supermajority Vote, will approve any appointment or removal of the CCO, CISO, or the Independent Auditor.\155\

      ---------------------------------------------------------------------------

      \153\ Id. at Section 6.1(b).

      \154\ Id.

      \155\ Id.

      ---------------------------------------------------------------------------

      In addition to a CCO, the Plan Processor will designate at least one other employee (in addition to the person then serving as CCO), which employee the Operating Committee has previously approved, to serve temporarily as the CCO if the employee then serving as the CCO becomes unavailable or unable to serve in such capacity (including by reason of injury or illness).\156\ Any person designated to serve as the CCO (including to serve temporarily) will be appropriately qualified to serve in such capacity based on the duties and responsibilities assigned to the CCO and will dedicate such person's entire working time to such service (or temporary service) except for any time required to attend to any incidental administrative matters related to such person's employment with the Plan Processor that do not detract in any material respect from such person's service as the CCO.\157\ Article VI sets forth various responsibilities of the CCO. With respect to all of his or her duties and responsibilities in such capacity (including those as set forth in the Plan), the CCO will be directly responsible and will directly report to the Operating Committee, notwithstanding that she or he is employed by the Plan Processor.\158\ The Plan Processor, subject to the oversight of the Operating Committee, will ensure that the CCO has appropriate resources to fulfill his or her obligations under the Plan and Rule 613.\159\ The compensation (including base salary and bonus) of the CCO will be payable by the Plan Processor, but be subject to review and approval by the Operating Committee.\160\ The Operating Committee will render the CCO's annual performance review.\161\

      ---------------------------------------------------------------------------

      \156\ Id.

      \157\ Id.

      \158\ Id. at Section 6.2(a)(iii).

      \159\ Id. at Section 6.2(a)(ii).

      \160\ Id. at Section 6.2(a)(iv).

      \161\ Id. at Section 6.2(b)(i).

      ---------------------------------------------------------------------------

      In addition to a CISO, the Plan Processor will designate at least one other employee (in addition to the person then serving as CISO), which employee the Operating Committee has previously approved, to serve temporarily as the CISO if the employee then serving as the CISO becomes unavailable or unable to serve in such capacity (including by reason of injury or illness).\162\ Any person designated to serve as the CISO (including to serve temporarily) will be appropriately qualified to serve in such capacity based on the duties and responsibilities assigned to the CISO under the Plan and will dedicate such person's entire working time to such service (or temporary service) except for any time required to attend to any incidental administrative matters related to such person's employment with the Plan Processor that do not detract in any material respect from such person's service as the CISO.\163\

      ---------------------------------------------------------------------------

      \162\ Id.

      \163\ Id.

      ---------------------------------------------------------------------------

      The Plan Processor, subject to the oversight of the Operating Committee, will ensure that the CISO has appropriate resources to fulfill the obligations of the CISO set forth in Rule 613 and in the Plan, including providing appropriate responses to questions posed by the Participants and the SEC.\164\ In performing such obligations, the CISO will be directly responsible and directly report to the Operating Committee, notwithstanding that he or she is employed by the Plan Processor.\165\ The compensation (including base salary and bonus) of the CISO will be payable by the Plan Processor, but be subject to review and approval by the Operating Committee, and the Operating Committee will render the CISO's annual performance review.\166\ Consistent with Appendices C and D, the CISO will be responsible for creating and enforcing appropriate policies, procedures, standards, control structures and real-time tools to monitor and address data security issues for the Plan Processor and the Central Repository, as described in the Plan.\167\ At regular intervals, to the extent that such information is available to the Company, the CISO will report to the Operating Committee the activities of the Financial Services Information Sharing and Analysis Center (``FS-ISAC'') or comparable bodies to the extent that the Company has joined FS-ISAC or other comparable body.\168\

      ---------------------------------------------------------------------------

      \164\ Id. at Section 6.2(b)(ii).

      \165\ Id. at Section 6.2(b)(iii).

      \166\ Id. at Section 6.2(b)(iv).

      \167\ Id. at Section 6.2(b)(v).

      \168\ Id. at Section 6.2(b)(vi).

      ---------------------------------------------------------------------------

      The Plan Processor will afford to the Participants and the Commission such access to the Representatives of the Plan Processor as any Participant or the Commission may reasonably request solely for the purpose of performing such Person's regulatory and oversight responsibilities pursuant to the federal securities laws, rules, and regulations or any contractual obligations.\169\ The Plan Processor will direct such Representatives to reasonably cooperate with any inquiry, investigation, or proceeding conducted by or on behalf of any Participant or the Commission related to such purpose.\170\

      ---------------------------------------------------------------------------

      \169\ Id. at Section 6.1(u).

      \170\ Id.

      ---------------------------------------------------------------------------

      The Operating Committee will review the Plan Processor's performance under the Plan at least once each year, or more often than once each year upon the request of two or more Participants that are not Affiliated Participants.\171\ The Operating Committee will notify the SEC of any determination made by the Operating Committee concerning the continuing engagement of the Plan Processor as a result of the Operating Committee's review of the Plan Processor and will provide the SEC with a copy of any reports that may be prepared in connection therewith.\172\

      ---------------------------------------------------------------------------

      \171\ Id. at Section 6.1(n).

      \172\ Id.

      ---------------------------------------------------------------------------

      The Operating Committee, by Supermajority Vote, may remove the Plan Processor from such position at any time.\173\ However, the Operating Committee, by Majority Vote, may remove the Plan Processor from such position at any time if it determines that the Plan Processor has failed to perform its functions in a reasonably acceptable manner in accordance with the provisions of the Plan or that the Plan Processor's expenses have become excessive and are not justified.\174\ In making such a determination, the Operating Committee will consider, among other factors: (1) The reasonableness of the Plan Processor's response to requests from Participants or the Company for technological changes or enhancements; (2) results of any assessments performed pursuant to Section 6.6; (3) the timeliness of preventative and corrective information technology system maintenance for reliable and secure operations; (4) compliance with requirements of Appendix D; and (5) such other factors related to experience, technological capability, quality and reliability of service, costs, back-up facilities, failure to meet service level agreement(s) and regulatory considerations as the Operating Committee may determine to be appropriate.\175\

      ---------------------------------------------------------------------------

      \173\ Id. at Section 6.1(q).

      \174\ Id. at Section 6.1(r).

      \175\ Id.

      ---------------------------------------------------------------------------

      In addition, the Plan Processor may resign upon two year's (or such other shorter period as may be determined by the Operating Committee by

      Page 84706

      Supermajority Vote) prior written notice.\176\ The Operating Committee will fill any vacancy in the Plan Processor position by Supermajority Vote, and will establish a Plan Processor Selection Subcommittee to evaluate and review Bids and make a recommendation to the Operating Committee with respect to the selection of the successor Plan Processor.\177\

      ---------------------------------------------------------------------------

      \176\ Id. at Section 6.1(s).

      \177\ Id. at Section 6.1(t).

      ---------------------------------------------------------------------------

    2. Central Repository

      The Central Repository, under the oversight of the Plan Processor, and consistent with Appendix D, Central Repository Requirements, will receive, consolidate, and retain all CAT Data.\178\ The Central Repository will collect (from a Securities Information Processor (``SIP'') or pursuant to an NMS plan) and retain on a current and continuing basis, in a format compatible with the Participant Data and Industry Member Data, all data, including the following: (1) Information, including the size and quote condition, on quotes, including the National Best Bid and National Best Offer for each NMS Security; \179\ (2) Last Sale Reports and transaction reports reported pursuant to an effective transaction reporting plan filed with the SEC pursuant to, and meeting the requirements of, Rules 601 and 608; \180\ (3) trading halts, Limit Up-Limit Down price bands and LULD indicators; \181\ and (4) summary data or reports described in the specifications for each of the SIPs and disseminated by the respective SIP.\182\

      ---------------------------------------------------------------------------

      \178\ Id. at Section 6.5(a)(i).

      \179\ Id. at Section 6.5(a)(ii)(A).

      \180\ Id. at Section 6.5(a)(ii)(B).

      \181\ Id. at Section 6.5(a)(ii)(C).

      \182\ Id. at Section 6.5(a)(ii)(D).

      ---------------------------------------------------------------------------

      Consistent with Appendix D, Data Retention Requirements, the Central Repository will retain the information collected pursuant to paragraphs (c)(7) and (e)(7) of Rule 613 in a convenient and usable standard electronic data format that is directly available and searchable electronically without any manual intervention by the Plan Processor for a period of not less than six years. Such data, when available to the Participants' regulatory Staff and the SEC, will be linked.\183\ In addition, the Plan Processor will implement and comply with the records retention policy contemplated by Section 6.1(d)(i).\184\

      ---------------------------------------------------------------------------

      \183\ Id. at Section 6.5(b)(i).

      \184\ Id. at Section 6.5(b)(ii).

      ---------------------------------------------------------------------------

      Consistent with Appendix D, Data Access, the Plan Processor will provide Participants and the SEC access to the Central Repository (including all systems operated by the Central Repository), and access to and use of the CAT Data stored in the Central Repository, solely for the purpose of performing their respective regulatory and oversight responsibilities pursuant to the federal securities laws, rules and regulations or any contractual obligations.\185\ The Plan Processor will create and maintain a method of access to the CAT Data stored in the Central Repository that includes the ability to run searches and generate reports.\186\ The method in which the CAT Data is stored in the Central Repository will allow the ability to return results of queries that are complex in nature, including market reconstructions and the status of order books at varying time intervals.\187\ The Plan Processor will, at least annually and at such earlier time promptly following a request by the Operating Committee, certify to the Operating Committee that only the Participants and the SEC have access to the Central Repository (other than access provided to any Industry Member for the purpose of correcting CAT Data previously reported to the Central Repository by such Industry Member).\188\

      ---------------------------------------------------------------------------

      \185\ Id. at Section 6.5(c)(i).

      \186\ Id. at Section 6.5(c)(ii).

      \187\ Id. at Section 6.5(c)(ii).

      \188\ Id. at Section 6.5(c)(iii); see also id. at Appendix C, The Security and Confidentiality of Information Reported to the Central Repository, and Appendix D, Data Security, describe the security and confidentiality of the CAT Data, including how access to the Central Repository is controlled.

      ---------------------------------------------------------------------------

    3. Data Recording and Reporting by Participants

      The Plan also sets forth the requirements regarding the data recording and reporting by Participants.\189\ Each Participant will record and electronically report to the Central Repository the following details for each order and each Reportable Event,\190\ as applicable (``Participant Data;'' also referred to as ``Recorded Industry Member Data'', as discussed in the next Section):

      ---------------------------------------------------------------------------

      \189\ See CAT NMS Plan, supra note 5, at Section 6.3. Participants may, but are not required to, coordinate compliance with the recording and reporting efforts through the use of regulatory services agreements and/or agreements adopted pursuant to Rule 17d-2 under the Exchange Act.

      \190\ See CAT NMS Plan, supra note 5, at Section 6.5(d). The CAT NMS Plan defines ``Reportable Event'' as ``including, but . . . not limited to, the original receipt or origination, modification, cancellation, routing, execution (in whole or in part) and allocation of an order, and receipt of a routed order.'' Id. at Section 1.1.

      for original receipt or origination of an order: (1) Firm Designated ID(s) (FDIs) for each customer; \191\ (2) CAT-Order-ID; \192\ (3) SRO-Assigned Market Participant Identifier of the Industry Member receiving or originating the order; \193\ (4) date of order receipt or origination; \194\ (5) time of order receipt or origination (using time stamps pursuant to Section 6.8); \195\ and (6) the Material Terms of the Order.\196\

      ---------------------------------------------------------------------------

      \191\ Id. at Section 6.3(d)(i)(A).

      \192\ Id. at Section 6.3(d)(i)(B).

      \193\ Id. at Section 6.3(d)(i)(C).

      \194\ Id. at Section 6.3(d)(i)(D).

      \195\ Id. at Section 6.3(d)(i)(E).

      \196\ Id. at Section 6.3(d)(i)(F). For a discussion of the Material Terms of the Order required by Rule 613, see Adopting Release, supra note 14, at 45750-52. The Commission notes that the Participants include in the Plan a requirement for the reporting of the OTC Equity Security symbol as one of the ``Material Terms of the Order.'' See CAT NMS Plan, supra note 5, at Section 1.1.

      ---------------------------------------------------------------------------

      for the routing of an order: (1) CAT-Order-ID; \197\ (2) date on which the order is routed; \198\ (3) time at which the order is routed (using time stamps pursuant to Section 6.8); \199\ (4) SRO-

      Assigned Market Participant Identifier of the Industry Member or Participant routing the order; \200\ (5) SRO-Assigned Market Participant Identifier of the Industry Member or Participant to which the order is being routed; \201\ (6) if routed internally at the Industry Member, the identity and nature of the department or desk to which the order is routed; \202\ and (7) the Material Terms of the Order.\203\

      ---------------------------------------------------------------------------

      \197\ See CAT NMS Plan, supra note 5, at Section 6.3(d)(ii)(A).

      \198\ Id. at Section 6.3(d)(ii)(B).

      \199\ Id. at Section 6.3(d)(ii)(C).

      \200\ Id. at Section 6.3(d)(ii)(D).

      \201\ Id. at Section 6.3(d)(ii)(E).

      \202\ Id. at Section 6.3(d)(ii)(F).

      \203\ Id. at Section 6.3(d)(ii)(G).

      ---------------------------------------------------------------------------

      for the receipt of an order that has been routed, the following information: (1) CAT-Order-ID; \204\ (2) date on which the order is received; \205\ (3) time at which the order is received (using time stamps pursuant to Section 6.8); \206\ (4) SRO-Assigned Market Participant Identifier of the Industry Member or Participant receiving the order; \207\ (5) SRO-Assigned Market Participant Identifier of the Industry Member or Participant routing the order; \208\ and (6) the Material Terms of the Order.\209\

      ---------------------------------------------------------------------------

      \204\ Id. at Section 6.3(d)(iii)(A).

      \205\ Id. at Section 6.3(d)(iii)(B).

      \206\ Id. at Section 6.3(d)(iii)(C).

      \207\ Id. at Section 6.3(d)(iii)(D).

      \208\ Id. at Section 6.3(d)(iii)(E).

      \209\ Id. at Section 6.3(d)(iii)(F).

      ---------------------------------------------------------------------------

      if the order is modified or cancelled: (1) CAT-Order-ID; \210\ (2) date the modification or cancellation is received or originated; \211\ (3) time at which the modification or cancellation is received or originated (using time stamps pursuant to Section 6.8); \212\ (4) price and remaining size of the order, if modified; \213\ (5) other changes in Material Terms, if modified; \214\ and (6) whether the modification or cancellation instruction was given by the Customer, or was initiated by the Industry Member or Participant.\215\

      ---------------------------------------------------------------------------

      \210\ Id. at Section 6.3(d)(iv)(A).

      \211\ Id. at Section 6.3(d)(iv)(B).

      \212\ Id. at Section 6.3(d)(iv)(C).

      \213\ Id. at Section 6.3(d)(iv)(D).

      \214\ Id. at Section 6.3(d)(iv)(E).

      \215\ Id. at Section 6.3(d)(iv)(F).

      ---------------------------------------------------------------------------

      Page 84707

      if the order is executed, in whole or in part: (1) CAT-Order-ID; \216\ (2) date of execution; \217\ (3) time of execution (using time stamps pursuant to Section 6.8); \218\ (4) execution capacity (principal, agency or riskless principal); \219\ (5) execution price and size;\220\ (6) the SRO-Assigned Market Participant Identifier of the Participant or Industry Member executing the order; \221\ (7) whether the execution was reported pursuant to an effective transaction reporting plan or the Plan for Reporting of Consolidated Options Last Sale Reports and Quotation Information; \222\ and (8) other information or additional events as may otherwise be ---------------------------------------------------------------------------

      prescribed in Appendix D, Reporting and Linkage Requirements.\223\

      \216\ Id. at Section 6.3(d)(v)(A).

      \217\ Id. at Section 6.3(d)(v)(B).

      \218\ Id. at Section 6.3(d)(v)(C).

      \219\ Id. at Section 6.3(d)(v)(D).

      \220\ Id. at Section 6.3(d)(v)(E).

      \221\ Id. at Section 6.3(d)(v)(F).

      \222\ Id. at Section 6.3(d)(v)(G).

      \223\ Id. at Section 6.3(d)(vi).

      ---------------------------------------------------------------------------

      As contemplated in Appendix D, Data Types and Sources, each Participant will report Participant Data to the Central Repository for consolidation and storage in a format specified by the Plan Processor, approved by the Operating Committee and compliant with Rule 613.\224\ As further described in Appendix D, Reporting and Linkage Requirements, each Participant is required to record the Participant Data contemporaneously with the Reportable Event.\225\ In addition, each Participant must report the Participant Data to the Central Repository by 8:00 a.m. Eastern Time (``ET'') on the Trading Day following the day that the Participant recorded the Participant Data.\226\ Participants may voluntarily report the Participant Data prior to the 8:00 a.m. ET deadline.\227\

      ---------------------------------------------------------------------------

      \224\ Id. at Section 6.3(a); Appendix D, Section 2.1.

      \225\ Id. at Section 6.3(b)(i); Appendix D, Section 3.

      \226\ Id. at Section 6.3(b)(ii).

      \227\ Id. at Section 6.3(b)(ii).

      ---------------------------------------------------------------------------

      Each Participant that is a national securities exchange is required to comply with the above recording and reporting requirements for each NMS Security registered or listed for trading on such exchange or admitted to unlisted trading privileges on such exchange.\228\ Each Participant that is a national securities association is required to comply with the above recording and reporting requirements for each Eligible Security for which transaction reports are required to be submitted to the association.\229\

      ---------------------------------------------------------------------------

      \228\ Id. at Section 6.3(c)(i).

      \229\ Id. at Section 6.3(c)(ii).

      ---------------------------------------------------------------------------

    4. Data Reporting and Recording by Industry Members

      The Plan also sets forth the data reporting and recording requirements for Industry Members. Specifically, subject to Section 6.4(c), and Section 6.4(d)(iii) with respect to Options Market Makers, and consistent with Appendix D, Reporting and Linkage Requirements, each Participant, through its Compliance Rule, will require its Industry Members to record and electronically report to the Central Repository for each order and each Reportable Event the information referred to in Section 6.3(d), as applicable (``Recorded Industry Member Data'')--that is, Participant Data discussed above.\230\ In addition, subject to Section 6.4(c), and Section 6.4(d)(iii) with respect to Options Market Makers, and consistent with Appendix D, Reporting and Linkage Requirements, each Participant, through its Compliance Rule, will require its Industry Members to record and report to the Central Repository the following (``Received Industry Member Data'' and, collectively with the Recorded Industry Member Data, ``Industry Member Data''): (1) If the order is executed, in whole or in part: (a) An Allocation Report; \231\ (b) SRO-Assigned Market Participant Identifier of the clearing broker or prime broker, if applicable; and (c) CAT-Order-ID of any contra-side order(s); (2) if the trade is cancelled, a cancelled trade indicator; and (3) for original receipt or origination of an order, information of sufficient detail to identify the Customer.\232\

      ---------------------------------------------------------------------------

      \230\ Id. at Section 6.4(d)(i).

      \231\ Id. at Section 6.4(d)(ii).

      \232\ Id.

      ---------------------------------------------------------------------------

      With respect to the reporting obligations of an Options Market Maker with regard to its quotes in Listed Options, Reportable Events required pursuant to Sections 6.3(d)(ii) and (iv) will be reported to the Central Repository by an Options Exchange in lieu of the reporting of such information by the Options Market Maker.\233\ Each Participant that is an Options Exchange will, through its Compliance Rule, require its Industry Members that are Options Market Makers to report to the Options Exchange the time at which a quote in a Listed Option is sent to the Options Exchange (and, if applicable, any subsequent quote modifications and/or cancellation time when such modification or cancellation is originated by the Options Market Maker).\234\ Such time information also will be reported to the Central Repository by the Options Exchange in lieu of reporting by the Options Market Maker.\235\

      ---------------------------------------------------------------------------

      \233\ Id. at Section 6.4(d)(iii).

      \234\ Id.

      \235\ Id.

      ---------------------------------------------------------------------------

      Each Participant will, through its Compliance Rule, require its Industry Members to record and report to the Central Repository other information or additional events as prescribed in Appendix D, Reporting and Linkage Requirements.\236\

      ---------------------------------------------------------------------------

      \236\ Id. at Section 6.4(d)(v).

      ---------------------------------------------------------------------------

      As contemplated in Appendix D, Data Types and Sources, each Participant will require its Industry Members to report Industry Member Data to the Central Repository for consolidation and storage in a format(s) specified by the Plan Processor, approved by the Operating Committee and compliant with Rule 613.\237\ As further described in Appendix D, Reporting and Linkage Requirements, each Participant will require its Industry Members to record Recorded Industry Member Data contemporaneously with the applicable Reportable Event.\238\ In addition, consistent with Appendix D, Reporting and Linkage Requirements, each Participant will require its Industry Members to report: (1) Recorded Industry Member Data to the Central Repository by 8:00 a.m. ET on the Trading Day following the day the Industry Member records such Recorded Industry Member Data; and (2) Received Industry Member Data to the Central Repository by 8:00 a.m. ET on the Trading Day following the day the Industry Member receives such Received Industry Member Data.\239\ Each Participant will permit its Industry Members to voluntarily report Industry Member Data prior to the applicable 8:00 a.m. ET deadline.\240\

      ---------------------------------------------------------------------------

      \237\ Id. at Section 6.4(e).

      \238\ Id. at Section 6.4(b)(i).

      \239\ Id. at Section 6.4(b)(ii).

      \240\ Id.

      ---------------------------------------------------------------------------

      Each Participant that is a national securities exchange must require its Industry Members to report Industry Member Data for each NMS Security registered or listed for trading on such exchange or admitted to unlisted trading privileges on such exchange.\241\ Each Participant that is a national securities association must require its Industry Members to report Industry Member Data for each Eligible Security for which transaction reports are required to be submitted to the association.\242\

      ---------------------------------------------------------------------------

      \241\ Id. at Section 6.4(c)(i).

      \242\ Id. at Section 6.4(c)(ii).

      ---------------------------------------------------------------------------

    5. Written Assessment

      As described in Article VI, the Participants are required to provide the Commission with a written assessment of the operation of the CAT that meets the requirements set forth in Rule 613, Appendix D, and the Plan at least every

      Page 84708

      two years or more frequently in connection with any review of the Plan Processor's performance under the Plan pursuant to Section 6.1(n).\243\ The CCO will oversee this assessment and will provide the Participants a reasonable time to review and comment upon the written assessment prior to its submission to the SEC.\244\ In no case will the written assessment be changed or amended in response to a comment from a Participant; rather any comment by a Participant will be provided to the SEC at the same time as the written assessment.\245\

      ---------------------------------------------------------------------------

      \243\ See CAT NMS Plan, supra note 5, at Section 6.6(a)(i).

      \244\ Id. at Section 6.6(a)(ii).

      \245\ Id.

      ---------------------------------------------------------------------------

    6. Business Clock Synchronization and Timestamp

      Section 6.8 of the Plan discusses the synchronization of Business Clocks \246\ and timestamps.

      ---------------------------------------------------------------------------

      \246\ Id. at Section 1.1. The CAT NMS Plan defines a ``Business Clock'' to mean ``a clock used to record the date and time of any Reportable Event required to be reported under SEC Rule 613.'' Id.

      ---------------------------------------------------------------------------

      Each Participant is required to synchronize its Business Clocks (other than such Business Clocks used solely for Manual Order Events) at a minimum to within 50 milliseconds of the time maintained by the National Institute of Standards and Technology (``NIST''), consistent with industry standards.\247\ In addition, each Participant must, through its Compliance Rule, require its Industry Members to: (1) Synchronize their respective Business Clocks (other than such Business Clocks used solely for Manual Order Events) at a minimum to within 50 milliseconds of the time maintained by the NIST, and maintain such a synchronization; (2) certify periodically that their Business Clocks meet the requirements of the Compliance Rule; and (3) report to the Plan Processor and the Participant any violation of the Compliance Rule pursuant to the thresholds set by the Operating Committee.\248\ Furthermore, each Participant is required to synchronize its Business Clocks and, through its Compliance Rule, require its Industry Members to synchronize their Business Clocks used solely for Manual Order Events at a minimum to within one second of the time maintained by the NIST, consistent with industry standards, and maintain such synchronization.\249\ Each Participant will require its Industry Members to certify periodically (according to a schedule defined by the Operating Committee) that their Business Clocks used solely for Manual Order Events meet the requirements of the Compliance Rule.\250\ The Compliance Rule of a Participant shall require its Industry Members using Business Clocks solely for Manual Order Events to report to the Plan Processor any violation of the Compliance Rule pursuant to the thresholds set by the Operating Committee.\251\ Pursuant to Section 6.8(c) of the CAT NMS Plan, the CCO, in conjunction with the Participants and other appropriate Industry Member advisory groups, annually must evaluate and make a recommendation to the Operating Committee as to whether the industry standard has evolved such that the clock synchronization standard should be tightened.\252\

      ---------------------------------------------------------------------------

      \247\ Id. at Section 6.8(a)(i). Participants and Industry Members reviewed their respective internal clock synchronization technology practices, and reviewed the results of The Financial Information Forum (``FIF'') Clock Offset and determined that a 50 millisecond clock offset tolerance was consistent with the current industry clock synchronization standard. See CAT NMS Plan, supra note 5, at Appendix C, Section A.3(c) and D.12(p); see also Financial Information Forum, FIF Clock Offset Survey Preliminary Report (February 17, 2015), available at http://www.catnmsplan.com/industryfeedback/p602479.pdf and http://catnmsplan.com/web/groups/catnms/@catnms/documents/appsupportdocs/p602479.pdf (``FIF Clock Offset Survey'').

      \248\ See CAT NMS Plan, supra note 5, at Section 6.8(a)(ii).

      \249\ Id. at Section 6.8(a)(iii).

      \250\ Id.

      \251\ Id.

      \252\ Id. at Section 6.8(c).

      ---------------------------------------------------------------------------

      Appendix C discusses mechanisms to ensure compliance with the 50 millisecond clock offset tolerance.\253\ The Participants anticipate that they and Industry Members will adopt policies and procedures to verify the required clock synchronization each trading day before the market opens, as well as periodically throughout the trading day.\254\ The Participants also anticipate that they and Industry Members will document their clock synchronization procedures and maintain a log recording the time of each clock synchronization performed, and the result of such synchronization, specifically identifying any synchronization revealing any clock offset between the Participant's or Industry Member's Business Clock and the time maintained by the NIST exceeding 50 milliseconds.\255\ The CAT NMS Plan states that once both large and small broker-dealers begin reporting to the Central Repository, and as clock synchronization technology matures further, the Participants will assess, in accordance with Rule 613, tightening the CAT's clock synchronization standards to reflect changes in industry standards.\256\

      ---------------------------------------------------------------------------

      \253\ See id. at Appendix C, Section A.3(c).

      \254\ See id.

      \255\ See id. It was noted that such a log would include results for a period of not less than five years ending on the then current date. Id.

      \256\ See id. at Appendix C, Section D.12(p).

      ---------------------------------------------------------------------------

      Each Participant shall, and through its Compliance Rule require its Industry Members to, report information required by Rule 613 and the Plan to the Central Repository in milliseconds.\257\ To the extent that any Participant utilizes timestamps in increments finer than the minimum required by the Plan, the Participant is required to make reports to the Central Repository utilizing such finer increment when reporting CAT Data to the Central Repository so that all Reportable Events reported to the Central Repository could be adequately sequenced. Each Participant will, through its Compliance Rule: (1) Require that, to the extent that its Industry Members utilize timestamps in increments finer than the minimum required in the Plan, such Industry Members will utilize such finer increment when reporting CAT Data to the Central Repository; and (2) provide that a pattern or practice of reporting events outside of the required clock synchronization time period without reasonable justification or exceptional circumstances may be considered a violation of SEC Rule 613 and the Plan.\258\ Notwithstanding the preceding sentences, each Participant and Industry Member will be permitted to record and report Manual Order Events to the Central Repository in increments up to and including one second, provided that Participants and Industry Members will be required to record and report the time when a Manual Order Event has been captured electronically in an order handling and execution system of such Participant or Industry Member (``Electronic Capture Time'') in milliseconds.\259\ In conjunction with Participants' and other appropriate Industry Member advisory groups, the CCO will annually evaluate and make a recommendation to the Operating Committee as to whether industry standards have evolved such that the required synchronization should be shortened or the required timestamp should be in finer increments.\260\ The Operating Committee will make determinations regarding the need to revise the synchronization and timestamp requirements.\261\

      ---------------------------------------------------------------------------

      \257\ See id. at Section 6.8(b).

      \258\ Id. at Section 6.8(b).

      \259\ Id.

      \260\ Id. at Section 6.8(c).

      \261\ Id. at Sections 6.8(a)(ii)(C), 6.8(a)(iii).

      ---------------------------------------------------------------------------

      Page 84709

    7. Technical Specifications

      Section 6.9 of the Plan establishes the requirements involving the Plan Processor's Technical Specifications. The Plan Processor will publish Technical Specifications that are at a minimum consistent with Appendices C and D, and updates thereto as needed, providing detailed instructions regarding the submission of CAT Data by Participants and Industry Members to the Plan Processor for entry into the Central Repository.\262\ The Technical Specifications will be made available on a publicly available Web site to be developed and maintained by the Plan Processor.\263\ The initial Technical Specifications and any Material Amendments thereto will require the approval of the Operating Committee by Supermajority Vote.\264\

      ---------------------------------------------------------------------------

      \262\ Id. at Section 6.9(a).

      \263\ Id.

      \264\ Id.

      ---------------------------------------------------------------------------

      The Technical Specifications will include a detailed description of the following: (1) The specifications for the layout of files and records submitted to the Central Repository; (2) the process for the release of new data format specification changes; (3) the process for industry testing for any changes to data format specifications; (4) the procedures for obtaining feedback about and submitting corrections to information submitted to the Central Repository; (5) each data element, including permitted values, in any type of report submitted to the Central Repository; (6) any error messages generated by the Plan Processor in the course of validating the data; (7) the process for file submissions (and re-submissions for corrected files); (8) the storage and access requirements for all files submitted; (9) metadata requirements for all files submitted to the CAT System; (10) any required secure network connectivity; (11) data security standards, which will, at a minimum: (a) Satisfy all applicable regulations regarding database security, including provisions of Regulation Systems Compliance and Integrity under the Exchange Act (``Reg SCI''); (b) to the extent not otherwise provided for under the Plan (including Appendix C thereto), set forth such provisions as may be necessary or appropriate to comply with Rule 613(e)(4); and (c) comply with industry best practices; and (12) any other items reasonably deemed appropriate by the Plan Processor and approved by the Operating Committee.\265\

      ---------------------------------------------------------------------------

      \265\ Id. at Section 6.9(b).

      ---------------------------------------------------------------------------

      Amendments to the Technical Specifications may be made only in accordance with Section 6.9(c).\266\ The process for amending the Technical Specifications varies depending on whether the change is material. An amendment will be deemed ``material'' if it would require a Participant or an Industry Member to engage in significant changes to the coding necessary to submit information to the Central Repository pursuant to the Plan, or if it is required to safeguard the security or confidentiality of the CAT Data.\267\ Except for Material Amendments to the Technical Specifications, the Plan Processor will have the sole discretion to amend and publish interpretations regarding the Technical Specifications; however, all non-Material Amendments made to the Technical Specifications and all published interpretations will be provided to the Operating Committee in writing at least ten days before being published.\268\ Such non-Material Amendments and published interpretations will be deemed approved ten days following provision to the Operating Committee unless two or more unaffiliated Participants call for a vote to be taken on the proposed amendment or interpretation.\269\ If an amendment or interpretation is called for a vote by two or more unaffiliated Participants, the proposed amendment must be approved by Majority Vote of the Operating Committee.\270\ Once a non-Material Amendment has been approved or deemed approved by the Operating Committee, the Plan Processor will be responsible for determining the specific changes to the Central Repository and providing technical documentation of those changes, including an implementation timeline.\271\

      ---------------------------------------------------------------------------

      \266\ Id. at Section 6.9(c).

      \267\ Id.

      \268\ Id. at Section 6.9(c)(i).

      \269\ Id.

      \270\ Id.

      \271\ Id.

      ---------------------------------------------------------------------------

      Material Amendments to the Technical Specifications require approval of the Operating Committee by Supermajority Vote.\272\ The Operating Committee, by Supermajority Vote, may amend the Technical Specifications on its own motion.\273\

      ---------------------------------------------------------------------------

      \272\ Id. at Section 6.9(c)(ii).

      \273\ Id. at Section 6.9(c)(iii).

      ---------------------------------------------------------------------------

    8. Surveillance

      Surveillance requirements are described in Section 6.10. Using the tools provided for in Appendix D, Functionality of the CAT System, each Participant will develop and implement a surveillance system, or enhance existing surveillance systems, reasonably designed to make use of the consolidated information contained in the Central Repository.\274\ Unless otherwise ordered by the SEC, within fourteen months after the Effective Date, each Participant must initially implement a new or enhanced surveillance system(s) as required by Rule 613 and Section 6.10(a) of the Plan.\275\ Participants may, but are not required to, coordinate surveillance efforts through the use of regulatory services agreements and agreements adopted pursuant to Rule 17d-2 under the Exchange Act.\276\

      ---------------------------------------------------------------------------

      \274\ See CAT NMS Plan, supra note 5, at Section 6.10(a).

      \275\ Id.

      \276\ Id. at Section 6.10(b).

      ---------------------------------------------------------------------------

      Consistent with Appendix D, Functionality of the CAT System, the Plan Processor will provide Participants and the SEC with access to all CAT Data stored in the Central Repository. Regulators will have access to processed CAT Data through two different methods: (1) An online targeted query tool; and (2) user-defined direct queries and bulk extracts.\277\ The online targeted query tool will provide authorized users with the ability to retrieve CAT Data via an online query screen that includes the ability to choose from a variety of pre-defined selection criteria.\278\ Targeted queries must include date(s) and/or time range(s), as well as one or more of a variety of fields.\279\ The user-defined direct queries and bulk extracts will provide authorized users with the ability to retrieve CAT Data via a query tool or language that allows users to query all available attributes and data sources.\280\

      ---------------------------------------------------------------------------

      \277\ Id. at Section 6.10(c)(i).

      \278\ Id. at Section 6.10(c)(i)(A).

      \279\ Id.

      \280\ Id. at Section 6.10(c)(i)(B).

      ---------------------------------------------------------------------------

      Extraction of CAT Data will be consistent with all permission rights granted by the Plan Processor.\281\ All CAT Data returned will be encrypted, and PII data \282\ will be masked unless users have permission to view the PII contained in the CAT Data that has been requested.\283\

      ---------------------------------------------------------------------------

      \281\ Id. at Section 6.10(c)(ii).

      \282\ The proposed CAT NMS Plan defines PII as ``personally identifiable information, including a social security number or tax identifier number or similar information.'' Id. at Section 1.1.

      \283\ Id. at Section 6.10(c)(ii).

      ---------------------------------------------------------------------------

      The Plan Processor will implement an automated mechanism to monitor direct query usage.\284\ Such monitoring will

      Page 84710

      include automated alerts to notify the Plan Processor of potential issues with bottlenecks or excessively long queues for queries or CAT Data extractions.\285\ The Plan Processor will provide the Operating Committee or its designee(s) details as to how the monitoring will be accomplished and the metrics that will be used to trigger alerts.\286\

      ---------------------------------------------------------------------------

      \284\ Id. at Section 6.10(c)(iii) (providing that ``such monitoring shall include automated alerts to notify the Plan Processor of potential issues with bottlenecks or excessively long queues for queries or CAT Data extractions. The Plan Processor shall provide the Operating Committee or its designee(s) details as to how the monitoring will be accomplished and the metrics that will be used to trigger alerts'').

      \285\ Id.

      \286\ Id.

      ---------------------------------------------------------------------------

      The Plan Processor will reasonably assist regulatory Staff (including those of Participants) with creating queries.\287\ Without limiting the manner in which regulatory Staff (including those of Participants) may submit queries, the Plan Processor will submit queries on behalf of regulatory Staff (including those of Participants) as reasonably requested.\288\ The Plan Processor will staff a CAT help desk, as described in Appendix D, CAT Help Desk, to provide technical expertise to assist regulatory Staff (including those of Participants) with questions about the content and structure of the CAT Data.\289\

      ---------------------------------------------------------------------------

      \287\ Id. at 6.10(c)(iv).

      \288\ Id. at Section 6.10(c)(v).

      \289\ Id. at Section 6.10(c)(vi).

      ---------------------------------------------------------------------------

    9. Information Security Program

      As set forth in Section 6.12, the Plan Processor is required to develop and maintain a comprehensive information security program for the Central Repository that contains, at a minimum, the specific requirements detailed in Appendix D, Data Security. The information security program must be approved and reviewed at least annually by the Operating Committee.\290\

      ---------------------------------------------------------------------------

      \290\ Id. at Section 6.12.

      ---------------------------------------------------------------------------

      6. Financial Matters

      Articles VII and VIII of the Plan address certain financial matters related to the Company. In particular, the Plan states that, subject to certain special allocations provided for in Section 8.2, any net profit or net loss will be allocated among the Participants equally.\291\ In addition, subject to Section 10.2, cash and property of the Company will not be distributed to the Participants unless the Operating Committee approves by Supermajority Vote a distribution after fully considering the reason that such distribution must or should be made to the Participants, including the circumstances contemplated under Section 8.3, Section 8.6, and Section 9.3.\292\ To the extent a distribution is made, all Participants will participate equally in any such distribution except as otherwise provided in Section 10.2.\293\

      ---------------------------------------------------------------------------

      \291\ Id. at Section 8.1.

      \292\ Id. at Section 8.5(a).

      \293\ Id.

      ---------------------------------------------------------------------------

      Article XI addresses the funding of the Company. On an annual basis the Operating Committee will approve an operating budget for the Company.\294\ The budget will include the projected costs of the Company, including the costs of developing and operating the CAT System for the upcoming year, and the sources of all revenues to cover such costs, as well as the funding of any reserve that the Operating Committee reasonably deems appropriate for prudent operation of the Company.\295\

      ---------------------------------------------------------------------------

      \294\ Id. at Section 11.1(a).

      \295\ Id.

      ---------------------------------------------------------------------------

      Subject to certain funding principles set forth in Article XI, the Operating Committee will have discretion to establish funding for the Company, including: (1) Establishing fees that the Participants will pay; and (2) establishing fees for Industry Members that will be implemented by Participants.\296\ In establishing the funding of the Company, the Operating Committee will seek to: (1) Create transparent, predictable revenue streams for the Company that are aligned with the anticipated costs to build, operate and administer the CAT and the other costs of the Company; (2) establish an allocation of the Company's related costs among Participants and Industry Members that is consistent with the Exchange Act, taking into account the timeline for implementation of the CAT and distinctions in the securities trading operations of Participants and Industry Members and their relative impact upon Company resources and operations; (3) establish a tiered fee structure in which the fees charged to: (a) CAT Reporters that are Execution Venues, including Alternative Trading Systems (``ATSs''), are based upon the level of market share, (b) Industry Members' non-ATS activities are based upon message traffic, and (c) the CAT Reporters with the most CAT-related activity (measured by market share and/or message traffic, as applicable) are generally comparable (where, for these comparability purposes, the tiered fee structure takes into consideration affiliations between or among CAT Reporters, whether Execution Venues and/or Industry Members); (4) provide for ease of billing and other administrative functions; (5) avoid any disincentives such as placing an inappropriate burden on competition and a reduction in market quality; and (6) build financial stability to support the Company as a going concern.\297\ The Participants will file with the SEC under Section 19(b) of the Exchange Act any such fees on Industry Members that the Operating Committee approves, and such fees will be labeled as ``Consolidated Audit Trail Funding Fees.'' \298\

      ---------------------------------------------------------------------------

      \296\ Id. at Section 11.1(b).

      \297\ Id. at Section 11.2.

      \298\ Id. at Section 11.1(b).

      ---------------------------------------------------------------------------

      To fund the development and implementation of the CAT, the Company will time the imposition and collection of all fees on Participants and Industry Members in a manner reasonably related to the timing when the Company expects to incur such development and implementation costs.\299\ In determining fees for Participants and Industry Members, the Operating Committee shall take into account fees, costs and expenses (including legal and consulting fees and expenses) incurred by the Participants on behalf of the Company prior to the Effective Date in connection with the creation and implementation of the CAT, and such fees, costs and expenses shall be fairly and reasonably shared among the Participants and Industry Members.\300\ Consistent with Article XI, the Operating Committee will adopt policies, procedures, and practices regarding the budget and budgeting process, assignment of tiers, resolution of disputes, billing and collection of fees, and other related matters.\301\ As a part of its regular review of fees for the CAT, the Operating Committee will have the right to change the tier assigned to any particular Person pursuant to this Article XI.\302\ Any such changes will be effective upon reasonable notice to such Person.\303\

      ---------------------------------------------------------------------------

      \299\ Id. at Section 11.1(c).

      \300\ Id.

      \301\ Id. at Section 11.1(d).

      \302\ The Commission notes that Section 11.1(b) of the CAT NMS Plan states that the Participants would file fees for Industry Members approved by the Operating Committee with the Commission. The Operating Committee may only change the tier to which a Person is assigned in accordance with a fee schedule filed with the Commission.

      \303\ See CAT NMS Plan, supra note 5, at Section 11.1(d).

      ---------------------------------------------------------------------------

      The Operating Committee will establish fixed fees to be payable by Execution Venues as follows. Each Execution Venue that executes transactions, or, in the case of a national securities association, has trades reported by its members to its trade reporting facility or facilities for reporting transactions effected otherwise than on an exchange, in NMS Stocks or OTC Equity Securities will pay a fixed fee depending on the market share of that Execution Venue in NMS

      Page 84711

      Stocks and OTC Equity Securities.\304\ The Operating Committee will establish at least two and no more than five tiers of fixed fees, based on an Execution Venue's NMS Stocks and OTC Equity Securities market share.\305\ For these purposes, market share will be calculated by share volume.\306\ In addition, each Execution Venue that executes transactions in Listed Options will pay a fixed fee depending on the Listed Options market share of that Execution Venue.\307\ The Operating Committee will establish at least two and no more than five tiers of fixed fees, based on an Execution Venue's Listed Options market share, with market share calculated by contract volume.\308\ Changes to the number of tiers after approval of the Plan would require a Supermajority Vote of the Operating Committee and Commission approval under Section 19(b) of the Exchange Act, as would the establishment of the initial fee schedule and any changes to the fee schedule within the tier structure.\309\

      ---------------------------------------------------------------------------

      \304\ Id. at Section 11.3(a)(i).

      \305\ Id.

      \306\ Id.

      \307\ Id. at Section 11.3(a)(ii).

      \308\ Id.

      \309\ The Commission notes that the Participants could choose to submit the proposed fee schedule to the Commission as individual SROs pursuant to Rule 19b-4 or jointly as Participants to an NMS plan pursuant to Rule 608 of Regulation NMS. Because the proposed fee schedule would establish fees, whether the Participants individually file it pursuant to Section 19(b)(3)(A)(ii) of the Act, or jointly file it pursuant to Rule 608(b)(3)(i) of Regulation NMS, the proposed fee schedule could take effect upon filing with the Commission. See 15 U.S.C. 78s(b)(3)(A)(ii); 17 CFR 242.608(b)(3)(i); see also Section IV.F, infra.

      ---------------------------------------------------------------------------

      The Operating Committee also will establish fixed fees payable by Industry Members, based on the message traffic generated by such Industry Member.\310\ The Operating Committee will establish at least five and no more than nine tiers of fixed fees, based on message traffic.\311\ For the avoidance of doubt, the fixed fees payable by Industry Members pursuant to this paragraph will, in addition to any other applicable message traffic, include message traffic generated by: (1) An ATS that does not execute orders that is sponsored by such Industry Member; and (2) routing orders to and from any ATS system sponsored by such Industry Member.\312\

      ---------------------------------------------------------------------------

      \310\ See CAT NMS Plan, supra note 5, at Section 11.3(b).

      \311\ Id.

      \312\ Id.

      ---------------------------------------------------------------------------

      Furthermore, the Operating Committee may establish any other fees ancillary to the operation of the CAT that it reasonably determines appropriate, including: fees for the late or inaccurate reporting of information to the CAT; fees for correcting submitted information; and fees based on access and use of the CAT for regulatory and oversight purposes (and not including any reporting obligations).\313\

      ---------------------------------------------------------------------------

      \313\ As it relates to fees that the Operating Committee may impose for access and use of the CAT for regulatory and oversight purposes, the Commission interprets the provisions in the Plan relating to the collection of fees as applying only to Participants and Industry Members, and thus the Commission would not be subject to such fees. See Section IV.F, infra, for further discussion regarding the funding of the Company.

      ---------------------------------------------------------------------------

      The Company will make publicly available a schedule of effective fees and charges adopted pursuant to the Plan as in effect from time to time.\314\ Such schedule will be developed after the Plan Processor is selected.\315\ The Operating Committee will review the fee schedule on at least an annual basis and will make any changes to such fee schedule that it deems appropriate.\316\ The Operating Committee is authorized to review the fee schedule on a more regular basis, but will not make any changes on more than a semi-annual basis unless, pursuant to a Supermajority Vote, the Operating Committee concludes that such change is necessary for the adequate funding of the Company.\317\

      ---------------------------------------------------------------------------

      \314\ See CAT NMS Plan, supra note 5, at Section 11.3(d).

      \315\ Id.

      \316\ Id.; see also supra note 309.

      \317\ Id.

      ---------------------------------------------------------------------------

      The Operating Committee will establish a system for the collection of fees authorized under the Plan.\318\ The Operating Committee may include such collection responsibility as a function of the Plan Processor or another administrator.\319\ Alternatively, the Operating Committee may use the facilities of a clearing agency registered under Section 17A of the Exchange Act to provide for the collection of such fees.\320\

      ---------------------------------------------------------------------------

      \318\ Id. at Section 11.4.

      \319\ Id.

      \320\ Id.

      ---------------------------------------------------------------------------

      Each Participant will require each Industry Member to pay all applicable fees authorized under Article XI within thirty days after receipt of an invoice or other notice indicating payment is due (unless a longer payment period is otherwise indicated).\321\ If an Industry Member fails to pay any such fee when due, such Industry Member will pay interest on the outstanding balance from such due date until such fee is paid at a per annum rate equal to the lesser of: (1) The Prime Rate plus 300 basis points; or (2) the maximum rate permitted by applicable law.\322\ Each Participant will pay all applicable fees authorized under Article XI as required by Section 3.7(b).\323\

      ---------------------------------------------------------------------------

      \321\ Id.

      \322\ Id.

      \323\ Id.

      ---------------------------------------------------------------------------

      Disputes with respect to fees the Company charges Participants pursuant to Article XI will be determined by the Operating Committee or a Subcommittee designated by the Operating Committee.\324\ Decisions by the Operating Committee on such matters shall be binding on Participants, without prejudice to the rights of any Participant to seek redress from the SEC pursuant to SEC Rule 608 or in any other appropriate forum.\325\ The Participants will adopt rules requiring that disputes with respect to fees charged to Industry Members pursuant to Article XI be determined by the Operating Committee or a Subcommittee.\326\ Decisions by the Operating Committee or Subcommittee on such matters will be binding on Industry Members, without prejudice to the rights of any Industry Member to seek redress from the SEC pursuant to SEC Rule 608 or in any other appropriate forum.\327\

      ---------------------------------------------------------------------------

      \324\ Id. at Section 11.5.

      \325\ Id.

      \326\ Id.

      \327\ Id.

      ---------------------------------------------------------------------------

      7. Amendments

      Section 12.3 of the CAT NMS Plan, which governs amendments to the Plan, states that, except with respect to the addition of new Participants (Section 3.3), the transfer of Company Interest (Section 3.4), the termination of a Participant's participation in the Plan (Section 3.7), amendments to the Selection Plan (Section 5.3 sic) and special allocations (Section 8.2), any change to the Plan requires a written amendment authorized by the affirmative vote of not less than two-thirds of all of the Participants, or with respect to Section 3.8 by the affirmative vote of all the Participants.\328\ Such proposed amendment must be approved by the Commission pursuant to Rule 608 or otherwise becomes effective under Rule 608.\329\ Notwithstanding the foregoing, to the extent that the Commission grants exemptive relief applicable to any provision of the LLC Agreement, Participants and Industry Members will be entitled to comply with such provision pursuant to the terms of the exemptive relief so granted at the time such relief is granted irrespective of whether the LLC Agreement has been amended.\330\

      ---------------------------------------------------------------------------

      \328\ Id. at Section 12.3.

      \329\ Id.

      \330\ Id.

      ---------------------------------------------------------------------------

      Page 84712

      8. Compliance Rule Applicable to Industry Members

      Under Article III, each Participant agrees to comply with and enforce compliance by its Industry Members with the provisions of Rule 613 and the Plan, as applicable, to the Participant and its Industry Members.\331\ Accordingly, the Participants will endeavor to promulgate consistent rules (after taking into account circumstances and considerations that may impact Participants differently) requiring compliance by their respective Industry Members with the provisions of Rule 613 and the Plan.\332\

      ---------------------------------------------------------------------------

      \331\ Id. at Section 3.11.

      \332\ Id.

      ---------------------------------------------------------------------------

      9. Plan Appendices

      The Plan includes three appendices.\333\ Appendix A provides the Consolidated Audit Trail National Market System Plan Request for Proposal, as issued February 26, 2013 and subsequently updated. In addition, Rule 613(a)(1) requires that the Plan discuss twelve considerations that explain the choices made by the Participants to meet the requirements specified in Rule 613 for the CAT. In accordance with this requirement, the Participants have addressed each of the twelve considerations in Appendix C. Finally, Appendix D describes the technical requirements for the Plan Processor.

      ---------------------------------------------------------------------------

      \333\ Appendix B is reserved for future use.

      ---------------------------------------------------------------------------

      As mentioned, Appendix C discusses the various ``considerations'' regarding how the Participants propose to develop and implement the CAT required to be discussed by Rule 613.\334\ These considerations, include: (i) The reporting of data to the Central Repository, including the sources of the data and the manner in which the Central Repository will receive, extract, transform, load, and retain the data; (ii) the time and method by which the data in the Central Repository will be made available to regulators; (iii) the reliability and accuracy of the data reported to and maintained by the Central Repository throughout its lifecycle; (iv) the security and confidentiality of the information reported to the Central Repository; (v) the flexibility and scalability of the systems used by the Central Repository to collect, consolidate and store CAT Data; (vi) the feasibility, benefits and costs of broker-

      dealers reporting certain information to the CAT in a timely manner; (vii) an analysis of expected benefits and estimated costs for creating, implementing, and maintaining the CAT pursuant to the proposed CAT NMS Plan; (viii) an analysis of the proposed CAT NMS Plan's impact on competition, efficiency, and capital formation; (ix) a plan to eliminate rules and systems that will be rendered duplicative by the CAT; (x) objective milestones to assess progress toward the implementation of the proposed CAT NMS Plan; (xi) the process by which Participants solicited views of members and other parties regarding creation, implementation, and maintenance of CAT and a summary of these views and how the Participants took them into account in preparing the CAT NMS Plan; and (xii) a discussion of reasonable alternative approaches that the Participants considered to create, implement, and maintain the CAT.\335\

      ---------------------------------------------------------------------------

      \334\ 17 CFR 242.613(a).

      \335\ See CAT NMS Plan, supra note 5, at Appendix C, Sections A.1-6, B.7-8, C.9-10.

      ---------------------------------------------------------------------------

      The technical requirements discussed in Appendix D to the CAT NMS Plan, CAT NMS Plan Processor Requirements, include an outline of minimum functional and technical requirements established by the Participants of the CAT NMS Plan for the Plan Processor. Appendix D provides the Plan Processor with details and guidelines for compliance with the requirements contained in Article VI that are not expressly stated therein.

      Appendix D also outlines technical architecture, capacity and data retention requirements for the Central Repository,\336\ as well as describes the types of data that would be reported to the Central Repository and the sources of such information.\337\ The Appendix outlines specific requirements relating to reporting data, linking data, validating and processing data and timing for availability to regulators.\338\ Appendix D further discusses how regulators would be able to access and use the data.\339\ It also provides requirements related to data security, and specific requirements governing how Customer and Customer Account Information must be captured and stored, separate from transactional data.\340\ Appendix D outlines requirements for the Plan Processor's disaster recovery and business continuity plans.\341\ Finally, Appendix D describes plans for technical, operational, and business support to CAT Reporters for all aspects of reporting, and describes how upgrades and new functionality would be incorporated.\342\

      ---------------------------------------------------------------------------

      \336\ Id. at Appendix D, Sections 1.1, 1.3-1.4.

      \337\ Id. at Appendix D, Section 2.1.

      \338\ Id. at Appendix D, Sections 3, 6.1-6.2, 7.2.

      \339\ Id. at Appendix D, Section 8.1.

      \340\ Id. at Appendix D, Sections 4.1, 9.1.

      \341\ Id. at Appendix D, Sections 5.3-5.4.

      \342\ Id. at Appendix D, Sections 10, 11.

      ---------------------------------------------------------------------------

      10. Reporting Procedures

      The CAT NMS Plan requires CAT Reporters to comply with specific reporting procedures when reporting CAT Data to the Central Repository.\343\ Specifically, CAT Reporters must format CAT Data to comply with the format specifications approved by the Operating Committee.\344\ CAT Reporters must record CAT Data contemporaneously with the applicable Reportable Event \345\ and report such data to the Central Repository by 8:00 a.m. ET on the next Trading Day.\346\ The obligation to report CAT Data applies to ``each NMS Security registered or listed for trading on a national securities exchange or admitted to unlisted trading privileges on such exchange,'' and ``each Eligible Security for which transaction reports are required to be submitted to such national securities association.'' \347\ Further, the Participants are required to adopt Compliance Rules \348\ that require Industry Members, subject to their SRO jurisdiction, to report CAT Data.\349\

      ---------------------------------------------------------------------------

      \343\ Id. at Sections 6.3-6.4; Appendix D, at Section 2.1.

      \344\ Id. at Sections 6.3(a), 6.4(a). The CAT NMS Plan also requires that the Operating Committee-approved format must be a format specified by the Plan Processor and Rule 613 compliant.

      \345\ Id. at Sections 6.3(b)(i), 6.4(b)(i).

      \346\ Id. at Sections 6.3(b)(ii); 6.4(b)(ii); Appendix C, Section A.1(a)(ii). Participants may voluntarily report CAT Data prior to the 8:00 a.m. ET deadline. Id. The CAT NMS Plan defines ``Trading Day'' as the date ``as is determined by the Operating Committee.'' The CAT NMS Plan also provides that ``the Operating Committee may establish different Trading Days for NMS Stocks (as defined in SEC Rule 600(b)(47), Listed Options, OTC Equity Securities, and any other securities that are included as Eligible Securities from time to time.'') Id. at Section 1.1.

      \347\ See CAT NMS Plan, supra note 5, at Sections 6.3(c)(i)-

      (ii), 6.4(c)(i)-(ii).

      \348\ The CAT NMS Plan defines the ``Compliance Rule'' to mean ``with respect to a Participant, the rules promulgated by such Participant as contemplated by Section 3.11.'' Id. at Section 1.1. Section 3.11 of the CAT NMS Plan provides that ``each Participant shall comply with and enforce compliance, as required by SEC Rule 608(c), by its Industry Members with the provisions of SEC Rule 613 and of the LLC Agreement, as applicable, to the Participant and its Industry Members. The Participants shall endeavor to promulgate consistent rules (after taking into account circumstances and considerations that may impact Participants differently) requiring compliance by their respective Industry Members with the provisions of SEC Rule 613 and the LLC Agreement.'' Id. at Section 3.11.

      \349\ See id. at Section 6.4(c)(i)-(ii).

      ---------------------------------------------------------------------------

      The CAT NMS Plan requires specific data elements of CAT Data that must be recorded and reported to the Central Repository upon: (i) ``original receipt or

      Page 84713

      origination of an order,'' \350\ (ii) ``routing of an order,'' \351\ and (iii) ``receipt of an order that has been routed.'' \352\ Additionally, the CAT NMS Plan requires that a CAT Reporter must record and report data related to an ``order that is modified or cancelled,'' \353\ and an ``order that is executed, in whole or in part,'' \354\ as well as ``other information or additional events as may be prescribed in Appendix D, Reporting and Linkage Requirements.'' \355\ The CAT NMS Plan also requires Industry Member CAT Reporters to report additional data elements for (i) an ``order that is executed, in whole or in part,'' \356\ (ii) a ``trade that is cancelled,'' \357\ or (iii) ``original receipt or origination of an order.'' \358\ Further, each Participant shall, through Compliance Rules, require Industry Members to record and report to the Central Repository information or additional events as may be prescribed to accurately reflect the complete lifecycle of each Reportable Event.\359\

      ---------------------------------------------------------------------------

      \350\ For ``original receipt or origination of an order,'' the CAT NMS Plan specifies the following data elements: (i) Firm Designated ID(s) for each Customer; (ii) CAT-Order-ID; (iii) SRO-

      Assigned Market Participant Identifier of the Industry Member receiving or originating the order; (iv) date of order receipt or origination; (v) time of order receipt or origination (using timestamps pursuant to Section 6.8 of the CAT NMS Plan); and (vi) Material Terms of the Order. Id. at Section 6.3(d)(i).

      \351\ For ``routing of an order,'' the CAT NMS Plan specifies the following data elements: (i) CAT-Order-ID; (ii) date on which the order is routed; (iii) time at which the order is routed (using timestamps pursuant to Section 6.8 of the CAT NMS Plan); (iv) SRO-

      Assigned Market Participant Identifier of the Industry Member or Participant routing the order; (v) SRO-Assigned Market Participant Identifier of the Industry Member or Participant to which the order is being routed; (vi) if routed internally at the Industry Member, the identity and nature of the department or desk to which the order is routed; and (vii) Material Terms of the Order. Id. at Section 6.3(d)(ii).

      \352\ For ``receipt of an order that has been routed,'' the CAT NMS Plan specifies the following data elements: (i) CAT-Order-ID; (ii) date on which the order is received; (iii) time at which the order is received (using timestamps pursuant to Section 6.8); (iv) SRO-Assigned Market Participant Identifier of the Industry Member or Participant receiving the order; (v) SRO-Assigned Market Participant Identifier of the Industry Member or Participant routing the order; and (vi) Material Terms of the Order. Id. at Section 6.3(d)(iii).

      \353\ For an ``order that is modified or cancelled,'' the CAT NMS Plan specifies the following data elements: (i) CAT-Order-ID; (ii) date the modification or cancellation is received or originated; (iii) time at which the modification or cancellation is received or originated (using timestamps pursuant to Section 6.8 of the CAT NMS Plan); (iv) price and remaining size of the order, if modified; (v) other changes in the Material Terms of the Order, if modified; and (vi) whether the modification or cancellation instruction was given by the Customer or was initiated by the Industry Member or Participant. Id. at Section 6.3(d)(iv).

      \354\ For an ``order that is executed, in whole or in part,'' the CAT NMS Plan specifies the following data elements: (i) CAT-

      Order-ID; (ii) date of execution; (iii) time of execution (using timestamps pursuant to Section 6.8 of the CAT NMS Plan); (iv) execution capacity (principal, agency or riskless principal); (v) execution price and size; (vi) SRO-Assigned Market Participant Identifier of the Participant or Industry Member executing the order; and (vii) whether the execution was reported pursuant to an effective transaction reporting plan or the Plan for Reporting of Consolidated Options Last Sale Reports and Quotation Information. Id. at Section 6.3(d)(v).

      \355\ See id. at Section 6.3(d)(vi).

      \356\ For an ``order that is executed, in whole or in part,'' the CAT NMS Plan specifies the following additional data elements: (i) an Allocation Report; (ii) SRO-Assigned Market Participant Identifier of the clearing broker or prime broker, if applicable; and (iii) CAT-Order-ID of any contra-side order(s). Id. at Section 6.4(d)(ii)(A).

      \357\ For a ``trade that is cancelled,'' the CAT NMS Plan specifies the following additional data element: a cancelled trade indicator. Id. at Section 6.4(d)(ii)(B).

      \358\ For ``original receipt or origination of an order,'' the CAT NMS Plan specifies the following additional data element(s): the Firm Designated ID, Customer Account Information, and Customer Identifying Information for the relevant Customer. Id. at Section 6.4(d)(ii)(C).

      \359\ Id. at Appendix D, Section 3.

      ---------------------------------------------------------------------------

      11. Timeliness of Data Reporting

      Section 6.3(b)(ii) of the CAT NMS Plan requires each Participant to report Participant Data to the Central Repository by 8:00 a.m. ET on the Trading Day following the day the Participant records such data.\360\ Additionally, a Participant may voluntarily report such data prior to this deadline.\361\ Section 6.4(b)(ii) states that each Participant shall, through its Compliance Rule, require its Industry Members to report Recorded Industry Member Data to the Central Repository by 8:00 a.m. ET on the Trading Day following the day the Industry Member records such data, and Received Industry Member Data to the Central Repository by 8:00 a.m. ET on the Trading Day following the day the Industry Member receives such data.\362\ Section 6.4(b)(ii) of the CAT NMS Plan also states that each Participant shall, through its Compliance Rule, permit its Industry Members to voluntarily report such data prior to the applicable 8:00 a.m. ET deadline.\363\

      ---------------------------------------------------------------------------

      \360\ Id. at Section 6.3(b)(ii); see also id. at Appendix C, Section A.1(a)(ii); Appendix D, Sections 3.1, 6.1.

      \361\ Id. at Section 6.3(b)(ii).

      \362\ Id. at Section 6.4(b)(ii).

      \363\ Id.

      ---------------------------------------------------------------------------

      12. Uniform Format

      The CAT NMS Plan does not mandate the format in which data must be reported to the Central Repository.\364\ Appendix D states that the Plan Processor will determine the electronic format in which data must be reported, and that the format will be described in the Technical Specifications.\365\ Appendix C specifies that CAT Reporters could be required to report data either in a uniform electronic format, or in a manner that would allow the Central Repository to convert the data to a uniform electronic format, for consolidation and storage.\366\ Similarly, Sections 6.3(a) and 6.4(a) of the CAT NMS Plan require that CAT Reporters report data to the Central Repository in a format or formats specified by the Plan Processor, approved by the Operating Committee, and compliant with Rule 613.\367\

      ---------------------------------------------------------------------------

      \364\ Id. at Appendix C, Section D.12(f); see also id. at Appendix C, Section A.1(a).

      \365\ Id. at Appendix D, Section 2.1. Appendix D states that more than one format may be allowed to support the various market participants that would report information to the Central Repository. Id.; see also id. at Section 6.9.

      \366\ Id. at Appendix C, Section A.1(b).

      \367\ Id. at Sections 6.3(a), 6.4(a).

      ---------------------------------------------------------------------------

      The CAT NMS Plan requires that data reported to the Central Repository be stored in an electronic standard format.\368\ Specifically, Section 6.5(b)(i) of the CAT NMS Plan requires the Central Repository to retain the information collected pursuant to Rule 613(c)(7) and (e)(7) in a convenient and usable standard electronic data format that is directly available and searchable electronically without any manual intervention by the Plan Processor for a period of not less than six (6) years.\369\ Such data must be linked when it is made available to the Participant's regulatory Staff and the Commission.\370\

      ---------------------------------------------------------------------------

      \368\ Pursuant to the Plan, for data consolidation and storage, as noted above, such data must be reported in a uniform electronic format or in a manner that would allow the Central Repository to convert the data to a uniform electronic format. Id. at Appendix C, Section A.1(b).

      \369\ Id. at Section 6.5(b)(i).

      \370\ Id.

      ---------------------------------------------------------------------------

      13. Symbology

      The CAT NMS Plan also addresses the symbology that CAT Reporters must use when reporting CAT Data. The CAT NMS Plan requires CAT Reporters to report data using the listing exchange's symbology. The CAT NMS Plan requires the Plan Processor to create and maintain a symbol history and mapping table, as well as provide a tool to regulators and CAT Reporters showing the security's complete symbol history, along with a start-of-day and end-of-day list of reportable securities for use by CAT Reporters, in .csv format, by 6:00 a.m. on each trading day.\371\ The Participants will be responsible for providing the Plan Processor with issue symbol information, and issue symbol validation must be included in the

      Page 84714

      processing of data submitted by CAT Reporters.\372\

      ---------------------------------------------------------------------------

      \371\ Id. at Appendix D, Section 2.

      \372\ Id. at Appendix C, Section A.1(a).

      ---------------------------------------------------------------------------

      14. CAT-Reporter-ID

      Sections 6.3 and 6.4 of the CAT NMS Plan require CAT Reporters to record and report to the Central Repository an SRO-Assigned Market Participant Identifier \373\ for orders and certain Reportable Events to be used by the Central Repository to assign a unique CAT-Reporter-ID \374\ for purposes of identifying each CAT Reporter associated with an order or Reportable Event (the ``Existing Identifier Approach'').\375\ The CAT NMS Plan requires the reporting of SRO-Assigned Market Participant Identifiers of: The Industry Member receiving or originating an order; \376\ the Industry Member or Participant from which (and to which) an order is being routed; \377\ the Industry Member or Participant receiving (and routing) a routed order; \378\ the Industry Member or Participant executing an order, if an order is executed; \379\ and the clearing broker or prime broker, if applicable, if an order is executed.\380\ An Industry Member would report to the Central Repository its existing SRO-Assigned Market Participant Identifier used by the relevant SRO specifically for transactions occurring at that SRO.\381\ Similarly, an exchange reporting CAT Reporter information would report data using the SRO-Assigned Market Participant Identifier used by the Industry Member on that exchange or its systems.\382\ Over-the-counter (``OTC'') orders and Reportable Events would be reported with an Industry Member's FINRA SRO-Assigned Market Participant Identifier.\383\

      ---------------------------------------------------------------------------

      \373\ The CAT NMS Plan defines an ``SRO-Assigned Market Participant Identifier'' as ``an identifier assigned to an Industry Member by an SRO or an identifier used by a Participant.'' Id. at Section 1.1.

      \374\ Rule 613 defines a CAT-Reporter-ID as ``a code that uniquely and consistently identifies a CAT Reporter for purposes of providing data to the central repository.'' 17 CFR 242.613(j)(2).

      \375\ The SROs requested exemptive relief from Rule 613 so that the CAT NMS Plan may permit the Existing Identifier Approach, which would allow a CAT Reporter to report an existing SRO-Assigned Market Participant Identifier in lieu of requiring the reporting of a universal CAT-Reporter-ID. See Exemptive Request Letter, supra note 21, at 19. The Commission granted exemptive relief on March 1, 2016 in order to allow this alternative to be included in the CAT NMS Plan and subject to notice and comment. See Exemption Order, supra note 21.

      \376\ See CAT NMS Plan, supra note 5, at Sections 6.3(d)(i), 6.4(d)(i).

      \377\ Id. at Sections 6.3(d)(ii), 6.4(d)(i).

      \378\ Id. at Sections 6.3(d)(iii), 6.4(d)(i).

      \379\ Id. at Sections 6.3(d)(v), 6.4(d)(i).

      \380\ Id. at Section 6.4(d)(ii)(A)(2). Industry Members are required by the CAT NMS Plan to record and report this information. Id. at Section 6.4(d)(ii).

      \381\ See Exemption Order, supra note 21, at 31-41.

      \382\ See id. at 20.

      \383\ Id.

      ---------------------------------------------------------------------------

      The CAT NMS Plan requires the Plan Processor to develop and maintain the mechanism to assign (and to change, if necessary) CAT-

      Reporter-IDs.\384\ For the Central Repository to link the SRO-Assigned Market Participant Identifier to the CAT-Reporter-ID, each SRO must submit, on a daily basis, all SRO-Assigned Market Participant Identifiers used by its Industry Members (or itself), as well as information to identify the corresponding market participant (for example, a CRD number or Legal Entity Identifier (``LEI'') to the Central Repository.\385\ Additionally, each Industry Member shall be required to submit to the Central Repository information sufficient to identify such Industry Member (e.g., CRD number or LEI, as noted above).\386\ The Plan Processor would use the SRO-Assigned Market Participant Identifiers and identifying information (i.e., CRD number or LEI) to assign a CAT-Reporter-ID to each Industry Member and SRO for internal use across all data within the Central Repository.\387\ The Plan Processor would create and maintain a database in the Central Repository that would map the SRO-Assigned Market Participant Identifiers to the appropriate CAT-Reporter-ID.\388\

      ---------------------------------------------------------------------------

      \384\ See CAT NMS Plan, supra note 5, at Appendix D, Section 10.1. Changes to CAT-Reporter-IDs must be reviewed and approved by the Plan Processor. Id. The CAT NMS Plan also requires the Central Repository to generate and assign a unique CAT-Reporter-ID to all reports submitted to the system based on sub-identifiers that are currently used by CAT Reporters in their order handling and trading processes (described in the Exemption Request as SRO-assigned market participant identifiers). Id. at Appendix D, Section 3; see also Exemption Order, supra note 21, at 31-41.

      \385\ See CAT NMS Plan, supra note 5, at Section 6.3(e)(i).

      \386\ Id. at Section 6.4(d)(vi).

      \387\ See Exemption Order, supra note 21, at 31-41.

      \388\ Id. at 20.

      ---------------------------------------------------------------------------

      The CAT must be able to capture, store, and maintain current and historical SRO-Assigned Market Participant Identifiers.\389\ The SRO-

      Assigned Market Participant Identifier must also be included on the Plan Processor's acknowledgment of its receipt of data files from a CAT Reporter or Data Submitter,\390\ on daily statistics provided by the Plan Processor after the Central Repository has processed data,\391\ and on a secure Web site that the Plan Processor would maintain that would contain each CAT Reporter's daily reporting statistics.\392\ In addition, data validations by the Plan Processor must include confirmation of a valid SRO-Assigned Market Participant Identifier.\393\

      ---------------------------------------------------------------------------

      \389\ Id. at Appendix D, Section 2.

      \390\ See id. at Appendix D, Section 7.1.

      \391\ See id. at Appendix D, Section 7.2.

      \392\ See id. at Appendix D, Section 10.1.

      \393\ See id. at Appendix D, Section 7.2. The CAT NMS Plan also notes that both the CAT-Reporter-ID and the SRO-Assigned Market Participant Identifier would be data fields for the online targeted query tool described in the CAT NMS Plan as providing authorized users with the ability to retrieve processed and/or validated (unlinked) data via an online query screen. See id. at Appendix D, Section 8.1.1.

      ---------------------------------------------------------------------------

      15. Customer-ID

    10. Customer Information Approach

      Rule 613(c)(7)(i)(A) requires that for the original receipt or origination of an order, a CAT Reporter report the ``Customer-ID(s) for each Customer.'' \394\ ``Customer-ID'' is defined in Rule 613(j)(5) to mean ``with respect to a customer, a code that uniquely and consistently identifies such customer for purposes of providing data to the Central Repository.'' \395\ Rule 613(c)(8) requires that ``all plan sponsors and their members shall use the same Customer-ID and CAT-

      Reporter-ID for each customer and broker-dealer.'' \396\

      ---------------------------------------------------------------------------

      \394\ 17 CFR 242.613(c)(7)(i)(A).

      \395\ 17 CFR 242.613(j)(5).

      \396\ 17 CFR 242.613(c)(8).

      ---------------------------------------------------------------------------

      In Appendix C, the Participants describe the ``Customer Information Approach,'' \397\ an alternative approach to the requirement that a broker-dealer report a Customer-ID for every Customer upon original receipt or origination of an order.\398\ Under the Customer Information Approach, the CAT NMS Plan would require each broker-dealer to assign a unique Firm Designated ID to each Customer.\399\ As the Firm Designated ID, broker-dealers would be permitted to use an account number or any other identifier defined by the firm,

      Page 84715

      provided each identifier is unique across the firm for each business date (i.e., a single firm may not have multiple separate customers with the same identifier on any given date).\400\ According to the CAT NMS Plan, broker-dealers would submit an initial set of Customer information to the Central Repository, including, as applicable, the Firm Designated ID, the Customer's name, address, date of birth, individual tax payer identifier number (``ITIN'')/social security number (``SSN''), individual's role in the account (e.g., primary holder, joint holder, guardian, trustee, person with power of attorney) and LEI,\401\ and/or Large Trader ID (``LTID''), if applicable, which would be updated as set forth in the CAT NMS Plan.\402\

      ---------------------------------------------------------------------------

      \397\ The SROs requested exemptive relief from Rule 613 so that the CAT NMS Plan may permit the Customer Information Approach, which would require each broker-dealer to assign a unique Firm Designated ID to each trading account and to submit an initial set of information identifying the Customer to the Central Repository, in lieu of requiring each broker-dealer to report a Customer-ID for each Customer upon the original receipt or origination of an order. See Exemptive Request Letter, supra note 21, at 12. The Commission granted exemptive relief on March 1, 2016 in order to allow this alternative to be included in the CAT NMS Plan and subject to notice and comment. See Exemption Order, supra note 21.

      \398\ See CAT NMS Plan, supra note 5, at Appendix C, Section A.1(a)(iii).

      \399\ Id. The CAT NMS Plan defines a ``Firm Designated ID'' as ``a unique identifier for each trading account designated by Industry Members for purposes of providing data to the Central Repository, where each such identifier is unique among all identifiers from any given Industry Member for each business date.'' See id. at Section 1.1.

      \400\ Id. at Appendix C, Section A.1(a)(iii).

      \401\ The CAT NMS Plan provides that where a validated LEI is available for a Customer or entity, this may obviate a need to report other identifier information (e.g., Customer name, address, EIN). Id. at Appendix C, Section A.1(a)(iii) n.31.

      \402\ The CAT NMS Plan states that the Participants anticipate that Customer information that is initially reported to the CAT could be limited to Customer accounts that have, or are expected to have, CAT Reportable Event activity. For example, the CAT NMS Plan notes accounts that are considered open, but have not traded Eligible Securities in a given time frame, may not need to be pre-

      established in the CAT, but rather could be reported as part of daily updates after they have CAT Reportable Event activity. Id. at Appendix C, Section A.1(a)(iii) n.32.

      ---------------------------------------------------------------------------

      Under the Customer Information Approach, broker-dealers would be required to report only the Firm Designated ID for each new order submitted to the Central Repository, rather than the ``Customer-ID'' as defined by Rule 613(c)(j)(5) and as required by Rule 613(c)(7)(i)(A), and the Plan Processor would associate specific Customers and their Customer-IDs with individual order events based on the reported Firm Designated IDs.\403\ Within the Central Repository, each Customer would be uniquely identified by identifiers or a combination of identifiers such as an ITIN/SSN, date of birth, and, as applicable, LEI and LTID.\404\ The Plan Processor would be required to use these unique identifiers to map orders to specific Customers across all broker-

      dealers.\405\ To ensure information identifying a Customer is updated, broker-dealers would be required to submit to the Central Repository daily updates for reactivated accounts, newly established or revised Firm Designated IDs, or associated reportable Customer information.\406\

      ---------------------------------------------------------------------------

      \403\ See id. at Appendix C, Section A.1(a)(iii). The CAT NMS Plan also requires Industry Members to report ``Customer Account Information'' upon the original receipt of origination of an order. See CAT NMS Plan, supra note 5, at Sections 1.1, 6.4(d)(ii)(C).

      \404\ See CAT NMS Plan, supra note 5, at Appendix C, Section A.1(a)(iii).

      \405\ Id.

      \406\ The CAT NMS Plan notes that because reporting to the CAT is on an end-of-day basis, intra-day changes to information could be captured as part of the daily updates to the information. To ensure the completeness and accuracy of Customer information and associations, in addition to daily updates, broker-dealers would be required to submit periodic full refreshes of Customer information to the CAT. The scope of the ``full'' Customer information refresh would need to be further defined, with the assistance of the Plan Processor, to determine the extent to which inactive or otherwise terminated accounts would need to be reported. Id. at Appendix C, Section A.1(a)(iii) n.33.

      ---------------------------------------------------------------------------

      Appendix C provides additional requirements that the Plan Processor must meet under the Customer Information Approach.\407\ The Plan Processor must maintain information of sufficient detail to uniquely and consistently identify each Customer across all CAT Reporters, and associated accounts from each CAT Reporter, and must document and publish, with the approval of the Operating Committee, the minimum list of attributes to be captured to maintain this association.\408\ In addition, the Plan Processor must maintain valid Customer and Customer Account Information \409\ for each trading day and provide a method for Participants and the Commission to easily obtain historical changes to that information (e.g., name changes, address changes).\410\ The Plan Processor also must design and implement a robust data validation process for submitted Firm Designated IDs, Customer Account Information and Customer Identifying Information, and be able to link accounts that move from one CAT Reporter to another due to mergers and acquisitions, divestitures, and other events.\411\ Under the Customer Information Approach, Industry Members will initially submit full account lists for all active accounts to the Plan Processor and subsequently submit updates and changes on a daily basis.\412\ Finally, the Plan Processor must have a process to periodically receive full account lists to ensure the completeness and accuracy of the account database.\413\

      ---------------------------------------------------------------------------

      \407\ See id. at Appendix C, Section A.1(a)(iii).

      \408\ Id. Section 9.1 of Appendix D also addresses, among other things, the minimum attributes that CAT must capture for Customers and the validation process for such attributes. Id. at Appendix D, Section 9.1.

      \409\ Id. at Appendix D, Section 9.1. In relevant part, ``Customer Account Information'' is defined in the Plan to include, but not be limited to, account number, account type, customer type, date account opened, and large trader identifier (if applicable). See id. at Section 1.1.

      \410\ See id. at Appendix C, Section A.1(a)(iii).

      \411\ Id. The CAT NMS Plan defines ``Customer Identifying Information'' to mean ``information of sufficient detail to identify a Customer, including, but not limited to, (a) with respect to individuals: Name, address, date of birth, individual tax payer identification number (``ITIN'')/social security number (``SSN''), individual's role in the account (e.g., primary holder, joint holder, guardian, trustee, person with the power of attorney); and (b) with respect to legal entities: Name, address, Employer Identification Number (``EIN'')/LEI) or other comparable common entity identifier, if applicable; provided, however, where the LEI or other common entity identifier is provided, information covered by such common entity identifier (e.g., name, address) would not need to be separately submitted to the Central Repository.'' See id. at Section 1.1.

      \412\ Id. at Appendix C, Section A.1(a)(iii).

      \413\ Id.

      ---------------------------------------------------------------------------

    11. Account Effective Date vs. Account Open Date

      Rule 613(c)(7)(viii)(B) requires broker-dealers to report to the Central Repository ``Customer Account Information'' upon the original receipt or origination of an order.\414\ The CAT NMS Plan defines ``Customer Account Information'' to include, in part, the Customer's account number, account type, customer type, date account opened and LTID (if applicable).\415\ The Plan, however, provides that in two limited circumstances, a broker-dealer could report the ``Account Effective Date'' in lieu of the date an account was opened.\416\ The first circumstance is where a relationship identifier--rather than an actual parent account--has been established for an institutional Customer relationship.\417\ In this case, no account open date is available for the institutional Customer parent relationship because there is no parent account, and for the same reason, there is no account number or account type available.\418\ Thus, the Plan provides that in this circumstance, a broker-dealer could report the ``Account Effective Date'' of the relationship in

      Page 84716

      lieu of an account open date.\419\ Further, the Plan provides that where such an institutional Customer relationship was established before the broker-dealer's obligation to report audit trail data, the ``Account Effective Date'' would be either (i) the date the broker-

      dealer established the relationship identifier, or (ii) the date when trading began (i.e., the date the first order was received) using the relevant relationship identifier, and if both dates are available and differ, the earlier date.\420\ Where such relationships are established after the broker-dealer's obligation to report audit trail data is required, the ``Account Effective Date'' would be the date the broker-

      dealer established the relationship identifier and would be no later than the date the first order was received.\421\ Regardless of when the relationship was established for such institutional Customers, the Plan provides that broker-dealers may report the relationship identifier in place of Rule 613(c)(7)(viii)(B)'s requirement to report the ``account number,'' and report ``relationship'' in place of ``account type.''\422\

      ---------------------------------------------------------------------------

      \414\ 17 CFR 242.613(c)(7)(viii)(B). ``Customer Account Information'' is defined in Rule 613(j)(4) to ``include, but not be limited to, account number, account type, customer type, date account opened, and large trader identifier (if applicable).'' 17 CFR 242.613(j)(4).

      \415\ See CAT NMS Plan, supra note 5, at Section 1.1.

      \416\ Id. The SROs requested exemptive relief from Rule 613 so that the CAT NMS Plan may permit broker-dealers to report to the Central Repository the ``effective date'' of an account in lieu of requiring each broker-dealer to report the date the account was opened in certain limited circumstances. See Exemptive Request Letter, supra note 21, at 13. The Commission granted exemptive relief on March 1, 2016 in order to allow this alternative to be included in the CAT NMS Plan and subject to notice and comment. See Exemption Order, supra note 21.

      \417\ See Exemption Order, supra note 21; see also September 2015 Supplement, supra note 21, at 4-5.

      \418\ See September 2015 Supplement, supra note 21, at 6.

      \419\ See CAT NMS Plan, supra note 5, at Section 1.1.

      \420\ Id.

      \421\ Id.

      \422\ Id.

      ---------------------------------------------------------------------------

      The second circumstance where a broker-dealer may report the ``Account Effective Date'' rather than the date an account was opened as required in Rule 613(c)(7)(viii)(B) is when particular legacy system data issues prevent a broker-dealer from providing an account open date for any type of account (i.e., institutional, proprietary or retail) that was established before the CAT's implementation.\423\ According to the Plan, these legacy system data issues may arise because:

      ---------------------------------------------------------------------------

      \423\ Id.; see also September 2015 Supplement, supra note 21, at 7-9.

      ---------------------------------------------------------------------------

      (1) A broker-dealer has switched back office providers or clearing firms and the new back office/clearing firm system identifies the account open date as the date the account was opened on the new system;

      (2) A broker-dealer is acquired and the account open date becomes the date that an account was opened on the post-merger back office/

      clearing firm system;

      (3) Certain broker-dealers maintain multiple dates associated with accounts in their systems and do not designate in a consistent manner which date constitutes the account open date, as the parameters of each date are determined by the individual broker-dealer; or

      (4) No account open date exists for a proprietary account of a broker-dealer.\424\

      ---------------------------------------------------------------------------

      \424\ See CAT NMS Plan, supra note 5, at Section 1.1.

      ---------------------------------------------------------------------------

      Thus, when legacy systems data issues arise due to one of the four reasons above and no account open date is available, the Plan provides that broker-dealers would be permitted to report an ``Account Effective Date'' in lieu of an account open date.\425\ When the legacy systems data issues and lack of account open date are attributable to above reasons (1) or (2), the ``Account Effective Date'' would be the date the account was established, either directly or via a system transfer, at the relevant broker-dealer.\426\ When the legacy systems data issues and lack of account open date are attributable to above reason (3), the ``Account Effective Date'' would be the earliest available date.\427\ When the legacy systems data issues and lack of account open date are attributable to above reason (4), the ``Account Effective Date'' would be (i) the date established for the proprietary account in the broker-

      dealer or its system(s), or (ii) the date when proprietary trading began in the account, i.e., the date on which the first order was submitted from the account.\428\

      ---------------------------------------------------------------------------

      \425\ Id.

      \426\ Id.

      \427\ Id.

      \428\ Id.

      ---------------------------------------------------------------------------

    12. Modification/Cancellation

      Rule 613(c)(7)(iv)(F) requires that ``the CAT-Reporter-ID of the broker-dealer or Customer-ID of the person giving the modification or cancellation instruction'' be reported to the Central Repository.\429\ Because the Customer Information Approach no longer requires, as permitted by the Exemption Order, that a Customer-ID be reported upon original receipt or origination of an order, and because reporting the Customer-ID of the specific person that gave the modification or cancellation instruction would result in an inconsistent level of information regarding the identity of the person giving the modification or cancellation instruction versus the identity of the Customer that originally received or originated an order, Section 6.3(d)(iv)(F) of the CAT NMS Plan modifies the requirement in Rule 613 and instead requires CAT Reporters to report whether the modification or cancellation instruction was ``given by the Customer or was initiated by the Industry Member or Participant.''\430\

      ---------------------------------------------------------------------------

      \429\ 17 CFR 242.613(c)(7)(iv)(F) (emphasis added).

      \430\ See CAT NMS Plan, supra note 5, at Section 6.3(d)(iv)(F). The SROs requested exemptive relief from Rule 613 so that the CAT NMS Plan may permit CAT Reporters to report whether a modification or cancellation instruction was given by the Customer associated with the order, or was initiated by the broker-dealer or exchange associated with the order, in lieu of requiring CAT Reporters to report the Customer-ID of the person giving the modification or cancellation instruction. See Exemptive Request Letter, supra note 21, at 12-13. The Commission granted exemptive relief on March 1, 2016 in order to allow this alternative to be included in the CAT NMS Plan and subject to notice and comment. See Exemption Order, supra note 21.

      ---------------------------------------------------------------------------

      16. Order Allocation Information

      Section 6.4(d)(ii)(A)(1) of the CAT NMS Plan provides that each Participant through its Compliance Rule must require that Industry Members record and report to the Central Repository an Allocation Report that includes the Firm Designated ID when an execution is allocated in whole or part.\431\ The CAT NMS Plan defines an Allocation Report as ``a report made to the Central Repository by an Industry Member that identifies the Firm Designated ID for any account(s), including subaccount(s), to which executed shares are allocated and provides the security that has been allocated, the identifier of the firm reporting the allocation, the price per share of shares allocated, the side of shares allocated, the number of shares allocated to each account, and the time of the allocation.'' \432\ The CAT NMS Plan explains, for the avoidance of doubt, that an Allocation Report shall not be required to be linked to particular orders or executions.\433\

      ---------------------------------------------------------------------------

      \431\ See CAT NMS Plan, supra note 5, at Section 6.4(d)(ii)(A)(1); see also April 2015 Supplement, supra note 21. The SROs requested exemptive relief from Rule 613 so that the CAT NMS Plan may permit Industry Members to record and report to the Central Repository an Allocation Report that includes the Firm Designated ID when an execution is allocated in whole or part in lieu of requiring the reporting of the account number for any subaccount to which an execution is allocated, as is required by Rule 613. See Exemptive Request Letter, supra note 21, at 26-27. The Commission granted exemptive relief on March 1, 2016 in order to allow this alternative to be included in the CAT NMS Plan and subject to notice and comment. See Exemption Order, supra note 21.

      \432\ See CAT NMS Plan, supra note 5, at Section 1.1; see also April 2015 Supplement, supra note 21.

      \433\ See CAT NMS Plan, supra note 5, at Section 1.1.

      ---------------------------------------------------------------------------

      17. Options Market Maker Quotes

      Section 6.4(d)(iii) of the CAT NMS Plan states that, with respect to the reporting obligations of an Options Market Maker under Sections 6.3(d)(ii) and (iv) regarding its quotes\434\ in Listed

      Page 84717

      Options, such quotes shall be reported to the Central Repository by the relevant Options Exchange in lieu of reporting by the Options Market Maker.\435\ Section 6.4(d)(iii) further states that each Participant that is an Options Exchange shall, through its Compliance Rule, require its Industry Members that are Options Market Makers to report to the Options Exchange the time at which a quote in a Listed Option is sent to the Options Exchange (and, if applicable, the time of any subsequent quote modification and/or cancellation where such modification or cancellation is originated by the Options Market Maker).\436\ Such time information also shall be reported to the Central Repository by the Options Exchange in lieu of reporting by the Options Market Maker.\437\

      ---------------------------------------------------------------------------

      \434\ Rule 613(c)(7) provides that the CAT NMS Plan must require reporting of the details for each order and each Reportable Event, including the routing and modification or cancellation of an order. 17 CFR 242.613(c)(7). Rule 613(j)(8) defines ``order'' to include ``any bid or offer.'' 17 CFR 242.613(j)(8).

