Frequently Asked Questions

What is the Consolidated Audit Trail (CAT)?

The CAT is a comprehensive audit trail that will track orders throughout their lifecycle and identify the broker-dealers handling them, thus allowing regulators to more efficiently and accurately track activity in Eligible Securities throughout the U.S. markets. The CAT is being created by a joint plan (CAT NMS Plan) of the 20 national securities exchanges and FINRA (collectively the SROs). The CAT NMS Plan details the creation, implementation and management of the CAT. When complete, the CAT will be the world’s largest data repository for securities transactions tracking approximately 58 billion records of orders, executions, and quote life-cycles for equities and options markets on a daily basis. Broker-dealers will be required to report into the CAT all reportable order events, including quotes, orders, executions, and allocations, as well as customer data associated with these orders.

What steps are the SROs taking now that the CAT has been approved?

With the approval of the CAT NMS Plan, the SROs are focusing on the implementation of the CAT Central Repository. A Plan Processor to build and operate the Central Repository must be selected by January 15th 2017. SROs must begin reporting by November 15th 2017, large broker-dealers by November 15th 2018, and small broker-dealers by November 15th 2019.

What securities will need to be reported to the CAT?

Initially, the CAT NMS Plan will cover all NMS Securities (which includes NMS stocks and listed options) and OTC Equity Securities. Within six months after the effectiveness of the CAT NMS Plan, the SROs must outline how information with respect to equity securities that are not NMS Securities or OTC Equity Securities and debt securities, including Primary Market Transactions in securities that are not NMS Securities or OTC Equity Securities and debt securities, could be added to the CAT.

What orders are reportable?

SEC Rule 613 and the CAT NMS Plan define the term "order" as:

  • Any order received by a member of an SRO from any person;
  • Any order originated by a member of an SRO; and
  • Any bid or offer.
Who is required to report?

The SROs and all members of an SRO on a rolling basis:

  • By one year after the Plan becomes effective, all SROs.
  • By two years after the Plan becomes effective, all members of an SRO, except small broker-dealers, as defined in SEC Rule 0-10(c).
  • By three years after the Plan becomes effective, all SRO members that are small broker-dealers.
What is required to be reported to the CAT?

The following events in the lifecycle of an order must be reported to the CAT:

  • Receipt or origination;
  • Routing of an order to another broker-dealer, national securities exchange or foreign exchange;
  • Routing of an order between desks or departments within a broker-dealer;
  • Modifications;
  • Cancellations; and
  • Executions

In addition, certain Customer identifying information must be reported to the CAT.

What is the definition of "customer"under SEC Rule 613? Who is the "customer" for purposes of the CAT: the end customer, the introducing broker or the clearing broker?

SEC Rule 613 defines "customer" as:

  • The end customer is the ultimate customer, and Rule 613 defines that entity to be (i) the account holder(s) of the account at the broker-dealer originating the order and (ii) any person(s) from whom the broker-dealer is authorized to accept trading instructions for the account, if different from the account holder(s).
What is the "Customer-ID"?

SEC Rule 613 requires that the CAT include information on customers associated with orders.

Under the CAT NMS Plan, CAT Reporters will be required to report existing customer identifiers (i.e., a unique identifier for each trading account provided by each CAT Reporter for its customers)), along with certain customer identifying information. The Plan Processor will use this information to assign a Customer-ID to each customer, and to link all reportable order events associated with an order for a customer.

What customer information must be reported to the CAT?

SEC Rule 613 requires the reporting of "Customer Account Information" to the CAT, which includes the following:

  • Account number;
  • Account type;
  • Customer type;
  • Date account opened; and
  • Large Trader ID, if applicable.
  • Legal Entity Identifier, if available.

The Plan also requires the reporting of Customer Identifying Information, which includes, but is not limited to, (a) with respect to individuals: name, address, date of birth, individual tax payer identification number ("ITIN")/social security number ("SSN"), individual’s role in the account (e.g., primary holder, joint holder, guardian, trustee, person with the power of attorney); and (b) with respect to legal entities: name, address, Employer Identification Number ("EIN")/Legal Entity Identifier ("LEI") or other comparable common entity identifier, if applicable; provided, however, that an Industry Member that has an LEI for a Customer must submit the Customer’s LEI in addition to other information of sufficient detail to identify a Customer.

When must events be reported to the CAT?

Generally, order events must be reported by 8:00 a.m. ET on the trading day following the day the data was recorded. Certain data elements are not required to be reported until 8:00 a.m. ET on the trading day following the day the CAT Reporter receives the information.

