Eliminating All PII from CAT

By Robert Cook, President and CEO, FINRA¹ 

Last month, the SEC issued an exemptive order providing significant relief from the personally identifiable information (PII) reporting requirements of CAT (the Exemptive Order).² This was an important step towards reducing unnecessary PII risk associated with CAT, and was directionally consistent with a blog I previously wrote calling for CAT to stop collecting and storing investors’ PII. As discussed below, however, the Exemptive Order did not eliminate all PII from CAT. 

CAT LLC has now filed with the SEC a proposal to formally amend CAT in a manner that would build on the objectives underlying the SEC’s Exemptive Order.³ Among other things, this proposal would stop the reporting of all PII to CAT and delete any PII previously reported to CAT. FINRA supports prompt approval of CAT LLC’s proposed amendment.⁴   

The SEC Exemptive Order

The SEC noted in its Exemptive Order that the evolving data security landscape must be considered when weighing the benefits and risks associated with collecting investors’ PII in CAT. Indeed, in 2020 the SEC responded to this evolving landscape by reducing the scope of investor PII collected by CAT.⁵ At that time, however, the Commission deemed it appropriate to continue requiring the collection of investors’ names, addresses, and years of birth.

In last month’s Exemptive Order, the SEC revisited the trade-off between regulatory efficiency and data privacy, stating that it “now weighs the benefits of maintaining some of that information in the CAT differently in light of both the heightened security risks posed by the increased sophistication of bad actors and the prospect of relatively efficient indirect access [by regulators] to customer information.”⁶ The latter point refers to the ability of regulators to utilize existing mechanisms, or to work with the industry to establish new mechanisms, to efficiently obtain information regarding the identity of market participants on an as-needed basis, without collecting and storing in CAT the PII of all investors.⁷

Based on these considerations, the SEC Exemptive Order permitted market participants to not report to CAT the names, addresses, and years of birth for investors who are U.S. natural persons.

CAT LLC’s Proposal—Finishing the Job on PII

FINRA appreciates the SEC’s willingness to review and update the requirements for CAT. The Exemptive Order will substantially reduce the future PII footprint of CAT.

CAT LLC’s recent proposal would build on the Exemptive Order in a number of important respects:

• Stop Reporting All Customer-Identifying Information. The Exemptive Order did not address the reporting of a subset of sensitive information regarding certain types of customers—e.g., certain foreign natural persons and legal entities (such as a trust). As with the PII covered by the Exemptive Order, this other information also presents security risks and can be obtained by regulators through alternative means. 

  CAT LLC’s proposal would cover the reporting of all customer-identifying information to CAT. 

• Make It Mandatory, Not Permissive. The Exemptive Order appears to be permissive, not mandatory, meaning that industry members may choose whether to continue reporting the relevant PII to CAT, and as a result CAT must continue to be prepared to accept that information.

  CAT LLC’s proposal would stop the reporting of PII to CAT by all market participants.

• Delete Previously Collected PII. The Exemptive Order addresses the reporting of certain PII to CAT on a going-forward basis. It does not address the existing footprint of PII reported to and stored by CAT since 2022. Due to regulatory record-keeping requirements, CAT currently must maintain this information. But the rationale for stopping the future reporting of PII applies equally to previously collected PII.

  CAT LLC’s proposal would delete previously reported PII from CAT.

• Reduce Costs. Because the Exemptive Order (1) did not cover all customer-identifying information, and (2) appears to be permissive (requiring CAT to maintain the capability to accept customer-identifying information), it will not by itself result in cost savings for CAT. 

  CAT LLC’s proposal would provide significant cost savings—estimated by CAT LLC to be up to $12 million per year. Viewed from a cost-benefit perspective, these cost savings further support approval of CAT LLC’s proposal.

CAT LLC’s proposal builds on the SEC’s Exemptive Order and further reduces the risks and costs associated with CAT. At the same time, the proposed modifications would preserve the core regulatory objectives of CAT, including providing regulators with the data they need to conduct ongoing and robust oversight of the markets and ensure they operate with integrity.8

FINRA supports approval of CAT LLC’s proposal and is committed to continuing to work with the SEC, the SROs and member firms to identify further opportunities to improve CAT.