      \435\ See CAT NMS Plan, supra note 5, at Section 6.4(d)(iii). The SROs requested exemptive relief from Rule 613 so that the CAT NMS Plan may permit Options Market Maker quotes to be reported to the Central Repository by the relevant Options Exchange in lieu of requiring that such reporting be done by both the Options Exchange and the Options Market Maker, as is required by Rule 613. See Exemptive Request Letter, supra note 21, at 2. In accord with the exemptive relief requested, the SROs committed to require Options Market Makers to report to the Exchange the time at which a quote in a Listed Option is sent to the Options Exchange. Id. at 3. The Commission granted exemptive relief on March 1, 2016 in order to allow this alternative to be included in the CAT NMS Plan and subject to notice and comment. See Exemption Order, supra note 21.

      \436\ See CAT NMS Plan, supra note 5, at Section 6.4(d)(iii).

      \437\ Id.

      ---------------------------------------------------------------------------

      18. Primary Market Transactions, Debt Securities and Futures

      Rule 613 and the CAT NMS Plan do not require the reporting of audit trail data for Primary Market Transactions,\438\ debt securities, and futures. However, Rule 613(i) requires that, within six months after the effective date of the CAT NMS Plan, the SROs shall jointly provide to the Commission ``a document outlining how such exchanges and associations could incorporate into the consolidated audit trail information with respect to equity securities that are not NMS securities,\439\ debt securities, primary market transactions in equity securities that are not NMS securities, and primary market transactions in debt securities, including details for each order and reportable event that may be required to be provided, which market participants may be required to provide the data, an implementation timeline, and a cost estimate.'' \440\

      ---------------------------------------------------------------------------

      \438\ The CAT NMS Plan defines ``Primary Market Transaction'' to mean ``any transaction other than a secondary market transaction and refers to any transaction where a Person purchases securities in an offering.'' Id. at Section 1.1.

      \439\ The Commission notes that in the CAT NMS Plan some non-NMS equities (specifically, OTC equity securities) are required to be reported. Id. at Sections 1.1, 6.3 (requiring Eligible Securities data to be reported, and where Eligible Securities is defined as all NMS securities and all OTC equity securities).

      \440\ See 17 CFR 242.613(i); see also CAT NMS Plan, supra note 5, at Section 6.11. The CAT NMS Plan defines ``NMS Securities'' to mean ``any security or class of securities for which transaction reports are collected, processed, and made available pursuant to an effective transaction reporting plan, or an effective national market system plan for reporting transactions in Listed Options.'' See CAT NMS Plan, supra note 5, at Section 1.1. The CAT NMS Plan defines ``OTC Equity Securities'' as ``any equity security, other than an NMS Security, subject to prompt last sale reporting rules of a registered national securities association and reported to one of such association's equity trade reporting facilities.'' Id.

      ---------------------------------------------------------------------------

      19. Error Rates

      The CAT NMS Plan defines Error Rate as ``the percentage of Reportable Events collected by the Central Repository in which the data reported does not fully and accurately reflect the order event that occurred in the market.'' \441\ Under the CAT NMS Plan, the Operating Committee sets the maximum Error Rate that the Central Repository would tolerate from a CAT Reporter reporting data to the Central Repository.\442\ The Operating Committee reviews and resets the maximum Error Rate, at least annually.\443\ If a CAT Reporter reports CAT Data to the Central Repository with errors such that their error percentage exceeds the maximum Error Rate, then such CAT Reporter would not be in compliance with the CAT NMS Plan or Rule 613.\444\ As such, ``the Participants as Participants or the SEC may take appropriate action for failing to comply with the reporting obligations under the CAT NMS Plan and SEC Rule 613.'' \445\ The CAT NMS Plan, however, does not detail what specific compliance enforcement provisions would apply if a CAT Reporter exceeds the maximum Error Rate.\446\

      ---------------------------------------------------------------------------

      \441\ See CAT NMS Plan, supra note 5, at Section 1.1; see also Rule 613(j)(6).

      \442\ Id. at Section 6.5(d)(i).

      \443\ Id. at Appendix C, Section A.3(b).

      \444\ Id. at Appendix C, Section A.3(b); Rule 613(g)-(h).

      \445\ Id. at Appendix C, Section A.3(b).

      \446\ See Notice, supra note 5, at 30645.

      ---------------------------------------------------------------------------

      The CAT NMS Plan sets the initial maximum Error Rate at 5% for any data reported pursuant to subparagraphs (3) and (4) of Rule 613(c).\447\ The SROs highlight that ``the Central Repository will require new reporting elements and methods for CAT Reporters and there will be a learning curve when CAT Reporters begin to submit data to the Central Repository'' in support of a 5% initial rate.\448\ Further, the SROs state that ``many CAT Reporters may have never been obligated to report data to an audit trail.'' \449\ The SROs believe an initial maximum Error Rate of 5% ``strikes the balance of making allowances for adapting to a new reporting regime, while ensuring that the data provided to regulators will be capable of being used to conduct surveillance and market reconstruction.'' \450\ In the CAT NMS Plan, the Participants compared the contemplated Error Rates of CAT Reporters to the error rates of OATS reporters in the time periods immediately following three significant OATS releases in the last ten years.\451\ The Participants state that for the three comparative OATS releases \452\: An average of 2.42% of order events did not pass systemic validations; an average of 0.36% of order events were not submitted in a timely manner; an average of 0.86% of orders were unsuccessfully matched to a trade reporting facility trade report; an average of 3.12% of OATS Route Reports were unsuccessfully matched to an exchange order; and an average of 2.44% of OATS Route Reports were unsuccessfully matched to a report by another reporting entity.\453\

      ---------------------------------------------------------------------------

      \447\ See CAT NMS Plan, supra note 5, at Section 6.5(d)(i).

      \448\ Id. at Appendix C, Section A.3(b).

      \449\ Id.

      \450\ Id.

      \451\ Id. The SROs note that the three comparative releases are known as ``(1) OATS Phase III, which required manual orders to be reported to OATS; (2) OATS for OTC Securities which required OTC equity securities to be reported to OATS; and (3) OATS for NMS which required all NMS stocks to be reported to OATS.'' Id.

      \452\ Id. The SROs note that the calculated ``combined average error rates for the time periods immediately following the OATS release across five significant categories for these three releases'' was used in setting in the initial maximum Error Rate. Id.

      \453\ Id.

      ---------------------------------------------------------------------------

      The Participants, moreover, anticipate reviewing and resetting the maximum Error Rate once Industry Members (excluding Small Industry Members) begin to report to the Central Repository and again once Small Industry Members report to the Central Repository.\454\

      ---------------------------------------------------------------------------

      \454\ Id.

      ---------------------------------------------------------------------------

      The Participants thus propose a phased approach to lowering the maximum Error Rates among CAT Reporters based on the period of time reporting to the Central Repository and whether the CAT Reporters are Participants, large broker-dealers or

      Page 84718

      small broker-dealers.\455\ The Plan sets forth a goal of the following maximum Error Rates \456\ where ``Year(s)'' refers to year(s) after the CAT NMS Plan's date of effectiveness:

      ---------------------------------------------------------------------------

      \455\ Id.

      \456\ Id.

      Table 1--Maximum Error Rates Schedule

      ----------------------------------------------------------------------------------------------------------------

      Three years

      One year (%) Two years (%) (%) Four years (%)

      ----------------------------------------------------------------------------------------------------------------

      Participants.................................... 5 1 1 1

      Large Industry Members.......................... N/A 5 1 1

      Small Industry Members.......................... N/A N/A 5 1

      ----------------------------------------------------------------------------------------------------------------

      The CAT NMS Plan requires the Plan Processor to: (i) Measure and report errors every business day; \457\ (ii) provide CAT Reporters daily statistics and error reports as they become available, including a description of such errors; \458\ (iii) provide monthly reports to CAT Reporters that detail a CAT Reporter's performance and comparison statistics; \459\ (iv) define educational and support programs for CAT Reporters to minimize Error Rates; \460\ and (v) identify, daily, all CAT Reporters exceeding the maximum allowable Error Rate.\461\ To timely correct data-submitted errors to the Central Repository, the Participants require that the Central Repository receive and process error corrections at all times.\462\ Further, the CAT NMS Plan requires that CAT Reporters be able to submit error corrections to the Central Repository through a web-interface or via bulk uploads or file submissions, and that the Plan Processor, subject to the Operating Committee's approval, support the bulk replacement of records and the reprocessing of such records.\463\ The Participants, furthermore, require that the Plan Processor identify CAT Reporter data submission errors based on the Plan Processor's validation processes.\464\

      ---------------------------------------------------------------------------

      \457\ Id. The CAT NMS Plan sets forth that the Plan Processor shall provide the Operating Committee with regular Error Rate reports. Id. at Section 6.1(o)(v). The Error Rate reports shall include each of the following--if the Operating Committee deems them necessary or advisable--``Error Rates by day and by delta over time, and Compliance Thresholds by CAT Reporter, by Reportable Event, by age before resolution, by symbol, by symbol type (e.g., ETF and Index) and by event time (by hour and cumulative on the hour).'' Id.

      \458\ See id. at Appendix C, Section A.3(b).

      \459\ See id.

      \460\ See id. at Appendix D, Section 10.1. The CAT NMS Plan sets forth support programs that shall include educational programs, including FAQs, a dedicated help desk, industry-wide trainings, certifications, industry-wide testing, maintaining Technical Specifications with defined intervals for new releases/updates, emailing CAT Reporter data outliers, conducting annual assessments, using test environments prior to releasing new code to production, and imposing CAT Reporter attendance requirements for testing sessions and educational and industry-wide trainings. Id.

      \461\ See id. at Appendix D, Section 10.4.

      \462\ See id. at Appendix C, Section A.3(b).

      \463\ See id.

      \464\ See id. At a minimum, the processes would include validating the data's file format, CAT Data format, type, consistency, range, logic, validity, completeness, timeliness and linkage. See id. at Appendix D, Section 7.2.

      ---------------------------------------------------------------------------

      20. Retirement of Existing Trade and Order Data Rules and Systems

    13. Duplicative or Partially Duplicative Rules and Systems

      As required by Rule 613(a)(1)(ix),\465\ the CAT NMS Plan provides a plan to eliminate rules and systems that will be rendered duplicative by the CAT.\466\ Under the CAT NMS Plan, each Participant will initiate an analysis of its rules and systems to determine which require information that is duplicative of the information available to the Participants through the Central Repository. The CAT NMS Plan states that each Participant has begun reviewing its rulebook and is waiting for the publication of the final reporting requirements to the Central Repository to complete its analysis. According to the Plan, each Participant should complete its analysis within twelve months after Industry Members (other than Small Industry Members) are required to begin reporting data to the Central Repository (or a later date to be determined by each Participant if sufficient data is not available to complete the analysis in that timeframe).\467\

      ---------------------------------------------------------------------------

      \465\ 17 CFR 242.613(a)(1)(ix).

      \466\ See CAT NMS Plan, supra note 5, at Section 6.7(d); Appendix C, Section C.9.

      \467\ Id. at Appendix C, Section C.9.

      ---------------------------------------------------------------------------

      Similarly, the CAT NMS Plan provides that each Participant will analyze which of its rules and systems require information that is partially duplicative of the information available to the Participants through the Central Repository.\468\ According to the CAT NMS Plan, this analysis should include a determination as to: (i) Whether the Participant should continue to collect the duplicative information available in the Central Repository; (ii) whether the Participant can use the duplicative information made available in the Central Repository without degrading the effectiveness of the Participant's rules or systems; and (iii) whether the Participant should continue to collect the non-duplicative information or, alternatively, whether it should be added to information collected by the Central Repository. The CAT NMS Plan states that each Participant has begun reviewing its rulebook and is waiting for the publication of the final reporting requirements to the Central Repository to complete its analysis. According to the Plan, each Participant should complete this analysis within eighteen months after Industry Members (other than Small Industry Members) are required to begin reporting data to the Central Repository (or a later date to be determined by each Participant if sufficient data is not available to complete the analysis in that timeframe).\469\

      ---------------------------------------------------------------------------

      \468\ Id.

      \469\ Id.

      ---------------------------------------------------------------------------

      The CAT NMS Plan also discusses the elimination of specific trade and order data collection systems that may be duplicative or partially duplicative of CAT.\470\ With respect to FINRA's OATS, the CAT NMS Plan notes that FINRA's ability to retire OATS is dependent on whether the Central Repository contains complete and accurate CAT Data that is sufficient to ensure that FINRA can effectively conduct surveillance and investigations of its members for potential violations of FINRA rules and federal laws and regulations.\471\ Based on an analysis conducted by the Participants, there are 33 data elements currently captured in OATS that are not specified in SEC Rule 613. The Plan notes that the Participants believe it is appropriate to incorporate data elements into the Central Repository that are necessary to retire OATS, and that these additional data elements will increase the likelihood that the Central

      Page 84719

      Repository will include sufficient order information to ensure that FINRA can continue to perform its surveillance with CAT Data rather than OATS data and can more quickly eliminate OATS. However, the Plan notes that OATS cannot be entirely eliminated until all FINRA members who currently report to OATS are reporting to the Central Repository, and that there will likely be some period of dual reporting until FINRA can verify that the data in the Central Repository is of sufficient quality for surveillance purposes and that data reported to the Central Repository meets the Error Rate standards set out in the CAT NMS Plan.\472\ With respect to rules and systems other than OATS, the CAT NMS Plan notes that based on preliminary industry analyses, broker-

      dealer recordkeeping and large trader reporting requirements under SEC Rule 17h-1 could potentially be eliminated. The Plan, however, notes that large trader self-identification and reporting responsibilities on Form 13H appear not be covered by the CAT.\473\

      ---------------------------------------------------------------------------

      \470\ Id.

      \471\ Id.

      \472\ Id.

      \473\ Id.

      ---------------------------------------------------------------------------

      Based on these analyses of duplicative or partially duplicative rules, the CAT NMS Plan provides that each Participant will prepare appropriate rule change filings to implement the rule modifications or deletions that can be made.\474\ The rule change filings should describe the process for phasing out the requirements under the relevant rule. Under the CAT NMS Plan, each Participant will file with the SEC the relevant rule change filing to eliminate or modify its rules within six months of the Participant's determination that such modification or deletion is appropriate.\475\ Similarly, the CAT NMS Plan provides that each Participant will analyze the most appropriate and expeditious timeline and manner for eliminating duplicative and partially duplicative rules and systems. Upon the Commission's approval of relevant rule changes, each Participant will implement this timeline. In developing these timelines, each Participant must consider when the quality of CAT Data will be sufficient to meet the surveillance needs of the Participants (i.e., to sufficiently replace current reporting data) before existing rules and systems can be eliminated.\476\

      ---------------------------------------------------------------------------

      \474\ Id.

      \475\ Id.

      \476\ Id.

      ---------------------------------------------------------------------------

    14. Non-Duplicative Rules and Systems

      The CAT NMS Plan provides that each Participant will conduct an analysis to determine which of its rules and systems related to monitoring quotes, orders, and executions provide information that is not rendered duplicative by the CAT.\477\ Under the CAT NMS Plan, each Participant must analyze: (i) Whether collection of such information remains appropriate; (ii) if still appropriate, whether such information should continue to be separately collected or should instead be incorporated into the consolidated audit trail; and, (iii) if no longer appropriate, how the collection of such information could be efficiently terminated, the steps the Participants would need to take to seek Commission approval for the elimination of such rules and systems, and a timetable for such elimination. Each Participant should complete this analysis within eighteen months after Industry Members (other than Small Industry Members) are required to begin reporting data to the Central Repository (or a later date to be determined by each Participant if sufficient data is not available to complete the analysis in that timeframe).\478\

      ---------------------------------------------------------------------------

      \477\ Id.

      \478\ Id.

      ---------------------------------------------------------------------------

    15. Elimination of SEC Rules

      In addition, to the extent that the Commission eliminates rules that require information that is duplicative of information available through the Central Repository, the CAT NMS Plan provides that each Participant will analyze its rules and systems to determine whether any modifications to such rules or systems are necessary (e.g., to delete references to outdated SEC rules) to support data requests made pursuant to such SEC rules.\479\ Each Participant should complete its analysis within three months after the SEC approves the deletion or modification of an SEC rule related to the information available through the Central Repository. The CAT NMS Plan also provides that Participants will coordinate with the Commission regarding modification of the CAT NMS Plan to include information sufficient to eliminate or modify those Exchange Act rules or systems that the Commission deems appropriate.\480\

      ---------------------------------------------------------------------------

      \479\ Id.

      \480\ Id.

      ---------------------------------------------------------------------------

      21. Regulatory Access

      Under Section 6.5(c) of the CAT NMS Plan and as discussed above, the Plan Processor must provide regulators access to the Central Repository for regulatory and oversight purposes and create a method of accessing CAT Data that includes the ability to run complex searches and generate reports.\481\ Section 6.10(c) requires regulator access by two different methods: (1) An online targeted query tool with predefined selection criteria to choose from; and (2) user-defined direct queries and bulk extractions of data via a query tool or language allowing querying of all available attributes and data sources.\482\ Additional requirements concerning regulator access appear in Section 8 of Appendix D.\483\

      ---------------------------------------------------------------------------

      \481\ Id. at Section 6.5(c). Appendix C provides objective milestones to assess progress concerning regulator access to the Central Repository. See id. at Appendix C, Section C.10(d).

      \482\ Id. at Section 6.10(c). Section 6.10(c) also requires the Plan Processor to reasonably assist regulatory Staff with queries, submit queries on behalf of regulatory Staff as requested, and maintain a help desk to assist regulatory Staff with questions concerning CAT Data. Id.

      \483\ See id. at Appendix D, Section 8.

      ---------------------------------------------------------------------------

      The CAT NMS Plan requires that the CAT must support a minimum of 3,000 regulatory users and at least 600 such users accessing the CAT concurrently without an unacceptable decline in performance.\484\ Moreover, the CAT must support an arbitrary number of user roles and, at a minimum, include defined roles for both basic and advanced regulatory users.\485\

      ---------------------------------------------------------------------------

      \484\ Id. at Appendix D, Section 8.1.

      \485\ Id.

      ---------------------------------------------------------------------------

    16. Online Targeted Query Tool

      Sections 8.1.1, 8.1.2, and 8.1.3 of Appendix D contain further specifications for the online targeted query tool.\486\ The tool must allow for retrieval of processed and/or validated (unlinked) data via an online query screen that includes a choice of a variety of pre-

      defined selection criteria.\487\ Targeted queries must include date(s) and/or time range(s), as well as one or more of a variety of fields listed in Section 8.1.1 (e.g., product type, CAT-Reporter-ID, and Customer-ID).\488\ Targeted queries would be logged such that the Plan Processor could provide monthly reports to the SROs and the SEC concerning metrics on performance and data usage of the search tool.\489\ The CAT NMS Plan further requires that acceptable response times for the targeted search be in increments of less than one minute; for complex queries scanning large volumes of data or large result sets (over one million records) response times must be available within 24 hours of the request; and queries for data within one business date of a 12-month period must return results within

      Page 84720

      three hours regardless of the complexity of criteria.\490\ Under the CAT NMS Plan, regulators may access all CAT Data except for PII data (access to which would be limited to an authorized subset of Participant and Commission employees) and the Plan Processor must work with regulators to implement a process for providing them with access and routinely verifying a list of active users.\491\

      ---------------------------------------------------------------------------

      \486\ Id. at Appendix D, Sections 8.1.1-8.1.3.

      \487\ Id. at Appendix D, Section 8.1.1.

      \488\ Id.

      \489\ Id.

      \490\ Id. at Appendix D, Section 8.1.2. Appendix D, Section 8.1.2 contains further performance requirements applicable to data and the architecture of the online query tool. Id.

      \491\ Id. at Appendix D, Section 8.1.3.

      ---------------------------------------------------------------------------

    17. User-Defined Direct Queries and Bulk Extraction of Data

      Section 8.2 of Appendix D outlines the requirements for user-

      defined direct queries and bulk extraction of data, which regulators would use to obtain large data sets for internal surveillance or market analysis.\492\ Under the CAT NMS Plan, regulators must be able to create, save, and schedule dynamic queries that would run directly against processed and/or unlinked CAT Data.\493\ Additionally, CAT must provide an open application program interface (``API'') that allows use of analytic tools and database drivers to access CAT Data.\494\ Queries submitted through the open API must be auditable and the CAT System must contain the same level of control, monitoring, logging, and reporting as the online targeted query tool.\495\ The Plan Processor must also provide procedures and training to regulators that would use the direct query feature.\496\ Sections 8.2.1 and 8.2.2 of Appendix D contain additional specifications for user-defined direct queries and bulk data extraction, respectively.\497\

      ---------------------------------------------------------------------------

      \492\ Id. at Appendix D, Section 8.2.

      \493\ Id.

      \494\ Id.

      \495\ Id. Direct queries must not return or display PII data but rather display non-PII unique identifiers (e.g., Customer-ID or Firm Designated ID). The PII corresponding to these identifiers could be gathered using the PII workflow described in Appendix D, Data Security, PII Data Requirements. See id. at Appendix D, Section 4.1.6.

      \496\ Id. at Appendix D, Section 8.2.

      \497\ Id. at Appendix D, Sections 8.2.1 and 8.2.2.

      ---------------------------------------------------------------------------

    18. Regulatory Access Schedule

      Section A.2 of Appendix C addresses the time and method by which CAT Data would be available to regulators.\498\ Section A.2(a) requires that data be available to regulators any point after the data enters the Central Repository and passes basic format validations.\499\ After errors are communicated to CAT Reporters on T+1, CAT Reporters would be required to report corrected data back to the Central Repository by 8:00 a.m. ET on T+3.\500\ Regulators must then have access to corrected and linked order and Customer data by 8:00 a.m. ET on T+5.\501\ Section A.2(b) generally describes Bidders' approaches regarding regulator access and use of CAT Data and notes that although the SROs set forth the standards the Plan Processor must meet, they do not endorse any particular approach.\502\ Section A.2(c) outlines requirements the Plan Processor must meet for report building and analysis regarding data usage by regulators, consistent with, and in addition to, the specifications outlined in Section 8 of Appendix D.\503\

      ---------------------------------------------------------------------------

      \498\ Id. at Appendix C, Section A.2.

      \499\ Id. at Appendix C, Section A.2(a). Appendix C, Section A.3(e) indicates this would be no later than noon EST on T+1. Id. at Appendix C, Section A.3(e).

      \500\ Id. at Appendix C, Section A.1(a)(iv); Appendix D, Section 6.1.

      \501\ Id. at Appendix C, Section A.2(a).

      \502\ Id. at Appendix C, Section A.2(b).

      \503\ Id. at Appendix C, Section A.2(c). Appendix C, Section A.2(d) addresses system service level agreements that the SROs and Plan Processor would enter into. Id. at Appendix C, Section A.2(d).

      ---------------------------------------------------------------------------

      22. Upgrades and New Functionalities

      Under Article VI of the CAT NMS Plan, the Plan Processor is responsible for consulting with the Operating Committee and implementing necessary upgrades and new functionalities. In particular, the Plan Processor would be required to, consistent with Appendix D, Upgrade Process and Development of New Functionality, design and implement appropriate policies and procedures governing the determination to develop new functionality for the CAT including, among other requirements, a mechanism by which changes can be suggested by Advisory Committee members, Participants, or the SEC.\504\ The Plan Processor shall, on an ongoing basis and consistent with any applicable policies and procedures, evaluate and implement potential system changes and upgrades to maintain and improve the normal day-to-day operating function of the CAT System.\505\ In consultation with the Operating Committee, the Plan Processor shall, on an as-needed basis and consistent with any applicable operational and escalation policies and procedures, implement such material system changes and upgrades as may be required to ensure effective functioning of the CAT System.\506\ Also in consultation with the Operating Committee, the Plan Processor shall, on an as-needed basis, implement system changes and upgrades to the CAT System to ensure compliance with applicable laws, regulations or rules (including those promulgated by the Commission or any Participant).\507\

      ---------------------------------------------------------------------------

      \504\ Id. at Section 6.1(d)(iv). Such policies and procedures also shall: (A) Provide for the escalation of reviews of proposed technological changes and upgrades (including as required by Section 6.1(i) and Section 6.1(j) or as otherwise appropriate) to the Operating Committee; and (B) address the handling of surveillance, including coordinated, SEC Rule 17d-2 or RSA surveillance queries and requests for data. Id.

      \505\ Id. at Section 6.1(i). Section 11 of Appendix D sets out the obligations of the Plan Processor with respect to the requirements discussed above (e.g., to develop a process to add functionality to CAT, including reviewing suggestions submitted by the Commission). The Plan Processor must create a defined process for developing impact assessments, including implementation timelines for proposed changes, and a mechanism by which functional changes that the Plan Processor wishes to undertake could be reviewed and approved by the Operating Committee. Section 11 further states that the Plan Processor must implement a process to govern changes to CAT (including ``business-as-usual'' changes and isolated infrastructure changes). Further, Section 11 states that the Plan Processor is required to implement a process governing user testing of changes to CAT functionality and infrastructure. See id. at Appendix D, Section 11.

      \506\ Id. at Section 6.1(j).

      \507\ Id. at Section 6.1(k).

      ---------------------------------------------------------------------------

      Appendix D provides additional detail about the obligations of the Plan Processor with respect to CAT Functional Changes, CAT Infrastructure Changes, and Testing of New Changes.\508\ In particular, the Plan Processor is required to propose a process for considering new functions, which must include a mechanism for suggesting changes to the Operating Committee from Advisory Committee members, the Participants and the Commission. The process must also include a method for developing impact assessments, including implementation timelines for proposed changes, and a mechanism by which functional changes that the Plan Processor wishes to undertake could be reviewed and approved by the Operating Committee.\509\

      ---------------------------------------------------------------------------

      \508\ Id. at Appendix D, Section 11.

      \509\ Id. at Appendix D, Section 11.1.

      ---------------------------------------------------------------------------

      The CAT NMS Plan also requires that the Plan Processor develop a similar process to govern the changes to the Central Repository--i.e., business-as-usual changes that could be performed by the Plan Processor with only a summary report to the Operating Committee, and infrastructure changes that would require approval by the Operating Committee.\510\ Finally, a process for user testing of new changes must be developed by the Plan Processor.\511\

      ---------------------------------------------------------------------------

      \510\ Id. at Appendix D, Section 11.2.

      \511\ Id. at Appendix D, Section 11.3.

      ---------------------------------------------------------------------------

      In addition, the CAT NMS Plan requires that the Plan Processor ensure that the Central Repository's technical

      Page 84721

      infrastructure is scalable (to increase capacity to handle increased reporting volumes); adaptable (to support future technology developments so that new requirements could be incorporated); and current (to ensure, through maintenance and upgrades, that technology is kept current, supported, and operational).\512\

      ---------------------------------------------------------------------------

      \512\ See id. at Appendix C, Section A.5(a).

      ---------------------------------------------------------------------------

      23. Business Continuity and Disaster Recovery

      The CAT NMS Plan provides that the Plan Processor must develop disaster recovery and business continuity plans to support the continuation of CAT business operations.\513\ The Plan Processor is required to provide the Operating Committee with regular reports on the CAT System's operation and maintenance that specifically address Participant usage statistics for the Plan Processor and the Central Repository, including capacity planning studies and daily reports called for by Appendix D, as well as business continuity planning and disaster recovery issues for the Plan Processor and the Central Repository, taking into account the business continuity planning and disaster recovery requirements in the Business Continuity Planning/

      Disaster Recovery (``BCP/DR'') Process set forth in Appendix D.\514\

      ---------------------------------------------------------------------------

      \513\ Id. at Appendix D, Sections 5.3-5.4.

      \514\ Id. at Section 6.1(o)(iii).

      ---------------------------------------------------------------------------

      The CAT NMS Plan requires the Business Continuity Plan to address protection of data, service for data submissions, processing, data access, support functions and operations.\515\ Additionally, the Plan Processor must develop a process to manage and report breaches.\516\ A secondary site that is fully equipped for immediate use must be selected to house critical staff necessary for CAT business operations, and planning should consider operational disruption and significant staff unavailability, but the Business Continuity Plan must also establish an effective telecommuting solution for critical staff which must ensure that CAT Data may not be downloaded to equipment that is not CAT-owned or compliant with CAT security requirements.\517\ The Business Continuity Plan will include a bi-annual test of CAT operations from the secondary site, and CAT operations staff must maintain and annually test remote access to ensure smooth operations in case of a ``site un-availability event.'' \518\ The Business Continuity Plan must also identify critical third-party dependencies to be involved in tests on an annual basis, and the Plan Processor will develop and annually test a crisis management plan to be invoked in specified circumstances.\519\ The Plan Processor must also conduct the following: An annual Business Continuity Audit using an Independent Auditor approved by the Operating Committee; and regular third party risk assessments to verify that security controls are in accordance with NIST SP 800-53.\520\ Appendix C mandates the use of a hot-warm structure for disaster recovery, where in the event of a disaster, the software and data would need to be loaded into the backup site for it to become operational.\521\

      ---------------------------------------------------------------------------

      \515\ Id. at Appendix D, Section 5.1.

      \516\ Id. at Appendix D, Section 5.2.

      \517\ Id. at Appendix D, Section 5.3.

      \518\ Id.

      \519\ Id.

      \520\ Id.

      \521\ Id. at Appendix C, Section 12(o). Appendix D, Section 5, provides details on how the CAT's BCP/DR process would be structured. In part, Appendix D states, ``a secondary processing site must be capable of recovery and restoration of services at the secondary site within a minimum of 48 hours, but with the goal of achieving next day recovery after a disaster event. The selection of the secondary site must consider sites with geographic diversity that do not rely on the same utility, telecom and other critical infrastructure services. The processing sites for disaster recovery and business continuity must adhere to the ``Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System.'' Id. at Appendix D, Section 5.1.

      ---------------------------------------------------------------------------

      Appendix D also requires that the Plan Processor provide an industry test environment that is discrete and separate from the production environment, but functionally equivalent to the production environment. The industry test environment must have end-to-end functionality meeting the standards of the production SLA, the performance metrics of the production environment, and management with the same information security policies applicable to the production environment.\522\ The industry test environment must have minimum availability of 24x6, and must support such things as: Testing of technical upgrades by the Plan Processor, testing of CAT code releases impacting CAT Reporters, testing of changes to industry data feeds, industry-wide disaster recovery testing, individual CAT Reporter and Data Submitter testing of their upgrades against CAT interfaces and functionality, and multiple, simultaneous CAT Reporter testing.\523\ The Plan Processor must provide the linkage processing of data submitted during industry-wide testing, as well as support for industry testing.\524\

      ---------------------------------------------------------------------------

      \522\ Id. at Appendix D, Section 1.2.

      \523\ Id.

      \524\ Id.

      ---------------------------------------------------------------------------

      24. Records and Accounting and Dissolution and Termination of the Company

      Article IX of the CAT NMS Plan sets forth the Company's obligations and policies related to books and records, accounting, company funds and tax matters.\525\ The CAT NMS Plan provides that the Company must maintain complete and accurate books and records of the Company in accordance with Rule 17a-1.\526\ The CAT NMS Plan further provides that books and records will be maintained and be made available at the office of the Plan Processor and/or such other Company designated locations.\527\ The CAT NMS Plan specifies that all CAT Data and other Company books and records are the property of the Company (and not the property of the Plan Processor), and to the extent in the possession of the Plan Processor, they will be made available to the Commission upon reasonable request.\528\

      ---------------------------------------------------------------------------

      \525\ Id. at Article IX.

      \526\ 17 CFR 240.17a-1. Upon request, representative copies of books and records maintained under Rule 17a-1 must be furnished to the Commission. 17 CFR 240.17a-1(c); see also CAT NMS Plan, supra note 5, at Section 9.1.

      \527\ See CAT NMS Plan, supra note 5, at Section 9.1.

      \528\ Id.

      ---------------------------------------------------------------------------

      Article IX also includes a confidentiality provision (subject to several express carve-outs) wherein the Receiving Party (the Company or a Participant) must hold in confidence information received from a Disclosing Party (the Company or any other Participant); and the Receiving Party may only disclose such information if prior written approval from the Disclosing Party is obtained.\529\ The confidentiality provision applies to information that is disclosed in connection with the CAT NMS Plan or the CAT System but expressly carves out the following: (i) CAT Data or information otherwise disclosed pursuant to the requirements of Rule 613; \530\ (ii) any information that was already lawfully in the Receiving Party's possession and, to the knowledge of the Receiving Party, free from any confidentiality obligation to the Disclosing Party at the time of receipt from the Disclosing Party; (iii) any information that is, now or in the future,

      Page 84722

      public knowledge; (iv) any information that was lawfully obtained from a third party having the right to disclose it free from any obligation of confidentiality; or (v) any information that was independently developed by the Receiving Party prior to disclosure by a Disclosing Party.\531\ Finally, the CAT NMS Plan provides that the confidentiality provision does not restrict disclosures required by: (i) Applicable laws and regulations, stock market or exchange requirements or the rules of any self-regulatory organization having jurisdiction; (ii) an order, subpoena or legal process; or (iii) for the conduct of any litigation or arbitral proceeding among the Participants (and their respective representatives) and/or the Company.\532\

      ---------------------------------------------------------------------------

      \529\ Id. at Section 9.6. The CAT NMS Plan states that the information is disclosed by or on behalf of the Company or a Participant (the ``Disclosing Party'') to the Company or any other Participant (the ``Receiving Party'') in connection with the Agreement or the CAT System, but excludes any CAT Data or information otherwise disclosed pursuant to the requirements of Rule 613. See CAT NMS Plan, supra note 5, at Section 9.6(a).

      \530\ 17 CFR 242.613.

      \531\ See CAT NMS Plan, supra note 5, at Section 9.6(a).

      \532\ Id.

      ---------------------------------------------------------------------------

      The CAT NMS Plan includes provisions relating to the dissolution of the Company.\533\ Any dissolution of the Company requires SEC approval and must be as a result of one of the following events (a ``Triggering Event''): (i) Unanimous written consent of the Participants; (ii) an event makes it unlawful or impossible for the Company business to be continued; (iii) the termination of one or more Participants such that there is only one remaining Participant; or (iv) a decree of judicial dissolution.\534\ If a Triggering Event has occurred and the SEC approves the Company's dissolution, the Operating Committee would act as liquidating trustee and liquidate and distribute the Company pursuant to the following necessary steps under the CAT NMS Plan: (i) Sell the Company's assets; and (ii) apply and distribute the sale proceeds by first, paying the Company's debts and liabilities; second, establishing reasonably necessary reserves for contingent recourse liabilities and obligations; and third, making a distribution to the Participants in proportion to the balances in their positive Capital Accounts.\535\

      ---------------------------------------------------------------------------

      \533\ Id. at Article X.

      \534\ Id. at Section 10.1.

      \535\ Id. at Section 10.2.

      ---------------------------------------------------------------------------

      25. Security of Data

      The CAT NMS Plan provides that the Plan Processor is responsible for the security and confidentiality of all CAT Data received and reported to the Central Repository, including during all communications between CAT Reporters and the Plan Processor, data extraction, data manipulation and transformation, loading to and from the Central Repository, and data maintenance by the Central Repository.\536\ The Plan Processor must, among other things, require that individuals with access to the Central Repository agree to use CAT Data only for appropriate surveillance and regulatory activities and to employ safeguards to protect the confidentiality of CAT Data.\537\

      ---------------------------------------------------------------------------

      \536\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(i), (iv)(A).

      \537\ Id. at Section 6.5(f)(i)(A).

      ---------------------------------------------------------------------------

      In addition, the Plan Processor must develop a comprehensive information security program as well as a training program that addresses the security and confidentiality of all information accessible from the CAT and the operational risks associated with accessing the Central Repository.\538\ The Plan Processor must also designate one of its employees as CISO; among other things, the CISO is responsible for creating and enforcing appropriate policies, procedures, and control structures regarding data security.\539\ The Technical Specifications, which the Plan Processor must publish, must include a detailed description of the data security standards for CAT.\540\ Appendix D of the CAT NMS Plan sets forth minimum data security requirements for CAT that the Plan Processor must meet.\541\

      ---------------------------------------------------------------------------

      \538\ Id. at Sections 6.1(m), 6.12.

      \539\ Id. at Section 6.2(b)(i), (v).

      \540\ Id. at Section 6.9(b)(xi).

      \541\ Id. at Appendix D, Section 4.

      ---------------------------------------------------------------------------

    19. General Standards

      The CAT NMS Plan provides that the data security standards of the CAT System shall, at a minimum satisfy all applicable regulations regarding database security, including provisions of Reg SCI.\542\ Appendix D of the CAT NMS Plan contains a partial list of industry standards to which the Plan Processor will adhere, including standards issued by the NIST; \543\ by the Federal Financial Institutions Examination Council,\544\ and the International Organization for Standardization.\545\

      ---------------------------------------------------------------------------

      \542\ 17 CFR 242.1000-1007; see also CAT NMS Plan, supra note 5, at Section 6.9(b)(xi).

      \543\ Standards issued by NIST that are explicitly listed in the CAT NMS Plan include NIST Security and Privacy Controls for Federal Information Systems and Organizations (Special Publication 800-53 Rev. 4); NIST Contingency Planning Guide for Federal Information Systems (Special Publication 800-34 Rev. 1), particularly Chapters 3, 4 & 5; NIST Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Test/Evaluated Products (Special Publication 800-23); NIST Technical Guide to Information Security Testing and Assessment (Special Publication 800-115); NIST Guide to Enterprise Password Management (Special Publication 800-118); NIST Recommendation for Cryptographic Key Generation (Special Publication 800-133); and NIST Information Security Continuous Monitoring for Federal Information Systems and Organizations (Special Publication 800-137). See CAT NMS Plan, supra note 5, at Appendix D, Sections 4.2, 5.2 and 5.3.

      \544\ Standards issued by the Federal Financial Institutions Examination Council that are explicitly listed in the CAT NMS Plan include FFIEC Authentication Best Practices, and the Federal Financial Institutions Examination Council, Supplement to Authentication in an Internet Banking Environment (June 22, 2011). See CAT NMS Plan, supra note 5, at Appendix D, Sections 4.1.1, 4.2.

      \545\ Standards issued by the International Organization for Standardization that are explicitly listed in the CAT NMS Plan include ISO/IEC 27001--Information Security Management. See CAT NMS Plan, supra note 5, at Appendix D, Section 4.2. The CAT NMS Plan also states that the CAT System must adhere to the 2003 Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System, Securities Exchange Act Release No. 47638 (April 8, 2003), 68 FR 17809 (April 11, 2003). See CAT NMS Plan, supra note 5, at Appendix D, Section 5.3.

      ---------------------------------------------------------------------------

      The CAT NMS Plan specifies that the Plan Processor is responsible for the security and confidentiality of all CAT Data received and reported to the Central Repository, including during all communications between CAT Reporters and the Plan Processor, data extraction, data manipulation and transformation, loading to and from the Central Repository, and data maintenance by the Central Repository.\546\ The Plan Processor must also designate one of its employees as the CISO; among other things, the CISO is responsible for creating and enforcing appropriate policies, procedures, and control structures regarding data security.\547\

      ---------------------------------------------------------------------------

      \546\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(i), (iv)(A).

      \547\ Id. at Section 6.2(b)(i), (v).

      ---------------------------------------------------------------------------

    20. Data Confidentiality

      The CAT NMS Plan also requires that the Plan Processor must develop a comprehensive information security program, with a dedicated staff for the Central Repository, that employs state of the art technology, which program will be regularly reviewed by the CCO and CISO, as well as a training program that addresses the security and confidentiality of all information accessible from the CAT and the operational risks associated with accessing the Central Repository.\548\ The Plan Processor must also implement and maintain a mechanism to confirm the identity of all individuals permitted to access the CAT Data stored in the Central Repository; maintain a record of all instances where such CAT Data was accessed; and implement and maintain appropriate policies regarding limitations on trading activities of its employees and independent contractors

      Page 84723

      involved with all CAT Data.\549\ The Technical Specifications, which will be published after the Plan Processor is selected, must include a detailed description of the data security standards for the CAT.\550\

      ---------------------------------------------------------------------------

      \548\ Id. at Sections 6.1(m), 6.5(f)(i)(C).

      \549\ Id. at Section 6.5(f)(i)(D), (E).

      \550\ Id. at Section 6.9.

      ---------------------------------------------------------------------------

      According to the CAT NMS Plan, the Plan Processor must require that individuals with access to the Central Repository (including the respective employees and consultants of the Participants and the Plan Processor, but excluding employees and Commissioners of the SEC) to agree: (i) To use appropriate safeguards to ensure the confidentiality of the CAT Data stored in the Central Repository and (ii) to not use CAT Data stored in the Central Repository for purposes other than surveillance and regulation in accordance with such individual's employment duties.\551\ A Participant, however, is permitted to use the CAT Data it reports to the Central Repository for regulatory, surveillance, commercial or other purposes as permitted by applicable law, rule, or regulation.\552\ In addition, the CAT NMS Plan provides that all individuals with access to the Central Repository (including the respective employees and consultants of the Participants and the Plan Processor, but excluding employees and Commissioners of the SEC) must execute a personal ``Safeguard of Information Affidavit'' in a form approved by the Operating Committee providing for personal liability for misuse of data.\553\

      ---------------------------------------------------------------------------

      \551\ Id. at Section 6.5(f)(i)(A).

      \552\ Id.

      \553\ Id. at Section 6.5(f)(i)(B).

      ---------------------------------------------------------------------------

    21. Data Security

      Appendix D of the CAT NMS Plan sets forth minimum data security requirements for CAT that the Plan Processor must meet, including various connectivity, data transfer, and encryption requirements.\554\

      ---------------------------------------------------------------------------

      \554\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.

      ---------------------------------------------------------------------------

      Appendix D states that the CAT Systems must have encrypted internet connectivity, and that CAT Reporters must connect to the CAT infrastructure using secure methods such as private lines or, for smaller broker-dealers, Virtual Private Network connections over public lines.\555\ Remote access to the Central Repository must be limited to authorized Plan Processor Staff and must use secure ``Multi-factor Authentication'' (or ``MFA'') that meets or exceeds Federal Financial Institutions Examination Council security guidelines surrounding authentication best practices.\556\ Appendix D also notes that CAT databases must be deployed within the network infrastructure so that they are not directly accessible from external end-user networks.\557\ If public cloud infrastructures are used, Appendix D states that network segments or private tenant segmentation must be used to isolate CAT Data from unauthenticated public access.\558\

      ---------------------------------------------------------------------------

      \555\ Id. at Appendix D, Section 4.1.1.

      \556\ Id. Multi-factor authentication, or MFA, is a method requiring a person to provide more than one factor (e.g., biometrics/personal information in addition to a password) in order to be validated by the system.). See id. at Appendix C, Section D.12(e), n.250.

      \557\ See id. at Appendix D, Section 4.1.1.

      \558\ Id.

      ---------------------------------------------------------------------------

      Regarding data encryption, Appendix D states that all CAT Data must be encrypted in-flight using industry standard best practices (e.g., SSL/TLS).\559\ Appendix D provides that symmetric key encryption must use a minimum key size of 128 bits or greater (e.g., AES-128), though larger keys are preferable.\560\ Asymmetric key encryption (e.g., PGP) for exchanging data between Data Submitters and the Central Repository is desirable.\561\

      ---------------------------------------------------------------------------

      \559\ Id. at Appendix D, Section 4.1.2.

      \560\ Id.

      \561\ Id.

      ---------------------------------------------------------------------------

      Appendix D further states that CAT Data stored in a public cloud must be encrypted at-rest.\562\ Non-personally identifiable information in CAT Data stored in a Plan Processor private environment is not required to be encrypted at-rest.\563\ If public cloud managed services are used that would inherently have access to the data (e.g., BigQuery, S3, Redshift), then the key management surrounding the encryption of that data must be documented (particularly whether the cloud provider manages the keys, or if the Plan Processor maintains that control).\564\ Auditing and real-time monitoring of the service for when cloud provider personnel are able to access/decrypt CAT Data must be documented, as well as a response plan to address instances where unauthorized access to CAT Data is detected.\565\ Key management/

      rotation/revocation strategies and key chain of custody must also be documented in detail.\566\

      ---------------------------------------------------------------------------

      \562\ Id.

      \563\ Id.

      \564\ Id.

      \565\ Id.

      \566\ Id.

      ---------------------------------------------------------------------------

      Regarding CAT Data storage, the CAT NMS Plan states that data centers housing CAT Systems (whether public or private) must, at a minimum, be SOC 2 certified by an independent third-party auditor.\567\ The frequency of the audit must be at least once per year.\568\ Furthermore, CAT computer infrastructure may not be commingled with other non-regulatory systems (or tenets, in the case of public cloud infrastructure).\569\ Systems hosting the CAT processing for any applications must be segmented from other systems as far as is feasible on a network level (firewalls, security groups, ACL's, VLAN's, authentication proxies/bastion hosts and similar).\570\ In the case of systems using inherently shared infrastructure/storage (e.g., public cloud storage services), an encryption/key management/access control strategy that effectively renders the data private must be documented.\571\

      ---------------------------------------------------------------------------

      \567\ Id. at Appendix D, Section 4.1.3.

      \568\ Id.

      \569\ Id.

      \570\ Id.

      \571\ Id.

      ---------------------------------------------------------------------------

      Appendix D further requires that the Plan Processor must include penetration testing and an application security code audit by a reputable (and named) third party prior to the launch of CAT as well as periodically as defined in the SLAs.\572\ Reports of the audit will be provided to the Operating Committee as well as a remediation plan for identified issues.\573\ The penetration test reviews of the Central Repository's network, firewalls, and development, testing and production systems should help the CAT evaluate the systems' security and resiliency in the face of attempted and successful systems intrusions.\574\

      ---------------------------------------------------------------------------

      \572\ Id.

      \573\ Id.

      \574\ Id.

      ---------------------------------------------------------------------------

      The CAT NMS Plan also addresses issues surrounding access to CAT Data. Among other things, the CAT NMS Plan requires the Plan Processor to provide an overview of how access to PII and other CAT Data by Plan Processor employees and administrators is restricted.\575\ This overview must include items such as, but not limited to, how the Plan Processor will manage access to the systems, internal segmentation, MFA, separation of duties, entitlement management, and background checks.\576\ The Plan Processor must develop and maintain policies and procedures reasonably designed to prevent, detect, and mitigate the impact of unauthorized access or usage of data in the Central Repository.\577\ The CAT NMS Plan also specifically states that a Role Based Access Control (``RBAC'') model must

      Page 84724

      be used to permission users with access to different areas of the CAT System.\578\ The Plan Processor must log every instance of access to Central Repository data by users.\579\ The CAT NMS Plan also has specific provisions related to passwords and logins, particularly as these relate to accessing PII in the Central Repository.\580\ Any login to the system that is able to access PII data must follow non-PII password rules and must be further secured via MFA.\581\

      ---------------------------------------------------------------------------

      \575\ Id. at Appendix D, Section 4.1.4.

      \576\ Id.

      \577\ Id.

      \578\ Id.

      \579\ Id.

      \580\ See id.

      \581\ Id.

      ---------------------------------------------------------------------------

      Appendix D also addresses what should be done in the event there is a breach in the security systems protecting CAT Data. Appendix D requires the Plan Processor to develop policies and procedures governing its responses to systems or data breaches.\582\ Such policies and procedures will include a formal cyber incident response plan, and documentation of all information relevant to breaches.\583\ The cyber incident response plan will provide guidance and direction during security incidents, and the plan will be subject to approval by the Operating Committee.\584\

      ---------------------------------------------------------------------------

      \582\ Id. at Appendix D, Section 4.1.5.

      \583\ Id.

      \584\ Id.

      ---------------------------------------------------------------------------

    22. Data Access and Use

      The CAT NMS Plan states that the Plan Processor shall provide Participants and the Commission with access to and use of the CAT Data stored in the Central Repository solely for the purpose of performing their respective regulatory and oversight responsibilities pursuant to federal securities laws, rules and regulations or any contractual obligations.\585\ The Plan specifies that Participants shall establish, maintain and enforce written policies and procedures reasonably designed to ensure the confidentiality of the CAT Data obtained from the Central Repository and limit the use of CAT Data obtained from the Central Repository to surveillance and regulatory purposes.\586\ The CAT NMS Plan provides that Participants must adopt and enforce policies and procedures that implement effective information barriers between each Participant's regulatory and non-regulatory Staff with regard to CAT Data, permit only persons designated by Participants to have access to the CAT Data stored in the Central Repository; and impose penalties for Staff non-compliance with any of its or the Plan Processor's policies and procedures with respect to information security.\587\ However, the Plan provides that a Participant may use the Raw Data \588\ it reports to the Central Repository for ``commercial or other'' purposes if not prohibited by applicable law, rule or regulation.\589\

      ---------------------------------------------------------------------------

      \585\ See id. at Section 6.5(c)(i).

      \586\ Id. at Section 6.5(g). The Commission notes that regulatory purposes includes, among other things, analysis and reconstruction of market events, market analysis and research to inform policy decisions, market surveillance, examinations, investigations, and other enforcement functions. See Notice, supra note 5, at 30649 n.266.

      \587\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(ii).

      \588\ Raw Data is defined as ``Participant Data and Industry Member Data that has not been through any validation or otherwise checked by the CAT System.'' Id. at Section 1.1.

      \589\ Id. at Section 6.5(h).

      ---------------------------------------------------------------------------

      Article VI of the CAT NMS Plan requires that the Plan Processor provide regulators access to the Central Repository for regulatory and oversight purposes and create a method of accessing CAT Data that includes the ability to run complex searches and generate reports.\590\ Section 6.10(c) of the CAT NMS Plan requires regulator access by two different methods: (i) An online targeted query tool with predefined selection criteria to choose from; and (ii) user-defined direct queries and bulk extractions of data via a query tool or language allowing querying of all available attributes and data sources.\591\ Appendix D contains technical details and parameters for use by the Plan Processor in developing the systems that will allow regulators access to CAT Data.\592\

      ---------------------------------------------------------------------------

      \590\ Id. at Section 6.5(c)(i), (ii). Appendix C provides objective milestones to assess progress concerning regulator access to the Central Repository. See id. at Appendix C, Section C.10(d).

      \591\ Id. at Section 6.10(c)(i). Section 6.10(c) also requires the Plan Processor to reasonably assist regulatory Staff with queries, submit queries on behalf of regulatory Staff as requested, and maintain a help desk to assist regulatory Staff with questions concerning CAT Data. Id. at 6.10(c)(iv)-(vi).

      \592\ See id. at Appendix D, Section 8.

      ---------------------------------------------------------------------------

      Appendix C addresses the time and method by which CAT Data would be available to regulators.\593\ Specifically, Appendix C requires that data be available to regulators any point after the data enters the Central Repository and passes basic format validations.\594\ After errors are communicated to CAT Reporters on a T+1 basis, CAT Reporters would be required to report corrected data back to the Central Repository by 8:00 a.m. ET on T+3.\595\ Regulators must then have access to corrected and linked order and Customer data by 8:00 a.m. ET on T+5.\596\ Appendix C further outlines requirements the Plan Processor must meet for report building and analysis regarding data usage by regulators, consistent with, and in addition to, the specifications outlined in Appendix D.\597\

      ---------------------------------------------------------------------------

      \593\ Id. at Appendix C, Section A.2.

      \594\ Id. at Appendix C, Section A.2(a). Appendix C, Section A.3(e) indicates this would be no later than noon EST on T+1. Id. at Appendix C, Section A.3(e).

      \595\ Id. at Appendix C, Section A.1(a)(iv); Appendix D, Section 6.1.

      \596\ Id. at Appendix C, Section A.2(a).

      \597\ Id. at Appendix C, Section A.2(c). Appendix C, Section A.2(d) addresses system service level agreements that the SROs and Plan Processor would enter into. See id. at Appendix C, Section A.2(d).

      ---------------------------------------------------------------------------

    23. Personally Identifiable Information

      According to the CAT NMS Plan, there are two separate categories of CAT Data for data security and confidentiality purposes: (i) PII; and (ii) other data related to orders and trades reported to the CAT.\598\ The Plan requires additional levels of protection for PII that is collected from Customers and reported to the Central Repository.\599\ For example, the CAT NMS Plan requires that all CAT Data provided to regulators must be encrypted, but that PII data shall be masked unless users have permission to view the CAT Data that has been requested.\600\ The Plan requires that all PII data must be encrypted both at-rest and in-flight, including archival data storage methods such as tape backup.\601\ Storage of unencrypted PII data is prohibited.\602\ The Plan Processor must describe how PII encryption is performed and the key management strategy (e.g., AES-256, 3DES).\603\

      ---------------------------------------------------------------------------

      \598\ See id. at Appendix C, Section A.4.

      \599\ See id. at Appendix C, Section A.4(a).

      \600\ See id. at Section 6.10(c)(ii).

      \601\ Id. at Appendix D, Section 4.1.2

      \602\ Id.

      \603\ Id.

      ---------------------------------------------------------------------------

      An additional protection afforded to PII concerns specific requirements for access. The CAT NMS Plan specifies that by default, users entitled to query CAT Data are not automatically authorized for PII access, and that the process by which a person becomes entitled for PII access, and how they then go about accessing PII data, must be documented by the Plan Processor.\604\ Access to PII will be based on a Role Based Access Control (``RBAC'') model, and shall follow the ``least privileged'' practice of limiting access as much as possible.\605\ In this regard, the CAT NMS Plan states that access will be limited to a ``need-to-know'' basis, and it is expected that the number of people given access to PII

      Page 84725

      associated with Customers and accounts will be much lower than the number granted access to non-PII CAT Data.\606\ The CAT NMS Plan further specifies that any login system that is able to access PII must follow non-PII password rules and must be further secured via MFA.\607\ MFA authentication for all logins (including non-PII) is required to be implemented by the Plan Processor.\608\

      ---------------------------------------------------------------------------

      \604\ Id. at Appendix D, Section 4.1.6.

      \605\ Id.

      \606\ Id. at Appendix C, Section A.4.

      \607\ Id. at Appendix D, Section 4.1.4. MFA is a method requiring a person to provide more than one factor (e.g., biometrics/personal information in addition to a password) in order to be validated by the system. See CAT NMS Plan, supra note 5, at Appendix C, Section D.12(e), n.250.

      \608\ See id. at Appendix D, Section 4.1.4.

      ---------------------------------------------------------------------------

      The CAT NMS Plan also requires that a designated officer or employee at each Participant and the Commission, such as the chief regulatory officer, must, at least annually, review and certify that persons with PII access have appropriately been designated to access PII in light of their respective roles.\609\ The CAT NMS Plan requires that a full audit trail of access to the PII collected at the Central Repository--which would include who accessed what data and when--must be maintained, and that the CCO and CISO shall have access to daily PII reports that list all users who are entitled for PII access, as well as the audit trail of all PII access that has occurred for the day being reported on.\610\

      ---------------------------------------------------------------------------

      \609\ Id. at Appendix D, Section 4.1.6.

      \610\ Id.

      ---------------------------------------------------------------------------

      The CAT NMS Plan also restricts the circumstances under which PII can be provided to an authorized person. The CAT NMS Plan provides, for example, that PII must not be included in the result set(s) from online or direct query tools, reports or bulk data extraction.\611\ Instead, the CAT NMS Plan requires any such results, reports or extractions to be displayed with ``non-PII unique identifiers (e.g., Customer-ID or Firm Designated ID).'' \612\ The CAT NMS Plan states that the PII corresponding to these non-PII identifiers can be gathered by using a separate ``PII workflow.'' \613\

      ---------------------------------------------------------------------------

      \611\ Id.

      \612\ Id.

      \613\ Id.

      ---------------------------------------------------------------------------

      Finally, the CAT NMS Plan further protects PII by requiring that PII data be stored separately from other CAT Data.\614\ The Plan specifies that PII cannot be stored with the transactional CAT Data, and it must not be accessible from public internet connectivity.\615\

      ---------------------------------------------------------------------------

      \614\ Id.

      \615\ Id.

      ---------------------------------------------------------------------------

      26. Governing or Constituent Documents

      Rule 608 requires copies of all governing or constituent documents relating to any person (other than a self-regulatory organization) authorized to implement or administer such plan on behalf of its sponsors.\616\ The Participants will submit to the Commission such documents related to the Plan Processor when the Plan Processor is selected.\617\

      ---------------------------------------------------------------------------

      \616\ 17 CFR 242.608(a)(4)(i).

      \617\ See CAT NMS Plan, supra note 5, at Section 6.7(a)(i).

      ---------------------------------------------------------------------------

      27. Development and Implementation Phases

      The terms of the Plan will be effective immediately upon approval of the Plan by the Commission (the ``Effective Date'').\618\ The Plan sets forth each of the significant phases of development and implementation contemplated by the Plan, together with the projected date of completion of each phase.\619\ These include the following, each of which is subject to orders otherwise by the Commission:

      ---------------------------------------------------------------------------

      \618\ Effective Date is defined as ``the date of approval of the CAT NMS Plan by the Commission.'' Id. at Section 1.1.

      \619\ Id. at Section 6.7, Appendix C, Section C.10.

      Within two months after the Effective Date, the Participants will jointly select the winning Shortlisted Bid and the Plan Processor pursuant to the process set forth in Article V. Following the selection of the Initial Plan Processor, the Participants will file with the Commission a statement identifying the Plan Processor and including the information required by Rule 608;

      Within four months after the Effective Date, each Participant will, and, through its Compliance Rule, will require its Industry Members to, synchronize its or their Business Clocks and certify to the Chief Compliance Officer (in the case of Participants) or the applicable Participant (in the case of Industry Members) that it has met this requirement;

      Within six months after the Effective Date, the Participants must jointly provide to the SEC a document outlining how the Participants could incorporate into the CAT information with respect to equity securities that are not NMS Securities,\620\ including Primary Market Transactions in securities that are not NMS Securities, which document will include details for each order and Reportable Event that may be required to be provided, which market participants may be required to provide the data, the implementation timeline, and a cost estimate;

      ---------------------------------------------------------------------------

      \620\ See id. at Section 6.7(a). In the Amendment to the CAT NMS Plan, Section 6.11 excludes OTC Equity Securities from the document the Participants would submit to the Commission, since the Participants plan to include OTC Equity Securities as well as NMS Securities in the initial phase in of CAT. See Notice, supra note 5, at 30634 n.82.

      ---------------------------------------------------------------------------

      Within one year after the Effective Date, each Participant must report Participant Data to the Central Repository;

      Within fourteen months after the Effective Date, each Participant must implement a new or enhanced surveillance system(s);

      Within two years after the Effective Date, each Participant must, through its Compliance Rule, require its Industry Members (other than Small Industry Members) to report Industry Member Data to the Central Repository; and

      Within three years after the Effective Date, each Participant must, through its Compliance Rule, require its Small Industry Members to provide Industry Member Data to the Central Repository.\621\

      ---------------------------------------------------------------------------

      \621\ See CAT NMS Plan, supra note 5, at Section 6.7(a).

      In addition, Industry Members and Participants will be required to participate in industry testing with the Central Repository on a schedule to be determined by the Operating Committee. Furthermore, Appendix C, A Plan to Eliminate Existing Rules and Systems (Rule 613(a)(1)(ix)), and Appendix D, Data Types and Sources, set forth additional implementation details concerning the elimination of rules and systems.

      The CCO will appropriately document objective milestones to assess progress toward the implementation of the CAT.\622\

      ---------------------------------------------------------------------------

      \622\ See id. at Section 6.7(b).

      ---------------------------------------------------------------------------

      As required by Rule 613(a)(1)(x),\623\ the CAT NMS Plan also sets forth detailed objective milestones, with projected completion dates, towards CAT implementation.\624\ The milestones discussed in the Plan include timeframes for when the Plan Processor will publish Technical Specifications for Participants and Industry Members to report order and market maker quote data and Customer Account Information \625\ to the Central

      Page 84726

      Repository, as well as timeframes for connectivity and acceptance testing for the reporting of this information.\626\ For example, the Plan Processor will publish Technical Specifications for Industry Member submission of order data one year before Industry Members are required to begin submitting this data to the Central Repository, and the Plan Processor will begin connectivity testing and accepting order data from Industry Members for testing purposes six months before Industry Members are required to begin submitting this data to the Central Repository.\627\ The Plan Processor will begin connectivity testing and accepting order and market maker quote data from Participants for testing purposes three months before Participants are required to begin reporting this data to the Central Repository and will publish Technical Specifications for Participant submission of this data six months before Participants are required to submit this data to the Central Repository.\628\ The CAT NMS Plan also includes implementation timeframes for the linkage of the lifecycle of order events, regulator access to the Central Repository, and the integration of other data (such as SIP quote and trade data) into the Central Repository.\629\

      ---------------------------------------------------------------------------

      \623\ 17 CFR 242.613(a)(1)(x).

      \624\ See CAT NMS Plan, supra note 5, at Appendix C, Section C.10. The CAT NMS Plan requires the CCO to document these objective milestones to assess progress toward the implementation of CAT. See id. at Section 6.7(b).

      \625\ ``Customer Account Information'' shall include, but not be limited to, account number, account type, customer type, date account opened, and large trader identifier (if applicable); except, however, that (a) in those circumstances in which an Industry Member has established a trading relationship with an institution but has not established an account with that institution, the Industry Member will (i) provide the Account Effective Date in lieu of the ``date account opened''; (ii) provide the relationship identifier in lieu of the ``account number''; and (iii) identify the ``account type'' as a ``relationship''; (b) in those circumstances in which the relevant account was established prior to the implementation date of the CAT NMS Plan applicable to the relevant CAT Reporter (as set forth in Rule 613(a)(3)(v) and (vi)), and no ``date account opened'' is available for the account, the Industry Member will provide the Account Effective Date in the following circumstances: (i) Where an Industry Member changes back office providers or clearing firms and the date account opened is changed to the date the account was opened on the new back office/clearing firm system; (ii) where an Industry Member acquires another Industry Member and the date account opened is changed to the date the account was opened on the post-merger back office/clearing firm system; (iii) where there are multiple dates associated with an account in an Industry Member's system, and the parameters of each date are determined by the individual Industry Member; and (iv) where the relevant account is an Industry Member proprietary account.'' See id. at Section 1.1.

      \626\ See id. at Appendix C, Section C.10(a)-(b).

      \627\ See id. at Appendix C, Section C.10(b).

      \628\ See id.

      \629\ See id. at Appendix C, Section C.10(c)-(e).

      ---------------------------------------------------------------------------

      28. Written Understanding or Agreements Relating to Interpretation of, or Participation in, the Plan

      The Participants have no written understandings or agreements relating to interpretations of, or participation in, the Plan other than those set forth in the Plan itself.\630\ For example, Section 4.3(a)(iii) states that the Operating Committee only may authorize the interpretation of the Plan by Majority Vote, Section 6.9(c)(i) addresses interpretations of the Technical Specifications, and Section 8.2 addresses the interpretation of Sections 8.1 and 8.2.\631\ In addition, Section 3.3 sets forth how any entity registered as a national securities exchange or national securities association under the Exchange Act may become a Participant.\632\

      ---------------------------------------------------------------------------

      \630\ See Notice, supra note 5, at 30635.

      \631\ See CAT NMS Plan, supra note 5, at Sections 4.3(a)(iii), 6.9(c)(i), 8.2.

      \632\ See id. at Section 3.3.

      ---------------------------------------------------------------------------

      29. Dispute Resolution

      The Plan does not include a general provision addressing the method by which disputes arising in connection with the operation of the Plan will be resolved.\633\ The Plan does, however, provide the means for resolving disputes regarding the Participation Fee.\634\ Specifically, Article III states that, in the event that the Company and a prospective Participant do not agree on the amount of the Participation Fee, such amount will be subject to the review by the Commission pursuant to Section 11A(b)(5) of the Exchange Act.\635\ In addition, the Plan addresses disputes with respect to fees charged to Participants and Industry Members pursuant to Article XI. Specifically, such disputes will be determined by the Operating Committee or a Subcommittee designated by the Operating Committee.\636\ Decisions by the Operating Committee or such designated Subcommittee on such matters will be binding on Participants and Industry Members, without prejudice to the rights of any Participant or Industry Member to seek redress from the Commission pursuant to Rule 608 or in any other appropriate forum.\637\

      ---------------------------------------------------------------------------

      \633\ See Notice, supra note 5, at 30635.

      \634\ See CAT NMS Plan, supra note 5, at Section 3.3(b).

      \635\ See id.; see also 15 U.S.C. 78k-l(b)(5).

      \636\ See CAT NMS Plan, supra note 5, at Section 11.5.

      \637\ Id.

      ---------------------------------------------------------------------------

  12. Discussion and Commission Findings

    In 1975, Congress directed the Commission, through the enactment of Section 11A of the Act,\638\ to facilitate the establishment of a national market system. Section 11A(a)(3)(B) of the Act authorizes the Commission, ``by rule or order, to authorize or require self-regulatory organizations to act jointly with respect to matters as to which they share authority under this title in planning, developing, operating, or regulating a national market system (or a subsystem thereof) or one or more facilities.'' \639\ The Commission adopted Rule 613 of Regulation NMS under the Act,\640\ requiring the SROs to submit an NMS plan to create, implement, and maintain the CAT.\641\

    ---------------------------------------------------------------------------

    \638\ 15 U.S.C. 78k-1.

    \639\ 15 U.S.C. 78k-1(a)(3)(B).

    \640\ See Adopting Release, supra note 14; see also Proposing Release, supra note 14.

    \641\ 17 CFR 242.613(a)(1), (c)(1), (c)(7).

    ---------------------------------------------------------------------------

    Rule 613 tasks the Participants with the responsibility to develop a CAT NMS Plan that achieves the goals set forth by the Commission. Because the Participants will be more directly responsible for the implementation of the CAT NMS Plan, in the Commission's view, it is appropriate that they make the judgment as to how to obtain the benefits of a consolidated audit trail in a way that is practicable and cost-effective in the first instance. The Commission's review of an NMS plan is governed by Rule 608 and, under that rule, approval is conditioned upon a finding that the proposed plan is ``necessary or appropriate in the public interest, for the protection of investors and the maintenance of fair and orderly markets, to remove impediments to, and perfect the mechanism of, a national market system, or otherwise in furtherance of the purposes of the Act.'' \642\ Further, Rule 608 provides the Commission with the authority to approve an NMS plan, ``with such changes or subject to such conditions as the Commission may deem necessary or appropriate.'' \643\ In reviewing the policy choices made by the Participants in developing the CAT NMS Plan, the Commission has sought to ensure that they are supported by an adequate rationale, do not call into question the Plan's satisfaction of the approval standard in Rule 608, and reasonably achieve the benefits of a consolidated audit trail without imposing unnecessary burdens. In addition, because of the evolving nature of the data captured by the CAT and the technology used, as well as the number of decisions still to be made in the process of implementing the CAT NMS Plan, the Commission has paid particular attention to the structures in place to guide decision-making going forward. These include the governance of the Company, the provisions made for Commission and other oversight, the standards established, and the development milestones provided for in the Plan.

    ---------------------------------------------------------------------------

    \642\ 17 CFR 242.608(b)(2); see also 15 U.S.C. 78k-1(a).

    \643\ 17 CFR 242.608(b)(2).

    ---------------------------------------------------------------------------

    The Commission received 24 comment letters on the CAT NMS Plan.\644\ The commenters included, among others, national securities exchanges, technology providers, academics, broker-dealers, investors, and organizations representing industry participants. Of the comment letters received regarding the Plan, 13

    Page 84727

    expressed general support,\645\ 3 comment letters expressed opposition to the Plan,\646\ and 8 comment letters neither supported nor opposed the Plan.\647\ Many of the commenters suggested modifications to certain provisions of the Plan or identified what they believed were deficiencies in the Plan.

    ---------------------------------------------------------------------------

    \644\ See supra note 6.

    \645\ FSR, FSI, MFA, ICI, TR, SIFMA, FIF, Fidelity, UnaVista, CBOE, KCG, and NYSE Letters.

    \646\ Better Markets, Bloomberg, and Data Boiler Letters.

    \647\ Anonymous I, Anonymous II, DAG, STA, DTCC, Hanley, Wachtel, FIX Trading, and Garrett Letters.

    ---------------------------------------------------------------------------

    The most significant areas raised in the comment letters pertained to: (i) The security and confidentiality of CAT Data (especially of PII); (ii) the cost and funding of the CAT; (iii) the timing of the retirement of duplicative regulatory reporting systems; (iv) the implementation time frame; (v) governance (particularly with respect to industry representation); (vi) the clock synchronization standard; (vi) error rates; and (vii) an overall lack of detail in the CAT NMS Plan.

    As discussed in detail below, the Commission has determined to approve the CAT NMS Plan, as amended, pursuant to Section 11A of the Act \648\ and Rule 608.\649\ The Commission believes that the Plan is reasonably designed to improve the completeness, accuracy, accessibility and timeliness of order and execution data used by regulators. The Commission believes that the Plan will facilitate regulators' access to more complete, accurate and timely audit trail data. The Plan will also allow for more efficient and effective surveillance and analysis, which will better enable regulators to detect misconduct, reconstruct market events, and assess potential regulatory changes. As a result, the CAT NMS Plan should significantly improve regulatory efforts by the SROs and the Commission, including market surveillance, market reconstructions, enforcement investigations, and examinations of market participants. The Commission believes that improved regulatory efforts, in turn, will strengthen the integrity and efficiency of the markets, which will enhance investor protection and increase capital formation.

    ---------------------------------------------------------------------------

    \648\ 15 U.S.C. 78k-1.

    \649\ 17 CFR 242.608(b)(2).

    ---------------------------------------------------------------------------

    As noted, commenters raised concerns about, and suggested alternatives to, certain Plan provisions. The Participants submitted five letters which responded to the comments and provided certain suggestions for amendments to the Plan, as discussed in detail below. After considering the proposed Plan, the issues raised by commenters, and the Participants' responses, the Commission has amended certain aspects of the Plan and has determined that the proposed Plan, as amended by the Commission, satisfies the standard of Rule 608. The Commission finds that the CAT NMS Plan is necessary or appropriate in the public interest, for the protection of investors and the maintenance of fair and orderly markets, to remove impediments to, and perfect the mechanism of a national market system, or is otherwise in furtherance of the purposes of the Act.\650\ The Commission does not believe that the remaining concerns identified by commenters individually or collectively call into question the Plan's satisfaction of the approval standard in Rule 608, or otherwise warrant a departure from the policy choices made by the Participants.

    ---------------------------------------------------------------------------

    \650\ See 17 CFR 242.608(b)(2).

    ---------------------------------------------------------------------------

    1. Definitions, Effectiveness of Agreement, and Participation (Articles I, II, and III)

      Article I of the CAT NMS Plan sets forth definitions for certain terms used in the CAT NMS Plan, as well as principles of interpretation. Article II of the CAT NMS Plan describes the corporate structure under which the Participants will build and maintain the CAT, and Article III addresses participation in the Plan, including admission of new Participants, resignation and termination of Participants, and the obligations and liability of Participants.\651\

      ---------------------------------------------------------------------------

      \651\ See Section III.1.; Section III.2., supra.

      ---------------------------------------------------------------------------

      The Commission did not receive any comments relating to Article II or III of the CAT NMS Plan, and is approving them as proposed, with certain technical conforming changes to reflect the Participants' proposal to treat the Company as a non-profit and certain Exchange Act obligations.\652\ The Commission did receive comments on three definitions: \653\ (1) Allocation Report; \654\ (2) Trading Day; \655\ and (3) Eligible Security.\656\

      ---------------------------------------------------------------------------

      \652\ See Sections IV.B and IV.F, infra.

      \653\ The Commission notes that some commenters recommended changing specific provisions in the CAT NMS Plan, which would also result in modifications to certain definitions set forth in Article I (e.g., Error Rate and Primary Market Transaction). The Commission discusses such comments in the Sections below in conjunction with the relevant substantive CAT NMS Plan provisions.

      \654\ TR Letter at 9.

      \655\ FIF Letter at 95-96.

      \656\ Anonymous Letter I at 9.

      ---------------------------------------------------------------------------

      For the definition of Allocation Report,\657\ one commenter stated that ``allocation time is not consistently defined or captured,'' and that without further guidance, CAT Reporters may have difficulties reporting this data element.\658\ The Participants responded to this comment by explaining that the Participants have not yet determined how ``time of the allocation'' will be defined, but indicated that they would address this in the Technical Specifications.\659\

      ---------------------------------------------------------------------------

      \657\ The Plan defines ``Allocation Report'' to mean a report made to the Central Repository by an Industry Member that identifies the Firm Designated ID for any account(s), including subaccount(s), to which executed shares are allocated and provides the security that has been allocated, the identifier of the firm reporting the allocation, the price per share of shares allocated, the side of shares allocated, the number of shares allocated to each account, and the time of the allocation; provided, for the avoidance of doubt, any such Allocation Report shall not be required to be linked to particular orders or executions. See CAT NMS Plan, supra note 5, at Section 1.1.

      \658\ TR Letter at 9.

      \659\ Response Letter I at 25.

      ---------------------------------------------------------------------------

      For the definition of Trading Day,\660\ one commenter stated that the cut-off time for Trading Day is not defined and argued that, consistent with OATS, the cut-off time should be 4:00 p.m., ET.\661\ The commenter argued a later cut-off time would compress the time CAT Reporters have to collect, validate, and report data in a timely manner.\662\ The Participants responded to this comment by explaining that a universal cut-off time for Trading Day is not recommended for the CAT because cut-off times may differ based on the different types of Eligible Securities (including the potential expansion of the security types covered in Eligible Securities). Rather, the Participants stated that the Operating Committee should determine cut-

      off times for the Trading Day and indicated that they would address this in the Technical Specifications.\663\

      ---------------------------------------------------------------------------

      \660\ The Plan states that ``Trading Day'' shall have such meaning as is determined by the Operating Committee. For the avoidance of doubt, the Operating Committee may establish different Trading Days for NMS Stocks (as defined in SEC Rule 600(b)(47), Listed Options, OTC Equity Securities, and any other securities that are included as Eligible Securities from time to time. See CAT NMS Plan, supra note 5, at Section 1.1.

      \661\ FIF Letter at 95-96.

      \662\ Id. at 96, 124.

      \663\ Response Letter I at 31.

      ---------------------------------------------------------------------------

      For the definition of Eligible Security,\664\ one commenter stated that ``a full audit trail would include transactions both on and off

      Page 84728

      exchange.'' \665\ The Participants noted that the CAT will capture on- and off-exchange transactions for NMS Securities and OTC Equity Securities, as the CAT would ``capture orders and transactions in NMS Securities and OTC Equity Securities, even if they occur in ATSs/dark pools, other trading venues or internally within broker-dealers.'' \666\

      ---------------------------------------------------------------------------

      \664\ The CAT NMS Plan provides that ``Eligible Security'' includes (a) all NMS Securities and (b) all OTC Equity Securities. See CAT NMS Plan, supra note 5, at Section 1.1.

      \665\ Anonymous Letter I at 9.

      \666\ Response Letter I at 25.

      ---------------------------------------------------------------------------

      The Commission believes that the definitions and principles of interpretation set forth in Article I of the CAT NMS Plan are reasonably designed to provide clarity to the terms set forth in the CAT NMS Plan. In response to the commenters that recommended modifications to the definitions of Allocation Report and Trading Day, the Commission believes it is reasonable for the Participants to address the Allocation Report and Trading Day specifics raised by commenters in the Technical Specifications to provide the CAT with necessary flexibility during its implementation, and based on the Plan's requirement that the Technical Specifications will be published no later than one year prior to when Industry Member reporting begins.\667\ With respect to Eligible Securities, the Commission believes that the commenter's concern is addressed already in the Plan.

      ---------------------------------------------------------------------------

      \667\ See Section IV.D.8.a, infra.

      ---------------------------------------------------------------------------

      The Commission also notes that the Participants submitted a letter to the Commission indicating that the names of certain Participants had changed and that two new exchanges have been approved by the Commission.\668\ Specifically, the Participants stated that BATS Exchange, Inc. is now known as Bats BZX Exchange, Inc.; BATS Y-

      Exchange, Inc. is now known as Bats BYX Exchange, Inc.; EDGA Exchange, Inc. is now known as Bats EDGA Exchange, Inc.; EDGX Exchange, Inc. is now known as Bats EDGX Exchange, Inc.; NASDAQ OMX BX, Inc. is now known as NASDAQ BX, Inc.; and NASDAQ OMX PHLX LLC is now known as NASDAQ PHLX LLC.\669\ In addition, the Participants stated that two new exchanges were approved by the Commission: ISE Mercury, LLC and Investors' Exchange, LLC.\670\ Thus, the Participants suggested that the Commission amend the Plan to reflect that ISE Mercury, LLC and Investors' Exchange LLC are Participants to the CAT NMS Plan, and to include their names on the signature block for the CAT NMS Plan (including the Plan's appendices).\671\ The Commission believes it is appropriate to amend the CAT NMS Plan to reflect the name changes of certain Participants because this will ensure that the names of those Participants are accurately reflected, and to amend the CAT NMS Plan to add ISE Mercury, LLC and Investors' Exchange, LLC as Participants to the CAT NMS Plan because all SROs are intended to be Participants to the CAT NMS Plan.\672\

      ---------------------------------------------------------------------------

      \668\ Participants' Letter I at 1.

      \669\ Id.

      \670\ Id.

      \671\ Id.

      \672\ See Notice, supra note 5, at 30618.

      ---------------------------------------------------------------------------

    2. Management of the Company (Article IV)

      Article IV of the CAT NMS Plan describes the management structure of CAT NMS, LLC.\673\ Many commenters raised concerns related to the governance structure set forth in the CAT NMS Plan.\674\ Most of the governance comments focused on the role, composition, obligations and powers of the Operating Committee and the Advisory Committee.\675\ A few commenters identified potential conflicts of interest (both with respect to the Officers and the Participants) as well as other governance concerns, including whether the CAT should be under the Commission's direct and sole control.\676\

      ---------------------------------------------------------------------------

      \673\ See Section III.3, supra.

      \674\ FSI Letter at 3; MFA Letter at 3-4; ICI Letter at 10-13; TR Letter at 6-7; SIFMA Letter at 24-29; FIF Letter at 14, 135-37; Fidelity Letter at 6-8; Better Markets Letter at 4-6; KCG Letter at 5-7; DAG Letter at 3; NYSE Letter at 4-6; STA Letter at 1-2.

      \675\ MFA Letter at 3-4; ICI Letter at 10-13; SIFMA Letter at 24-29; KCG Letter at 5-7; DAG Letter at 3; NYSE Letter at 4-6; TR Letter at 6-7; FIF Letter at 14, 135-37; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      \676\ FSI Letter at 3; MFA Letter at 3-4; ICI Letter at 10-13; Better Markets Letter at 4-6.

      ---------------------------------------------------------------------------

      1. Operating Committee

      Article IV of the CAT NMS Plan provides that an Operating Committee will manage the CAT, where each Participant appoints one member of the Operating Committee, and each Participant appointee has one vote.\677\ Article IV also sets forth certain other provisions relating to the Operating Committee, including identification of those actions requiring a Majority Vote, a Supermajority Vote, or a unanimous vote; and the management of conflicts of interest. Commenters raised concerns about the composition, voting and independence of the Operating Committee.

      ---------------------------------------------------------------------------

      \677\ See CAT NMS Plan, supra note 5, at Section 4.2, Appendix C, Section D.11(b).

      ---------------------------------------------------------------------------

      Some commenters argued that the composition of the Operating Committee should not be limited to the SROs,\678\ arguing that non-SROs also should have full voting powers.\679\ Commenters recommended that the Operating Committee should include members who are broker-

      dealers,\680\ and other non-SRO and non-broker-dealer market participants,\681\ institutional investors, broker-dealers with a substantial retail base, broker-dealers with a substantial institutional base, a data management expert, and a federal agency representative with national security cybersecurity experience.\682\ Another commenter recommended including representatives of registered funds as members of the Operating Committee, noting their strong interest in ensuring the security of CAT Data and that CAT Reporter position information and trading strategies not be compromised.\683\ Two commenters argued that no legal authority bars broker-dealers or other non-SROs from serving on the Operating Committee.\684\

      ---------------------------------------------------------------------------

      \678\ MFA Letter at 3-4; ICI Letter at 10-13; SIFMA Letter at 24-26; KCG Letter at 5-7; DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      \679\ SIFMA Letter at 24-26; KCG Letter at 5-7; DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      \680\ SIFMA Letter at 25; MFA Letter at 3; DAG Letter at 3; KCG Letter at 6; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      \681\ KCG Letter at 6; MFA Letter at 3.

      \682\ MFA Letter at 3.

      \683\ ICI Letter at 11. This commenter further noted that registered funds' expertise in protecting trade and order information could help formulate CAT-related data security policies. Id.

      \684\ KCG Letter at 6; ICI Letter at 11.

      ---------------------------------------------------------------------------

      In support of their recommendation to expand the Operating Committee's membership, commenters stressed the need for meaningful input by stakeholders with specific expertise, which they believed would improve the implementation and maintenance of the CAT.\685\ One commenter described the CAT as ``a uniquely complex facility'' \686\ and another commenter described the CAT as ``a critical market utility designed to benefit the national market system and all market participants,'' and stated that as such ``the governance and operation of the CAT NMS Plan should be structured to obtain meaningful input from the broker-dealer community.'' \687\ One of these commenters noted broker-dealers would have complementary ``expertise and insight'' to the SROs, insofar as broker-dealers would be ``providing the

      Page 84729

      lion's share of the reported data to the CAT.'' \688\ This commenter clarified that, in recommending broker-dealer participation on the Operating Committee, the commenter ``does not expect (or request) that broker-dealer representatives would have access to the surveillance patterns and other regulatory means by which the SROs will use the data collected by the CAT.'' \689\

      ---------------------------------------------------------------------------

      \685\ SIFMA Letter at 25; KCG Letter at 7.

      \686\ SIFMA Letter at 25.

      \687\ KCG Letter at 7. KCG suggested that the Advisory Committee alone would have ``almost no voice in the operation of the NMS plan'' based on the feedback regarding the administration and operation of other NMS plans. KCG Letter at 7.

      \688\ SIFMA Letter at 25; see also ICI Letter at 11 (``The perspective of other market participants--particularly given that the central repository will house their sensitive information--would help in the development and maintenance of the CAT.''); MFA Letter at 3 (``The decisions of the Operating Committee, such as those related to data security . . . will have a significant impact on market participants immediately and in the future.''). One commenter further noted that ``the SROs expect the broker-dealers to help fund the costs of the CAT, and they proposed a funding model under which the vast majority of the CAT building and operating costs would be imposed on the broker-dealer firms.'' SIFMA Letter at 25.

      \689\ SIFMA Letter at 25.

      ---------------------------------------------------------------------------

      One commenter described the industry's experience as part of the DAG as informing its belief that full industry participation on the Operating Committee is required.\690\ This commenter stated that ``the SROs limited the Industry's participation in important aspects of the development process'' to an extent that direct engagement with Bidders ``provided a more complete and relevant picture of the proposed CAT solution than had been received through involvement in the DAG.'' \691\ This commenter argued the Operating Committee should include non-SRO industry participants because it would allow them to participate in selecting a Plan Processor and developing the CAT operating procedures.\692\

      ---------------------------------------------------------------------------

      \690\ DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      \691\ DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      \692\ DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      ---------------------------------------------------------------------------

      One commenter recommended that the allocation of voting rights among the Participants be reevaluated, noting that the Commission's Equity Market Structure Advisory Committee (``EMSAC'') provided a similar recommendation regarding plan governance generally.\693\ This commenter also recommended limiting the number of Operating Committee actions that require unanimous voting.\694\

      ---------------------------------------------------------------------------

      \693\ Fidelity Letter at 7. The Commission also notes that although the commenter did not include the EMSAC's rationale for the reallocation of voting rights recommendation, in the EMSAC Recommendations cited by the commenter, the EMSAC explained that it recommended reallocating voting rights because the ``reallocation of voting rights among NMS plan participants is intended to better reflect the proportional interests of NMS plan participants''). See EMSAC, Recommendations Regarding Enhanced Industry Participation in Certain SRO Regulatory Matters (June 10, 2016), available at https://www.sec.gov/spotlight/emsac/emsac-trading-venues-regulation-subcommittee-recomendation-61016.pdf (``EMSAC Recommendations'').

      \694\ Fidelity Letter at 7. This commenter noted that the EMSAC provided this recommendation. The Commission notes that although the commenter did not include the EMSAC's rationale for this recommendation, in the EMSAC Recommendations cited by the commenter, the EMSAC explained that it recommended the limited use of unanimous voting requirements ``to prevent undue friction or delay in plan voting matters.'' See EMSAC Recommendations, supra note 693, at 8.

      ---------------------------------------------------------------------------

      Commenters also recommended that the Operating Committee include ``independent directors.'' \695\ One commenter recommended that these independent directors be both non-industry and non-SRO.\696\ Other commenters argued that the ``CAT governance structure should include independent directors, comprised of both non-industry and industry participants.'' \697\

      ---------------------------------------------------------------------------

      \695\ See Better Markets Letter at 6; DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations); SIFMA Letter at 25 n.4 (noting Rule 613 does not preclude the SROs from including independent directors in the Operating Committee).

      \696\ Better Markets Letter at 6.

      \697\ DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      ---------------------------------------------------------------------------

      In response to comments regarding the composition of the Operating Committee, the Participants argued that the Operating Committee should remain as a committee solely of SROs because only SROs have a statutory obligation under the Exchange Act to create, implement and maintain the CAT and regulate securities markets, whereas broker-dealers do not.\698\ The Participants also identified potential conflicts of interest if the ``subjects of surveillance are involved in decision-

      making of a plan that, at its core has SEC and SRO regulatory surveillance as its primary objective.'' \699\ Finally, the Participants discussed their belief that the Advisory Committee, discussed below, is the appropriate forum for non-Participants to provide their views.\700\

      ---------------------------------------------------------------------------

      \698\ Response Letter I at 6; see also, NYSE Letter at 5.

      \699\ Response Letter I at 6.

      \700\ Id. at 7.

      ---------------------------------------------------------------------------

      In response to comments regarding the allocation of voting rights among the Participants, the Participants explained that each Participant has one vote to permit equal representation among the Participants.\701\ The Participants indicated their commitment to this allocation of voting rights because each Participant independently has obligations with regard to the CAT under Rule 613, and each Participant's regulatory surveillance obligations are not constrained by revenues or market share. The Participants also noted that this voting model is common among other NMS plans.\702\

      ---------------------------------------------------------------------------

      \701\ Id.

      \702\ Id.

      ---------------------------------------------------------------------------

      In response to the commenter suggesting that the CAT NMS Plan should limit the number of provisions requiring a unanimous vote, the Participants highlighted that only three extraordinary circumstances require a unanimous vote under the CAT NMS Plan: (i) Obligating Participants to make a loan or capital contribution to the Company;\703\ (ii) dissolving the Company; \704\ and (iii) acting by written consent in lieu of a meeting.\705\

      ---------------------------------------------------------------------------

      \703\ The Participants explained this would impose an additional and direct financial burden on each Participant, thus each Participant's approval is important. Id. at 8.

      \704\ The Participants explained this would directly impact each Participant's ability to meet its regulatory and compliance requirements, so it is critical that each Participant consent to this action. Id.

      \705\ The Participants explained that this would ensure that all Operating Committee members would have knowledge of, and consider, all actions taken by the Operating Committee if an action by written consent is effected in lieu of a meeting. Id.

      ---------------------------------------------------------------------------

      In response to comments recommending the CAT governance structure include independent directors, the Participants noted that many of the Participants have independent representation on their governing boards, such that each Participant's input regarding the CAT would reflect independent views.\706\

      ---------------------------------------------------------------------------

      \706\ Id. at 7.