What is the implementation timeline for the CAT?

CAT processor selected by NMS Plan Participants No later than two months after effectiveness of the approved CAT NMS Plan
Business clock synchronization for SROs and broker-dealers No later than four months after effectiveness of the approved CAT NMS Plan
SROs begin submitting data to the central repository Within one year after effectiveness of the approved CAT NMS Plan
SROs must implement enhanced surveillance using CAT data Within 14 months after effectiveness of the approved CAT NMS Plan
SRO members, except small members, must begin submitting data to the central repository Within two years after effectiveness of the approved NMS Plan
Small SRO members must begin submitting data to the central repository Within three years after effectiveness of the approved NMS Plan
Where can updated information regarding the NMS Plan process be found?

The SROs have established a dedicated website which will be updated to reflect the status of the NMS Plan process – www.catnmsplan.com.

How can I submit comments or questions about the NMS Plan or the CAT?

The SROs have established a dedicated email address to receive feedback from members of the public: feedback@catnmsplan.com.

Will any existing reporting systems be eliminated once the CAT is operational?

Rule 613 requires the SROs to analyze existing rules and systems to find and eliminate redundancies that may exist as a result of the CAT. Two systems that are of particular focus are OATS and Electronic Blue Sheets (EBS). The SROs have conducted gap analyses to identify data that must be captured by the CAT to facilitate retirement of these and other identified systems. Specific timelines for retirement of these, or other systems, have not been finalized and will depend upon the finalization of the Plan Processor’s technical requirements, as well as CAT Reporters meeting appropriate data submission error rates. A discussion of the SROs’ plans for the elimination of systems can be found in the CAT NMS Plan.\

OATS allows entities to submit data on someone else’s behalf. Will this be the same for the CAT?

The SROs currently anticipate that other parties will be able to submit information on behalf of CAT Reporters.

Will there be a single set of specifications for broker-dealers reporting to the CAT?

The Plan Processor will be responsible for developing detailed data and interface specifications for data to be submitted by CAT Reporters. CAT Reporters and data submitters will transmit data in an electronic data format(s) that will be defined by the Plan Processor. It is possible that more than one format will be defined to support the various senders throughout the industry.

Have the SROs considered tying the audit trail to clearing data?

Clearing is not within scope of SEC Rule 613. To minimize impact to CAT Reporters, the SROs will not be requiring clearing data to be submitted to the CAT.

With respect to reporting account and customer information to the CAT, have the SROs considered requiring submission only of changes to account and customer information, rather than requiring firms to resubmit the full data set on a daily basis?

The SROs anticipate that, following a firm’s initial submission of account and customer information to the CAT, just the changes would be sent to the CAT on a daily basis. However, periodic full customer data refreshes may be periodically required to help ensure the database remains accurate and current.

When error corrections are submitted, will the SROs require the full data set to be resubmitted or just the corrected errors?

The SROs are currently anticipating that only the error corrections will generally be required to be submitted after the full file has been submitted initially.

Will market surveillance be part of the CAT?

Market surveillance is performed by the SEC and the SROs. The CAT is not anticipated to include market surveillance tools as part of the solution provided by the selected Plan Processor. That said, the CAT will include tools to allow the SEC and the SROs to have the flexibility to run their own surveillance patterns against CAT data in the CAT or remove CAT data to run such patterns in house.

What is meant by preventing information leakage and preventing reverse engineering of an order?

In determining the best way to track an order throughout its entire lifecycle, the SROs are mindful that certain reporting methods could provide third parties with information about a particular order that they would not otherwise have. For example, if a single CAT-Order-ID approach is used and is passed from firm to firm with the order and a very large order is routed to various locations, the same CAT-Order-ID would be sent with every route. The use of a single CAT-Order-ID under these circumstances could potentially allow market participants to determine that there is a large underlying order.

For these reasons, and based on industry feedback and analysis conducted by the SROs, the CAT will utilize a "daisy chain" approach for the CAT-Order-ID framework whereby existing Order IDs will be used (as opposed to the single CAT-Order-ID approach referenced above).

Are the SROs considering any sort of phase-in approach beyond what is currently in Rule 613?

The SROs are evaluating accelerating the reporting requirements for all Small Industry Members that are OATS reporters to require them to begin reporting to the Central Repository two years after Plan approval when Large Industry Members are required to report.

When will the technical specifications be published?