      ---------------------------------------------------------------------------

      The Commission notes that the Participants' proposed governance structure--with both an Operating Committee and an Advisory Committee--

      is similar to the governance structure used today by other NMS plans, and the Commission believes that this general structure is reasonably designed to allow the Participants to fulfill their regulatory obligations and, at the same time, provide an opportunity for meaningful input from the industry and other stakeholders.\707\

      Page 84730

      The Commission believes that it is reasonable for the Operating Committee to be composed exclusively of SROs. As the Participants point out, the CAT NMS Plan is the vehicle through which they will fulfill key regulatory and oversight responsibilities. The Commission notes the Participants' statutory obligations as SROs, the opportunity for Advisory Committee input on the CAT NMS Plan decisions, the opportunity for public comment on Plan amendments, and close Commission oversight, when reaching that determination.\708\

      ---------------------------------------------------------------------------

      \707\ See 17 CFR 242.613; see, e.g., Securities Exchange Act Release Nos. 77679 (April 21, 2016), 81 FR 24908 (April 21, 2016) (NMS plan regarding addressing extraordinary market volatility); 75660 (August 11, 2015), 80 FR 48940 (August 14, 2015) (NMS plan regarding the consolidated tape association); 75504 (July 22, 2015), 80 FR 45252 (July 29, 2015) (NMS plan regarding consolidated quotations); 75505 (July 22, 2015), 80 FR 45254 (July 29, 2015) (NMS plan regarding unlisted trading privileges). The Commission believes it is reasonable for the CAT NMS Plan to include a governance structure similar to that utilized by other NMS plans that the Commission previously has found to be consistent with the Act. As noted above, the Commission is separately reviewing the EMSAC recommendations. See supra note 693.

      \708\ For these reasons, the Commission does not believe it is necessary to mandate independent directors in the governance of the CAT.

      ---------------------------------------------------------------------------

      Furthermore, the Commission notes that the current provisions, which allocate voting rights such that each Participant has one vote, is consistent with other NMS plans and recognizes that the obligations imposed by Rule 613 on the SROs are also imposed on each SRO independently. With respect to the limited use of a unanimous voting standard, the Commission believes that the Plan is reasonably designed to facilitate effective governance and notes that only the three extraordinary Operating Committee actions specified above require unanimity, whereas all other Operating Committee actions can be accomplished with either a Majority Vote or Supermajority Vote.

      The Commission notes that Commission Staff may observe all meetings (regular and special), including Executive Sessions, of the Operating Committee and Advisory Committee and receive all minutes.\709\ The Commission anticipates that only a few members of Commission Staff would observe any given meeting.

      ---------------------------------------------------------------------------

      \709\ See Section IV.B.2, infra.

      ---------------------------------------------------------------------------

      The Commission also notes that independent of its review of the CAT NMS Plan, the EMSAC has been reviewing, among other things, the issues surrounding NMS plan governance. On June 10, 2016, the EMSAC presented its recommendations in this area to the Commission.\710\

      ---------------------------------------------------------------------------

      \710\ See supra note 693.

      ---------------------------------------------------------------------------

      Finally, the Commission is amending Section 4.4(b) of the Plan to specify that the Operating Committee's discretion to deviate from the treatment, as set forth therein, of persons submitting a Form 1 application to become a national securities exchange or persons submitting a Form X-15AA-A application to become a national securities association, must be reasonable and not impose any unnecessary or inappropriate burden on competition. The Commission is also amending Section 3.3(b)(v) of the Plan to specify that the Operating Committee's discretion, in considering other factors in determining the Participation Fee of a new Participant, must be reasonable, equitable and not unfairly discriminatory. The Commission believes these amendments are appropriate because they set forth in the CAT NMS Plan specific limitations with respect to the Operating Committee's discretion that are consistent with existing SRO obligations under the Exchange Act.\711\

      ---------------------------------------------------------------------------

      \711\ 15 U.S.C. 78f(b)(4)-(5), (8).

      ---------------------------------------------------------------------------

      2. Advisory Committee

      Article IV of the Plan establishes an Advisory Committee charged with advising the SROs on the implementation, operation, and administration of the Central Repository.\712\ Under the Plan, the Advisory Committee has the right to attend Operating Committee and Subcommittee meetings--unless they are held in Executive Session--and submit its views prior to a decision by the Operating Committee.\713\ As proposed, the composition of the Advisory Committee includes: (i) Broker-dealers of varying sizes and types of business, including a clearing firm, (ii) an individual who maintains a securities account, (iii) an academic, (iv) institutional investors, and (v) the Commission's Chief Technology Officer (or Commission equivalent), who while not formally a member of the Advisory Committee, serves as an observer.\714\

      ---------------------------------------------------------------------------

      \712\ See Section III.3, supra; see also CAT NMS Plan, supra note 5, at Section 4.13(a), (d).

      \713\ See Section III.3, supra; see also CAT NMS Plan, supra note 5, at Section 4.13(d).

      \714\ See Section III.3, supra; see also CAT NMS Plan, supra note 5, at Section 4.13(b).

      ---------------------------------------------------------------------------

      Most comments regarding the Advisory Committee recommended formalizing and expanding its role.\715\ Commenters made the following recommendations: (i) Change the selection process of, and expand the membership of, the Advisory Committee; \716\ (ii) form the Advisory Committee before the CAT NMS Plan is approved; \717\ (iii) formalize procedures for Advisory Committee meetings, including requiring specific documentation and written correspondence; (iv) narrow the use of Operating Committee Executive Sessions, whereby the Advisory Committee is excluded from participating; and (v) adopt in the CAT NMS Plan, the EMSAC's recommendations for NMS plan advisory committees.\718\

      ---------------------------------------------------------------------------

      \715\ DAG Letter at 3; ICI Letter at 10-13; SIFMA Letter at 26-

      29; FIF Letter at 14, 135-37; see also STA Letter at 1-2 (supporting the SIFMA, FIF and DAG Letters' Advisory Committee recommendations); but see NYSE Letter.

      \716\ TR Letter at 6-7; SIFMA Letter at 26-27; FIF Letter at 14, 135-37; see also STA Letter at 2 (supporting the SIFMA and FIF Letters' Advisory Committee recommendations).

      \717\ DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      \718\ SIFMA Letter at 26; ICI Letter at 10-13; see also STA Letter at 1-2 (supporting the SIFMA Letter's Advisory Committee recommendations).

      ---------------------------------------------------------------------------

      One commenter suggested that the process for selecting Advisory Committee members should change to ensure that the Advisory Committee membership is independent of the SROs.\719\ The commenter noted selection of Advisory Committee members independent from the Participants is critical in light of the inherent conflict of interest the Participants face as sponsors and overseers of a Plan that will, at the same time, impose obligations on the very same Participants.\720\ This commenter also recommended that the Advisory Committee members should be selected by broker-dealer representatives--not by the SROs--

      and in support of this position argued that the Advisory Committee's purpose ``should be to represent the interest of the industry and bring to bear the wide expertise of broker-dealers.'' \721\

      ---------------------------------------------------------------------------

      \719\ SIFMA Letter at 27; see also STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations).

      \720\ SIFMA Letter at 27; see also STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations).

      \721\ SIFMA Letter at 27; see also STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations).

      ---------------------------------------------------------------------------

      Those commenters that advocated expanding the membership of the Advisory Committee \722\ suggested including: (i) Trade processing and order management service bureaus; (ii) registered funds; (iii) inter-

      dealer brokers; (iv) agency brokers; (v) retail brokers; (vi) institutional brokers; (vii) proprietary trading firms; (viii) smaller broker-dealers; (ix) firms with a floor presence; (x) and industry/

      trade associations.\723\ One commenter recommended expanding the Advisory Committee to 20 members, with a

      Page 84731

      minimum of 12 broker-dealers.\724\ Another commenter suggested including two financial economists (preferably academic) with expertise in both econometrics and the economics of the primary market and market microstructure.\725\

      ---------------------------------------------------------------------------

      \722\ SIFMA Letter at 27; FIF Letter at 14, 135-37; TR Letter at 6-7 (arguing that a service bureau representative should be added to the Advisory Committee to offer a ``collective perspective'' that comes from supporting multiple clients); ICI Letter at 10-13; see also STA Letter at 1-2 (supporting the SIFMA and FIF Letters' Advisory Committee recommendations).

      \723\ TR Letter at 6; SIFMA Letter at 27; FIF Letter at 135; ICI Letter at 12; see also STA Letter at 2 (supporting the SIFMA and FIF Letters' Advisory Committee recommendations).

      \724\ FIF Letter at 135; see also STA Letter at 2 (supporting the FIF Letter's Advisory Committee recommendations).

      \725\ Hanley Letter at 6.

      ---------------------------------------------------------------------------

      Another commenter recommended forming the Advisory Committee prior to the CAT NMS Plan receiving the Commission's approval to ``allow representative participation in the selection of the Plan Processor and in developing operating procedures.'' \726\

      ---------------------------------------------------------------------------

      \726\ DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's Advisory Committee recommendations).

      ---------------------------------------------------------------------------

      Commenters suggested increasing the governance role of the Advisory Committee, with one commenter advocating that ``the Advisory Committee should be involved in every aspect of the CAT,'' \727\ such as budgets, fees and charges, and new requirements that may significantly burden broker-dealers.\728\

      ---------------------------------------------------------------------------

      \727\ SIFMA Letter at 27; see also ICI Letter at 11; FIF Letter at 14, 135-37; STA Letter at 2 (supporting the FIF and SIFMA Letters' Advisory Committee recommendations).

      \728\ SIFMA Letter at 27; see also STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations).

      ---------------------------------------------------------------------------

      To facilitate increasing the Advisory Committee's role in the CAT's governance, a few commenters offered concrete recommendations for procedural safeguards.\729\ Two commenters suggested that the Operating Committee be required to document a written rationale any time the Operating Committee rejects an Advisory Committee recommendation.\730\ One of these commenters recommended that all documents prepared for or submitted to the Operating Committee by the Plan Processor also be submitted to the Advisory Committee, to keep the Advisory Committee fully informed.\731\ One commenter recommended that agendas and documentation for Operating Committee meetings be distributed to Advisory Committee members in advance of meetings.\732\

      ---------------------------------------------------------------------------

      \729\ SIFMA Letter 27-29; ICI Letter at 10-13; TR Letter at 6-7; see also STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations). These recommendations are similar to the recommendations of the EMSAC.

      \730\ SIFMA Letter at 28; ICI Letter at 13; see also STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations).

      \731\ ICI Letter at 13.

      \732\ SIFMA Letter at 28; see also STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations and noting its concern with the frequency and timeliness of information provided to the Advisory Committee).

      ---------------------------------------------------------------------------

      A commenter also recommended that all information concerning the operation of the Central Repository be made available to the Advisory Committee, except for limited information of a confidential regulatory nature.\733\ This commenter added that when information is deemed to be of a confidential regulatory nature, the SROs should maintain a written record of what is designated confidential (and excluded from the Advisory Committee) and include an explanation of such designation.\734\

      ---------------------------------------------------------------------------

      \733\ SIFMA Letter at 28; ICI Letter at 10-13; see also STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations).

      \734\ SIFMA Letter at 28; see also Fidelity Letter at 7 (noting the ``Operating Committee determines the scope and content of information supplied to the Advisory Committee''); STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations).

      ---------------------------------------------------------------------------

      Two commenters recommended revising the confidentiality policies related to the CAT to permit Advisory Committee members to ``share information from the Advisory Committee meetings with their colleagues and with other industry participants.'' \735\ One commenter further suggested that an Advisory Committee member should be allowed to make other firm personnel available that may have relevant expertise if the Advisory Committee is ``tasked with evaluating issues outside the members' subject matter expertise.'' \736\

      ---------------------------------------------------------------------------

      \735\ SIFMA Letter at 27, 28; DAG Letter at 3; see also STA Letter at 1-2 (supporting the SIFMA and DAG Letters' Advisory Committee recommendations).

      \736\ SIFMA Letter at 27; see also STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations).

      ---------------------------------------------------------------------------

      Two commenters suggested that the Advisory Committee should have a right to review proposed amendments to the CAT NMS Plan that would affect CAT Reporters.\737\ One of these commenters noted that ``it may not be obvious to the Operating Committee when a change to the Plan impacts CAT Reporters in a material way.'' \738\ The other commenter suggested modifying the Plan's definition of a Material Amendment \739\ to distinguish between amendments that are internal or external to the Plan Processor.\740\ This commenter recommended that both internal and external material amendments to the CAT NMS Plan be reviewed by the Advisory Committee, but be designated for different levels of review. This commenter suggested that material amendments that are ``internal'' to the Plan Processor would only be reviewed to ensure that that they do not materially affect CAT Reporters; whereas, amendments that are ``external'' to the Plan Processor would require Advisory Committee consultation and an implementation plan with reasonable time for development and testing.\741\

      ---------------------------------------------------------------------------

      \737\ TR Letter at 7; FIF Letter at 136; see also STA Letter at 2 (supporting the FIF Letter's Advisory Committee recommendations).

      \738\ TR Letter at 7.

      \739\ The CAT NMS Plan defines a ``Material Amendment'' to the Technical Specifications as an amendment that requires ``a Participant or an Industry Member to engage in significant changes to the coding necessary to submit information to the Central Repository pursuant to the LLC Agreement or if it is required to safeguard the security or confidentiality of the CAT Data.'' See CAT NMS Plan, supra note 5, at Section 6.9(c).

      \740\ FIF Letter at 136; see also STA Letter at 2 (supporting the FIF Letter's Advisory Committee recommendations). The commenter references ``external'' material amendments as any change that affects the CAT Reporter Interface, such as coding or configuration changes. ``Internal'' material amendments are changes that do not affect the CAT Reporter interface (i.e., does not require coding or configuration changes).

      \741\ FIF Letter at 136; see also STA Letter at 2 (supporting the FIF Letter's Advisory Committee recommendations).

      ---------------------------------------------------------------------------

      A commenter recommended specific CAT NMS Plan governance changes to expand and clarify the role of the Advisory Committee.\742\ This commenter supported: (i) Clarifying the process for selecting Advisory Committee representatives; (ii) expanding and formalizing the role of the Advisory Committee, such as providing it formal votes on matters before the Operating Committee and the ability to initiate its own recommendations; and (iii) significantly narrowing the use of Executive Sessions for the Operating Committee.\743\ Moreover, a commenter recommended that when the Operating Committee meets in Executive Session, the SROs should maintain a written record including an explanation of why an Executive Session is required.\744\

      ---------------------------------------------------------------------------

      \742\ Fidelity Letter at 7.

      \743\ Id. This commenter noted that the EMSAC provided these recommendations; see also SIFMA Letter at 28; STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations).

      \744\ SIFMA Letter at 28; see also Fidelity Letter at 7 (noting there are ``no limitations on when the Operating Committee can call an Executive Session'' and that the Operating Committee can, for any reason, ``prohibit the Advisory Committee from attending any Executive Session of the Operating Committee by a majority vote''); STA Letter at 2 (supporting the SIFMA Letter's Advisory Committee recommendations).

      ---------------------------------------------------------------------------

      One commenter, an SRO, stated that ``the governance structure in the proposed CAT NMS Plan would establish an appropriate advisory role for the Advisory Committee that is consistent with the requirements specified by the Commission in Rule

      Page 84732

      613.'' \745\ This commenter stressed that while the SROs have a legal obligation under Commission rules to create, implement and maintain a consolidated audit trail and central repository, non-SROs do not have this legal obligation. Accordingly, this commenter stated its belief that Advisory Committee members should not have a voting right with respect to Operating Committee actions.\746\ Finally, this commenter argued that having non-SRO Advisory Committee members vote in connection with the CAT NMS Plan would be incompatible with the requirements of the Exchange Act and Commission rules that squarely place the obligations to implement and enforce ``the CAT NMS Plan on the shoulders of the SROs.'' \747\ In this regard, the commenter highlighted the Rule 613(f) requirement that SROs ``develop and implement a surveillance system, or enhance existing surveillance systems, reasonably designed to make use of the consolidated information contained in the consolidated audit trail.'' \748\

      ---------------------------------------------------------------------------

      \745\ NYSE Letter at 4.

      \746\ Id.

      \747\ Id. at 6.

      \748\ Id.

      ---------------------------------------------------------------------------

      Regarding the size and composition of the Advisory Committee, the Participants recommended amending the Plan to include a service bureau representative, because service bureaus ``perform audit trail reporting on behalf of their customers . . . and would provide a valuable perspective on how the CAT and any enhancements thereto would affect the service bureau clients, which often include a number of small and medium-sized firms.'' \749\ The Participants also recommended augmenting the institutional investor representation on the Advisory Committee by including institutional investor representation by an adviser from registered funds, and increasing from two to three institutional investor representatives with at least one of the institutional investor representatives trading on behalf of an investment company or group of investment companies registered pursuant to the Investment Company Act of 1940.\750\ The Participants also suggested removing references in the Advisory Committee eligibility requirements for those institutional investors ``on behalf of a public entity . . . and on behalf of a private entity,'' which is in response to a comment noting the vagueness of the terms ``public'' and ``private'' with respect to institutional investors.\751\

      ---------------------------------------------------------------------------

      \749\ Response Letter I at 9.

      \750\ Id. at 10.

      \751\ Id.

      ---------------------------------------------------------------------------

      The Participants, however, disagreed with commenters that the academic representative of the Advisory Committee should be limited to a financial economist because a general requirement that ``a member of academia with expertise in the securities industry or any other industry relevant to the operation of the CAT System,'' does not preclude a financial economist serving on the Advisory Committee so long as they have the relevant expertise.\752\ The Participants also disagreed with commenters that members of industry trade groups should also serve on the Advisory Committee, noting that the CAT NMS Plan includes a variety of representatives from the members of such trade groups and would provide ``a meaningful opportunity for the representation of the views of industry trade groups.'' \753\ Furthermore, the Participants disagreed with commenters who advocated increasing the number of broker-dealer representatives on the Advisory Committee from seven to twelve, and increasing the size of the Advisory Committee from twelve to twenty members. The Participants noted that, in ``balancing the goal of having a sufficient cross section of representation with the goal of having a well-run committee,'' seven broker-dealers of varying sizes and business types would provide ``significant opportunity to provide broker-dealers' views'' and increasing an Advisory Committee from twelve to twenty creates a committee structure that would ``likely hamper, rather than facilitate,'' discussion.\754\

      ---------------------------------------------------------------------------

      \752\ Id.

      \753\ Id.

      \754\ Id. at 10-12.

      ---------------------------------------------------------------------------

      In response to commenters recommending a more active and participatory role in operation of the CAT for non-SRO stakeholders, the Participants stated that the Plan strikes an appropriate balance between providing the ``industry with an active role in governance while recognizing the Participants' regulatory obligations with regard to the CAT.'' \755\ In response to a commenter recommending that Advisory Committee members be selected by broker-dealer representatives, the Participants stated their belief that the Operating Committee should select the members, but agreed with commenters that the Advisory Committee should be permitted to advise the Operating Committee regarding potential Advisory Committee members.\756\ The Participants suggested that the CAT NMS Plan be amended to permit the Advisory Committee to advise the Operating Committee on Advisory Committee member selection, provided however, that the Operating Committee in its sole discretion would select members of the Advisory Committee.\757\

      ---------------------------------------------------------------------------

      \755\ Id. at 13-14.

      \756\ Id.

      \757\ Id.

      ---------------------------------------------------------------------------

      In response to comments recommending formalized modes of written communication between the Operating Committee and the Advisory Committee, the Participants recommended that the CAT NMS Plan remain unchanged.\758\ In support, the Participants stated their belief that the proposed structure adequately addresses the commenters' concerns, while recognizing the need for the Participants to have the opportunity to discuss certain matters, particularly certain regulatory and security issues, without the participation of the industry.\759\ The Participants also noted that the Advisory Committee is permitted to attend all of the non-Executive Session Operating Committee meetings, where information concerning the operation of the CAT is received (subject to the Operating Committee's authority to determine the scope and content of information supplied to the Advisory Committee).\760\ Further, the Participants stated that minutes, subject to customary exceptions for confidentiality and privilege considerations, will be provided to the Advisory Committee. Finally, the Participants did not support instituting formalized modes of written communication between the Operating Committee and the Advisory Committee because such ``an overly formulaic approach to Operating Committee interactions'' would ``hamper, rather than enhance, Operating Committee interactions with the Advisory Committee.'' \761\

      ---------------------------------------------------------------------------

      \758\ Id. at 15-16.

      \759\ Id. at 16.

      \760\ Id.

      \761\ Id.

      ---------------------------------------------------------------------------

      With respect to comments recommending narrowing the use of Operating Committee Executive Sessions, the Participants stated their belief that the Operating Committee's capabilities to meet in Executive Session are appropriate and cited the Commission's statement in the Adopting Release that: ``meeting in Executive Session without members of the Advisory Committee appropriately balances the need to provide a mechanism for industry input into the operation of the central repository, against the regulatory imperative that the operations and decisions regarding the consolidated

      Page 84733

      audit trail be made by SROs who have a statutory obligation to regulate the securities markets, rather than by members of the SROs, who have no corresponding statutory obligation to oversee the securities markets.'' \762\ The Participants represented that their intended use of an Executive Session is for limited purposes requiring confidentiality and offered four examples: Matters that present an actual or potential conflict of interest for Advisory Committee members (e.g., relating to member's regulatory compliance); discussion of actual or potential litigation; CAT security issues; and personnel issues. The Participants also noted that Executive Sessions must be called by a Majority Vote and that the meeting minutes are recorded, subject to confidentiality and attorney-client privilege considerations.\763\

      ---------------------------------------------------------------------------

      \762\ Id. at 15.

      \763\ Id.

      ---------------------------------------------------------------------------

      Finally, in response to comments that the Advisory Committee should form before the approval of the CAT NMS Plan, the Participants noted that the Plan itself provides for the establishment of the Operating Committee and the Advisory Committee and thus cannot be formed until the Commission approves the Plan. The Participants also noted that the DAG provides the Participants with ``advice regarding the development of the Plan from an industry perspective.'' \764\

      ---------------------------------------------------------------------------

      \764\ Id. at 16.

      ---------------------------------------------------------------------------

      For reasons discussed below, the Commission finds reasonable the Participants' suggested modifications to add a service bureau representative, increase the number of institutional investor representatives on the Advisory Committee, remove terms that create vagueness for the institutional investor representative categories, and make the applicable conforming changes to Section 4.13 of the Plan. Accordingly, after considering the comments, the Commission is amending Section 4.13 of the Plan to include a service bureau representative, increase the number of institutional investor representatives from two (2) to three (3), and remove the terms that a commenter identified as creating vagueness with respect to the institutional investor category.

      The Commission understands that service bureaus frequently serve a core role in reporting CAT Data on behalf of broker-dealers, and as such, the Commission finds appropriate their inclusion as an Advisory Committee member. Further, the Commission finds the increase from two to three members on the Advisory Committee representing institutional investors, as well as removing the references to ``on behalf of a public entity'' and ``on behalf of a private entity'' due to the vagueness of such terms with respect to institutional investor Advisory Committee members, to be reasonable responses to commenters seeking additional representation and clarity. The Commission also agrees with the Participants that it is reasonable to not mandate inclusion of representatives on the Advisory Committee from industry and trade associations, given the existing substantial industry representation on the Advisory Committee, which is reasonably designed to ensure a wide range of meaningful industry perspectives.

      The Commission agrees with commenters who argued that the academic representative on the Advisory Committee should be a financial economist. The Commission acknowledges the Participants' response that a financial economist is not precluded from serving as the academic representative of the Advisory Committee, but the Commission believes that specifying that the academic representative must be a financial economist is appropriate to ensure the Advisory Committee and the Operating Committee have access to such expertise in assessing the CAT's operations and development. Accordingly, the Commission is amending Section 4.13(b)(ix) of the Plan to specify that the academic representative on the Advisory Committee must be a financial economist.

      The Commission agrees with the Participants' suggestion, in response to commenters, to permit the Advisory Committee to recommend Advisory Committee candidates to the Operating Committee. Accordingly, the Commission is amending Section 4.13(d) of the Plan to permit the Advisory Committee to recommend Advisory Committee candidates to the Operating Committee, but notes that the Operating Committee still maintains the sole discretion to select members of the Advisory Committee.

      The Commission believes the amendment is reasonably designed to ensure a robust selection process for Advisory Committee membership that identifies candidates that best represent the industry perspective. With respect to the comment suggesting that the Advisory Committee be established before the approval of the CAT NMS Plan, the Commission notes it would be premature and technically not possible to establish an advisory committee to an NMS plan before such plan has been approved by the Commission. Moreover, the Commission notes that the interests of the industry and other stakeholders have been represented through the DAG, the public comment process, and through the SROs themselves as the CAT NMS Plan has been developed.

      The Commission is amending the Executive Sessions provision in Section 4.4(a) of the Plan, as well as the Advisory Committee provision in Section 4.13(b) of the Plan related to the Commission's Chief Technology Officer (or equivalent) being an observer of the Advisory Committee. As the Commission is responsible for regulatory oversight of the Participants and the CAT NMS Plan, the Commission believes that it is appropriate for the Plan to expressly provide that Commission Staff may attend all CAT NMS Plan meetings, including those held in Executive Session. Similarly, because the Commission has broad regulatory responsibility for the Plan, the Commission does not believe it is appropriate to limit to the Commission's Chief Technology Officer (or equivalent) the right to serve as an observer at Advisory Committee meetings. Accordingly, the Commission is amending Sections 4.4(a) and 4.13(b) to provide that Commission Staff may attend Executive Sessions, and to permit the Commission to select the Commission representative to observe Advisory Committee meetings. The Commission anticipates that only a few members of Commission Staff would observe any given meeting.

      The Commission also is amending Section 4.13(e) of the Plan in response to comments to provide that the Advisory Committee shall receive the same documents and information concerning the operation of the Central Repository as the Operating Committee. The Operating Committee may, however, withhold such information to the extent it reasonably determines such information requires confidential treatment. Although the Plan as filed permits Advisory Committee members to attend all of the non-Executive Session Operating Committee meetings, with respect to information concerning the operation of the CAT, it allows the Operating Committee broad discretion to determine the scope and content of information supplied to the Advisory Committee. The Commission believes it is important for the Advisory Committee to fulfill its role that its members receive full information on Plan operations (other than confidential information) and that it is therefore appropriate to amend Section 4.13(e) of the Plan accordingly.

      Page 84734

      With respect to the other comments regarding authority, composition and role of the Advisory Committee, as well as the use of the Operating Committee Executive Sessions, the Commission notes that the Plan provisions relating to the Advisory Committee and the Operating Committee Executive Sessions are similar to those in other NMS plans and are, therefore, reasonable.\765\

      ---------------------------------------------------------------------------

      \765\ As previously stated, the Commission believes it is reasonable for the CAT NMS Plan to include a governance structure similar to that utilized by other NMS plans that the Commission previously has found to be consistent with the Act. As with the comments regarding the Operating Committee, some of the suggestions made by commenters regarding the Advisory Committee are mirrored in the EMSAC recommendations. As already discussed, the Commission is separately reviewing these EMSAC recommendations. See supra note 693.

      ---------------------------------------------------------------------------

      3. Officers of the Company

      The CAT NMS Plan requires the Company to appoint a CISO and a CCO, who shall be employees solely of the Plan Processor.\766\ The Plan acknowledges that the CISO and CCO may have fiduciary and other similar duties to the Plan Processor pursuant to their employment with the Plan Processor, and the Plan, as proposed, sets forth that to the extent permitted by law, the CISO and CCO will have no fiduciary or similar duties to the Company.\767\

      ---------------------------------------------------------------------------

      \766\ See Section III.3, supra; see also CAT NMS Plan, supra note 5, at Section 4.6(a).

      \767\ See Section III.3, supra; see also CAT NMS Plan, supra note 5, at Sections 4.6(a), 4.7(c).

      ---------------------------------------------------------------------------

      One commenter expressed concern that appointing a CISO and CCO who would both be officers of the Company and employees of the Plan Processor ``creates a potential conflict of interest that would undermine the ability of these officers to effectively carry out their responsibilities under the CAT NMS Plan because they would owe a fiduciary duty to the Plan Processor rather than to the Company.'' \768\ This commenter recommended that the officers of the Company should be required to act in the best interest of the Company to avoid conflicts of interest in carrying out their oversight activities.\769\ In addition, this commenter suggested that the CAT NMS Plan impose a fiduciary duty on the CISO and CCO, or at a minimum require the Plan Processor to select individuals who do not have a fiduciary duty to the Plan Processor to serve in these roles.\770\

      ---------------------------------------------------------------------------

      \768\ FSI Letter at 3.

      \769\ Id.

      \770\ Id.

      ---------------------------------------------------------------------------

      In response to these comments, the Participants suggested that the CAT NMS Plan be changed so that all Officers of the Company, including the CISO and CCO, have fiduciary duties to the Company in the same manner and extent as an officer of a Delaware corporation.\771\ The Participants also represented that the Operating Committee, in an agreement with the Plan Processor, will have the Plan Processor acknowledge that the Officers of the Company will owe fiduciary duties to the Company, and to the extent that the duties owed to the Company by the Officers of the Company, including the CISO or CCO, conflict with any duties owed to the Plan Processor, the duties to the Company should control.\772\

      ---------------------------------------------------------------------------

      \771\ Response Letter I at 18-19.

      \772\ Id. at 18.

      ---------------------------------------------------------------------------

      The Commission believes that the suggested modifications by the Participants in response to comments about potential conflicts of interest are reasonable. Accordingly, the Commission is amending Section 4.7(c) of the Plan so that each Officer shall have the same fiduciary duties and obligations to the Company as a comparable officer of a Delaware corporation and in all cases shall conduct the business of the Company and execute his or her duties and obligations in good faith and in the manner that the Officer reasonably believes to be in the best interests of the Company. Furthermore, the Commission is amending Section 4.6(a) of the Plan to codify the Participants' representation that that the Operating Committee, in an agreement with the Plan Processor, will have the Plan Processor acknowledge that the Officers of the Company will owe fiduciary duties to the Company, and to the extent that the duties owed to the Company by the Officers of the Company, including the CISO or CCO, conflict with any duties owed to the Plan Processor, the duties to the Company should control.

      The Commission believes that amending the CAT NMS Plan to expressly affirm the Officers' fiduciary duties or similar duties or obligations to the Company provides clarity and assurances that the Officers will act in the best interests of the Company.\773\ The Commission also believes it is reasonable, as the Participants have suggested in their response to comments, to have the Company and the Plan Processor enter into an agreement that specifies not only that Officers have fiduciary duties and obligations to the Company, but that if such Officers may have competing duties and obligations owed to the Company and to the Plan Processor, the duties and obligations to the Company should control. At this time, it is unclear what competing duties and obligations Officers may owe to the Company and the Plan Processor. While in many cases, the Officers' duties towards the Plan Processor and the Company are likely to be aligned, there may be circumstances (e.g., related to the performance of the Plan Processor) where such duties may conflict and the Commission finds reasonable that in such circumstances, the duties to the Company should control in order to mitigate any conflict between the interests of the Plan Processor and those of the Company in administering the CAT. The Commission further notes that the CAT NMS Plan provides reasonable oversight of the Officers by the Operating Committee, for example, the Plan requires: (i) The Operating Committee to approve the CISO and CCO with a Supermajority Vote \774\; (ii) the CISO and CCO to devote, with minor exceptions, their entire working time to serving as the CISO and CCO \775\; (iii) the Operating Committee to oversee that the Plan Processor allocates appropriate resources for the CISO and CCO to fulfill their obligations \776\; (iv) the CISO and CCO to report directly to the Operating Committee with respect to their duties \777\; (v) the compensation of the CISO and CCO to be subject to the Operating Committee's review and approval \778\; and (vi) an annual performance review of the CISO and CCO to be conducted by the Operating Committee.\779\

      ---------------------------------------------------------------------------

      \773\ While the SROs expressly waive fiduciary obligations to the Company, the SROs are subject to statutory obligations to regulate the securities markets and to create, implement and maintain the CAT.

      \774\ See CAT NMS Plan, supra note 5, at Section 6.2(a)(i), (b)(i).

      \775\ See id. at Section 6.2(a)(i), (b)(i).

      \776\ See id. at Section 6.2(a)(ii), (b)(ii).

      \777\ See id. at Section 6.2(a)(iii), (b)(iii).

      \778\ See id. at Section 6.2(a)(iv), (b)(iv).

      \779\ See id. at Section 6.2(a)(iv), (b)(iv).

      ---------------------------------------------------------------------------

      4. Additional Governance Provisions

      Commenters raised additional governance concerns related to conflicts of interest for the Participants, whether there should be an audit committee, and whether the Participants should be required to coordinate the administration of the CAT from a legal, administrative, supervisory and enforcement perspective.\780\

      ---------------------------------------------------------------------------

      \780\ See SIFMA Letter at 27, 29; ICI Letter at 12; Better Markets Letter at 5-6; DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      ---------------------------------------------------------------------------

      Some commenters expressed concern that the Participants would have a conflict of interest because of the various roles they perform with respect

      Page 84735

      to the CAT. One commenter stated that the Participants are ``sponsors and overseers of the Plan, while at the same time, the Plan will impose obligations on them.'' \781\ Another commenter raised concerns that the Participants would ``control the Operating Committee for the Plan, use CAT Data for regulatory purposes, and potentially commercialize the information that they report to the CAT.'' \782\ This commenter suggested that these roles may ``present conflicting incentives'' for Participants.\783\

      ---------------------------------------------------------------------------

      \781\ SIFMA Letter at 27.

      \782\ ICI Letter at 12.

      \783\ Id.

      ---------------------------------------------------------------------------

      One commenter argued that the Participants should not oversee and control the CAT and recommended instead that the Commission should build and host the CAT, which would then be under the Commission's direct and sole control.\784\ In support of this view, the commenter stated the Commission's statutory mission to protect investors would make it better positioned to operate the CAT, as compared to for-profit SROs, who would seek to maximize profits from the CAT Data.\785\ The commenter suggested that the Commission could outsource the building of the CAT and fund the CAT similar to how it funds its EDGAR system.\786\ The commenter stated that CAT NMS, LLC should reorganize as a not-for-

      profit entity and set forth an organizational purpose aligned with the Commission's mission statement.\787\ Finally, the commenter argued that the Commission solely should control access to and usage of the CAT System.\788\

      ---------------------------------------------------------------------------

      \784\ Better Markets Letter at 5.

      \785\ Id. at 5-6.

      \786\ Id. at 6.

      \787\ Id. The commenter recommended that the board of directors of such entity contain a super-majority of independent directors to oversee the not-for-profit CAT NMS, LLC, and that the chair of the board of directors should be non-industry and appointed by the Commission. Further, the commenter recommended that the Director of the Division of Trading and Markets permanently serve as the vice-

      chair of the board of directors. Better Markets Letter at 6; see also DAG Letter at 3 (arguing that the CAT corporate governance structure should have independent directors comprised of both non-

      industry and industry participants); STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      \788\ Better Markets Letter at 6.

      ---------------------------------------------------------------------------

      Two commenters recommended that the Company governance structure include an audit committee.\789\ One commenter noted that the audit committee should be comprised of mostly independent directors.\790\ Another commenter stated the audit committee should be responsible for the oversight of how the CAT's revenue sources are used for regulatory purposes, and that the costs and financing of the CAT must be fully transparent and publicly disclosed in annual reports, including audited financial statements.\791\

      ---------------------------------------------------------------------------

      \789\ SIFMA Letter at 29; DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations).

      \790\ DAG Letter at 3; see also STA Letter at 1 (supporting the DAG Letter's governance recommendations). The Commission notes that the commenter specified in its comment that their definition of independent director includes industry participants (i.e., broker-

      dealers). See DAG Letter at 3.

      \791\ SIFMA Letter at 29.

      ---------------------------------------------------------------------------

      Finally, one commenter suggested that the SROs should coordinate the administration of the CAT through a single centralized body from a legal, administrative, supervisory and enforcement perspective.\792\ The commenter recommended amending the Plan to require this coordination, and suggested that such coordination could be facilitated through agreements under SEC Rule 17d-2, regulatory service agreements or some combination thereof.\793\ In support of this view, the commenter noted that different CAT-related compliance requirements among the SROs might arise and subject firms to duplicative regulation and enforcement, with the accompanying inefficiencies, additional costs, and potential inconsistencies.\794\

      ---------------------------------------------------------------------------

      \792\ Id.

      \793\ Id.

      \794\ Id.

      ---------------------------------------------------------------------------

      In response to commenters suggesting the formation of an audit committee, the Participants stated that they would have the ability to review CAT-related issues objectively because ``members of the Operating Committee are not employed by the Company and are fulfilling mandated regulatory oversight responsibilities, and that the Company will not operate as a profit-making company, which may need more scrutiny as compared to a company that is operating on a break-

      even basis.'' \795\ Further, the Participants noted that the CAT NMS Plan requires that a Compliance Subcommittee be established--and noted that the Operating Committee in the future could decide if an audit committee should be formed as a subcommittee.\796\

      ---------------------------------------------------------------------------

      \795\ Response Letter I at 8.

      \796\ Id. at 9.

      ---------------------------------------------------------------------------

      In response to commenters regarding the coordinated compliance and enforcement oversight of the CAT, the Participants acknowledged the benefits of having a single Participant be responsible for enforcing compliance with Rule 613 and the CAT NMS Plan through Rule 17d-2 agreements, regulatory services agreements or some other approach and represented that they would consider such an arrangement after the CAT NMS Plan's approval.\797\ As discussed in Section IV.H, the Commission is amending Section 6.6 of the Plan to require that the Participants provide the Commission within 12 months of effectiveness of the Plan, a report detailing the Participants' consideration of coordinated surveillance (e.g., entering into 17d-2 agreements or regulatory services agreements).\798\

      ---------------------------------------------------------------------------

      \797\ Id. at 17.

      \798\ See Section IV.H., supra.

      ---------------------------------------------------------------------------

      The Commission acknowledges the commenters' concern about the conflicts inherent in having SROs performing various roles as overseers of the Plan and at the same time enforcing compliance with Rule 613. The Commission, however, highlights that the Participants are performing roles specified pursuant to obligations under the Exchange Act and the rules thereunder and remain under the direct oversight of the Commission. With respect to comments expressing concerns that the Participants may be in a position to commercialize the respective Raw Data reported by each SRO submitting to the CAT, order and execution information is already collected by SROs from its members and they are permitted under current law to commercialize this data (e.g., direct market feeds, provided that the terms are fair and reasonable and not unreasonably discriminatory \799\) subject to appropriate rule filings and oversight by the Commission.\800\ Thus, the Plan does not expand the Participants' ability to commercialize their Raw Data beyond what is currently permitted.

      ---------------------------------------------------------------------------

      \799\ 17 CFR 242.603.

      \800\ See, e.g., Securities Exchange Act Release Nos. 73918 (December 23, 2014), 79 FR 78920 (December 31, 2014) (BATS One Feed); 74128 (January 23, 2015), 80 FR 4951 (January 29, 2015) (NYSE Integrated Feed).

      ---------------------------------------------------------------------------

      With respect to comments that suggested that the Participants should not oversee and control the CAT, but that instead it should be under the Commission's direct and sole control, the Commission notes that in the Adopting Release, the Commission mandated that the Participants develop an NMS plan for the development and operation of the CAT. As such, the CAT NMS Plan, as noticed, whereby the Participants directly manage the CAT, was in furtherance of Rule 613 as adopted. Additionally, because the Participants, as SROs, currently serve as front-line regulators of many aspects of the securities markets, including

      Page 84736

      administering the existing sources of regulatory data, the Commission believes they are well positioned to oversee the CAT. Moreover, the Commission believes that any potential conflicts arising from the status of certain Participants as for profit enterprises are reasonably addressed through the Plan provisions and Commission oversight.

      The Commission concurs with the Participants that it is reasonable for the Company not to have an audit committee at this time. Further, the Participants are permitted to form an audit committee, as a subcommittee of the Operating Committee. The Commission notes that the absence of a requirement for an audit committee is consistent with other NMS plans.

      Section 9.2(a) of the Plan states that the Operating Committee shall maintain a system of accounting for the Company established and administered in accordance with GAAP (or another standard if determined appropriate by the Operating Committee). Section 9.2(a) also requires, among other things, that the Company prepare and provide to each Participant an audited balance sheet, income statement and statement of cash flow, to the extent the Operating Committee deems advisable. In addition, Section 9.2(c) of the Plan states that all matters concerning accounting procedures shall be determined by the Operating Committee. The Participants recommended that the Commission amend Section 9.2(a) to eliminate the flexibility for the Company to administer a system of accounting in accordance with non-GAAP standards, thus requiring that all financial statements or information that may be supplied to the Participants shall be prepared in accordance with GAAP.\801\ In addition, the Participants recommended amending the Plan to eliminate the discretion of the Operating Committee to provide financials only if it deems advisable and instead to require that the Company's audited annual balance sheet, income statement, and statement of cash flows be audited by an independent public accounting firm and made publicly available.\802\ The Commission believes that the changes recommended by the Participants are reasonable because they will promote greater accuracy and transparency with respect to the Company's financial accounting and is therefore amending the Plan accordingly.

      ---------------------------------------------------------------------------

      \801\ Participants' Letter II at 2.

      \802\ Participants' Letter II at 2.

      ---------------------------------------------------------------------------

      Section 6.1(o)(vi) of the Plan states that financial statements of the Plan Processor, prepared in accordance with GAAP and audited by an independent public accounting firm or certified by the Plan Processor's Chief Financial Officer, shall be provided to the Operating Committee no later than 90 days after the Plan Processor's fiscal year end. The Participants recommended that the Commission amend the Plan to change this timeframe to 180 days after the Plan Processor's fiscal year end to provide further flexibility to the Plan Processor with respect to the preparation of its financial statements.\803\ The Commission believes that it is reasonable to provide this additional flexibility and is therefore amending the Plan accordingly.

      ---------------------------------------------------------------------------

      \803\ Participants' Letter II at 1.

      ---------------------------------------------------------------------------

      The Commission also agrees with the commenters and Participants that a coordinated approach to self-regulatory oversight may have benefits, such as regulatory efficiencies and consistency, but believes that it is reasonable for such an arrangement to be considered by the Participants after the CAT NMS Plan's approval rather than mandating a specific approach for SRO coordination under the Plan at this time--as the Plan Processor has not been selected nor has the CAT System been developed. The Commission nevertheless notes that, as described above, it is amending the CAT NMS Plan to require a written assessment by the Participants within 12 months of effectiveness of the Plan, considering coordinated surveillance (e.g., entering into Rule 17d-2 agreements, regulatory services agreements or other arrangements, to facilitate regulatory coordination).\804\

      ---------------------------------------------------------------------------

      \804\ See Section IV.H, infra.

      ---------------------------------------------------------------------------

      Finally, the Commission notes that the CAT NMS Plan provides that books and records of the CAT LLC shall be made available to the Commission upon ``reasonable request.'' \805\ Because the CAT LLC is a facility of the Participants, the Commission has the right to the books and records of CAT LLC ``upon request'' under Exchange Act Rule 17a-

      1,\806\ and therefore is amending Section 9.1 of the Plan to delete the requirement that any request for the CAT LLC's books and records be ``reasonable.''

      ---------------------------------------------------------------------------

      \805\ See CAT NMS Plan, supra note 5, at Section 9.1.

      \806\ 17 CFR 240.17a-1(c).

      ---------------------------------------------------------------------------

    3. Plan Processor Selection (Article V)

      Article V of the CAT NMS Plan sets forth the process for selecting the Plan Processor following approval of the CAT NMS Plan.\807\ The Plan Processor selection provisions in Article V are identical to the selection process set forth in the Selection Plan.\808\

      ---------------------------------------------------------------------------

      \807\ See Section III.4, supra, for a more detailed description of the Selection Plan.

      \808\ See Selection Plan, supra note 23.

      ---------------------------------------------------------------------------

      The Commission received three comments suggesting that the Plan Processor selection process be accelerated,\809\ with some commenters suggesting that the Selection Plan be amended to require the selection of the Plan Processor prior to the approval of the CAT NMS Plan.\810\ According to one commenter, the earlier selection of a Plan Processor would advance the release and development of the Technical Specifications.\811\ Another commenter offered support for a specific Bidder, noting their regulatory and technical competencies.\812\ One commenter recommended that the Commission re-open the Plan Processor's agreement with CAT NMS, LLC every five years to ensure that the Plan remains state-of-the-art, and to provide a process for public input.\813\ Another commenter stated that the Plan does not set forth sufficient incentives for the Plan Processor and the Participants to incorporate new technology into or to continuously innovate and strive to reduce the costs of the CAT System.\814\

      ---------------------------------------------------------------------------

      \809\ FSR Letter at 10; TR Letter at 4-5; FIF Letter at 42-43.

      \810\ TR Letter at 4-5; FIF Letter at 42-43.

      \811\ TR Letter at 4-5; see also Section V.G.4, infra, for a further discussion of these comment letters.

      \812\ Anonymous Letter I at 1 (advocating for FINRA's regulatory abilities related to OATS); but see Anonymous Letter II (criticizing FINRA's handling of OATS non-compliance).

      \813\ Better Markets Letter at 7.

      \814\ Data Boiler Letter at 17, 27.

      ---------------------------------------------------------------------------

      In response to the comments to accelerate the Plan Processor selection process, the Participants acknowledged that the selection of the Plan Processor will likely affect implementation issues and related costs,\815\ but that it is not feasible to accelerate the selection of the Plan Processor prior to the Commission's approval of the Plan. The Participants noted that until the Plan is finalized and approved by the Commission, the requirements of the CAT could change, which could impact the selection of the Plan Processor.\816\ Moreover, the Participants noted that Rule 613's requirement that the Plan Processor be selected within two months after effectiveness of the Plan ensures that the selection of the Plan

      Page 84737

      Processor will occur expeditiously once the Commission approves the Plan.\817\

      ---------------------------------------------------------------------------

      \815\ Response Letter I at 51.

      \816\ The Participants note in Response Letter I that the Selection Plan contemplates the selection of the Plan Processor after the approval of the Plan. Id. at 52.

      \817\ 17 CFR 242.613(a)(3)(i).

      ---------------------------------------------------------------------------

      In response to the comment in support for a specific Bidder, the Participants stated that they determined that utilizing a competitive bidding process to select the Plan Processor was the most appropriate way to promote an innovative and efficient CAT solution.\818\ Pursuant to that process, the Participants noted that they have reduced the number of Bidders to three Shortlisted Bidders.

      ---------------------------------------------------------------------------

      \818\ Response Letter I at 52.

      ---------------------------------------------------------------------------

      In response to the comment to re-open the Plan Processor's agreement with the CAT LLC every five years and to provide a process for public input on the agreement, the Participants stated that they agree that it is important to ensure that the CAT solution remains effective and efficient going forward.\819\ Accordingly, the Participants noted that they have proposed a process for regularly reviewing the performance of the Plan Processor throughout the term of the Plan Processor's agreement and for modifying it if necessary to avoid an outdated CAT solution. The Participants added that, as set forth in the Plan, the Operating Committee will review the Plan Processor's performance under the Plan at least once each year, or more often than once each year upon the request of two or more Participants that are not Affiliated Participants.\820\ In addition, the Participants noted that the Plan sets forth the process for removing the Plan Processor. Specifically, the Participants noted that the Operating Committee, by Supermajority Vote, may remove the Plan Processor from such position at any time, and that the Operating Committee may, by Majority Vote, remove the Plan Processor from such position at any time if it determines that the Plan Processor has failed to perform its functions in a reasonably acceptable manner in accordance with the provisions of the Plan. The Participants stated that if they were to vote to remove the Plan Processor, the Operating Committee would select a new Plan Processor through a competitive bidding process.

      ---------------------------------------------------------------------------

      \819\ Id.

      \820\ See supra note 67 for a definition of ``Affiliated Participants.''

      ---------------------------------------------------------------------------

      In approving the Selection Plan, the Commission stated that the Selection Plan is reasonably designed to achieve its objective of facilitating the development of the CAT NMS Plan and the selection of the Plan Processor.\821\ The Commission also found that the Selection Plan is reasonably designed to govern the process by which the SROs will formulate and submit the CAT NMS Plan, including the review, evaluation, and narrowing down of Bids in response to the RFP, and ultimately choosing the Plan Processor that will build, operate, and maintain the consolidated audit trail.\822\ The Commission believes that the process set out in the Selection Plan for selecting a Plan Processor remains a reasonable approach, which will facilitate the selection of Plan Processor through a fair, transparent and competitive process and that no modifications to the Selection Plan are required to meet the approval standard. In response to the commenters recommending that the Plan Processor selection process be accelerated, the Commission agrees with the Participants that changes to the CAT NMS Plan that are being made in this Order may be relevant to the selection of the Plan Processor. The Commission believes that selecting the Plan Processor within two months of Plan approval, rather than prior to Plan approval, will allow the remaining Bidders to consider the CAT NMS Plan, as amended and approved by the Commission, and to make any necessary modifications to their Bids, which will enable the Participants to make a more fully informed decision on the Plan Processor in light of the amended and approved CAT NMS Plan.\823\ The Commission believes this timeframe to select the Plan Processor--two months following Commission approval of the Plan--will not result in the untimely release of the Technical Specifications.

      ---------------------------------------------------------------------------

      \821\ See Selection Plan Approval Order, supra note 23.

      \822\ See id.

      \823\ In addition, the Commission notes that, pursuant to an amendment to the Selection Plan, the Participants have already narrowed the Bidders to three Shortlisted Bidders, which will facilitate the timely completion of the Plan Processor selection process. See Selection Plan, supra note 23.

      ---------------------------------------------------------------------------

      In response to the comment that offered support for a specific Bidder, the Commission agrees with the Participants that the competitive bidding process to select the Plan Processor is a reasonable and effective way to choose a Plan Processor and thus believes that the process set forth in the Selection Plan should be permitted to continue. In response to the commenter that recommended that the Commission re-open the Plan Processor's agreement with the CAT LLC every five years and provide a process for public input on the agreement, the Commission believes that the CAT NMS Plan already contains provisions that permit the reevaluation--and possible replacement--of the Plan Processor. Thus, the Commission is not amending the plan to require that the Plan Processor's agreement with the CAT LLC be reevaluated every five years.

      Finally, in response to the commenter that stated that the Plan does not provide sufficient incentives for the Plan Processor and the Participants to incorporate new technology, innovate and reduce the costs of the CAT System, the Commission believes that requirements for regular evaluations of the operation of the CAT, the identification of potential improvements, and the delivery of a written assessment to the Commission, as well as the Plan's provisions regarding the possible removal of the Plan Processor provide sufficient incentives for the Plan Processor and the Participants in these areas.\824\

      ---------------------------------------------------------------------------

      \824\ See CAT NMS Plan, supra note 5, at Section 4.3(b)(ii) (providing that the Operating Committee may terminate the Plan Processor without cause).

      ---------------------------------------------------------------------------

    4. Functions and Activities of the CAT System (Article VI)

      Article VI of the CAT NMS Plan sets forth the functions and activities of the CAT System.\825\

      ---------------------------------------------------------------------------

      \825\ See Section IV.B., supra.

      ---------------------------------------------------------------------------

      1. Data Recording and Reporting Requirements

      Article VI of the Plan imposes requirements regarding what data elements must be reported to the Central Repository and by when. The Commission received comments regarding to whom these requirements should apply and the appropriateness of the provisions.

      One commenter recommended that firms using manual orders that are currently exempt from OATS reporting pursuant to FINRA Rule 7470 should also be exempt from the CAT reporting obligations.\826\ This commenter argued that to qualify for such an exemption, a firm would need to ``eliminate many practices of regulatory concern'' and have a ``perfect regulatory history,'' and that the exemption would have little impact on the CAT because it would exclude only the reporting of events that take place prior to delivery of an order to a market venue. The commenter argued that the exemption is necessary to keep currently-

      exempt firms in business due to the high costs that CAT reporting would impose.\827\ This commenter further argued that the requested exemption for OATS-exempt firms would not be the same as an exemption for ``small firms,'' and that wrongdoers would not fall within this exemption because of the limitations on the level of market activity, the

      Page 84738

      voluntary restrictions from operations such as market making and trading with customers, the use of manual orders, and the expected high levels of compliance.\828\

      ---------------------------------------------------------------------------

      \826\ Wachtel Letter at 1-2.

      \827\ Id.

      \828\ Id.

      ---------------------------------------------------------------------------

      Another commenter broadly stated that the data recording and reporting procedures described in the CAT NMS Plan are inappropriate and unreasonable.\829\ This commenter also stated that it may be easier for the Plan Processor to work directly with service bureaus, rather than with individual CAT Reporters, on data submission.\830\

      ---------------------------------------------------------------------------

      \829\ Data Boiler Letter at 18. Specifically, the commenter argued that to link information accurately, there must be ``a robust event sequencing method,'' and stated that the Plan lacks sufficient detail on this matter. The commenter further suggested that order and execution information should be represented in a meaningful way and recommended expressing this information in audio/musical notes form.

      \830\ Id. at 19-20.

      ---------------------------------------------------------------------------

      In response to the commenter's request that OATS-exempt firms also be exempted from reporting to the CAT, the Commission believes that completely exempting any group of broker-dealers from reporting requirements would be contradictory to the goal of Rule 613, which is to create an accurate, complete, accessible and timely audit trail.\831\ To permit such an exemption would eliminate the collection of audit trail information from a segment of broker-dealers and would thus result in an audit trail that does not capture all orders by all participants in the securities markets. The Commission believes that the CAT should contain data from all broker-dealers, including those that may appear to be at low risk for wrong-doing based on their history of compliance or business model. Regulators will not only use the CAT for surveillance and investigations, but also for market reconstructions and market analyses. Therefore, data from all broker-

      dealers is necessary.\832\

      ---------------------------------------------------------------------------

      \831\ The Participants did not respond to this comment.

      \832\ As discussed in more detail below, the Commission believes that even if regulatory burdens reduce the number of small broker-

      dealers in specialized segments, overall competition in those segments may not be harmed. See Section V.G.1, infra.

      ---------------------------------------------------------------------------

      The Commission believes that the data recording and reporting procedures outlined in the CAT NMS Plan meet the requirements of Rule 613 \833\ and are reasonable in that they are designed to ensure that data is recorded and reported in a manner that will provide regulators access to linked CAT Data that is timely, accurate, secure, and complete.\834\ Further, while under certain circumstances it might be efficient for the Plan Processor to work directly with service bureaus, the reporting requirements in the CAT NMS Plan apply to CAT Reporters, which are regulated entities, and therefore, it is necessary that the Plan Processor deal directly with CAT Reporters in determining matters related to reporting CAT Data.\835\

      ---------------------------------------------------------------------------

      \833\ 17 CFR 242.613(c).

      \834\ In the Adopting Release for Exchange Act Rule 613, the Commission stated that the data recording and reporting procedures are reasonably designed ``to ensure that the CAT will be designed in a way that provides regulators with the accurate, complete, accessible, and timely market activity data they need for robust market oversight.'' See Adopting Release, supra note 14, at 45743.

      \835\ The Commission notes that the CAT NMS Plan also requires the Plan Processor to measure and monitor latency within the CAT. See CAT NMS Plan, supra note 5, at Appendix D, Section 8.3.

      ---------------------------------------------------------------------------

      2. Format

      The CAT NMS Plan does not mandate the format in which data must be reported to the Central Repository.\836\ Rather, the Plan provides that the Plan Processor will determine the electronic format in which data must be reported, and that the format will be described in the Technical Specifications.\837\

      ---------------------------------------------------------------------------

      \836\ See CAT NMS Plan, supra note 5, at Appendix C, Section D.12(f); see also id. at Appendix C, Section A.1(a). The CAT NMS Plan states that CAT Reporters could be required to report data either in a uniform electronic format, or in a manner that would allow the Central Repository to convert the data to a uniform electronic format, for consolidation and storage. Id. at Appendix C, Section A.1(b).

      \837\ Id. at Appendix D, Section 2.1. Appendix D states that more than one format may be allowed to support the various market participants that would report information to the Central Repository. Id.; see also id. at Section 6.9.

      ---------------------------------------------------------------------------

      Two commenters expressed support for allowing the Plan Processor to determine the format for reporting data.\838\ One of these commenters stated that prescribing an approach in the Plan may hinder scalability and future system development.\839\

      ---------------------------------------------------------------------------

      \838\ ICI Letter at 13.

      \839\ Data Boiler Letter at 9. This commenter also stated that the formatting procedures in the Plan were insufficient and recommended using an audio/musical approach. Id. at 18.

      ---------------------------------------------------------------------------

      Three commenters, however, recommended that the format be specified in the Plan.\840\ One commenter argued that mandating an approach in the Plan, rather than waiting for the Technical Specifications, would give the industry more time to develop approaches to reporting using that format.\841\ The commenter also argued that if the format is not known until the Technical Specifications are published, this would limit the opportunity to make changes to the format, if necessary, without disrupting the implementation schedule.\842\ The commenter suggested that at least guidelines for a messaging protocol be included in the Plan.\843\

      ---------------------------------------------------------------------------

      \840\ FIF Letter at 90-92; FIX Trading Letter at 1; Better Markets Letter at 7 (stating that ``the Commission should mandate the most widely used, open-sourced, machine-readable data format possible.'')

      \841\ FIF Letter at 90-91.

      \842\ Id. at 90.

      \843\ Id. at 91-92.

      ---------------------------------------------------------------------------

      Commenters also expressed opinions about whether the Plan Processor should allow CAT Reporters to use multiple formats or one uniform format to report CAT Data. Four commenters generally supported an approach that would allow CAT Reporters to report CAT Data using a non-

      uniform format.\844\ Under such an approach, the Central Repository would be responsible for normalizing the data into a uniform format to link and store the data. These commenters noted that CAT Reporters should be permitted to use any of the currently existing industry protocols widely used by industry participants, such as OATS, SWIFT or FIX.\845\ One commenter advocated for the use of its own electronic communications protocol, FIX, stating that it would result in quicker implementation times and simplify data aggregation.\846\ This commenter noted that FIX is currently used by thousands of firms in the financial services industry and that it would not make sense to require firms to convert from a FIX format to a proprietary format designed by the Plan Processor and mandated for CAT reporting.\847\ The commenter stated that FIX already tracks the lifecycle of an order both within an organization and across organizations, thus making it a good choice as the format for the CAT.\848\ It also noted that it is used globally and can be used for products beyond listed options and equities. Finally, the commenter represented that FIX can handle any identifier, including LEI, and can support the CAT NMS Plan's use of Customer-ID, average price processing, options reporting, and the daisy chain approach for reporting.\849\

      ---------------------------------------------------------------------------

      \844\ FIF Letter at 90-92; ICI Letter at 13; FIX Trading Letter at 1-2; Data Boiler Letter at 41.

      \845\ ICI Letter at 13; FIX Trading Letter at 1-2; Data Boiler Letter at 41; FIF Letter at 91. FIF stated that CAT Reporters could use either an existing format or a ``native'' format developed by the Plan Processor. Another commenter was against trying to develop a native CAT format. Data Boiler Letter at 20. This commenter suggested preserving data in its most original format and then converting trade streams into ``music formats'' for ease of storage and comparison and to facilitate surveillance. Id.

      \846\ FIX Trading Letter at 1-2.

      \847\ Id. at 1; see also FIF Letter at 92.

      \848\ FIX Trading Letter at 2.

      \849\ Id. at 2-3.

      ---------------------------------------------------------------------------

      Page 84739

      One commenter stated that while mandating one uniform format would reduce the burden on the Central Repository for consolidating and storing data, it would impose a burden on CAT Reporters to accurately translate their current reporting format into a uniform CAT interface that could result in more errors than if the conversion to a uniform format occurred at the Central Repository.\850\ Conversely, another commenter cautioned that requiring one uniform format would create a monopoly.\851\

      ---------------------------------------------------------------------------

      \850\ FIF Letter at 92.

      \851\ Data Boiler Letter at 36, 41.

      ---------------------------------------------------------------------------

      One commenter argued that while data reported in a non-uniform format can be reliably converted into a uniform format, there are benefits to using a uniform format.\852\ Specifically, the commenter stated that using a uniform format can reduce data integrity issues within the Plan Processor, reduce data processing times, lower error correction rates between T+1 and T+3, reduce time and resources needed to on-board participants, and improve data accuracy and consistency across broker-dealers.\853\ The commenter also stated that use of a uniform format would improve data completeness because exact fields and standards would be defined.

      ---------------------------------------------------------------------------

      \852\ UnaVista Letter at 2.

      \853\ Id.

      ---------------------------------------------------------------------------

      In their response, the Participants stated that they do not believe that the Plan should mandate a specific format for reporting to the Central Repository, but rather should allow the Bidders to use discretion in selecting the format that will work most efficiently with their solution.\854\ The Participants stated that the nature of data ingestion is key to the architecture of the CAT and therefore the Plan does not mandate a data ingestion format, but allows the Plan Processor to determine the format.\855\ The Participants also noted that the remaining three Bidders propose accepting existing messaging protocols (e.g., FIX), rather than requiring CAT Reporters to use a new format.\856\ The Participants stated that when they evaluate each Bidder's solution, they will consider whether the Bidder's proposed approach for a message format is easily understood and adoptable by the industry. The Participants also stated that they will take into consideration each Bidder's ability ``to reliably and accurately convert data to a uniform electronic format for consolidation and storage, regardless of the message formats in which the CAT Reporters would be required to report data to the Central Repository.'' \857\

      ---------------------------------------------------------------------------

      \854\ Response Letter I at 29.

      \855\ Response Letter III at 14.

      \856\ Id.

      \857\ Response Letter I at 29.

      ---------------------------------------------------------------------------

      The Commission believes it is reasonable to allow the Plan Processor to determine the electronic format in which data must be reported, and whether the format is uniform or whether multiple formats can be used to report CAT Data. The Commission recognizes that if a format were mandated in the CAT NMS Plan, CAT Reporters would have the information necessary to accommodate the format sooner than if they need to wait for the Plan Processor to choose the format. Although the Commission recognizes the benefit of early notice, mandating a particular format(s) in the Plan could limit the Plan Processor's options for designing the operation of the CAT as envisioned. Moreover, the Commission notes that the Participants have stated that they will consider whether a Bidder has proposed a format that is easily understood and adoptable by the industry.\858\ Further, because the Plan contemplates there will be iterations of the Technical Specifications, as well as time between publication of the Technical Specifications and the time by which data reporting must begin, the Commission believes that Industry Members will have sufficient time to comply with the ultimate format chosen by the Plan Processor. Therefore, the Commission believes that, rather than mandating the decision regarding the format for reporting in the CAT NMS Plan, it is reasonable for the format to be determined by the Plan Processor as a component of the CAT design.

      ---------------------------------------------------------------------------

      \858\ Id.

      ---------------------------------------------------------------------------

      3. Reporting Timelines

      The CAT NMS Plan provides that CAT Reporters must report order event and trading information into the Central Repository by 8:00 a.m. ET on the Trading Day following the day the CAT Reporter records such information.\859\ A CAT Reporter must report post-trade information by 8:00 a.m. ET on the Trading Day following the day the CAT Reporter receives such information.\860\ The CAT NMS Plan provides that CAT Reporters may voluntarily report Participant Data prior to the 8:00 a.m. ET deadline.\861\

      ---------------------------------------------------------------------------

      \859\ See CAT NMS Plan, supra note 5, at Sections 6.3, 6.4.

      \860\ See id. at Section 6.4. Post-trade information includes: (1) If an order is executed in whole or part: (a) An Allocation Report; (b) SRO-Assigned Market Participant Identifier of the clearing broker or prime broker, if applicable; and (c) CAT-Order-ID of any contra-side order(s); (2) if the trade is cancelled, a cancelled trade indicator; and (3) for original receipt or origination of an order, the Firm Designated ID, Customer Account Information, and Customer Identifying Information for the relevant Customer.

      \861\ See id. at Sections 6.3, 6.4.

      ---------------------------------------------------------------------------

      Commenters expressed opinions about the timeframe in which data should be reported by CAT Reporters to the Central Repository. One commenter expressed general support for the proposed reporting deadline, but noted that without having detailed Technical Specifications and validation rules, it could not assess the feasibility of meeting this deadline.\862\ The commenter stated that more information is needed regarding the CAT data reporting requirements to determine whether collating and formatting for the required data fields is achievable within the deadlines.\863\

      ---------------------------------------------------------------------------

      \862\ UnaVista Letter at 2.

      \863\ Id.

      ---------------------------------------------------------------------------

      In contrast, two commenters suggested that data should be reported in real-time, or near real-time, rather than at 8:00 a.m. ET the Trading Day following the day that the data was recorded.\864\ One commenter noted under the CAT NMS Plan's reporting deadlines, if a trade were completed at 9:30 a.m. ET on a Friday on an exchange, it would not have to be reported until Monday at 8:00 a.m. ET.\865\ The commenter stated that the CAT NMS Plan does not present a convincing reason for the 8:00 a.m. ET deadline given that market participants have access to the data in real-time and should be able to report it in seconds or less.\866\ The commenter opined that real-time, or near real-time, reporting would allow for more robust surveillance and a ``quicker reaction time.'' \867\ Another commenter argued that data should be reported within 50 milliseconds so that regulators can conduct real-time surveillance.\868\ The commenter recommended that CAT support real-time ingestion, processing and surveillance.\869\

      ---------------------------------------------------------------------------

      \864\ Data Boiler Letter at 18; Better Markets Letter at 6.

      \865\ Better Markets Letter at 6.

      \866\ Id.

      \867\ Id.

      \868\ Data Boiler Letter at 19.

      \869\ Id. at 1. This commenter suggested that if CAT Data was going to be reported in real-time, SIP data should also be reported in real-time. See Data Boiler Letter at 42. Because the Commission does not believe that real-time reporting should be mandated by the Plan, the commenter's suggestion that SIP data be reported in real-

      time if CAT Data is going to be reported in real-time, is moot.

      ---------------------------------------------------------------------------

      This commenter also questioned the Plan Processor's ability to receive data from all CAT Reporters at 8:00 a.m. ET, and suggested that receiving data in real-time would alleviate any potential

      Page 84740

      problems in this regard.\870\ Another commenter also addressed concerns regarding CAT's capacity if a significant number of CAT Reporters choose to submit data at or around the same time, and recommended that the Plan Processor model its methodology on a system that has proven it can successfully project and manage large amounts of data, such as the Options Price Reporting Authority (``OPRA'').\871\

      ---------------------------------------------------------------------------

      \870\ Id. at 19-20.

      \871\ FIF Letter at 125.

      ---------------------------------------------------------------------------

      In response to these comments, the Participants noted that the Commission considered the idea of requiring real-time reporting in Rule 613, but instead imposed a reporting deadline of 8:00 a.m. ET.\872\ Therefore, the Participants are not required to file a plan containing real-time reporting.\873\ Further, in response to the commenter that stated that real-time, or near real-time, reporting would assist with surveillance and early warning of market events,\874\ the Participants noted that certain of them already have real-time surveillance tools in place that will not be affected by the implementation of the CAT.\875\

      ---------------------------------------------------------------------------

      \872\ See Adopting Release, supra note 14, at 45765.

      \873\ See 17 CFR 242.613(c)(3). See Adopting Release, supra note 14, at 45765. Indeed, Rule 613 stated that the CAT NMS Plan may not impose a reporting deadline earlier than 8:00 a.m. ET on the Trading Day after the trade date. 17 CFR 242.613(c)(3).

      \874\ Better Markets Letter at 6.

      \875\ Response Letter I at 31, 43.

      ---------------------------------------------------------------------------

      As the Participants noted, the Commission considered whether CAT Reporters should be required to report data in real-time when it adopted Rule 613 under Regulation NMS.\876\ In response to the Proposing Release which proposed that data be collected in real-time, commenters questioned the accuracy, cost, and usability of data reported in real-time.\877\ The Commission concluded that there were practical advantages to taking a more gradual approach for an undertaking such as the CAT, and acknowledged that while there might be certain advantages to receiving data intraday, the greater majority of benefits to be realized from development of the CAT do not require real-time reporting.\878\ Further, the Commission recognized that not requiring real-time reporting upon implementation would result in significant cost savings for industry participants.\879\ After reviewing the CAT NMS Plan and considering the commenters' statements, the Commission continues to adhere to that view.

      ---------------------------------------------------------------------------

      \876\ See Adopting Release, supra note 14, at 45765.

      \877\ Id. at 45768-69.

      \878\ Id. at 45768.

      \879\ Id. at 45769.

      ---------------------------------------------------------------------------

      Further, in response to the commenter that questioned the feasibility of reporting data by the 8:00 a.m. ET reporting deadline without having detailed Technical Specifications and validation rules,\880\ the Commission notes that this reporting deadline is the same as that currently required for OATS reporting. Therefore, while again acknowledging the importance of timely delivery of Technical Specifications, the Commission believes many CAT Reporters already have the capability to report in compliance with the deadline proposed in the Plan and that such deadline is reasonable.

      ---------------------------------------------------------------------------

      \880\ UnaVista Letter at 2.

      ---------------------------------------------------------------------------

      Additionally, in response to the commenter that questioned the Plan Processor's ability to simultaneously receive data from all CAT Reporters at 8:00 a.m. ET and suggested that receiving data in real-

      time would alleviate potential problems resulting from an influx of all the data at one time, the Commission notes that the CAT NMS Plan requires the Plan Processor to have the capacity to handle two times the historical peak daily volume to ensure that, if CAT Reporters choose to submit data all at one time, the Plan Processor can handle the influx of data.\881\ Furthermore, because CAT Reporters have the option to report data throughout the day, the Commission anticipates that CAT Reporters, consistent with certain reporting practices, such as OATs reporting, will stagger their reports, thus alleviating concerns that a flurry of activity shortly before the 8:00 a.m. ET deadline would impose unnecessary burdens on the Plan Processor.

      ---------------------------------------------------------------------------

      \881\ See CAT NMS Plan, supra note 5, at Appendix C, Section A.1.(a).(ii).

      ---------------------------------------------------------------------------

      4. Data Elements

      The CAT NMS Plan requires that numerous data elements be reported to the Central Repository to ensure there is sufficient information to create the lifecycle of an order, and provide regulators with sufficient detail about an order to perform their regulatory duties.

      The Commission received a number of comments regarding specific data elements that CAT Reporters are required to report to the Central Repository. In addition, one commenter questioned generally if the SEC should reconsider the scope of Rule 613 and ``ask whether a more broad and complete audit trail is really what regulators need to efficiently and effectively perform their duties.'' \882\ This commenter also questioned whether the data being captured is ``relevant to achieve the SEC's goals, or whether the data is being collected for statistical purposes and would simply overwhelm usability of the audit trail.'' \883\

      ---------------------------------------------------------------------------

      \882\ Anonymous Letter I at 1.

      \883\ Id. at 3.

      ---------------------------------------------------------------------------

      The Commission continues to believe that the overall scope of Rule 613 is appropriate. However, the Commission has considered comments on each data element contained in the CAT NMS Plan and its necessity to achieving the goal of creating a consolidated audit trail, and has determined to amend or eliminate certain of the requirements proposed in the CAT NMS Plan as detailed below.

      1. Customer-ID

        (1) Customer Information Approach

        Article VI of the CAT NMS Plan adopts the ``Customer Information Approach'' for creating and utilizing a Customer-ID and identifying a Customer, which reflects the exemptive relief granted by the Commission.\884\ Several commenters expressed general support for the Customer Information Approach.\885\ Two commenters, however, requested a modification to the Customer Information Approach to permit Customer Identifying Information and Customer Account Information to be reported as part of the ``customer definition process'' \886\ instead of upon the original receipt or origination of an order.\887\ One of these commenters also stated that this modification would improve the security of Customer Account Information and the CAT because sensitive customer PII data ``would not need to be passed to order management systems or stored with the firm's CAT Reporting systems, but would remain with Customer Information Repositories which would issue the `Customer definition' CAT Report.'' \888\ One commenter stated that a unique identifier for every client may not be necessary and a unique identifier could be applied to only those with a

        Page 84741

        certain threshold of trading activity.\889\ Another commenter expressed general support for the Customer Information Approach, but suggested that the CAT system should tag related trade patterns with each identifiable customer and counterparties as a ``fingerprint (unique ID) to a customer and/or counterparty.'' \890\

        ---------------------------------------------------------------------------

        \884\ See Exemptive Request Letter, supra note 21, at 8-18; see also Section III.15, supra.

        \885\ FIF Letter at 9-10, 67-72; Data Boiler Letter at 22-24; TR Letter at 8; see also UnaVista Letter at 3; DAG Letter at 2; STA Letter at 1 (supporting the DAG Letter's Exemptive Request Letter recommendations).

        \886\ Under the ``customer definition process,'' broker-dealers would submit an initial set of information identifying the Customer to the Central Repository.

        \887\ FIF Letter at 9-10, 70-71; TR Letter at 8.

        \888\ FIF Letter at 67; see also DAG Letter at 2; STA Letter at 1 (supporting the DAG Letter's Exemptive Request Letter recommendations).

        \889\ Anonymous Letter I at 3.

        \890\ Data Boiler Letter at 23.

        ---------------------------------------------------------------------------

        Several commenters commented on the specific data elements required to be reported under the Customer Information Approach. One commenter suggested that the definition of ``account type'' should be consistent with existing OATS definitions.\891\ Another commenter noted that it could not find the definition of ``customer type'' in the CAT NMS Plan or Rule 613.\892\ This commenter recommended using an existing field currently reported to the SROs or the SEC for ``customer type'' to minimize implementation effort.\893\ This commenter also stated that an individual's ``role in the account,'' required to be reported as part of Customer Identifying Information, may not be consistently maintained across firms and that population and maintenance of this data field may be an issue.\894\ As a result, this commenter believed that the field for an individual's role in the account should only be required to be reported when firms create new accounts after the implementation of reporting under the CAT.\895\

        ---------------------------------------------------------------------------

        \891\ TR Letter at 9.

        \892\ Id.

        \893\ Id.

        \894\ Id. at 10.

        \895\ Id.

        ---------------------------------------------------------------------------

        One commenter requested clarification that Industry Members would only be required to report CAT Data for ``active'' accounts, and then offered that ``active accounts would be defined as those with activity in CAT reportable securities.'' \896\ One commenter discussed whether Customer Identifying Information and Customer Account Information should be ``refreshed'' (i.e., updated) by an Industry Member. This commenter suggested ``having the functional support for a voluntary full refresh, but . . . eliminating the mandated requirement to provide full refreshes periodically,'' and stated that, ``the initial load, daily updates and standard error processing should be sufficient to maintain data integrity.'' \897\ This commenter added that while eliminating the periodic refresh of the information used to identify a Customer ``may slightly reduce the burden or cost on the broker-dealer community as well as the Plan Processor, it would eliminate the need for unneeded transmission and handling of sensitive PII data.'' \898\

        ---------------------------------------------------------------------------

        \896\ FIF Letter at 10.

        \897\ Id. at 122.

        \898\ Id. at 93.

        ---------------------------------------------------------------------------

        Another commenter noted the different data elements that identify a Customer under the Customer Information Approach and recommended that ``customer information fields be categorized based on degree of importance for market surveillance and market reconstruction, so that focus can be concentrated on ensuring accuracy of the most important fields from a surveillance viewpoint.'' \899\ This commenter added that ``different criteria could be established based on the customer data categorization for correction turn-around time; e.g., customer unique identifier (LTID or social security number) would be of highest priority; zip code may be of lesser importance and not impact regulators' ability to surveil the marketplace.'' \900\ This commenter requested clarification whether only ``active'' accounts are required to report customer identifying information as part of the customer definition process.\901\

        ---------------------------------------------------------------------------

        \899\ Id.

        \900\ Id.

        \901\ Id. at 10.

        ---------------------------------------------------------------------------

        One commenter opposed the Customer Information Approach. This commenter stated that the Commission should require ``a universal customer ID to aid in the accuracy, integrity, and consolidation of CAT Data'' and that ``firm-based IDs will significantly increase the complexity and fragmentation of the dataset, slowing down consolidation.'' \902\

        ---------------------------------------------------------------------------

        \902\ Better Markets Letter at 9.

        ---------------------------------------------------------------------------

        According to the Participants, the Customer Information Approach would not have an adverse effect on the various ways in which, and purposes for which, regulators would use, access, and analyze the audit trail data reported under Rule 613 nor would it compromise the linking of order events, alter the time and method by which regulators may access the data, or limit the use of the CAT audit trail data. The Participants noted the unique nature of the existing identifiers to be used under the Customer Information Approach, which would allow the Plan Processor to create customer linkages with the same level of accuracy as the Customer-ID. The Participants also stated that the reliability and accuracy of the data reported to the Central Repository under the Customer Information Approach is the same as under the approach outlined in Rule 613 with regard to Customer-IDs because the identifiers used under the proposed Customer Information Approach are also unique identifiers. In some cases, the Participants stated that the Customer Information Approach may result in more accurate data, as errors may be minimized because broker-dealers will not have to adjust their systems to capture and maintain the additional Customer-ID data element, and only a single entity will have to perform the mapping of firm-designated account information to Customer-ID. The Participants also noted that a universal identifier that is tied to personally identifiable information could create a substantial risk of misuse and of possible identify theft as the universal identifiers are passed between the Plan Processor and each CAT Reporter.

        The Participants further argued that the benefits of the Customer Information Approach outweigh any potential disadvantages.\903\ The Participants added that based upon their analysis of this issue and discussions with the industry, as detailed in the Exemptive Request Letter and the Plan, the Participants disagree that the Customer Information Approach will increase complexity or slow down consolidation. The Participants stated that utilizing a single Customer-ID within the CAT while allowing firms to report using existing identifiers would substantially reduce costs and speed implementation without limiting the regulatory use of the data. Indeed, the Participants noted that the additional cost required to comply with the Customer-ID approach set forth in the Rule, rather than with the Customer Information Approach as proposed in the CAT NMS Plan, would be at least $195 million for the largest CAT Reporters.\904\

        ---------------------------------------------------------------------------

        \903\ Response Letter I at 33.

        \904\ See Exemptive Request Letter, supra note 21, at 17.

        ---------------------------------------------------------------------------

        The Participants clarified in their response at what point Customer Account Information and Customer Identifying Information must be reported under the Plan.\905\ The Participants stated that the approach discussed in the Exemptive Request Letter was intended to require CAT Reporters to supply Customer Identifying Information and Customer Account Information as part of the customer definition process--that is, prior to the origination or original receipt of an order--rather than as information submitted with each order. The Participants noted that Section

        Page 84742

        6.4(d)(iv) of the Plan describes this customer definition process, which includes the process for submitting customer information and for assigning Customer-IDs for use within the CAT. According to the Participants, the operation of Sections 6.3(d)(i) and 6.4(d)(i) of the Plan clarify that a CAT Reporter is required to submit the Firm Designated IDs with the new order reports, but not the information to identify a Customer. The Participants recognized, however, that the language in Section 6.4(d)(ii)(C) of the Plan could be read to suggest that the customer identifying information must be provided with each new order report (i.e., that the Customer Account Information and Customer Identifying Information must be submitted contemporaneously with each order, rather than submitting such information pursuant to the customer definition process). The Participants proposed that the CAT NMS Plan be amended to make clear that customer information would be submitted pursuant to the customer definition process rather than with each original receipt or origination of an order.

        ---------------------------------------------------------------------------

        \905\ Response Letter I at 34.

        ---------------------------------------------------------------------------

        The Participants also noted that they do not believe that trading activity thresholds with respect to identifiers would be consistent with the requirements of Rule 613.\906\ The Participants stated that the use of unique IDs is essential to the effectiveness and usefulness of the CAT because these data elements will help regulatory users conduct surveillance across market centers and identify activity originating from multiple market participants.

        ---------------------------------------------------------------------------

        \906\ Id. at 23.

        ---------------------------------------------------------------------------

        In their response, the Participants stated that they have not yet determined how ``account type'' and ``customer type'' will be defined for purposes of reporting to the Central Repository and anticipate that they will be defined in the Technical Specifications.\907\

        ---------------------------------------------------------------------------

        \907\ Id. at 24.

        ---------------------------------------------------------------------------

        With respect to limiting the reporting of a Customer's ``role in the account'' on a going-forward basis (i.e., after implementation of the CAT), the Participants stated that the Plan does not distinguish between legacy and new accounts with regard to this requirement and the Participants do not believe that this change is necessary.\908\

        ---------------------------------------------------------------------------

        \908\ Id. at 23.

        ---------------------------------------------------------------------------

        The Participants stated in their response that the CAT NMS Plan currently anticipates that Industry Member CAT Reporters would only report information to identify a customer for ``active accounts'' as part of the customer definition process.\909\ Specifically, the Plan states that ``broker-dealers will initially submit full account lists for all active accounts to the Plan Processor and subsequently submit updates and changes on a daily basis,'' \910\ and defines ``active accounts'' as ``accounts that have had activity within the last six months.'' \911\ Moreover, the Participants noted that the Plan states that ``the Participants anticipate that Customer information that is initially reported to the CAT could be limited to only customer accounts that have, or are expected to have, CAT-reportable activity. For example, accounts that are considered open, but have not traded Eligible Securities in a given timeframe may not need to be pre-

        established in the CAT, but rather could be reported as part of daily updates after they have CAT-reportable activity.'' \912\ Accordingly, the Participants suggested that the CAT NMS Plan be amended to clarify that only active accounts are required to report Customer Identifying Information during the customer definition process.

        ---------------------------------------------------------------------------

        \909\ Id. at 35.

        \910\ Id. at 22 (citing the CAT NMS Plan, Appendix C, Section A.1(a)(iii)).

        \911\ Id. (citing the CAT NMS Plan, Appendix C, Section A.1(a)(iii), n.39).

        \912\ Id. (citing the CAT NMS Plan, Appendix C, Section A.1(a)(iii), n.36).

        ---------------------------------------------------------------------------

        With respect to the Plan's requirement to periodically refresh Customer Identifying Information and Customer Account Information, the Participants stated in their response that they believe that maintaining the accuracy of customer information is vital to the operation of the CAT.\913\ Therefore, the Participants noted that a periodic refresh of customer information is beneficial because it will help to ensure that all customer information remains accurate and up to date. The Participants further acknowledged the concern with maintaining the confidentiality of PII and other CAT Data.\914\ To that end, the Participants highlighted Section 6.12 of the Plan, which requires the Plan Processor to develop and maintain a comprehensive information security program that meets certain requirements set forth in the Plan, and the fact that the information security program must be approved and reviewed at least annually by the Operating Committee. The Participants stated that they continue to assess the Bidders' proposed security solutions and believe that once the CAT is operational the information security program will address the commenters' concerns regarding data security. Finally, the Participants noted that the Plan will define the scope of a ``full'' customer information refresh and the extent to which inactive or other accounts would need to be reported.\915\

        ---------------------------------------------------------------------------

        \913\ Id. at 31.

        \914\ Id. at 32.

        \915\ Id.

        ---------------------------------------------------------------------------

        The Participants further stated that they do not agree that it would be appropriate to rank the importance of particular data elements reported to the Central Repository for data correction or other purposes for several reasons.\916\ First, the Participants pointed out that Rule 613 does not indicate that any data elements are more or less important for market surveillance or market reconstruction purposes. The Participants noted that Rule 613(c)(7) states that the Plan ``shall require each national securities exchange, national securities association, and any member of such exchange or association to record and electronically report to the central repository details for each order and each reportable event, including, but not limited to the information set forth in Rule 613(c)(7)(i)-(viii)'' (emphasis added). Second, the Participants noted that ranking the importance of data elements for market surveillance and market reconstruction purposes might inappropriately reveal the confidential, proprietary surveillance processes used by each Participant. Third, the Participants stated that with respect to data accuracy, the Participants have included provisions in the Plan to take into account minor and major inconsistencies in Customer information. In particular, the Participants noted that Appendix D explains that ``the Plan Processor must design and implement procedures and mechanisms to handle both minor and material inconsistencies in Customer information.'' \917\ Additionally, material inconsistencies must be communicated to the submitting CAT Reporter(s) and resolved within the established error correction timeframe, as detailed in Sections 6-7 of Appendix D of the Plan.\918\ The Participants stated that the Central Repository also must have an audit trail showing the resolution of all errors.\919\ Finally, the Participants noted that they intend to monitor errors in the customer information fields and will consider, as appropriate, whether to prioritize the correction of certain data fields over others.

        ---------------------------------------------------------------------------

        \916\ Id.

        \917\ Id. at 22 (citing the CAT NMS Plan at Appendix D, Section 9.4).

        \918\ Id.

        \919\ Id.

        ---------------------------------------------------------------------------

        The Commission believes that the clarification provided by the

        Page 84743

        Participants that Customer Account Information and Customer Identifying Information are reported as part of the customer definition process, rather than with each original receipt or origination of an order, is reasonable. The Commission believes that this will clarify the process for submitting information to identify a Customer under the CAT NMS Plan and will remove any ambiguity as to the reporting responsibilities of Industry Members. The Commission further believes that this clarification also will reduce the prospect of unnecessarily passing sensitive customer PII data. Accordingly, the Commission is amending Section 6.4(d)(ii)(C) of the CAT NMS Plan to clarify that Customer Identifying Information and Customer Account Information will be reported as part of the Customer definition process, rather than upon original receipt or origination of an order.

        The Commission also agrees that creating a unique Customer-ID as contemplated by the CAT NMS Plan, regardless of the Customer's trading activity threshold, is reasonable. The Commission notes that surveillance and enforcement efforts are necessary, even for accounts with low levels of trading activity.

        The Commission further believes that it is reasonable to allow the Plan Processor, in conjunction with the Operating Committee, to define the specific ``account types'' and ``customer types'' in the Technical Specifications for the CAT NMS Plan. This approach will allow the Plan Processor to assess the various definitions of ``account type'' and ``customer type'' that exist among the CAT Reporters, and then make a determination as to how to appropriately classify them for purposes of CAT reporting. The Commission expects the Plan Processor will define these terms with sufficient precision so that the reporting requirements will be clear.

        The Commission agrees that a Customer's role in the account should be a data element that is reported as part of the customer definition process, regardless of whether the account existed prior to implementation of the CAT or was created thereafter. The CAT NMS Plan does not distinguish between legacy and new accounts, for purposes of reporting Customer Identifying Information, and the Commission believes identifying the Customer's role in the account will facilitate surveillance and enforcement efforts.

        The Commission also believes that it is reasonable to limit the reporting of Customer Identifying Information and Customer Account Information to only those accounts that are ``active,'' defined as a Customer account that has had activity (i.e., received or originated an order), in an Eligible Security within the last six months. This will alleviate the need for CAT Reporters to update the Customer Identifying Information or Customer Account Information for accounts that have not received or originated an order for more than six months, but still ensures that the Central Repository will collect audit trail data for Customer accounts that have any Reportable Events. The Commission notes that pursuant to the Plan and the Customer Information Approach, a CAT Reporter must upload any Customer Identifying Information and Customer Account Information to the Central Repository prior to a Customer originating an order. Because of this requirement, even if a CAT Reporter has not been updating the Customer Identifying Information and Customer Account Information for a Customer with an account with no Reportable Events for six months, if the Customer decides to submit or originate an order, the CAT Reporter would upload the required information identifying the Customer on the same day the Customer submits the order, and upon submission of the order, the Central Repository will collect the audit trail data required by Section 6.4 of the Plan. Accordingly, the Commission is amending Section 1.1 of the CAT NMS Plan to add a definition of ``Active Accounts'' to mean an account that has received or originated an order in an Eligible Security within the last six months. In addition, the Commission will amend Section 6.4(d)(iv) of the Plan to require that Industry Members submit an initial set of Customer Identifying Information and Customer Account Information to the Central Repository only for Active Accounts; and require Industry Members to update Customer Identifying Information and Customer Account Information only for Active Accounts.

        The Commission also believes that it is reasonable for the CAT NMS Plan to require the periodic refresh of such information to ensure that the Central Repository has the most current information identifying a Customer. The Commission notes that both daily updates and periodic refreshes will require the uploading of PII, along with other CAT Data, to the Central Repository, but believes that the robust information security program to be implemented and maintained by the Plan Processor should sufficiently protect all CAT Data.\920\

        ---------------------------------------------------------------------------

        \920\ The Commission also finds it reasonable not to rank CAT data elements in terms of relative importance because importance of the CAT data elements will necessarily vary in accordance with the manner in which the data is used.

        ---------------------------------------------------------------------------

        (2) Modification or Cancellation of an Order

        In connection with their proposal to adopt the Customer Information Approach, as discussed above, the Participants also suggested modification to Rule 613(c)(7)(iv)(F), which requires that ``the CAT-

        Reporter-ID of the broker-dealer or Customer-ID of the person giving the modification or cancellation instruction'' be reported to the Central Repository.\921\ In the CAT NMS Plan, the Participants proposed that CAT Reporters report whether a modification or cancellation instruction was given by the Customer associated with the order, or was initiated by the broker-dealer or exchange associated with the order.\922\ According to the Participants, it is most critical for regulatory purposes to ascertain whether the modification or cancellation instruction was given by the Customer or was instead initiated by the broker-dealer or exchange, rather than capturing the identity of the specific person who gave the instruction.\923\

        ---------------------------------------------------------------------------

        \921\ 17 CFR 242.613(c)(7)(iv)(F) (emphasis added).

        \922\ See Exemption Request Letter, supra note 21, at 12.

        \923\ Id.

        ---------------------------------------------------------------------------

        One commenter believed that modification and cancellation instructions are as important as other Reportable Events and, therefore, the identity of the person giving such instructions is ``vital information for market surveillance purposes.'' \924\ The commenter opposed the Participants' approach of permitting CAT Reporters to report whether a modification or cancellation of an order was given by a Customer or initiated by a broker-dealer or exchange, in lieu of requiring the reporting of the Customer-ID of the person giving the modification or cancellation instruction.\925\

        ---------------------------------------------------------------------------

        \924\ Data Boiler Letter at 24 (responding to Question 161 of the Plan Proposing Release).

        \925\ See CAT NMS Plan, supra note 5, at Section 6.3(d)(iv)(F).

        ---------------------------------------------------------------------------

        In their response, the Participants noted that reporting a single, specific Customer-ID for all modifications and cancellations is not possible under the Customer Information Approach because broker-dealers would not maintain Customer-IDs; instead, each broker-dealer would provide Firm-Designated IDs to the Central Repository

        Page 84744

        to identify a Customer.\926\ The Participants also stated that requiring CAT Reporters to report the Customer-ID of the specific individual initiating a cancellation or modification would introduce an inconsistent level of granularity in customer information between order origination and order modifications or cancellations, because Rule 613(c)(7)(i) does not require the reporting of the specific individual originating an order.

        ---------------------------------------------------------------------------

        \926\ Response Letter I at 24.

        ---------------------------------------------------------------------------

        The Commission has considered the commenter's concern and the Participants' response, and believes that requiring that CAT Reporters report whether a modification or cancellation instruction was given by the Customer associated with the order, or was initiated by the broker-

        dealer or exchange associated with the order, is a reasonable approach to providing useful audit trail data regarding the modification or cancellation of an order. The approach set forth in the Plan also will not result an inconsistent level of granularity between the Reportable Events of origination or receipt of an order, and the modification or cancellation of the order because it would not require the identity of the person that gave the modification or cancellation instruction--

        which is not required under the CAT NMS Plan nor Rule 613.

        (3) Reporting an Account Effective Date

        In connection with their proposal to adopt the Customer Information Approach, as discussed above, the Participants also proposed an alternative method for reporting the date an account was opened, as required by Rule 613(c)(7)(viii)(B).\927\ When reporting ``Customer Account Information,'' an Industry Member is required to report the date an account was opened.\928\ The SROs requested an exemption to allow an ``effective date'' be reported in lieu of an account open date in certain limited circumstances.\929\ As a result, an Industry Member will report the date an account was opened; except, however, that (a) in those circumstances in which an Industry Member has established a trading relationship with an institution but has not established an account with that institution, the Industry Member will (i) provide the Account Effective Date in lieu of the ``date account opened''; (ii) provide the relationship identifier in lieu of the ``account number''; and (iii) identify the ``account type'' as a ``relationship''; \930\ and (b) in those circumstances in which the relevant account was established prior to the implementation date of the CAT NMS Plan applicable to the relevant CAT Reporter and no ``date account opened'' is available for the account, the Industry Member will provide the Account Effective Date in the following circumstances: (i) Where an Industry Member changes back office providers or clearing firms and the date account opened is changed to the date the account was opened on the new back office/clearing firm system; (ii) where an Industry Member acquires another Industry Member and the date account opened is changed to the date the account was opened on the post-merger back office/

        clearing firm system; (iii) where there are multiple dates associated with an account in an Industry Member's system, and the parameters of each date are determined by the individual Industry Member; and (iv) where the relevant account is an Industry Member proprietary account.\931\ Several commenters supported the Participants' approach to reporting an account effective date rather than the date an account was opened, as set forth in the CAT NMS Plan, and which reflects the exemptive relief granted by the Commission.\932\ The Commission believes that the CAT NMS Plan's approach to reporting an account effective date, rather than the date an account was opened, is reasonable and will not impact the quality or usefulness of the information available to regulators.

        ---------------------------------------------------------------------------

        \927\ See September 2015 Supplement, supra note 21.

        \928\ See CAT NMS Plan, supra note 5, at Section 1.1.

        \929\ See September 2015 Supplement, supra note 21.

        \930\ The Commission notes that because ``account type'' will be defined in the Technical Specifications for purposes of reporting to the Central Repository, one type of ``account type'' will be ``relationship,'' See Section IV.D.4.a(1), supra.

        \931\ CAT NMS Plan, supra note 5, at Section 1.1.

        \932\ Data Boiler Letter at 24; TR Letter at 8; FIF Letter at 9, 81-83; see also Exemption Order, supra note 21.

        ---------------------------------------------------------------------------

        (4) Identifying a Customer Using LEI

        The Commission also received several comments stating that the Commission should mandate the use of LEIs whenever applicable.\933\ One commenter, also noting its support for using a global entity identifier in general and LEI specifically, stated that while it agrees that the system should provide for the capture and reporting of LEIs for customer identification, it would be appropriate to provide for a transitional approach to the collection of the LEIs. Under the commenter's recommended transitional approach, broker-dealers would provide the LEI to the CAT in each instance where the LEI is already known and collected.\934\ This commenter also believed that it would be important to establish the CAT in a way that captures the LEI as part of the initial implementation of the system, rather than having to adapt the system at a future date, and that use of LEIs is important for both risk management and operational efficiency.\935\ Another commenter, however, did not recommend that the LEI be mandated for use by broker-dealers and argued that mandating the use of LEIs would disadvantage small broker-dealers who have no business requirement at this time to use LEI.\936\

        ---------------------------------------------------------------------------

        \933\ Better Markets Letter at 8; DTCC Letter at 1; see also UnaVista Letter at 3 (supporting the use of LEIs in conjunction with other personal identifiers to identify Customers).

        \934\ SIFMA Letter at 36.

        \935\ Id. at 37; see also DTCC Letter at 2-4 (noting industry and regulatory support for LEIs and, that if LEIs were mandated, it would facilitate the ability for regulators to aggregate systemic risk exposures across markets).

        \936\ FIF Letter at 70.

        ---------------------------------------------------------------------------

        In their response, the Participants stated that based on discussions with the DAG, they agree with the commenters that it would be reasonable to require an Industry Member to report its LEI or the LEI of a Customer to the Central Repository as part of Customer Identifying Information if the Industry Member has or acquires an LEI.\937\ The Participants added that Industry Members that report LEIs would do so in addition to, rather than in lieu of, the other Customer Identifying Information required by the Plan.\938\ The Participants do not believe, however, that the Plan should require Industry Members or others to obtain an LEI for a Customer if they do not already have one.\939\

        ---------------------------------------------------------------------------

        \937\ Response Letter II at 5-6.

        \938\ Response Letter III at 12.

        \939\ Response Letter II at 5.

        ---------------------------------------------------------------------------

        The Participants further stated that, based on discussions with the DAG, they believe that Industry Members should be permitted to provide Customer LEIs in their possession without the imposition of any due diligence obligations beyond those that may exist today with respect to information associated with an LEI.\940\ The Participants noted that, although Industry Members should not be required to perform additional due diligence with regard to the LEIs for CAT purposes, Industry Members will be required to accurately provide the LEIs in their records and may not knowingly submit inaccurate LEIs to the CAT.\941\ In addition, the Participants

        Page 84745

        stated that all of the remaining Bidders have indicated that their solutions will be able to support the use of LEIs.\942\ Moreover, although the Participants believed that there are costs related to requiring Industry Members to provide an LEI if they have one, the Participants believed that the benefits outweigh the costs.\943\

        ---------------------------------------------------------------------------

        \940\ Id.

        \941\ Id.

        \942\ Id. at 5-6.

        \943\ The Participants do not believe that the proposed use of LEIs would reduce the granularity of information provided as the proposed use of LEIs would not change the provisions related to the SRO-Assigned Market Participant Identifiers (e.g., MPIDs). See CAT NMS Plan, supra note 5, at Sections 1.1 (definition of SRO-Assigned Market Participant Identifier), 6.3 (requiring reporting of SRO-

        Assigned Market Participant Identifier).

        ---------------------------------------------------------------------------

        The Commission has considered the commenters' views on the merits of reporting an LEI to the Central Repository as part of Customer Identifying Information and the Participants' response and believes that it is reasonable to require an Industry Member to report an LEI for its Customer if the Industry Member has or acquires the LEI for its Customer. Accordingly, the Commission is amending the definition of ``Customer Identifying Information'' in Section 1.1 of the Plan to require that an Industry Member report an LEI to identify a Customer that is a legal entity, if the Industry Member has or acquires the LEI of such Customer. However, the Commission is also making clear that the LEI is not reported in lieu of the other Customer Identifying Information for a legal entity (e.g., name, address, or employer identification number), but must be reported along with other Customer Identifying Information.

        The Commission believes use of the LEI enhances the quality of identifying information for Customers by incorporating a global standard identifier increasingly used throughout the financial markets. The Commission notes that according to the Plan, Industry Members will still be required to report other Customer Identifying Information even if the Industry Member reports an LEI to identify a Customer; thus the LEI supplements the other information that will be used by the Central Repository to identify a Customer.

        The Commission further believes that it is reasonable to not require an Industry Member to obtain an LEI for its Customer or for itself if the Industry Member does not already have an LEI for its Customer or itself because such a requirement would impose an additional burden. However, the Commission believes that requiring Industry Members to accurately provide the LEIs in their records and not knowingly submit inaccurate LEIs to the CAT is reasonable, because reporting accurate information to the CAT is a fundamental requirement of the Plan.\944\

        ---------------------------------------------------------------------------

        \944\ See CAT NMS Plan, supra note 5, at Section 6.5(d).

        ---------------------------------------------------------------------------

        In response to the commenter that believed that such a requirement might disadvantage small broker-dealers, the Commission notes that the requirement to report LEIs does not mandate that a broker-dealer obtain an LEI to comply with the Plan; therefore, small broker-dealers that do not currently have an LEI will not be required to report one and thus will not be disadvantaged.

      2. CAT-Reporter-ID

        (1) Existing Identifier Approach

        Article VI of the CAT NMS Plan reflects the ``Existing Identifier Approach'' for purposes of identifying each CAT Reporter associated with an order or Reportable Event.\945\ Under the Existing Identifier Approach, CAT Reporters are required to record and report to the Central Repository an SRO-Assigned Market Participant Identifier for orders and certain Reportable Events to be used by the Central Repository to assign a unique CAT-Reporter-ID to identify CAT Reporters. An Industry Member is required to report its existing SRO-

        Assigned Market Participant Identifier used by the relevant SRO specifically for transactions occurring on that SRO to the Central Repository.\946\ Similarly, an exchange reporting CAT Reporter information is required to report data using the SRO-Assigned Market Participant Identifier used by the Industry Member on that exchange or its systems.\947\ Off-exchange orders and Reportable Events will be reported with an Industry Member's FINRA SRO-Assigned Market Participant Identifier.\948\

        ---------------------------------------------------------------------------

        \945\ See id. at Section 6.3(e).

        \946\ See Exemption Order, supra note 21, at 31-41.

        \947\ See id. at 20.

        \948\ Id.

        ---------------------------------------------------------------------------

        For the Central Repository to link the SRO-Assigned Market Participant Identifier to the CAT-Reporter-ID, each SRO will submit, on a daily basis, all SRO-Assigned Market Participant Identifiers used by its Industry Members (or itself), as well as information sufficient to identify the corresponding market participant (e.g. a CRD number or LEI) to the Central Repository.\949\ Additionally, each Industry Member will be required to submit to the Central Repository information sufficient to identify such Industry Member (e.g., CRD number or LEI, as noted above).\950\ The Plan Processor will use the SRO-Assigned Market Participant Identifiers and identifying information (i.e., CRD number or LEI) to assign a CAT-Reporter-ID to each Industry Member and SRO for internal use within the Central Repository.\951\

        ---------------------------------------------------------------------------

        \949\ See CAT NMS Plan, supra note 5, at Section 6.3(e)(i).

        \950\ Id. at Section 6.4(d)(vi).

        \951\ See Exemption Order, supra note 21, at 31-41.

        ---------------------------------------------------------------------------

        The reporting of an existing SRO-Assigned Market Participant Identifier differs from Rule 613 in that under Rule 613(c)(8), CAT Reporters would be required to report a universal CAT-Reporter-ID for certain Reportable Events.\952\ In the Exemptive Request Letter, the SROs requested an exemption to permit a CAT Reporter to report an existing SRO-Assigned Market Participant Identifier in lieu of requiring the reporting of a universal CAT-Reporter-ID.\953\ Specifically, the Participants stated that the Existing Identifier Approach would not negatively impact regulators' access, use, and analysis of CAT Data, and that it could allow additional levels of granularity compared to the universal CAT-Reporter-ID approach, in that SRO-Assigned Market Participant Identifiers may contain additional information not mandated by the CAT NMS Plan, such as the specific desk or department responsible for trades.\954\ The Participants also stated that they believe the reliability and accuracy of CAT Data under the Existing Identifier Approach would not be undermined,\955\ and represented that the Existing Identifier Approach could result in fewer errors and more reliable and accurate linkage

        Page 84746

        of order information.\956\ Further, the Participants noted their belief--based upon discussion with the DAG--that the Existing Identifier Approach would reduce the cost and implementation burdens on CAT Reporters to comply with Rule 613,\957\ as it would allow them to continue using their current business practices and data flows instead of building new infrastructure to support the CAT-Reporter-ID requirement.\958\

        ---------------------------------------------------------------------------

        \952\ Rule 613(c)(8) requires that CAT Reporters use the same CAT-Reporter-ID for each broker-dealer. 17 CFR 242.613(c)(8). The Reportable Events for which CAT-Reporter-IDs must be reported are: The broker-dealer receiving or originating an order (17 CFR 242.613(c)(7)(i)(C)); the broker-dealer or national securities exchange from which (or to which) an order is being routed (17 CFR 242.613(c)(7)(ii)(D) and (E)); if the order is routed to a national securities association, then the CAT-Reporter-ID of that national securities association must be reported (17 CFR 242.613(c)(7)(ii)(E)); the broker-dealer or national securities exchange receiving (or routing) a routed order (17 CFR 242.613(c)(7)(iii)(D) and (E)); if a national securities association receives the routed order, then the CAT-Reporter-ID of that national securities association must be reported (17 CFR 242.613(c)(7)(iii)(D)); the broker-dealer, if applicable, giving a modification or cancellation instruction, if an order is modified or cancelled (17 CFR 242.613(c)(7)(iv)(F)); the national securities exchange or broker-dealer executing an order, if an order is executed (17 CFR 242.613(c)(7)(v)(F)); and the clearing broker or prime broker, if applicable, if an order is executed (17 CFR 242.613(c)(7)(vi)(B)).

        \953\ See Exemptive Request Letter, supra note 21, at 19.

        \954\ See id. at 23, 26.

        \955\ Id. at 23.

        \956\ Id.

        \957\ Id. at 21, 22, 24.

        \958\ Id. at 24.

        ---------------------------------------------------------------------------

        Several commenters expressed support for the Existing Identifier Approach.\959\ Two of the commenters listed benefits of the Existing Identifier Approach over the approach required in Rule 613.\960\ One of the commenters stated that the Existing Identifier Approach would be more efficient and cost-effective than the Rule 613 approach.\961\ The other commenter listed the following benefits: The Existing Identifier Approach would allow the industry to keep its current business processes and identifiers; coordination of a single CAT-Reporter-ID to be used across all Participants to identify broker-dealers would not be necessary; CAT Reporters would not have to expand their information repositories to store and manage a new CAT-Reporter-ID; the Plan Processor would manage the translation between the SRO-Assigned Market Participant Identifiers and the CAT-Reporter-ID; since the Plan Processor would be assigning CAT-Reporter-IDs, CAT Reporters would not be subject to errors with respect to the application of CAT-Reporter-

        IDs; a common information technology solution would be used; the Existing Identifier Approach would allow regulators to surveil on a more granular level; and the Existing Identifier Approach would save CAT Reporters the expense of maintaining and supplying a unique CAT-

        Reporter-ID for every Reportable Event.\962\ Both commenters stated that the Existing Identifier Approach would not affect the accuracy, accessibility, timeliness or security and confidentiality of CAT Data over the Rule 613 approach.\963\

        ---------------------------------------------------------------------------

        \959\ See Data Boiler Letter at 22; FIF Letter at 73-74 ; TR Letter at 7-8; see also DAG Letter at 2; STA Letter at 1 (supporting the DAG Letter's Exemptive Request Letter recommendations).

        \960\ Data Boiler Letter at 22; FIF Letter at 73-74.

        \961\ Data Boiler Letter at 22.

        \962\ FIF Letter at 73-74.

        \963\ Data Boiler Letter at 22; FIF Letter at 74.

        ---------------------------------------------------------------------------

        Three commenters offered recommendations for modifying the Existing Identifier Approach.\964\ Two commenters asked that the FINRA MPID be permitted for non-execution reports.\965\ One commenter stated that, regardless of whether the Existing Identifier Approach or the Rule 613 approach is used, the CAT should ``tag'' trade patterns with the trading desk and trader.\966\

        ---------------------------------------------------------------------------

        \964\ Data Boiler Letter; TR Letter; FIF Letter.

        \965\ TR Letter at 8-9; FIF Letter at 10-11.

        \966\ Data Boiler at 22.

        ---------------------------------------------------------------------------

        In response to the two commenters that requested that the FINRA MPID be used for non-execution reports,\967\ the Participants stated that the practices described by the two commenters would be acceptable under the Existing Identifier Approach, explaining that a broker-dealer CAT Reporter would be permitted to use any existing SRO-Assigned Market Participant Identifier (e.g., FINRA MPID, NASDAQ MPID, NYSE Mnemonic, CBOE User Acronym and CHX Acronym) when reporting order information to the Central Repository, regardless of the eventual execution venue.\968\

        ---------------------------------------------------------------------------

        \967\ TR Letter at 8-9; FIF Letter at 10-11. The Participants did not respond to the comment suggesting the CAT should ``tag'' trade patterns with the trading desk and trader.

        \968\ Response Letter I at 33.

        ---------------------------------------------------------------------------

        Based on the Participants' representations in the Plan, the Commission believes that the Existing Identifier Approach is designed to provide the same regulatory benefits in terms of identifying CAT Reporters as would be achieved under Rule 613, at a reduced cost and implementation burden on CAT Reporters.\969\ The Existing Identifier Approach is designed to link, within the Central Repository, all SRO-

        Assigned Market Participant Identifiers to the appropriate CAT-

        Reporter-ID, and ultimately to the CAT Reporter, in a manner that is efficient, accurate, and reliable.

        ---------------------------------------------------------------------------

        \969\ According to the Participants, requiring the reporting of unique CAT-Reporter-IDs of: (i) The Industry Member receiving or originating an order; (ii) the Industry Member or Participant from which (and to which) an order is being routed; (iii) the Industry Member or Participant receiving (and routing) a routed order; (iv) the Industry Member or Participant executing an order; and (v) the clearing broker or prime broker, would have imposed technical implementation difficulties on CAT Reporters and the Plan Processor alike to adopt the infrastructure to comply with the reporting, collection, and maintenance of CAT-Reporter-IDs. See Exemptive Request Letter, supra note 21, at 26. The Commission has considered the economic implications of the exemptive relief permitting the Existing Identifier Approach, as well as the other approaches in the CAT NMS Plan (options market maker quotes, Customer-ID, linking of executions to specific subaccount allocations on Allocation Reports, and timestamp granularity for Manual Order Events) that required exemptive relief from Rule 613 for inclusion in its economic analysis. See Notice, supra note 5, at 30709.

        ---------------------------------------------------------------------------

        The Commission notes that one commenter recommended that the CAT be able to link trades to the responsible trading desk and trader.\970\ The Commission notes that an additional benefit of the Existing Identifier Approach is that, as the Participants have represented, it may allow for the voluntary collection of additional levels of granularity, such as responsible trading desk or trader.\971\

        ---------------------------------------------------------------------------

        \970\ Data Boiler Letter at 22.

        \971\ See Exemptive Request Letter, supra note 21, at 23. Further, the Commission notes that Section 6.3(d)(ii)(F) of the CAT NMS Plan currently requires the reporting of the identity and nature of the department or desk to which an internally routed order is being routed, so the identity of a trading desk for internally routed orders will be captured through this provision.

        ---------------------------------------------------------------------------

        (2) Use of LEI

        Section 6.3(e)(i) of the CAT NMS Plan requires each Participant to submit, on a daily basis, all SRO-Assigned Market Participant Identifiers used by its Industry Members or itself, as well as information to identify the corresponding market participant to the Central Repository, such as a CRD number or LEI, but does not require the reporting of LEIs. Section 6.4(d)(vi) of the CAT NMS Plan requires each Industry Member to submit to the Central Repository information sufficient to identify such Industry Member, such as a CRD number or LEI, but similarly does not require the reporting of LEIs.

        As discussed above in relation to the Customer-ID, several commenters recommended, or noted, the use of LEIs in lieu, or as part of the development of, a CAT-Reporter-ID.\972\ One commenter stated that it supported requiring Industry Members to provide their LEIs, as long as LEIs are already being captured by their systems.\973\ Another commenter supported the optional use of LEIs, believing that mandatory use of LEIs would unfairly burden small broker-dealers that may not currently accommodate LEIs in their systems.\974\

        ---------------------------------------------------------------------------

        \972\ FIX Letter at 2; FIF Letter at 75, Data Boiler Letter at 22; DTCC Letter at 1-6.

        \973\ Data Boiler Letter at 22.

        \974\ FIF Letter at 11.

        ---------------------------------------------------------------------------

        In recognition of the comments that encouraged the use of LEIs in the CAT, and based on discussions with the DAG, the Participants have recommended that Sections 6.3(e)(i) and 6.4(d)(vi) of the CAT NMS Plan be amended to require a Participant to submit an Industry Member's LEI if the Participant has (or acquires) an LEI for an Industry Member, and to require Industry Members to submit to the Central Repository their LEIs if they have LEIs.\975\ This information will be

        Page 84747

        reported to the Central Repository as part as the information the Plan Processor will use to assign CAT-Reporter-IDs.

        ---------------------------------------------------------------------------

        \975\ Response Letter II at 6; Response Letter III at 12.

        ---------------------------------------------------------------------------

        The Commission considers the suggested modifications by the Participants to Section 6.3(e)(i) and Section 6.4(d)(vi) of the CAT NMS Plan to require the Participants and Industry Members to provide Industry Member LEIs, if known, by such Participant or Industry Member to be reasonable and an improvement in the information available in the CAT with respect to CAT Reporters. Accordingly, the Commission is amending these sections to require the Participants and Industry Members to provide Industry Member LEIs, if known, by such Participant or Industry Member; however, the Commission is also amending these sections to require the submission of Participant LEIs, if a Participant has an LEI, as well as Industry Member CRD numbers. Specifically, the amendment to Section 6.3(e)(i) would require a Participant (i) for purposes of reporting information to identify itself pursuant to Section 6.3(e)(i), to submit its LEI to the Central Repository, if the Participant has an LEI; and (ii) for purposes of reporting information to identify an Industry Member pursuant to Section 6.3(e)(i), to submit the CRD number for the Industry Member, as well as the LEI of the Industry Member if the Participant has collected such LEI of the Industry Member. The amendment to Section 6.4(d)(vi) with respect to Industry Members would require an Industry Member, for purposes of reporting information to identify itself pursuant to Section 6.4(d)(vi), to submit to the Central Repository the CRD number of the Industry Member as well as the LEI of the Industry Member (if the Industry Member has an LEI).

        The Commission believes these amendments are appropriate because they may enhance the quality of identifying information by requiring the submission of the LEI--a global standard identifier increasingly used throughout the financial markets--to the extent it has otherwise been obtained. Because the amendments only impose the requirement to report an LEI on Participants and Industry Members that currently have an LEI, and which is known by the CAT Reporter, it should not impose the additional burden on them to obtain an LEI. Further, the Participants have represented that the Bidders' solutions can support the reporting of LEIs.\976\ Although Section 6.3(e)(i) and Section 6.4(d)(vi) currently permit the submission of CRD numbers, the Commission believes that requiring the submission of the Industry Member CRD numbers will provide regulators with consistent identifying information about Industry Members that is useful for regulatory investigations and has significant regulatory benefit. In addition, requiring CRD numbers to be provided should not impose additional burdens on Industry Members because, as registered broker-dealers, all Industry Members currently have CRD numbers.

        ---------------------------------------------------------------------------

        \976\ Response Letter II at 5-6.

        ---------------------------------------------------------------------------

      3. Open/Close Indicator

        Rule 613 and the CAT NMS Plan require CAT Reporters to report an open/close indicator as a ``Material Term'' on all orders.

        Three commenters objected to the requirement that CAT Reporters report an open/close indicator for equities transactions.\977\ One of these commenters requested additional cost-benefit analysis on the open/close indicator.\978\ Another commenter argued that the open/close indicator should be reported for options only, noting that this indicator is not currently used for equities.\979\ Another commenter noted that including an open/close indicator for equities would require ``significant process changes and involve parties other than CAT Reporters, such as buy-side clients, OMS/EMS vendors, and others.'' \980\ This commenter stated that, if the SROs and the Commission believe that there is value in obtaining the open/close indicator for surveillance purposes with respect to equities transactions, then a rule proposal covering this request and a thorough cost-benefit analysis should be filed for public comment.\981\ Another commenter characterized the requirement to report an open/close indicator as a ``market structure change'' and likewise stated that the requirement should be subject to its own rulemaking process, including a cost-

        benefit analysis, and subject to a public comment period.\982\

        ---------------------------------------------------------------------------

        \977\ TR Letter at 9; SIFMA Letter at 35-36; FIF Letter at 83-

        86.

        \978\ FIF Letter at 84; see also SIFMA Letter at 36.

        \979\ TR Letter at 9.

        \980\ SIFMA Letter at 35.

        \981\ SIFMA Letter at 36; see also FIF Letter at 83-85.

        \982\ FIF Letter at 85.

        ---------------------------------------------------------------------------

        In response, the Participants stated that they understand that Rule 613 requires that an ``open/close indicator'' be reported as part of the ``material terms of the order'' for both equities and options transactions, but recommended that CAT Reporters not be required to report an open/close indicator for equities transactions, or for options transactions, such as for market marker options transactions, in which the open/close indicator is not captured by current industry practice.\983\

        ---------------------------------------------------------------------------

        \983\ Response Letter I at 22.

        ---------------------------------------------------------------------------

        The Commission notes that Rule 613(c)(2) states only that ``the plan submitted pursuant to this section'' (emphasis added) must require reporting of a set of ``material terms of the order,'' including an open/close indicator. It does not state that the Plan as approved must include that data element. Now that the Participants have submitted a plan in compliance with Rule 613, that rule does not preclude the Commission from approving a Plan that implements the Participants' recommendation to limit the set of transactions to which the requirement to report an open/close indicator would apply. After consideration, the Commission believes that limiting the requirement to provide an open/close indicator to listed options is reasonable. The open/close indicator will provide important information about whether an order is opening or increasing a position in the option, or closing or reducing a position. While this information is useful with respect to non-market maker options activity, the Commission acknowledges the concerns in other areas, including the lack of a clear definition of the term for equities transactions, and the lack of utility of that data at the time of quote entry for options market makers.

        Accordingly, as recommended by the Participants, the Commission is amending the Plan to remove the requirement that an open/close indicator be reported as part of the Material Terms of the Order for equities and Options Market Maker quotations.\984\

        ---------------------------------------------------------------------------

        \984\ ``Material Terms of the Order'' is defined in Section 1.1 of the CAT NMS Plan.

        ---------------------------------------------------------------------------

      4. Allocations

        (1) Use of Allocation Reports

        The CAT NMS Plan requires that broker-dealers submit an Allocation Report following the execution of an order if such order is allocated to one or more accounts or subaccounts (the ``Allocation Report Approach''). An Allocation Report must contain the following information: (i) The Firm Designated ID for any account(s), including subaccount(s), to which executed shares are allocated and the security that has been allocated; (ii) the identifier of the firm reporting the allocation; (iii) the price per share of shares allocated; (iv) the side of shares allocated; (v) the number of shares

        Page 84748

        allocated to each account; and (vi) the time of the allocation.\985\

        ---------------------------------------------------------------------------

        \985\ See CAT NMS Plan, supra note 5, at Section 1.1.

        ---------------------------------------------------------------------------

        The Allocation Report Approach differs from Rule 613 in that under Rule 613(c)(7)(vi)(A), each CAT Reporter would be required to record and report to the Central Repository ``the account number for any subaccounts to which the execution is allocated (in whole or part).'' \986\ Under Rule 613 regulators would be able to link the subaccount to which an allocation was made to a specific order. In contrast, under the Allocation Report Approach, regulators would only be able to link an allocation to the account to which it was made, and not to a specific order.

        ---------------------------------------------------------------------------

        \986\ See 17 CFR 242.613(c)(7)(vi)(A).

        ---------------------------------------------------------------------------

        In the Exemption Request, the Participants represented that, based on discussions with the DAG, broker-dealer systems do not presently link orders with allocations of the resulting executions, and building such functionality would be complex and costly. In addition, the Participants stated that the Allocation Report Approach would not affect the various ways in which, and purposes for which, regulators would use, access, and analyze CAT Data.\987\ The Participants represented that the Allocation Report Approach would still provide regulators with the ability to associate allocations with the Customers that received them and would provide regulators with useful information without imposing undue burden on the industry.\988\ The Participants also stated that they do not believe that this approach would compromise the linking of order events, alter the time and method by which regulators may access the data, or limit the use of the data as described in the use cases contained in the Adopting Release for Rule 613.\989\

        ---------------------------------------------------------------------------

        \987\ See Exemption Request, supra note 21, at 30.

        \988\ See id.

        \989\ Id.; see also Adopting Release, supra note 14, at 45798-

        99.

        ---------------------------------------------------------------------------

        Moreover, the Participants stated that they, along with the industry, believe that linking allocations to specific executions, as mandated by Rule 613, would be artificial and would not otherwise serve a legitimate purpose.\990\ The Participants argued that because the Allocation Report Approach leverages existing business processes instead of creating new workflows, it could help improve the reliability and accuracy of CAT Data as well as reduce the time CAT Reporters need to comply with the CAT reporting requirements.\991\ The Participants also stated that complying with the requirements of Rule 613(c)(7)(vi)(A) would require additional system and process changes which could potentially impact the reliability and accuracy of CAT Data.\992\

        ---------------------------------------------------------------------------

        \990\ See Exemption Request, supra note 21, at 30.

        \991\ Id.

        \992\ Id.

        ---------------------------------------------------------------------------

        Four commenters expressed support for the Allocation Report Approach, noting that the approach would eliminate the need to re-

        engineer systems.\993\ One of the commenters stated that the information reported in an Allocation Report would provide regulators with sufficient information to link allocations through reference information to the Customer that placed the order, but noted that ``there may not always be sufficient linkage information to relate a specific order, execution and allocation for a customer.'' \994\ This commenter argued that it is not possible to link allocations to order lifecycles in the case of many-to-many orders.\995\

        ---------------------------------------------------------------------------

        \993\ See FIF Letter at 75-79; TR Letter at 8; see also DAG Letter at 2; STA Letter at 1 (supporting the DAG Letter's Exemptive Request Letter recommendations).

        \994\ FIF Letter at 78, 90.

        \995\ Id. at 90.

        ---------------------------------------------------------------------------

        One commenter, however, disagreed with the Allocation Report Approach, stating that it would impact the completeness, accessibility and timeliness of CAT Data, and foreseeing challenges in linking the accounts and subaccounts to which an execution is allocated.\996\ This commenter believed that broker-dealers can, and should, track order allocation information, including in the case of many-to-many orders.\997\

        ---------------------------------------------------------------------------

        \996\ Data Boiler Letter at 24-25.

        \997\ Id. at 40.

        ---------------------------------------------------------------------------

        In response to commenters, the Participants restated their belief that the Allocation Report Approach set forth in the CAT NMS Plan appropriately weights the costs and benefits, and that ``linking allocations to executions could show artificial relationships between these order events.'' \998\

        ---------------------------------------------------------------------------

        \998\ Response Letter I at 36-37. The Participants estimated compliance costs related to linking orders to executions to be at least $525 million for the largest broker-dealers. Id.

        ---------------------------------------------------------------------------

        The Commission believes that the Plan's Allocation Report Approach will provide regulators the necessary information to detect abuses in the allocation process without imposing undue burdens on broker-

        dealers. The use of Allocation Reports will provide the Central Repository the ability to efficiently, accurately, and reliably link the subaccount holder to those with authority to trade on behalf of the account, which will ultimately improve regulatory efforts by SROs and the Commission, including market surveillance, market reconstructions, enforcement investigations, and examinations of market participants.\999\ Additionally, by leveraging existing broker-dealer processes, the Plan's Allocation Report Approach could potentially reduce the time CAT Reporters need to comply with CAT reporting requirements and lower costs by using existing business processes.

        ---------------------------------------------------------------------------

        \999\ See April 2015 Supplement, supra note 20 (providing examples of how the Allocation Report would be used to link the subaccount holder to those with authority to trade on behalf of the account).

        ---------------------------------------------------------------------------

        (2) Time of Allocations

        Under the CAT NMS Plan, CAT Reporters would need to submit the time of an allocation on the Allocation Report which, with the exception of Manual Orders, must be at a millisecond level of granularity.\1000\

        ---------------------------------------------------------------------------

        \1000\ See CAT NMS Plan, supra note 5, at Sections 6.4(d)(ii)(A)(1), 6.8(b).

        ---------------------------------------------------------------------------

        Two commenters argued that the time of allocation should be reported with a timestamp granularity of no finer than one second.\1001\ Three commenters asserted that the timestamps should not be required at all as part of the Allocation Report.\1002\ One of those commenters noted that, because allocations are part of the post-trade process, the timing of such allocations is not critical, and requiring timestamps on allocations would represent ``a potentially costly and misleading reporting requirement divorced from the goals of CAT.'' \1003\ Another commenter similarly asserted that requiring a timestamp on allocations would be costly and ``will not assist the SEC in achieving the expected regulatory benefit.'' \1004\ This commenter explained that instructions for allocations can be communicated by phone, fax, or instant messaging or that standing instructions may be maintained for allocations.\1005\ Therefore, the commenter stated, the only consistent point at which to capture a timestamp for an allocation is the time the allocation is booked into an allocation processing system.\1006\

        ---------------------------------------------------------------------------

        \1001\ Id. These commenters also expressed the view that Business Clocks that capture the time of allocation should be subject to a clock synchronization standard of one second. Id.

        \1002\ SIFMA Letter at 35; FIF Letter at 86-90; FSR Letter at 9.

        \1003\ SIFMA Letter at 35.

        \1004\ FIF Letter at 86. In support of its objection to including a timestamp in the Allocation Report, this commenter explained that, to detect wrongdoing in the collection process, one could compare the average execution price on the allocation to the market price when the allocation was submitted. If any subaccount had a total and an average profit and loss far exceeding the average profit and loss for all subaccounts of the advisor, such subaccount could be highlighted. Id.

        \1005\ FIF Letter at 86.

        \1006\ Id. This commenter also provided an analysis of the cost for adding a timestamp on allocations. The cost analysis concluded that the cost to the industry of reporting timestamps on allocations to the millisecond with a clock offset of 50 milliseconds would be $88,775,000. The cost estimate is discussed further in the economic analysis. See Section V.F.3.a(4), infra.

        ---------------------------------------------------------------------------

        Page 84749

        In response, the Participants stated that allocation timestamps would ``be a significant tool for detecting regulatory issues associated with allocations, including allocation fraud,'' and supported requiring them in the Plan.\1007\ However, the Participants stated that the cost of changes that would be necessary to capture timestamps to the millisecond may not be justified, particularly in light of the fact that allocations tend to be a manual process. Therefore, the Participants suggested that Allocation Reports should have timestamps with a one second granularity, as is the case with similar Manual Order Events.\1008\

        ---------------------------------------------------------------------------

        \1007\ Response Letter I at 37.

        \1008\ Id. at 37-38. Similarly, the Participants also suggested that the Plan be amended to permit Industry Members to synchronize their Business Clocks used solely for reporting of the time of allocation to within one second of NIST, instead of 50 milliseconds. Id.

        ---------------------------------------------------------------------------

        The Commission agrees with the Participants that inclusion of the time of an allocation as part of the data submitted in the Allocation Report is reasonable to help detect abuse that may occur if executions are allocated among subaccounts at the same time. For example, the Commission believes that the time of allocation will assist regulators in assessing regulatory issues that might arise in the allocation process, such as ``cherry-picking'' (systematically favoring one customer over another in connection with specific allocation decisions).\1009\ Currently, investigations of potential cherry-picking require a manual, data-intensive process. The Commission believes that having access to data with the time of allocations should improve regulators' ability to spot potential abuses and assess the prevalence of allocation practices industry-wide.\1010\ The Commission also believes that data with the time of allocations could assist in examining whether broker-dealers are making allocations in accordance with their policies and procedures.

        ---------------------------------------------------------------------------

        \1009\ See Notice, supra note 5, at Section I.e(2).

        \1010\ The Commission does not believe that the alternative suggested by one commenter, comparing the average execution price on the allocation to the market price when the allocation was submitted and looking for excess profits and losses, would be nearly as effective, given that the time of the actual allocation would not be available.

        ---------------------------------------------------------------------------

        With regard to the appropriate level of granularity for the timestamps on Allocation Reports, the Commission agrees with the Participants that, given the manual nature of the allocation process, a timestamp granularity of one second is appropriate and would not reduce the regulatory value of the information. The Commission also believes that the clock synchronization standard for Business Clocks that capture the time of an allocation need only be to the second. This approach is consistent with the approach for Manual Order Events. The Commission does not believe that the regulatory benefit of requiring allocation times to be recorded in milliseconds (compared to seconds) and clock synchronization to 50 milliseconds (compared to one second) justifies the costs at this time.\1011\

        ---------------------------------------------------------------------------

        \1011\ As discussed in the economic analysis, the Commission believes that requiring a one-second timestamp instead of a one-

        millisecond timestamp for the allocation on Allocation Reports could save $44 million in implementation costs and $5 million in annual ongoing costs. See Section V.H.5, infra.

        ---------------------------------------------------------------------------

        Accordingly, the Commission is amending Section 6.8(a)(ii) and (b) of the Plan to permit the Business Clocks used solely for the time of allocation on Allocation Reports to be synchronized to no less than within one second of the time maintained by the NIST and the time of allocation on an Allocation Report to the second.

      5. Market Maker Quotes

        Under the CAT NMS Plan, market maker quotations in Listed Options need to be reported as Reportable Events to the Central Repository only by the applicable Options Exchange \1012\ and not by the Options Market Maker.\1013\ However, under the Plan: (1) An Options Market Maker must submit to the relevant Options Exchange, along with any quotation, or any modification or cancellation thereof, the time it sent such message to the Options Exchange (``Quote Sent Time''); and (2) Options Exchanges must submit the Quote Sent Time received from Options Market Makers, along with the applicable message, to the Central Repository without change.\1014\

        ---------------------------------------------------------------------------

        \1012\ As used in the CAT NMS Plan, ``Options Exchange'' means a registered national securities exchange or automated trading facility of a registered securities association that trades Listed Options. See CAT NMS Plan, supra note 5, at Section 1.1.

        \1013\ See CAT NMS Plan, supra note 5, at Section 6.4(d)(iii). As used in the CAT NMS Plan, ``Options Market Maker'' means a broker-dealer registered with an exchange for the purpose of making markets in options contracts traded on the exchange. See id. at Section 1.1.

        \1014\ Id.

        ---------------------------------------------------------------------------

        The requirements for reporting Options Market Maker quotes in the Plan differ from the requirements in Rule 613(c)(7), which provide that the CAT NMS Plan must require each CAT Reporter to record and electronically report to the Central Repository details for each order and each reportable event, including the routing and modification or cancellation of an order.\1015\ Rule 613(j)(8) defines ``order'' to include ``any bid or offer;'' so that the details for each Options Market Maker quotation must be reported to the Central Repository by both the Options Market Maker and the Options Exchange to which it routes its quote.\1016\

        ---------------------------------------------------------------------------

        \1015\ See 17 CFR 242.613(c)(7).

        \1016\ See 17 CFR 242.613(j)(8).

        ---------------------------------------------------------------------------

        In the Exemption Request, the Participants noted that requiring the applicable Options Exchange to report market maker quotations to the Central Repository would not degrade the reliability or accuracy of the CAT Data, or its security and confidentiality.\1017\ Further, the Participants stated that the proposed approach would not have an adverse effect on the ways in which, and purposes for which, regulators would use, access, and analyze the CAT Data.\1018\ The Participants included a cost-benefit analysis of options data reporting approaches in support of the Exemption Request.\1019\ This analysis noted that the volume of options market maker quotes would be larger than any other category of data to be reported to the Central Repository, generating approximately 18 billion daily records, and that requiring duplicative reporting of this large amount of data would lead to a substantial increase in costs.\1020\ The Participants argued in their cost-benefit analysis that eliminating the requirement of Rule 613(c)(7) that both Options Market Makers and Options Exchanges report nearly identical quotation data to the Central Repository would have the potential effect of reducing the projected capacity and other technological requirements of the Central Repository, which could result in significant cost savings.\1021\

        ---------------------------------------------------------------------------

        \1017\ See Exemption Request, supra note 21, at 8.

        \1018\ Id. at 7.

        \1019\ Id. at 6-7.

        \1020\ Id.

        \1021\ Id. at 7.

        ---------------------------------------------------------------------------

        A few commenters expressed support for the provisions of the CAT NMS Plan regarding the reporting of Market Maker Quotations in Listed Options.\1022\ One of these commenters stated that permitting only Option Exchanges to report Options Market Maker quote information, instead of both Options Market Makers and Options Exchanges, would not affect the completeness, timeliness, accuracy, security or confidentiality of CAT Data, and would

        Page 84750

        result in a cost savings.\1023\ One commenter suggested that equities market maker quotes should be handled in the same manner as Options Market Maker quotes.\1024\

        ---------------------------------------------------------------------------

        \1022\ FIF Letter at 62-64; TR Letter at 8; see also DAG Letter at 2; STA Letter at 1 (supporting the DAG Letter's Exemptive Request Letter recommendations).

        \1023\ FIF Letter at 64-65.

        \1024\ Id. at 65-66.

        ---------------------------------------------------------------------------

        Another commenter, however, suggested that providing an exemption to Options Market Makers for reporting Options Market Maker quotes could be ``detrimental to achieving the objective of capturing `complete audit trails' of all the market activities.'' \1025\ The commenter believed that exempting Options Market Makers from reporting their quotes to the CAT risked ``overly discounted/distorted signals'' for market surveillance and manipulation detection purposes.\1026\

        ---------------------------------------------------------------------------

        \1025\ Data Boiler Letter at 25.

        \1026\ Id.

        ---------------------------------------------------------------------------

        In their response, the Participants disagreed that requiring only the Options Exchanges to report market maker quotations to the Central Repository would be detrimental to the CAT.\1027\ The Participants noted that all data that would otherwise be reported by Options Market Makers will still be reported, including Quote Sent Time. The only difference between the requirement under Rule 613 and the approach in the Plan is the reporting party.\1028\

        ---------------------------------------------------------------------------

        \1027\ Response Letter I at 36.

        \1028\ Id.

        ---------------------------------------------------------------------------

        With regard to the commenter that suggested equities market maker quotes should be handled in the same manner as Options Market Maker quotes, the Participants explained that they focused on Options Market Makers because of the significant volume of quotes they produce.\1029\ The Participants stated that the volume of equities market maker quotes is much smaller than the volume of options market maker quotes, noting that there are far fewer quote updates for every trade in the equities markets, with an approximate average ratio of quotes to trades of 18 to 1 in the equities markets as compared to ratio of 8,634 to 1 for options.\1030\

        ---------------------------------------------------------------------------

        \1029\ Id.

        \1030\ Id. (noting that this is an approximation based on the equities SIP data from the Consolidated Tape Association/

        Consolidated Quotation System and UTP Plans from June 2014 to June 2016).

        ---------------------------------------------------------------------------

        The Commission believes the proposed approach is reasonable in providing the same regulatory benefits as would be achieved under Rule 613, at a reduced cost and implementation burden on CAT Reporters. The Commission notes that the information that Options Market Makers report to Options Exchanges must be reported to the Central Repository without change, and the information that regulators would receive if Options Market Makers reported their quotation information to the Central Repository would be identical to the information that they will receive under the requirements of the CAT NMS Plan. Therefore, there will be no degradation to the audit trail. The Commission disagrees with the comment that signals for market surveillance and manipulation detection purposes could be distorted if Options Market Makers are not required to report their quotation information \1031\ because the exact information that the Options Market Makers would report to the CAT will be reported on their behalf by the Options Exchanges. The Commission acknowledges the commenter who recommended that equity market makers also be exempt from reporting their quotes to the CAT, but does not believe that it is appropriate at this time to grant such an exemption. As noted above, equity market makers produce significantly fewer quotes that Options Market Makers, and the Commission has not been presented with evidence that reporting equity market maker quotes is unduly burdensome.\1032\

        ---------------------------------------------------------------------------

        \1031\ Data Boiler Letter at 25.

        \1032\ The Commission notes that, when considering whether to require Options Market Makers to report their quotes to the Central Repository, the Commission was provided a detailed cost analysis of the savings that would result if Options Market Makers were not required to directly report their quote information to the Central Repository.

        ---------------------------------------------------------------------------

      6. Data Elements Not Included in the CAT

        One commenter recommended a re-examination of the data elements to be collected in the CAT NMS Plan, and questioned whether a ``more broad and complete audit trail'' is needed.\1033\ This commenter recommended that the CAT include data on the settlement of securities transactions (i.e., post-execution) from the DTCC and NSCC, short sale information, including lending/borrowing information and pre-execution short sale locate data, and creation/redemption information for Exchange Traded Funds (``ETFs'').\1034\

        ---------------------------------------------------------------------------

        \1033\ Anonymous Letter I at 1, 3; see also Anonymous Letter I at 9-15 (stating that CAT Reporters should include ATSs, internalizers, ELPs, clearing firms, the Depository Trust and Clearing Corporation (``DTCC''), National Securities Clearing Corporation (``NSCC'')).

        \1034\ Anonymous Letter I at 6.

        ---------------------------------------------------------------------------

        In response to the commenter, the Participants described how the CAT NMS Plan aligns with the scope of required elements in Rule 613. The Participants generally expressed their view that the potential benefit of requiring additional elements, such as settlement information, lending/borrowing information, short sale locate data,\1035\ and ETF creation/redemption data,\1036\ would be outweighed by the design and implementation costs at this time.\1037\ The Participants committed generally to assess whether additional information should be reported to the CAT in the future.\1038\

        ---------------------------------------------------------------------------

        \1035\ The Participants noted the definition of Material Terms of the Order includes whether an order is short or short exempt. Response Letter I at 26.

        \1036\ The Participants explained that the processes involved in the ETF creations and redemptions are distinct from those used for transactions in NMS securities, and may involve parties that are not CAT Reporters. Response Letter I at 25-26.

        \1037\ Response Letter I at 26.

        \1038\ Id. at 25.

        ---------------------------------------------------------------------------

        The Commission notes that, with regard to a locate identifier on short sales, data could be readily obtained from a follow-up request to a broker-dealer if the other data required to be reported to the CAT, particularly the information relating to the customer behind the order, is included in the consolidated audit trail. \1039\ With regard to lending/borrowing information, the Commission understands that some of this data can be obtained through private sources, such as service providers. The Participants stated that they do not believe that the benefits of including this information in the CAT justify the costs for requiring them to be reported. The Commission similarly believes that it is not necessary to require this information in CAT. With regard to the inclusion of information on ETF creations and redemptions, the Commission agrees with the Participants that the relevant market participants may not be included in the current scope of CAT Reporters. Therefore, the Commission is not amending the Plan to include these data elements in the CAT at this time. Nor is it amending the Plan to include information on the settlement of securities transactions from DTCC and NSCC in the CAT, as it would require participation by entities not currently party to the CAT NMS Plan, and the regulatory benefits to the Participants and the Commission would not, at this time, justify the costs.

        ---------------------------------------------------------------------------

        \1039\ See Proposing Release, supra note 14, at 32574.

        ---------------------------------------------------------------------------

        The Commission appreciates the commenter's perspective that additional data elements may offer some regulatory benefit. However, neither Rule 613 nor the CAT NMS Plan proposed including such data elements. After considering the comments, the Commission believes that it is reasonable to not mandate the reporting of new data elements to the

        Page 84751

        CAT at this time. The Commission does not believe that the benefits to the Commission and Participants justify the cost for requiring additional data elements to be reported. The Commission or the Participants may consider additional data elements in the future.

        5. Symbology

        The CAT NMS Plan requires CAT Reporters to report data using the listing exchange's symbology. The CAT NMS Plan requires the Plan Processor to create and maintain a symbol history and mapping table, as well as provide a tool for regulators and CAT Reporters showing a security's complete symbol history, along with a start-of-day and end-

        of-day list of reportable securities for use by CAT Reporters.\1040\

        ---------------------------------------------------------------------------

        \1040\ See CAT NMS Plan, supra note 5, at Appendix D, Section 2.

        ---------------------------------------------------------------------------

        Three commenters objected to the Plan requiring listing exchange symbology to be used by CAT Reporters.\1041\ One commenter recommended that CAT Reporters be permitted to use the symbology standard they currently use and that the Central Repository should be responsible for normalizing the various standards.\1042\ The commenter stated that while it does not expect that allowing CAT Reporters to use existing symbology would result in a large cost savings, it believes that use of existing symbology would reduce errors.\1043\

        ---------------------------------------------------------------------------

        \1041\ FIF Letter at 95; Bloomberg Letter at 5-6; Data Boiler Letter at 36 (recommending the use of multiple formats and favoring use of ``existing market practices/processes'').

        \1042\ FIF Letter at 95.

        \1043\ Id. The commenter also requested clarity on what symbology would be used for options. Id. This comment was not addressed by the Participants.

        ---------------------------------------------------------------------------

        Another commenter expressed the view that it would be costly to use the listing exchange's symbology for reporting to the CAT and instead advocated for a standardized nomenclature or symbology across the markets, stating that without a standardized data nomenclature, the integration of a data reporting system and surveillance will be significantly more difficult.\1044\ The commenter suggested use of a uniform, global, open, multi-asset identifier, such as the Financial Instrument Global Identifier (``FIGI''), a product developed by Bloomberg LP.\1045\ The commenter stated that use of a standard with the characteristics of FIGI would simplify cross-asset surveillance, lower error rates and potentially lower symbology licensing costs.\1046\

        ---------------------------------------------------------------------------

        \1044\ Bloomberg Letter at 5.

        \1045\ Id. at 6.

        \1046\ Id.

        ---------------------------------------------------------------------------

        The Participants responded that the Plan required CAT Reporters to submit data to the CAT using the listing exchange symbology based on their understanding of current reporting practices.\1047\ The Participants noted that Industry Members use solutions and systems that allow them to translate symbology into the correct format of the listing exchange when submitting data to exchanges or regulatory reporting systems, such as OATS and Electronic Blue Sheets (``EBS'').\1048\ The Participants further noted that all CAT Reporters subject to OATS or EBS reporting requirements use the symbology of the listing exchange when submitting such reports.\1049\ Accordingly, the Participants did not agree with the comment that advocated adopting a new symbology approach, concluding that it would add significant cost and complexity for the industry.\1050\ The Participants also noted that permitting CAT Reporters to use symbology other than the listing exchange symbology, and having the Plan Processor translate the symbology of different CAT Reporters to the listing exchange symbology, would require each CAT Reporter to submit regular mapping symbology information to the CAT, thereby increasing the complexity and the likelihood for errors in the CAT.\1051\ The Participants stated that the requirement to use exchange symbology is the most efficient, cost-

        effective and least error-prone approach.\1052\ The Participants, however, acknowledged that the Plan Processor may, in the future, determine whether the use of a standardized symbology, other than listing exchange symbology, would be appropriate.\1053\

        ---------------------------------------------------------------------------

        \1047\ Response Letter II at 7.

        \1048\ Response Letter III at 13.

        \1049\ Response Letter II at 7 (citing OATS Reporting Technical Specifications (September 12, 2016), available at http://www.finra.org/sites/default/files/TechSpec_9122016.pdf. (requiring data to be reported using symbol format published by primary listing exchange for listed securities).

        \1050\ Id. The Plan requires the Participants to provide the Plan Processor with issue symbol information, and the Plan Processor to maintain a complete symbology database, including historical symbology. In addition, issue symbol validation must be included in the processing of data submitted by CAT Reporters. See CAT NMS Plan, supra note 5, at Appendix C, Section A.1(a); Appendix D, Section 2.

        \1051\ Id.

        \1052\ Response Letter II at 7.

        \1053\ The Participants noted, based on conversations with the DAG and as noted by one commenter, certain industry messaging formats, such as some exchange binary formats, require symbology other than the primary listing exchange symbology. Id.

        ---------------------------------------------------------------------------

        The Commission believes that the CAT NMS Plan's requirement that CAT Reporters report data using the listing exchange's symbol is reasonable. The Commission agrees with the Participants that allowing each CAT Reporter to determine its reporting symbology would impose burdens on, and add complexity for, the Plan Processor by requiring each CAT Reporter to regularly submit to the Plan Processor symbology mappings. Additionally, the Commission believes that using existing symbology may reduce errors, as noted by the Participants. The Commission also understands, based on the Participants' representations, that CAT Reporters that report to OATS and EBS today already have the ability to translate to the listing exchange's symbology.

        6. Security of CAT Data

        The CAT NMS Plan requires that the Plan Processor develop and, with the prior approval of the Operating Committee, implement, policies, procedures and control structures related to the security of the CAT System.\1054\ Appendices C and D describe the general security requirements for CAT data and outline minimum data security requirements that the Plan Processor must meet.\1055\

        ---------------------------------------------------------------------------

        \1054\ See CAT NMS Plan, supra note 5, at Section 6.1(c); see also Sections III.26 and III.27, supra.

        \1055\ See CAT NMS Plan, supra note 5, at Appendix C and D.

        ---------------------------------------------------------------------------

      7. CAT Information Security Program Details

        Several commenters believed that the CAT NMS Plan did not provide enough details regarding the security and confidentiality of CAT Data. One commenter noted that ``explicit language indicating requirements for overall security of data transmission and storage, rather than suggestions, should be included in the finalized CAT requirements.'' \1056\ Another commenter stated that the Plan does not provide enough granular details related to actual controls, service levels, and technical support that will be implemented by the Plan Processor.\1057\ Similarly, another commenter stated that the CAT NMS Plan lacks proper guidance concerning

        Page 84752

        the requirements for security and confidentiality controls of the CAT System regarding, for example, network security, firewalls, systems management and library controls, IT personnel access to the CAT System and data, system logs and archives.\1058\ One commenter ``urged the SEC to require the SROs to share more detailed information on data loss prevention, business continuity plans and cyber incident response plans as a Plan Processor is selected and the Central Repository is built.'' \1059\ Other commenters suggested that certain market participants be provided another opportunity to provide feedback on the security controls, policies and procedures that will be adopted by the Plan Processor.\1060\ Another commenter supported having an information security officer be responsible for regular updates of the documents and processes, breach identification, and management and processes for periodic penetration tests of all applications.\1061\

        ---------------------------------------------------------------------------

        \1056\ SIFMA Letter at 20; see also ICI Letter at 4 (stating that ``despite the highly sensitive nature of the data captured by the CAT, the proposed CAT NMS plan provides only vague details about the information security provisions for the CAT. . . . We understand that certain details of the plan processor's information security program must remain confidential, but the proposed CAT NMS plan sets too low of a bar for information security'').

        \1057\ FSR Letter at 6; see also TR letter at 8 (seeking clarification on the service levels and liability that will be associated with data transfers between CAT Reporters and the CAT Processor, and how information security will be addressed with customer service staff at the Plan Processor that will assist CAT Reporters with troubleshooting).

        \1058\ FIF Letter at 131-132.

        \1059\ Fidelity Letter at 4.

        \1060\ One commenter, for example, suggested that experts from Industry Members be permitted to review and provide feedback on the security controls, policies and procedures of the Plan Processor. FIF Letter at 130. Another suggested that market participants be provided an opportunity to comment on these important details. Fidelity Letter at 4.

        \1061\ UnaVista Letter at 5.

        ---------------------------------------------------------------------------

        In response to commenters that requested more detail regarding the security controls for CAT Data, the Participants noted that in the Adopting Release for Rule 613, the Commission stated that ``an outline or overview description of the policies and procedures that would be implemented under the NMS plan submitted to the Commission for its consideration would be sufficient to satisfy the requirement of the Rule.'' \1062\ The Participants also reiterated the position of the Commission at the time of adoption of Rule 613 that ``it is important for the NMS plan submitted to the Commission to establish the fundamental framework of these policies and procedures, but recognizes the utility of allowing the plan sponsors flexibility to subsequently delineate them in greater detail with the ability to make modifications as needed.'' \1063\ The Participants noted that Section 6.12 of the CAT NMS Plan requires the Plan Processor to develop and maintain a comprehensive information security program for the Central Repository, to be approved and reviewed at least annually by the Operating Committee.\1064\

        ---------------------------------------------------------------------------

        \1062\ Response Letter I at 53-54 (citing Adopting Release, supra note 14, at 45782).

        \1063\ Response Letter I at 53-54 (citing Adopting Release, supra note 14, at 45782).

        \1064\ Id.

        ---------------------------------------------------------------------------

        The Participants also referred to Appendix D of the Plan, which discusses the fundamental framework of this program, including: (1) Appropriate solutions and controls to ensure data confidentiality and security during all communications between CAT Reporters and Data Submitters and the Plan Processor, data extraction, manipulation and transformation, loading to and from the Central Repository and data maintenance by the CAT System; (2) security controls for data retrieval and query reports by Participants and the SEC; and (3) appropriate tools, logging, auditing and access controls for all components of the CAT System.\1065\ The Participants further noted the Plan provisions addressing: (1) The physical assets and personnel of the CAT; (2) training of all persons who have access to the Central Repository; (3) encryption; (4) remote access to the CAT System; (5) the handling of PII; (6) data storage (including penetration testing and third party audits); (7) access to PII and other CAT Data; breach management; and (8) the minimum industry standards that must be followed by the Plan Processor in developing and implementing the security and confidentiality policies and procedures for the Plan.\1066\ The Participants also provided a high level description of the security requirements for the CAT System, which described the architecture controls, program level controls, and data usage and regulator controls applicable to the CAT.\1067\ Notably, the Participants also stated that they believe that ``publicly releasing too many details about the data security and information policies and procedures of the CAT System presents its own security concerns and is not advisable.'' \1068\

        ---------------------------------------------------------------------------

        \1065\ Response Letter I at 54.

        \1066\ Id.

        \1067\ Id.

        \1068\ Id.

        ---------------------------------------------------------------------------

        The Participants stated that they do not believe that market participants such as experts from Industry Members should be permitted to review and provide feedback on the security controls, policies and procedures of the Plan Processor because each Bidder already has provided information on the various security issues discussed in the Plan and as a result, the Plan Processor will have sufficient information from which to formulate appropriate data security and information policies and procedures.\1069\ The Participants added that data security policies and procedures of the Plan Processor will be subject to the review and approval of the Operating Committee, which will seek the views of the Advisory Committee.\1070\ Therefore, the Participants do not believe that it is necessary to allow Industry Members to separately review the security controls, policies and procedures of the Plan Processor.\1071\

        ---------------------------------------------------------------------------

        \1069\ Response Letter I at 55.

        \1070\ Id.

        \1071\ Id.

        ---------------------------------------------------------------------------

        The Participants also provided additional details concerning certain security controls and protocols required of the Plan Processor. Specifically, the Participants noted that the Plan Processor must establish a penetration testing protocol and that the Participants generally would expect penetration testing to occur following major changes to system architecture (e.g., changes in the network segmentation, major system upgrades, or installation of new management level applications), or when other specific new threats are identified.\1072\ The Participants also provided additional detail clarifying their threat monitoring program and stated that they expect that the Plan Processor will ``adhere to industry practice for an infrastructure initiative such as the CAT, and, therefore, the Plan Processor will provide 24x7 operational monitoring, including monitoring and alerting for any potential security issues across the entire CAT environment.'' \1073\ Related to threat monitoring, the Participants noted that the CISO also is required to establish policies and procedures to address imminent threats.\1074\ Specifically, the Participants stated that they expect the CISO to establish procedures for addressing security threats that require immediate action to prevent security threats to the CAT Data.\1075\

        ---------------------------------------------------------------------------

        \1072\ Response Letter III at 7.

        \1073\ Id.

        \1074\ Response Letter III at 8.

        \1075\ Id.

        ---------------------------------------------------------------------------

        The Commission fully recognizes the importance of maintaining the security of the CAT Data and the need to have sufficient information regarding the policies, procedures and control structures that will be adopted by the Plan Processor that will apply to the security of the CAT Data. The Commission also reiterates its view, as set forth in the Adopting Release and as noted by the Participants in their response, that an outline or overview description of the policies and procedures that would be implemented by the Plan Processor regarding data

        Page 84753

        security satisfies the requirements of Rule 613 and that it is reasonable for additional detail about the controls, policies and procedures applicable to the CAT's information security program to be determined and published after the Plan Processor is selected, including through the CAT's Technical Specifications, which will be publicly available.\1076\ The Commission also shares the concerns articulated by the Participants that publicly releasing too many details about the technical security requirements, tools and techniques of the CAT NMS Plan could invite exploitation. The Commission believes that the CAT NMS Plan must strike a balance between setting out the fundamental framework for the security of the CAT Data while maintaining the ability of the Plan Processor to adopt additional security parameters as it sees fit, some of which the Plan Processor may not want to make public.

        ---------------------------------------------------------------------------

        \1076\ See CAT NMS Plan, supra note 5, at Section 6.9(a).

        ---------------------------------------------------------------------------

        The Commission has considered the security provisions in the CAT NMS Plan and finds that a reasonable level of detail regarding the security and confidentiality controls has been provided in the CAT NMS Plan. However, the Commission expects that the Participants will require the Plan Processor to continuously monitor the information security program of the CAT to ensure that it is consistent with the highest industry standards for the protection of data, and to proactively implement appropriate changes to the security program to guard against any unauthorized intrusions or breaches of the Plan Processor's data security protocols and protections. The Commission also expects that, when the Plan Processor is chosen, the Plan Processor will provide more detail about the specific security requirements and attendant obligations placed on the Participants, including through the issuance of Technical Specifications, which will be publicly available; more explicit language indicating requirements for overall security of data transmission and storage; more granularity related to actual controls and service levels; and more details about the technical support that will be implemented by the Plan Processor. The Commission also notes that, as discussed in Section IV.H, the Commission is amending Section 6.6 of the Plan to require that the Participants provide the Commission with an annual evaluation of the information security program to ensure that the program is consistent with the highest industry standards for the protection of data.\1077\

        ---------------------------------------------------------------------------

        \1077\ See Section IV.H, supra.

        ---------------------------------------------------------------------------

        The Commission also believes that, based on the CAT NMS Plan and the Participants' response, a reasonable level of detail and explicit requirements regarding the overall security of data transmission, storage, service levels, and technical support has been provided.\1078\ Similarly, the Commission believes that the Plan adequately addresses network security, firewalls, systems management, data loss prevention, business continuity plans and cyber incident response plans.\1079\ In response to the commenters that requested that market participants such as experts from Industry Members be permitted to review and provide feedback on the security controls, policies and procedures of the Plan Processor, the Commission believes that such review and feedback is not necessary, particularly in light of input by the Advisory Committee.

        ---------------------------------------------------------------------------

        \1078\ See CAT NMS Plan, supra note 5, at Appendix C, Section A.1(b) (discussing the manner in which the Central Repository will receive, extract, transform, load, and retain data); Section 6.10(c) (discussing the CAT user Help Desk).

        \1079\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4 (Data Security); Section 5 (Business Continuity/Disaster Recovery).

        ---------------------------------------------------------------------------

        In response to the commenter that supported having an information security officer be responsible for regular updates of the documents and processes, breach identification, and management and processes for periodic penetration tests of all applications, the Commission notes that the Plan provides for a CISO who has a broad range of responsibilities regarding the security of the CAT Data.

      8. Security Standards for the CAT System

        Several commenters put forth various industry security standards that should be adopted by the Plan Processor. One commenter stated that if the CAT System operates using a cloud infrastructure, the CAT should employ a cloud provider rated for security via the Cloud Controls Matrix from the Cloud Security Alliance.\1080\ This commenter further recommended that the CAT ``be subject to existing data security and privacy standards like Regulation P Annual Privacy Notice Requirement under the Gramm-Leach-Bliley Act, FISMA Federal Information Security Management Act and FedRAMP Federal Risk and Authorization Management Program.'' \1081\ One commenter stated that steps should be taken to ensure proper controls are in place to protect the data throughout its lifecycle using secure, authenticated and industry-accepted encryption mechanisms.\1082\ Another commenter recommended the use of ``pre-

        defined extract templates and uniform global formats such as ISO International Organization for Standardization 2002.'' \1083\ One commenter stated that at a minimum, connection to CAT infrastructure should be protected by transport layer security/secure sockets layer (``TLS/SSL'') through a secure tunnel.\1084\ Another commenter suggested that the CAT NMS Plan employ the cybersecurity framework developed by NIST and the cybersecurity assessment tool created by the Federal Financial Institutions Examination Council (``FFIEC'').\1085\

        ---------------------------------------------------------------------------

        \1080\ SIFMA Letter at 21.

        \1081\ Id.

        \1082\ FSI Letter at 5 (citing to Government Accountability Office, High-Risk Series: An Update, GAO-15-290 at 235 (Feb. 2016)).

        \1083\ UnaVista Letter at 4.

        \1084\ FIF Letter at 133.

        \1085\ ICI Letter at 5.

        ---------------------------------------------------------------------------

        One commenter noted the need for an ongoing assessment of the risks associated with the CAT System and data to meet the NIST industry standards referenced in the Plan.\1086\ In discussing the confidentiality and sensitivity of CAT Data, a commenter noted that ``the emphasis shouldn't be favoring on sic a particular prescribed standard . . . but the key is: CAT needs independence sic privacy and security assessment at regular intervals. The assessment will include: Vulnerability scan and identifying system nuisances that can cause or already caused privacy and security issues.'' \1087\

        ---------------------------------------------------------------------------

        \1086\ FIF Letter at 130-31.

        \1087\ Data Boiler Letter at 29.

        ---------------------------------------------------------------------------

        With respect to the industry standards applicable to the CAT System, in their response, the Participants noted that at the outset of operation of the CAT, the Plan Processor will adopt all relevant standards from the NIST Cyber Security Framework, NIST 800.53 or ISO 27001 that would be appropriate to apply to the Plan Processor.\1088\ The Participants added that because industry standards may evolve over time, the Participants will require that the CAT's security program align with current industry standards and best practices as they evolve in the future.\1089\ To this end, the Plan requires that the Plan Processor's information security program be reviewed at least annually by the Operating Committee.\1090\

        ---------------------------------------------------------------------------

        \1088\ Response Letter III at 5.

        \1089\ Id.

        \1090\ Id.

        ---------------------------------------------------------------------------

        Regarding security standards applicable to the Participants that access

        Page 84754

        CAT Data, the Participants noted that the Plan requires the Participants to ``establish, maintain and enforce written policies and procedures reasonably designed . . . to ensure the confidentiality of the CAT Data obtained from the Central Repository.'' \1091\ The Participants stated that ``such policies and procedures will be subject to Reg SCI and oversight by the SEC.'' \1092\ Moreover, in their response, the Participants stated that ``in the event that relevant standards evolve, the proposed Plan also requires that ``each Participant shall periodically review the effectiveness of the policies and procedures . . . and take prompt action to remedy deficiencies in such policies and procedures.'' \1093\

        ---------------------------------------------------------------------------

        \1091\ Response Letter III at 8.

        \1092\ Id.

        \1093\ Response Letter III at 8.

        ---------------------------------------------------------------------------

        In response to the commenters that believed that an ongoing assessment of the risks associated with the CAT System and data should meet the NIST standards in the Plan, the Participants stated that they agree that the CAT System should be regularly assessed for security risks,\1094\ and that the Operating Committee must conduct an annual review of the Plan Processor's information security program.\1095\ The Participants further noted that Section 6.2(a)(v)(C) of the Plan provides that the CCO, in collaboration with the CISO, will retain independent third parties with appropriate data security expertise to review and audit on an annual basis the policies, procedures, standards and real-time tools that monitor and address data security issues for the Plan Processor and the Central Repository.\1096\

        ---------------------------------------------------------------------------

        \1094\ Response Letter I at 61.

        \1095\ Response Letter III at 5.

        \1096\ Response Letter I at 61.

        ---------------------------------------------------------------------------

        In response to the commenter that believed that the Plan Processor should be FedRAMP certified, the Participants stated that they do not believe that the Plan Processor should be required to be certified FedRAMP.\1097\ The Participants stated that requiring FedRAMP certification could limit the portions of each cloud provider's solutions that each Bidder may access, while also increasing costs for the CAT. The Participants stated that furthermore, FedRAMP certification itself does not provide for additional security controls beyond those contained in the NIST standards, but rather focuses on providing a certification and evaluation process for government applications.\1098\ Moreover, the Participants believe that the security controls required in the Plan and proposed by the Bidders, as well as those provided by the Bidders' cloud providers, are robust and would not be materially enhanced by requiring them to be FedRAMP certified.\1099\ The Participants also pointed out that regular independent third party audits, as required by the Plan, also would help to ensure the security of the CAT and any cloud solutions in use.\1100\

        ---------------------------------------------------------------------------

        \1097\ Response Letter III at 5.

        \1098\ Response Letter III at 5.

        \1099\ Response Letter III at 5-6.

        \1100\ Id.

        ---------------------------------------------------------------------------

        The Commission notes that Appendix D of the Plan addresses the security standards applicable to the CAT System. Specifically, Section 4.2 of Appendix D of the CAT NMS Plan, as proposed, states that ``the following industry standards, at a minimum, must be followed as such standards and requirements may be replaced by successor publications, or modified, amended, or supplemented and as approved by the Operating Committee (in the event of a conflict between standards, the more stringent standard shall apply, subject to the approval of the Operating Committee).'' \1101\ The Plan then lists several NIST standards (e.g., NIST 800), FFIEC's ``Authentication Best Practices,'' and ISO/IEC 27001's ``Information Security Management. Appendix D, Section 4.2, as proposed, also states that the CAT LLC shall join the Financial Services-Information Sharing and Analysis Center (``FS-

        ISAC'') and comparable bodies as the Operating Committee may determine.

        ---------------------------------------------------------------------------

        \1101\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.2.

        ---------------------------------------------------------------------------

        Moreover, in the Commission's view, the Participants' commitment in their response that, at the outset of the operation of CAT, the Plan Processor will adhere to the relevant standards from the NIST Cyber Security Framework is a reasonable step toward ensuring a robust security information program. At this time, the Commission believes that the NIST Cyber Security Framework provides a reliable and comprehensive approach to cybersecurity risks and threats, and helps to ensure that the Plan Processor will be abiding by appropriately rigorous industry standards to help identify, protect, detect, respond and recover from cyberattacks, whether internal or external, domestic or international. Accordingly, the Commission is amending Appendix D, Section 4.2 of the CAT NMS Plan to add the requirement that Plan Processor will adhere to the NIST Cyber Security Framework in its entirety.\1102\ The Commission believes that adherence to the standards of the NIST Cyber Security Framework provides a reasonable approach to ensuring that security standards applicable to the CAT System will reflect high industry standards regarding the protection of CAT Data.

        ---------------------------------------------------------------------------

        \1102\ The Commission notes that, in contrast to the Participants' response, the Commission is amending the Plan without limitation to only ``relevant standards'' because the Commission believes that the NIST Cyber Security Framework already provides flexibility to ensure only relevant standards apply, and without specific reference to NIST 800-53 or ISO 27001. The Commission also is amending Appendix D, Section 4.2 of the Plan to clarify that the listed industry standards are not intended to be an exclusive list. The Commission believes this amendment is appropriate to clarify that the Participants may adhere to additional industry standards.

        ---------------------------------------------------------------------------

        In light of the Participants' commitment and ongoing requirement to adhere to the NIST Cyber Security Framework--which will address the security of the CAT cloud provided by the Plan Processor--and the limitations that FedRAMP certification might impose on the cloud provider's solutions that each bidder might access should the bidder be chosen as the Plan Processor, the Commission believes that it is reasonable to not require that the Plan Processor be FedRAMP certified. In addition, the Commission believes that it is reasonable to allow the Plan Processor to evaluate whether it should adhere to the data security and privacy standards like Regulation P, FISMA and ISO 2002, and whether the connection to the CAT infrastructure should be protected by TLS/SSL.

        The Commission also notes that in their response, the Participants stated that with respect to partnerships with other private or public organizations and information sharing entities, the Participants do not intend to restrict the CAT LLC's partnership only to the FS-ISAC; the Participants stated that the CAT LLC may seek to join other industry groups such as the National Cyber-Forensic & Training Alliance, the Department of Homeland Security's National Cybersecurity & Communications Integration Center, or other reputable cyber and information security alliances.\1103\ The Commission believes the Participants have appropriately clarified that the provisions in Appendix D, Section 4.2 of the Plan listing the other organizations that the CAT LLC may join was not intended to be an exclusive list because the provision explicitly states that the CAT LLC shall endeavor

        Page 84755

        to join other ``comparable bodies as the Operating Committee may determine.''

        ---------------------------------------------------------------------------

        \1103\ Response Letter III at 6-7.

        ---------------------------------------------------------------------------

      9. CAT User Access Administration

        Many commenters discussed issues related to the administration of CAT users. One commenter stated that ``appropriate policies and procedures should be in place for user access administration, including provisioning of administrators, user data management, password management and audit of user access management.'' \1104\ Another commenter noted the need to train employees and contractors with access to CAT Data on how to maintain the security and confidentiality of the data,\1105\ while another commenter supported the establishment of processes to prevent access to sensitive data by any individuals who have not attended compliance training.\1106\ One commenter stated that persons authorized to access CAT Data should have comprehensive background checks.\1107\

        ---------------------------------------------------------------------------

        \1104\ SIFMA Letter at 21.

        \1105\ ICI Letter at 9.

        \1106\ UnaVista Letter at 4.

        \1107\ FSR Letter at 5; FSI Letter at 5.

        ---------------------------------------------------------------------------

        Other commenters discussed the password authentication procedures in the CAT NMS Plan that are meant to ensure that CAT Data is only accessed by credentialed personnel. One commenter stated that all persons with access to the CAT System should have their access secured via multi-factor authentication as prescribed in OMB Memorandum M-06-

        16.\1108\ Another commenter suggested leveraging any authentication procedures at the entity that employs a person seeking access to CAT Data, stating that this approach would also allow for automated deactivation of users that leave the CAT Reporter or Participant.\1109\

        ---------------------------------------------------------------------------

        \1108\ MFA Letter at 6.

        \1109\ SIFMA Letter at 21. This commenter also generally recommended automatic deactivation for users who do not access CAT for a specified period of time (e.g., 6 months), or whose access is not re-confirmed by the entity who employs the person requesting CAT Data, or whose firm account has been deactivated. Additionally, the commenter stated that email addresses for CAT users should be immutable and should allow for change via administrative review workflow, and shared user IDs should be prohibited. Id.

        ---------------------------------------------------------------------------

        In its response to commenters, the Participants noted the provisions in Appendix D of the Plan that require the Plan Processor to develop and maintain policies and procedures reasonably designed to prevent, detect and mitigate the impact of unauthorized access or usage of data in the Central Repository.\1110\ The Participants further noted that the Plan requires that such policies and procedures include, at a minimum, (1) information barriers governing access to and usage of data in the Central Repository; (2) monitoring processes to detect unauthorized access to or usage of data in the Central Repository; and (3) escalation procedures in the event that unauthorized access to or usage of data is detected.\1111\ The Participants also note that the Plan requires that passwords be stored according to industry best practices and recovered by secure channels, and that all logins will be subject to MFA.\1112\ The Participants further note that the Plan Processor will have discretion to consider additional controls on user access in formulating the data security policies and procedures for the CAT System, including, without limitation, deactivating users who have not accessed the CAT System for a specified period of time.\1113\

        ---------------------------------------------------------------------------

        \1110\ Response Letter I at 55-56.

        \1111\ Id.

        \1112\ The Commission notes that certain provisions of the Plan appeared to require MFA only for access to PII. The Participants clarified in their response letter that MFA is required for all logins. Response Letter III at 6.

        \1113\ Response Letter I at 56.

        ---------------------------------------------------------------------------

        The Commission believes that monitoring the access to CAT to ensure that only authorized persons are allowed to access the CAT System and CAT Data is critical to ensuring the security of CAT Data. The Commission agrees with the Participants that the requirements set out in Appendix D, and other provisions of the CAT NMS Plan, provide a reasonable outline of CAT user access administration (including provisioning of administrators) in general, as well as user data management and password management.\1114\

        ---------------------------------------------------------------------------

        \1114\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.4 (discussing an overview of access to CAT Data).

        ---------------------------------------------------------------------------

        In response to specific commenters that believed that only individuals with appropriate training should be permitted access to CAT Data, Section 6.1(m) of the Plan states that ``the Plan Processor shall develop and, with the prior approval of the Operating Committee, implement a training program, which will be made available to all individuals who have access to the Central Repository on behalf of the Participants or the SEC prior to such individuals being granted access to the Central Repository, that addresses the security and confidentiality of all information accessible from the CAT, as well as the operational risks associated with accessing the Central Repository.'' \1115\ Appendix D of the Plan also states that the Plan Processor must provide to the Operating Committee a comprehensive security plan that covers all components of the CAT System, including physical assets and personnel, and the training of all persons who have access to the Central Repository consistent with Article VI, Section 6.1(m).\1116\ Thus, the Commission believes that these Plan provisions, taken together, indicate that the Plan Processor will require that all persons that have access to CAT Data will be required to complete training prior to accessing CAT Data, and expects that only those persons that have been adequately trained will have access to CAT Data.

        ---------------------------------------------------------------------------

        \1115\ See CAT NMS Plan, supra note 5, at Section 6.1(m).

        \1116\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.

        ---------------------------------------------------------------------------

        In response to the commenter that stated that persons authorized to access CAT Data should have comprehensive background checks, the Commission notes that the Plan provides that ``in addition to other policies, procedures and standards generally applicable to the Plan Processor's employees and contractors, the Plan Processor shall have hiring standards and shall conduct and enforce background checks (e.g., fingerprint-based) for all of its employees and contractors to ensure the protection, safeguarding and security of the facilities, systems, networks, equipment and data of the CAT System. . . .'' \1117\ While the Commission believes that this provision sets out a reasonable approach to background checks for employees and contractors of the Plan Processor, the Commission believes that such a requirement generally should extend to Participants with respect to all of their users that have access to CAT Data and therefore is amending the Plan to require that each Participant conduct background checks for its employees and contractors that will use the CAT System.\1118\ The Commission believes that this amendment to the Plan is appropriate in order to ensure that only authorized and qualified persons are using the CAT System.

        ---------------------------------------------------------------------------

        \1117\ See CAT NMS Plan, supra note 5, at Section 6.1(g).

        \1118\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.4.

        ---------------------------------------------------------------------------

        The Commission also notes that the Participants have represented that all logins must be secured by MFA, in response to commenters concerns that authentication procedures for CAT users should ensure that only credentialed persons are accessing the CAT Data. In addition, in response to commenters that expressed concerns about the password authentication procedures of the Plan Processor, the Commission

        Page 84756

        notes that the Plan addresses password guidelines such as, for example, the appropriate complexity of passwords and the recovery of lost passwords.\1119\ The Commission also believes that the Plan does not prohibit the Plan Processor from considering an approach to authenticating a CAT user that would leverage the authentication procedures at the entity (either a Participant or CAT Reporter) that employs a person seeking access to CAT Data, as suggested by a commenter. The Commission believes these provisions, taken together, provide reasonable protections around CAT user administration.

        ---------------------------------------------------------------------------

        \1119\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.4 (discussing an overview of the CAT password requirements).

        ---------------------------------------------------------------------------

        Finally, with respect to another aspect of CAT user access administration, in their response the Participants noted that they do not believe that memoranda of understanding or similar agreements between the CAT LLC and the Participants are necessary since the Participants will be bound by both their participation in the Plan as well as the agreement between the CAT LLC and the Plan Processor.\1120\ However, the Participants stated they believe that it is important that information regarding CAT Data usage, such as contact points and escalation procedures, be shared between the Plan Processor and the Participants; therefore, the Participants state they expect to establish such information sharing agreements between the Plan Processor and the Participants once the Plan Processor is chosen. Moreover, the Participants stated, they expect that one of the CISO's responsibilities would be to make sure that this information is captured and kept up to date appropriately.\1121\

        ---------------------------------------------------------------------------

        \1120\ Response Letter III at 8.

        \1121\ Response Letter III at 9.

        ---------------------------------------------------------------------------

        The Commission notes that the Plan Processor has not yet been chosen and thus the execution of such memoranda is not appropriate at this time. However, the Commission believes that explicitly memorializing issues relating to CAT Data usage between the Plan Processor and each Participant would be beneficial to the operation of the CAT System.

        The Commission also notes that, with respect to access, the CAT NMS Plan provides that the Plan Processor will provide to the Participants and the Commission access to the Representatives of the Plan Processor as any Participant or the Commission may reasonably request solely for the purpose of performing such Person's regulatory and oversight responsibilities pursuant to the federal securities laws, rules, and regulations or any contractual obligations.\1122\ The Plan also provides that the Plan Processor will direct its Representatives to reasonably cooperate with any inquiry, investigation, or proceeding conducted by or on behalf of any Participant or the Commission related to such purpose.\1123\ As filed, this provision would allow the Plan Processor to refuse access to the Commission and/or Participants upon its own determination of ``unreasonableness.'' The Commission believes that Commission or Participant requests for access to Representatives of the Plan Processor should be considered reasonable, absent other circumstances. It is therefore amending the Plan to delete the requirement that the access to Plan Processor Representatives be ``reasonable'' and that the Representatives of the Plan Processor only be required to ``reasonably'' cooperate with any inquiry, investigation, or proceeding conducted by or on behalf of the Commission. The Commission expects that, even without the ``reasonableness'' qualifier, it and the Participants will be reasonable in requesting access to the Representatives of the Plan Processor.

        ---------------------------------------------------------------------------

        \1122\ See CAT NMS Plan, supra note 5, at Section 6.1(u).

        \1123\ Id.

        ---------------------------------------------------------------------------

      10. Downloading CAT Data By Regulators

        Several commenters discussed the security risks associated with the downloading of CAT Data by regulators. One commenter argued that CAT Data should never be extracted, removed, duplicated, or copied from the CAT, noting that such practices would introduce additional risk and render even the most advanced security measures ineffective.\1124\ Instead, this commenter recommended allowing data to be imported into a CAT query sub-system if surveillance is needed in conjunction with external data.\1125\ Another commenter similarly noted the security risk associated with extracting data from the Central Repository and stated its preference for an approach ``where the data is accessible by the Regulators but the data is not extracted and stored outside the Central Repository, except for extraction of `comparable' data that would facilitate exemption from duplicative reporting and retirement of high priority duplicative systems.'' \1126\ This commenter added ``if combined datasets surveillance is needed (with data external to CAT), the SROs should be allowed to upload external SRO data to a sandbox environment within CAT, in order to enable combined surveillance.'' \1127\

        ---------------------------------------------------------------------------

        \1124\ SIFMA Letter at 20; see also Data Boiler Letter at 26 (stating ``CAT should under ABSOLUTELY NO CIRCUMSTANCE (including BCP/DR) allow anyone the option of to download the `entire' data sets, because this essentially opens a `backdoor' to significant security risk.'').

        \1125\ SIFMA Letter at 20.

        \1126\ FIF Letter at 134.

        \1127\ Id.

        ---------------------------------------------------------------------------

        Another commenter stated that the CAT NMS Plan's provision permitting the Commission and SROs to download entire data sets and analyze the data within the regulator's systems or the regulator's cloud, and the Plan's proposal to allow broker-dealers to ``verify certain data that they have submitted to the CAT,'' represent security risks to CAT Data that the SEC and SROs should avoid.\1128\ This commenter further noted that having multiple points of access to CAT Data, and the ability to download CAT Data, raise ``significant cybersecurity concerns and outweigh the benefit of access to processed CAT Data.'' \1129\ Another commenter believed that CAT Data should remain in the Central Repository, but noted that if the Commission determines to permit the downloading of CAT Data, the CAT NMS Plan should only allow a user to download CAT Data if the information security measures available at the user's site equal or exceed those protecting the data at the Central Repository.\1130\

        ---------------------------------------------------------------------------

        \1128\ Fidelity Letter at 4.

        \1129\ Id.

        \1130\ ICI Letter at 7.

        ---------------------------------------------------------------------------

        In response to commenters, the Participants noted that Rule 613 requires regulators to develop and implement a surveillance system, or enhance existing surveillance systems to make use of CAT Data.\1131\ The Participants stated that regulators should have flexibility in designing such surveillance systems, including the ability to access and transfer data where necessary and consistent with appropriate data security safeguards.\1132\ Such access must be via secure channels (e.g., secure FTP, API or over encrypted lines) as required in the Plan.\1133\ The Participants further noted that the Plan requires that Participants have appropriate policies and procedures in place to protect such data.\1134\ Specifically, the Plan requires that Participants establish, maintain and enforce written policies and procedures reasonably designed to ensure the

        Page 84757

        confidentiality of CAT Data.\1135\ The Participants also stated that they believed that all regulators, including the Commission, should be obligated to establish security measures to protect the security and confidentiality of CAT Data for security purposes.\1136\

        ---------------------------------------------------------------------------

        \1131\ Response Letter I at 56.

        \1132\ Id.

        \1133\ Id.

        \1134\ Id.

        \1135\ Id. (citing to CAT NMS Plan, supra note 5, at Section 6.5(f)(iv)).

        \1136\ Id.

        ---------------------------------------------------------------------------

        The Participants also noted that the CAT NMS Plan requires the Plan Processor to provide regulators with the ability to perform bulk data extraction and download of CAT Data.\1137\ The Participants stated they continue to believe that permitting regulators to download order/

        transaction data from the Central Repository for regulatory use (i.e., ``bulk data extracts'') is important for their regulatory purposes, and that eliminating or limiting bulk data extracts of the CAT Data may significantly and adversely impact the Participants' ability to effectively conduct surveillance of their markets using CAT Data. The Participants stated that they also plan to enrich their existing surveillance using bulk data extracts of CAT Data.\1138\

        ---------------------------------------------------------------------------

        \1137\ Response Letter III at 10 (citing to Appendix D, Section 8.2 (providing that ``the Central Repository must provide for direct queries, bulk extraction, and download of Data for all regulatory users.'')).

        \1138\ Response Letter III at 11.

        ---------------------------------------------------------------------------

        Regarding the security of extracted CAT Data, the Participants stated that they ``recognize the security concerns raised by bulk data extracts and any Participant-controlled systems (e.g., Participant sandboxes residing in the Plan Processor's cloud or a Participant's local system) used to store and analyze such data extracts, but the Participants believe that requiring the Participants to adopt and enforce policies and procedures to address these security issues appropriately addresses these concerns without diminishing the surveillance benefits of the CAT.'' \1139\ The Participants noted that the Plan requires the Participants to ``establish, maintain and enforce written policies and procedures reasonably designed . . . to ensure the confidentiality of the CAT Data obtained from the Central Repository.'' \1140\ Accordingly, the Participants stated that Participants must have policies and procedures reasonably designed to ensure the confidentiality of CAT Data obtained through bulk data extracts and maintained in the Participants' systems.\1141\ In their response, the Participants stated that their own security controls, not those of the Plan Processor, would apply to such systems as they would be outside the Plan Processor's control.\1142\ The Participants' represented that their security controls would be consistent with industry standards, including security protocols that are compliant with Regulation SCI, and the Participants would periodically review the effectiveness of such controls pursuant to their policies and procedures addressing data security.\1143\

        ---------------------------------------------------------------------------

        \1139\ Id.

        \1140\ Id.

        \1141\ Id.

        \1142\ Id.

        \1143\ Id.

        ---------------------------------------------------------------------------

        Regarding the Participants' security controls, the Participants stated that the CISO would be obligated to escalate issues that could represent a security threat to CAT Data.\1144\ For example, the Participants stated that if the CISO observes activity from a CAT Reporter or Participant that suggests that there may be a security threat to the Plan Processor or the Central Repository, then the CISO, in consultation with the CCO, may escalate the matter to the Operating Committee.\1145\ The Participants stated, however, that they do not envision, that ``such policy enforcement by the CISO would involve a regulatory enforcement role with regard to the Participants.'' \1146\ The Participants further stated that ``the Plan does not give the CISO the authority to engage in such regulatory enforcement.\1147\ Moreover, although the Plan permits the Operating Committee to impose fees for late or inaccurate reporting of information to the CAT, it does not authorize the Participants to oversee, or serve enforcement actions against, each other via the Plan Processor. Only the SEC has such authority under the Securities Exchange Act of 1934.'' \1148\

        ---------------------------------------------------------------------------

        \1144\ Response Letter III at 7. Notwithstanding the foregoing example, the Participants noted that the details regarding such an escalation policy will not be determined until the Plan Processor has been selected.

        \1145\ Id.

        \1146\ Response Letter III at 8.

        \1147\ Id.

        \1148\ Id.

        ---------------------------------------------------------------------------

        The Commission believes that ensuring the security and confidentiality of CAT Data is of utmost importance, and also notes the Participants' recognition that regulators should have flexibility in designing such surveillance systems, including the ability to access and transfer data where necessary and consistent with appropriate data security safeguards. As described above, the Plan Processor has the specific responsibility to develop and implement policies, procedures and control structures related to the security of the CAT System.\1149\ The Plan Processor also is responsible for the security and confidentiality of all CAT Data received and reported to the Central Repository, including during all communications between CAT Reporters and the Plan Processor, data extraction, data manipulation and transformation, loading to and from the Central Repository, and data maintenance and storage by the Central Repository.\1150\ The Plan Processor also must require the establishment of secure controls for data retrieval and query reports for CAT Data reported to and stored in the Central Repository.\1151\

        ---------------------------------------------------------------------------

        \1149\ See CAT NMS Plan, supra note 5, at Section 6.1(c).

        \1150\ See id. at Section 6.5(f)(i), (iv).

        \1151\ See id. at Section 6.5(f)(iv).

        ---------------------------------------------------------------------------

        While the Plan Processor is responsible for the security of the CAT Data collected by and stored in the Central Repository, the Commission agrees with commenters that once CAT Data is extracted into a Participant's regulatory surveillance system, the Plan Processor can no longer assure the security of the CAT Data because the details, requirements and rigor of the policies and procedures regarding the security of CAT Data at each Participant are beyond the direct control of the Plan Processor. This is the case whether the CAT Data is downloaded to a Participant's local server, or downloaded into a dedicated sandbox within the CAT cloud--and whether the CAT Data that is downloaded is a subset of all the CAT Data collected by the Central Repository, or the entirety of the CAT Data (i.e., cloning the entire CAT database).

        Therefore, the Commission believes that if a Participant chooses to extract CAT Data, whether into its own local server environment or into its own sandbox within the CAT cloud, the Participant must have policies and procedures regarding CAT Data security that are comparable to those implemented and maintained by the Plan Processor for the Central Repository, and that each Participant must certify and provide evidence to the CISO that its policies and procedures for the security of CAT Data meet the same security standards applicable to the CAT Data that is reported to, and collected and stored by, the Central Repository. Given the necessity of ensuring the security of CAT Data that is collected by and stored in the Central Repository, the Commission believes that this is a reasonable requirement that will ensure that CAT Data is subject to the same standards of security, whether the CAT Data is downloaded by

        Page 84758

        a Participant onto the Participant's local servers, or downloaded into the Participant's sandbox within the CAT cloud,\1152\ and therefore, is amending the plan accordingly.\1153\

        ---------------------------------------------------------------------------

        \1152\ The Commission also notes that each Participant must comply with Regulation SCI. Response Letter III at 8.

        \1153\ See CAT NMS Plan, supra note 5 at Section 6.2(b)(vii).

        ---------------------------------------------------------------------------

        The Commission believes that it is critical to the security of the CAT Data to assign responsibility to the CISO to review the data security policies and procedures of Participants that extract CAT Data into their own systems, whether on a local server or within a sandbox within the CAT cloud, to determine whether such policies and procedures are comparable to the data security policies and procedures applicable to the Central Repository. The Commission further believes that if the CISO, in consultation with the CCO, finds that any such information security policies and procedures of a Participant are not comparable to the policies and procedures applicable to the CAT System, and the issue is not promptly addressed by the applicable Participant, the CISO, in consultation with the CCO, will be required to provide notice of any such deficiency to the Operating Committee.\1154\

        ---------------------------------------------------------------------------

        \1154\ See id.

        ---------------------------------------------------------------------------

      11. Use of CAT Data for Regulatory and Surveillance Purposes

        One commenter stated that access to CAT Data should be restricted to Commission and SRO Staff with regulatory and oversight responsibilities.\1155\ Another commenter stated that the proposed model and timeframe for regulatory access to the reported data is consistent with the Commission's broader regulatory objectives.\1156\ Another commenter noted that access should not be granted to the academic community.\1157\ On the other hand, one commenter believed that aggregated CAT Data should be made available to the public on a limited or time-delayed basis, so as to enable more creative approaches to market surveillance, foster industry collaboration, and augment regulatory efforts.\1158\

        ---------------------------------------------------------------------------

        \1155\ Fidelity Letter at 4.

        \1156\ UnaVista Letter at 4.

        \1157\ MFA Letter at 6.

        \1158\ Data Boiler Letter at 14.

        ---------------------------------------------------------------------------

        The Participants stated that they do not plan to make CAT Data available for use by the public (or academics or other third parties) at this time.\1159\ The Participants noted that there may be certain benefits to this type of expanded access, such as promoting academic evaluations of the economic costs and benefits of regulatory policy.\1160\ Nevertheless, the Participants believed that the privacy and security concerns raised by such public access would outweigh the potential benefits.\1161\ The Participants stated that this conclusion is ``in line with the SEC's statements in the adopting release for SEC Rule 613 that, in light of the privacy and security concerns, `it is premature to require that the NMS plan require the provision of data to third parties.' '' \1162\

        ---------------------------------------------------------------------------

        \1159\ Response Letter I at 44-45.

        \1160\ Id. at 45.

        \1161\ Id.

        \1162\ Id.

        ---------------------------------------------------------------------------

        The Commission agrees with the Participants and believes that it is reasonable to continue to limit access to CAT Data to regulatory authorities for regulatory and surveillance use.\1163\ As previously noted, the CAT is designed to be a regulatory tool. While the Commission recognizes that there may be benefits to expanding the distribution of CAT Data, the Commission also believes that limiting the use of CAT Data for regulatory and surveillance purposes is reasonable at this time, given the vast scope of the CAT Data and need to ensure the security and confidentiality of the CAT Data.\1164\

        ---------------------------------------------------------------------------

        \1163\ Such purposes include, among other things, analysis and reconstruction of market events, market analysis and research to inform policy decisions, market surveillance, examinations, investigations, and other enforcement functions. See supra note 586.

        \1164\ This limitation on the use of CAT Data for regulatory and surveillance purposes does not restrict the ability of a Participant from using the Raw Data that it reports for commercial or other purposes. See Section IV.D.6.k, infra.

        ---------------------------------------------------------------------------

        Although not raised by commenters, the Commission emphasizes that under the Plan the CCO must develop and implement a notification and escalation process to resolve and remediate any alleged non-compliance with the rules of the CAT by a Participant or Industry Member, which shall include appropriate notification and order of escalation to a Participant, the Operating Committee, or the Commission.\1165\ The Commission expects that any additional escalation procedures outlined by the CCO, once the CCO is selected, will adhere to this process.

        ---------------------------------------------------------------------------

        \1165\ See CAT NMS Plan, supra note 5, at Section 6.2(a)(v)(L).

        ---------------------------------------------------------------------------

      12. Regulation SCI

        Several commenters discussed the applicability of Regulation SCI to the Central Repository.\1166\ One commenter stated that because the CAT is an ``SCI System'' and an SCI System of each of the SROs, all obligations associated with Regulation SCI must be complied with by the SROs to ensure the security and integrity of the CAT.\1167\ One commenter stated that Industry Members are not subject to Regulation SCI and the CAT NMS Plan should ``make clear that Regulation SCI would not be expanded to apply to an Industry Members sic by virtue of its reporting requirements under the CAT Plan.'' \1168\ Another commenter stated that because the CAT NMS Plan provides that the Plan Processor must be compliant with Regulation SCI requirements, compliance with Regulation SCI requirements should be ``an explicit evaluation criterion as part of the selection process for the CAT Processor.'' \1169\

        ---------------------------------------------------------------------------

        \1166\ See CAT NMS Plan, supra note 5, at Section 6.9(b)(xi).

        \1167\ SIFMA Letter at 21-22; see also MFA Letter at 4.

        \1168\ FSR Letter at 6. This commenter also noted that the Plan Processor should ensure access to the PII complies with Regulation SCI and any other applicable federal and state privacy laws. Id.

        \1169\ SIFMA Letter at 45.

        ---------------------------------------------------------------------------

        The Participants noted that the Plan Processor will need to satisfy all applicable regulations involving database security, including Regulation SCI, and the Participants have discussed with the Bidders their responsibilities under Regulation SCI on numerous occasions.\1170\ They added they do not believe that it is appropriate that the Plan provide details on how the Plan Processor will ensure that the Central Repository will comply with Regulation SCI.\1171\

        ---------------------------------------------------------------------------

        \1170\ Response Letter I at 58.

        \1171\ Id.

        ---------------------------------------------------------------------------

        The Central Repository, as a facility of each of the Participant SROs, is an SCI Entity \1172\ and the CAT System is an SCI system, and thus it must comply with Regulation SCI.\1173\ The CAT NMS Plan states that data security standards of the CAT System shall, at a minimum, satisfy all applicable regulations regarding database security, including provisions of Regulation SCI.\1174\ The Plan Processor thus must establish, maintain and enforce written policies and procedures reasonably designed to ensure that the CAT System has levels of capacity, integrity, resiliency,

        Page 84759

        availability, and security adequate to maintain its operational capability to comply with Regulation SCI.

        ---------------------------------------------------------------------------

        \1172\ An ``SCI Entity'' means an SCI self-regulatory organization, SCI alternative trading system, plan processor, or exempt clearing agency subject to the Commission's Automated Review Program (``ARP''). 17 CFR 242.1000.

        \1173\ An ``SCI System'' means all computer network, electronic, technical, or automated, or similar systems of, or operated by or on behalf of, an SCI entity that, with respect to securities, directly support trading, clearance and settlement, order routing, market data, market regulation, or market surveillance. 17 CFR 242.1000.

        \1174\ See CAT NMS Plan, supra note 5, at Section 6.9(b)(xi).

        ---------------------------------------------------------------------------

        According to Regulation SCI, the policies and procedures must require: (i) The establishment of reasonable current and future technology infrastructure capacity planning estimates; (ii) periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner; (iii) a program to review and keep current systems development and testing methodology for such systems; (iv) regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters; (v) business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption; (vi) standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and (vii) monitoring of such systems to identify potential SCI events.\1175\ Compliance with Regulation SCI will also require the Plan Processor to periodically review the effectiveness of the policies and procedures and take prompt action to remedy deficiencies in such policies and procedures.\1176\

        ---------------------------------------------------------------------------

        \1175\ 17 CFR 242.1001(a)(2). ``SCI event'' means an event at an SCI entity that constitutes: (1) A systems disruption; (2) a systems compliance issue; or (3) a systems intrusion. 17 CFR 242.1000.

        \1176\ 17 CFR 242.1001(a)(3).

        ---------------------------------------------------------------------------

        For purposes of compliance with Regulation SCI, the Commission has stated that an SCI entity's policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which are required to be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization, although compliance with current SCI industry standards is not the exclusive means to comply with the requirements of Regulation SCI.\1177\ To assist SCI entities in developing policies and procedures consistent with ``current SCI industry standards,'' Staff of the Commission issued Staff Guidance which lists examples of publications describing processes, guidelines, frameworks, or standards that an SCI entity could look to in developing reasonable policies and procedures to comply with Regulation SCI.\1178\ The standards under the Staff Guidance address nine subject areas, including application control; capacity planning; computer operations and production environment controls; contingency planning; information security and networking; audit; outsourcing; physical security; and systems development methodology.\1179\

        ---------------------------------------------------------------------------

        \1177\ 17 CFR 242.1001(a)(4).

        \1178\ See Staff Guidance on Current SCI Standards, issued on November 19, 2014, available at https://www.sec.gov/rules/final/2014/staff-guidance-current-sci-industry-standards.pdf.

        \1179\ Id.

        ---------------------------------------------------------------------------

        The Commission believes that compliance with Regulation SCI will help to reduce the occurrence of systems issues; improve the resiliency of the technological infrastructure when systems problems do occur; and enhance the Commission's oversight of the Central Repository. In response to a concern by a commenter about the potential of the Plan to expand the scope of Regulation SCI, the Commission clarifies that Industry Members will not be subject to Regulation SCI by virtue of reporting audit trail data to the Central Repository. In addition, in response to the commenter that stated that the Participants should use compliance with Regulation SCI as an explicit evaluation criterion as part of the selection process for the CAT Processor, the Commission expects that the Participants will evaluate a Bidder's ability to comply with Regulation SCI as part of its Bidder evaluation process, as compliance with Regulation SCI is an explicit criteria of the CAT NMS Plan.

      13. Physical Security of CAT Systems

        The CAT NMS Plan requires the Plan Processor to provide a solution addressing physical security controls for corporate, data center and any leased facilities where any CAT Data is transmitted or stored.\1180\ One commenter stated that the data centers housing the CAT System must, at a minimum, be SOC 2 certified with such certification annually attested to by a qualified third-party auditor that is not affiliated with the SROs or the Plan Processor.\1181\ The Participants stated that they intended for data centers housing the CAT System to be AICPA SOC 2 certified.\1182\ In addition, the Participants recommended that the auditor provision should be amended to require a qualified third-party auditor that is not an affiliate of any of the Participants or the Plan Processor.\1183\

        ---------------------------------------------------------------------------

        \1180\ See CAT NMS Plan, supra note 5, at Appendix C, Section A.4(a).

        \1181\ SIFMA Letter at 21.

        \1182\ Response Letter I at 58.

        \1183\ Id. at 58-59.

        ---------------------------------------------------------------------------

        The Commission believes that assuring the physical security of the data centers that house the CAT Data, including PII Data, is a critical component of the overall security program and the Commission believes that the Participants' recommendation to amend the standards applicable to ensure the physical security of the CAT System to reflect that it will be AICPA SOC 2 certified and audited by a qualified third-party auditor that is not an affiliate of any Participant or the Plan Processor is reasonable. The Commission therefore is amending the Plan accordingly.\1184\

        ---------------------------------------------------------------------------

        \1184\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.3.

        ---------------------------------------------------------------------------

      14. Encryption of CAT Data

        Commenters discussed the CAT NMS Plan's provisions regarding encryption of CAT Data, including CAT Data that is PII. One commenter stated that the CAT NMS Plan's data encryption requirements alone were not sufficient to protect CAT Data at-rest and PII, and that many more detailed and technical issues must be considered for the encryption requirements for the CAT System and CAT Data to be sufficient.\1185\ The commenter also recommended that the CAT Plan require data to be encrypted both at-rest and in-flight, and that particularly sensitive pieces of data be isolated and compartmentalized.\1186\ Another commenter highlighted specific standards for in-transit data (e.g., asymmetric encryptions and transport layer security), data at-rest (e.g., NIST Special Publication 800-57), and data in-use (e.g., implementing data protection controls such as disclosing intended use and duration).\1187\

        ---------------------------------------------------------------------------

        \1185\ MFA Letter at 8.

        \1186\ Id.; see also SIFMA Letter at 20-21 (stating that ``the CAT Processor should employ strong, evolving encryption and decryption standards that are continuously updated to meet the most stringent data encryption requirements possible'').

        \1187\ FSR Letter at 5-6; see also FIF Letter at 125 (suggesting that if given the option WORM (write once, read man) technology may be convenient and cost effective).

        ---------------------------------------------------------------------------

        One commenter requested that Section 4.1.2 of Appendix D of the Plan, which addresses the encryption of CAT Data, be amended to make clear that the monitoring, alerting, auditing, and any other requirements that apply with

        Page 84760

        respect to CAT Data also apply to archival CAT Data.\1188\ Another commenter opined that the encryption and decryption standards used by the Plan Processor should be continuously updated to meet the most stringent data encryption requirements possible, and designed to support end-to-end data encryption, with data decrypted at the desktop level.\1189\

        ---------------------------------------------------------------------------

        \1188\ MFA Letter at 8.

        \1189\ SIFMA Letter at 20-21.

        ---------------------------------------------------------------------------

        Commenters also focused on the particular necessity of encrypting PII, both when in-transit and at-rest, to ensure it remains secure and confidential.\1190\ One commenter noted the CAT NMS Plan's requirement that CAT Data provided to regulators that contains PII be ``masked,'' \1191\ and stated that PII should be masked unless users have permission to view the PII contained in the CAT Data that has been requested,\1192\ while another commenter believed that clarification is needed regarding the meaning of ``masked'' under the CAT NMS Plan.\1193\

        ---------------------------------------------------------------------------

        \1190\ FSR Letter at 5; MFA Letter at 8 (also stating that ``strong encryption should be at the heart of the CAT NMS Plan's efforts to protect data'').

        \1191\ FSR Letter at 4; see also CAT NMS Plan, supra note 5, at Section 6.10(c)(ii).

        \1192\ Id.

        \1193\ FIF Letter at 135.

        ---------------------------------------------------------------------------

        The Participants stated that ``given that all three remaining bidders propose cloud based solutions, all data will be encrypted in-

        flight and at-rest.'' \1194\

        ---------------------------------------------------------------------------

        \1194\ Response Letter III at 5. The Commission notes that as filed, the CAT NMS Plan had stated that all CAT Data must be encrypted in-flight using industry best practices, and that PII must be encrypted both at-rest and in-flight; storage of unencrypted PII is not permissible; and non-PII CAT Data stored in a Plan Processor private environment is not required to be encrypted at-rest. See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.2; see also Response Letter I at 57.

        ---------------------------------------------------------------------------

        The Commission notes that the CAT NMS Plan requires the Plan Processor to describe how PII encryption is performed and the key management strategy. The CAT NMS Plan also requires that PII encryption methods include a secure documented key management strategy such as the use of HSM(s).

        The Commission agrees with commenters that encryption of CAT Data is a necessary and critically important means of protecting CAT Data, including PII. Therefore, given the role that encryption plays in maintaining the security of CAT Data, the Commission believes that all CAT Data must be encrypted and is amending the Plan accordingly.\1195\

        ---------------------------------------------------------------------------

        \1195\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.2.

        ---------------------------------------------------------------------------

        In response to the commenter that believed that encryption alone was not sufficient to protect CAT Data at-rest and PII, the Commission notes that the CAT NMS Plan provides several means of protecting CAT Data in addition to encryption, including provisions addressing connectivity and data transfer requirements, parameters for the storage of CAT Data in general, and PII in particular, and limitations on access to CAT Data by authorized users only. In addition, the Plan states that the Technical Specifications, which will be published one year before Industry Members must report CAT Data to the Central Repository, will include more details about the data security for CAT.\1196\ Thus, in response to the commenter that believed that more detailed and technical issues must be considered for the encryption requirements for the CAT System and CAT Data to be sufficient, the Commission believes that preparation and publication of the Technical Specifications referenced above commits the Participants to undertaking an analysis of security requirements, in addition to and as a supplement to, the existing encryption requirements. With respect to the issues raised by the commenter regarding the specific standards for in-transit data (including asymmetric encryptions and transport layer security), data at-rest (e.g., NIST Special Publication 800-57), and data in-use (e.g., implementing data protection controls such as disclosing intended use and duration), the Commission notes that, as amended by the Commission, the Plan requires the Participants to adhere to all relevant standards in the NIST Cyber Security Framework, which includes standards regarding encryption.\1197\

        ---------------------------------------------------------------------------

        \1196\ Id. at Section 6.9(b)(xi).

        \1197\ Response Letter III at 8.

        ---------------------------------------------------------------------------

        In response to the commenter that stated that encryption and decryption standards used by the Plan Processor should be continuously updated to meet the most stringent data encryption requirements possible, the Commission notes that the CAT NMS Plan provides that all CAT Data must be encrypted in-flight and at-rest using industry standard best practices, and that such industry standards may be replaced by successor publications, or modified, amended, or supplemented as approved by the Operating Committee.\1198\

        ---------------------------------------------------------------------------

        \1198\ See CAT NMS Plan, supra note 5, at Appendix D, Sections 4.1.2 and 4.2.

        ---------------------------------------------------------------------------

        In response to commenters that discussed the need that PII be ``masked,'' the Commission notes that the CAT NMS Plan mandates that all CAT Data that is returned in response to a regulatory inquiry will be encrypted, and that PII data returned shall be masked unless users have permission to view the CAT Data that has been requested.\1199\ The Commission believes that this requirement adds an additional, reasonable requirement that protects PII from view, unless the person seeking PII is authorized to view the PII.

        ---------------------------------------------------------------------------

        \1199\ Id. at Section 6.10(c).

        ---------------------------------------------------------------------------

      15. Connectivity

        One commenter stated that accessing the CAT System must be done via secure methods, that the SROs should consider mandating the usage of private lines rather than encrypted internet connectivity, and that the CAT Processor's systems should be air-gapped from the internet, thereby eliminating access to the internet and/or any internal non-CAT systems used by the Plan Processor.\1200\

        ---------------------------------------------------------------------------

        \1200\ SIFMA Letter at 20.

        ---------------------------------------------------------------------------

        With respect to using private lines to connect to the CAT, the Participants stated that the Plan does not require CAT Reporters to use private lines to connect to the CAT due to cost concerns, particularly for smaller broker-dealers.\1201\ Noting that the Plan requires that CAT Reporters access the CAT via a secure, encrypted connection, the Participants also cited to Appendix D which states that ``CAT Reporters must connect to the CAT infrastructure using secure methods such as private lines or (for smaller broker-dealers) Virtual Private Network connection over public lines.'' \1202\

        ---------------------------------------------------------------------------

        \1201\ Response Letter III at 6.

        \1202\ Id.

        ---------------------------------------------------------------------------

        The Participants noted that pursuant to the Bidders' solutions, the core CAT architecture would not be accessible via the public internet.\1203\ The Participants cited to Appendix D, Section 4.1.1 of the Plan, which states that ``the CAT databases must be deployed within the network infrastructure so that they are not directly accessible from external end-user networks. If public cloud infrastructures are used, Virtual Private Networking and firewalls/

        access control lists or equivalent controls such as private network segments or private tenant segmentation must be used to isolate CAT Data from unauthenticated public access.'' \1204\

        ---------------------------------------------------------------------------

        \1203\ Id.

        \1204\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.1.

        ---------------------------------------------------------------------------

        The Commission believes that the CAT NMS Plan's provisions regarding connectivity to the Central Repository reflect a reasonable approach to ensuring secure access to the CAT Data residing within the Central Repository. The Commission believes that leaving

        Page 84761

        the option for connection via Virtual Private Network for smaller broker-dealers is reasonable, given the potential cost of mandating use of a private line. The Commission also believes that prohibiting access to the CAT System via the public internet is appropriate, given the potential risk to the security of the CAT Data residing in the Central Repository that might be caused by allowing direct access into the CAT using an unsecure method by unauthenticated users.

      16. Breach of CAT Security

        Commenters also discussed the appropriate action to be taken in the event of a security breach. One commenter recommended that the Commission define a ``reportable incident'' that would trigger implementation of the cyber incident report plan.\1205\ Three commenters recommended that the CAT NMS Plan's cyber incident report plan include notification procedures in the event of a cyber incident.\1206\ One commenter specifically stated that the Plan should require that notice of an incident be provided to the Operating Committee, affected broker-dealers, other market participants and law enforcement within a designated period of time (e.g., 24 hours).\1207\ Another commenter agreed, noting that the Plan should provide a clear mechanism for promptly notifying all victims of a CAT data breach, including Customers.\1208\ Similarly, another commenter recommended that the Plan Processor ``release a protocol document describing the specific procedures it will take upon a breach of CAT, including the procedure for notifying Participants and allowing them to suspend CAT submissions temporarily in the event of an ongoing breach.'' \1209\ This commenter also requested that the data security plan include a process for reviewing data incidents to determine what corrective actions are required to reduce the likelihood of recurrence.\1210\

        ---------------------------------------------------------------------------

        \1205\ MFA Letter at 8. This commenter also suggested that the Plan Processor adopt a ``bug bounty program'' which awards individuals who report software bugs. Id.

        \1206\ SIFMA Letter at 21; ICI Letter at 8; FSI Letter at 4.

        \1207\ SIFMA Letter at 21.

        \1208\ ICI Letter at 8; see also FSI Letter at 4 (recommending that investors be notified of a breach).

        \1209\ FSI Letter at 4.

        \1210\ Id.

        ---------------------------------------------------------------------------

        Some commenters discussed who should bear the cost of a data breach. One commenter stated that Industry Members should not bear the cost of a security breach that occurs on the systems of the Commission, the Participants, the Plan Processor, Central Repository, or ``in-

        transit'' amongst the various parties.\1211\ Another commenter recommended that the CAT Processor, the SROs, and the Commission indemnify the broker-dealers from any and all liability in the event of a breach that is in no part the fault of the broker-dealers.\1212\ Two commenters added that CAT NMS, LLC should purchase an insurance policy that covers potential breaches and extends to Industry Members and their obligations vis-agrave-vis their clients whose CAT Data is required to be reported by the CAT Plan.\1213\

        ---------------------------------------------------------------------------

        \1211\ FSR Letter at 8.

        \1212\ SIFMA Letter at 22; see also FSI Letter at 5 (suggesting that the Plan Processor should bear responsibility in the event of a data breach and that the Plan Processor should expressly indemnify Participants for any costs or damages incurred as a result of a data breach occurring after they have provided data to the CAT).

        \1213\ FSR Letter at 8; see also SIFMA Letter at 22.

        ---------------------------------------------------------------------------

        In response to commenters, the Participants noted that the Plan Processor is required to work with the Operating Committee to develop a breach protocol in accordance with industry practices.\1214\ However, the Participants also stated that they believe that providing more details on these processes or procedures raises security issues.\1215\ Moreover, the Participants noted, the CAT System will be subject to applicable regulations involving database security, including Regulation SCI and its requirement to provide notice to the Commission and to disseminate information about SCI Events to affected CAT Reporters.\1216\

        ---------------------------------------------------------------------------

        \1214\ Response Letter I at 58.

        \1215\ Id.

        \1216\ Id.

        ---------------------------------------------------------------------------

        With respect to breaches of the CAT System and the accompanying protocols for dealing with breaches, the Commission notes that the CAT NMS Plan provides that the Plan Processor must develop policies and procedures governing its responses to systems or data breaches,\1217\ and the Participants added that the Plan Processor will work with the Operating Committee to develop a breach protocol in accordance with industry practices.\1218\ According to the CAT NMS Plan, such policies and procedures will include a formal cyber incident response plan and documentation of all information relevant to breaches.\1219\ The cyber incident response plan will provide guidance and direction during security incidents, and may include items such as guidance on crisis communications; security and forensic procedures; Customer notifications; ``playbook'' or quick reference guides that allow responders quick access to key information; insurance against security breaches; retention of legal counsel with data privacy and protection expertise; and retention of a public relations firm to manage media coverage.\1220\ The CAT NMS Plan further provides that documentation of information relevant to breaches should include a chronological timeline of events from the breach throughout the duration of the investigation; relevant information related to the breach (e.g., date discovered, who made the discovery, and details of the breach); response efforts, involvement of third parties, summary of meetings/

        conference calls, and communication; and the impact of the breach, including an assessment of data accessed during the breach and impact on CAT Reporters.\1221\

        ---------------------------------------------------------------------------

        \1217\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.5.

        \1218\ Response Letter I at 58.

        \1219\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.5.

        \1220\ Id.

        \1221\ Id.

        ---------------------------------------------------------------------------

        In response to commenters that requested additional detail about the CAT NMS Plan breach management protocol, such as the definition of a ``reportable incident,'' the Commission notes that the Plan requires the Plan Processor to develop policies and procedures to govern its responses to systems or data breaches and the Commission expects the definition of a ``reportable incident'' will be clearly set forth in those policies and procedures. While the Plan does not explicitly require it, in response to the commenter that requested that notice of a breach be provided to the Operating Committee, the Commission expects that the CAT NMS Plan's cyber incident response plan will incorporate notice of the breach to the Operating Committee, because the Operating Committee is the body that manages the CAT LLC. As a Regulation SCI System, the Plan Processor must also notify the Commission in the event of an SCI Event.\1222\

        ---------------------------------------------------------------------------

        \1222\ Pursuant to Regulation SCI, the Commission must be notified within 24 hours of an SCI Event. See 17 CFR 242.1002(b).

        ---------------------------------------------------------------------------

        As for commenters that opined on the other parties that should be notified upon a breach, including affected parties such as Customers, the Commission notes that the Plan explicitly requires customer notifications to be included in the cyber incident response plan, and that the cyber incident response plan may list other market participants that will be notified upon a breach of the CAT System and the procedure for notifying

        Page 84762

        relevant participants of the breach.\1223\ In response to the commenter that requested that the breach protocol include a process for reviewing ``data incidents'' to determine what corrective actions are required to reduce the likelihood of recurrence, the Commission notes that the Plan requires that the impact of the breach be assessed, and the Commission expects that such assessment will also help identify the corrective actions that must be taken to reduce the likelihood of recurrence.

        ---------------------------------------------------------------------------

        \1223\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.5.

        ---------------------------------------------------------------------------

        In response to the several commenters that discussed issues surrounding the cost of a breach, including which parties should bear the cost of a breach, and whether the Plan Processor, the Participants and the Commission should indemnify the broker-dealers from all liability in the event of a breach that is no fault of the broker, the Commission notes that the Plan requires that the Plan Processor's cyber incident response plan must address insurance issues related to security breaches and that as part of the discussions on insurance coverage and liability, further detail about the distribution of costs will be undertaken. The Commission believes that it is reasonable to require, at this stage, that the cyber incident response plan outline the key areas of breach management that must be addressed by the Plan Processor; further details on the breach management protocols, including details about who might bear the cost of a breach and under what specific circumstances, will follow once the Plan Processor is selected.

      17. Use of Raw Data for Commercial or Other Purposes

        Commenters also discussed the CAT NMS Plan's provision permitting a Participant to use the Raw Data \1224\ it reports for commercial or other purposes as long as such use is not prohibited by applicable law, rule or regulation.\1225\ One commenter believed that the Plan should be amended to state specifically when a Participant may--or more importantly, according to the commenter, may not--use Raw Data or CAT Data for commercial purposes.\1226\ This commenter also noted inconsistencies in the Participants' commercial use of data.\1227\ Specifically, the commenter noted that Section 6.5(f)(i)(A) of the Plan states that each SRO may use ``the CAT Data it reports to the Central Repository for regulatory, surveillance, commercial or other purposes as permitted by applicable law, rule or regulation,'' and Section 6.5(h) permits a Participant to ``use the Raw Data it reports to the Central Repository for regulatory, surveillance, commercial or other purposes as otherwise not prohibited by applicable law, rule or regulation.'' \1228\ Another commenter stated that the CAT NMS Plan should be amended to clarify that Participants may not use data stored in the Central Repository--beyond the data that the SROs submit to the CAT--for their own commercial purposes.\1229\ One commenter provided two recommendations designed to ensure that Participants do not use the CAT NMS Plan to ``enlarge the scope of data that they commercialize.'' \1230\ First, the commenter believed that the Plan should specify that no Participant may commercialize customer identifying information, regardless of whether applicable law expressly prohibits its commercialization. Second, the Plan should limit the scope of data subject to commercialization by narrowing the definition of Raw Data to include only data that a Participant must report under Rule 613 or the Plan.\1231\

        ---------------------------------------------------------------------------

        \1224\ ``Raw Data'' means Participant Data and Industry Member Data that has not been through any validation or otherwise checked by the CAT System. See CAT NMS Plan, supra note 5, at Section 1.1. The Commission notes that the Section 6.5(h) of the CAT NMS Plan also limits the use by a Participant of the Raw Data that the Participant has reported to the Central Repository; a Participant may not use the Raw Data reported by another Participant.

        \1225\ ICI Letter at 10; SIFMA Letter at 31.

        \1226\ SIFMA Letter at 31.

        \1227\ Id.

        \1228\ Id.

        \1229\ KCG Letter at 9.

        \1230\ ICI Letter at 10.

        \1231\ Id.

        ---------------------------------------------------------------------------

        In response to commenters, the Participants stated that they continue to believe that it is appropriate for the CAT NMS Plan to permit the Participants to use their Raw Data for commercial or other purposes.\1232\ Therefore, the Participants do not propose to prohibit such use.\1233\ Nevertheless, to address the concern raised by a commenter that the CAT NMS Plan inconsistently uses the terms ``Raw Data'' and ``CAT Data'' in Sections 6.5(f)(i)(A) Section 6.5(h) of the CAT NMS Plan, the Participants recommended that the term ``Raw Data'' replace the term ``CAT Data'' in Section 6.5(f)(i)(A) of the Plan.\1234\

        ---------------------------------------------------------------------------

        \1232\ Response Letter I at 43.

        \1233\ Id.

        \1234\ Id.

        ---------------------------------------------------------------------------

        As an initial matter, the Commission finds that it is reasonable to amend the Plan to replace the term ``CAT Data'' with ``Raw Data'' in Section 6.5(f)(i)(A) of the Plan, to remove any inconsistency and potential confusion. The Commission also finds that the CAT NMS Plan's provisions regarding the use of Raw Data by a Participant is a reasonable approach to the use of audit trail data that is reported by the Participant itself. In response to the commenter's request that the Commission define the circumstances under which a Participant cannot use its Raw Data, the Commission finds that the CAT NMS Plan's provision that the use must not be prohibited by applicable law, rule or regulation is sufficient guidance to Participants regarding their use of the Raw Data used for commercial or other purposes.\1235\ Similarly, the Commission believes that the CAT NMS Plan's definition of ``Raw Data'' is sufficiently clear and further addresses the comments that the Participants may expand the audit trail data that Participants may use for commercial or other purposes. The Commission notes that the CAT NMS Plan's definition of ``Raw Data'' limits such data to ``Participant Data'' or ``Industry Member Data.'' \1236\ In this regard, in response to the commenter with concerns about a Participant commercializing customer identifying information, the Commission notes that a Participant would never be in a position to report customer identifying information itself; therefore, a Participant could not use customer identifying information for commercial or other purposes. The Commission also believes that, pursuant to the CAT NMS Plan, the Participants may not use CAT Data for commercial purposes.

        ---------------------------------------------------------------------------

        \1235\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(i)(A).

        \1236\ See id. at Section 1.1.

        ---------------------------------------------------------------------------

      18. Ownership of CAT Data

        Several commenters discussed the ownership of CAT Data. Two commenters believed that the CAT NMS Plan should be amended to indicate that broker-dealers retain ownership rights in all of the data they report to the CAT.\1237\ In response to commenters, Participants stated that Rule 613 does not address broker-dealer CAT Reporters' ownership rights with respect to the CAT Data, and the Participants do not believe that it is appropriate to address such ownership rights in the Plan.\1238\

        ---------------------------------------------------------------------------

        \1237\ SIFMA Letter at 30; KCG Letter at 7-8.

        \1238\ Response Letter I at 44.

        ---------------------------------------------------------------------------

        The Commission believes that it is reasonable for the CAT NMS Plan not to address ownership rights to the data that broker-dealers report to the Central Repository. The resolution of legal questions regarding ownership rights to the data that is reported to the Central

        Page 84763

        Repository by broker-dealers is not required by Rule 613; is outside the scope of Rule 613; and is not necessary to find that the Plan meets the approval standard of Rule 608.

      19. Bulk Access to an Industry Member's CAT Data

        A few commenters discussed whether Industry Members should be permitted access to their own reported audit trail data through bulk data exports. One commenter stated that it ``would be highly beneficial for CAT Reporters to have access to their own data'' to assist with error identification and correction, and stressed the importance of building such access into CAT as part of the initial design, even if CAT Reporters were not permitted such access during the initial phase of CAT.\1239\ To address security concerns, the commenter suggested that retrieval of PII data should be limited to a set of CAT Reporter personnel who are responsible for entering and correcting customer information.\1240\ Another commenter noted that broker-dealers should be permitted to access, export and use their data within the Central Repository at no charge and that ``allowing broker-dealers to access their own data will be beneficial for surveillance and internal compliance programs and may incentivize firms to make other internal improvements including, among other things, reducing potential errors.'' \1241\ This commenter also argued that broker-dealers should not be subject to additional fees to simply retrieve data they already submitted to the CAT, noting that CAT is the only broker-dealer regulatory reporting service for which the SROs have proposed to impose system-specific fees on broker-dealers.'' \1242\ Another commenter stated that ``allowing CAT Reporters to access their own data would be beneficial for surveillance and internal compliance programs. If data access is considered as part of the initial design of the Central Repository, we believe the benefits outweigh the cost.'' \1243\ One commenter argued that independent software vendors also should have fair, reasonable, and non-discriminatory access, at their client's request, to the data submitted or stored at the Central Repository on their client's behalf.\1244\ In support, this commenter noted that OATS permitted access to determine reporting accuracy by ``matching in both directions,'' so that reporters could address matching errors.\1245\

        ---------------------------------------------------------------------------

        \1239\ FIF Letter at 61.

        \1240\ Id.

        \1241\ SIFMA Letter at 30. In this regard, this commenter noted that broker-dealers could use their CAT reported data to run complex searches and generate reports to (1) meet their regulatory surveillance requirements; (2) conduct best execution analysis; and (3) conduct transaction costs analysis. Id.

        \1242\ Id.; see also KCG Letter at 7.

        \1243\ TR Letter at 8.

        \1244\ Bloomberg Letter at 7.

        \1245\ Id. (noting further that independent software vendors could build sophisticated analytics to aid this).

        ---------------------------------------------------------------------------

        In response to these comments, the Participants noted that during the development of the Plan, the SROs considered whether to provide Industry Members with access to their own data through bulk data exports.\1246\ Based on the data security and cost considerations, the Participants stated that they determined that such access was not a cost-effective requirement for the CAT.\1247\ Accordingly, the CAT NMS Plan was drafted to state that ``non-Participant CAT Reporters will be able to view their submissions online in a read-only, non-exportable format to facilitate error identification and correction.'' \1248\

        ---------------------------------------------------------------------------

        \1246\ Response Letter I at 44.

        \1247\ Id.

        \1248\ See CAT NMS Plan, supra note 5, at Appendix D, Section 10.1.

        ---------------------------------------------------------------------------

        In light of the comments that the Commission received and further evaluation of the issue, however, in their response, the Participants stated that they now believe that there may be merit to providing Industry Members and their vendors with bulk access to the CAT Reporters' own unlinked CAT Data.\1249\ For example, the Participants stated that such access may facilitate the CAT Reporters' error analysis and internal surveillance and that it may expedite the retirement of duplicative reporting systems.\1250\ However, the Participants noted, providing bulk data access also raises a variety of operational, security, cost and other issues related to the CAT.\1251\ The Participants stated that they would need to address this additional functionality with the Plan Processor; in addition, the Participants stated that inclusion of this functionality would create additional burdens on the CAT and the Plan Processor and, therefore, may require additional funding from CAT Reporters for such access to the CAT Data.\1252\ Therefore, the Participants stated that they will consider this issue once the CAT is operational.\1253\

        ---------------------------------------------------------------------------

        \1249\ Response Letter I at 44.

        \1250\ Id.

        \1251\ Id.

        \1252\ Id.

        \1253\ Id.

        ---------------------------------------------------------------------------

        The Commission recognizes the commenters' desire for bulk access to their own data for surveillance and internal compliance purposes, as well as possible error correction purposes. The Commission also recognizes the Participants' initial approach of not permitting such access for security and cost purposes, as set forth in their response. Given the complexity of initially implementing the CAT, the Commission believes that the Participants' approach that limits Industry Members to only being able to view their submissions online in a read-only, non-exportable format to facilitate error identification and correction is a reasonable approach at the present time. The Commission notes the Participants' representation that they will consider offering bulk access to the audit trail data reported by Industry Members once CAT is operational. The Commission expects the Participants to fulfill this commitment and as part of their evaluation, the Commission expects that the Participants may consider whether a fee for such access would be appropriate and how such a fee might impact the funding of the CAT.\1254\

        ---------------------------------------------------------------------------

        \1254\ The Commission preliminarily believes that if the Participants decide to provide access to broker-dealer CAT Reporters, an amendment to the CAT Plan would be required as this would expand the Plan's restriction that CAT Data only be used by Participants for regulatory and surveillance purposes. See CAT NMS Plan, supra note 5, at Section 6.5(h).

        ---------------------------------------------------------------------------

        The Commission disagrees with the commenters that recommended providing access to CAT Data for independent software vendors.\1255\ Given the highly sensitive nature of the CAT Data, the Commission believes that it is reasonable to not allow access to parties other than the SROs and the Commission. If the Participants decide to propose granting such access after gaining experience with CAT operations, and are able to ensure the security of data, the Commission will consider, based on the analysis presented, whether granting access to CAT Reporters and other non-regulator industry members is reasonable.

        ---------------------------------------------------------------------------

        \1255\ Bloomberg Letter at 7.

        ---------------------------------------------------------------------------

        The Commission also notes that, as discussed in Section IV.H, the Commission is amending Section 6.6 of the Plan to require that, within 24 months of effectiveness of the Plan, the Participants provide the Commission with a report discussing the feasibility, benefits, and risks of allowing an Industry Member to bulk download the Raw Data it submitted to the Central Repository.\1256\

        ---------------------------------------------------------------------------

        \1256\ See Section IV.H, supra.

        ---------------------------------------------------------------------------

      20. Regulator Use Cases

        One commenter noted that the Plan does not provide any details on how

        Page 84764

        regulators will be able to perform their day-to-day analysis using CAT Data.\1257\ Specifically, this commenter analyzed the limitations of the CAT NMS Plan in light of the regulator use cases (``Regulator Use Cases'') contained in the Adopting Release, which provided further detail about how regulators envisioned using, accessing, and analyzing audit trail data under CAT.\1258\ This commenter made three recommendations that the commenter believed would provide additional clarity to the CAT NMS Plan: (i) The Plan should clearly specify the analytical capability requirements of the CAT to inform the SROs about the level and limits of the Central Repository's analytical capabilities; (ii) the Plan should precisely describe the technology enhancements required by the SROs and the Commission to effectively and efficiently use the CAT Data; and (iii) the Regulator Use Cases should be a key criteria in the selection of the Plan Processor, which would require Bidders to prove that their solution is capable of facilitating regulators' need to extract and analyze the data.\1259\

        ---------------------------------------------------------------------------

        \1257\ SIFMA Letter at 32-33.

        \1258\ Id. at 31-33.

        \1259\ Id. at 33.

        ---------------------------------------------------------------------------

        The Commission recognizes the commenter's concerns about the lack of details in the CAT NMS Plan regarding how regulators will be able to perform their day-to-day analysis using CAT Data, in light of the Regulator Use Cases. The Commission notes, however, that in the Adopting Release the Commission stated that it was not including the Regulator Use Cases and accompanying questions to endorse a particular technology or approach to the consolidated audit trail; rather, the Regulator Use Cases and accompanying questions were designed to aid the SROs' understanding of the types of useful, specific information that the CAT NMS Plan could contain that would assist the Commission in its evaluation of the Plan.\1260\ The Commission noted that its description of Regulator Use Cases includes a non-exclusive list of factors that SROs could consider when developing the NMS plan.\1261\ Thus, the Commission believes that the Regulator Use Cases were not intended to serve as a list of specific requirements regarding analytical capability or technological enhancements that should be addressed by the Participants in the CAT NMS Plan. In response to the comment that the Regulator Use Cases should be a key criteria in the selection of the Plan Processor, the Commission reiterates that the Regulator Use Cases were not intended to be used as selection criteria for the Plan but were meant to elicit the types of useful information from the bidders that would assist in the Commission in its evaluation of the CAT NMS Plan.

        ---------------------------------------------------------------------------

        \1260\ See Adopting Release, supra note 13, at 45798.

        \1261\ Id.

        ---------------------------------------------------------------------------

      21. Obligations on Participants and the Commission Regarding Data Security and Confidentiality

        Under the CAT NMS Plan as noticed, certain obligations are imposed, or required to be imposed by the Plan Processor upon the Participants and the Commission regarding data security and confidentiality.\1262\ However, Commissioners and employees of the Commission are excluded from certain of these obligations.\1263\

        ---------------------------------------------------------------------------

        \1262\ See CAT NMS Plan, supra note 5, at Sections 6.5(f)(i)(A)-

        (B), 6.5(f)(i)(D), 6.5(f)(iii), 6.5(f)(iv)(B), 6.5(g), Appendix D, Sections 4.1.4, 4.1.6, 11.3; see also supra Section III.25.

        \1263\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(i)(A)-

        (B).

        ---------------------------------------------------------------------------

        Two commenters opined on these provisions. One stated that ``the security of the confidential data stored in the Central Repository and other CAT systems must be of the highest quality and that no authorized users with access to CAT Data should be exempt from any provisions regarding security requirements and standards set forth in the Plan.'' \1264\ Another commenter expressed concern that the Plan does not require Commission Staff to abide by the same security protocols for handling PII that other users of CAT Data are required to follow and urged the Commission to adopt these safeguards.\1265\

        ---------------------------------------------------------------------------

        \1264\ NYSE Letter at 2-4 (noting that ``if employees of the Commission with access to the data stored in the Central Repository or other CAT systems are subject to security standards less stringent than those applicable to other authorized users, the data obtained and held by those individuals may be subject to heightened risk of a data breach.'').

        \1265\ Garrett Letter at 1-2.

        ---------------------------------------------------------------------------

        Specifically, one commenter objected to the exclusion of Commissioners and employees of the Commission from Section 6.5(f)(i)(A) of the Plan, which provides that the Plan Processor must require individuals with access to the Central Repository to use appropriate confidentiality safeguards and to use CAT Data only for surveillance and regulatory purposes.\1266\ In addition, the commenter argued that Section 6.5(g) of the Plan, which requires the Participants to establish and enforce policies and procedures regarding CAT Data confidentiality, should also apply to the Commission.\1267\ Similarly, another commenter sees no reason why the Commission should not have to follow the requirements of Section 6.5(g) and emphasized that the Commission needs to follow adequate policies and procedures when handling PII.\1268\ However, the first commenter noted that it ``does not believe that individuals performing their employment duties should be subject to personal liability and that such liability would not reduce security risks,'' and objected to Section 6.5(f)(i)(B) of the Plan, which requires the submission of a ``Safeguard of Information Affidavit'' providing for personal liability for misuse of data.\1269\

        ---------------------------------------------------------------------------

        \1266\ NYSE Letter at 3.

        \1267\ Id. at 3-4 (citing U.S. Government Accountability Office (``GAO'') report discussing certain weaknesses in the Commission's information security policies).

        \1268\ Garrett Letter at 1 (noting also that computer systems at the Federal Deposit Insurance Corporation, Internal Revenue Service, Federal Reserve, and Office of Personnel Management have all recently been compromised by cyberattacks and that an April 2016 GAO report identified several weaknesses related to the SEC's cybersecurity protocols that the Commission has not yet addressed).

        \1269\ NYSE Letter at 3 (also objecting to the terms ``misuse'' and ``data'' (rather than CAT Data) as overly broad and imprecise).

        ---------------------------------------------------------------------------

        In response to these comments, the Participants stated that they agree that the Plan's security program must take into consideration all users with access to CAT Data, including the Commission, and noted that Commission Staff had requested the exclusion of Commission employees and Commissioners from subsections (A) and (B) of Section 6.5(f)(i) of the Plan.\1270\ The Participants, nevertheless, recommended removing these exclusions and applying the requirements of Section 6.5(g) to the Commission.\1271\

        ---------------------------------------------------------------------------

        \1270\ Response Letter I at 60.

        \1271\ Id. at 60-61.

        ---------------------------------------------------------------------------

        The Commission takes very seriously concerns about maintaining the security and confidentiality of CAT Data and believes that it is imperative that all CAT users, including the Commission, implement and maintain a robust security framework with appropriate safeguards to ensure that CAT Data is kept confidential and used only for surveillance and regulatory purposes. However, the Commission is not a party to the Plan.\1272\ By statute, the Commission is the regulator of the Participants, and the Commission will oversee and enforce their compliance with the Plan.\1273\ To impose obligations

        Page 84765

        on the Commission under the Plan would invert this structure, raising questions about the Participants monitoring their own regulator's compliance with the Plan.\1274\ Accordingly, the Commission does not believe it is appropriate for its security and confidentiality obligations, or those of its personnel, to be reflected through Plan provisions.\1275\ Rather, the obligations of the Commission and its personnel with respect to the security and confidentiality of CAT Data should be reflected through different mechanisms than those of the Participants. The Commission reiterates that in each instance the purpose of excluding Commission personnel from these provisions is not to subject the Commission or its personnel to more lenient data security or confidentiality standards. Despite these differences in the origins of their respective obligations, the rules and policies applicable to the Commission and its personnel will be comparable to those applicable to the Participants and their personnel.

        ---------------------------------------------------------------------------

        \1272\ See 17 CFR 242.608(a)(1) (stating that NMS plans are filed by two or more SROs).

        \1273\ See 17 CFR 242.608(b)(2), (c), (d); 17 CFR 242.613(h).

        \1274\ Such an approach also has the potential to create tension with the existing oversight of the Commission conducted by the Office of the Inspector General and the Government Accountability Office.

        \1275\ Moreover, Commission employees are generally immune from personal liability for actions performed in the course of their duties. See, e.g., Gilbert v. Digress, 756 F.2d 1455, 1458 (9th Cir. 1985) (``the bar of sovereign immunity cannot be avoided by naming officers and employees of the United States as defendants''); Clark v. Library of Congress, 750 F.2d 89, 103-04 (D.C. Cir. 1984) (absent a specific waiver by the government, sovereign immunity bars constitutional suits for money damages against government employees in their official capacity, even in cases where the employee acted outside his authority); 28 U.S.C. 2679 (barring claims against government employees under the Federal Tort Claims Act).

        ---------------------------------------------------------------------------

        The Commission and its personnel are subject to a number of existing federal and Commission rules and policies regarding the security and confidentiality of information that they encounter in the course of their employment. These rules and policies apply with equal force to data that Commission personnel can access in the CAT. For example, existing laws and regulations prohibit Commission personnel from disclosing non-public information \1276\ without authorization.\1277\ CAT Data available to Commission personnel will contain non-public information. Thus, Commission personnel who disclose or otherwise misuse this data would potentially be subject to criminal penalties (including fines and imprisonment), as well as disciplinary action (including termination of employment), civil injunction, and censure by professional associations (for attorneys and accountants).\1278\ The Commission believes that the protections described above provide as strong a deterrent against the possible misuse of CAT Data by Commission personnel as would the submission of the ``Safeguard of Information Affidavit'' required by Section 6.5(f)(i)(B).\1279\

        ---------------------------------------------------------------------------

        \1276\ See, e.g., 5 CFR 2635.703(b) (``Nonpublic information is information that the employee gains by reason of Federal employment and that he knows or reasonably should know has not been made available to the general public.'').

        \1277\ See, e.g., 15 U.S.C. 78x(b) (``It shall be unlawful for any member, officer, or employee of the Commission to disclose to any person other than a member, officer, or employee of the Commission, or to use for personal benefit, any information contained in any application, statement, report, contract, correspondence, notice, or other document filed with or otherwise obtained by the Commission (1) in contravention of the rules and regulations of the Commission under the Freedom of Information Act, or (2) in circumstances where the Commission has determined pursuant to such rules to accord confidential treatment to such information''); 17 CFR 200.735-3(b)(2)(i) (``A member or employee of the Commission shall not . . . divulge to any unauthorized person or release in advance of authorization for its release any nonpublic Commission document, or any information contained in any such document or any confidential information: (A) In contravention of the rules and regulations of the Commission promulgated under the Freedom of Information Act, the Privacy Act, and the Sunshine Act; or (B) in circumstances where the Commission has determined to accord such information confidential treatment''); 5 CFR 2635.703(a) (``An employee shall not engage in a financial transaction using nonpublic information, nor allow the improper use of nonpublic information to further his own private interest or that of another, whether through advice or recommendation, or by knowing unauthorized disclosure.'').

        \1278\ See, e.g., 18 U.S.C. 1905 (``Whoever, being an officer or employee of the United States or of any department or agency thereof . . . publishes, divulges, discloses, or makes known in any manner or to any extent not authorized by law any information coming to him in the course of his employment or official duties, . . . which information concerns or relates to the trade secrets, processes, operations, style of work, or apparatus, or to the identity, confidential statistical data, amount or source of any income, profits, losses, or expenditures of any person, firm, partnership, corporation, or association; . . . shall be fined under this title, or imprisoned not more than one year, or both; and shall be removed from office or employment''); 5 U.S.C. 552a(h)(i)(1) (``Criminal penalties--Any officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited by this section or by rules or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000'').

        \1279\ A comment from one Participant suggested that persons with access to the Central Repository--regardless of whether they are employed by the Plan Processor, the Commission, or a Participant--should not be subject to personal liability for the misuse of data. The Commission is not amending the Plan to remove personal liability from all categories of such persons. The inclusion in the Plan of a provision providing for personal liability for the misuse of data indicates that the Participants more broadly believe that this is an appropriate and potentially effective way of deterring misuse of data, including by their own employees. And, in the Commission's view, the Participants' belief is reasonable.

        ---------------------------------------------------------------------------

        In addition, the Commission already has robust information security policies and procedures developed in accordance with federal directives and NIST standards that prohibit the unauthorized disclosure and inappropriate use of confidential data. Moreover, the Commission will review and update, as necessary, its existing confidentiality and data use policies and procedures to account for access to the CAT, and, like the Participants, will periodically review the effectiveness of these policies and procedures and take prompt action to remedy deficiencies in such policies and procedures. Like other information security controls over information resources that support federal operations and assets, the Commission's policies and procedures applicable to CAT must comply with the Federal Information Security Modernization Act of 2014 and the NIST standards required thereunder,\1280\ and will be subject to audits by the SEC Office of Inspector General and the GAO.

        ---------------------------------------------------------------------------

        \1280\ Public Law 113-283 (Dec. 18, 2014); NIST, Security and Privacy Controls for Federal Information Systems and Organizations, Special Publication 800-53, revision 4 (Gaithersburg, Md.: April 2013); NIST, Contingency Planning Guide for Federal Information Systems, Special Publication 800-34, revision 1 (Gaithersburg, Md.: May 2010).

        ---------------------------------------------------------------------------

        Notwithstanding the existence of these protections, in light of the scope and nature of CAT Data, the Commission recognizes the need to ensure that it has in place a comprehensive framework for CAT data security. Accordingly, a cross-divisional steering committee of senior Commission Staff is being formed to design policies and procedures regarding Commission and Commission Staff access to, use of, and protection of CAT Data. The policies and procedures will consider, but not be limited to, access controls, appropriate background checks, usage and data protection, as well as incident response. In developing these policies and procedures, the steering committee will, of necessity, take into account how the data collection and other systems are developed in connection with the creation of the CAT. The Commission will ensure that its policies and procedures impose protections upon itself and its personnel that are comparable to those required under the provisions in the Plan from which the

        Page 84766

        Commission and its personnel are excluded.

        For these reasons, the Commission does not believe that the Plan should be amended to remove the exclusion of ``employees and Commissioners of the SEC'' from Section 6.5(f)(i)(A)-(B) or to extend the requirements of Section 6.5(g) to the Commission. Similarly, the Commission does not believe that the requirements in Section 6.5(g) that Participants establish and enforce policies and procedures designed to ensure the confidentiality of CAT Data obtained from the Central Repository and to limit the use of such data to surveillance and regulatory purposes can or should be extended to the Commission. Moreover, the Commission is further amending the Plan, as set forth below, to remove the Commission from certain other obligations.

        First, the Commission is amending the Plan to provide that Section 6.5(f)(iii) does not apply to the Commission or its personnel. As proposed, this provision provided that the Participants and the Commission must, as promptly as reasonably practicable, but in any event within twenty-four hours, report instances of non-compliance with policies and procedures or breaches of the security of the CAT to the CCO. The Commission received no comments on this provision. The Commission notes that, consistent with presidential directives and guidance from the OMB and the Department of Homeland Security United States Computer Emergency Readiness Team (``US-CERT''), its existing incident response policies and procedures require Commission employees to promptly convey any known instances of non-compliance with data security and confidentiality policies and procedures or breaches of the security of its systems to the CISO of the Commission, and this policy will apply to any instances of non-compliance or breaches that occur with respect to the CAT. The Commission's policies and procedures regarding the CAT will also address conveying information regarding any such incidents to the CCO when appropriate.

        Second, for the reasons discussed above, the Commission is amending the Plan to clarify that Section 6.5(f)(iv)(B) does not apply to the Commission or its personnel. As proposed, this provision stated that the Plan Processor must ``require the establishment of secure controls for data retrieval and query reports by Participant regulatory Staff and the Commission.'' \1281\ The Commission received no comments on this provision. The Commission will ensure that comparable controls governing data retrieval and query reports from the CAT will be included, as applicable, in its policies and procedures.

        ---------------------------------------------------------------------------

        \1281\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(iv)(B).

        ---------------------------------------------------------------------------

        Third, the Commission is amending the Plan to clarify that the requirement to test changes to CAT functionality in Appendix D, Section 11.3 applies only to the Participants. As proposed, this provision stated that, with respect to changes to CAT functionality and infrastructure, the Plan Processor must ``define the process by which changes are to be tested by CAT Reporters and regulators.'' The Commission received no comments on this provision. For the reasons discussed above, the Commission is narrowing this provision so that it is applicable only to the Participants. However, the Commission intends to take part in the testing of changes in CAT functionality or infrastructure that would affect the way Commission personnel access and use the CAT System.

        Fourth, for the reasons discussed above, the Commission is amending the Plan to exclude the Commission and its personnel from certain CAT user access provisions in Appendix D, Sections 4.1.4 and 4.1.6 of the CAT NMS Plan. The Plan, as proposed, provided that the Plan Processor shall ``implement and maintain a mechanism to confirm the identity of all individuals permitted to access the CAT Data stored in the Central Repository and maintain a record of all instances where such CAT Data was accessed.'' \1282\ Specifically, Appendix D, Section 4.1.4 of the CAT NMS Plan provides: that ``periodic reports detailing the current list of authorized users and the date of their most recent access must be provided to Participants, the SEC and the Operating Committee,'' that the ``reports of the Participants and the SEC will include only their respective list of users,'' that the ``Participants and the SEC must provide a response to the report confirming that the list of users is accurate,'' and that the ``Plan Processor must log every instance of access to Central Repository data by users.''

        ---------------------------------------------------------------------------

        \1282\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(i)(D).

        ---------------------------------------------------------------------------

        In addition, the CAT NMS Plan provides that ``a full audit trail of PII access (who accessed what data, and when) must be maintained,'' that ``the Chief Compliance Officer and the Chief Information Security Officer shall have access to daily PII reports that list all users who are entitled for PII access, as well as the audit trail of all PII access that has occurred for the day being reported on,'' and that ``the chief regulatory officer, or other such designated officer or employee at each Participant and the Commission must, at least annually, review and certify that people with PII access have the appropriate level of access for their role.'' \1283\

        ---------------------------------------------------------------------------

        \1283\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.6.

        ---------------------------------------------------------------------------

        For the reasons discussed above, the Commission is amending the Plan to exclude the Commission from the provisions that require the Commission to ``provide a response to the report confirming that the list of users is accurate'' and to ``review and certify that people with PII access have the appropriate level of access for their role.'' \1284\ However, in accordance with Commission information security policies and procedures, the Commission will periodically review the appropriateness of CAT access by personnel and work with the Plan Processor to ensure the list of SEC users authorized to access CAT Data in the Central Repository is appropriate.

        ---------------------------------------------------------------------------

        \1284\ Id. at Appendix D, Sections 4.1.4 and 4.1.6.

        ---------------------------------------------------------------------------

        7. Personally Identifiable Information

      22. Protections Around PII, Regulatory Access to PII

        A number of commenters discussed the Plan Processor's provisions to protect the PII reported to and stored in the Central Repository. Two commenters noted that PII should be held to the ``highest'' or ``most stringent'' standards of information protection.'' \1285\ However, one commenter stated that ``the protection and security of PII in CAT is ``good enough.'' \1286\ Another commenter recommended that the Plan provide further details as to how PII data will be treated and confidentiality maintained, specifically during extraction and transmission of the data.\1287\

        ---------------------------------------------------------------------------

        \1285\ TR Letter at 8; SIFMA Letter at 22; see also NYSE Letter at 3 (discussing CAT Data, including PII reported to the Central Repository, and noting that the security of the confidential data stored in the Central Repository and other CAT systems must be of the highest quality).

        \1286\ Data Boiler Letter at 29 (stating ``PII should properly be safeguarded . . . . but nothing will be absolutely ``bullet-

        proof.'').

        \1287\ SIFMA Letter at 44 (suggesting that the Bidders should be evaluated on how their proposed solutions will meet the confidentiality requirements by a technical panel of experts with representation from broker-dealers).

        ---------------------------------------------------------------------------

        Commenters also discussed the Plan's provisions regarding access to PII. One commenter noted that ``access to PII data should be provided only in the rarest of instances (i.e., SEC investigations for securities law

        Page 84767

        violations), as regulators and other authorized users should be able to perform the majority, if not all, of their regulatory and oversight responsibilities by utilizing non-PII data, such as the CAT Customer-

        ID.'' \1288\ Another commenter stated that there should be controls, policies and procedures to prohibit the downloading of certain sensitive information, such as PII, and suggested limiting Participant access to sensitive data only to specific enforcement actions.\1289\ One commenter recommended that PII data never be exported, extracted, copied or downloaded in any manner or form from the CAT environment.\1290\ This commenter added that PII data should not be included in email or other electronic communications, and advocated for use of a special CAT information management tool.\1291\ Another commenter believed the PII should be excluded from direct query tools, reports or bulk data extraction.\1292\

        ---------------------------------------------------------------------------

        \1288\ SIFMA Letter at 22.

        \1289\ FIF Letter at 134-135.

        \1290\ SIFMA Letter at 22.

        \1291\ Id.

        \1292\ FSI Letter at 3.

        ---------------------------------------------------------------------------

        In their response, the Participants noted that Section 6.10(c)(i)(B) of the Plan provides that ``the user-defined direct queries and bulk extracts will provide authorized users with the ability to retrieve CAT Data via a query tool or language that allows users to query all available attributes and data sources.'' \1293\ The Participants clarified that no customer-related information, including PII, will be included in response to queries of the broader order and transaction database, nor will it be available in bulk extract form.\1294\ Instead, the Participants stated that customer-related information, such as PII, will be stored in a separate database, which can be accessed only in accordance with heightened security protocols.\1295\ In such case, a regulatory user would have to be specifically authorized to access the database with PII and other customer-related information.\1296\ The Participants stated that they expect that the Plan Processor and the CISO will establish policies and procedures to identify abnormal usage of the database containing customer-related information, and to escalate concerns as necessary; and noted that the details regarding such policies and procedures will be determined once the Plan Processor has been selected.\1297\

        ---------------------------------------------------------------------------

        \1293\ Response Letter III at 10.

        \1294\ Id.

        \1295\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.6.

        \1296\ For example, in their Response Letter, the Participants noted that if a regulatory user received a tip about a particular person, such user, if he or she were appropriately authorized to do so, could search the customer-related information database and view unmasked information to identify the person's Customer-ID, and then use the Customer-ID to query the broader order and transaction database to view the relevant activity for that Customer-ID. Response Letter III at 10.

        \1297\ Id.

        ---------------------------------------------------------------------------

        With respect to the standards of protection for PII, the Commission notes that the Plan Processor must adhere to the NIST Risk Management Framework and implement baseline security controls identified in NIST Special Publication 800-53, which the Commission believes, when applied properly, are sufficiently rigorous industry standards for the protection of sensitive data such as PII.\1298\ The Commission also believes that the Participants' general approach to treating PII differently--and with more stringent protections--than other CAT Data is also reasonable, given the highly sensitive nature of PII, and the risk that an individual Customer's orders and transactions could be identified should the Central Repository's data security protections be breached. Thus, the Commission believes that the Plan's provisions which limit who can access PII and how PII can be accessed are a reasonable means of ensuring the protection of PII. Specifically, the Commission believes that requiring access to PII to follow RBAC, adhering to the ``least privileged'' practice of limiting access,\1299\ restricting access to PII to those with a ``need-to-know,'' and requiring that any login system that is able to access PII must be further secured via MFA, are reasonable.\1300\

        ---------------------------------------------------------------------------

        \1298\ See Section IV.D.6.b, supra.

        \1299\ The Commission understands that the ``least privileged'' practice entails limiting access to the minimal level of access to PII that will allow normal functioning.

        \1300\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.4.

        ---------------------------------------------------------------------------

        The Commission also believes that the Participants' approach to the use of PII is a reasonable means of protecting PII of Customers reported to the Central Repository. Specifically, the Commission believes that the Plan's provisions setting out specific parameters applicable to the inclusion of PII in queries, as described by the Participants, is a reasonable approach to controlling the disclosure of PII and helps to ensure that PII will only be used by regulators for regulatory and surveillance purposes and, as set out in the Plan, for market reconstruction and analysis.

        The Commission notes that the Plan and the Participants' response affirms that access to PII data will only be provided to a limited set of authorized individuals, and only for the limited purpose of conducting regulatory and surveillance activities.\1301\ The Plan also contains an explicit prohibition on the ability to bulk download sensitive information such as PII, and this protection must be reinforced through the Plan Processor's controls, policies and procedures.

        ---------------------------------------------------------------------------

        \1301\ The Commission notes that regulatory uses includes, among other things, analysis and reconstruction of market events, market analysis and research to inform policy decisions, market surveillance, examinations, investigations, and other enforcement functions. See supra note 586.

        ---------------------------------------------------------------------------

        Thus, the Commission believes that the Plan's provisions addressing the protections of PII, and the limitations on its access and use, provide a reasonable framework for the protection of PII. While it is concluding that the Plan sets forth a reasonable framework for the protection of PII, the Commission notes that the Plan Processor will continually assess, and the CISO and Operating Committee will vigorously oversee, the adequacy of the security of CAT Data, and in particular PII, and will promptly and thoroughly address any deficiencies that are identified.\1302\

        ---------------------------------------------------------------------------

        \1302\ See CAT NMS Plan, supra note 5, at Section 6.1(o)(ii) (requiring the Plan Processor to provide the Operating Committee regular reports addressing, among other things, data security issues for the Plan Processor and the Central Repository taking into account the data security requirements set forth in Appendix D).

        ---------------------------------------------------------------------------

      23. PII Scope: Customer Identifying Information and Customer Account Information

        One commenter requested clarification on the scope of PII, stating ``the exact scope of PII should be defined, i.e., are all fields associated with a customer included as PII?'' \1303\ In their response, the Participants provided additional clarification on their interpretation of PII, as well as on the scope of the Plan's protections for all customer-related information.\1304\ Specifically, the Participants clarified that they view all customer-related information--not only PII, but also Customer Identifying Information and Customer Account Information--as the type of highly sensitive information that requires the highest level of protection under the Plan.\1305\ The Participants further stated that because there is some inconsistency in how these terms are used in the Plan, to the extent that any statement in the Plan, including Section 6.10(c) of the Plan, and Appendices C or D thereto, are inconsistent with the above description, the Participants recommend that the Commission amend

        Page 84768

        the Plan to address any potential confusion.\1306\

        ---------------------------------------------------------------------------

        \1303\ FIF Letter at 135.

        \1304\ Response Letter III at 9-10.

        \1305\ Response Letter III at 9.

        \1306\ Response Letter III at 10.

        ---------------------------------------------------------------------------

        The Commission agrees with the Participants and believes that the security of Customer Identifying Information and Customer Account Information, irrespective of whether it meets a common understanding of the definition of PII, should be subject to the highest standards of protection. Accordingly, the Commission is amending the definition of PII in Section 1.1 of the CAT NMS Plan to provide that PII means ``personally identifiable information, including a social security number or tax identifier number or similar information; Customer Identifying Information and Customer Account Information.'' The Commission believes that this amendment is reasonable in that it will ensure that all information that identifies a Customer will be afforded the same high levels of protection as data that the Participants initially defined as PII.

      24. Storage of PII

        Commenters also discussed the policies and procedures addressing storage of PII as a means to enhance the security and confidentiality of PII reported to the Central Repository. A few commenters stated that PII should be stored separately from other CAT Data.\1307\ One commenter stated that ``PII must be segregated from other transactional data that will be stored by the CAT Processor.'' \1308\ Another commenter opined that, while it does not believe that the CAT NMS Plan should mandate a particular storage method, it supported requiring PII to be stored separately, given its sensitive nature and the potential for identify theft or fraud.\1309\

        ---------------------------------------------------------------------------

        \1307\ FSR Letter at 4; FSI Letter at 3; SIFMA Letter at 22; see also MFA Letter at 8 (stating that particularly sensitive pieces of data should be isolated or compartmentalized).

        \1308\ FIF Letter at 125. Similarly, another commenter recommended that PII data not overlap with access to the other transaction data available in the CAT. See SIFMA Letter at 23.

        \1309\ FSI Letter at 3.

        ---------------------------------------------------------------------------

        In their response, the Participants clarified that they view all customer-related information (i.e., PII, including Customer Identifying Information and Customer Account Information) as highly sensitive information that requires the highest level of protection and, as such, all customer-related information will be stored in a different, physically separated architecture.\1310\

        ---------------------------------------------------------------------------

        \1310\ Response Letter III at 9.

        ---------------------------------------------------------------------------

        The Commission believes that the CAT NMS Plan's provisions regarding the storage of PII set forth a reasonable framework for the security of such data. The Plan further provides that the CAT infrastructure may not be commingled with other non-regulatory systems, including being segmented to the extent feasible on a network level, and data centers housing CAT systems must be AICPA SOC-2 certified by a qualified third party auditor that is not an affiliate of any Participant or the Plan Processor.\1311\

        ---------------------------------------------------------------------------

        \1311\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.1.3; see also Response Letter I at 58-59.

        ---------------------------------------------------------------------------

        8. Implementation Schedule

        The CAT NMS Plan sets forth timeframes for key CAT implementation events and milestones, such as when the Plan Processor will release the Technical Specifications, begin accepting data from Participants, begin accepting data from Industry Members for testing purposes, and when Industry Members must begin reporting to CAT.\1312\

        ---------------------------------------------------------------------------

        \1312\ See Section III.27, supra.

        ---------------------------------------------------------------------------

      25. Specificity and Timing of Implementation Milestones

        One commenter stated that the CAT NMS Plan does not provide sufficient detail to allow for implementation planning.\1313\ Another commenter argued that the CAT development milestones are unacceptable because they do not promote the objective of facilitating improved market surveillance.\1314\

        ---------------------------------------------------------------------------

        \1313\ FIF Letter at 43.

        \1314\ Data Boiler Letter at 17.

        ---------------------------------------------------------------------------

        Other commenters suggested extending the implementation schedule for CAT.\1315\ One commenter suggested that there should be additional time to reassess and more carefully tailor the schedules and milestones that are included in the Plan to make the roll-out of the CAT as efficient as possible.\1316\ Another commenter suggested extending the implementation schedule for a period of at least six to twelve months beyond the timeframe in the Plan as filed, particularly in light of the fact that many Industry Members will be working to comply with the Department of Labor's new fiduciary duty regulation as well as T+2 implementation during this same timeframe.\1317\ This commenter noted that such an extended implementation timetable would also allow for additional testing and synchronization, which would result in a more accurate reporting environment on the ``go-live'' date.\1318\ Another commenter noted that the CAT implementation schedule is more aggressive than the actual timeframes for implementing OATS for NMS or large trader reporting, which could lead to, among other things, poorly built systems and an inferior quality of data reporting.\1319\ This commenter also presented a detailed alternative implementation and milestone schedule that provides more time for Industry Members to prepare for CAT reporting.\1320\

        ---------------------------------------------------------------------------

        \1315\ See, e.g., FSR Letter at 10 (noting that the implementation schedule should be extended to provide the industry a sufficient amount of time to comply with the new reporting structure under the CAT NMS Plan, including the ability to report CAT Data in a timely and accurate manner with a reduced error rate); FIF Letter at 7, 40-41, 45 (stating that FIF could not support the Plan's implementation milestones as proposed and that the Plan lacks appropriate risk-mitigating strategies for CAT Reporters to cope with the ``aggressive'' implementation schedule and suggesting several such strategies).

        \1316\ SIFMA Letter at 23.

        \1317\ FSR Letter at 10. The Commission notes that, as of the date of this Order, a T+2 standard settlement cycle has been proposed, but not adopted. See Securities Exchange Act Release No. 78962 (September 28, 2016), 81 FR 69240 (October 5, 2016).

        \1318\ FSR Letter at 10.

        \1319\ FIF Letter at 36.

        \1320\ Id. at 41-50. For example, FIF suggested that the Participants should select the Plan Processor prior to Plan approval and that the test environment should be available to CAT Reporters twelve months prior to the start of Industry Member reporting (rather than six months prior to the start of Industry Member reporting as proposed in the Plan). Id. at 42-43.

        ---------------------------------------------------------------------------

        On the other hand, another commenter believed that the implementation schedule is too protracted, noting that the phased-in approach of requiring CAT reporting first from Participants and then from Industry Members, combined with the fact that market participants typically request additional time to create systems to comply with new recordkeeping requirements, will render the CAT system incomplete for several years.\1321\

        ---------------------------------------------------------------------------

        \1321\ Anonymous Letter I at 3.

        ---------------------------------------------------------------------------

        Several commenters addressed the CAT NMS Plan's development and testing milestones. One commenter noted that a robust testing period should be included in the implementation schedule and that currently the Plan does not allow sufficient time for thorough testing for broker-dealers or third-party service providers.\1322\ This commenter also suggested a trial period to permit industry-wide testing of CAT readiness to ensure that the Plan Processor is capable of meeting reporting and linkage requirements outlined in the Plan.\1323\ Another

        Page 84769

        commenter recommended that the CAT NMS Plan include ``acceptance criteria'' for the completion of each CAT development milestone to ensure that the implementation of the CAT and the completion of subsequent milestones are not hindered by poor quality at earlier development stages.\1324\

        ---------------------------------------------------------------------------

        \1322\ SIFMA Letter at 24.

        \1323\ Id.; see also TR Letter at 6 (emphasizing the importance of the testing period and noting that the three-month period included in the Plan for testing the customer definition process and order data process is inadequate based on the commenter's experience with projects of lesser complexity than the CAT and because continuous reporting of customer and options data will be entirely new processes).

        \1324\ FIF Letter at 41.

        ---------------------------------------------------------------------------

        This commenter further supported an earlier start to the development of the Technical Specifications and stated that the six-

        month period contemplated by the CAT NMS Plan for the industry to test software that will interface with the Plan Processor is insufficient, particularly for third-party service providers and service bureaus.\1325\ This commenter suggested, among other things, accelerating the availability of the CAT test environment to earlier in the implementation cycle and allowing a minimum of twelve months of access to the CAT test environment for the first group of Industry Member reporters.\1326\ Another commenter proposed a twelve-month testing period with clear criteria established before moving into production, including coordinated testing across industry participants and the vendors that support them.\1327\ This commenter also noted that the testing plans that will be used for any potential move to T+2 would be useful in developing industry testing for the CAT and that error rates should be consistent with OATS for reports that are currently reported to OATS.\1328\ This commenter further suggested that robust testing that mirrors production will be necessary to ensure that the Plan Processor is capable of meeting the reporting and linkage requirements outlined in the Plan.\1329\

        ---------------------------------------------------------------------------

        \1325\ Id. at 37-38; see also id. at 38-39 (highlighting other development and testing issues, noting in particular that linkage testing across multiple CAT Reporters is one of the most complex pieces of logic for the CAT System and CAT Reporters).

        \1326\ FIF Letter at 39.

        \1327\ TR Letter at 6.

        \1328\ Id.

        \1329\ Id. at 2.

        ---------------------------------------------------------------------------

        In response to these commenters, the Participants explained that in light of their experience with testing timelines for other system changes, discussions with the Bidders, and other considerations, they continue to believe that the Plan sets forth an achievable testing timeline.\1330\ The Participants also acknowledged the importance of the development process for the Technical Specifications for all CAT Reporters and noted that they have emphasized this as a high priority with the Bidders.\1331\

        ---------------------------------------------------------------------------

        \1330\ Response Letter I at 39.

        \1331\ Id. at 41.

        ---------------------------------------------------------------------------

        The Participants stated that they ``do not propose to amend the Plan to reflect an expedited schedule for the Industry Member Technical Specifications.'' \1332\ In addition, the Participants indicated that while strategies to mitigate any risks in meeting the implementation milestones will be a necessary part of promoting the successful implementation of the CAT, they believe that formulating specifics regarding risk mitigation strategies will depend on the selected Plan Processor and its solution.\1333\ Therefore, the Participants stated their belief that such risk mitigation strategies will be addressed as a part of the agreement between the Plan Processor and the CAT LLC, and implemented thereafter.\1334\

        ---------------------------------------------------------------------------

        \1332\ Id.

        \1333\ Id. at 39.

        \1334\ Id.

        ---------------------------------------------------------------------------

        The Commission agrees that prompt availability of Technical Specifications that provide detailed instructions on data submission and a robust period of testing CAT reporting functionality are important factors in ensuring that Industry Members are able to timely transition to CAT reporting and accurately report data to the Central Repository. In this regard, the Commission expects the Participants to ensure that the Technical Specifications will be published with sufficient time for CAT Reporters to program their systems, and strongly encourages the Participants and the Plan Processor to provide the earliest possible release of the initial Technical Specifications for Industry Member reporting and to begin accepting Industry Member data for testing purposes as soon as practicable. In addition, the Commission is amending Appendix C, Section C.10 of the Plan to ensure that the completion dates for the Technical Specifications, testing, and other development milestones designate firm outer limits, rather than ``projected'' completion dates, for the completion of these milestones. For example, as amended, the Plan will provide that the Plan Processor will begin developing Technical Specifications for Industry Member submission of order data no later than fifteen months before Industry Members are required to begin reporting this data, and will publish the final Technical Specifications no later than one year before Industry Members are required to begin reporting. Moreover, the Commission is amending Appendix C, Section C.10 of the Plan to clarify that the CAT testing environment will be made available to Industry Members on a voluntary basis no later than six months prior to when Industry Members are required to report data to the CAT and that more coordinated, structured testing of the CAT System will begin no later than three months prior to when Industry Members are required to report data to the CAT.

        The Commission acknowledges that the transition to CAT reporting will be a major initiative that should not be undertaken hastily, that Industry Members and service bureaus will need sufficient time to make the preparations necessary to comply with the reporting requirements of the Plan and the Technical Specifications, and the importance of thorough testing. However, the Commission does not believe that the Plan's Technical Specification and testing timeframes are unachievable. Therefore, the Commission believes it is premature--one year before the Technical Specifications for Industry Members will be finalized, eighteen months before testing will begin, and before any problem with achieving these milestones has actually arisen--to consider amending the CAT NMS Plan to mandate a more protracted implementation schedule.

        Similarly, the Commission continues to believe that the implementation dates that are explicitly provided in Rule 613--for example, that Industry Members and Small Industry Members will begin reporting Industry Member data to the Central Repository within two or three years, respectively, of Plan approval \1335\--are reasonable. As discussed above, the Plan provides appropriate interim milestones, such as iterative drafts of the Technical Specifications and a testing period, which will help prepare Industry Members to transition to CAT reporting pursuant to the implementation schedule set forth in the CAT NMS Plan. No issues complying with these dates have actually arisen, and the Commission is not altering these dates at this time.\1336\ In addition, with

        Page 84770

        respect to the comment that strategies to mitigate the risks imposed by an ``aggressive'' implementation schedule--such as delays, poorly built systems, and an inferior quality of data reporting--should be included in the Plan, the Commission agrees with the Participants that formulating detailed risk mitigation strategies will depend upon the selected Plan Processor and its specific solution and will be addressed in the agreement between the Plan Processor and CAT NMS, LLC. Therefore, the Commission is not amending the Plan to require specific risk mitigation strategies at this time.

        ---------------------------------------------------------------------------

        \1335\ 17 CFR 242.613(a)(3).

        \1336\ See also Adopting Release, supra note 14, at 45744, 45805 (stating that phasing CAT implementation to allow broker-dealers to begin reporting to the CAT after the SROs will ``allow members additional time to, among other things, implement the systems and other changes necessary to provide the required information to the Central Repository, including capturing customer and order information that they may not have previously been required to collect'' and that ``the Commission encourages plan sponsors to propose in the NMS plan a requirement that small broker-dealers report data to the Central Repository within three years after effectiveness of the NMS plan, as the Commission believes that providing small broker-dealers a longer implementation time should assist such broker-dealers in identifying the most cost-effective and the most efficient manner in which to procure third-party software or make any systems modifications or other changes to comply with Rule 613.'').

        ---------------------------------------------------------------------------

      26. Impact of Technical Specifications on Implementation Milestones

        In addition, several commenters suggested that reasonable timeframes for implementing the CAT can only be established once the Plan Processor publishes--and CAT Reporters review--the Technical Specifications.\1337\ Similarly, one commenter suggested that the CAT NMS Plan should establish a milestone for amending the CAT NMS Plan based on a review of the final Technical Specifications and that these amendments should set forth the CAT implementation schedule.\1338\ Another commenter argued that the Plan does not currently include critical information, such as interface details and other key technical specifications, and that broker-dealers must understand these specifications in order to establish a reasonable implementation schedule.\1339\

        ---------------------------------------------------------------------------

        \1337\ SIFMA Letter at 23-24; FSR Letter at 10 (stating that the release of final Technical Specifications should drive the implementation timeline and that Industry Members should be provided with the Technical Specifications and given an opportunity to review and provide feedback to the Plan Processor in an effort to determine an appropriate implementation schedule); TR Letter at 3-6 (stating that rule-making should begin once final Technical Specifications are published and noting that, in keeping with the SEC's Equity Market Structure Advisory Committee's Rule Change Implementation timing recommendation, the timing of CAT implementation should be based on a review of the Technical Specifications); FIF Letter at 6-

        7 (recommending that an implementation schedule be established only after publication of the Technical Specifications and that the process for SRO and Commission rulemaking should begin upon publication of the final Technical Specifications).

        \1338\ See TR Letter at 6.

        \1339\ SIFMA Letter at 23-24.

        ---------------------------------------------------------------------------

        Several commenters suggested that the implementation schedule should be designed to provide more time for iterative interactions between Industry Members and the Plan Processor in terms of developing and executing system specifications, particularly as those specifications relate to listed options transactions and customer information.\1340\ In addition, one commenter suggested that a technical committee should be established to work with the Plan Processor on refining the specifications and making necessary adjustments or accommodations as the specifications are developed and implemented.\1341\ Another commenter suggested including a ``Specifications Date'' in the NMS Plan, which would be the date by which final Technical Specifications are released, at which point the industry would work with the Plan Processor to assess implementation timeframes.\1342\ This commenter also urged the Commission to take a data-driven approach to implementation timing, leveraging prior experience with OATS, EBS and large trader reporting to fashion an implementation plan that is achievable.\1343\

        ---------------------------------------------------------------------------

        \1340\ Id. at 24; see also FIF Letter at 7, 40-41 (noting that there should be more time for testing and iterative specification reviews for CAT reporting).

        \1341\ SIFMA Letter at 24.

        \1342\ TR Letter at 5.

        \1343\ Id. at 6.

        ---------------------------------------------------------------------------

        Two commenters suggested that the Participants and the Commission, prior to the creation of the Technical Specifications, should provide the Plan Processor with additional detail on how they intend to use trade and order data.\1344\ These commenters argued that this will ensure that the CAT is designed to provide all the functionality of existing systems with the initial implementation of CAT.\1345\

        ---------------------------------------------------------------------------

        \1344\ FIF Letter at 6; TR Letter at 3.

        \1345\ FIF Letter at 6; TR Letter at 3-4.

        ---------------------------------------------------------------------------

        In their response, the Participants explained that while the Technical Specifications will be important drivers of the implementation timeline, Rule 613 mandates certain compliance dates.\1346\ According to the Participants, delaying the assessment and definition of implementation milestones until the availability of the Technical Specifications would jeopardize the ability of the Participants to meet their obligations under Rule 613.\1347\ However, the Participants also explained that ``the steps leading up to the compliance dates set forth in SEC Rule 613 can be tailored to the Technical Specifications'' leaving room to accommodate specific developments related to the Technical Specifications.\1348\ The Participants also expect the Plan Processor to provide more specific guidance as to steps toward implementation with the Technical Specifications and, to the extent that such guidance would require an amendment to the Plan's implementation timelines, the Participants will propose to amend the Plan accordingly.\1349\ With respect to the comments recommending an iterative process between broker-dealers and the Plan Processor in developing final Technical Specifications, the Participants noted that the Plan, as drafted, already contemplates the publication of iterative drafts as needed before the final Technical Specifications are published.\1350\

        ---------------------------------------------------------------------------

        \1346\ Response Letter I at 39-40.

        \1347\ Id. at 40.

        \1348\ Id.

        \1349\ Id.

        \1350\ Id. at 41.

        ---------------------------------------------------------------------------

        As noted, the Commission does not believe it is necessary to tie completion dates for CAT implementation events or milestones to the release and review of Technical Specifications. The Commission believes that setting forth specific timeframes in the CAT NMS Plan for completing the various CAT implementation stages and tying these timeframes to the Effective Date rather than to subsequent events such as the release, review, or finalization of the Technical Specifications, is a reasonable approach to achieve a timely implementation of the CAT. Therefore, and the Commission is not deferring or reducing the specificity of these timeframes at this time.

        In response to the comments suggesting that the Plan should provide for a more iterative process between Industry Members and the Plan Processor in the development of the Technical Specifications, as the Participants' response pointed out, the CAT NMS Plan provides that the Plan Processor will publish iterative drafts of the Technical Specifications as needed prior to the publication of the final Technical Specifications.\1351\ However, the Commission recognizes the importance of workable Technical Specifications, and notes that the Plan requires the Participants and the Plan Processor to work with Industry Members in an iterative process, as necessary, to develop effective final Technical Specifications.\1352\

        ---------------------------------------------------------------------------

        \1351\ See CAT NMS Plan, supra note 5, at Appendix C, Section C.10(b).

        \1352\ See also Section IV.D.15, infra.

        ---------------------------------------------------------------------------

        Regarding the comment that the Participants and the Commission should provide the Plan Processor, prior to the creation of the Technical Specifications,

        Page 84771

        with additional details on how they use trade and order data, the Commission understands that the Participants have provided the Bidders with their use cases and those of the Commission \1353\ and have indicated that they will ``work with the Plan Processor and the industry to develop detailed Technical Specifications.'' \1354\ The Commission and its Staff will work with the Participants and the Plan Processor to facilitate the development and implementation of the Technical Specifications and the CAT System more broadly, including by providing the Plan Processor with appropriate information on its current and prospective use of trade and order data.

        ---------------------------------------------------------------------------

        \1353\ See Response Letter II at 27 (``The Participants have provided the Bidders with specific use cases that describe the surveillance and investigative scenarios that the Participants and the SEC would require for the CAT.'').

        \1354\ See id. at 21.

        ---------------------------------------------------------------------------

      27. Phasing of Industry Member Reporting

        The CAT NMS Plan provides that Small Industry Members--broker-

        dealers whose capital levels are below a certain limit defined by regulation--must report Industry Member Data to the Central Repository within three years of the Effective Date, as opposed to the two years provided to other Industry Members.\1355\

        ---------------------------------------------------------------------------

        \1355\ See Section III.27, supra.

        ---------------------------------------------------------------------------

        Several commenters noted the impact the CAT NMS Plan's implementation schedule would have on small broker-dealers, clearing firms, and service bureaus. One commenter emphasized the need for sufficient lead time to enable small firms previously exempt from OATS reporting to establish the internal structure, technical expertise, systems, and contractual arrangements necessary for CAT reporting.\1356\ Other commenters suggested that only those firms that are exempt or excluded from OATS reporting obligations--rather than Small Industry Member firms based on capital levels as set forth in the CAT NMS Plan--should have an additional year to begin reporting to CAT, arguing that such a change would allow existing systems to be retired earlier at a significant cost savings.\1357\ Similarly, another commenter noted the impact the phased implementation schedule would have upon third-party vendors, service bureaus, and correspondent clearing firms with both large and small clients, and suggested that dividing Industry Members based on whether or not they currently report to OATS is preferable to the capital level-based division proposed in the CAT NMS Plan.\1358\

        ---------------------------------------------------------------------------

        \1356\ SIFMA Letter at 23.

        \1357\ TR Letter at 3-4 (recommending that the definition of Small Industry Member be based on FINRA Rules 7470 and 7410(o)); see also Wachtel Letter at 1-2 (arguing that OATS-exempt firms should be granted Small Industry Member status and that metrics other than capital level such as number of registered persons, revenue, or number of orders routed may be better ways of assessing a firm's actual activity level and market impact); FIF Letter at 49 (supporting the Plan's approach to require Participants to report to the CAT first but suggesting that CAT reporting obligations be phased in first for OATS reporters and then non-OATS reporters, or, in the alternative, phasing reporting obligations based on functionality, such as equities, options and allocations); Section V.F.2.b, infra.

        \1358\ FIF Letter at 40 (suggesting, in the alternative, that the CAT NMS Plan should permit Small Industry Members to report concurrently with Large Industry Members).

        ---------------------------------------------------------------------------

        In response to these comments, the Participants explained their understanding that the Commission permitted additional compliance time for smaller firms because ``small broker-dealers may face greater financial constraints in complying with Rule 613 as compared to larger broker-dealers'' and that the Participants have based the implementation timeline on that framework.\1359\ However, the Participants explained that they believe that Rule 613 and the Plan already permit Small Industry Members to commence reporting to the CAT when large Industry Members begin reporting to the CAT on a voluntary basis.\1360\ In addition, the Participants stated that accelerating the reporting requirements for all Small Industry Members that are OATS reporters to require them to begin reporting to the Central Repository two years after Plan approval, when Large Industry Members are required to report, may enable FINRA to retire OATS on a more expedited basis and that the Participants will consider including in their Compliance Rules a requirement to accelerate reporting for Small Industry Members that are OATS reporters.\1361\

        ---------------------------------------------------------------------------

        \1359\ Response Letter II at 19-20 (citing Adopting Release).

        \1360\ Id.

        \1361\ Id.

        ---------------------------------------------------------------------------

        The Commission acknowledges that the capital-level based definition contained in the Plan is not the only way to define Small Industry Members for the purposes of the implementation schedule. However, this definition is derived from Exchange Act Rule 0-10,\1362\ which defines small entities under the Exchange Act for purposes of the Regulatory Flexibility Act, and reflects an ``existing regulatory standard that is an indication of small entities for which regulators should be sensitive when imposing regulatory burdens.'' \1363\ In addition, the group of firms that do not currently report to OATS is diverse, and includes some large broker-dealers and entities that--although they are not FINRA members and hence do not have regular OATS reporting obligations--nevertheless engage in a significant volume of trading activity.\1364\ Therefore, the Commission continues to believe, at this time, that the definition of Small Industry Member in the Plan is a reasonable means to identify market participants for which it would be appropriate to provide, and that would benefit from, an additional year to prepare for CAT reporting due to their relatively limited resources.

        ---------------------------------------------------------------------------

        \1362\ 17 CFR 240.0-10.

        \1363\ Adopting Release, supra note 14, at 45804.

        \1364\ See Notice, supra note 5, at 30715, 30793.

        ---------------------------------------------------------------------------

        In addition, the Commission encourages the Participants and the Plan Processor to work with Small Industry Members that are also OATS reporters to enable them to begin reporting to CAT, on a voluntary basis, at the same time that large Industry Members are required to begin reporting, particularly if the Participants believe that this would facilitate more expeditious retirement of OATS. Accordingly, the Commission is amending Appendix C, Section C.9 of the Plan to require the Participants to consider, in their rule change filings to retire duplicative systems,\1365\ whether the availability of certain data from Small Industry Members two years after the Effective Date would facilitate a more expeditious retirement of duplicative systems. In addition, the Commission notes that FINRA is considering whether it can integrate CAT Data with OATS data in such a way that ``ensures no interruption in FINRA's surveillance capabilities,'' and that FINRA will consider ``exempting firms from the OATS Rules provided they report data to the Central Repository pursuant to the CAT NMS Plan and any implementing rules.'' \1366\ The Commission encourages the other Participants to consider similar measures to exempt firms from reporting to existing systems once they are accurately reporting comparable data to the CAT and to enable the usage of CAT Data to conduct their regulatory activities.\1367\ The Commission believes that this approach will reduce or eliminate the duplicative reporting costs

        Page 84772

        of Industry Members prior to the commencement of Small Industry Member reporting.

        ---------------------------------------------------------------------------

        \1365\ See Section IV.D.9.a(1), infra.

        \1366\ See CAT NMS Plan, supra note 5, at Appendix C, Section C.9.

        \1367\ See Section IV.D.9.a(1), infra (requiring the Participants to consider, in their rule change filings to retire duplicative systems, whether individual Industry Members can be exempted from reporting to duplicative systems once their CAT reporting meets specified accuracy and reliability standards).

        ---------------------------------------------------------------------------

        The Commission remains open to other approaches to phasing in CAT reporting obligations that will promote the earlier retirement of reporting systems that will be rendered duplicative by the CAT. However, for the reasons discussed above, the Commission believes that, at this time, the Plan's definition of Small Industry Member is reasonable, and is therefore not amending the Plan to change this definition or to otherwise change the phased approach to CAT implementation.

        9. Retirement of Existing Trade and Order Data Rules and Systems

      28. SRO Rules and Systems \1368\

        ---------------------------------------------------------------------------

        \1368\ See also Section V.F.2.b, infra (discussing comments on the costs of duplicative reporting).

        ---------------------------------------------------------------------------

        As discussed above, the CAT NMS Plan provides that the Participants will conduct analyses of which existing trade and order data rules and systems require the collection of information that is duplicative, partially duplicative, or non-duplicative of CAT.\1369\ Among other things, the Participants, in conducting these analyses, will consider whether information collected under existing rules and systems should continue to be collected or whether that information should be incorporated into CAT, and, in the case of retiring OATS, whether the Central Repository contains complete and accurate CAT Data that is sufficient to ensure that FINRA can effectively conduct surveillance and investigations of its members for potential violations of FINRA rules and federal laws and regulations.\1370\ Under the Plan, as proposed, each Participant should complete its analysis of which of its systems will be duplicative of CAT within twelve months of when Industry Members are required to report to the Central Repository, and should complete its analyses of which of its systems will be partially duplicative and non-duplicative of CAT within eighteen months of when Industry Members are required to report to the Central Repository, although these timeframes could be extended if the Participants determine that more time is needed.\1371\ In addition, the Plan requires each Participant to analyze the most appropriate and expeditious timeline and manner for eliminating duplicative and partially duplicative rules and systems and to prepare rule change filings with the Commission within six months of determining that an existing system or rule should be modified or eliminated.\1372\

        ---------------------------------------------------------------------------

        \1369\ See Section III.20, supra.

        \1370\ Id.

        \1371\ Id.

        \1372\ Id.

        ---------------------------------------------------------------------------

        (1) Timing

        Several commenters addressed the timeframes proposed by the Participants for retiring systems that will be rendered duplicative by CAT. One commenter noted that the CAT NMS Plan does not contain a detailed approach for retiring duplicative reporting systems and thereby fails to meet the directives of Rule 613.\1373\ This commenter suggested that the CAT NMS Plan should be amended to provide a detailed framework for elimination of reporting systems that will be rendered duplicative and outdated by CAT implementation, and to set forth a prioritized timetable for retirement of such duplicative systems.\1374\ Similarly, another commenter expressed disappointment regarding the plan to eliminate duplicative systems, noting that the Plan merely sets forth a ``loose commitment'' from the Participants to complete their analyses of which rules and systems may be duplicative of CAT, rather than an actual retirement schedule.\1375\

        ---------------------------------------------------------------------------

        \1373\ KCG Letter at 2-3; see also DAG Letter at 2.

        \1374\ KCG Letter at 2-3.

        \1375\ DAG Letter at 2; see also STA Letter at 1 (supporting the DAG Letter's elimination of systems recommendations).

        ---------------------------------------------------------------------------

        Several commenters emphasized the importance of eliminating duplicative systems as soon as possible and suggested that the current proposal to allow up to two and a half years for the Participants to consider system elimination is too long in light of the additional expenses that will be incurred during the period of duplicative reporting.\1376\ One commenter noted that without a regulatory obligation driving systems retirement, the Participants lack an incentive to retire existing systems, and that the Plan should not enable the Participants to move to planning for fixed income or primary market transaction reporting prior to mapping out the elimination of redundant systems.\1377\ Another commenter presented a detailed alternative schedule--with significantly more aggressive timelines--for analyzing and retiring duplicative systems.\1378\

        ---------------------------------------------------------------------------

        \1376\ SIFMA Letter at 5-6; Bloomberg Letter at 7; Data Boiler Letter at 16-17, 36 (noting that the timing to retire duplicative reporting systems should be ``now or never'' and that CAT should have a milestone target of sun-setting OATS on the first day CAT goes live); FSR Letter at 10; TR Letter at 2-3; FIF Letter at 4 (noting that lack of an aggressive, detailed and committed retirement plan will result in excessive costs for CAT Reporters); Fidelity Letter at 2, 4-5 (noting that the Plan should establish a fixed date for retiring regulatory compliance systems that overlap with the CAT or, in the alternative, duplicative rules should sunset automatically once the CAT reaches certain performance metrics).

        \1377\ SIFMA Letter at 5-6.

        \1378\ FIF Letter at 26, 31-34. For example, FIF suggests that the Participants should complete their analyses of duplicative and partially duplicative rules and systems upon approval of the CAT NMS Plan and that the Participants should file rule changes to implement rule modifications or deletions when the Technical Specifications are released. Id.

        ---------------------------------------------------------------------------

        In addition, several commenters suggested replacing or modifying the duplicative reporting period with a ``test period'' or ``trial period.'' \1379\ In this regard, one commenter suggested modifying the CAT NMS Plan to include a trial period of no more than six months, after which duplicative systems are retired or firms are exempted from duplicative reporting if they have met certain error rate requirements.\1380\ Similarly, another commenter recommended replacing the duplicative reporting period with a trial period mirroring production, lasting no longer than six months, and providing that the actual launch of CAT functionality be linked to the retirement of existing systems and the end of the trial period.\1381\ Other commenters suggested that the launch of CAT should be linked to the retirement of existing reporting systems, noting that it is important to maintain a single audit trail of record to avoid duplicative reporting.\1382\

        ---------------------------------------------------------------------------

        \1379\ See, e.g., FSR Letter at 10 (recommending the replacement of the currently contemplated duplicative reporting period with a test period of the new CAT reporting system).

        \1380\ FIF Letter at 6, 25-28, 39 (recommending that there should be no penalties, archiving requirements or regulatory inquiries related to CAT reporting during this trial period).

        \1381\ TR Letter at 2.

        \1382\ FSR Letter at 10; TR Letter at 2.

        ---------------------------------------------------------------------------

        One commenter suggested that the Participants should provide detailed requirements regarding retirement of existing systems to the Plan Processor after the Plan Processor is selected to ensure that the Technical Specifications include all functionality necessary to retire existing systems.\1383\ Similarly, other commenters noted that the CAT should be designed in the first instance to include all data field information necessary to allow prompt elimination of redundant systems.\1384\ One

        Page 84773

        commenter noted that the CAT should be so designed even if it means that CAT includes information, products, or functionality not necessary to meet the minimum initial CAT requirements under Rule 613.\1385\ This commenter also proposed that the CAT should be designed to allow the ready addition of data fields over time to enhance the ability to retire other systems and capture additional necessary information.\1386\

        ---------------------------------------------------------------------------

        \1383\ TR Letter at 4.

        \1384\ SIFMA Letter at 5-6; DAG Letter at 2 (suggesting that the Technical Specifications and functional requirements should include certain data attributes to assist in retiring duplicative systems and that the inclusion of OTC equities will more readily allow for the retirement of duplicative systems) ; see also STA Letter at 1 (supporting the DAG Letter's elimination of systems recommendations).

        \1385\ SIFMA Letter at 5-6.

        \1386\ Id. at 5-6.

        ---------------------------------------------------------------------------

        One commenter outlined the steps that it believes are necessary to retire OATS and COATS.\1387\ This commenter stated that these systems cannot be eliminated until FINRA and CBOE can seamlessly continue performing their current surveillance on their member firms and that the relevant data elements needed by FINRA and CBOE to perform the current surveillance would need to be retained as part of CAT's Technical Specifications.\1388\

        ---------------------------------------------------------------------------

        \1387\ Id. at 10-12.

        \1388\ Id.

        ---------------------------------------------------------------------------

        In response to the comments recommending that the Participants accelerate the timeline to identify their existing rules and systems that are duplicative of CAT requirements and that CAT should be designed in the first instance to include all data field information necessary to allow prompt elimination of such redundant systems, the Participants explained that they recognize the importance of eliminating duplicative reporting requirements as rapidly as possible.\1389\ The Participants also stated that to expedite the retirement of duplicative systems, the Participants with duplicative systems have already completed gap analyses for systems and rules identified for retirement (in full or in part), and confirmed that data that would need to be captured by the CAT to support retirement of these systems will be included in the CAT.\1390\ Specifically, the relevant Participants have evaluated each of the following systems/

        rules: FINRA's OATS Rules (7400 Series),\1391\ COATS and associated rules, NYSE Rule 410(b), PHLX Rule 1022, CBOE Rule 8.9, EBS and associated rules, C2 Rule 8.7 and CHX BrokerPlex reporting (Rule 5).\1392\ In addition, the Participants stated that a broader review of the Participants' rules intended to identify any other impact that the CAT may have on the Participants' rules and systems generally is ongoing.\1393\ The Participants also explained that once the Plan Processor is selected, the Participants will work with the Plan Processor and the industry to develop detailed Technical Specifications that ensure that by the time Industry Members are required to report to the CAT, the CAT will include all data elements necessary to facilitate the rapid retirement of these duplicative systems.\1394\

        ---------------------------------------------------------------------------

        \1389\ Response Letter II at 21.

        \1390\ Id.

        \1391\ The Participants stated that this review also would cover the rules of other Participants that incorporate FINRA's OATS requirements. Response Letter II at 21 (citing NASDAQ Rule 7000A Series, BX Rule 6950 Series, PHLX Rule 3400 Series, NYSE Rule 7400 Series, NYSE Arca Equities Rule 7400 Series, NYSE MKT Rule 7400 Series).

        \1392\ Response Letter II at 21.

        \1393\ Id. (noting that descriptions of OATS and EBS gap analyses created on behalf of the Participants are available for public review on the CAT NMS Plan Web site and that Participants have worked to keep these gap analyses up-to-date by including newly-added data fields in these duplicative systems, such as the new OATS data fields related to the tick size pilot and ATS order book changes, in the gap analyses).

        \1394\ Id. at 20-21.

        ---------------------------------------------------------------------------

        To reflect these efforts, the Participants recommended an acceleration of the timelines for analyzing duplicative rules and systems by recommending amendments to Appendix C of the CAT NMS Plan to change the completion dates for their analyses of: (1) Duplicative rules and systems to nine to twelve months from Plan approval (rather than 12 months from the onset of Industry Member reporting) and (2) partially duplicative and non-duplicative rules and systems to nine to twelve months from Plan approval (rather than 18 months from the onset of Industry Member reporting).\1395\ However, the Participants noted that these proposed timelines are based on the Plan Processor's appropriate and timely implementation of the CAT and the CAT Data being sufficient to meet the surveillance needs of each Participant.\1396\

        ---------------------------------------------------------------------------

        \1395\ Id. at 22-26.

        \1396\ Id. at 22.

        ---------------------------------------------------------------------------

        In response to the comments recommending that duplicative systems be retired on a fixed date, the Participants explained that they cannot commit to retiring any duplicative systems by a designated date because the retirement of a system depends on a variety of factors.\1397\ For example, the Participants explained that they would need to ensure that the CAT Data is sufficiently extensive and of high quality before they could rely on it for regulatory oversight purposes and that they would be unable to retire any of their duplicative systems until any rule changes related to such systems retirements are approved by the Commission.\1398\ The Participants also noted that the elimination of potentially duplicative requirements established by the Commission (e.g., EBS reporting pursuant to SEC Rule 17a-25 and large trader reporting pursuant to SEC Rule 13h-1) are outside the Participants' purview.\1399\ In addition, in response to the comment that the Participants lack an incentive to retire duplicative systems, the Participants explained that they are incented to eliminate systems that would be extraneous for regulatory purposes after CAT is operational due to the significant costs Participants face in running such systems.\1400\

        ---------------------------------------------------------------------------

        \1397\ Id. at 20-21.

        \1398\ See id.

        \1399\ Id.; see also Section IV.D.9.b, infra, discussing the Commission's plans to retire certain aspects of EBS and large trader reporting and other SEC rules once CAT is operational.

        \1400\ Response Letter II at 20.

        ---------------------------------------------------------------------------

        In response to the comments suggesting the use of a trial period to transition to the CAT, the Participants stated that they recognize the concerns regarding the potential for disciplinary actions during the commencement of reporting to the CAT when, despite good faith efforts, reporting errors may develop due to the lack of experience with the CAT.\1401\ Accordingly, the Participants stated that they will take into consideration the lack of experience with the CAT when evaluating any potential regulatory concerns with CAT reporting during the first months after such reporting is required.\1402\ In addition, the Participants stated that they intend to work together with Industry Members to facilitate their CAT reporting; for example, the CAT's testing environments will provide an opportunity for Industry Members to gain experience with the CAT, and the Plan Processor will provide Industry Members with a variety of resources to assist them during onboarding and once CAT reporting begins, including user support and a help desk.\1403\

        ---------------------------------------------------------------------------

        \1401\ Id. at 27.

        \1402\ Id.

        \1403\ Id.

        ---------------------------------------------------------------------------

        The Commission acknowledges that a protracted period of duplicative reporting would impose significant costs on broker-dealers and recognizes the importance of retiring duplicative rules and systems as soon as possible and of setting forth an appropriate schedule to achieve such retirement in the CAT NMS Plan. As discussed above, although a broader review of the Participants' rules intended to identify any other impact that the CAT may have on the Participants' rules and systems generally is ongoing, the Participants have completed gap analyses for

        Page 84774

        systems and rules identified for full or partial retirement, including larger systems such as OATS and COATS. The Participants have confirmed that the data needed to support the retirement of these key systems will be included in the CAT,\1404\ and have proposed to accelerate the projected dates for completing these analyses of duplicative, partially duplicative, and non-duplicative rules and systems to nine to twelve months after Plan approval.

        ---------------------------------------------------------------------------

        \1404\ Id. at 21.

        ---------------------------------------------------------------------------

        Although the Commission appreciates these efforts to accelerate the retirement of existing data reporting rules and systems that are duplicative of the CAT, the Commission believes that stronger Plan amendments than those recommended by the Participants should be made to ensure that such rules and systems are eliminated, modified, or retired as soon as practicable after the CAT is operational so that the period of duplicative reporting is kept short. Therefore, the Commission is amending Section C.9 of Appendix C of the Plan to reflect the Participants' representation that their analyses of key duplicative systems are already complete and to provide that proposed rule changes to effect the retirement of duplicative systems, effective at such time as CAT Data meets minimum standards of accuracy and reliability, shall be filed with the Commission within six months of Plan approval.

        Based on the Participants' statement in their response to comments that their gap analyses are complete with respect to the major existing trade and order data reporting systems, the Commission believes that the process of assessing which systems can be retired after CAT is operational is in an advanced stage. Rather than amending the Plan to state that these analyses for duplicative systems will be complete within nine to twelve months of the Commission's approval of the CAT NMS Plan, as recommended by the Participants, the Commission believes that the milestones listed in Appendix C should include the Participants' representation that they have completed gap analyses for key rules and systems and should enumerate those specific systems because this more accurately reflects, and more prominently and clearly conveys to market participants and the public, the status of the Participants' planning for the transition from existing systems to CAT.

        For these reasons, the Commission is also amending Section C.9 of Appendix C of the Plan to require the Participants to file with the Commission rule change proposals to modify or eliminate duplicative rules and systems within six months of the Effective Date. These filings will not effectuate an immediate retirement of duplicative rules and systems--the actual retirement of such rules and systems must depend upon the availability of comparable data in CAT of sufficient accuracy and reliability for regulatory oversight purposes, as specified in the Participants' rule change proposals. The Commission also is amending the Plan to require the Participants, in their rule change proposals, to discuss specific accuracy and reliability standards that will determine when duplicative systems will be retired, including, but not limited to, whether the attainment of a certain Error Rate should determine when a system duplicative of the CAT can be retired. Although these amendments were not suggested by the Participants, the Commission believes that the rule change filing milestone should be changed to six months from Plan approval given the status of the Participants' gap analyses and because the actual retirement of rules and systems will only occur once CAT Data meets minimum standards of accuracy and reliability. In addition, the Commission believes that an explicit statement in the Appendix C milestones that the retirement of systems that are duplicative of CAT shall occur once CAT Data meets minimum standards of accuracy and reliability will provide greater clarity regarding how the transition from existing reporting systems to the CAT will proceed. In addition, these amendments will better align the systems retirement schedule with the broader CAT implementation schedule. For example, requiring rule change proposals to be submitted to the Commission within six months will ensure that public comments, and Commission review of these comments, which could inform the development of the Technical Specifications, will be in progress as the Technical Specifications for Industry Member data submission are being developed (i.e., at least fifteen months before Industry Members are required to report to CAT).

        The Commission believes that, taken together, these amendments may facilitate an accelerated retirement of existing data reporting rules and systems that are duplicative of CAT and thus reduce the length of the duplicative reporting period as compared to the Plan as filed. Given that their requisite analytical work is already substantially complete, the Commission believes that the milestones, as amended, are achievable without a substantial increase in the burdens imposed on the Participants. Given the importance of retiring existing systems as rapidly as possible to reduce the substantial burdens on Industry Members that come with an extended period of duplicative reporting, the Commission believes that these amendments are appropriate. The CAT NMS Plan, as amended, recognizes that the Participants' requisite analytical work is already substantially complete and explicitly conditions the elimination of duplicative reporting only on the availability of accurate and reliable CAT Data that will enable the SROs to carry out their regulatory and oversight responsibilities. The amended Plan also accelerates the initiation of the formal process of retiring duplicative rules and systems by requiring that rule change filings be filed within six months of the Effective Date.

        The Commission believes that the CAT NMS Plan, as amended, contains an appropriate level of detail regarding the process of retiring duplicative rules and systems. However, the Commission is not amending the Plan to include fixed or mandatory dates for the retirement of existing rules and systems at this time. As the Participants noted in their response to comments, retiring a system depends upon many factors, including the availability of sufficiently extensive and high quality CAT Data.\1405\ The Commission and the SROs will continue to rely on the information collected through existing regulatory reporting systems to reconstruct market events, conduct market analysis and research in support of regulatory decision-making, and conduct market surveillance, examinations, investigations, and other enforcement functions until sufficiently complete, accurate, and reliable data is available through CAT. Therefore, precise dates for retiring these rules and systems cannot be determined prospectively. However, the Commission agrees with the Participants that they have incentives to retire extraneous systems after CAT is operational due to the desire to avoid the costs associated with maintaining such systems; the Commission believes that these incentives will mitigate any delay that would otherwise result from the difficulty of setting forth specific system retirement dates in advance.

        ---------------------------------------------------------------------------

        \1405\ Response Letter II at 20.

        ---------------------------------------------------------------------------

        As discussed above, the gap analyses completed by the Participants regarding the key existing trade and order data systems have confirmed that the CAT contains the data fields necessary to retire these systems, and the

        Page 84775

        Commission has amended the Plan to ensure that any additional analysis related to duplicative rule and system retirement is completed in a timely manner. The Participants also explained that once the Plan Processor is selected, the Participants will work with the Plan Processor and Industry Members to develop detailed Technical Specifications that ensure that by the time Industry Members are required to report to the CAT, the CAT will include all data elements necessary to facilitate the rapid retirement of duplicative systems.\1406\ The Commission agrees that the Participants should work with the Plan Processor and Industry Members in this manner and provide appropriate information about how they use trade and order data collected through existing rules and systems to ensure that the Technical Specifications are developed with these requirements in mind. In addition, with respect to the comment that CAT should be designed to permit the inclusion of additional data fields, the Commission notes that the Plan contains provisions regarding periodic reviews and upgrades to CAT that could lead to proposing additional data fields that are deemed important,\1407\ and does not believe any changes to the Plan are necessary.

        ---------------------------------------------------------------------------

        \1406\ Id. at 20-21.

        \1407\ See Notice, supra note 5, at 30700.

        ---------------------------------------------------------------------------

        (2) Proposed Alternative Approaches to Systems Retirement

        Several commenters suggested linking the retirement of duplicative systems to the error rate or quality of data reported to CAT. For example, one commenter suggested that the CAT NMS Plan should be amended to include an exemption from duplicative reporting obligations for individual brokerhyphendealers based on meeting certain CAT reporting quality metrics.\1408\ Similarly, another commenter suggested that a ``Retirement Error Rate'' should be defined as the acceptable error rate for discontinuing reporting to a duplicative system, and that the Retirement Error Rate should be based on comparable data in CAT (e.g., OATS equivalent data reported to CAT should meet the reporting and quality criteria required by FINRA, but higher error rates associated with data elements that are outside the scope of existing systems should not prevent the retirement of such systems).\1409\ One commenter suggested reducing the error rate as quickly as possible to facilitate the elimination of duplicative systems by including a test period to bring reporting near a 1% error rate when CAT is launched in production.\1410\ This commenter also noted that disparities in error rate tolerance between CAT and other existing regulatory reporting systems should not serve as a pretext for prolonging the lifespan of those legacy systems.\1411\ Several commenters suggested that the error rates used for elimination of duplicative systems should be post-correction error rates and that when a firm meets the necessary standards, the Plan should allow for individual firm exemptions from duplicative reporting.\1412\

        ---------------------------------------------------------------------------

        \1408\ KCG Letter at 2-3.

        \1409\ FIF Letter at 5, 24-26; see also Bloomberg Letter at 8 (noting that the Commission should specify an appropriate error rate for CAT NMS reporting such that, once met, CAT reporters can retire superseded systems).

        \1410\ SIFMA Letter at 6-7.

        \1411\ Id.

        \1412\ Id. at 7; see also FIF Letter at 5, 24 (corrected data should be used for error rates and individual firms should be allowed to retire duplicative systems once the Retirement Error Rate is achieved); TR Letter at 5-6; FSR Letter at 9 (stating that the error rate should only apply to post-correction data on equities). Section IV.D.11, infra, discusses the Commission's response to commenters suggesting the use of post-correction error rates.

        ---------------------------------------------------------------------------

        One commenter also noted that the Participants have not adequately incorporated the 14-month milestone associated with the requirement that they enhance their surveillance systems \1413\ into their milestones for the retirement of existing systems, noting that if the Participants are prepared to use CAT Data after 14 months, there should be no obstacles to retiring existing systems once the Retirement Error Rates are met.\1414\ If the 14-month milestone is insufficient to obligate the Participants to use CAT Data in place of existing systems, this commenter would recommend a new milestone be created such that by the end of a trial period, the Participants must use CAT Data in place of existing systems.\1415\

        ---------------------------------------------------------------------------

        \1413\ 17 CFR 242.613(a)(3)(iv).

        \1414\ FIF Letter at 6, 24-25.

        \1415\ Id.

        ---------------------------------------------------------------------------

        Several commenters expressed support for the Plan's exemption from OATS reporting for CAT Reporters as long as there would be no interruption in FINRA's surveillance capabilities and urged the SROs to consider a similar approach for firms that meet certain error rate thresholds.\1416\

        ---------------------------------------------------------------------------

        \1416\ DAG Letter at 2; FIF Letter at 23; see also STA Letter at 1 (supporting the DAG Letter's elimination of systems recommendations).

        ---------------------------------------------------------------------------

        Similarly, one commenter suggested a ``principles-based framework'' for eliminating potentially duplicative systems.\1417\ This framework would include: (i) A ``phased'' elimination program in which reporters that have achieved sufficient accuracy in CAT reporting can individually retire their systems; (ii) designing the Central Repository from the outset to include the ability to implement all of the surveillance methods and functions currently used by SROs; (iii) rather than relying on a simple field-mapping exercise to determine which systems can be eliminated, considering whether all the data elements currently reported under existing systems are really needed for the types of surveillance and other analyses typically undertaken by the Participants, whether the Central Repository can use alternative methods of surveillance or analysis that do not rely on those data elements, and whether data elements currently collected by an existing reporting system that are not available in the Central Repository could be derived or computed from data that is in the Central Repository; and (iv) requiring that questions to broker-dealers regarding their reported data should be directed though the process created for the Central Repository, not through previously-established channels based on legacy systems.\1418\

        ---------------------------------------------------------------------------

        \1417\ SIFMA Letter at 7-10.

        \1418\ Id. SIFMA also applied this framework to the retirement of OATS, EBS, and COATS. See id. at 10-12.

        ---------------------------------------------------------------------------

        Several commenters suggested that the Commission should impose a moratorium on changes to existing systems to coincide with the launch of CAT to enable firms to dedicate resources to the successful launch and operation of CAT rather than the maintenance of legacy systems.\1419\ In addition, several commenters suggested that the Plan should allow for elimination of individual systems as they become redundant or unnecessary once production commences in CAT.\1420\

        ---------------------------------------------------------------------------

        \1419\ Id. at 5-6; see also TR Letter at 5 (calling for such a moratorium to commence once the Technical Specifications are in development to ensure that the Technical Specifications are sufficiently robust and to avoid enhancing systems that will be retired); Fidelity Letter at 2, 4-5 (noting that the Plan should call for an immediate cessation of enhancements to existing broker-

        dealer reporting systems which will retire once the CAT is operational); KCG Letter at 3 (noting that there should be a cessation of any changes to duplicative reporting systems during the period leading up to the CAT compliance date and once brokerhyphendealers have to begin reporting to the CAT and any such changes should be built in to the CAT); FIF Letter at 27.

        \1420\ SIFMA Letter at 5-6; FSR Letter at 10 (stating that to the extent that any subset of data collected under the CAT NMS Plan is otherwise collected under a different reporting regime, the existing reporting regime should be amended as soon as possible to remove the duplicative reporting requirement).

        ---------------------------------------------------------------------------

        In response to the comments recommending that exemptions be granted for individual Industry Member CAT Reporters from duplicative reporting obligations if they meet a

        Page 84776

        specified data reporting quality threshold, the Participants explained that this would implicate the rules of the individual Participants and would be dependent upon the availability of extensive and high quality CAT Data, as well as Commission approval of rule change proposals by the Participants and the elimination of Commission data reporting rules such as Rules 17a-25 and 13h-1.\1421\ Therefore, the Participants did not recommend an amendment to the Plan to incorporate such an exemption from the individual Participants' rules.\1422\

        ---------------------------------------------------------------------------

        \1421\ Response Letter II at 26.

        \1422\ Id.

        ---------------------------------------------------------------------------

        Nevertheless, the Participants explained that they have been exploring whether the CAT or the duplicative systems would require additional functionality to permit cross-system regulatory analyses that would minimize the duplicative reporting obligations.\1423\ The Participants stated that FINRA remains committed to working with the Plan Processor to integrate CAT Data with data collected by OATS if it can be accomplished in an efficient and cost effective manner.\1424\ However, the Participants stated that FINRA anticipates that CAT Reporters who are FINRA members and report to OATS will need to report to both OATS and the CAT for some period until FINRA can ensure that CAT Data is of sufficient quality for surveillance purposes and FINRA is able to integrate CAT Data with the remaining OATS data in a way that permits it to continue to perform its surveillance obligations.\1425\ In addition, the Participants stated that FINRA believes that requiring all current OATS reporters to submit data to the Central Repository within two years after the Commission approves the Plan may reduce the amount of time that OATS and CAT will need to operate concurrently and may help facilitate the prompt retirement of OATS.\1426\

        ---------------------------------------------------------------------------

        \1423\ Id.

        \1424\ Id. (noting that the Plan states that FINRA would consider exempting firms from the OATS requirements if the data submitted to the CAT is of sufficient quality for surveillance purposes and FINRA is able to integrate CAT Data with the remaining OATS data in a way that permits it to continue to perform its surveillance obligations).

        \1425\ Id.

        \1426\ Id.

        ---------------------------------------------------------------------------

        In response to the comment that the CAT should be designed from the outset to include the ability to implement all of the surveillance methods and functions currently used by the Participants, the Participants explained that CAT is not intended to be the sole source of surveillance for each Participant, and, therefore, would not cover all surveillance methods currently employed by the Participants.\1427\ However, the Participants stated that, with the goal of using the CAT rather than duplicative systems for surveillance and other regulatory purposes, the Participants have provided the Bidders with specific use cases that describe the surveillance and investigative scenarios that the Participants and the Commission would require for the CAT, and that during the bidding process each Bidder has been required to demonstrate its ability to meet these criteria.\1428\ In addition, the Participants noted that they have had multiple discussions with the Bidders regarding the query capabilities that each Bidder would provide, and the Participants believe that the selected Plan Processor will have the capability to provide the necessary surveillance methods and functions to allow for the retirement of duplicative systems.\1429\ The Participants also stated that the Plan Processor will provide support, including a trained help-desk staff and a robust set of testing, validation, and error correction tools, to assist CAT Reporters as they transition to CAT reporting.\1430\

        ---------------------------------------------------------------------------

        \1427\ Id. at 27.

        \1428\ Id.

        \1429\ Id.

        \1430\ Response Letter I at 38-39.

        ---------------------------------------------------------------------------

        In response to comments concerning a moratorium on changes to new systems, the Participants explained that they plan to minimize the number of changes that are rolled out to duplicative systems to the extent possible.\1431\ The Participants, however, cannot commit to making no changes to the duplicative systems as some changes may be necessary before these systems are retired--for example, changes to these duplicative systems may need to be made to address Commission initiatives, new order types or security-related changes.\1432\

        ---------------------------------------------------------------------------

        \1431\ Response Letter II at 28.

        \1432\ Id.

        ---------------------------------------------------------------------------

        The Commission agrees with the commenters that the accuracy of the data reported to CAT, as in part measured by CAT Reporters' Error Rate, should be a factor in determining whether and when duplicative trade and order data rules and systems should be eliminated. As discussed above, the rule change proposals regarding duplicative systems retirement that the Participants will file with the Commission within six months of the Effective Date must condition the elimination of existing data reporting systems on CAT Data meeting minimum standards of accuracy and reliability. The Commission believes that this approach may incentivize accurate CAT reporting because it could potentially allow Industry Members to retire redundant, and costly to maintain, systems sooner. The Commission believes that any such improvements in accuracy, together with the amended Plan's reduction of the period for the Participants to complete their analyses of duplicative, partially duplicative, and non-duplicative rules and its acceleration of the requirement to file system elimination rule change proposals, should facilitate an earlier retirement of duplicative systems. However, the Commission does not believe that a specific Error Rate that would automatically trigger the elimination of the collection of data through an existing, duplicative system can be set in advance, through a Plan amendment at this time. Rather, the more flexible standard set forth in the Plan, as amended--that duplicative systems will be retired as soon as possible after data of sufficient accuracy and reliability to ensure that the Participants can effectively carry out their regulatory obligations is available in CAT--recognizes the primacy of ensuring that CAT Data can be used to perform all regulatory functions before existing systems are retired, and is therefore more appropriate.

        In response to the comments regarding individual exemptions from reporting to duplicative systems for Industry Members whose CAT reporting meets certain quality thresholds, the Commission supports the Participants' efforts to explore whether this can be feasibly accomplished by adding functionality to permit cross-system regulatory analyses that would minimize duplicative reporting obligations or, in the case of OATS, integrating CAT Data with data collected by OATS. Accordingly, the Commission is amending Section C.9 of Appendix C of the Plan to require that the Participants consider, in their rule filings to retire duplicative systems, whether individual Industry Members can be exempted from reporting to duplicative systems once their CAT reporting meets specified accuracy standards, including, but not limited to, ways in which establishing cross-system regulatory functionality or integrating data from existing systems and the CAT would facilitate such individual Industry Member exemptions. However, the Commission does not believe that it would be appropriate, at this time, to amend the Plan to require the Participants to grant such individual

        Page 84777

        exemptions because, as noted by the Participants, it may not be feasible to implement the technological and organizational mechanisms that would obviate the need for duplicative reporting by ensuring that the Participants can effectively carry out their regulatory obligations using CAT Data.

        In response to the comment that the CAT should be designed from the outset to include the ability to implement all of the surveillance methods and functions currently used by the Participants, the Commission notes that the Participants have indicated that they have provided the Bidders with their surveillance and investigative use cases, that each Bidder has been required to demonstrate its ability to meet these criteria, and that the selected Plan Processor will have the capability to provide the necessary surveillance methods and functions to allow for the retirement of duplicative systems. Therefore, the Commission believes that the CAT is being designed to include the ability to implement all of the surveillance methods and functions currently used by the Participants, and is not amending the Plan in response to this comment.

        In response to the commenter that suggested a specific principles-

        based framework for retiring duplicative systems,\1433\ the Commission believes that, in general, the principles outlined in the CAT NMS Plan for retiring potentially duplicative rules and systems are reasonable. The principles outlined in the Plan recognize that the Participants and the Commission will continue to rely on information collected through existing regulatory reporting systems to reconstruct market events, conduct market analysis and research in support of regulatory decision-

        making, and conduct market surveillance, examinations, investigations, and other enforcement functions until analogous information is available through CAT. Some period of duplicative reporting may be necessary to ensure that regulators can obtain accurate and reliable information through CAT to carry out these functions. However, the Commission also agrees that the CAT Reporter support, testing, and validation tools created for the CAT--rather than similar tools associated with legacy reporting systems--should be used to assist Industry Members as they transition to CAT reporting.\1434\

        ---------------------------------------------------------------------------

        \1433\ SIFMA Letter at 7-10.

        \1434\ See supra notes 1403, 1430 and accompanying text.

        ---------------------------------------------------------------------------

        The Commission agrees with the Participants that there cannot be a moratorium on changes to existing systems in connection with the launch of CAT. As discussed above, the Commission and the SROs use the information collected through existing regulatory reporting systems to carry out a variety of regulatory functions. Until these systems are fully retired, the Commission and the SROs will continue to rely upon these systems to obtain the information they need to perform these functions. Therefore, because changes to these systems may be necessary for the Commission or the SROs to obtain such information, the Commission does not believe a moratorium should be imposed on changes to these systems. However, the Commission supports the Participants' commitment to minimizing changes to existing systems and encourages the Participants to consider the necessity of any such changes and any additional burden such changes would impose on their members during the period in which members are transitioning to CAT reporting. Accordingly, the Commission is amending Section C.9 of Appendix C of the Plan to state that between the Effective Date and the retirement of the Participants' duplicative systems, each Participant, to the extent practicable, will attempt to minimize changes to those duplicative systems.

      29. Retirement of Systems Required by SEC Rules

        The CAT NMS Plan also discusses specific Commission rules that potentially can be eliminated in connection with CAT implementation. Specifically, the Plan states that, based on preliminary industry analyses, large trader reporting requirements under SEC Rule 13h-1 could be eliminated. In contrast, the Plan states that ``large trader reporting responsibilities on Form 13H and self-identification would not appear to be covered by the CAT.'' \1435\

        ---------------------------------------------------------------------------

        \1435\ See CAT NMS Plan, supra note 5, at Appendix C, Section C.9.

        ---------------------------------------------------------------------------

        One commenter suggested that the Commission should eliminate requirements such as Rule 13h-1 and Form 13H regarding large trader filings, noting that Commission Staff will have access to the same information that they are receiving through Form 13H through CAT.\1436\ Another commenter recommended the elimination of the EBS system, under SEC Rule 17a-25,\1437\ with respect to equity and option data.\1438\

        ---------------------------------------------------------------------------

        \1436\ MFA Letter at 9.

        \1437\ 17 CFR 240.17a-25.

        \1438\ SIFMA Letter at 10-11. This commenter also explained that in order to retire EBS, the relevant data elements that are included in an EBS report need to be retained as part of CAT's Technical Specifications and the accuracy of the CAT Data reported by member firms should meet an acceptable threshold for its error/rejection rate. Id. The commenter also noted that fixed income data, since it will not be available initially through CAT, will still need to be requested through the EBS system and that historical equity and option data will have to be retained and archived to accommodate requests for this data through EBS. Id.

        ---------------------------------------------------------------------------

        In their response, the Participants noted that ``the elimination of potentially duplicative requirements established by the SEC (e.g., SEC Rule 17a-25 regarding electronic submission of securities transactions the EBS system and SEC Rule 13h-1 regarding large traders) are outside the Participants' purview.'' \1439\

        ---------------------------------------------------------------------------

        \1439\ Response Letter II at 21.

        ---------------------------------------------------------------------------

        The Commission acknowledges that duplicative reporting will impose significant burdens and costs on broker-dealers, that certain SEC rules require the reporting of some information that will also be collected through CAT, and that certain SEC rules may need to be modified or eliminated in light of CAT. Specifically, the Commission believes that, going forward, CAT will provide Commission Staff with much of the equity and option data that is currently obtained through equity and option cleared reports \1440\ and EBS,\1441\ including the additional transaction data captured in connection with Rule 13h-1 concerning large traders.\1442\ Accordingly, Commission Staff is directed to develop a proposal for Commission consideration, within six months of the Effective Date, to: (i) Amend Rule 17a-25 to eliminate the components of EBS that are redundant of CAT, and (ii) amend Rule 13h-

        1,\1443\ the large trader Rule, to eliminate its transaction reporting requirements, in each case effective at such time as CAT Data meets minimum standards of accuracy and reliability. In addition, as part of this proposal, Commission Staff will recommend whether there will continue to be any need for the

        Page 84778

        Commission to make requests for equity and option cleared reports, except for historical data, once CAT is fully operational and CAT Data meets minimum standards of accuracy and reliability.\1444\ The Commission notes that the EBS system will still be used to collect historical equity and options data--i.e., for executions occurring before CAT is fully operational--and data on asset classes not initially covered by CAT, such as fixed income, municipal, or other government securities, and that the components of the EBS system necessary to enable such usage will need to be retained. However, to the extent that CAT is expanded to include data on additional asset classes, the Commission will consider whether the components of the EBS system related to the retention and reporting of data on these asset classes can also be eliminated.\1445\

        ---------------------------------------------------------------------------

        \1440\ See Notice, supra note 5, at 30660 (discussing equity and option cleared reports).

        \1441\ See id. (discussing the EBS system).

        \1442\ 17 CFR 240.13h-1; see also Adopting Release, supra note 14, at 45734 (``The Commission . . . notes . . . that . . . aspects of Rule 13h-1 may be superseded by Rule 613. Specifically, the trade reporting requirements of Rule 13h-1 are built upon the existing EBS system. To the extent that . . . data reported to the central repository under Rule 613 obviates the need for the EBS system, the Commission expects that the separate reporting requirements of Rule 13h-1 related to the EBS system would be eliminated.'')

        \1443\ 17 CFR 240.13h-1(e).

        \1444\ At this time, the Commission does not anticipate that there will be a need to make such requests.

        \1445\ In addition, the Commission does not anticipate that it will make requests for equity and option cleared reports, except for historical data, once CAT is fully operational.

        ---------------------------------------------------------------------------

        The Commission does not agree with the comment that SEC Staff will have access through CAT to the ``same information'' that it receives through Form 13H.\1446\ Form 13H collects information to identify a large trader, its securities affiliates, and its operations, and does not collect audit trail data on effected transactions. The self-

        identification and other Form 13H filing requirements of Rule 13h-1 will not be duplicated by or redundant of CAT.

        ---------------------------------------------------------------------------

        \1446\ To cite one example, Item 4 of Form 13H requires large traders to provide an ``Organizational Chart'' that will not be reported under CAT.

        ---------------------------------------------------------------------------

      30. Record Retention

        The CAT NMS Plan states that certain broker-dealer recordkeeping requirements could be eliminated once the CAT is operational.\1447\ The Plan also requires that information reported to the Central Repository be retained in a convenient and usable standard electronic data format that is directly available and searchable electronically without any manual intervention by the Plan Processor for a period of not less than six years.\1448\

        ---------------------------------------------------------------------------

        \1447\ See CAT NMS Plan, supra note 5, at Appendix C, Section C.9.

        \1448\ See id. at Section 6.5(b).

        ---------------------------------------------------------------------------

        One commenter suggested that record retention by the CAT should be established for periods long enough to satisfy regulatory requirements associated with other regulatory systems (e.g., the seven year record retention requirement for EBS) and that the Commission should consider the extent to which CAT reporting could fulfill recordkeeping obligations for a CAT Reporter.\1449\

        ---------------------------------------------------------------------------

        \1449\ SIFMA Letter at 5-6.

        ---------------------------------------------------------------------------

        The Participants explained that the Plan's six-year retention period exceeds the record retention period applicable to national securities exchanges and national securities associations under SEC Rules 17a-1(b) and 17a-6(a),\1450\ which require that documents be kept for at least five years.\1451\ The Participants further explained that they do not believe that the Plan's record retention requirements should be expanded beyond six years since such expansion would impact Bidder solutions and the maintenance costs associated with the CAT.\1452\ With respect to the comment regarding CAT Reporters using the CAT to satisfy their recordkeeping obligations, the Participants maintained that it would be inappropriate for CAT Reporters to fulfill their recordkeeping obligations by relying on the Central Repository in the initial phase of CAT reporting because permitting this use of the Central Repository would impose additional regulatory and resource obligations on the Central Repository.\1453\ In the longer term, the Participants recognized that the Central Repository could be a useful tool to assist CAT Reporters in satisfying their recordkeeping and record retention obligations, and stated that after the implementation of CAT, the Operating Committee will review whether it may be possible for CAT Reporters to use the CAT to assist in satisfying certain recordkeeping and record retention obligations.\1454\

        ---------------------------------------------------------------------------

        \1450\ 17 CFR 240.17a-1(b), 17a-6(a).

        \1451\ Response Letter I at 27.

        \1452\ Id.

        \1453\ Id.

        \1454\ Id.

        ---------------------------------------------------------------------------

        The Commission disagrees with the suggestion from commenters that the CAT NMS Plan should be amended to extend its six-year record retention timeframe to satisfy the requirements of existing reporting systems. In addition to exceeding the five year retention period applicable to national securities exchanges and associations under Rules 17a-1(b) and 17a-6(a), as pointed out by the Participants, the Commission notes that the six-year timeframe set forth in the CAT NMS Plan reflects the six-year data retention requirement of Rule 17a-

        4(a).\1455\ The Commission does not anticipate that any variation between the retention periods for existing systems and the CAT system will hinder the potential retirement of existing systems that are duplicative of CAT. In addition, while the Commission believes it is important to implement the initial phases of CAT reporting first, once CAT is fully operational, the Participants, the Plan Processor, and the Commission can consider further enhancements to the CAT system, including enhancements that could potentially enable the Central Repository to satisfy certain broker-dealer recordkeeping requirements, such as those set forth in Rules 17a-3 and 17a-4.\1456\

        ---------------------------------------------------------------------------

        \1455\ See CAT NMS Plan, supra note 5, at Appendix C, Section D.12(m).

        \1456\ 17 CFR 240.17(a)(3)-(4).

        ---------------------------------------------------------------------------

        10. Primary Market Transactions and Futures

      31. Primary Market Transactions

        The CAT NMS Plan provides that the Participants jointly, within six months of the CAT NMS Plan's approval by the Commission, will provide a document (the ``Discussion Document'') to the Commission that will include a discussion of how Primary Market Transactions could be incorporated into the CAT.\1457\ In Appendix C of the CAT NMS Plan, the Participants conclude that the Discussion Document should be limited to sub-account allocations for Primary Market Transactions.\1458\ Moreover, the CAT NMS Plan does not require any specific timetable for Primary Market Transaction data to be reported to the CAT.

        ---------------------------------------------------------------------------

        \1457\ See CAT NMS Plan, supra note 5, at Section 6.11; see also infra note 3059. The CAT NMS Plan specifies that the Discussion Document will include details for (i) each order and Reportable Event that may be required to be provided, (ii) which market participants may be required to provide the data, (iii) the implementation timeline, and (iv) a cost estimate.

        \1458\ See CAT NMS Plan, supra note 5, at Appendix C, Section A.6.

        ---------------------------------------------------------------------------

        The Participants explained that for Primary Market Transactions there are generally two key phases: A ``book building'' phase and an allocation phase (which includes top-account allocations and sub-

        account allocations).\1459\ According to the Participants, the ``book building phase involves the process by which underwriters gather and assess investor demand for an offering of securities and seek information important to their determination as to the size and pricing of an issue. Using this and other information, the underwriter will then decide how to allocate IPO shares to purchasers.'' \1460\ The Participants' understanding is ``that these are so-called `top account' allocations--allocations to institutional clients or retail broker-

        dealers, and that such allocations are conditional and may fluctuate until the offering

        Page 84779

        syndicate terminates. Sub-account allocations occur subsequently, and are made by top-account institutions and broker-dealers prior to settlement.'' \1461\

        ---------------------------------------------------------------------------

        \1459\ Id.

        \1460\ Id.

        \1461\ Id.

        ---------------------------------------------------------------------------

        In reaching their decision to limit Primary Market Transactions data for CAT reporting to sub-account allocations, the Participants noted that sub-account allocations are ``maintained by broker-dealers in a manner that would allow for reporting to the Central Repository without unreasonable costs and could assist the Commission and the Participants in their regulatory obligations.'' \1462\ The Participants argued, however, that because top-account allocations are not firm and may fluctuate, reporting this information to the Central Repository ``would involve significantly more costs which, when balanced against the marginal benefit, is not justified at this time.'' \1463\

        ---------------------------------------------------------------------------

        \1462\ Id.

        \1463\ Id.

        ---------------------------------------------------------------------------

        The Commission received two comments advocating for delaying the inclusion of all Primary Market Transactions data in the CAT (and for excluding top-account allocation data),\1464\ and one comment supporting the inclusion of Primary Market Transaction data in the CAT, for both top-account and sub-account allocation data.\1465\ Specifically, the two commenters who advocated that Primary Market Transactions should be delayed until OATS and other regulatory reporting systems are retired cited ``mounting regulatory expenses'' and limited and different resources being required to address this element.\1466\ These commenters added that regulatory and surveillance requirements should be defined before adding Primary Market Transaction data to the CAT and disputed the Commission's assessment in the Notice of the CAT NMS Plan that top-account allocation should be a CAT data element.\1467\ One of these commenters noted that significant analysis and data modelling would be required to effectively and efficiently include Primary Market Transaction data.\1468\ The other commenter cited a DAG recommendation that if Primary Market Transaction data were required that only sub-account allocation data should be included due to operational feasibility.\1469\ The same commenter also requested clarification as to what is meant by Primary Market Transaction ``allocations,'' and described its understanding that ``allocations'' under Rule 613(a)(1)(vi) only apply to the final step in the allocation process (i.e., not the preliminary book building allocations but the actual placement into a customer's account).\1470\

        ---------------------------------------------------------------------------

        \1464\ See SIFMA Letter at 36; FIF Letter at 13, 118-20.

        \1465\ See Hanley Letter.

        \1466\ SIFMA Letter at 36; FIF Letter at 13 (noting that ``the primary market and the secondary market are inherently different . . . different rules and reporting requirements, . . . business processes, . . . vendors, . . . and systems with different technology personnel.'').

        \1467\ SIFMA Letter at 36; FIF Letter at 13; see also Notice, supra note 5, at 30772 (``The Commission preliminarily believes that the potential benefits of including top-account information in the CAT could be significant and that the costs of including top-account information could be lower than what is described in the CAT NMS Plan and appropriate in light of significant potential benefits. For these reasons, the Commission preliminarily believes that top-

        account information should not be excluded from the Discussion Document.'').

        \1468\ FIF Letter at 13.

        \1469\ SIFMA Letter at 36.

        \1470\ Id.

        ---------------------------------------------------------------------------

        The third commenter, however, advocated for including Primary Market Transaction data (both top-account and sub-account) in the CAT.\1471\ The commenter believed that regulators would benefit from having both sub-account and top-account Primary Market Transaction data, noting that such data would help regulators understand the economics of the offering process and could promote efficient capital formation.\1472\ The commenter reviewed academic literature related to the book building allocation process and suggested that the collection and analysis of Primary Market Transaction data could address open questions as to potential capital formation inefficiencies, including potential manipulation and/or violations of Rule 105 and fund manipulation.\1473\ The commenter stated that Form 13F data cannot fully capture primary market allocations because it is limited to institutional investment managers with investment discretion over $100 million, and because secondary market transactions may occur before the filing of Form 13F is required.\1474\ The commenter also recommended that the SROs and the Commission require indications of interest during preliminary book building to be made available in an easily accessible format for both regulators and academics outside of CAT.\1475\

        ---------------------------------------------------------------------------

        \1471\ Hanley Letter.

        \1472\ Id. at 1.

        \1473\ Id. at 2-3.

        \1474\ Id. at 1 (noting ``top-account allocations refer to allocations during the book-building process to institutional clients and retail broker-dealers . . . the subsequent sub-account allocations to the actual accounts receive the shares'').

        \1475\ Id. at 5-6. The commenter, however, stated that it is not requesting that CAT include pre-offer changes in tentative allocations. Hanley Letter at 4-6 (noting that during the pre-

        offering stage of a book-building process, preliminary indications of interest while gathered are believed to be subject to change).

        ---------------------------------------------------------------------------

        The commenter advocating for the inclusion of both top-account and sub-account allocation Primary Market Transaction data also cited and disputed a FIF estimate that it would cost broker-dealers approximately $704,200 per firm to provide initial allocation information, stating that ``manually entering top-account allocation information into CAT (if available) should cost substantially less than estimated.'' \1476\ The commenter estimated costs to be $2,400 per offering for providing top-account allocation information, and argued such costs would be ``de minimis with respect to the overall cost of issuance.'' \1477\ The commenter also contested FIF's cost estimate of $58.7 million for providing sub-account information, noting that if CAT were to replace EBS \1478\ then the incremental cost of providing sub-account allocation information should also be de minimis.\1479\

        ---------------------------------------------------------------------------

        \1476\ Id. at 4.

        \1477\ Id. at 5.

        \1478\ EBS are trading records requested by the Commission and SROs from broker-dealers that are used in regulatory investigations to identify buyers and sellers of specific securities.

        \1479\ Hanley Letter at 5.

        ---------------------------------------------------------------------------

        In response to commenters, the Participants maintained their support for including in the CAT sub-account allocations but did not support reporting, or discussing in the Discussion Document, top-

        account allocations.\1480\ The Participants reiterated that top-account allocation reporting for Primary Market Transactions would ``likely impose significant costs to CAT Reporters while only providing a marginal additional regulatory benefit over sub-account allocation data.'' \1481\ The Participants further stated that they have not determined a timeline for reporting Primary Market Transaction allocations, but have committed to not require it during the initial implementation phase of CAT.\1482\

        ---------------------------------------------------------------------------

        \1480\ Response Letter I at 49.

        \1481\ Id.

        \1482\ Id. at 50. In response to a commenter seeking clarification on the meaning of certain aspects of Primary Market Transactions, the Participants identified the relevant Plan provisions for the commenter. Id. at 50-51.

        ---------------------------------------------------------------------------

        Consistent with the reasoning stated in the adoption of Rule 613, the Commission believes that the Discussion Document should discuss the potential costs and benefits of expansion of CAT to include both top-

        account and sub-account allocations for Primary Market Transactions. At the

        Page 84780

        same time, the Commission acknowledges that mandating the inclusion of Primary Market Transaction data, either top-account or sub-account, would require Commission action following public notice and comment. The Commission discusses the Primary Market Transaction cost comments in its economic analysis below.\1483\

        ---------------------------------------------------------------------------

        \1483\ See Section V.H.8, infra.

        ---------------------------------------------------------------------------

      32. Futures

        Rule 613 and the CAT NMS Plan do not require the reporting of audit trail data on the trading of futures. One commenter, noting that the CAT NMS Plan does not require any information about stock index futures or options on index futures, stated that incorporating futures data into CAT would ``create a more comprehensive audit trail, which would further enhance the SROs' and Commission's surveillance programs.'' \1484\

        ---------------------------------------------------------------------------

        \1484\ CBOE Letter at 2; see also Better Markets Letter at 7.

        ---------------------------------------------------------------------------

        As noted above, the Participants, within six months of the CAT NMS Plan's approval by the Commission, will provide the Discussion Document that will include a discussion of how additional securities and transactions could be incorporated into CAT.\1485\ In their response, the Participants recognized that ``the reporting of additional asset classes and types of transactions is important for cross-market surveillance.'' \1486\ Further, the Participants stated their belief that the Commission also recognizes ``the importance of gradually expanding the scope of the CAT,'' and cited the Adopting Release, wherein the Commission directed the Commission Staff ``to work with the SROs, the CFTC staff, and other regulators and market participants to determine how other asset classes, such as futures, might be added to the consolidated audit trail.'' \1487\ Accordingly, the Participants stated that they intend to assess whether it would be appropriate to expand the scope of the CAT to include futures, at a later date.

        ---------------------------------------------------------------------------

        \1485\ See CAT NMS Plan, supra note 5, at Section 6.11.

        \1486\ Response Letter I at 26. The CAT NMS Plan specifies that the Discussion Document will include a discussion of debt securities and Primary Market Transactions, but does not expressly require that futures be in the Discussion Document. See CAT NMS Plan, supra note 5, at Section 6.11.

        \1487\ Response Letter I at 26-27 (citing Adopting Release, supra note 14 at 45745 n.241).

        ---------------------------------------------------------------------------

        The Commission believes that the omission of futures data from the CAT NMS Plan is reasonable, particularly in light of limitations on the Commission's jurisdiction.

        11. Error Rate

        CAT Data reported to the Central Repository must be timely, accurate and complete.\1488\ The CAT NMS Plan specifies the maximum Error Rate for CAT Reporters.\1489\ As noted in Section III.19, the term Error Rate is defined as ``the percentage of Reportable Events collected by the Central Repository in which the data reported does not fully and accurately reflect the order event that occurred in the market.'' \1490\ The Error Rate will apply to CAT Data as it is initially submitted to the Central Repository, before it has undergone the correction process.\1491\

        ---------------------------------------------------------------------------

        \1488\ See CAT NMS Plan, supra note 5, at Section 6.5(d)(2).

        \1489\ Id. at Section 6.5(d)(i). The Participants expect that post-correction Error Rates will be de minimis. See id. at Appendix C, Section A.3(b), n.102.

        \1490\ See id. at Section 1.1; see also 17 CFR 242.613(j)(6).

        \1491\ See CAT NMS Plan, supra note 5, at Appendix C, Section A.3(a) (stating, ``The initial step in ensuring the reliability and accuracy of data in the Central Repository is the validation checks made by the Plan Processor when data is received and before it is accepted into the Central Repository.'')

        ---------------------------------------------------------------------------

      33. Definition of Error

        Some commenters sought additional information about the meaning of the term ``Error Rate'' and how Error Rates would be calculated. One commenter suggested that there should be clarification as to whether all errors would be treated equally.\1492\ Another commenter questioned whether there would be a minimum number of reports submitted before Error Rate calculations would take place, and whether all data submissions would be covered.\1493\ One commenter suggested that Error Rates be calculated daily on a rolling average, comparing a CAT Reporter's error rate to an aggregate Error Rate, so as to take into account daily fluctuations in Error Rates.\1494\ One commenter did not believe that all errors should be treated with the same severity, noting that some errors can be auto-corrected by CAT, and some errors (such as late reporting) can be immediately resolved, while other errors, such as linkage errors, are more problematic.\1495\ Three commenters suggested that the Error Rate should apply only to post-

        correction, not pre-correction, data.\1496\ One of these commenters expressed support for the eventual goal of a de minimis post-correction Error Rate, but could not predict how long this would take to be achieved.\1497\

        ---------------------------------------------------------------------------

        \1492\ SIFMA Letter at 6.

        \1493\ UnaVista Letter at 4.

        \1494\ FIF Letter at 51.

        \1495\ Id. at 57. This commenter also stated that importance of data quality could consider whether the same data is available from multiple sources, noting that if two or more CAT Reporters are supplying the same information, regulators could effectively surveil if only one source of the data was correct. See id. at 58.

        \1496\ FSR Letter at 9; SIFMA Letter at 7; FIF Letter at 51.

        \1497\ FIF Letter at 52, 60. The commenter also noted that currently OATS does not have a de minimis error rate, and questioned how the CAT Plan Processor could detect errors that OATS cannot correct. Id. at 60.

        ---------------------------------------------------------------------------

        The Participants responded by explaining that the CAT NMS Plan adopted the definition of Error Rate from Rule 613, which does not distinguish among order events and focuses on cases where data ``does not fully and accurately reflect the order event that occurred in the market.'' \1498\ The Participants stated that they believe this definition is appropriate.\1499\ The Participants disagreed with commenters who suggested that the maximum Error Rate should be based on post-correction data,\1500\ and noted that a maximum Error Rate based on pre-corrected data is intended to encourage CAT Reporters to submit accurate data initially and to reduce the need for error corrections, as well as allow regulators more timely access to accurate data.\1501\

        ---------------------------------------------------------------------------

        \1498\ Response Letter I at 45 (citing 17 CFR 242.608(j)(6)).

        \1499\ Id.

        \1500\ FSR Letter at 9; SIFMA Letter at 7; FIF Letter at 51.

        \1501\ Response Letter I at 47.

        ---------------------------------------------------------------------------

        The Commission believes that the proposed, uniform definition of Error Rate is reasonable. The Commission also agrees with the Participants that Error Rates should be calculated based on pre-

        correction, and not post-correction, data. The Commission believes that assessing Error Rates on a pre-correction basis is important to ensure that CAT Reporters submit CAT Data in compliance with the Plan and applicable rules of the Participants, and develop and maintain their reporting systems in a way that minimizes errors. In addition, focusing on Error Rates for pre-corrected data should reduce reliance on the error correction process, and improve the accuracy of the ``uncorrected'' CAT Data available to regulators in circumstances where immediate action is required. The Commission also believes it critical that the error correction process be effective, so that errors in post-

        correction CAT Data will be de minimis, as contemplated by the Participants.

      34. Maximum Error Rate

        Several commenters expressed opinions regarding the initial maximum Error Rate. Two commenters supported

        Page 84781

        a 5% initial maximum Error Rate.\1502\ One of these commenters believed that a 5% Error Rate would permit an appropriate level of flexibility for CAT Reporters while still ensuring that CAT Data would be useable for market reconstructions.\1503\ Another commenter, however, disagreed and argued that, given the industry's experience with OATS, the maximum Error Rates should be lower than those proposed by the Participants.\1504\

        ---------------------------------------------------------------------------

        \1502\ UnaVista Letter at 3-4; FSR Letter at 9.

        \1503\ UnaVista Letter at 3.

        \1504\ Better Markets Letter at 9.

        ---------------------------------------------------------------------------

        Several commenters expressed views on how the initial maximum Error Rate should be adjusted over time.\1505\ Two commenters supported the Plan's requirement to evaluate Error Rates at least annually.\1506\ One of these commenters also believed that lowering the maximum Error Rate to 1% after one year of reporting was acceptable based on the current OATS error rates and the commenter's own experience with regulatory reporting.\1507\ Another commenter stated that it was difficult to assess whether a maximum Error Rate of 1% after one year of reporting was appropriate, and indicated that it would prefer a more gradual rate decrease.\1508\ The commenter recommended that the Operating Committee establish maximum Error Rates for the second and third years of reporting after reviewing the first year's Error Rate data.\1509\ Two commenters recommended that the maximum Error Rate be reviewed whenever there are significant changes to the CAT (e.g., the addition of security classes) \1510\ or applicable regulations.\1511\

        ---------------------------------------------------------------------------

        \1505\ UnaVista Letter at 3-4, Better Markets Letter at 9, FIF Letter at 50-52, SIFMA Letter at 6; FSR Letter at 9; see also Section IV.D.9, supra, for a summary of comment letters that discuss how error rates impact the retirement of duplicative systems.

        \1506\ UnaVista Letter at 3-4; FSR Letter at 9.

        \1507\ UnaVista Letter at 3-4.

        \1508\ FIF Letter at 56, 58.

        \1509\ Id. The commenter stated the objective should be an Error Rate that meets the regulators' surveillance objectives, and is achievable by CAT Reporters at a reasonable cost. Id. at 57.

        \1510\ Id. at 52, 55.

        \1511\ UnaVista Letter at 4.

        ---------------------------------------------------------------------------

        In response to concerns that the Participants do not have sufficient information or experience to determine the initial maximum Error Rate, \1512\ the Participants explained that they established this maximum Error Rate after performing a detailed analysis of OATS error rates over time, and believed that such analysis provided a sound basis for their determination.\1513\ The Participants stressed the importance of evaluating a CAT Reporter's actual experience, in setting an appropriate maximum Error Rate, and noted that the CAT NMS Plan requires the Operating Committee to review the maximum Error Rate at least annually.\1514\

        ---------------------------------------------------------------------------

        \1512\ FIF Letter at 50, SIFMA Letter at 6-7.

        \1513\ Response Letter I, at 45-46. This analysis considered the initial error rates for reporting by market participants that were reporting audit trail information to OATS for the first time, and assumed a similar learning curve would be experienced by CAT Reporters who have not previously reported audit trail information, such as options market participants.

        \1514\ Id.

        ---------------------------------------------------------------------------

        With respect to the comments recommending that the maximum Error Rate also be reviewed upon significant changes to the CAT or regulations, the Participants noted that the required testing and other management processes surrounding CAT systems changes should mitigate concerns about their impact on Error Rates, and that the periodic updates on Error Rates provided to the Operating Committee should alert them if there is a need to change the maximum Error Rate.\1515\

        ---------------------------------------------------------------------------

        \1515\ Id. at 46-47.

        ---------------------------------------------------------------------------

        The Commission believes that the proposed 5% initial maximum Error Rate is reasonable and strikes an appropriate balance between: (1) Ensuring that the initial submissions to the Central Repository by CAT Reporters are sufficiently accurate for regulatory use; and (2) providing CAT Reporters with time to adjust to the new more comprehensive regulatory reporting mechanism. The Commission understands that the Participants considered relevant historical information related to OATS reporting error rates, particularly when new reporting requirements were introduced, and believes this is a reasonable basis for setting the initial maximum Error Rates for CAT Data.\1516\ The Commission understands that CAT Reporters who currently report to OATS report with a significantly lower Error Rate, but recognizes that more flexibility may be necessary during the transition, and notes the 1% maximum Error Rate applicable to each CAT Reporter one year after their reporting obligation has begun is comparable to current OATS reporting error rates.\1517\

        ---------------------------------------------------------------------------

        \1516\ Participants have considered the industry's experience with the OATS system over the last 10 years, including three significant additions to OATS: (1) Requirement that manual orders be reported to OATS; (2) requirement that OTC Equity Securities be reported to OATS; and (3) requirement that all NMS stocks be reported to OATS. Each of these changes resulted in significant updates to the required formats which required OATS reporters to update and test their reporting systems and infrastructure. See CAT NMS Plan, supra note 5, at Appendix C, Section A.3(b).

        \1517\ See id. at Appendix C, Section A.3(b), n.99.

        ---------------------------------------------------------------------------

        The Commission also believes that the process established by the CAT NMS Plan for reducing the maximum Error Rate over time is reasonable, and emphasizes the important roles of both the Plan Processor and the Operating Committee in ensuring that Error Rates are steadily reduced over time. The Plan requires the Plan Processor regularly to provide information and recommendations regarding Error Rates to the Operating Committee,\1518\ and requires the Operating Committee to review and reset the maximum Error Rate at least on an annual basis.\1519\ Given the importance to regulators of audit trail information that meets high standards of accuracy, the Commission expects the Plan Processor and Participants to closely monitor Error Rates, particularly in the early stages of CAT implementation, so that steps can be taken to reduce the maximum Error Rate as promptly as possible. The Commission also encourages the Plan Processor and Participants to assess the impact of significant changes to the CAT or applicable regulations on the maximum Error Rate, at least on a transitional basis, and provide additional flexibility as warranted. As described in Section IV.H, the Commission is amending Section 6.6 of the Plan to require that, prior to the implementation of any Material Systems Change, the Participants provide the Commission with an assessment of the projected impact of any Material Systems Change on the maximum Error Rate.

        ---------------------------------------------------------------------------

        \1518\ Id. at Appendix C, Section A.3(b).

        \1519\ See id. at Section 6.5(d)(i); Appendix C, Section A.3(b).

        ---------------------------------------------------------------------------

      35. Different Error Rates for Different Products and Data Elements

        The CAT NMS Plan imposes the same Error Rate on all products and data elements. Commenters suggested differentiation in this area. One commenter recommended that the Error Rate only apply to equities.\1520\ Another commenter suggested that Error Rates for equities, options and customer data should be calculated separately.\1521\ A third commenter expressed the view that, as new products are covered by CAT, they should be subject to a more liberal Error Rate for an appropriate transition period.\1522\ Two commenters did not believe there is enough information to set an appropriate maximum Error Rate for options market making, customer information or allocations, given that there is little or

        Page 84782

        no reporting history for them, and suggested applying the Error Rate on a post-correction basis for these products and data elements, at least for a transitional period.\1523\

        ---------------------------------------------------------------------------

        \1520\ FSR Letter at 9.

        \1521\ SIFMA Letter at 6.

        \1522\ FIF Letter at 52.

        \1523\ FIF Letter at 51, SIFMA Letter at 6-7.

        ---------------------------------------------------------------------------

        In response, the Participants stated that they continue to believe that a single overall Error Rate for all products and data elements is appropriate.\1524\ They acknowledged the importance of gathering more granular information about Error Rates, including differences among products, and noted that the CAT NMS Plan requires the Plan Processor to provide the Operating Committee with regular reports that show more detailed Error Rate data.\1525\

        ---------------------------------------------------------------------------

        \1524\ Response Letter I at 47.

        \1525\ Id. (referencing CAT NMS Plan Section 6.1(o)(v)).

        ---------------------------------------------------------------------------

        The Commission believes that it is reasonable, at this time, to apply the same maximum Error Rate to all products and data elements, in the Plan filed by the Participants. The Commission notes that the initial 5% maximum Error Rate, which substantially exceeds the OATS error rates, was established in recognition of the fact that certain products (e.g., options) and data elements (e.g., market maker quotes, customer information) had not previously been reported in OATS. The Commission, however, notes that the Participants may assess, as the CAT is developed and implemented, whether it is appropriate to impose Error Rates that vary depending on the product, data element, or other criteria.\1526\ As discussed in Section IV.H, the Commission is amending the Plan to require that the Participants provide the Commission with an annual evaluation that addresses the application of Error Rates based on product, data elements or other criteria.

        ---------------------------------------------------------------------------

        \1526\ Section 6.5(d) of the CAT NMS Plan contemplates a single Error Rate for all data. If the Participants determine that it is appropriate to establish different Error Rates for different products, data elements, or other criteria, a Plan amendment, subject to notice and comment, would be required.

        ---------------------------------------------------------------------------

      36. Compliance With Maximum Error Rate During the Initial Implementation Period

        Two commenters suggested that CAT Reporters not be required to comply with the maximum Error Rate during the initial implementation period for the CAT.\1527\ One of these commenters explained that this would provide CAT Reporters a window of time to better understand the types of errors that are being returned by the CAT, and adjust their processes accordingly, without incurring liability for exceeding the maximum Error Rate.\1528\ Another commenter stressed the importance of receiving feedback from the Plan Processor so that CAT Reporters can identify weaknesses and improve the accuracy of their CAT reporting.\1529\ This commenter recommended that the Plan Processor provide CAT Reporters with a detailed daily error report, as well as monthly report cards.\1530\

        ---------------------------------------------------------------------------

        \1527\ SIFMA Letter at 6-7, UnaVista Letter at 4. One commenter also stated that small broker-dealers should not be excused from error rate requirements if they begin reporting voluntarily at the same time large broker-dealers begin reporting. This commenter argued that if small broker-dealers are permitted to report to CAT with limitless errors during the phase designed for large broker-

        dealers to report without being subject to an error rate, the utility of CAT will be diminished. See Better Markets Letter at 9. The Commission believes that a maximum Error Rate would apply to anyone reporting to CAT, whether mandated to do so to be in accordance with the CAT NMS Plan or voluntarily.

        \1528\ SIFMA Letter at 6.

        \1529\ FIF Letter at 52.

        \1530\ FIF Letter at 54; see also SIFMA Letter at 7. This commenter also recommended that the CAT include a robust toolset and customer service model to assist CAT Reporters in meeting the established error rates. See FIF Letter at 126-127.

        ---------------------------------------------------------------------------

        The Participants responded by noting that Rule 613(g) requires the Participants to enforce compliance by their members with the provisions of the Plan at all times it is in effect.\1531\ The Participants also pointed out that the Plan provides that CAT Reporters will be provided tools to facilitate testing and error correction, as well as have access to user support. With respect to the importance of feedback from the Plan Processor,\1532\ the Participants noted that the Plan requires the Plan Processor to provide CAT Reporters with error reports, including details on the reasons for rejection, as well as daily and monthly statistics from which CAT Reporters can compare their performance with their peers.\1533\ As discussed in Section IV.H, the Commission is amending the Plan to require that the Participants provide the Commission with an annual evaluation of how the Plan Processor and the Participants are monitoring Error Rates.

        ---------------------------------------------------------------------------

        \1531\ Response Letter I at 47-48.

        \1532\ FIF Letter at 52, 55, 57.

        \1533\ See Response Letter I at 48 (referencing CAT NMS Plan, Appendix D, Section 1.2).

        ---------------------------------------------------------------------------

        The Commission believes that the implementation period for Error Rates is reasonable and that it is not necessary to establish a grace period, as suggested by commenters, during which Error Rates would not apply. Ensuring the accuracy of CAT Data is critical to regulators and, as noted above, the initial maximum Error Rates have been set at levels to accommodate the fact that CAT Reporters will be adjusting to a new regulatory reporting system.\1534\ In addition, the Commission notes that the CAT NMS Plan provides for testing periods,\1535\ as well as tools and other support, to facilitate initial compliance by CAT Reporters. As noted by the Participants, the Plan Processor will provide regular feedback to CAT Reporters with respect to their reporting weaknesses to assist them in reducing their Error Rates.\1536\

        ---------------------------------------------------------------------------

        \1534\ In response to the commenter that noted that if two or more CAT Reporters are supplying the same information, regulators could effectively surveil if only one source of the data was correct, see FIF Letter at 58, the Commission believes that it is important that the audit trail contains consistently accurate information from all sources obligated to report data and that errors not be permitted to exist in the audit trail just because they were correctly reported by one party.

        \1535\ See Section IV.D.8, supra, for a description of testing periods.

        \1536\ The Plan requires the Plan Processor to define and design a process to efficiently and effectively communicate with CAT Reporters to identify errors, so that they can work to ensure that they get feedback to improve their reporting. See CAT NMS Plan, supra note 5, at Appendix C, Section A(3)(b).

        ---------------------------------------------------------------------------

      37. Error Correction Timeline

        The CAT NMS Plan sets forth a timeline with deadlines for providing raw data and corrected data to the CAT. CAT Reporters must submit data to the CAT by 8:00 a.m. ET on T+1.\1537\ By 12:00 p.m. ET on T+1, the CAT must perform checks for initial validations and lifecycle linkages, and communicate errors to CAT Reporters.\1538\ CAT Reporters must resubmit corrected data to the CAT by 8:00 a.m. ET on T+3.\1539\ The Plan Processor must ensure that regulators have access to corrected and linked order and Customer data by 8:00 a.m. ET on T+5.\1540\

        ---------------------------------------------------------------------------

        \1537\ See id. at Sections 6.3(b)(ii), 6.4(b)(ii).

        \1538\ Id. at Appendix C, Section A.1(a)(iv).

        \1539\ Id.

        \1540\ Id. at Appendix C, Section A.2(a).

        ---------------------------------------------------------------------------

        Two commenters believed the error correction timeline was too aggressive, and that at least initially, the CAT should use the current error correction timelines for systems such as OATS, which is T+5.\1541\ One commenter specifically suggested that the timeline for error corrections should remain at T+5 for the first year of CAT reporting.\1542\ This commenter also noted that, because the Plan Processor is required to communicate errors to CAT Reporters by 5:00 p.m. ET on T+1,

        Page 84783

        staffing adjustments may be necessary to ensure that the appropriate personnel are available after 5:00 p.m. ET to analyze and correct data, and if communications with a customer were necessary to correct an error, the CAT Reporter could not satisfy the 8:00 a.m. ET T+2 timeline for providing corrected data.\1543\ This commenter also recommended that the Plan Processor identify errors in customer information data by noon on T+1, the same time as the Plan Processor identifies errors in transaction reports, instead of by 5:00 p.m. ET on T+1, to assist with prompt analysis of linking errors.\1544\ Another commenter suggested that the use of ``pre-validation checks,'' prior to the formal submission of data to the CAT, could enhance the accuracy and integrity of the CAT Data.\1545\

        ---------------------------------------------------------------------------

        \1541\ KCG Letter at 9; FIF Letter at 52.

        \1542\ FIF Letter at 52. The commenter also noted that CAT Reporters do not have access to their reported data using a bulk extract format, which would facilitate error validation and correction. Id. The commenter also suggested that the five-day error correction timeline begin from the time the CAT Reporter receives a reject message. Id. at 53.

        \1543\ Id. at 53. The Commission notes that time by which a CAT Reporter must report corrected Customer data is 5:00 p.m. ET on T+3.

        \1544\ Id. This commenter also suggested that CAT provide an ``incident'' error functionality, similar to the one available for OATS. This functionality would allow CAT Reporters that are experiencing a systematic issue with reporting to submit an incident report to CAT and receive a case number, so the CAT Reporter's data reported could be tracked and referenced when considering the Reporter's error rate compliance. See FIF Letter at 130.

        \1545\ UnaVista Letter at 4. The commenter also noted that a T+5 timeframe for regulatory access is feasible but that uniform formatting or pre-validation checks may reduce the timeframe for regulatory access. Id.

        ---------------------------------------------------------------------------

        In response to commenters who believed the timeframe for correction of CAT Data was too short, the Participants stressed the importance to regulators of the prompt availability of accurate data.\1546\ The Participants stated that the three day window for correction provided in the CAT NMS Plan appropriately balances the need for regulators to have prompt access to accurate data with the burdens imposed on the industry by the shorter error correction timeframe.\1547\ The Participants noted that the shorter three-day error correction timeframe would allow better regulatory surveillance and market oversight in accordance with Rule 613.\1548\ In response to the commenter that requested additional time to correct errors in customer data, the Participants expressed the view that the two-day timeframe provided by the Plan is sufficient to accommodate any communications with customers that might be necessary to correct errors in customer data.\1549\ With respect to the suggestion to use pre-validation checks, the Participants acknowledged their value, and stated that they have discussed with the Bidders making tools, such as pre-validation checks, available to CAT Reporters to assist with data submission.\1550\

        ---------------------------------------------------------------------------

        \1546\ Response Letter I at 30.

        \1547\ Id.

        \1548\ Id.

        \1549\ Id.

        \1550\ Id.

        ---------------------------------------------------------------------------

        The Commission believes that the error correction timeline set forth in the CAT NMS Plan is reasonable. Improved accuracy and timeliness of regulatory data are key goals of Rule 613 and the CAT NMS Plan.\1551\ In response to commenters that suggested that the error correction timeline is too aggressive, the Commission believes that the error correction tools and processes to be established by the Plan Processor, and the accommodations to facilitate the use of existing systems by CAT Reporters, should ease the burden of complying with shorter error correction timelines than exist today in OATS.\1552\ The Commission believes any incremental compliance burden in this area is offset by the benefits of faster availability to regulators of corrected CAT Data for important regulatory purposes, such as surveillance, oversight and enforcement, as well as market reconstructions, in today's high-speed electronic markets.

        ---------------------------------------------------------------------------

        \1551\ See Adopting Release, supra note 13, at 45727.

        \1552\ The timeline in the CAT NMS Plan improves the timeliness of regulators' access to data they use for much of their surveillance by several days because the corrected and linked CAT Data would be accessible on T+5, compared to OATS Data, which is not available until T+8.

        ---------------------------------------------------------------------------

        In response to the commenter that stated that additional staffing may be needed to assist in addressing error correction information that is received from the Plan Processor at 5:00 p.m. ET on T+1, the Commission believes, as noted above, the regulatory benefits of a shorter error correction timeframe justify the incremental compliance costs, including the potential hiring of additional staff in some cases.\1553\ The Commission also believes that CAT Reporters would have sufficient time to contact customers in the event customer feedback was necessary to correct errors.\1554\ In this regard, the Commission notes that the CAT NMS Plan provides that corrected order data is not required to be reported until 8:00 a.m. ET on T+3, and corrected Customer data is not required to be reported until 5:00 p.m. ET on T+3.\1555\

        ---------------------------------------------------------------------------

        \1553\ See Section V.F.3.a(7), infra.

        \1554\ FIF Letter at 53.

        \1555\ In Response Letter I, the Participants noted an inadvertent error in Appendix D relating the Error Rate correction time. Specifically, the Plan incorrectly states that the Plan Processor must validate customer data and generate error reports no later than 5:00 p.m. ET on T+3. The Plan should state that such validations and error reports must occur no later than 5:00 p.m. ET on T+1. The Commission is amending the Plan to correct this error.

        ---------------------------------------------------------------------------

        12. Business Continuity and Disaster Recovery

        The CAT NMS Plan requires the Plan Processor to implement efficient and cost-effective business continuity and disaster recovery capabilities that will ensure no loss of data and will support the data availability requirements and anticipated volumes of the Central Repository.\1556\

        ---------------------------------------------------------------------------

        \1556\ See CAT NMS Plan, supra note 5, at Appendix C, Section A.3(f); Appendix D, Sections 5.1-5.4.

        ---------------------------------------------------------------------------

        Commenters discussed the CAT NMS Plan's provisions regarding business continuity and disaster recovery for the CAT.\1557\ One commenter noted that the Plan does not include an explanation of how the primary and the secondary sites will remain synchronized at all times to provide a seamless transition from primary site to secondary site in the event of a failure.\1558\ This commenter suggested that the Plan should specify additional details regarding the expected elapsed time for the secondary site to become live if the primary site goes down due to a technical failure or a disaster.\1559\ The commenter also noted that the requirement for disaster recovery plans does not address whether regulators will have uninterrupted access to the CAT Data, although the commenter acknowledged that it can be inferred that the secondary site should provide all the functionalities of the primary site in the event of primary site outage.\1560\ Further, the commenter recommended that while the CAT NMS Plan states that the goal of disaster recovery is to achieve next day recovery after an event, the Plan should provide a list of scenarios and the expectation of the recovery times for each scenario.\1561\

        ---------------------------------------------------------------------------

        \1557\ SIFMA Letter; Data Boiler Letter (also noting that, if the markets deem acceptable that exchanges experience downtime without going into a contingency mode or halting trading, then standards comparable to those required of exchanges, but not tighter, are sufficient, due to cost); FSI Letter; FIF Letter. One commenter requested clarification of the requirement for a bi-annual test of the CAT systems at the disaster recovery site. This commenter noted that ``bi-annual'' is commonly understood to mean twice a year, but can also mean once every two years. The commenter believed that clarification is necessary to ensure that the site is tested twice a year. It also believed that secondary equipment and critical personnel should be tested at least once a year. See FSI Letter at 5. In their response, the Participants affirmed that the bi-annual disaster recovery test of CAT operations at the secondary facility is required to be conducted twice a year. See Response Letter I at 51.

        \1558\ SIFMA Letter at 45.

        \1559\ Id.

        \1560\ Id.

        \1561\ Id.

        ---------------------------------------------------------------------------

        Page 84784

        One commenter recommended that the CAT NMS Plan state that the Plan Processor must support 24x7 production and test environments, provide test and validation tools to result in a higher quality audit trail, provide a consistent and comprehensive data security program, and provide an adequate level of help desk staffing, especially during industry testing and when Industry Members are being on-boarded.\1562\ This commenter also stated that large firms that already have the staffing capability for a 24x7 operating schedule could benefit from 24x7 production support, explaining that it would permit added flexibility in error processing or recovery scenarios, as well as the use of off-shore staffing.\1563\ Another commenter recommended that the CAT NMS Plan should not mandate a particular industry testing process, stating that ``appropriate management flexibilities/discretions are needed.'' \1564\

        ---------------------------------------------------------------------------

        \1562\ FIF Letter at 13, 49, 125-26.

        \1563\ Id. at 123.

        \1564\ Data Boiler Letter at 42.

        ---------------------------------------------------------------------------

        The Participants argued that the Plan provisions with respect to business continuity and disaster recovery are appropriate, but did note that they intend to discuss with the Bidders requiring test environments to be available 24x7 instead of 24x6.\1565\

        ---------------------------------------------------------------------------

        \1565\ See Response Letter I at 51.

        ---------------------------------------------------------------------------

        The Commission has considered the business continuity and disaster recovery requirements set forth in the CAT NMS Plan, as well as the comments received addressing these requirements and believes that the Participants' approach is reasonable. The Commission believes that the CAT NMS Plan's business continuity and disaster recovery provisions establish a framework that is reasonably designed to ensure that the CAT business processes can continue despite a failure or disaster scenario.\1566\ In particular, the CAT will be subject to all applicable requirements of Regulation SCI, as it will be an ``SCI system'' \1567\ of each of the Participants, and the Participants, as ``SCI entities,'' \1568\ are required to establish, maintain and enforce written policies and procedures for their SCI systems that comply with the technology standards and other requirements of Regulation SCI, including with respect to the business continuity and disaster recovery plans for the CAT.\1569\ In addition, the CAT will be subject to certain additional requirements with respect to business continuity and disaster recovery that are set forth in the CAT NMS Plan.\1570\

        ---------------------------------------------------------------------------

        \1566\ See CAT NMS Plan, supra note 5, at Appendix D, Section 5.4.

        \1567\ See supra note 1173.

        \1568\ See supra note 1172.

        \1569\ 17 CFR 242.1001(a)(2). See Section IV.D.6.f, supra, for a discussion of Regulation SCI.

        \1570\ For example, Appendix D requires a bi-annual test of CAT operations from the secondary site; an effective telecommuting solution for all critical CAT operations staff; and a secondary site with the same level of availability, capacity, throughput and security (physical and logical) as the primary site. See CAT NMS Plan, supra note 5, at Sections 5.3 and 5.4.

        ---------------------------------------------------------------------------

        With respect to the commenter that noted that the Plan does not explain how the primary and the secondary sites will remain synchronized,\1571\ and that additional detail should be provided regarding the failover times between primary and secondary sites,\1572\ the CAT NMS Plan expressly requires recovery and restoration of services within 48 hours, but with a goal of next-day recovery. While data will not be synchronized in real time, sufficient synchronization will be maintained to support these recovery timeframes. Although, as noted above, the Commission believes the Participants' approach is reasonable, the Commission encourages the Plan Processor and Participants to strive to reduce the time it will take to restore and recover CAT Data at a backup site. As discussed in Section IV.H., the Commission is amending the Plan to require the Participants to submit to the Commission an annual evaluation of the time necessary to restore and recover CAT Data at a back-up site.

        ---------------------------------------------------------------------------

        \1571\ SIFMA Letter at 45.

        \1572\ Id.

        ---------------------------------------------------------------------------

        With respect to the commenter that recommended that the Plan Processor support 24x7 testing and production environments,\1573\ the Commission recognizes that this could facilitate disaster recovery and other important processes by Industry Members, and believes that the Participants' commitment to discuss requiring test environments to be available 24x7 with the Bidders is reasonable.\1574\

        ---------------------------------------------------------------------------

        \1573\ FIF Letter at 13, 49. In response to the commenter's suggestions that the Plan Processor provide a consistent and comprehensive data security program, and an adequate level of help desk staffing, especially during industry testing and on-boarding, the Commission notes that the Plan Processor will support industry testing and provide help desk support during industry testing, and that the same information security policies applicable to the production environment will apply to the industry test environment. See CAT NMS Plan, supra note 5, at Appendix D, Section 1.2.

        \1574\ Response Letter I at 51.

        ---------------------------------------------------------------------------

        13. Business Clock Synchronization and Timestamp Granularity

      38. Business Clock Synchronization

        (1) Industry Standard

        Rules 613(d)(1) and (2) require CAT Reporters to synchronize their Business Clocks \1575\ to the time maintained by NIST, consistent with industry standards. In the CAT NMS Plan, the Participants determined that the industry standard for the synchronization of Business Clocks is within 50 milliseconds of the time maintained by NIST, except for Manual Order Events.\1576\ For Business Clocks used solely for Manual Order Events, the Participants determined that the industry standard for clock synchronization is within one second of NIST. To ensure that clock synchronization standards remain consistent with industry standards, as they evolve, the CAT NMS Plan requires the Operating Committee to annually review the clock synchronization standard to determine whether it should be shortened.

        ---------------------------------------------------------------------------

        \1575\ For purposes of the CAT NMS Plan, ``Business Clock'' means a clock used to record the date and time of any Reportable Event required to be reported under SEC Rule 613. See CAT NMS Plan, supra note 5, at Section 1.1.

        \1576\ See Exemption Order, supra note 21. In this Order, the Commission is also amending the Plan to allow Business Clocks used solely for the time of an allocation to synchronize to within one second of NIST. See Section IV.D.4.d, supra.

        ---------------------------------------------------------------------------

        In determining the current industry standard for clock synchronization, the Participants and Industry Members reviewed their respective clock synchronization technology practices,\1577\ and the results of a clock synchronization survey conducted by FIF.\1578\ After completing these reviews, the Participants concluded that a 50 millisecond clock synchronization standard represented an aggressive, but achievable, standard.\1579\

        ---------------------------------------------------------------------------

        \1577\ CAT NMS Plan, supra note 5, at Appendix C, Section D.12(p).

        \1578\ Id. at Appendix C, n.236. See FIF Clock Offset Survey, supra note 247.

        \1579\ Id. at Appendix C, Section D.12(p).

        ---------------------------------------------------------------------------

        The Commission received a number of comments on the CAT NMS Plan's provisions relating to clock synchronization. Several commenters agreed with the Participants that 50 milliseconds was a reasonable standard.\1580\ Four commenters specifically recommended that the clock synchronization standard for OATS--also 50 milliseconds--and CAT should be aligned for regulatory reporting purposes.\1581\ One commenter argued for a finer standard for Industry Members, noting that they accept data

        Page 84785

        feeds from exchanges that have more precise clock synchronization, some to the microsecond.\1582\

        ---------------------------------------------------------------------------

        \1580\ SIFMA Letter at 34-35; FIF Letter at 110-111, 115; TR Letter at 7; Data Boiler Letter at 9, 20; FSR Letter at 8-9. Three of these commenters stated that there should be a uniform clock synchronization standard for Industry Members. SIFMA Letter at 34; FIF Letter at 97-98; FSR Letter at 8.

        \1581\ Data Boiler Letter at 9 (noting that FINRA's current clock synchronization for Industry Members is 50 milliseconds); TR Letter at 7; SIFMA Letter at 34; FSR Letter at 8.

        \1582\ Better Markets Letter at 8. The commenter recommended that exchanges and Industry Members should be required to use the same--presumably finer--clock synchronization standard for CAT purposes as they use for internal or commercial purposes.

        ---------------------------------------------------------------------------

        Other commenters opposed mandating a standard finer than the 50 millisecond clock synchronization standard.\1583\ One commenter argued that a finer synchronization standard could not be met without dramatically increasing costs,\1584\ and expressed the view that the 50 millisecond standard is reasonable given the geographically dispersed market.\1585\ In particular, this commenter believed that, while a finer standard may create the illusion of a more accurate time sequence of events, in practice geographically dispersed market events could still be sequenced incorrectly.\1586\ This commenter stated that it is better to allow for clock synchronization standards to be tightened voluntarily, based on business needs rather than regulatory requirements.\1587\ Finally, one commenter expressed the view that clock synchronization was less important for certain types of orders, and suggested that the clock synchronization standard for manual orders, orders that have both a manual and electronic component, and orders that are not time-critical (e.g., post-trade events such as allocations) should be one second rather than 50 milliseconds.\1588\

        ---------------------------------------------------------------------------

        \1583\ FIF Letter at 102, TR Letter at 7.

        \1584\ FIF Letter at 110. This commenter revisited the cost estimates for clock synchronization presented in the commenter's Clock Offset Survey, noting in particular that the industry will face increased costs with a finer clock synchronization standard as industry has already been working toward a clock synchronization standard of 50 milliseconds, and would need another two years of lead time to comply with a finer standard than 50 milliseconds. FIF Letter at 108, 114; see also SIFMA Letter at 34.

        \1585\ FIF Letter at 99, 110-111. FIF recommended a pilot study be conducted to test the boundaries of clock synchronization and its accuracies across a broad geographic region at different tolerances for the purpose of event sequencing. Id. at 100, 112.

        \1586\ Id. at 102. FIF also noted that timestamps together with the daisy chain approach to linking orders and events will allow sequencing of events. Id. at 101.

        \1587\ Id. at 104-05. This commenter also argued that Industry Member CAT Reporters that synchronize their clocks to a finer standard voluntarily should not be required to maintain that clock synchronization under CAT as it would create an uneven playing field. Id. at 99, 112, 115. Similarly, another commenter noted that finer standards are already in place at exchanges and ATSs that maintain an order book and since they are already in place for commercial reasons, there is no reason to mandate them. TR Letter at 7.

        \1588\ SIFMA Letter at 34-35.

        ---------------------------------------------------------------------------

        One commenter noted that stricter clock synchronization standards are already in place at exchanges and ATSs.\1589\ Another commenter stated that, if exchanges maintained finer clock synchronization standards than currently required by the CAT NMS Plan, the ability to sequence Reportable Events that occur across markets could be improved.\1590\

        ---------------------------------------------------------------------------

        \1589\ TR Letter at 7.

        \1590\ FIF Letter at 97.

        ---------------------------------------------------------------------------

        In their response, the Participants stated that they continue to believe that the clock synchronization standard for Industry Members should be within 50 milliseconds of the time maintained by NIST, except for with regard to Manual Order Events.\1591\ The Participants noted that they discussed this topic with Industry Members and conducted a survey of Industry Members to better understand current clock synchronization practices.\1592\ The Participants represented that they considered various clock synchronization options, which ranged from microseconds to one second, before settling on a 50 millisecond standard, which they believe represents the current industry standard for Industry Members.\1593\ The Participants stated that, based on their analysis, imposing a finer clock synchronization standard for Industry Members as part of the initial implementation of the CAT would significantly increase the cost of compliance for some segments of the industry,\1594\ but emphasized that the Operating Committee will be reviewing the synchronization standard annually and will reduce the standard as appropriate.\1595\

        ---------------------------------------------------------------------------

        \1591\ Response Letter II at 4.

        \1592\ Id.

        \1593\ Id. In response to the commenters that suggested that the CAT clock synchronization should be same as the OATS standard, the Participants agreed that there is value in consistency between these standards. See Response Letter I at 20. See also Securities Exchange Act Release No. 77565 (April 8, 2016), 72 FR 22136 (April 14, 2016) (approving a 50 millisecond clock synchronization requirement for FINRA members).

        \1594\ Response Letter II at 4 (noting CAT NMS Plan Appendix C, Section D.12(p)).

        \1595\ Response Letter II at 4 (noting CAT NMS Plan Section 6.8(c)).

        ---------------------------------------------------------------------------

        The Participants, however, represented that they all currently operate pursuant to a clock synchronization standard that is within 100 microseconds of the time maintained by NIST, at least with respect to their electronic systems. Accordingly, the Participants recommended that the Commission amend the Plan to require that Participants adhere to the 100 microsecond standard of clock synchronization with regard to their electronic systems, but not their manual systems, such as the manual systems operated on the trading floor, manual order entry devices, and certain other systems.\1596\

        ---------------------------------------------------------------------------

        \1596\ Response Letter II at 4-5. In response to the commenters that argued that CAT Reporters would need lead time to address any changes made to the clock synchronization in the future, the Participants explained that Section 6.8(c) of the CAT NMS Plan requires that, in conjunction with Participants' and other appropriate Industry Member advisory groups, the CCO must annually evaluate and recommend to the Operating Committee whether technology has evolved such that the standard should be shortened. The Participants further explained they will take the time required for CAT Reporters to update and test their systems for any changes to the clock synchronization standard into consideration when determining when changes to the standard are necessary. Response Letter I at 21.

        ---------------------------------------------------------------------------

        After reviewing the CAT NMS Plan, and considering the commenters' statements and the Participants' response thereto, the Commission believes that it is appropriate for the Participants to consider the type of CAT Reporter (e.g., Participant, Industry Member), the type of Industry Member (e.g., ATS, small broker-dealer), and type of system (e.g., order handling, post-execution) when establishing appropriate industry standards. The Commission does not believe that one industry standard should apply across all CAT Reporters and systems. Therefore, the Commission is amending Section 6.8(c) of the Plan to state that industry standards for purposes of clock synchronization should be determined based on the type of CAT Reporter, type of Industry Member and type of system.

        For the initial implementation of the CAT, however, the Commission believes a 50 millisecond clock synchronization standard for Industry Members is reasonable at this time. While the Commission believes that regulators' ability to sequence orders accurately in certain cases could improve if the clock synchronization for Industry Members were finer, the Commission is sensitive to the costs associated with requiring a finer clock synchronization for Industry Members at this time, and believes that a standard of 50 milliseconds for Industry Members will allow regulators to sequence orders and events with a level of accuracy that is acceptable for the initial phases of CAT reporting.

        Although the Commission understands that certain Industry Members, such as ATSs and broker-dealers that internalize off-exchange order flow, today adhere to a finer clock synchronization standard, the Commission is not imposing a finer standard than 50 milliseconds for such Industry Members at this time. The Commission believes that it is

        Page 84786

        reasonable to expect that finer clock synchronization for Industry Members, or certain categories or systems thereof, will evolve over time. As described in Section IV.H, the Commission is amending the Plan to require that the Participants provide the Commission an assessment of clock synchronization standards, including consideration of industry standards based on the type of Industry Member or type of system, within six (6) months of effectiveness of the Plan.

        With regard to the Participants, however, the Commission notes that the Participants have acknowledged that they currently synchronize their Business Clocks to within 100 microseconds of NIST, and recommended that the Commission amend the Plan to require the Participants to adhere to that finer standard for their non-manual systems.\1597\ Accordingly, the Commission is amending Section 6.8(a)(i) of the Plan, consistent with this recommendation, to impose a clock synchronization standard of 100 microseconds on exchanges' electronic systems. The Commission believes that because the Participants already synchronize their clocks to this standard,\1598\ any costs to comply with this standard are not likely to be substantial.\1599\ In addition, the Commission believes that a finer clock synchronization requirement for exchanges generally should allow regulators to better sequence orders and order events across multiple exchanges.\1600\ The Commission agrees with the Participants that it would not be appropriate to impose this finer standard with regard to Participants' manual systems, given that the timing of manual events is inherently less precise and the timestamp requirement for manual events is only to the second.\1601\ Accordingly, the Commission believes the one-second clock synchronization standard set forth in the Plan with respect to Manual Order Events, whether generated by the Participants or Industry Members, is reasonable.

        ---------------------------------------------------------------------------

        \1597\ Response Letter II at 4-5. In the Notice, the Commission explained that, according to FIF, all exchange matching engines meet a clock synchronization standard of 50 milliseconds, and NASDAQ stated that all exchanges that trade NASDAQ securities have clock offset tolerances of 100 microseconds or less. See Notice, supra note 5, at 30760.

        \1598\ Response Letter II at 4-5.

        \1599\ See Section V.F.3.a(5), infra.

        \1600\ See Section V.E.1.b(3)B, infra. A commenter agreed, noting that if exchanges were required to maintain finer clock synchronization standards than what the CAT NMS Plan currently requires, sequencing of the events in the lifecycle of an order across firms could be improved. FIF Letter at 97.

        \1601\ See Section IV.D.13.b(1), infra.

        ---------------------------------------------------------------------------

        The Commission believes the requirement that the Participants annually review the clock synchronization standard to determine whether it should be shortened, in light of the evolution of technology, is reasonable to ensure that clock synchronization standards remain as tight as practicable in light of technological developments. In particular, as technology advances over time, the Commission believes that it will be appropriate for the Participants to consider whether some CAT Reporters should be required to maintain a finer clock synchronization than required by the Plan today. As the Participants conduct their annual reviews, the Commission expects them to consider proposing new clock synchronization standards whenever they determine the industry standard for CAT Reporters, or certain categories or systems thereof, has become more granular than required by the Plan at that time.\1602\ As discussed in Section IV.H., the Commission is amending Section 6.6 of the Plan to require that the Participants provide the Commission with a copy of the annual assessment performed by the Plan Processor pursuant to Section 6.8(c) of the Plan.

        ---------------------------------------------------------------------------

        \1602\ The Participants should consider the amount of time the industry may need to implement and test a newly imposed clock synchronization standard, and notes that any change to the clock synchronization standard will need to be submitted to the Commission as a proposed amendment to the Plan pursuant to Rule 608. 17 CFR 242.608(a)(ii)(A) and (B), (b)(1). Therefore, the Commission, as well as commenters, will have an opportunity to assess any proposed change to the clock synchronization requirements, including the related implementation time frames.

        ---------------------------------------------------------------------------

        Compliance with the clock synchronization standards is vital to the accuracy of the CAT. To this end, the Operating Committee is required to adopt policies and procedures, including standards, that require that the CAT Data reported be timely, accurate, and complete, and to ensure the integrity of CAT Data.\1603\ The Plan Processor is responsible for implementing these policies and procedures,\1604\ and the CCO is tasked with regularly monitoring them.\1605\ The Participants represented that they are developing their clock synchronization compliance rules, and will keep the industry informed as their efforts progress.\1606\

        ---------------------------------------------------------------------------

        \1603\ See CAT NMS Plan, supra note 5, at Section 6.5(d)(ii).

        \1604\ Id.

        \1605\ Id. at Section 6.2(a)(v)(k).

        \1606\ Response Letter I at 20-21.

        ---------------------------------------------------------------------------

        (2) Documentation Requirements

        The CAT NMS Plan also requires CAT Reporters to document their clock synchronization procedures, and maintain a log of each time they synchronize their clocks and the results of such synchronization. This log must specifically identify each synchronization event and note whenever the time of the CAT Reporter's Business Clock and the time maintained by the NIST differs by more than the permitted amount.\1607\

        ---------------------------------------------------------------------------

        \1607\ See CAT NMS Plan, supra note 5, at Appendix C, Section A.3.(c).

        ---------------------------------------------------------------------------

        One commenter objected to the requirement that each instance of clock synchronization be logged, and took the position that doing so would be costly.\1608\ This commenter instead suggested that CAT Reporters should only be required to log instances of clock synchronization exceptions, and not all clock synchronization events.\1609\ In response, the Participants reaffirmed that the Plan requires each Participant and Industry Member to maintain a log of all instances of clock synchronization.\1610\

        ---------------------------------------------------------------------------

        \1608\ FIF Letter at 108.

        \1609\ Id. This commenter also recommended that reasonable policies and procedures be in place to ensure compliance with the clock synchronization requirements. See id. at 104-05. As noted above, the Plan requires that the Operating Committee adopt policies and procedures, including standards, that require that the CAT Data reported be timely, accurate, and complete, and to ensure the integrity of CAT Data.

        \1610\ Response Letter I at 20.

        ---------------------------------------------------------------------------

        The Commission acknowledges that there could be cost savings if the Plan did not require CAT Reporters to log every clock synchronization event,\1611\ but it believes that having this information at the outset of the operation of the CAT should facilitate compliance with, and oversight of, the clock synchronization standards. To the extent the Participants find that a complete log of clock synchronization events is not required to effectively surveil for compliance with these standards, they may at a later date seek to amend the Plan to reduce the logging obligation as appropriate.

        ---------------------------------------------------------------------------

        \1611\ See Section V.H.5, supra.

        ---------------------------------------------------------------------------

      39. Timestamp Granularity

        The CAT NMS Plan reflects the requirements in Rule 613 regarding timestamps, as modified by an exemption for Manual Order Events granted by the Commission.\1612\ Specifically, the Plan requires CAT

        Page 84787

        Reporters to record and report the time of each Reportable Event using timestamps reflecting current industry standards (which must be at least to the millisecond) or, if a CAT Reporter uses timestamps in increments finer than milliseconds, such finer increments, when reporting to the Central Repository. For Manual Order Events, the Plan provides that such events must be recorded in increments up to and including one second, provided that CAT Reporters record and report the time the event is captured electronically in an order handling and execution system (``Electronic Capture Time'') in milliseconds (``Manual Order Event Approach'').\1613\ Under the CAT NMS Plan, the CCO, in conjunction with the Participants and Industry Member advisory groups, must annually review the timestamp granularity requirements of the CAT and determine whether to require finer timestamp granularity in light of the evolution of industry standards.\1614\

        ---------------------------------------------------------------------------

        \1612\ See Exemption Order, supra note 21, at 51. For purposes of the CAT NMS Plan, ``Manual Order Event'' is defined as a non-

        electronic communication of order-related information for which CAT Reporters must record and report the time of the event.

        \1613\ See CAT NMS Plan, supra note 5, at Section 6.8(b); see also Exemption Order, supra note 21. In this Order, the Commission is amending the Plan to allow the time of an allocation reported on an Allocation Report to be timestamped to the second. See Section IV.D.4.d, supra.

        \1614\ See CAT NMS Plan, supra note 5, at Section 6.8(c).

        ---------------------------------------------------------------------------

        (1) Manual Order Event Approach

        According to the Participants, the Manual Order Event Approach would not have an adverse effect on the various ways in which, and purposes for which, regulators would use, access, and analyze the CAT Data.\1615\ In particular, the Participants stated that they do not believe that the Manual Order Event Approach will compromise the linking of order events, or alter the time and method by which regulators may access the data.\1616\ The Participants also stated that the Manual Order Event Approach would not negatively impact the reliability and accuracy of the CAT Data.\1617\ Further, the Participants represented that one second is the industry standard for reporting the time of Manual Order Events.\1618\ The Participants conducted a cost-benefit analysis of the Manual Order Event Approach and concluded that this approach would impose a much smaller cost burden, if any, on market participants, than would transitioning to technology that has the capability to record timestamps for Manual Order Events to the millisecond.\1619\

        ---------------------------------------------------------------------------

        \1615\ See Exemption Request, supra note 21, at 36.

        \1616\ See id. at 36.

        \1617\ See id. at 35.

        \1618\ See id. at 32.

        \1619\ See id. at 36-37.

        ---------------------------------------------------------------------------

        Two commenters supported the CAT NMS Plan's requirement that Manual Order Events be recorded and reported with a timestamp granularity of up to and including one second.\1620\ One commenter stated that the requirement to record timestamps at one-second levels for manual orders was appropriate, and that it was not logical to require a finer timestamp given that attempting to record Manual Order Events at subsecond increments would be inherently imprecise.\1621\ Another commenter stated that a manual order timestamped to the second coupled with a daisy chain of other order events timestamped to the millisecond should create ``a fairly clear sequence of events with the order lifecycle for the regulator.'' \1622\

        ---------------------------------------------------------------------------

        \1620\ DAG Letter at 2; see also STA Letter at 1 (supporting the DAG Letter's Exemptive Request Letter recommendations). These commenters also supported a clock synchronization standard of one second for Manual Order Events. See Section IV.D.13, supra.

        \1621\ SIFMA Letter at 35.

        \1622\ FIF Letter at 80. The commenter supported use of a daisy chain approach for linking orders, noting that it is successfully used by OATS and its logic is well-known by the industry. Id. at 96-

        97.

        ---------------------------------------------------------------------------

        One commenter expressed the view that there would be cost savings if a less stringent timestamp requirement for manual orders was imposed.\1623\ Another commenter suggested using a more relaxed timestamp initially for manual orders, and to consider tightening the standard in the future.\1624\ Another commenter suggested that anti-

        gaming provisions should be developed to ensure that CAT Reporters do not program their systems to generate orders that imitate manual orders to take advantage of the one second timestamp requirement.\1625\

        ---------------------------------------------------------------------------

        \1623\ Id. at 79, 116-117.

        \1624\ Data Boiler Letter at 21-22.

        \1625\ Better Markets Letter at 8.

        ---------------------------------------------------------------------------

        The Commission believes it is reasonable to permit Manual Order Events to be timestamped to the second, provided that CAT Reporters record and report the Electronic Capture Time in milliseconds. The Commission understands that the timing of Manual Order Events is inherently imprecise, and believes that requiring a timestamp to a level of granularity finer than one second is not likely to provide any additional information that will be useful to regulators. The Commission believes, however, that requiring the timestamp for the Electronic Capture Time to be recorded to the millisecond would not be burdensome and would help facilitate the reconstruction of Manual Order Events once the order is handled by an electronic system. While the Commission is not aware of any credible means or rationale to disguise electronic orders as manual orders to take advantage of the one second timestamp granularity, as suggested by a commenter, the Commission believes that the Participants should address potential methods of avoiding compliance generally as they develop their Compliance Rules.\1626\

        ---------------------------------------------------------------------------

        \1626\ See CAT NMS Plan, supra note 5, at Section 3.11.

        ---------------------------------------------------------------------------

        (2) Millisecond (or Finer) Timestamp Requirement for All Other Order Events

        Commenters generally supported the proposed requirement that the timestamps for non-Manual Order Events be recorded to the millisecond.\1627\ Two commenters also agreed with the requirement to provide timestamps in increments finer than milliseconds, to the extent a CAT Reporter already uses more granular timestamps.\1628\ Two other commenters disagreed, however, arguing that costly systems changes would be required for regulatory reporting of these finer timestamps used in its normal practice, and that they would not be useful for regulatory purposes.\1629\ Finally, two commenters took the position that certain post-trade events should not be required to have a timestamp, or have a less granular timestamp than a millisecond, as this information is less time-sensitive than fully-electronic trading events.\1630\

        ---------------------------------------------------------------------------

        \1627\ SIFMA Letter at 35; DAG Letter at 2; see also FIF Letter at 12, 80; STA Letter at 1 (supporting the DAG Letter's Exemptive Request Letter recommendations).

        \1628\ Better Markets Letter at 8; Data Boiler Letter at 21-22.

        \1629\ SIFMA Letter at 35; FIF Letter at 12. One commenter also requested clarification that the timestamp granularity requirement would be based on the functionality of the applicable CAT reporting system. See TR Letter at 7.

        \1630\ FIF Letter at 79, 99, 111, 116-17; SIFMA Letter at 35. FIF listed Reportable Events in a descending level of sensitivity: (1) Fully electronic trading events; (2) electronic orders requiring manual intervention; (3) manual order events; (4) post-trade events. See FIF Letter at 116. However, another commenter stated that no one particular reportable event is more time-sensitive than the others for surveillance purposes. See Data Boiler Letter at 21.

        ---------------------------------------------------------------------------

        In response, the Participants maintained that the Plan's timestamp requirements for non-Manual Order Events were appropriate, but also noted that as CAT Reporters incorporate finer timestamps in their systems, the quality of CAT Data will increase correspondingly.\1631\

        ---------------------------------------------------------------------------

        \1631\ Response Letter I at 29.

        ---------------------------------------------------------------------------

        The Commission believes that requiring that non-manual Reportable Events be reported with timestamp of at least a millisecond in granularity will help ensure that regulators can sequence

        Page 84788

        events with a reasonable degree of accuracy. Given the speed with which the industry currently handles orders and executes trades, it is important that the CAT utilize a timestamp that will enable regulators to reasonably sequence the order in which Reportable Events occur.\1632\ The Commission believes that timestamps in increments greater than a millisecond would undermine the improved ability to sequence events with any reasonable degree of reliability.\1633\ In response to commenters' suggestions that timestamps should not be required on manual orders and other post-execution events,\1634\ the Commission notes that it has provided flexibility for Manual Order Events and for post-execution allocations to be reported with one second timestamps.\1635\

        ---------------------------------------------------------------------------

        \1632\ For example, the ability to reconstruct market activity, perform other detailed market analyses, or determine whether a series of orders rapidly entered by a particular market participant is manipulative or otherwise violates SRO rules or federal securities laws requires the audit trail to sequence each order and event accurately.

        \1633\ See Adopting Release, supra note 14, at 45762.

        \1634\ FIF Letter at 79, 99, 111, 116-17; SIFMA Letter at 35.

        \1635\ See Section IV.D.4.d, supra.

        ---------------------------------------------------------------------------

        In response to the commenters that stated it would be costly for CAT Reporters to report using timestamps to the same granularity they use in their normal practice,\1636\ the Commission believes it is appropriate to make a clarifying change to the Plan. The CAT NMS Plan provides that to the extent that any CAT Reporter utilizes timestamps in increments finer than one millisecond such CAT Reporter must utilize such finer increment when reporting CAT Data to the Central Repository.\1637\ Rule 613(d)(3), however, required that a finer increment must be used only to the extent that ``the relevant order handling and execution systems of any CAT Reporter utilizes timestamps finer that a millisecond.'' \1638\ Accordingly, the Commission is amending Section 6.8(b) of the Plan to limit the circumstances in which a CAT Reporter must report using an increment finer than a millisecond to when a CAT Reporter utilizes a finer increment for its order handling and execution systems. The Commission finds that, this modification is appropriate in light of the increased burdens placed on CAT Reporters by the additional systems changes that would otherwise be required in order to report in finer increments. With this modification, reporting in a finer increment than a millisecond would not be a costly undertaking, and the Commission therefore believes that this approach will improve the accuracy of order event records, particularly those occurring rapidly across multiple markets, without imposing undue burdens on market participants.

        ---------------------------------------------------------------------------

        \1636\ SIFMA Letter at 35; FIF Letter at 12.

        \1637\ See CAT NMS Plan, supra note 5, at Section 6.8(b).

        \1638\ 17 CFR 242.613(d)(3).

        ---------------------------------------------------------------------------

        14. Upgrades and New Functionalities

        Under Article VI of the CAT NMS Plan, the Plan Processor is responsible, in consultation with the Operating Committee, for establishing policies and procedures for implementing potential changes and upgrades to the CAT System and infrastructure, including ``business as usual'' changes and the addition of new functionalities.\1639\ The CAT NMS Plan also requires that the Plan Processor ensure that the technical infrastructure is scalable from a capacity standpoint, adaptable to future technology developments, and technologically current.\1640\

        ---------------------------------------------------------------------------

        \1639\ See CAT NMS Plan, supra note 5, at Sections 6.1(d)(iv), (h)(i), (j), and (k). Appendix D provides additional detail about the obligations of the Plan Processor with respect to CAT Functional Changes, CAT Infrastructure Changes, and Testing of New Changes. See id. at Appendix D, Section 11.

        \1640\ See id. at Appendix C, Section A.5(a).

        ---------------------------------------------------------------------------

        The Commission received two comments on the Plan provisions pertaining to upgrades and new functionalities. The first commenter expressed concern that the Plan provisions apply only to infrastructure improvements and not also to regulatory tools.\1641\ The second commenter, noting the importance of scalability, suggested that the Plan Processor be required to meet certain capacity requirements recommended by Industry Members.\1642\ The Participants did not respond to these comments.

        ---------------------------------------------------------------------------

        \1641\ See Data Boiler Letter at 34.

        \1642\ See SIFMA Letter at 45.

        ---------------------------------------------------------------------------

        The Commission believes that the Plan's provisions with respect to potential upgrades and new functionalities are reasonable. The Commission notes that the Plan Processor is responsible for overseeing the day-to-day operations of CAT and, as such, should be well-

        positioned and informed to consider whether and when systems changes or upgrades are necessary, subject to consultation and approval by the Operating Committee.\1643\ With respect to the development of new regulatory tools, the Commission notes that the Participants, as SROs, are responsible for developing appropriate regulatory tools and, to the extent they identify necessary enhancements to the CAT, the Commission expects the Participants to direct the Plan Processor to implement them.\1644\ With respect to a commenter's recommendation that the Plan Processor be required to meet certain capacity requirements to assure scalability, the Commission notes that one of the key considerations for the CAT is that it be flexible and scalable,\1645\ and that the CAT NMS Plan already requires that the Plan Processor ensure that the Central Repository's infrastructure is scalable to handle increased reporting volumes and enhancements to technology over time.\1646\ As discussed in Section IV.H, the Commission is amending Section 6.6 of the Plan to require the Participants to submit to the Commission an annual evaluation of potential technology upgrades based on a review of technological developments over the preceding year, drawing on internal or external technological expertise.

        ---------------------------------------------------------------------------

        \1643\ See CAT NMS Plan, supra note 5, at Section 6.1(i)-(k), Appendix D, Section 11.

        \1644\ Rule 613(f) requires the Participants to develop and implement a surveillance system, or enhance existing surveillance systems that are reasonably designed to make use of the CAT Data. 17 CFR 242.613(f); see also CAT NMS Plan, supra note 5, at Section 6.9(c), Appendix D, Section 11.

        \1645\ See CAT NMS Plan, supra note 5, at Appendix C, Section 5.

        \1646\ See id. at Appendix C, Section A.5(a).

        ---------------------------------------------------------------------------

        15. Technical Specifications

        The CAT NMS Plan provides that the Plan Processor will publish Technical Specifications regarding the submission of data to the Central Repository that must be consistent with the requirements of Appendices C and D of the Plan.\1647\ Under the Plan, as filed, the Plan Processor (i) will begin developing Technical Specifications for the submission of order data by Industry Members fifteen months before Industry Members are required to begin reporting to the Central Repository, (ii) will publish these Technical Specifications one year before Industry Members are required to begin reporting to the Central Repository, and (iii) will begin connectivity testing and accepting order data from Industry Members for testing purposes six months before Industry Members are required to begin reporting to the Central Repository.\1648\ With respect to Customer Account Information, the Plan Processor will publish the Technical Specifications six months before Industry Members are required to report data to the Central Repository, and will begin connectivity and acceptance testing three months before Industry Members are required to report data to the Central

        Page 84789

        Repository.\1649\ The development of Technical Specifications for Participant submission of order data will commence ten months before Participants are required to report to the Central Repository, and will be published six months before Participants are required to report to the Central Repository.\1650\ Commenters raised several concerns regarding the Technical Specifications.\1651\

        ---------------------------------------------------------------------------

        \1647\ See id. at Section 6.9.

        \1648\ See id. at Appendix C, Section C.10(b).

        \1649\ See id. at Appendix C, Section C.10(a).

        \1650\ See id. at Appendix C, Section C.10(b).

        \1651\ FIF Letter at 36-38, 43-44; TR Letter at 4-6; UnaVista Letter at 2; Fidelity Letter at 3, 5-6.

        ---------------------------------------------------------------------------

      40. Industry Input and Timing of Technical Specifications

        One commenter emphasized the importance of having comprehensive Technical Specifications that incorporate feedback from industry.\1652\ Another commenter stated that because CAT is new and complex, time should be built into the schedule to permit two iterative reviews of the Technical Specifications before they are considered final.\1653\ This commenter suggested that this review period should be no less than six months, arguing that the current timeframes to develop and test the Technical Specifications for the reporting of information to identify a Customer, in particular, are insufficient.\1654\ Another commenter suggested that the review process with respect to Technical Specifications for reporting order data and information to identify a Customer should begin two months after a Plan Processor is selected and continue for nine months.\1655\

        ---------------------------------------------------------------------------

        \1652\ TR Letter at 4.

        \1653\ FIF Letter at 37, 43-44. More specifically, the commenter recommended that the Plan Processor provide technical specifications for order processes and Customer and allocation reporting within two months after the Effective Date and allow CAT Reporters six months to review and comment on the Technical Specifications before they are finalized. FIF Letter at 37-38.

        \1654\ FIF Letter at 38.

        \1655\ TR Letter at 5. Thomson Reuters noted the review of Technical Specifications related to the expansion of OATS to all NMS equities took four months, and specifications for changes to EBS to support large trader reporting took ten months to finalize. Id.

        ---------------------------------------------------------------------------

        One commenter recommended that the Technical Specifications for Industry Members be prepared concurrently with the Technical Specifications for Participants to provide them with more time to review and implement any necessary changes, particularly with regard to interfaces that the Participants and Industry Members will use.\1656\ The commenter also recommended that the implementation schedule address allocation reporting and suggested that Technical Specifications for allocation reporting be provided at the same time as those for reporting order data and information to identify a Customer.\1657\ The commenter also stated that very detailed and timely information regarding CAT interfaces, message, and file formats in the Technical Specifications are essential due to the aggressive timeline for implementation of CAT.\1658\

        ---------------------------------------------------------------------------

        \1656\ FIF Letter at 36, 37-38; see also SIFMA Letter at 24.

        \1657\ FIF Letter at 37.

        \1658\ Id. at 91.

        ---------------------------------------------------------------------------

        In response to these commenters, the Participants acknowledged the importance of the development process for the Technical Specifications for all CAT Reporters and emphasized that in their discussions with the Bidders, they have made development of Technical Specifications a high priority.\1659\ Although the Participants noted that the Plan would not prohibit the Plan Processor from concurrently developing the Participant and Industry Member Technical Specifications, they explained that ``in light of various practical issues raised by the pending decisions regarding the selection of the Plan Processor, the Participants do not propose to amend the Plan to reflect an expedited schedule for the Industry Member Technical Specifications.'' \1660\

        ---------------------------------------------------------------------------

        \1659\ Response Letter I at 41.

        \1660\ Id.

        ---------------------------------------------------------------------------

        In their response to comments regarding industry input on the Technical Specifications, the Participants stated that they believe that iterative interactions regarding the Technical Specifications would be beneficial in optimizing the efficiency and quality of the final Technical Specifications.\1661\ The Participants further explained that Appendix C of the Plan contemplates the publication of iterative drafts of the Technical Specifications, with respect to the submission of order data, as needed before the final Technical Specifications are published, noting that this language provides the flexibility for iterative drafts, as necessary.\1662\

        ---------------------------------------------------------------------------

        \1661\ Id.

        \1662\ Id.

        ---------------------------------------------------------------------------

        In their response to comments, the Participants also recommended amendments to the Plan to better align the milestones related to the submission of order data to the Central Repository with the milestones for the submission of Customer Account Information to the Central Repository. Specifically, the Participants recommended explicitly including milestones for the beginning of the Plan Processor's development of Technical Specifications for the submission of Customer Account Information and for the publication of iterative drafts of such Technical Specifications.\1663\ However, the Participants did not recommend aligning the timeframe for the publication of Technical Specifications for the submission of Customer Account Information (six months prior to when Industry Members are required to begin reporting to the Central Repository) with the timeframe for the publication of Technical Specifications for the submission of order data (one year prior to when Industry Members are required to begin reporting to the Central Repository), explaining that reporting order data to the CAT will be a significantly more complex process than reporting Customer Account Information and that therefore it is appropriate to allow Industry Members more time to review Technical Specifications and to begin testing their systems with regard to order data.\1664\

        ---------------------------------------------------------------------------

        \1663\ Response Letter II at 7-8.

        \1664\ Response Letter III at 12-13.

        ---------------------------------------------------------------------------

        The Commission recognizes the importance of providing sufficient opportunity for CAT Reporters to provide input as the Technical Specifications are developed. As noted by the Participants, Appendix C of the CAT NMS Plan, as recommended to be amended by the Participants in their response to comments,\1665\ provides that, for the submission processes for both order data and information to identify a Customer, the Plan Processor will begin developing the Technical Specifications fifteen months prior to Industry Member reporting and will publish iterative drafts of the Technical Specifications as needed prior to the publication of the final Technical Specifications.\1666\ In addition, the Participants stated that they will ``work with the Plan Processor and the industry to develop detailed Technical Specifications.'' \1667\

        ---------------------------------------------------------------------------

        \1665\ See supra note 1663 and accompanying text.

        \1666\ See CAT NMS Plan, supra note 5, at Appendix C, Section C.10.

        \1667\ Response Letter II at 21.

        ---------------------------------------------------------------------------

        Based on these provisions of the Plan and the Participants' statements in their response, the Commission understands that the Participants will work with and consider input from Industry Members during the Technical Specification drafting and development processes. The Commission further understands that the milestones in the Plan regarding the development of the Technical Specifications will keep Industry Members reasonably informed as to the status and content of the Technical Specifications and will permit Industry

        Page 84790

        Members, whether through the Advisory Committee or other, more informal mechanisms, to provide input on the Technical Specifications as they are being developed. As discussed above, the Plan requires the Participants and the Plan Processor to work with Industry Members in an iterative process, as necessary, to develop effective final Technical Specifications.\1668\ However, the Commission believes that providing the Plan Processor with some flexibility regarding the mechanics of the Technical Specification development process is appropriate, and that it would be premature at this time to provide for mandatory iterative interactions or to require a specific number of iterations.

        ---------------------------------------------------------------------------

        \1668\ See Section IV.D.8.b, supra.

        ---------------------------------------------------------------------------

        In addition, the Commission believes it will be beneficial for the milestones for the submission of order data and information to identify a Customer to be as aligned as possible so that all stakeholders can identify issues and present solutions on these related processes simultaneously. The Commission believes that the Participants' recommendations to include specific milestones for the commencement of the development of Technical Specifications for the submission of Customer Account Information and for the publication of iterative drafts of such Technical Specifications are reasonable, and is therefore amending the Plan accordingly.\1669\ Although not specifically recommended in the Participant's response, the Commission is also amending the Plan to clarify that the milestones for the submission of information to identify a Customer apply to Customer Identifying Information as well as Customer Account Information.\1670\ The Commission understands that the term Customer Identifying Information was inadvertently omitted from Appendix C, Section C.10(a), and therefore believes it is appropriate to amend the Plan to add this term to the milestones applicable to the development of Technical Specifications for Customer data submission.

        ---------------------------------------------------------------------------

        \1669\ Specifically, the Commission is amending Appendix C, Section C.10(a) of the Plan to state that the Plan Processor will begin developing the Technical Specifications for Industry Member reporting of Customer Account Information and Customer Identifying Information no later than fifteen months before Industry Members are required to begin reporting data to the Central Repository. The Plan Processor will also begin developing the Technical Specifications for order data reporting at that time. In addition, the Commission is amending Appendix C, Section C.10(a) of the Plan to state that the Plan Processor will publish iterative drafts of the Technical Specifications for Industry Member reporting of Customer Account Information and Customer Identifying Information, as well as Industry Member reporting of order data, as needed before the final versions of these Technical Specifications are published.

        \1670\ The milestones listed in Appendix C, Section C.10(a) apply to the customer definition process described in Section 6.4(d)(iv), which requires Industry Members to submit both Customer Account Information and Customer Identifying Information. See Section IV.D.4.a(1), supra.

        ---------------------------------------------------------------------------

        The Commission agrees with the Participants that the reporting of order data to the Central Repository is likely to be significantly more complex than the reporting of Customer Account Information and Customer Identifying Information to the Central Repository because of the greater number of data elements and reporting requirements for order data.\1671\ Therefore, the Commission believes it is reasonable for the milestones in Appendix C of the Plan to state that the Plan Processor will publish the Technical Specifications for the submission of order data prior to the publication of Technical Specifications for the submission of Customer Account Information and Customer Identifying Information to permit Industry Members to spend additional time reviewing the order data Technical Specifications and testing their order data submission systems and processes.

        ---------------------------------------------------------------------------

        \1671\ See Section III.5.d, supra.

        ---------------------------------------------------------------------------

        In response to the comments recommending that Technical Specifications for Participants and Industry Members be developed concurrently, the Commission agrees with the Participants that the completion dates associated with the development, iterative drafting, and final release of the Technical Specifications for both Participants and Industry Members set forth outer limits on when such milestones must be completed,\1672\ which would not preclude the concurrent development of Participant and Industry Member Technical Specifications. The Commission further agrees that such concurrent development could be beneficial since it would permit all stakeholders to be apprised of issues and to offer solutions simultaneously and, accordingly, encourages the Participants and the Plan Processor to develop the Technical Specifications in this manner, if feasible. However, given that the Plan Processor, which will be primarily responsible for developing the Technical Specifications, will not be selected until after the Plan is approved, and that the Plan Processor has a variety of other responsibilities related to the development of the CAT, the Commission believes that providing the Plan Processor with flexibility regarding the mechanics of the Technical Specification development process is reasonable and is not amending the Plan to require concurrent development of Participant and Industry Member Technical Specifications. Moreover, the Commission believes that the sequencing of Technical Specification milestones in the Plan--for example, that development of Technical Specifications for Participant reporting of order data to the Central Repository should begin ten months before Participants are required to begin reporting data to the Central Repository while development of Technical Specifications for Industry Member reporting of order data to the Central Repository should begin fifteen months before Industry Members are required to begin reporting data to the Central Repository \1673\--reflects a reasonable prioritization in light of the phased implementation of Participant and Industry Member reporting.

        ---------------------------------------------------------------------------

        \1672\ See Section IV.D.8.a, supra (discussing Commission amendments to the Technical Specifications and other milestones set forth in Section C.10 of Appendix C).

        \1673\ See CAT NMS Plan, supra note 5, at Appendix C, Section C.10.

        ---------------------------------------------------------------------------

        Similarly, with respect to the period of time that Industry Members will have to review and provide input on the Technical Specifications for Industry Member data reporting, the Commission notes that, because the Plan Processor may begin developing the Technical Specifications earlier than fifteen months prior to Industry Member reporting, and because the Plan Processor may seek Industry Member comment on draft Technical Specifications, there may in effect be a period of Technical Specification review that is longer than suggested by a strict interpretation of the milestones in Appendix C. Therefore, the Commission is not amending the Plan to revise these timeframes.

        However, as discussed above, the Commission expects that the Technical Specifications will be published with sufficient time for CAT Reporters to program their systems to satisfy their reporting obligations under the Plan and is amending Appendix C, Section C.10 of the Plan to ensure that the completion dates for the Technical Specification development milestones designate firm outer limits, rather than ``projected'' completion dates, for the completion of these milestones.\1674\ Therefore, the Commission is amending the Plan to provide for a minimum period of three months during which the Plan Processor and Industry

        Page 84791

        Members will work together to develop the Technical Specifications.\1675\

        ---------------------------------------------------------------------------

        \1674\ See Section IV.D.8.a, supra.

        \1675\ As amended, the Plan will require that the Plan Processor will begin developing Technical Specifications for Industry Member submission of order data no later than fifteen months before Industry Members are required to begin reporting this data and will publish the final Technical Specifications no later than one year before Industry Members are required to begin reporting. Id.

        ---------------------------------------------------------------------------

      41. Impact on Industry Members

        One commenter stated that changes that SROs require of their members' systems and processes can be costly in terms of both dollars and human capital.\1676\ The commenter also noted that these changes are often subject to short implementation time periods and there is a lack of opportunity for discussion of concerns about the extent to which such new requirements can potentially expose the markets and investors to unnecessary risk.\1677\ This commenter recommended that any new CAT requirements that will be imposed by the Participants on broker-dealers should be done through the SRO rulemaking process to afford market participants the opportunity to discuss any proposed changes with the Participants and the Commission, and to provide a sufficient lead time to implement necessary systems and coding changes.\1678\

        ---------------------------------------------------------------------------

        \1676\ Fidelity Letter at 6.

        \1677\ Id. at 3, 5-6.

        \1678\ Id.

        ---------------------------------------------------------------------------

        The Participants explained in their response that they do not believe, generally, that the Technical Specifications are required to be filed with the Commission under Rule 608,\1679\ and cautioned that requiring rule filings may introduce significant delays in the process of developing the Technical Specifications. The Participants stated that in the normal course they do not intend to file the Technical Specifications with the Commission, but noted that to the extent that a change to the Technical Specifications is significant enough to require a change to the Plan, then such an amendment to the Plan would be filed pursuant to Rule 608.\1680\

        ---------------------------------------------------------------------------

        \1679\ The Participants noted that technical specifications for other NMS plans, such as the Tick Size Pilot Plan, have not been filed with the SEC. Response Letter I at 42.

        \1680\ Response Letter I at 42.

        ---------------------------------------------------------------------------

        As discussed above, the Commission recognizes the importance of providing sufficient opportunity for all CAT Reporters to provide input as the initial Technical Specifications are developed, and believes that the Technical Specification development process outlined in the Plan, as amended--including the iterative interactions discussed above--will provide such an opportunity.\1681\ The Commission believes that the completion dates for the availability of final Technical Specifications--e.g., no later than one year before Industry Members are required to report data to the Central Repository for the release of Technical Specifications governing Industry Member reporting of order data--are reasonable and provide Industry Members with sufficient lead time to adjust their systems or make other preparations necessary to comply with the Technical Specifications, particularly since drafts of the Technical Specifications will likely have been available even earlier and Industry Members will have been involved in the process of developing the Technical Specifications.\1682\

        ---------------------------------------------------------------------------

        \1681\ See Section IV.D.15.a, supra.

        \1682\ See CAT NMS Plan, supra note 5, at Appendix C, Section C.10. The Commission also believes that the details regarding data reporting and recording included in the CAT NMS Plan itself are sufficient for CAT Reporters to begin the process of preparing their systems for CAT reporting.

        ---------------------------------------------------------------------------

        The Commission recognizes that there may be costs associated with complying with technical or operational changes in reporting requirements. The Commission notes that Material Amendments to the Technical Specifications--i.e., amendments that would ``require a Participant or an Industry Member to engage in significant changes to the coding necessary to submit information to the Central Repository''--must be approved by a Supermajority Vote of the Operating Committee, so the Plan provides additional controls with respect to changes to the Technical Specifications that could potentially be costly.\1683\ In addition, the Advisory Committee, which includes Industry Member representation, will be able to raise Industry Member concerns regarding any unexpected or costly requirements in the Technical Specifications with the Operating Committee. Moreover, while the Commission agrees with the Participants that changes to the Technical Specifications generally will not be required to be filed with the Commission, the Participants must comply with the CAT NMS Plan as approved by the Commission,\1684\ which constrains the ability of the Operating Committee to approve major changes that would alter the scope of the CAT NMS Plan through Technical Specifications. In addition, the Commission will oversee the Participants' compliance with the Plan,\1685\ which provides an additional protection against the Participants or Plan Processor attempting to include changes in the Technical Specifications that properly should be filed as Plan amendments.

        ---------------------------------------------------------------------------

        \1683\ See id. at Section 6.9(c).

        \1684\ 17 CFR 242.613(h)(1).

        \1685\ See 17 CFR 242.608(b)(2), (c), (d); 17 CFR 242.613(h).

        ---------------------------------------------------------------------------

      42. Technical Specifications Content

        Several commenters noted that the Technical Specifications for CAT must be robust and comprehensive.\1686\ Some commenters recommended that specific elements be included in the Technical Specifications.\1687\ One commenter recommended that the Participants ensure the Technical Specifications include provisions to ensure that multiple service providers are able to connect to CAT to report CAT Data.\1688\ Another commenter stressed the importance of including connectivity requirements in the Technical Specifications.\1689\ This commenter also stated that achievement of the CAT NMS Plan's reporting requirement would be dependent on the details in the Technical Specifications.\1690\ Another commenter stated that while it supports the reporting procedures identified in the CAT NMS Plan, ``clearly defined technical guidelines for field specifications under different trading scenarios'' are also needed.\1691\ A different commenter stated that the items to be included in the Technical Specifications ``inappropriately constrain'' the design of the CAT system to ``too rigidly follow a traditional SQL database design'' to the exclusion of more sophisticated analytical approaches.\1692\

        ---------------------------------------------------------------------------

        \1686\ TR Letter at 5; FIF Letter at 91; UnaVista Letter at 2.

        \1687\ TR Letter at 5 (recommending that the CAT Technical Specifications should include all scenarios currently covered in the OATS technical specification as well as additional scenarios on new processes related to the Customer definition process and options order reporting and that all scenarios required to meet the CAT NMS Plan Appendix D, Reporting & Linkage Requirements should be considered including step-outs, cancel-rebills, bunched orders and manual order processing); UnaVista Letter at 2.

        \1688\ TR Letter at 5.

        \1689\ FIF Letter at 124, 128.

        \1690\ Id. at 124.

        \1691\ UnaVista Letter at 2 (noting further that CAT certification courses, webinars, user groups and a forum for FAQs may improve knowledge transfer).

        \1692\ Data Boiler Letter at 9-10.

        ---------------------------------------------------------------------------

        In response, the Participants explained that they believe that each of these items are more appropriately addressed in the Technical Specifications, and should not be incorporated as requirements of the Plan. Nevertheless, the Participants explained that they believe that each of

        Page 84792

        the elements identified by the commenters will be incorporated into the Technical Specifications developed by the Plan Processor.\1693\

        ---------------------------------------------------------------------------

        \1693\ Response Letter I at 40.

        ---------------------------------------------------------------------------

        The Commission acknowledges the importance of timely, comprehensive, and detailed Technical Specifications that will provide all CAT Reporters with effective guidance on how to report data to the Central Repository. The Commission notes that the CAT NMS Plan specifies a number of parameters for what the Technical Specifications must contain, including specifications for the layout of files and records submitted to the Central Repository and the process for file submissions.\1694\ The Commission believes that it may be beneficial to include the elements referenced by the commenters, such as details regarding the submission of data for the Customer definition process and options order reporting, in the Technical Specifications, but believes that it is reasonable to allow the Plan Processor, with input from Industry Members during the iterative drafting process, to have some flexibility in determining these details of the Technical Specifications. In addition, the Participants have indicated that the elements referenced by the commenters will be incorporated into the Technical Specifications, and therefore the Commission does not believe it is necessary to amend the Plan to require these elements.

        ---------------------------------------------------------------------------

        \1694\ See CAT NMS Plan, supra note 5, at Section 6.9(b).

        ---------------------------------------------------------------------------

        In response to the comment that the Plan's parameters regarding the content of the Technical Specifications are too rigid and limit the ability of the Plan Processor to offer certain design solutions, the Commission believes that the parameters strike an appropriate balance between providing the Bidders flexibility to offer a variety of solutions on the one hand and including some baseline requirements for the Technical Specifications on the other, and does not believe these parameters will inappropriately constrain the solutions that the Plan Processor can develop.

    5. Capital Accounts, Allocations of Income and Loss, and Distributions (Articles VII and VIII)

      As filed, the CAT NMS Plan provides that the Operating Committee must approve by Supermajority Vote a distribution of cash and property of the Company to the Participants.\1695\ To the extent a distribution is made, all Participants must participate equally in any such distribution, except as otherwise provided in the CAT NMS Plan.\1696\ The CAT NMS Plan, as filed, also includes provisions relating to each Participant's Capital Account, and how net profits and net losses (and any other item allocable to the Participants) shall be allocated to the Participants.\1697\

      ---------------------------------------------------------------------------

      \1695\ See CAT NMS Plan, supra note 5, at Section 8.5(a).

      \1696\ Id.

      \1697\ See id. at Article VIII.

      ---------------------------------------------------------------------------

      Three commenters raised concerns about the CAT NMS Plan's proposed allocations of profit and loss, particularly concerning the ability of the Participants to profit from CAT.\1698\ Two commenters argued that the CAT NMS Plan should be amended to state that any profits arising out of the CAT may not be used to fund the Participants' other operations.\1699\ One of the commenters also stated that the CAT should operate at-cost \1700\ and that funding related to the CAT should not create a surplus for the Participants.\1701\

      ---------------------------------------------------------------------------

      \1698\ SIFMA Letter; KCG Letter; DAG Letter.

      \1699\ SIFMA Letter at 19; DAG Letter at 5.

      \1700\ SIFMA Letter at 29.

      \1701\ Id. at 14.

      ---------------------------------------------------------------------------

      Another commenter noted that the proposed funding model would allocate net profits or net losses only to Participants, even though both Participants and broker-dealers would be funding the Central Repository.\1702\ The commenter deemed this inequitable and suggested that any profits should be distributed back to all entities that fund the CAT, not just the Participants.\1703\ This commenter believed that the CAT should function as a non-profit industry utility, distributing profits to all entities funding the CAT and raising fees if there are any losses.\1704\

      ---------------------------------------------------------------------------

      \1702\ KCG Letter at 5.

      \1703\ Id.

      \1704\ Id.

      ---------------------------------------------------------------------------

      In response, the Participants stated that the Company is expected to be operated on a ``break-even'' basis, with fees imposed to cover costs and an appropriate reserve, and explained that any surpluses would be treated as an operational reserve to offset future fees and would not be distributed to the Participants as profits.\1705\ In addition, the Participants stated that they received advice from counsel to CAT NMS, LLC that the Company could qualify for tax exempt status as a ``business league'' under Section 501(c)(6) of the Internal Revenue Code and decided to have the Company apply for such status to allow it to establish reserves from the fees paid to the Company without incurring income taxes on those amounts.\1706\ Accordingly, to ensure that the Company can qualify for the business league exemption, the Participants proposed that the Commission amend the Plan so that the Company is treated as a corporation for U.S. tax purposes, that distributions, if any, are made consistent with the purposes of Section 501(c)(6) of the Internal Revenue Code, and that certain other Plan provisions related to distributions to the Participants or to the taxation of the Company as a partnership for U.S. tax purposes be eliminated.\1707\ In particular, the Participants suggested that the Commission amend the Plan to delete in its entirety Article VII, which pertains to Capital Accounts maintained by the Company for each Participant, and to replace Article VIII, which pertains to allocations of income and loss and distributions, with a provision stating that the Company intends to operate in a manner such that it qualifies as a business league within the meaning of Section 501(c)(6) of the Internal Revenue Code, and requiring the Operating Committee to submit an application to the Internal Revenue Service to attain such status for the Company.\1708\

      ---------------------------------------------------------------------------

      \1705\ Participants' Letter I at 1.

      \1706\ Id.

      \1707\ Id.

      \1708\ See id. The Participants also suggested conforming amendments to: Article I, to remove the definition of Capital Account; Article II, to state that the Company's activities also shall be consistent with its tax exempt status; Articles III, IX, and XII and Appendix C to eliminate certain references to the Participants' Capital Accounts and provisions regarding the Company's potential taxation as a partnership and its distributions and allocations; and Article X, to state that certain distributions after an event of dissolution shall be made to such persons or institutions as is consistent with the purposes of the Company and with Section 501(c)(6) of the Internal Revenue Code. See id.

      ---------------------------------------------------------------------------

      The Commission believes that the Participants' stated intent to operate the CAT on a break-even basis is appropriate. Inasmuch as the CAT is a regulatory tool mandated under Rule 613, it should not be used to fund the SROs' other operations. To ensure the CAT is operated in this manner, the Commission is amending Section 11.1(c) of the CAT NMS Plan to require that any surplus of the Company's revenues over its expenses will be treated as an operational reserve to offset future fees. The Commission believes this amendment is reasonable because it formalizes the representation made by the Participants, and provides certainty that the Participants' operation of the CAT will not contribute to the funding of their other operations. The Commission notes that, under the Exchange Act, any fees proposed to be charged by the Participants to fund the CAT must be filed as proposed rule changes pursuant to Rule 19b-4(f)(2) or

      Page 84793

      filed pursuant to Rule 608(b)(3)(i) \1709\ with the Commission, published for public comment, and meet statutory standards with respect to reasonableness, equitable allocation, and other matters.\1710\

      ---------------------------------------------------------------------------

      \1709\ See 15 U.S.C. 78s(b)(3)(A)(ii); 17 CFR 242.608(b)(3)(i). The Commission notes that, although Section 11.1(b) of the CAT NMS Plan states that the Participants will file fees for Industry Members pursuant to Section 19(b) of the Exchange Act, the Participants could choose to submit the proposed fee schedule to the Commission as individual SROs pursuant to Rule 19b-4 under the Exchange Act or jointly as Participants to an NMS plan pursuant to Rule 608 of Regulation NMS. See 17 CFR 240.19b-4; 17 CFR 242.608. Because the proposed fee schedule would establish fees, whether the Participants individually file it pursuant to Section 19(b)(3)(A)(ii) of the Act, or jointly file it pursuant to Rule 608(b)(3)(i) of Regulation NMS, the proposed fee filings will be eligible for immediate effectiveness. See 15 U.S.C. 78s(b)(3)(A)(ii); 17 CFR 242.608(b)(3)(i). The Commission also notes that publication will be subject to the filing of the fee proposal by the Participants that satisfies the requirements of the Exchange Act. If the Participants file the proposed fee schedule pursuant to Rule 19b-4(f)(2) and the Commission deems such fees not to meet applicable statutory standards, the Commission summarily may temporarily suspend the fees if it appears to the Commission that such action is necessary or appropriate in the public interest, for the protection of investors, or otherwise in furtherance of the purposes of the Exchange Act. See 15 U.S.C. 78s(b)(3)(C). If the Commission takes such action, the Commission shall institute proceedings under Section 19(b)(2)(B) to determine whether the proposed rule should be approved or disapproved. See 15 U.S.C. 78s(b)(3)(A). If the Participants file the proposed fee schedule pursuant to Rule 608(b)(3)(i), the Commission may summarily abrogate the fees and require them to be refiled in accordance with Rule 608(a)(1) and reviewed in accordance with Rule 608(b)(2) if it appears to the Commission that such action is necessary or appropriate in the public interest, for the protection of investors, or the maintenance of fair and orderly markets, to remove impediments to, and perfect the mechanisms of, a national market system or otherwise in furtherance of the purposes of the Exchange Act. See 17 CFR 242.608(b)(3)(iii).

      \1710\ Id.

      ---------------------------------------------------------------------------

      The Commission believes that it is reasonable to amend the Plan as filed by the Participants to treat CAT NMS, LLC as a tax exempt business league under Section 501(c)(6) of the Internal Revenue Code.\1711\ The Commission believes that allowing the Company to establish reserves from the fees paid to the Company without incurring income taxes on those reserves would be more efficient and could potentially make more funding available to pay for the development and operation of the CAT or reduce fees. Further, the Commission believes that that the Company's application for Section 501(c)(6) business league status addresses issues raised by commenters about the Plan's proposed allocations of profit and loss by mitigating concerns that the Company's earnings could be used to benefit individual Participants.\1712\ Accordingly, the Commission is amending the Plan as filed by the Participants to delete in its entirety Article VII, which pertains to Capital Accounts maintained by the Company for each Participant, and to replace Article VIII, which pertains to allocations of income and loss and distributions, with a provision stating that the Company intends to operate in a manner such that it qualifies as a business league and that the Operating Committee will apply to attain such status for the Company. The Commission is also amending the Plan to make the conforming amendments to Articles I-III, IX, X, and XII and Appendix C as suggested by the Participants.\1713\

      ---------------------------------------------------------------------------

      \1711\ The Commission defers, however, to the Internal Revenue Service regarding whether CAT NMS, LLC meets all the necessary requirements to so qualify.

      \1712\ To qualify as a business league, an organization must ``not be organized for profit and no part of the net earnings of the organization can inure to the benefit of any private shareholder or individual.'' 26 U.S.C. 501(c)(6).

      \1713\ See supra note 1708.

      ---------------------------------------------------------------------------

    6. Funding of the Company (Article XI)

      The CAT NMS Plan contemplates a bifurcated funding model, where costs associated with building and operating the Central Repository would be borne by (1) Participants and Industry Members that are ``Execution Venues'' \1714\ through fixed tier fees, and (2) Industry Members (other than ATSs), through fixed tier fees based on message traffic.\1715\ With respect to Execution Venues, the Operating Committee will establish at least two, and no more than five, tiers of fixed fees based on the Execution Venue's NMS Stock and OTC Equity Securities market share, as calculated by share volume.\1716\ Execution Venues that execute transactions in Listed Options will pay a fixed fee depending on the Listed Options market share of such Execution Venue, with the Operating Committee establishing at least two, and no more than five, tiers of fixed fees based on an Execution Venue's Listed Options market share, as calculated by contract volume.\1717\ With respect to Industry Members, the Plan provides that the Operating Committee will establish fixed fees to be payable by Industry Members based on the message traffic generated by such Industry Member. In addition to the message traffic fees for the non-ATS activities of Industry Members, the Plan provides that message traffic fees will be assessed on message traffic generated by: (i) An ATS that does not execute orders and that is sponsored by such Industry Member; and (ii) routing orders to and from any ATS sponsored by such Industry Member. The Operating Committee will establish at least five, and no more than nine, tiers of fixed fees based on message traffic.\1718\

      ---------------------------------------------------------------------------

      \1714\ The CAT NMS Plan defines ``Execution Venue'' as ``a Participant or an alternative trading system (``ATS'') (as defined in Rule 300 of Regulation ATS) that operates pursuant to Rule 301 of Regulation ATS (excluding any such ATS that does not execute orders).'' See CAT NMS Plan, supra note 5, at Section 1.1. The CAT NMS Plan categorizes FINRA as an Execution Venue because it has trades reported by its members to its trade reporting facilities (``TRFs'') for reporting transactions effected otherwise than on an exchange. See id. at Section 11.3(i).

      \1715\ See id. at Section 11.3(a)(i)-(ii); Section 11.3(b); Appendix C, at Section B.7(b)(iv)(B).

      \1716\ See id. at Section 11.3(a)(i).

      \1717\ See id. at Section 11.3(a)(ii).

      \1718\ See id. at Section 11.3(b); Appendix C, Section B.7(b)(iv)(B).

      ---------------------------------------------------------------------------

      1. Funding Model Generally

      Several commenters argued that the proposed funding model unfairly or inappropriately allocates costs to Industry Members and away from Participants.\1719\ One commenter believed that the Commission should consider whether Industry Members should fund the costs of CAT at all.\1720\

      ---------------------------------------------------------------------------

      \1719\ KCG Letter at 3; DAG Letter at 4; see also FSR Letter at 9-10 (noting the ultimate cost of the CAT will be in the billions of dollars, ``which will be passed-down to the Industry Members and investors through new fees'').

      \1720\ DAG Letter at 4; see also STA Letter at 1 (supporting the DAG Letter's cost and funding recommendations).

      ---------------------------------------------------------------------------

      Some commenters stated that requiring the creation and maintenance of a Participant-owned and -operated system like CAT to be partially funded by Industry Members would be a significant departure from the funding models currently used for existing regulatory systems.\1721\ One of these commenters believed that the Participants should justify the need for Industry Members to fund the creation and ongoing costs of the CAT.\1722\ The commenter opposed any Participant-imposed fee for the CAT,\1723\ and stated that the CAT NMS Plan does not distinguish between the costs of the CAT that are associated with Industry Member data reporting and costs associated with the Participants' regulatory uses.\1724\ This commenter

      Page 84794

      further stated that the funding authority of the CAT should extend only to expenses directly related to the reasonable implementation and operating costs of the CAT system, such as costs related to the management of the business of the CAT, and the direct costs of building and maintaining of the Central Repository.\1725\ The commenter specifically opposed the Participants' proposal to recover the costs of the creation or development of the CAT NMS Plan, such as legal and consulting costs, and expressed the view that these costs are solely the responsibility of the Participants as part of their regulatory cost of doing business.\1726\ Further, this commenter suggested that the governance structure include an audit committee to assure that the CAT's revenue is used for regulatory purposes.\1727\

      ---------------------------------------------------------------------------

      \1721\ SIFMA Letter at 14 (noting that the Participants fund similar systems like OATS themselves and then a portion of those costs are borne by Industry Members through fees); DAG Letter at 5.

      \1722\ SIFMA Letter at 14.

      \1723\ Id.

      \1724\ Id. at 17. The commenter further noted that the Plan does not address how new costs resulting from regulatory research needs are allocated, providing as an example if the Commission requested a significant increase in the Central Repository's processing capability to facilitate a large-scale analysis related to a market structure study, opining that it would be inappropriate to require Industry Members to pay for Participant-specific system enhancements through the general allocation of CAT costs. Id. at 18.

      \1725\ Id. at 15.

      \1726\ Id.; see also DAG Letter at 4-5.

      \1727\ SIFMA Letter at 29.

      ---------------------------------------------------------------------------

      Finally, two commenters believed that, to the extent the CAT generates cost savings for the Participants, that cost savings should be used first to fund the CAT before fees are imposed on Industry Members.\1728\

      ---------------------------------------------------------------------------

      \1728\ SIFMA Letter, DAG Letter; see also STA Letter at 1 (supporting the DAG Letter's cost and funding recommendations).

      ---------------------------------------------------------------------------

      In response, the Participants stated that Rule 613 specifically contemplated the allocation of the costs of the creation, implementation and maintenance of the CAT among both the Participants and their members, and that the Adopting Release for Rule 613 discussed and permitted the recovery of such costs by Participants from their members.\1729\ Additionally, with respect to the comments that objected to Participants using fees under the Plan to recover development costs of the Plan, and in particular legal and consulting costs, the Participants explained that Rule 613 permitted the Participants to propose to recover such costs.\1730\ The Participants stated their belief that it is equitable that the Industry Members as well as Participants contribute to the funding of the CAT, including the development of the Plan governing the CAT,\1731\ because both benefit from the enhanced market oversight afforded regulators by the CAT,\1732\ and noted that adopting CAT-specific fees would provide greater transparency for market participants than a general regulatory fee.\1733\

      ---------------------------------------------------------------------------

      \1729\ Response Letter II at 9-10 (citing 17 CFR 242.613(a)(1)(vii)(D) and Adopting Release, supra note 14, at 45795).

      \1730\ Response Letter II at 13.

      \1731\ Id.

      \1732\ Id. at 10.

      \1733\ Id.

      ---------------------------------------------------------------------------

      In response to the commenters that suggested that the CAT be funded, at least in part, by cost savings,\1734\ the Participants acknowledged that cost savings from retiring existing systems will partially offset their expenses associated with the CAT, but declined to make any specific funding commitments.\1735\

      ---------------------------------------------------------------------------

      \1734\ SIFMA Letter at 17-18; DAG Letter at 4.

      \1735\ Response Letter II at 16. Specifically, the Participants stated that they expect to realize approximately $10.6 million in cost savings associated with the retirement of existing systems when moving to the CAT. However, they also said that they will incur approximately $17.9 million in expenses associated with complying with the CAT reporting requirements, and an additional $23.2 million in expenses related to the implementation of surveillance programs.

      ---------------------------------------------------------------------------

      The Participants, as SROs, have traditionally recovered their regulatory costs through the collection of fees from their members, and such fees are specifically contemplated by the Exchange Act.\1736\ The Participants currently collect certain regulatory and other fees, dues and assessments from their members to fund their SRO responsibilities in market and member regulation; such fees must be consistent with applicable statutory standards under the Exchange Act, including being reasonable, equitably allocated \1737\ and not unfairly discriminatory.\1738\

      ---------------------------------------------------------------------------

      \1736\ Sections 6(b)(1) and 15A(b)(2) of the Exchange Act require that an exchange or association have the capacity to be able to carry out the purposes of the Exchange Act, the rules and regulations thereunder, and the rules of the exchange or association. 15 U.S.C. 78f(b)(1); 15 U.S.C. 78o-3(b)(2). See e.g., Schedule A to the By-Laws of FINRA, Section 1(a) (stating ``FINRA shall, in accordance with this section, collect member regulatory fees that are designed to recover the costs to FINRA of the supervision and regulation of members, including performing examinations, financial monitoring, and policy, rulemaking, interpretive, and enforcement activities''). As SROs, the Participants have an obligation to be so organized and have the capacity to be able to carry out the purposes of the Exchange Act, and to enforce compliance by their members with the Exchange Act and their rules. 15 U.S.C. 78f(b)(1); 15 U.S.C. 78o-3(b)(2).

      \1737\ 15 U.S.C. 78f(b)(4); 15 U.S.C. 78o-3(b)(5).

      \1738\ 15 U.S.C. 78f(b)(5); 15 U.S.C. 78o-3(b)(6).

      ---------------------------------------------------------------------------

      The Commission believes that the proposed funding model reflects a reasonable exercise of the Participants' funding authority to recover the Participants' costs related to the CAT. The CAT is a regulatory facility jointly owned by the Participants and, as noted above, the Exchange Act specifically permits the Participants to charge members fees to fund their self-regulatory obligations. The Commission further believes that the proposed funding model is designed to impose fees reasonably related to the Participants' self-regulatory obligations because the fees would be directly associated with the costs of establishing and maintaining the CAT, and not unrelated SRO services. The Commission emphasizes that the CAT NMS Plan does not set forth, and the Commission is not hereby approving, the specific fees to be charged by the Participants; rather, such fee proposals later will be separately filed with the Commission by the Participants, published for public comment, and assessed by the Commission for consistency with applicable Exchange Act standards, including whether they are reasonable and equitably allocated,\1739\ and not unfairly discriminatory.\1740\

      ---------------------------------------------------------------------------

      \1739\ 15 U.S.C. 78f(b)(4); 15 U.S.C. 78o-3(b)(5).

      \1740\ 15 U.S.C. 78f(b)(5); 15 U.S.C. 78o-3(b)(6).

      ---------------------------------------------------------------------------

      2. Funding Model's Allocation of Costs

      Several commenters expressed concern about the proposed allocation of CAT costs between the Participants and Industry Members.\1741\ Some expressed concern that the majority of the costs of the CAT would be allocated to Industry Members, with some estimating that Industry Members would pay approximately 88% of the ongoing annual costs of the CAT.\1742\ One commenter stated that the funding model is ``excessively and unjustifiably weighted to broker-dealers,'' \1743\ and requested to review proposed CAT fees to ensure they are reasonable and equitable.\1744\ Another commenter

      Page 84795

      expressed concern that the costs and funding of CAT might not be allocated equitably among Industry Members and Participants, given that the Participants are sole voting members of the Plan.\1745\

      ---------------------------------------------------------------------------

      \1741\ KCG Letter; SIFMA Letter; Fidelity Letter; FSR Letter; DAG Letter; Data Boiler Letter; Wachtel Letter.

      \1742\ See DAG Letter at 4 (noting that the CAT NMS Plan estimates that 88% of the annual costs of CAT would be allocated to Industry Members, and that the Participants additionally intend to require Industry Members to help fund the creation and ongoing costs of CAT, significantly increasing the burden on Industry Members); KCG Letter at 4; SIFMA Letter at 12-13 (noting that the total estimated annual cost of the CAT NMS Plan would be $1.7 billion, of which $1.5 billion, or 88% of the costs for the operation of CAT, would be borne by Industry Members). One of these commenters stated that, although not mentioned in the CAT NMS Plan, it believed the Participants anticipate allocating 75% of CAT Central Repository build and operational costs to Industry Members and 25% to Execution Venues, thereby shifting the majority of CAT costs away from the SROs and on the Industry Members, and increasing the Industry Member portion of annual CAT-related costs from approximately 88% to more than 96%. KCG Letter at 4. That commenter stated that ``this methodology is inequitable and serves to underscore the inherent conflicts of interest the SROs face with respect to CAT funding and the effects of precluding broker-dealers from meaningfully participating in management of the CAT.'' KCG Letter at 4-5.

      \1743\ SIFMA Letter at 13.

      \1744\ Id. at 18.

      \1745\ Fidelity Letter at 5.

      ---------------------------------------------------------------------------

      More generally, two commenters believed that the CAT NMS Plan's funding model lacks sufficiently detailed information.\1746\ One of the commenters stated that the Plan's funding model does not adequately represent the industry feedback that the group provided to the Participants, and noted that the CAT NMS Plan lacks an analysis of how a CAT fee would fit into the existing funding model for regulation, including whether FINRA trading activity fees would be reduced after OATS is retired.\1747\ Another commenter stated that the information made publicly available in the CAT NMS Plan is insufficient for it to provide meaningful analysis on the funding model.\1748\

      ---------------------------------------------------------------------------

      \1746\ SIFMA Letter; DAG Letter.

      \1747\ DAG Letter at 5.

      \1748\ SIFMA Letter at 16. This commenter noted that the CAT NMS Plan provides only a high-level description of a funding model that reflects no input from broker-dealers and contains very little information on how costs will be allocated between broker-dealers and Participants. Id. at 13.

      ---------------------------------------------------------------------------

      The Participants disputed the estimate quoted by several commenters that Industry Members would bear 88% of the costs of the CAT, stating that this calculation referred to Industry Member compliance costs, and does not directly reflect CAT fees to be imposed pursuant to the Plan.\1749\

      ---------------------------------------------------------------------------

      \1749\ Response Letter II at 10. The Participants stated that the funding model provides a framework for the recovery of the costs to create, develop and maintain the CAT, and is not meant to address the cost of compliance for Industry Members and Participants with the reporting requirements of Rule 613.

      ---------------------------------------------------------------------------

      In response to the commenter that asked whether existing regulatory fees would be reduced once the CAT is implemented,\1750\ the Participants stated that each SRO will consider potential revisions to its existing regulatory fees once the CAT begins operation and legacy systems are retired.\1751\ The Participants also disagreed with the commenters that expressed concern that the funding model does not adequately reflect industry input,\1752\ and stressed that the funding model was discussed with the DAG many times and that the funding model was developed taking into account their input.\1753\

      ---------------------------------------------------------------------------

      \1750\ DAG Letter at 5.

      \1751\ Response Letter II at 17-18.

      \1752\ SIFMA Letter at 13; DAG Letter at 4.

      \1753\ Response Letter II at 18.

      ---------------------------------------------------------------------------

      The Commission believes that the proposed funding model is reasonably designed to allocate the costs of the CAT between the Participants and Industry Members. The Commission notes that the proposed funding model set forth in the Plan does not specify that the Participants or Industry Members would bear any particular percentage allocation of the costs associated with building and operating the Central Repository. As noted above, the Participants are permitted to recoup their regulatory costs under the Exchange Act through the collection of fees from their members, as long as such fees are reasonable, equitably allocated \1754\ and not unfairly discriminatory, and otherwise are consistent with Exchange Act standards.\1755\ The Commission will have the opportunity, at a later date, to review, and Industry Members and other interested persons will have the opportunity to comment upon, the specific fees the Participants intend to impose pursuant to the general funding model discussed herein.\1756\

      ---------------------------------------------------------------------------

      \1754\ 15 U.S.C. 78f(b)(4); 15 U.S.C. 78o-3(b)(5).

      \1755\ 15 U.S.C. 78f(b)(5); 15 U.S.C. 78o-3(b)(6).

      \1756\ See Section IV.F.1, supra.

      ---------------------------------------------------------------------------

      3. Message Traffic and Market Share Distinction

      Two commenters addressed the proposed allocation of costs between Execution Venues and Industry Members based on market share and message traffic, respectively.\1757\ One of the commenters questioned the allocation of costs to Industry Members by message-traffic tiers, noting that market makers in exchange-traded products (``ETPs'') could incur much greater allocated costs than market makers in corporate stocks, given that market makers in ETPs may generate ten times the amount of message traffic per executed trade as market makers in corporate stocks.\1758\ The commenter also noted that Industry Members that primarily take liquidity do not generate significant quote-message traffic, so that ``any mechanism that allocates costs to broker-dealers strictly based on message traffic would unfortunately disadvantage broker-dealers that typically provide liquidity compared to those that may only take liquidity,'' \1759\ thereby discouraging the display of quotes. The commenter expressed concern that the Plan does not explain how much the Participants would charge per message or per market share percentage, or how they would assign the fixed-fee tiers to exchanges and Industry Members.\1760\

      ---------------------------------------------------------------------------

      \1757\ SIFMA Letter at 16-17; Data Boiler Letter at 15; see also DAG Letter at 5 (urging additional transparency related to the funding model based on market share and message traffic).

      \1758\ SIFMA Letter at 17.

      \1759\ Id.

      \1760\ Id. at 16.

      ---------------------------------------------------------------------------

      This commenter also noted that the CAT NMS Plan does not distinguish between costs of the CAT that are related to Industry Member data collection and processing, and costs of the CAT related to SRO surveillance and research, and expressed the view that allocating CAT costs simply based on message traffic or market share would make Industry Members subsidize Participant surveillance systems and other regulatory functions that currently are funded by the Participants through other regulatory fees imposed on Industry Members.\1761\ Finally, this commenter stated that the CAT NMS Plan does not explain why the SROs propose to allocate costs by message-traffic tiers for non-ATS Industry Members and by market share for exchanges and ATSs, and expressed concern that the market share approach applicable to exchanges and ATSs is primarily driven by their ability to pay, as opposed to the actual costs they impose on the Central Repository.\1762\

      ---------------------------------------------------------------------------

      \1761\ Id. at 17-18.

      \1762\ Id. at 16-17. The commenter urged the Participants to explain why they would not use the market share method of allocation for non-ATS Industry Members.

      ---------------------------------------------------------------------------

      Another commenter expressed the view that the proposed allocation of fees among Participants, other types of Execution Venues and Industry Members is not fair,\1763\ and that assessing fees based on message traffic and market share is not appropriate or reasonable.\1764\ This commenter stated that charging for message traffic would amount to a ``financial transaction tax'' that would negatively impact the financial markets, and recommended that charges instead be based on ``quarantine or red-flag of suspicious trade messages.'' \1765\

      ---------------------------------------------------------------------------

      \1763\ Data Boiler Letter at 15.

      \1764\ Id.

      \1765\ Id.

      ---------------------------------------------------------------------------

      In response, the Participants explained that ``in designing a funding model, the Participants have sought to ensure an equitable allocation of fees such that large broker-dealers or broker-dealer complexes and large Participants or Participant complexes pay more than small broker-dealers and small exchanges.'' \1766\ The Participants believe that there is a strong correlation between message traffic and the size of an Industry Member, and that Industry Members increase their message traffic volume as they grow.\1767\ The

      Page 84796

      Participants stated that message traffic is a key component of the costs of operating the CAT, so they believe that message traffic is an appropriate criterion for placing Industry Members in a certain fee tier.\1768\ The Participants also expressed the view that the correlation between message traffic and size does not apply to Execution Venues, which they describe as producing similar amounts of message traffic regardless of size. They explained that charging Execution Venues based on message traffic would make large and small Execution Venues pay comparable fees, which they believe would be an inequitable result,\1769\ so the Participants decided to treat Execution Venues differently from Industry Members in the funding model.\1770\ The Participants estimated that the result of the funding model would be that fees for the smallest Execution Venues would be comparable to the largest Industry Members, and that aggregate fees for Participant complexes\1771\ would be at least comparable to those of large Industry Members.\1772\

      ---------------------------------------------------------------------------

      \1766\ Response Letter II at 11.

      \1767\ Id.

      \1768\ Id.

      \1769\ Id.

      \1770\ Id. at 12.

      \1771\ ``Participant complexes'' refers to Affiliated Participants, which include single entities that hold self-

      regulatory licenses for multiple exchanges. The Plan defines ``Affiliated Participant'' as ``any Participant controlling, controlled by, or under common control with another Participant.'' See CAT NMS Plan, supra note 5, at Section 1.1.

      \1772\ Response Letter II at 12.

      ---------------------------------------------------------------------------

      In response to the commenter that stated that the funding model should distinguish between the costs of Industry Member data collection and processing and the costs related to SRO surveillance and research,\1773\ and to the commenter that recommended that fees be based on suspicious trade messages,\1774\ the Participants noted that the Bidders cited data ingestion and processing as the primary driver of CAT costs and thus believe that data collection and processing requirements are a reasonable basis for allocating costs to CAT Reporters.\1775\ As to concerns that a fee based on message traffic would discourage the display of quotes,\1776\ the Participants explained that ``one of the reasons for proposing a tiered, fixed fee funding model was to limit the disincentives to providing liquidity to the market,'' as might be the case with a strictly variable funding model.\1777\

      ---------------------------------------------------------------------------

      \1773\ SIFMA Letter at 17-18.

      \1774\ Data Boiler Letter at 15.

      \1775\ Response Letter II at 14.

      \1776\ SIFMA Letter at 17.

      \1777\ Response Letter II at 16. As an example, the Participants stated that a firm with a large volume of quotes would likely be categorized by the proposed funding model in an upper fee tier instead of being assessed a fee for its message traffic directly as it would be under ``a more directly metered model.''

      ---------------------------------------------------------------------------

      The Commission expressed concern in the Notice that the structure of the funding model could provide a competitive advantage to exchanges over ATSs.\1778\ Under the proposed funding model, for an execution occurring on an exchange, the exchange would pay an Execution Venue fee based on its market share to the CAT. For an execution that occurs on an ATS, the Industry Member operating the ATS would pay an Execution Venue fee based on its market share \1779\ and the national securities association also would pay an Execution Venue fee based on its market share when the ATS trade is reported to it.\1780\ In the Notice, the Commission expressed concern that, under the Plan, ATS volume would effectively be charged once to the Industry Member operating the ATS and a second time to FINRA, which would result in ATS volumes contributing twice as much to CAT funding as exchange volumes. The Commission further inquired whether the funding model would disadvantage ATSs relative to registered exchanges, and whether trading volume could migrate to exchanges in response.\1781\

      ---------------------------------------------------------------------------

      \1778\ See Notice, supra note 5, at 30740.

      \1779\ The Commission notes that the Industry Member that operates an ATS also will be subject to message traffic fees. Section 11.3(b) of the CAT NMS Plan states: ``The Operating Committee will establish fixed fees to be payable by Industry Members, based on the message traffic generated by such Industry Member. . . . For the avoidance of doubt, the fixed fees payable by Industry Members pursuant to this paragraph shall, in addition to any other applicable message traffic, include message traffic generated by: (i) An ATS that does not execute orders that are sponsored by such Industry Member, and (ii) routing orders to and from any ATS sponsored by such Industry Member.'' See CAT NMS Plan, supra note 5, at Section 11.3(b).

      \1780\ Section 11.3(a)(i) of the CAT NMS Plan states: ``Each Execution Venue that: (A) Executes transactions; or (B) in the case of a national securities association, has trades reported by its members to its trade reporting facility or facilities for reporting transactions effected otherwise than on an exchange, in NMS Stock or OTC Equity Securities will pay a fixed fee depending on the market share of that Execution Venue in NMS Stock and OTC Equity Securities . . .'' Section 11.3(b) applies to Execution Venues transacting in Listed Options, stating: ``Each Execution Venue that executes transactions in Listed Options will pay a fixed fee depending on the Listed Options market share of that Execution Venue . . .'' See CAT NMS Plan, supra note 5, at Section 11.3(a)(i)-(ii).

      \1781\ See Notice, supra note 5, at 30740. The Commission solicited comment on two Commission-proposed alternatives pertaining to fees imposed on ATSs. In the first alternative, the Commission proposed excluding ATS volume from TRF volume. The Commission stated that this alternative would allow SROs that operate TRFs (currently only FINRA) to avoid paying Execution Venue fees for volume originating from an ATS execution and would avoid double-counting ATS volume as share volume. See id. at 30768. The Commission also solicited comment on not charging Industry Members for message traffic to and from their ATSs while still assessing fees to ATSs as Execution Venues or exchange Industry Members for their message traffic. The Commission explained that this alternative would mitigate incentives for Industry Members to route their orders in order to minimize costs under the proposed funding model. Id.

      ---------------------------------------------------------------------------

      To address this concern, the Participants recommended modifying the proposed funding model to exclude from the charges applicable to a national securities association any market share attributable to transactions reported to it by an ATS.\1782\

      ---------------------------------------------------------------------------

      \1782\ Response Letter II at 13.

      ---------------------------------------------------------------------------

      The Commission finds reasonable the suggested modification to the funding model by the Participants and, accordingly, is amending Section 11.3(a)(i) of the CAT NMS Plan so that the share volume of trades in NMS Stocks or OTC Equity Securities reported by an ATS to a national securities association shall not be included in the calculation of the national securities association's market share for purposes of determining its Execution Venue fee. The Commission believes this amendment helps to mitigate concerns that this aspect of the proposed funding model, by effectively double-counting ATS transactions, would result in an inequitable allocation of fees, unfair discrimination and an unnecessary burden on competition.

      With this change, the Commission believes that the funding model set forth in the CAT NMS Plan is reasonable. The Participants have offered a credible justification for using different criteria to charge Execution Venues (market share) and Industry Members (message traffic). The Participants also have offered a reasonable basis for establishing a funding model based on broad tiers, in that it may be easier to implement and less likely to have an incremental deterrent effect on liquidity provision.\1783\

      ---------------------------------------------------------------------------

      \1783\ Further, the Commission believes that the tiered fee structure effectively mitigates a concern expressed by a commenter that charging for message traffic would amount to a ``financial transaction tax'' that would negatively impact the financial markets. See Data Boiler Letter at 15.

      ---------------------------------------------------------------------------

      In response to concerns that the funding model could make Industry Members subsidize Participant surveillance systems and functions that currently are funded through regulatory fees on Industry Members,\1784\ the Commission reiterates that the Exchange Act permits the Participants to assess fees among their members to recoup their regulatory costs, as long as such fees meet the applicable Exchange Act

      Page 84797

      standards, including that they be reasonable and equitably allocated,\1785\ and are not unfairly discriminatory.\1786\ When such fee proposals are filed with the Commission, they will be published for public comment,\1787\ and the Commission will have the opportunity to assess the fees.

      ---------------------------------------------------------------------------

      \1784\ SIFMA Letter at 17-18.

      \1785\ See 15 U.S.C. 78f(b)(4); 15 U.S.C. 78o-3(b)(5).

      \1786\ See 15 U.S.C. 78f(b)(5); 15 U.S.C. 78o-3(b)(6).

      \1787\ See supra note 1709.

      ---------------------------------------------------------------------------

      4. Transparency and Alternatives to the Funding Model

      Five commenters advocated for greater transparency into CAT funding.\1788\ One commenter recommended that the CAT's costs and financing be completely transparent and that the CAT should have ``publicly disclosed annual reports, audited financial statements, and executive compensation disclosure.'' \1789\ The commenter also recommended that the Participants engage an independent third party to design the funding model, determine any CAT fees to be charged by Participants,\1790\ and audit their regulatory revenues and the allocation thereof. It also believed that the Commission should publish the results of the audit.\1791\ Another commenter similarly recommended that the Commission require the Participants to engage an independent third party to review and make recommendations for a transparent and equitable funding model.\1792\ Another commenter urged transparency in the process of calculating any fees assessed on Participants to make sure they are related to the costs to build, operate, and administer the CAT.\1793\ One commenter suggested a greater role in CAT NMS Plan governance for Industry Members and institutional investors to help ensure that the costs and funding of CAT are allocated equitably among Industry Members and SROs.\1794\

      ---------------------------------------------------------------------------

      \1788\ SIFMA Letter; FSI Letter; KCG Letter; Fidelity Letter at 5; DAG Letter. One commenter generally supported additional transparency into the funding model with respect to market share and message traffic. See DAG Letter at 5; see also STA Letter at 1 (supporting the DAG Letter's cost and funding recommendations).

      \1789\ SIFMA Letter at 29.

      \1790\ Id. at 14.

      \1791\ Id.

      \1792\ KCG Letter at 5.

      \1793\ FSI Letter at 6.

      \1794\ Fidelity Letter at 5.

      ---------------------------------------------------------------------------

      Two commenters offered alternative funding models.\1795\ One commenter suggested that CAT fees be set by an independent advisory committee, rather than by the Operating Committee.\1796\ The other commenter recommended a centralized funding mechanism for the CAT, with the Participants collectively charging Industry Members a single CAT fee instead of each creating their own independent fees, believing it to be the most efficient and consistent way to collect CAT fees.\1797\ The commenter also suggested that, before the Participants impose any CAT fees on Industry Members, they should provide a public accounting of their current revenues and how that money is spent.\1798\

      ---------------------------------------------------------------------------

      \1795\ Data Boiler Letter; SIFMA Letter.

      \1796\ Data Boiler Letter at 15.

      \1797\ SIFMA Letter at 18.

      \1798\ Id.

      ---------------------------------------------------------------------------

      Four commenters recommended imposing certain specific fees to fund the CAT.\1799\ Three of the commenters suggested that the Participants and the Commission pay a user fee for the CAT, since they are direct beneficiaries of the system.\1800\ Another commenter suggested that the costs of building and maintaining the CAT should be borne by CAT Reporters through a filing or technology fee,\1801\ and recommended charging CAT Reporters with high cancellation rates and those that add ``noise'' to the CAT system a special usage fee.\1802\

      ---------------------------------------------------------------------------

      \1799\ SIFMA Letter; Better Markets Letter; FSR Letter; DAG Letter; see also STA Letter at 1 (supporting the DAG Letter's cost and funding recommendations).

      \1800\ SIFMA Letter at 18, 30 (stating that if Industry Members must pay a user fee to access their own CAT data, then there should be also be a user fee for the Participants); FSR Letter at 10; DAG Letter at 5; see also STA Letter at 1 (supporting the DAG Letter's cost and funding recommendations).

      \1801\ Better Markets Letter at 5.

      \1802\ Id. at 6.

      ---------------------------------------------------------------------------

      In response, the Participants stated that they did not believe that an independent third party should be hired to evaluate CAT fees, noting that all CAT fees would be filed with the Commission pursuant to the Exchange Act, so that Industry Members and other interested persons would have an opportunity to comment, and the Commission would evaluate whether they are consistent with the statutory standards.\1803\ The Participants also noted that the funding model is intended to operate the CAT on a break-even basis, without creating profits for individual Participants.\1804\ In addition, the Participants stressed that they are prohibited from using regulatory fees for commercial purposes.\1805\ The Participants concluded that employing an independent third party would be unnecessary in light of these provisions.\1806\

      ---------------------------------------------------------------------------

      \1803\ Response Letter II at 17.

      \1804\ Id.

      \1805\ Id. at 17 n.60.

      \1806\ Id. at 17.

      ---------------------------------------------------------------------------

      In response to the commenter that recommended a centralized funding mechanism,\1807\ the Participants indicated that they intend for fees to be billed and collected centrally through the CAT LLC, so that each Industry Member will receive one invoice instead of separate invoices from each Participant.\1808\ In response to the suggestion that the Participants charge a regulatory usage fee, the Participants noted that the CAT NMS Plan authorizes the imposition of such a fee, and stated that they plan to evaluate the implementation of usage fees within a year after the Participants begin using the CAT.\1809\

      ---------------------------------------------------------------------------

      \1807\ SIFMA Letter at 15.

      \1808\ Response Letter II at 15.

      \1809\ Id.

      ---------------------------------------------------------------------------

      The Commission believes that the funding model proposed by the Participants, as amended by the Commission, is consistent with Rule 613(a)(1)(vii)(D) and is reasonable. Rule 613(a)(1)(vii)(D) requires the Participants to discuss in the CAT NMS Plan how they propose to fund the creation, implementation and maintenance of the CAT, including the proposed allocation of estimated costs among the Participants, and between the Participants and Industry Members.\1810\ In the CAT NMS Plan, the Participants set forth a funding model that establishes a framework for the allocation of CAT costs across Participants and Industry Members. At this time, the Commission believes that the Exchange Act rule filing process, described above, will provide sufficient transparency into the fees charged by the Participants that are associated with CAT.\1811\

      ---------------------------------------------------------------------------

      \1810\ See 17 CFR 242.613(a)(1)(vii)(D).

      \1811\ See 17 CFR 240.19b-4(f)(2); see also 15 U.S.C. 78s(b)(3)(A); 17 CFR 242.608; supra note 1756.

      ---------------------------------------------------------------------------

      With respect to the suggested imposition of a regulatory user fee,\1812\ a fee for high cancellation rates and ``noise,'' \1813\ or a specific technology fee, \1814\ the Commission notes that nothing in the Plan prohibits such fees from being charged and, if the Participants determine such fees to be appropriate, they may file a proposed rule change that would be subject to public comment and Commission review.\1815\

      ---------------------------------------------------------------------------

      \1812\ SIFMA Letter at 18; FSR Letter at 10, DAG Letter at 5; see also STA Letter at 1 (supporting the DAG Letter's cost and funding recommendations).

      \1813\ Better Markets Letter at 6.

      \1814\ Id. at 5.

      \1815\ See Section V.F.3.b, infra, for additional discussion of these comments. As it relates to fees that the Operating Committee may impose for access to and use of the CAT for regulatory and oversight purposes, the Commission interprets the provisions in the Plan relating to the collection of fees as applying only to Participants and Industry Members, and thus the Commission would not be subject to such fees.

      ---------------------------------------------------------------------------

      Page 84798

      5. Miscellaneous

      The Commission notes that it is amending Section 11.1(d) of the CAT NMS Plan, which currently states that the Operating Committee shall adopt policies, procedures, and practices regarding, among other matters, the assignment of fee tiers, and that, as part of its regular review of fees for the CAT, the Operating Committee shall have the right to change the tier assigned to any particular Person in accordance with Article XI, and such changes will be effective upon reasonable notice to such Person. The Commission is amending this section to provide that the Operating Committee shall have the right to change the tier assigned to any particular Person in accordance with fee schedules previously filed with the Commission by the Operating Committee that are reasonable, equitable and not unfairly discriminatory and subject to notice and comment. The Commission believes this amendment to Section 11.1(d) is appropriate because it limits the discretion of the Operating Committee to change the tier assigned to a particular Person to objective standards previously filed with the Commission that are consistent with Exchange Act standards, and provides notice of any changes to the objective standards and the opportunity for public comment.

    7. Dispute Resolution

      As noted above, the Plan does not include a general provision addressing the method by which disputes arising in connection with the operation of the Plan will be resolved.\1816\ The Plan does, however, provide the means for resolving disputes regarding the Participation Fee in Articles III and XI of the Plan.\1817\ The Commission did not receive any comments regarding these general dispute resolution provisions. However, the Commission is amending Article III to make it consistent with Article XI.

      ---------------------------------------------------------------------------

      \1816\ See Notice, supra note 5, at 30635.

      \1817\ CAT NMS Plan, supra note 5, at Section 3.3.

      ---------------------------------------------------------------------------

      Specifically, Article III, Section 3.3(b) of the Plan states that, in the event that the Company and a prospective Participant do not agree on the amount of the Participation Fee, such amount will be subject to the review by the Commission. The Plan currently cites to Section 11A(b)(5) of the Exchange Act \1818\ as the authority by which the Commission can review such disputes. However, Section 11A(b)(5) of the Exchange Act is not the appropriate authority for Commission review under these circumstances because the CAT is not a ``registered securities information processor.'' Accordingly, the Commission is making a technical amendment to the Plan (consistent with Article XI, Section 11.5) to provide that in the event that the Company and a prospective Participant do not agree on the amount of the Participation Fee, such amount will be subject to review by the Commission pursuant to SEC Rule 608 \1819\ or in any other appropriate forum.

      ---------------------------------------------------------------------------

      \1818\ See id. at Section 3.3(b); see also, Exchange Act Section 11A(b)(5), 15 U.S.C. 78k-l(b)(5) (which provides that a prohibition or limitation on access to services by a registered securities information processor must be reviewed by the Commission upon application by an aggrieved person).

      \1819\ 17 CFR 242.608(d).

      ---------------------------------------------------------------------------

    8. Written Assessments, Audits and Reports

      Section 6.6 of the Plan as filed, pursuant to Rule 613(b)(6), requires the Participants to provide the Commission with a written assessment of the operation of the CAT at least every two years or more frequently in connection with any review of the Plan Processor's performance.\1820\ The Plan requires that such written assessment include, at a minimum: (i) An evaluation of the Plan Processor's performance; (ii) a detailed plan for any potential improvements to its performance; (iii) an estimate of the costs associated with any such potential improvements; and (iv) an estimated implementation timeline for any such potential improvements.\1821\

      ---------------------------------------------------------------------------

      \1820\ See CAT NMS Plan, supra note 5, at Section 6.6.

      \1821\ Id.

      ---------------------------------------------------------------------------

      The Commission believes that it is important that the CAT keep pace with technological developments and changes to industry business practices, which can occur very rapidly. As such, the Commission believes that assessments more frequent than biannually of the CAT's standards and processes could ensure that the Plan Processor and the Participants remain current in their knowledge of technological and business developments and facilitate enhancements to the CAT as appropriate. The Commission believes that the preparation of reports and assessments on an annual basis, rather than a biannual basis, will help ensure that CAT technology and operations continue to provide timely, accurate, complete and accessible data, and that it is collected in a cost-effective manner. Accordingly, the Commission is amending Section 6.6 of the Plan to change the frequency of the assessment contemplated by Rule 613(b)(6) from biannual to annual.

      The Commission is also amending Section 6.6 of the Plan to provide further detail regarding elements of the written assessment to be conducted by the Participants. Specifically, as amended, the Participants' annual written assessment must also include: (1) An evaluation of the information security program of the CAT to ensure that the program is consistent with the highest industry standards for protection of data; \1822\ (2) an evaluation of potential technological upgrades based upon a review of technological developments over the preceding year, drawing on necessary technological expertise, whether internal or external; \1823\ (3) an assessment of efforts to reduce the time to restore and recover CAT Data at a back-up site; \1824\ (4) an assessment of how the Plan Processor and SROs are monitoring Error Rates and addresses the application of Error Rates based on product, data element or other criteria; \1825\ (5) a copy of the evaluation required by Section 6.8(c) of the Plan as to whether industry standards have evolved such that: (i) The clock synchronization standard in Section 6.8(a) should be shortened; or (ii) the required timestamp in Section 6.8(b) should be in finer increments; and (6) an assessment of whether any data elements should be added, deleted or changed.\1826\ The Commission believes that requiring these specific issues to be addressed in the Participants' annual assessment will focus the Plan Processor and Participants on critical technological and other developments, and should help ensure that CAT technology is up-to-date, resilient and secure, and provides accurate CAT Data.

      ---------------------------------------------------------------------------

      \1822\ See Section IV.D.6.a, supra.

      \1823\ See Section IV.D.14, supra.

      \1824\ See Section IV.D.12, supra.

      \1825\ See Section IV.D.11, supra.

      \1826\ See Section IV.D.13, supra.

      ---------------------------------------------------------------------------

      Section 6.6 of the Plan as filed also requires the Participants to provide an estimate of the costs associated with any potential improvements to the performance of the CAT, including an assessment of the potential impact on competition, efficiency and capital formation. The Commission believes, however, that it is important that the Participants consider not just the costs but also the potential benefits associated with any improvements to the performance of the CAT, including the impact on investor protection. Accordingly, the Commission is also amending Section 6.6 of the Plan to

      Page 84799

      require the annual assessment to consider the benefits of potential improvements to the CAT, including to investor protection.

      The Commission is further amending Section 6.6 of the Plan to require that the Participants provide the Commission with certain written reports on a one-time basis. First, the Participants must provide the Commission, and make public, at least one month prior to submitting any rule filing to establish initial fees for CAT Reporters, an independent audit of the fees, costs, and expenses incurred by the Participants on behalf of the Company prior to the Effective Date of the Plan.\1827\ The Commission notes that any such filing will be published for public notice and comment. As the Commission understands that the Participants intend to recover through CAT fees the amounts spent on the development of the CAT to date, to facilitate public comment and Commission review of such fee filings,\1828\ the Commission believes it is appropriate for the Participants to obtain an audit of the fees, costs and expenses incurred by the Participants on behalf of the Company prior to the Effective Date.

      ---------------------------------------------------------------------------

      \1827\ See Section III.6., supra.

      \1828\ See supra note 1709.

      ---------------------------------------------------------------------------

      Second, the Commission is amending the Plan to require the Participants to provide the Commission with a written assessment of the clock synchronization standards in the Plan \1829\ within six months of effectiveness of the Plan. As noted above, the Commission believes that the Participants should consider the type of CAT Reporter, the type of Industry Member, and type of system when determining industry standards, and is amending the Plan to clarify this more granular approach. The Commission believes the Participants should consider the Plan's clock synchronization standards in light of this clarification promptly, and propose any appropriate amendments, and that a six-month timeframe to do so is reasonable.

      ---------------------------------------------------------------------------

      \1829\ See Section IV.D.13, supra.

      ---------------------------------------------------------------------------

      Third, the Commission is amending the Plan to require the Participants to provide the Commission with a written report that discusses the Participants' assessment of implementing coordinated surveillance, whether through 17d-2 agreements, RSAs, or some other approach, within 12 months of effectiveness of the Plan.\1830\ The Commission notes that the CAT is designed to facilitate the ability of regulators to conduct cross-market surveillances and to review conduct that occurs across the market. As a result, the Commission believes that it may be efficient for the Participants to coordinate to conduct cross-market surveillances.

      ---------------------------------------------------------------------------

      \1830\ See Section IV.B.4., supra. This assessment can be provided in conjunction with an annual written assessment required by Rule 6.6 of the Plan.

      ---------------------------------------------------------------------------

      Fourth, the Commission is amending the Plan to require the Participants to submit to the Commission a written report, within 24 months of effectiveness of the Plan, discussing the feasibility, benefits, and risks of allowing an Industry Member to bulk download the Raw Data that it has submitted to the Central Repository.\1831\ Commenters expressed a desire to have bulk access to their own data for surveillance and internal compliance purposes, as well as to facilitate the error correction process. While, the Participants did not permit such access in the Plan, citing security and cost concerns, they did represent that they would consider allowing bulk access to the audit trail data reported by Industry Members once CAT is operational. The Commission believes it is important to consider the potential efficiencies of allowing Industry Members bulk access to their own CAT data, so long as such access does not impact the security of the CAT Data, and accordingly believes that requiring a report discussing this issue by the date Industry Members first begin reporting to the CAT, is appropriate.

      ---------------------------------------------------------------------------

      \1831\ See Section IV.D.6.m, supra. This report may be provided in conjunction with an annual written assessment required by Rule 6.6 of the Plan.

      ---------------------------------------------------------------------------

      Fifth, the Commission is amending the Plan to require the Participants to provide the Commission with a written assessment, within 36 months of effectiveness of the Plan, of the nature and extent of errors in the Customer information submitted to the Central Repository and whether the correction of certain data fields over others should be prioritized.\1832\ The Commission believes that requiring such an assessment, which will coincide with the date all Industry Members are reporting to the CAT, could help ensure that the accuracy of CAT Data is achieved in the most prompt and efficient manner.

      ---------------------------------------------------------------------------

      \1832\ See Section IV.D.4.a, supra. This assessment may be provided in conjunction with an annual written assessment required by Rule 6.6 of the Plan.

      ---------------------------------------------------------------------------

      Sixth, the Commission is amending the Plan to require the Participants to provide the Commission with a written report, 36 months after effectiveness of the Plan, on the impact of tiered fees on market liquidity, including an analysis of the impact of the tiered-fee structure on Industry Members' provision of liquidity.\1833\ One commenter expressed concern that use of a tiered fee structure could discourage displayed quotes and, in response, the Participants explained that one of the reasons they chose to use a tiered-fee funding model was to limit disincentives to provide liquidity. To help determine whether the Plan's funding model actually achieves the Participants' stated objective, the Commission believes it appropriate to require them to prepare such an assessment of the impact of tiered fees once the CAT becomes fully operational.

      ---------------------------------------------------------------------------

      \1833\ See Section IV.F.3., supra.

      ---------------------------------------------------------------------------

      Finally, the Commission is amending the Plan to require the Participants to provide the Commission a written assessment of the projected impact of any Material Systems Change on the Maximum Error Rate, prior to the implementation of any Material Systems Change.\1834\ The Commission believes that Material Systems Changes either could result in new challenges for CAT Reporters or simplify the means for reporting data. In either case, the appropriateness of the Maximum Error Rate could be impacted, and thus warrant a change. Accordingly, the Commission believes it appropriate to require the Participants to provide the Commission an assessment of the projected impact on the Maximum Error Rate, including any recommended changes thereto, prior to the implementation of any Material Systems Change.

      ---------------------------------------------------------------------------

      \1834\ See Section IV.D.11.b., supra.

      ---------------------------------------------------------------------------

  13. Economic Analysis

    1. Introduction

      The Commission is sensitive to the economic effects of the CAT NMS Plan,\1835\ including its costs and benefits and its impact on efficiency, competition and capital formation. In accordance with the approach articulated by the Commission in the Adopting Release, the Commission published its preliminary economic analysis of the CAT NMS Plan in the Notice, and solicited comment on its analysis and on all aspects of the proposed Plan. The Commission has considered the comments received, along with the Participants' responses, and has modified certain aspects of the Plan, as discussed above.

      ---------------------------------------------------------------------------

      \1835\ See CAT NMS Plan, supra note 5.

      ---------------------------------------------------------------------------

      This Section reflects the Commission's analysis and conclusions regarding the economic effects of the creation, implementation and maintenance of the CAT pursuant to the details in the CAT NMS Plan, as amended and hereby approved by the

      Page 84800

      Commission. The analysis is divided into seven topics: (1) A summary of the expected economic effects of approving the CAT NMS Plan; (2) a description of the economic framework for analyzing the economic effects of approving the CAT NMS Plan; (3) a discussion of the current, or ``Baseline,'' audit trail data available to regulators, and the sources of such data; (4) a discussion of the potential benefits of approving the CAT NMS Plan; (5) a discussion of the potential costs of approving the CAT NMS Plan; (6) a discussion of the CAT NMS Plan's potential impact on efficiency, competition, and capital formation; and (7) a discussion of alternatives to various features of the CAT NMS Plan and to the CAT NMS Plan itself.

    2. Summary of Expected Economic Effects

      The Commission has analyzed the expected economic effects of the CAT NMS Plan in light of the existing shortcomings in the regulatory data infrastructure and the goal of improving the ability of SROs and the Commission to perform their regulatory activities to the benefit of investors and the markets.\1836\ In general, the Commission believes that the CAT NMS Plan will result in benefits by improving the quality of the data available to regulators in four areas that affect the ultimate effectiveness of core regulatory efforts--completeness, accuracy, accessibility and timeliness.\1837\ The Commission believes that the improvements in these data qualities that will be realized from approval of the CAT NMS Plan will substantially improve regulators' ability to perform analysis and reconstruction of market events, market analysis and research to inform policy decisions, and other regulatory activities including market surveillance, examinations, investigations, and other enforcement functions. Regulators depend on data for many of these activities and the improvements in the data qualities will thus improve the efficiency and effectiveness of such regulatory activities. As explained further below, these improvements could benefit investors by giving regulators more and better regulatory tools to provide investors with a more effectively regulated trading environment,\1838\ which could increase capital formation, liquidity, and price efficiency. Data improvements could enhance regulators' ability to provide investors and the public with more timely and accurate analysis and reconstruction of market events, and to develop more effective responses to such events. Improved understanding of emerging market issues resulting from enhanced market analysis and research could inform regulatory policies that improve investor protection through better market quality, more transparency, and more efficient prices. Improvements in quality and quantity of order events could lead to improvements in developing and targeting policy approaches to ensure a fair and orderly market.

      ---------------------------------------------------------------------------

      \1836\ The Commission noted current SRO audit trail limitations in the Proposing Release and the Adopting Release. See Proposing Release, supra note 14, at 32563-68; Adopting Release, supra note 14, at 45726-30. Rule 613 is designed to address these limitations.

      \1837\ See Adopting Release, supra note 14, at 45727 (discussing four ``qualities'' of trade and order data that impact the effectiveness of core SRO and Commission regulatory efforts: Accuracy, completeness, accessibility, and timeliness); see also Section V.E. infra, for a detailed discussion of the expected benefits of the CAT NMS Plan.

      \1838\ See Section V.E.2, infra.

      ---------------------------------------------------------------------------

      In terms of completeness, the Plan requires the reporting of certain additional data fields, events, and products.\1839\ More importantly, the CAT NMS Plan requires data elements useful for regulatory analysis to be available from a single data source. Having relevant data elements available from a single source will simplify and expedite regulators' data collection process and facilitate more efficient analyses and surveillances that incorporate cross-market and cross-product data.

      ---------------------------------------------------------------------------

      \1839\ See CAT NMS Plan, supra note 5, at Sections 6.3, 6.4; see also 17 CFR 242.613(c)(7).

      ---------------------------------------------------------------------------

      With respect to the accuracy of available data, the Commission believes that the requirements in the Plan will improve data accuracy significantly. For example, the Commission expects that the requirements to store the CAT Data in a uniform linked format and the use of consistent identifiers for customers and market participants will result in fewer inaccuracies as compared to current data sources. These accuracy improvements should significantly reduce the time regulators spend processing the data and finding solutions when faced with inaccurate data. The Commission believes that the requirements in the Plan for clock synchronization and timestamp granularity will improve the accuracy of data with respect to the timing of market events. The Commission believes that the Plan will improve regulators' ability to determine the sequence of some market events relative to all surrounding events.\1840\

      ---------------------------------------------------------------------------

      \1840\ The CAT NMS Plan requires that CAT Reporters who are Industry Members synchronize their business clocks to within 50 milliseconds of the time maintained by the NIST, which will increase the precision of the timestamps provided by the 39% of broker-

      dealers who currently synchronize their clocks with less precision than what is called for by the Plan. See FIF Clock Offset Survey, supra note 247. Further, the Commission has amended the Plan to require exchanges to synchronize their business clocks to within 100 microseconds. While this is similar to current practice, this requirement should still provide the greater ability for regulators to sequence unrelated events in a market reconstruction by anchoring lifecycles to events at exchanges. Independent of the potential time clock synchronization benefits, the order linking data that will be captured in CAT should increase the proportion of events that could be sequenced accurately. This reflects the fact that some records pertaining to the same order could be sequenced by their placement in an order lifecycle (e.g., an order submission must have occurred before its execution) without relying on timestamps. This information may also be used to partially sequence surrounding events, particularly with the Plan modifications.

      ---------------------------------------------------------------------------

      The Commission also believes that the Plan will increase the accessibility of data for SROs and the Commission, because regulators will be able to access the CAT Data directly.\1841\ This, coupled with the improvements in completeness, will vastly increase the scope of information readily available to regulators and significantly reduce the number of data requests from the several hundred thousand requests regulators make each year. The increased scope of readily available information should facilitate more data-driven regulatory policy decisions, broaden the potential surveillances, expand the opportunities for SRO and Commission analysis to help target broker-

      dealers and investment advisers for examinations and help to perform those examinations.

      ---------------------------------------------------------------------------

      \1841\ See CAT NMS Plan, supra note 5, at Appendix C, Section A.2, Appendix D, Section 8.1; see also 17 CFR 242.613(e)(2).

      ---------------------------------------------------------------------------

      Finally, the Commission believes that the CAT NMS Plan will improve the timeliness of available data. Because regulators will be able to access uncorrected data the day after an order event and will be able to access corrected and linked data five days after an order event,\1842\ many data elements will be available to regulators more quickly than they are currently. Accordingly, the amount of time regulators would need to acquire and process data before running analyses would be reduced. For example, the corrected and linked data available on T+5 will identify the customer account

      Page 84801

      associated with all order events, information that currently takes ten days or longer for regulators to obtain and then need to link to other data sources for use. These improvements in timeliness, combined with improvements in completeness, accessibility, and accuracy discussed above, will improve the efficiency of regulatory analysis and reconstruction of market events, as well as market analysis and research that informs policy decisions, and make market surveillance, examinations, investigations, and other enforcement functions more efficient, allowing, for example, the SROs and the Commission to review tips and complaints more effectively.

      ---------------------------------------------------------------------------

      \1842\ CAT Data will be reported by 8:00 a.m. ET on T+1 and made available to regulators in raw form after it is received and passes basic formatting validations with an error correction process completed by 8:00 a.m. ET on T+5. While the Plan does not specify exactly when these validations would be complete, the requirement to link records by 12:00 p.m. ET on T+1 gives a practical upper bound on this timeline. See CAT NMS Plan, supra note 5, at Appendix C, Sections A.2(a), A.3(a), Appendix D, Section 6.2.

      ---------------------------------------------------------------------------

      The Commission notes that the Plan lacks information regarding the details of certain elements of the Plan likely to affect the costs and benefits associated with it, primarily because those details have not yet been determined, and this lack of information creates some uncertainty about the expected economic effects. As discussed further below, lack of specificity surrounding the processes for converting data formats and linking related order events creates uncertainty as to the anticipated improvements in accuracy because such processes have the potential to create new data inaccuracies. Lack of specificity surrounding the process for regulators to access the CAT Data also creates uncertainty around the expected improvements in accessibility. For example, while the Plan indicates that regulators would have an online targeted query tool and a tool for user-defined direct queries or bulk extraction,\1843\ the Plan itself does not provide an indication for how user-friendly the tools would be or the particular skill set needed to use the tools for user-defined direct queries. However, the Commission has analyzed the expected economic effects of the Plan to the extent possible with the information available, noting areas of uncertainty in its analysis where applicable. The Commission has also considered whether certain provisions related to the operation and administration of the Plan could mitigate some of the uncertainties.\1844\

      ---------------------------------------------------------------------------

      \1843\ Id. at Appendix D, Sections 8.1.1, 8.1.2.

      \1844\ See Section V.E.3.d, infra.

      ---------------------------------------------------------------------------

      The Commission also believes that more effective and efficient regulation of securities markets and market participants resulting from implementation of the CAT NMS Plan could significantly benefit investors and the integrity of the market. For example, the Commission believes that more effective and efficient surveillance and enforcement should detect a higher proportion of violative market activity. This additional detection could not only reduce violative behavior through potential enforcement actions, but through deterrence if market participants believe violative activities are more likely to be detected. Because violative activity degrades market quality and imposes costs on investors and market participants, reductions in violative activity would benefit investors and market integrity. Likewise, more effective and efficient risk assessment and risk-based examinations should facilitate the selection of market participants for examination who have characteristics that elevate their risk of violating the rules. Decreasing the amount of violative activity by targeting exams in this way should provide investors with a more effectively regulated trading environment and hence better market quality. Further, access to audit trail data that is comprehensive, accurate, and timely should improve regulatory reconstruction of market events, market analysis, and research, resulting in an improved understanding of emerging market issues and regulatory policies that better encourage industry competition, thus improving investor protection through better transparency and more efficient prices.\1845\ Regulatory initiatives that are based on a more thorough understanding of underlying events and their causes, and that are narrowly tailored to address any market deficiency, should improve market quality and benefit investors. Access to more complete and linked audit trail data will improve regulators' ability to analyze and reconstruct market events, allowing regulators to provide investors and the public with more accurate explanations of market events, to develop more effective responses to such events, and to use the information to assist in retrospective analyses of their rules and pilots.

      ---------------------------------------------------------------------------

      \1845\ See Section V.E.2, infra.

      ---------------------------------------------------------------------------

      The Commission has also evaluated the potential costs that will result from the approval of the CAT NMS Plan. The Commission's cost analysis is based on the preliminary analysis in the Notice, which analyzed information included in the Plan, information gathered from market participants through discussions, surveys of market participants, and other relevant information to estimate the potential costs associated with building and maintaining the Central Repository as well as the costs to report data to the Central Repository. The Commission has considered the comments received on its preliminary analysis, the Participants' response to the comments, and the impact of the Commission's modifications to the Plan and has revised its analysis and estimates accordingly.\1846\ Currently, the 21 Participants spend $170.3 million annually on reporting regulatory data and performing surveillance, while the approximately 1,800 broker-dealers anticipated to have CAT reporting responsibilities spend $1.6 billion annually on regulatory data reporting, for total current industry costs of $1.7 billion annually for regulatory data reporting and surveillance by SROs. Having considered the comments, the Participants' response and the Commission's modifications to the Plan, the Commission now estimates the cost of the Plan as approximately $2.4 billion in initial aggregate implementation costs and recurring annual costs of $1.7 billion.\1847\ Furthermore, the Commission acknowledges that during the period of duplicative reporting, during which CAT Reporters will report to both current regulatory data reporting systems and CAT, industry will face duplicative reporting costs that the Commission estimates at $1.7 billion per year, the cost of industry's current data reporting.

      ---------------------------------------------------------------------------

      \1846\ See Section V.F.1 and Section V.F.2, infra for discussion of comments received on cost estimates, and revisions the Commission made to those estimates in response.

      \1847\ See Section V.F.2, infra.

      ---------------------------------------------------------------------------

      Commenters had numerous comments on individual estimates of costs, particularly as they related to requirements to report allocation timestamps in milliseconds, the costs of duplicative reporting, and generally about the uncertainty surrounding cost estimates. The primary driver of the annual costs is the data reporting cost for broker-

      dealers, which is estimated to be $1.5 billion per year. For both large and small broker-dealers, the primary driver of both the current $1.6 billion reporting costs and projected $1.5 billion CAT reporting costs is costs associated with staffing. Bidder estimates of the costs to build the Central Repository vary from $37.5 million to $65 million and annual operating costs range from $36.5 to $55 million. The eventual magnitude of Central Repository costs depends on the Participants' selection of the Plan Processor, and may ultimately differ from estimates discussed above if Bids are revised as the bidding process progresses. Furthermore, the Plan anticipates a period of duplicative reporting responsibilities preceding the

      Page 84802

      retirement of potentially duplicative regulatory data reporting systems; these duplicative reporting costs are likely to be significant.\1848\

      ---------------------------------------------------------------------------

      \1848\ The economic analysis discusses duplicative reporting costs in Section V.F.2, infra.

      ---------------------------------------------------------------------------

      Drawing from the discussion in the CAT NMS Plan, the comments received, and the Participants' response to the comments,\1849\ the Commission expects that the Plan will have a number of additional economic effects, including effects on efficiency, competition, and capital formation. The Commission believes that the Plan generally promotes competition. However, the Commission recognizes that the Plan could increase barriers to entry because of the costs to comply with the Plan. Further, the Commission's analysis identifies several limiting factors to competition; however, Plan provisions and Commission oversight could mitigate such limiting factors. The Commission believes that the Plan will result in significant improvements in efficiency related to how regulatory data is collected and used. Specifically, the approval of the Plan will result in improved data becoming available to regulators, which will increase the efficiency of regulatory activities such as market surveillance, examinations, investigations, and other enforcement functions that could enhance market efficiency by reducing violative activity that harms market efficiency. In addition, the availability of this data should improve regulatory analysis and reconstruction of market events, as well as market analysis and research that informs policy decisions. Finally, the Commission believes that the Plan could have positive effects on capital formation and allocative efficiency and that the threat of a security breach at the Central Repository is unlikely to significantly harm capital formation. The Commission recognizes that the Plan's likely effects on competition, efficiency and capital formation are dependent to some extent on the performance and decisions of the Plan Processor and the Operating Committee in implementing the Plan, and thus there is necessarily some uncertainty in the Commission's analysis. Nonetheless, the Commission believes that the Plan contains certain governance provisions, as well as provisions relating to the selection and removal of the Plan Processor, that mitigate this uncertainty by promoting decision-making that could, on balance, have positive effects on competition, efficiency, and capital formation.

      ---------------------------------------------------------------------------

      \1849\ See CAT NMS Plan, supra note 5, at Appendix C, Section B.8; see also Section V.G, infra.

      ---------------------------------------------------------------------------

      As part of its economic analysis, the Commission has also considered the likely economic effects of a number of alternatives to the approaches taken in the CAT NMS Plan. The Commission has analyzed certain alternatives that could have a direct and significant impact on costs or benefits deriving from at least one of the four data qualities discussed above: Accuracy, completeness, accessibility, and timeliness. This analysis includes alternatives proposed by commenters.

    3. Framework for Economic Analysis

      As discussed above, the Commission has conducted an economic analysis of the CAT NMS Plan, including the modifications made by the Commission, as anticipated in the Adopting Release for Rule 613.\1850\ In particular, the Commission has carefully evaluated the information in the CAT NMS Plan, including the twelve considerations required by Rule 613 \1851\ and the details of the decisions left to the discretion of the SROs. The Commission has also considered information drawn from outside the Plan, but that was included in its preliminary economic analysis in the Notice and subject to public comment,\1852\ in order to assess potential economic effects not addressed therein. Finally, the Commission considered comments submitted in response to its Notice. To provide context for this analysis, this Section describes the economic framework for the analysis and seeks to identify uncertainties within that framework.

      ---------------------------------------------------------------------------

      \1850\ See Adopting Release, supra note 14, at 45789.

      \1851\ 17 CFR 242.613(a)(1).

      \1852\ See Notice, supra note 5, at 30651-30797.

      ---------------------------------------------------------------------------

      The framework for the Commission's final economic analysis is largely the same as the framework set out in the economic analysis of the Notice,\1853\ though the Commission has revised its discussion of uncertainty to recognize comments.\1854\ This Section includes a high-

      level summary of those comments, which are addressed in the economic analysis to follow.

      ---------------------------------------------------------------------------

      \1853\ Id. at 30654-30656.

      \1854\ See Data Boiler Letter at 9, 30; SIFMA Letter at 6, 13, 15-16, 23-24,32, 39, 40, 42, 44-45; FSR Letter at 9-10; Fidelity Letter at 6; TR Letter at 4; FSI Letter at 5-6; DAG Letter at 5; UnaVista Letter at 2.

      ---------------------------------------------------------------------------

      1. Economic Framework

      1. Benefits

      The CAT NMS Plan will create a new data source that should modernize and eventually replace the use of some disparate current data sources for many regulatory activities. As such, the economic benefits of the CAT NMS Plan will come from any expanded and more efficient regulatory activities facilitated by improvements to the data regulators use. Therefore, the framework for examining benefits in this economic analysis involves first considering whether and to what degree the CAT Data will improve on the Baseline of current trading and order data in terms of the four qualities of accuracy, completeness, accessibility, and timeliness.\1855\

      ---------------------------------------------------------------------------

      \1855\ See Adopting Release, supra note 14, at 45727.

      ---------------------------------------------------------------------------

      Through these improvements in the data, the economic analysis then considers the degree to which the Plan will result in improvements to regulatory activities such as the analysis and reconstruction of market events, in addition to market analysis and research conducted by SROs and Commission Staff, as well as market surveillance, examinations, investigations, and other enforcement functions. These potential improvements, based on the regulatory objectives of the CAT NMS Plan described in the Adopting Release,\1856\ relate to the overall goal of substantially enhancing the ability of the SROs and the Commission to oversee securities markets and fulfill their regulatory responsibilities under the securities laws. The economic framework explores how the improvements to these regulatory activities provide economic benefits to investors and the market. Among other things, potential benefits that could result from the CAT NMS Plan include benefits rooted in changes in the behavior of market participants. For example, requirements to report certain data elements or events to the CAT could have the beneficial effect of detecting and deterring rule violations because the inclusion of certain data fields and improvements in the ability to surveil for violations could increase the perceived costs of violating rules and regulations. Potential benefits could also stem from improved investor protection, such as from more effective surveillance and more informed, data-driven rulemaking. In addition, potential benefits could stem from future reduced costs due to more targeted, data-driven policy choices.

      ---------------------------------------------------------------------------

      \1856\ Id. at 45730.

      ---------------------------------------------------------------------------

      (1) Data Qualities

      In assessing the potential benefits of the CAT NMS Plan, the Commission's economic analysis compares the data that will be available under the Plan to the trading and order data currently

      Page 84803

      available to regulators to determine whether and to what degree the Plan will improve the available data with respect to the four qualities of accuracy, completeness, accessibility, and timeliness.\1857\

      ---------------------------------------------------------------------------

      \1857\ Id. at 45727. Accuracy refers to whether the data about a particular order or trade is correct and reliable. Completeness refers to whether a data source represents all market activity of interest to regulators, and whether the data is sufficiently detailed to provide the information regulators require. While current data sources provide the trade and order data required by existing rules and regulations, those sources generally do not provide all of the information of interest to regulators in one consolidated audit trail. Accessibility refers to how the data is stored, how practical it is to assemble, aggregate, and process the data, and whether all appropriate regulators could acquire the data they need. Timeliness refers to when the data is available to regulators and how long it would take to process before it could be used for regulatory analysis. As explained in the Baseline, Section V.D.2, infra, the trading and order data currently available to regulators suffers from deficiencies in all four dimensions.

      ---------------------------------------------------------------------------

      (2) Regulatory Activities

      Any economic benefits will derive from how such improved data will affect regulatory activities. Therefore, to analyze the potential benefits of the CAT NMS Plan, the economic analysis also evaluates the potential of the CAT NMS Plan to meet the regulatory objectives set out in the Adopting Release for Rule 613. The objectives are: Improvements in the analysis and reconstruction of broad-based market events; improvements in market analysis in support of regulatory decisions; and improvements in market surveillance, investigations, and other enforcement activities.\1858\

      ---------------------------------------------------------------------------

      \1858\ See Adopting Release, supra note 14, at 45730.

      ---------------------------------------------------------------------------

    4. Analysis and Reconstruction of Broad-Based Market Events

      The economic analysis considers whether and to what extent the CAT NMS Plan will facilitate regulators' performance of analysis and reconstruction of market events, potentially helping to better inform both regulators and investors about such market events and speeding the regulatory response following market events. Regulators perform reconstructions of market events so that they and the public can be informed by an accurate accounting of what happened (and, possibly, why it happened). As discussed in the Benefits Section,\1859\ market reconstructions currently can take a significant amount of time, in large measure due to various deficiencies in the currently available trading and order data.\1860\ The sooner regulators complete a reconstruction and analysis of a market event, the sooner investors can be informed and the sooner regulators can begin reviewing the event to determine what happened, who was affected and how, and whether the analysis supports potential regulatory responses.\1861\ In addition, the improved ability for regulators to generate prompt and complete market reconstructions could provide improved market knowledge, which could assist regulators in conducting retrospective analysis of their rules and pilots.

      ---------------------------------------------------------------------------

      \1859\ See Section V.E.2.a, infra.

      \1860\ See Section V.D.2.b, infra.

      \1861\ See Adopting Release, supra note 14, at 45732.

      ---------------------------------------------------------------------------

    5. Market Analysis in Support of Regulatory Decisions

      The economic analysis considers whether and to what extent the CAT NMS Plan will enhance the ability of the SROs and the Commission to conduct market analysis and research, including analysis of market structure, and the degree to which it will improve regulators' market knowledge and facilitate consideration of policy questions of interest. The SROs and Commission Staff conduct data-driven analysis on market structure, in direct support of both rulemaking and other regulatory decisions such as SRO rule approvals. The Commission also relies on such analysis to improve understanding of market structure in ways that could inform policy. Finally, SROs conduct market analysis and research on their own regulatory initiatives. Improvements in the ability to conduct market analysis could further improve analysis related to regulatory decisions and potentially influence those regulatory decisions to the benefit of investors and the markets more generally.

    6. Market Surveillance and Investigations

      The economic analysis examines whether the CAT NMS Plan will improve market surveillance and investigations, potentially resulting in more effective oversight of trading, better investor protection, and deterrence of violative behavior. As described in more detail in the Baseline Section,\1862\ both SROs and the Commission conduct market surveillance, examinations, investigations, and other enforcement functions targeting illegal activities such as insider trading, wash sales, or manipulative practices. Improvements in market surveillance and investigations could come in the form of ``facilitating risk-based examinations, allowing more accurate and faster surveillance for manipulation, improving the process for evaluating tips, complaints, and referrals . . . , and promoting innovation in cross-market and principal order surveillance.'' \1863\

      ---------------------------------------------------------------------------

      \1862\ See Section V.D.1.c.(1) and Section V.D.1.c.(3), infra.

      \1863\ See Adopting Release, supra note 14, at 45730.

      ---------------------------------------------------------------------------

      1. Costs

      The economic analysis evaluates the costs of building and operating the Central Repository; the costs of CAT reporting for Participants, broker-dealers, and service bureaus; and other CAT-related costs. Where the CAT NMS Plan provides estimates of these costs, the economic analysis evaluates those estimates and re-estimates them when necessary. The economic analysis also discusses the drivers of these costs, and whether broker-dealers may or may not pass these costs down to their customers. As a part of its consideration of the costs of the CAT NMS Plan, the economic analysis considers costs from duplicative reporting for some period of time as well as potential cost savings from the retirement of duplicative regulatory reporting systems.\1864\

      ---------------------------------------------------------------------------

      \1864\ Rule 613 requires the Plan to discuss ``a plan to eliminate existing rules and systems (or components thereof) that would be rendered duplicative by the consolidated audit trail.'' 17 CFR 242.613(a)(1)(ix); see also CAT NMS Plan, supra note 5, at Appendix C Section C.9.

      ---------------------------------------------------------------------------

      The economic analysis also considers whether the CAT NMS Plan could result in second order effects, such as changes to the behavior of market participants, that impose certain costs. For example, the CAT NMS Plan's tiered funding model could lead to efforts by market participants to try to control their tiers in order to affect their fee payments, such as reducing activity levels near the end of an activity level measuring period to avoid being classified as a higher activity level firm. In addition, Participants, their members, and investors could incur costs if their private information were accessed in the event of a security breach of the Central Repository. The economic analysis considers these and other elements of the Plan that could lead to distortions in behavior by market participants.

      2. Existing Uncertainties

      In the Notice, the Commission described how it analyzed the information in the CAT NMS Plan, as well as other relevant data,\1865\ in order

      Page 84804

      to assess the economic effects of the Plan. As discussed throughout the analysis in the Notice, in certain cases the Commission lacked information needed to evaluate all of the potential economic effects of the CAT NMS Plan, creating uncertainty in some potential benefits and costs. The primary drivers of uncertainty included the fee schedule applicable to funding the Central Repository (the ``Funding Model''), which has not yet been finalized, the deferral of decisions on certain discretionary elements including the Technical Specifications applicable to the CAT, and a lack of detailed information that would enable the Commission to assess certain economic effects with greater precision.\1866\ The Notice discussed implications of each primary area of uncertainty.\1867\

      ---------------------------------------------------------------------------

      \1865\ In addition to the CAT NMS Plan, the economic analysis in the Notice analyzed, for example, the Exemptive Relief Letter (see supra note 21), a survey of clock synchronization practices and costs (see supra note 247), discussions with members of the industry and service bureaus (see Section V.F.1.c and Section V.F.1.d, infra), data from FINRA (see Section V.F.1.c.(2).B., infra), and academic literature. See Notice, supra note 5, at 30655-56.

      \1866\ As discussed below, the Commission notes that many of the uncertainties that existed at the time of the Notice will continue upon approval of the Plan. For example, the Funding Model and Technical Specifications will be determined after a Plan Processor is selected.

      \1867\ See Notice, supra note 5, at 30655-56.

      ---------------------------------------------------------------------------

      First, the economic analysis in the Notice evaluated information provided in the CAT NMS Plan on the economic effects of the Plan, as well as information drawn from outside of the Plan. However, the Commission lacked detailed information regarding some of the individual costs and discretionary decisions in the Plan, including the Funding Model. Specifically, the Plan does not outline the proportion of CAT costs that will be allocated to Participants versus broker-dealers. This uncertainty limited the Commission's ability to evaluate the economic effects of the Plan in some cases. However, the Commission analyzed the expected economic effects of the Plan to the extent possible with the information available, and where the Commission identified such areas of uncertainty, the economic analysis addressed this uncertainty.

      Second, the Commission pointed out that certain elements of the CAT NMS Plan will not be finalized until after the selection of a ``Plan Processor.'' \1868\ Among these are the security and confidentiality procedures of the Central Repository,\1869\ the precise methods by which regulators will access data in the Central Repository,\1870\ and the complete Technical Specifications.\1871\ The Plan also provides the Plan Processor the ``sole discretion'' to publish interpretations of the Technical Specifications, including interpretations of permitted values in data elements.\1872\

      ---------------------------------------------------------------------------

      \1868\ See CAT NMS Plan, supra note 5, at Article VI. The Plan Participants have engaged in a bidding process to select a Plan Processor, and the leading candidate bidders have proposed different solutions. In certain instances, the Plan Participants have decided to adopt the solutions proposed by whichever bidder they select.

      \1869\ See Section V.F.4.b, infra, for additional discussion of risks and uncertainties related to data security.

      \1870\ Rule 613(e)(1) requires the CAT NMS Plan to create a Central Repository to collect, link, and store CAT Data and to make that data available to regulators. See 17 CFR 242.613(e)(1).

      \1871\ The CAT NMS Plan contains minimum standards and principles for setting many of Technical Specifications, see CAT NMS Plan, supra note 5, at Section 6.9, and the Commission's economic analysis reflects those minimum standards and principles. However, because the detailed Technical Specifications are not yet finalized by the Participants, the Commission cannot fully assess any corresponding costs and benefits.

      \1872\ Id. at Section 6.9.

      ---------------------------------------------------------------------------

      Because these and other elements of the Plan had not yet been finalized, the Commission could not assess how and to what extent the elements could affect the overall economic effects of the Plan. The Commission's economic analysis was therefore limited to the extent that the economic effects of the Plan depend on decisions that will be made after approval of the Plan. However, the Commission identified these areas of uncertainty and assessed the economic effects of the Plan to the best of its ability in light of these existing uncertainties.

      Given the range of possible outcomes with respect to both the costs and benefits of the CAT NMS Plan that depend on future decisions, the Commission also recognized in the Notice the importance of provisions of the Plan related to the operation and administration of the CAT. In particular, the Commission stated that governance provisions of the Plan related to voting by the Operating Committee and the involvement of the Advisory Committee may help promote better decision-making by the relevant parties. Such provisions could mitigate concerns about potential uncertainty in the economic effects of the Plan by giving the Commission greater confidence that its expected benefits would be achieved in an efficient manner and that costs resulting from inefficiencies will be avoided. Nevertheless, commenters rightly observed that uncertainties remain, and will continue to remain until selection of the Plan Processor, the publication of Technical Specifications, and/or the implementation of CAT reporting.\1873\

      ---------------------------------------------------------------------------

      \1873\ Many commenters identified uncertainties related to the economic effects of the Plan that were consistent with those mentioned in the Notice. See SIFMA Letter at 6, 13, 15-16, 23, 32, 39, 40, 42, 44, 45; FIF Letter at 36, 50, 84-85, 86-90; FSI Letter at 5-6; FSR Letter at 9-10; DAG Letter at 5; UnaVista Letter at 2; TR Letter at 4; Fidelity Letter at 6; Data Boiler Letter at 9, 26, 30. Commenters also discussed several implications of the uncertainty in the Plan that were consistent with the Commission's statement in the Notice that it cannot assess how and to what extent these elements of the Plan could affect the overall economic effects of the Plan. See FSR Letter at 9; FSI Letter at 5-6; TR at 4. Others highlighted implications for the Commission to consider. See, e.g., Fidelity Letter at 6; SIFMA Letter at 23-24, 44.

      ---------------------------------------------------------------------------

      The Commission has considered the comments it received relevant to the potential uncertainties in its analysis of the economic effects of the CAT NMS Plan, the Participants' response, and the effect of Plan modifications on such uncertainties and has revised its economic analysis accordingly. Throughout this economic analysis, the Commission recognizes these uncertainties, including the ones raised by commenters. In particular, the economic analysis described below recognizes uncertainties as they relate to the baseline, benefits, and costs and as they relate to the analysis of alternatives, efficiency, competition, and capital formation. In some cases, the Plan modifications and the Participants' response letters reduce the uncertainty in the Commission's analysis. However, the Commission continues to believe that governance provisions of the Plan could mitigate concerns about many of the sources of potential uncertainty in the economic effects of the Plan.\1874\

      ---------------------------------------------------------------------------

      \1874\ For a full discussion of the governance provisions and how they may mitigate concerns about many of the sources of potential uncertainty in the economic effects of the Plan, see Section V.E.3.d, infra.

      ---------------------------------------------------------------------------

    7. Baseline

      To assess the overall economic impact of the CAT NMS Plan, the economic analysis in the Notice used as the Baseline the current state of regulatory activity and the current state of trade and order data.\1875\ The Baseline discussed the currently available sources of data, limitations in available data that could impact regulatory activity, how regulators currently use the available data, and the burden that producing that data imposes on SROs and broker-dealers. As discussed in more detail below, the Commission has revised certain aspects of its Baseline to incorporate new information from commenters, but the Baseline remains

      Page 84805

      largely the same as that described in the Notice.

      ---------------------------------------------------------------------------

      \1875\ See Notice, supra note 5, at 30656-59.

      ---------------------------------------------------------------------------

      1. Current State of Regulatory Activities

      As addressed in detail in the Notice, SROs and the Commission use data to analyze and reconstruct market events, conduct market analysis and research in support of regulatory decision-making, and conduct market surveillance, examinations, investigations, and other enforcement functions.\1876\ The trend in this area is to use more automated and data-intensive methods as regulators' activities adjust to the data and technology available. The Notice described these regulatory activities and how regulators currently use data. While the Commission did not receive any comments on its description of the current state of regulatory activities, the Participants did confirm the use of real-time surveillance and monitoring tools by SROs. The Commission continues to believe that the current state of regulatory activity, as described in detail in the Notice and as summarized below, reflects the Baseline for the CAT NMS Plan.

      ---------------------------------------------------------------------------

      \1876\ Id.

      ---------------------------------------------------------------------------

      1. Analysis and Reconstruction of Market Events

        In the Notice, the Commission discussed how regulators currently analyze and reconstruct market events.\1877\ In terms of market reconstructions, currently, regulators aim to provide an accurate and factual accounting of what transpired during a market event of interest by conducting a thorough analysis of the available market data.\1878\ Market events often encompass activity in many securities across multiple trading venues, and analysis and reconstruction of these market events requires linking data from multiple sources.\1879\ Examples of recent market reconstructions include the Commodity Futures Trading Commission (``CFTC'') and SEC's analysis of the May 6, 2010 ``Flash Crash,'' \1880\ analysis of equity market volatility on August 24, 2015,\1881\ and the multi-agency report on the U.S. Treasuries market on October 15, 2014.\1882\

        ---------------------------------------------------------------------------

        \1877\ Id. at 30656-57.

        \1878\ Id.

        \1879\ Id. Examples of recent market reconstructions include the Commodity Futures Trading Commission (``CFTC'') and SEC's analysis of the May 6, 2010 ``Flash Crash,'' analysis of equity market volatility on August 24, 2015, and the multi-agency report on the U.S. Treasuries market on October 15, 2014.

        \1880\ See Findings Regarding the Market Events of May 6, 2010: Report of the Staffs of the CFTC and SEC to the Joint Advisory Committee on Emerging Regulatory Issues (September 30, 2010) (``Flash Crash Analysis''), available at http://www.sec.gov/news/studies/2010/marketevents-report.pdf.

        \1881\ See Staff of the Office of Analytics and Research, Division of Trading and Markets, Research Note: Equity Market Volatility on August 24, 2015 (Dec. 2015), available at http://www.sec.gov/marketstructure/research/equity_market_volatility.pdf; see also Austin Gerig and Keegan Murphy, The Determinants of ETF Trading Pauses on August 24th, 2015, White Paper (February 2016), available at http://www.sec.gov/marketstructure/research/determinants_eft_trading_pauses.pdf.

        \1882\ See U.S. Department of the Treasury, Board of Governors of the Federal Reserve System, Federal Reserve Bank of New York, U.S. Securities and Exchange Commission, and U.S. Commodity Futures Trading Commission, Joint Staff Report: The U.S. Treasury Market on October 15, 2014 (July 13, 2015), available at http://www.sec.gov/reportspubs/special-studies/treasury-market-volatility-10-14-2014-joint-report.pdf.

        ---------------------------------------------------------------------------

      2. Market Analysis and Research

        In the Notice, the Commission discussed how regulators currently perform market analysis and research.\1883\ In terms of market analysis and research, as addressed in detail in the Notice, the Commission and SRO Staffs currently conduct data-driven analysis on market structure, in direct support of both rulemaking and other regulatory decisions such as SRO rule approvals as well as retrospective analyses of rules and pilots.\1884\ The Commission relies on data analysis to inform its market structure policy, and SROs also conduct market analysis and research on their own regulatory initiatives. Examples of data-driven market analysis include reports on OTC trading,\1885\ small capitalization stock trading,\1886\ the Limit Up-Limit Down Pilot,\1887\ short selling,\1888\ and high frequency trading.\1889\

        ---------------------------------------------------------------------------

        \1883\ See Notice, supra note 5, at 30657.

        \1884\ Id.

        \1885\ See Laura Tuttle, Alternative Trading Systems: Description of ATS Trading in National Market System Stocks (October 2013) available at http://www.sec.gov/divisions/riskfin/whitepapers/alternative-trading-systems-10-2013.pdf; Laura Tuttle, OTC Trading: Description of Non-ATS OTC Trading in National Market System Stocks (March 2014), available at http://www.sec.gov/dera/staff-papers/white-papers/otc-trading-white-paper-03-2014.pdf.

        \1886\ See Securities Exchange Act Release No. 74892, Order Approving the National Market System Plan to Implement a Tick Size Pilot Program (May 6, 2015), 80 FR 27514, 27534, 27541 (May 13, 2015); see also Charles Collver, A Characterization of Market Quality for Small Capitalization US Equities (September 2014), available at http://www.sec.gov/marketstructure/research/small_cap_liquidity.pdf.

        \1887\ See SRO Supplemental Joint Assessment, available at http://www.sec.gov/comments/4-631/4-631.shtml; Memo to File from the Division of Economic and Risk Analysis regarding the Cornerstone Analysis of the Impact of Straddle States on Options Market Quality (February 8, 2016), available at http://www.sec.gov/comments/4-631/4631-42.pdf; see also Gerig and Murphy, supra note 1881.

        \1888\ See Memo to Chairman Christopher Cox from Daniel Aromi and Cecilia Caglio regarding an Analysis of Short Selling Activity during the First Weeks of September 2008, (December 16, 2008), available at http://www.sec.gov/comments/s7-08-09/s70809-369.pdf; Memo to Chairman Christopher Cox from Daniel Aromi and Cecilia Caglio regarding an Analysis of a Short Sale Price Test Using Intraday Quote and Trade Data (December 17, 2008), available at http://www.sec.gov/comments/s7-08-09/s70809-368.pdf; Memo from the Office of Economic Analysis regarding an Analysis of the July Emergency Order Requiring a Pre-borrow on Short Sales (January 14, 2009) available at http://www.sec.gov/spotlight/shortsales/oeamemo011409.pdf.

        \1889\ See Austin Gerig, High-Frequency Trading Synchronizes Prices in Financial Markets, (January 2015), available at http://www.sec.gov/dera/staff-papers/working-papers/dera-wp-hft-synchronizes.pdf; see also Staff of the Office of Analytics and Research, Division of Trading and Markets, Research Note: Equity Market Volatility on August 24, 2015 (December 2015), available at http://www.sec.gov/marketstructure/research/equity_market_volatility.pdf.

        ---------------------------------------------------------------------------

      3. Market Surveillance and Investigations

        As explained in detail in the Notice, regulators perform market surveillance and investigation functions that rely on access to multiple types of market data.\1890\ The following Sections summarize the discussion from the Notice describing the current state of SRO surveillance and SRO and Commission examinations and enforcement investigations.

        ---------------------------------------------------------------------------

        \1890\ See Notice, supra note 5, at 30657-59.

        ---------------------------------------------------------------------------

        (1) Current SRO Surveillance

        Rule 613(f) requires the SROs to develop and implement a surveillance system, or enhance existing surveillance systems, reasonably designed to make use of the CAT Data.\1891\ For the purposes of the economic analysis in the Notice, the Commission considered surveillance to involve SROs running automated processes on routinely collected or in-house data to identify potential violations of rules or regulations.\1892\ For instance, SROs use surveillance systems, developed internally or by a third party, to detect violations of trading rules, market abuse, or unusual behavior, in real time, within one day, or within a few weeks of the activity in question. As discussed in the Notice, SRO surveillance can help

        Page 84806

        protect investors by detecting fraudulent behavior and anomalous trading.

        ---------------------------------------------------------------------------

        \1891\ 17 CFR 242.613(f).

        \1892\ See Notice, supra note 5, at 30657-58.

        ---------------------------------------------------------------------------

        Currently, exchange-operating SROs use surveillance systems and are responsible for surveillance of their own market. As discussed in the Notice, FINRA conducts off-exchange and cross-market surveillance \1893\ and oversees and regulates OTC trading of exchange-listed and non-exchange-listed securities, as well as trading in corporate and municipal debt instruments and other fixed income instruments. FINRA also provides surveillance services to U.S. equity and options exchanges through regulatory services agreements with nearly every equity market and all options exchanges. Additional surveillance is conducted by exchange-operating SROs and some of this additional surveillance is conducted as trading activity occurs. This surveillance can include detection of market manipulation, violations of trading rules, and other unusual behavior.

        ---------------------------------------------------------------------------

        \1893\ FINRA conducts cross-market surveillance for approximately 99% of the listed equity market and approximately 70% of the listed options market. See Notice, supra note 5, at 30657.

        ---------------------------------------------------------------------------

        While there were no explicit comments pertaining to the current practices regarding SRO surveillance, the Participants' responses confirm that they have real-time surveillance and monitoring tools in place for their respective markets.\1894\

        ---------------------------------------------------------------------------

        \1894\ Response Letter I at 31.

        ---------------------------------------------------------------------------

        (2) Examinations

        In the Notice, the Commission discussed how regulators currently perform examinations.\1895\ As addressed in detail in the Notice, SROs currently conduct exams of broker-dealers for violations of trading-

        related federal laws, rules, and regulations and for violations of SRO rules and regulations.\1896\ In 2015, FINRA's Member Regulation Department conducted approximately 2,400 broker-dealer examinations.\1897\ Currently, the Commission conducts exams of broker-

        dealers, transfer agents, investment advisers, investment companies, municipal advisers, clearing agencies, the national securities exchanges, other SROs such as FINRA and the Municipal Securities Rulemaking Board, and the Public Company Accounting Oversight Board (``PCAOB'').\1898\ For example, the Commission conducted 493 broker-

        dealer examinations in 2014 and 484 in 2015, and 70 exams of the national securities exchanges and FINRA in 2014 and 21 in 2015. In addition, the Commission conducted 1,237 investment adviser and investment company examinations in 2014 and 1,358 in 2015. Virtually all investment adviser examinations and a significant proportion of the Commission's other examinations involve analysis of trading and order data. Examinations of broker-dealers and investment advisers involve intensive analysis of trading data. Examinations seek to determine whether the entity being examined is: Conducting its activities in accordance with the federal securities laws, rules adopted under these laws, and SRO rules; adhering to the disclosures it has made to its clients, customers, the general public, SROs and/or the Commission; and implementing supervisory systems and/or compliance policies and procedures that are reasonably designed to ensure that the entity's operations are in compliance with the applicable legal requirements.\1899\ In order to select candidates for examination, the Commission and certain SROs, including FINRA,\1900\ use a risk-based approach. ``Risk-based examinations'' seek to increase regulatory efficiency by using preliminary data analysis to direct examination resources towards entities and activities where risks of violative or illegal activity are the highest. The Commission uses risk and data analysis before opening an exam to identify broker-dealers and investment advisers for areas of focus such as suspicious trading, as well as during an exam to identify the particular activities of a broker-dealer or investment adviser that could trigger certain compliance and supervisory risks.

        ---------------------------------------------------------------------------

        \1895\ See Notice, supra note 5, at 30658.

        \1896\ Id.

        \1897\ Id. This estimate was based on Staff discussions with FINRA. See also FINRA Overview of Member Regulation, available at http://www.finra.org/industry/member-regulation.

        \1898\ Id.

        \1899\ See SEC, Examination Information for Entities Subject to Examination or Inspection by the Commission (June, 2014), available at http://www.sec.gov/about/offices/ocie/ocie_exambrochure.pdf.

        \1900\ FINRA conducts regulatory examinations by contract on behalf of all the options and equities exchanges, except for the Chicago Stock Exchange, Inc. (``CHX'') and the National Stock Exchange, Inc. (``NSX''). Accordingly most exchanges also employ a risk-based approach to examination selection and scope. CHX examines members on a cycle basis. NSX recently resumed operations in December 2015. See Securities Exchange Act Release No. 76640 (December 14, 2015), 80 FR 79122 (December 18, 2015).

        ---------------------------------------------------------------------------

        (3) Enforcement Investigations

        In the Notice, the Commission discussed how regulators currently approach enforcement investigations.\1901\ As explained in detail in the Notice, the Commission and SROs undertake numerous investigations to enforce the securities laws and related rules and regulations, including investigations of market manipulation, insider trading, and issuer repurchase violations.\1902\ The Commission estimates that 30-

        50% of enforcement investigations use trade and order data. In 2015, the Commission filed 807 enforcement actions, including 39 related to insider trading, 43 related to market manipulation, 124 related to broker-dealers, 126 related to investment advisers/investment companies, and one related to exchange or SRO duties. In 2014, the Commission filed 755 enforcement actions, including 52 related to insider trading, 63 related to market manipulation, 166 related to broker-dealers, and 130 related to investment advisers/investment companies, many of which involved trade and order data.

        ---------------------------------------------------------------------------

        \1901\ See Notice, supra note 5, at 30658.

        \1902\ Id. Examples of investigations of market manipulations include marking the close, order layering and spoofing, wash sales, and trading ahead. Layering and spoofing are manipulations where orders are placed close to the best buy or sell price with no intention to trade in an effort to falsely overstate the liquidity in a security.

        ---------------------------------------------------------------------------

        The Commission initiates enforcement investigations when SROs or others submit reliable tips, complaints, or referrals, or when the Commission becomes aware of anomalies indicative of manipulation. After the detection of potential anomalies, a tremendous amount of time and resources are expended in gathering and interpreting trade and order data to construct an accurate picture of when trades were actually executed, what market conditions were in effect at the time of the trade, which traders participated in the trade, and which beneficial owners were affected by the trade. The Commission also explained in the Notice that SROs rely primarily on surveillance to initiate investigations based on anomalies in the trading of securities. FINRA brought 1,397 disciplinary actions in 2014 and 1,512 in 2015.

        (4) Tips and Complaints

        In the Notice, the Commission discussed how regulators currently analyze and investigate tips and complaints.\1903\ Market participants or those with experience in analyzing market data sometimes notice atypical trading or quoting patterns in publicly available market data, and these observations sometimes result in a tip or complaint to a regulator. As the Commission discussed in the Notice, regulators investigate thousands of tips and complaints each year.\1904\ In fiscal

        Page 84807

        years 2014 and 2015, the Commission received around 15,000 entries in its Tips, Complaints and Referrals (``TCR'') system, approximately one third of which related to manipulation, insider trading, market events, or other trading and pricing issues. Analysis of tips and complaints generally follow three stages. First, regulators ensure that the tip or complaint contains sufficient information to facilitate analysis. Second, regulators use directly accessible data or make phone calls and other informal queries to determine if the tip or complaint is credible. Third, for tips and complaints that seem credible, regulators then perform a more in-depth investigation or examination, which follows the processes described above for examinations and enforcement investigations.

        ---------------------------------------------------------------------------

        \1903\ See Notice, supra note 5, at 30659.

        \1904\ Id.

        ---------------------------------------------------------------------------

        2. Current State of Trade and Order Data

        To assess how and to what degree the CAT NMS Plan would affect the trade and order data available to regulators, the economic analysis in the Notice considered what data regulators use currently and the limitations in that data. The Commission did not receive any comments on its description of the current sources of trade and order data. The Commission received some comments on its description of the current limitations on trade and order data, which are discussed below. However, the Commission continues to believe that the current state of trade and order data, as described in detail in the Notice and as summarized below, reflects the relevant baseline for its economic analysis of the CAT NMS Plan.

      4. Current Sources of Trade and Order Data

        In the Notice, the Commission stated that SROs and the Commission currently use a range of trading and order data sources \1905\ for their regulatory activities. The types of data and ease of use of these sources of data can vary widely. The Notice reviewed the primary sources of data currently available to regulators, describing the content of the data provided and examples of their specialized uses.

        ---------------------------------------------------------------------------

        \1905\ Id. at 30659-62.

        ---------------------------------------------------------------------------

        (1) SRO Data

        As discussed in detail in the Notice, SROs maintain audit trails that contain trade and order data that they obtain from their members. Currently, regulators have access to at least three sources of audit trail data. First, the National Association of Securities Dealers (``NASD'') established its OATS in 1998, which required NASD (n/k/a FINRA) members to report certain trade and order data regarding NASDAQ-

        listed equity securities. OATS was later expanded to include OTC Equity Securities and all NMS stocks. Second, beginning in 2000, several of the current options exchanges implemented the Consolidated Options Audit Trail System (``COATS''). Finally, each equities and options exchange keeps an audit trail of orders and trades that occur on its market.\1906\

        ---------------------------------------------------------------------------

        \1906\ Id. at 30659.

        ---------------------------------------------------------------------------

        The Commission explained that for each of these stages in the life of an order, FINRA Rule 7440 requires the recording and reporting of the following information, as applicable, including but not limited to: For the receipt or origination of the order, the date and time the order was first originated or received by the reporting member, a unique order identifier, the market participant symbol of the receiving reporting member, and the material terms of the order; for the internal or external routing of an order, the unique order identifier, the market participant symbol of the member to which the order was transmitted, the identification and nature of the department to which the order was transmitted if transmitted internally, the date and time the order was received by the market participant or department to which the order was transmitted, the material terms of the order as transmitted, the date and time the order was transmitted, and the market participant symbol of the member who transmitted the order; for the modification or cancellation of an order, a new unique order identifier, original unique order identifier, the date and time a modification or cancellation was originated or received, and the date and time the order was first received or originated; and for the execution of an order, in whole or in part, the unique order identifier, the designation of the order as fully or partially executed, the number of shares to which a partial execution applies and the number of unexecuted shares remaining, the date and time of execution, the execution price, the capacity in which the member executed the transaction, the identification of the market where the trade was reported, and the date and time the order was originally received. FINRA Rule 7440 also requires reporting of the account type, the identification of the department or terminal where an order is received from a customer, the identification of the department or terminal where an order is originated by a reporting member, and the identification of a reporting agent if the agent has agreed to take on the responsibilities of a reporting member under Rule 7450.\1907\

        ---------------------------------------------------------------------------

        \1907\ Id. at 30659-60. The Notice provided further details on the reporting requirements of FINRA Rule 7440. Id. at 30659-60 nn.354-57.

        ---------------------------------------------------------------------------

        The Commission also explained that a majority of options exchanges require their members to provide the following information with respect to orders entered onto their exchange: (1) The material terms of the order; (2) order receipt time; (3) account type; (4) the time a modification is received; (5) the time a cancellation is received; (6) execution time; and (7) the clearing member identifier of the parties to the transaction.\1908\

        ---------------------------------------------------------------------------

        \1908\ Id. at 30660. The Notice provided further details on the reporting requirements of options exchanges. Id. at 30660 nn.358-59. The Notice also outlined the reporting requirements of other SRO audit trails. Id. at 30660 n.364.

        ---------------------------------------------------------------------------

        As discussed in the Notice, SRO audit trail data is used for market reconstructions and market analyses, and to inform policy decisions, both by the Commission and by SROs. Regulators also use SRO audit trail data extensively for surveillance, examinations, investigations, and other enforcement functions. Current SRO market surveillance relies primarily on data from the SRO audit trails, generated directly from the exchange servers and from OATS. Likewise, SRO examinations and investigations pull information from their own audit trails before seeking data from others. Commission examinations and investigations also rely heavily on SRO audit trails to start the process of tracing a particular trade from its execution to the order initiation and customer information, and the audit trails can be useful for manipulation investigations or other regulatory activities that require analyses of microcap securities trading activity.\1909\

        ---------------------------------------------------------------------------

        \1909\ Id. at 30660.

        ---------------------------------------------------------------------------

        (2) Equity and Option Cleared Reports

        The SROs and the Commission also have access to equity and option cleared reports. In the Notice, the Commission noted that clearing broker-dealers report their equity and option cleared data on a daily basis and the NSCC and the OCC aggregate the data across the market and generate the reports.\1910\ Equity and

        Page 84808

        option cleared reports provide a way for regulators to directly access a dataset to see how much trading volume is accounted for by a particular clearing broker. As such, these data are often used at the beginning of an examination or investigation to start identifying the market participants that may have additional data needed to pinpoint a particular activity.

        ---------------------------------------------------------------------------

        \1910\ Equity and option cleared reports show ``the number of trades and daily cleared trade and share volume, by clearing member, for each equity and listed option security in which transactions took place. Regulators can query these reports directly through an internal online system that interfaces with the Depository Trust and Clearing Corporation (``DTCC'') data by security name and CUSIP number.'' A CUSIP number is a ``unique alphanumeric identifier assigned to a security and facilitates the clearance and settlement of trades in the security.'' Id.

        ---------------------------------------------------------------------------

        (3) Electronic Blue Sheets

        As the Commission discussed in the Notice, broker-dealers also provide detailed data to regulators in the form of Electronic Blue Sheets (``EBS''). The EBS data, provided pursuant to Rule 17a-25 under the Act, facilitate investigations by the SROs and Commission Staff, particularly in the areas of insider trading and market manipulations. The EBS system provides certain detailed execution information in its electronic format upon request by SRO or Commission Staff. This information often includes the employer of the beneficial owner of an account, which can be important to insider trading investigations, and in some cases, a tax identification number.\1911\

        ---------------------------------------------------------------------------

        \1911\ Id. at 30661. The Notice provided further details on Rule 17a-25 and its reporting requirements. Id. at 30661, notes 368-369.

        ---------------------------------------------------------------------------

        The EBS system also provides additional information on market participants who meet the definition of ``large traders'' and have self-identified to the Commission as required by Rule 13h-1. Large trader data provide the Commission with a way to acquire information about the activities of large traders and allow the activities of large traders to be more readily aggregated across or partitioned by multiple broker-dealers.\1912\

        ---------------------------------------------------------------------------

        \1912\ Id. The Notice provided the definition of a ``large trader'' and further details on the reporting requirements of Rule 13h-1. Id.

        ---------------------------------------------------------------------------

        (4) Trade Blotters and Order Tickets

        As the Commission addressed in detail in the Notice, investment advisers and broker-dealers also maintain data in the form of order tickets and trade blotters that regulators can obtain on request. Order tickets are in-house records maintained by investment advisers and broker-dealers that provide order details, including timestamps of order initiation and placement, special order types, any special instructions for the order, and plans for the allocation of shares and prices across accounts and subaccounts. Order tickets also identify account owners. Commission Staff collects order tickets regularly for examinations, and occasionally also for market manipulation investigations.\1913\

        ---------------------------------------------------------------------------

        \1913\ Id.

        ---------------------------------------------------------------------------

        The Commission discussed the fact that broker-dealers maintain data in trade blotters that are similar to EBS. However, the trade blotters also contain more information, including the commissions paid in executing each order, timestamps of when an order is received and when it is executed (and the number of fills), and the pricing information for all executions in the order. SROs use trade blotters in examinations of their members. Commission Staff uses trade blotters frequently for examinations, including in almost every broker-dealer, investment adviser, and hedge fund examination, as well as for insider trading and market manipulation investigations. Regulators use trade blotter data to determine the order entry time and execution time for trades by a particular customer in examinations and enforcement investigations. Trade blotters are also the primary data source used in regulatory investigations for which subaccount allocation information is important for determining violative behavior, such as cherry-picking and front-running cases.\1914\

        ---------------------------------------------------------------------------

        \1914\ Id.

        ---------------------------------------------------------------------------

        As the Commission discussed in the Notice, broker-dealers and exchanges collect and maintain records of activity in their order handling systems and internal matching systems.\1915\ Some of the data that is collected and maintained in these systems exceeds the scope of information captured in EBS, SRO audit trail, trade blotter, or order ticket data and may include data on order receipt, modification or routing information not otherwise reported to SROs. Regulators use these trading and order handling system data in investigations and examinations to further analyze issues discovered during their analysis of data from other sources.\1916\

        ---------------------------------------------------------------------------

        \1915\ ``Internal matching systems of broker-dealers may include Alternative Trading Systems (``ATSs'') or automated trading systems that provide liquidity to received orders without interacting on a registered exchange. The Commission understands that some broker-

        dealers rely on their clearing firms to collect and maintain records relating to routed orders on their behalf. Broker-dealers that operate their own internal matching systems are more likely to collect and maintain their own records.'' Id. at 30662.

        \1916\ Id.

        ---------------------------------------------------------------------------

        (5) Public Data

        As discussed in detail in the Notice, exchanges and SROs make some data available to the public and regulators can access these data for their regulatory activities. One type of public data is ``consolidated'' data feeds that are disseminated by registered Securities Information Processors (``SIPs'') pursuant to joint SRO plans. For a fee, the SIPs distribute consolidated market data on recent equity and option transactions and the prevailing best quotes at each exchange to market data subscribers. Additionally, all exchanges also make data available through direct data feeds. These feeds contain all data included in the SIP feed, but also include depth of book information and, depending on the exchange, may include additional data, such as the submission, cancellation and execution of all displayed orders and auction imbalance information on the exchange, among other things. Furthermore, at the request of Commission Staff, most equities exchanges also produce and make public two datasets with information on short sales: A file of short selling volume by stock, which contains the short selling and total volume on that exchange by symbol, and a file of short selling transactions, which contains trade information such as time, volume, and price for each transaction involving a short sale.\1917\

        ---------------------------------------------------------------------------

        \1917\ Id.

        ---------------------------------------------------------------------------

        The Commission and SROs use these publicly available trade and order data to conduct market analyses, market reconstructions, examinations, and investigations. Due to the accessibility and ease of use of the public data, regulators often use it as a starting point or a basis of comparison to other data sources. For example, real-time surveillance can rely on SIP data, and some insider trading surveillance relies on information from other publicly available sources such as news sources. Further, investigations into short sale market manipulation sometimes start with an analysis of the short selling data.\1918\

        ---------------------------------------------------------------------------

        \1918\ Id.

        ---------------------------------------------------------------------------

      5. Current Limitations of Trade and Order Data

        As the Commission addressed in detail in the Notice, while regulators have access to trade and order data from the sources described above,\1919\ the available data are, for various reasons, limited in terms of the four qualities discussed above.\1920\ In terms of completeness, current sources do not represent all of the market activity of interest in sufficient detail in one consolidated audit trail. In terms of accuracy, current sources may reflect data errors, insufficiently granular clock

        Page 84809

        synchronization and timestamps, errors introduced in the process of combining data from different sources, a lack of consistent customer and broker-dealer identifiers, and data that is too aggregated at the record level to provide the information regulators need. In terms of accessibility, the SROs and Commission lack direct access to most of the data sources described above, and with respect to timeliness, obtaining trade and order data from current sources and converting the data into a form in which they can be analyzed can involve a significant delay from the time of a particular event of interest. Due to these limitations on current data sources, as the Commission addressed in detail in the Notice, regulators are limited in their ability to perform the activities outlined in Section V.D.1, above. Table 1 summarizes the key characteristics of the currently available data sources, the limitations of which are discussed in more detail below.

        ---------------------------------------------------------------------------

        \1919\ See Section V.D.2(a), supra.

        \1920\ See Notice, supra note 5, at 30662-74.

        Page 84810

        Table 1

        ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

        Routing/

        Customer Broker-dealer TimeStamp Allocation Order display Buy-to-cover Special modification/ Entire Direct access Off- exchange Timeliness of

        identifier identifier \1921\ information information indicator handling cancellation lifecycle for regulators activity \1922\ data compiling

        instructions information \1923\

        ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

        OATS........................ No............. Yes............ Yes (majority No............. Yes (for limit No............. Yes Yes............ Yes ( before No (except Yes............ Raw Data: T+1.

        in orders). (conditional). order reaches FINRA). Access Corrected Data:

        milliseconds exchange). can take T+6.

        but some in No (once order several weeks.

        seconds). reaches

        exchange).

        COATS....................... No............. Yes............ Yes............ No............. No............. No............. No............. Yes............ No............. No (except SROs No............. Reported same-

        w/r/t their day, but

        own members). separate file

        transmitted at

        latest T+1.

        SRO Audit Trails............ No............. Yes............ Yes (majority No............. No............. No............. No............. Yes............ No (only once No (except SROs No............. As soon as a

        in order reaches w/r/t their trade is

        milliseconds exchange). own trails). executed.

        but some in Access can

        seconds). take several

        weeks.

        Equity and Option Cleared No............. No............. No............. No............. No............. No............. No............. No............. No............. Yes............ Yes............ Equity: T+3.

        Reports. Option: T+1.

        Electronic Blue Sheets...... Yes (but not Yes (but not Yes............ No............. No............. No............. No............. No (except for No............. No. Access can Yes............ 10 business

        always always certain take several days after

        consistent consistent cancellation weeks or request is

        across broker- across broker- information). months. submitted.

        dealers) dealers).

        \1924\.

        Trade Blotters/Order Tickets Yes (but not Yes (but not Yes (can be No............. No............. No............. No............. No............. No............. No. Access can Yes............ Same-day.

        always always requested, take several

        consistent consistent although not days.

        across broker- across broker- always

        dealers). dealers). reliable).

        Trading and Order Handling Depends on the Yes............ Yes............ No............. No............. No............. No............. Yes............ Yes (except No. Regulators Yes............ Same-day.

        System Data. trader. allocations). must request

        this data (SEC

        asks for the

        data within 10

        days).

        Public/Proprietary Data..... No............. No............. Yes (varied No............. No............. No............. No............. Yes (except non- No............. Yes............ Yes............ Same-day.

        between displayed

        seconds and orders).

        microseconds).

        ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

        Page 84811

        (1) Completeness

        ---------------------------------------------------------------------------

        \1921\ As proposed, the CAT NMS Plan also requires CAT Reporters to synchronize their time clocks to the time maintained by the NIST with an allowable drift of 50 milliseconds. See CAT NMS Plan, supra note 5, at Section 6.8. According to a survey conducted by the FIF, 39% of responding broker-dealers currently synchronize their clocks with less precision than what is called for by the CAT NMS Plan. Thus, the CAT NMS Plan would also increase the accuracy of the timestamps used by certain broker-dealers. See FIF Clock Offset Survey, supra note 247.

        \1922\ Off-exchange activity includes currently reportable events that are not handled by a registered securities exchange.

        \1923\ In this instance, ``timeliness'' refers to when the data are compiled at the source in question (e.g., when OATS receives data from reporting broker-dealers), not when they become available to regulators because that timeline can vary depending on the regulator in question. As shown in the ``Direct Access for Regulators'' column, it may still take several days, weeks, or months for regulators to be able to access the data. For example, while OATS reporters provide the data at T+1, the SEC must request OATS data in order to access it, which may take several days or weeks. This narrower definition of timeliness is not used throughout this economic analysis.

        \1924\ Guidance from FINRA indicates that broker-dealers must ``identify the party to the trade'' through EBS fields such as ``Primary Party Identifier,'' but that party may be another broker-

        dealer rather than the ultimate customer. See FINRA, Electronic Blue Sheet Submissions, FINRA and ISG Extend Effective Date for Certain Electronic Blue Sheet Data Elements, Regulatory Notice 12-47 (Oct. 2012), available at https://www.finra.org/sites/default/files/NoticeDocument/p194655.pdf. Similarly, under the large trader rule, persons exercising ``investment discretion'' are reported through EBS, but in some cases such persons are investment advisers rather than their customers. See Notice, supra note 5, at note 372 and accompanying text (discussing the large trader rule).

        ---------------------------------------------------------------------------

        ``Completeness'' refers to whether the data represents all market activity of interest or just a subset, and whether the data is sufficiently detailed to provide the required information.\1925\ As addressed in detail in the Notice, while current data sources provide trade and order data specified by existing rules and regulations, those sources do not contain all market activity that might be required for certain market inquiries, in sufficient detail, within one consolidated audit trail. The Commission explained in the Notice that, to obtain information regarding a particular market event, regulators may have to piece together information from different data sources and that some data is not required to be reported at all under existing regulations. Therefore, as described below, current data sources either cover only a limited number of events and products, or lack some data fields that would be useful to regulators, each of which impedes effective market surveillance.\1926\

        ---------------------------------------------------------------------------

        \1925\ Id. at 30664.

        \1926\ Id.

        ---------------------------------------------------------------------------

        One commenter agreed with the Commission's analysis by stating that ``the fragmented nature of current data sources does pose significant challenges to regulators seeking complete data.'' \1927\

        ---------------------------------------------------------------------------

        \1927\ Data Boiler Letter at 30.

        ---------------------------------------------------------------------------

    8. Events and Products

      As the Commission addressed in detail in the Notice, there is currently no single data source that covers all market activities. EBS data contains executed trades but does not contain information on orders or quotes (and thus does not provide information on routes, modifications, or cancellations). Similarly, trade blotters and order tickets contain only information recorded by the particular broker-

      dealer or investment adviser that generated them and may contain limited information about full order lifecycles. SRO audit trail data are limited to identifying the activity of their members, can have incomplete information concerning their members, lack order lifecycle information occurring prior to receipt by an exchange, and may not contain information regarding principal trading. Furthermore, although public consolidated and direct data feeds provide data about the entire market, they lack information regarding non-displayed orders and do not provide sufficient information to identify the different lifecycle events of a single order.\1928\

      ---------------------------------------------------------------------------

      \1928\ See Notice, supra note 5, at 30664.

      ---------------------------------------------------------------------------

      The Commission also discussed individual SRO audit trails. While extensive, they contain only activity of their own members, and many SRO audit trails are incomplete in their coverage of the activities of those members. For example, FINRA's OATS data does not include proprietary orders originated by a trading desk in the ordinary course of a member's market making activities, or options data. And while OATS collects data from FINRA members with respect to orders and trades involving NMS and OTC stocks, OATS does not include trade or order activity that occurs on exchanges or at broker-dealers that are not FINRA members. In addition, while broker-dealers who are not members of FINRA must be members of an exchange SRO, an individual exchange SRO's audit trail data is generally limited to activity taking place on that exchange. The Commission noted that because broker-dealers who are not members of FINRA may engage in trading activity in off-exchange markets, a substantial portion of the trading activity that an exchange SRO supervises is not reported to the supervising SRO.\1929\ The Commission also discussed the fact that not all FINRA members are obligated to report to OATS. FINRA's rules exclude from reporting certain members that engage in a non-discretionary order routing process. Additionally, FINRA has the authority to exempt the manual orders of other members who meet specific criteria from the OATS recording and reporting requirements.\1930\

      ---------------------------------------------------------------------------

      \1929\ Id.

      \1930\ Id. (citing FINRA Rule 7470). At the time of the Notice, FINRA had granted approximately 50 such exemptions.

      ---------------------------------------------------------------------------

      The Commission also explained that some SRO audit trails do not include and are not required to include activity associated with principal trading, such as market-making activity. This may result in the exclusion of a significant amount of activity, particularly for firms with substantial market-making business activities.\1931\

      ---------------------------------------------------------------------------

      \1931\ Id. at 30665.

      ---------------------------------------------------------------------------

      Finally, the Commission discussed the fact that no single current data source integrates both equities and options, and that the lack of any combined equity and options audit trail data is a significant impediment to regulators performing cross-product surveillance.\1932\

      ---------------------------------------------------------------------------

      \1932\ Id.

      ---------------------------------------------------------------------------

    9. Data Fields

      As addressed in detail in the Notice, each of the currently available data sources discussed above is missing certain data fields that are useful for conducting a variety of regulatory activities. Furthermore, certain valuable data fields are not contained in any of the data sources discussed above.\1933\

      ---------------------------------------------------------------------------

      \1933\ Id.

      ---------------------------------------------------------------------------

      Most notably, as the Commission explained in detail in the Notice, the identity of the customer is not available from any of the current data sources that are reported to regulators on a routine basis. As discussed in the Notice, a unique customer identifier could be useful for many types of investigations and examinations such as market manipulation investigations and examinations of investment advisers. The Commission also explained that although some data sources--

      specifically large trader reports, EBS, trade blotters, and order tickets--identify customers, these data sources are not reported on a routine basis, provide only one part of the order lifecycle, and have other inherent limitations.\1934\

      ---------------------------------------------------------------------------

      \1934\ Id.

      ---------------------------------------------------------------------------

      The Commission explained that because there is currently no data source that includes customer identities

      Page 84812

      across multiple parts of an order lifecycle, regulators must seek and link multiple sources of data, which can be a burdensome and imperfect process. For example, trade blotter and order ticket data that identify customers from one broker-dealer may only include customer names and thus may not be readily matched to similar data from another broker-

      dealer, or may require substantial time, effort, and uncertainty to reconcile across firms. Further, EBS data's limited coverage of trading activity and lack of some detailed trade information raises costs and reduces the timeliness of insider trading investigations.\1935\

      ---------------------------------------------------------------------------

      \1935\ Id. for a full discussion of the impact on insider trading investigations.

      ---------------------------------------------------------------------------

      As the Commission addressed in detail in the Notice, some valuable data fields, such as modifications that make an order non-displayed and other special handling instructions are consistently available on only a few data sources or require linking different data sources.\1936\ The Commission explained that the lack of direct, consistent access to order display information and special handling instructions creates inefficiencies in surveillances, examinations, and investigations that examine hidden liquidity and the treatment of customer orders.\1937\

      ---------------------------------------------------------------------------

      \1936\ In the Notice, the Commission provided furt