Technical specifications will be developed by the Plan Processor once the Plan Processor is selected after the CAT NMS Plan is approved. The Participants believe that iterative interactions regarding the technical specifications would be beneficial in optimizing the efficiency and quality of the final technical specifications. Accordingly, Appendix C of the CAT NMS Plan, contemplates that the implementation schedule be designed to allow for the publication of iterative drafts of the technical specifications as needed before publishing the final document.

(a) Publication and Implementation of the Methods for Providing Information to the Customer-ID Database:

Milestone Projected Completion Date
Industry Members (other than Small Industry Member)
Plan Processor begins developing the procedures, connectivity requirements and Technical Specifications for Industry Members to Report Customer Account Information to the Central Repository No later than 15 months before Industry Members (other than Small Industry Members) are required to begin reporting data to the Central Repository
Plan Processor publishes iterative drafts of the procedures, connectivity requirements and Technical Specifications for Industry Members to Report Customer Account Information to the Central Repository As needed before publishing the final documents
Plan Processor publishes the procedures, connectivity requirements and Technical Specifications for Industry Members to report Customer Account Information to the Central Repository No later than 6 months before Industry Members (other than Small Industry Members) are required to begin reporting data to the Central Repository

(b) Submission of Order and MM Quote Data to Central Repository:

Milestone Projected Completion Date
Participants
Plan Processor begins developing Technical Specification(s) for Participant submission of order and MM Quote data No later than 10 months before Participants are required to begin reporting data to the Central Repository
Plan Processor publishes iterative drafts of Technical Specification(s) As needed before publishing the final documents
Plan Processor publishes Technical Specification(s) for Participant submission of order and MM Quote data No later than 6 months before Participants are required to begin reporting data to the Central Repository
Industry Members (other than Small Industry Member)
Plan Processor begins developing Technical Specification(s) for Industry Members submission of order data No later than 15 months before Industry Members (other than Small Industry Members) are required to begin reporting data to the Central Repository
Plan Processor publishes iterative drafts of Technical Specification(s) As needed before publishing of the final document
Plan Processor publishes Technical Specification(s) for Industry Member submission of order data No later than 1 year before Industry Members (other than Small Industry Members) are required to begin reporting data to the Central Repository
Will Options Clearing Corporation (OCC) data be included in the CAT?

As required by SEC Rule 613, the CAT NMS Plan sets forth a series of detailed objective milestones toward the implementation of the CAT, including the potential integration of other data. This data includes SIP quote and trade data, OPRA data, trade and quote information from Participants and reference data.

What are the timing accuracy requirements for orders?

All CAT Reporters must synchronize their Business Clocks at a minimum to within 50 milliseconds of the time maintained by NIST, with the exception of clocks used in Manual Order Events, which must be synced to within one second of the NIST clock. Each Participant shall other than such Business Clocks used solely for Manual Order Events, synchronize its Business Clocks at a minimum to within 100 microseconds of the time maintained by the NIST, consistent with industry standards. Reportable order events must be reported using a granularity of one millisecond, with the exception of Manual Order Events, which must be reported with a granularity of one second. To the extent that firms capture data in granularity finer than these requirements, they must report using that finer granularity.

Will introducing brokers have to report to the CAT or can they rely on their clearing firms?

The CAT has no exemptions for small firms or firms that route all orders to a single clearing firm like OATS has today, so all members, including introducing brokers, will have reporting obligations. However, it is anticipated that introducing brokers may contract with their clearing firms or other vendors to transmit CAT data on the introducing broker’s behalf.

Will the Legal Entity Identifier (LEI) system be integrated into the Customer-ID approach?

It is required that CAT Reporters report LEIs to the extent that: (1) their customers already have an LEI; and (2) they already collect LEIs from their customers. No CAT Reporters will be required to have their customers obtain or otherwise report an LEI as part of the CAT.

Would the SROs be willing to consider linking sub-account allocations by Customer-ID rather than CAT-Order-ID?

Under the CAT NMS Plan, allocations will not be tied to specific executions. Allocation reports will include, at a minimum, the number of shares allocated, the firm-designated identifier of the entity to which shares are allocated, the Firm Designated ID of any subaccounts to which the shares are allocated, and the time of allocation. Firms will not be required to identify the specific execution(s) that may make up the allocation.

Do the SROs have a group currently working on funding issues?

Yes. The Cost and Funding Subcommittee has been working on funding issues and will continue to do so under the guidance of the Operating Committee.

Has any thought been given to building the CAT in a way that can pay for itself? The data that is required to be submitted is very valuable and could be sold to firms themselves or issuers/investors/trading system designers. If CAT data could be sanitized to address privacy concerns, this could eliminate the cost burden on the industry.

Rule 613 states that the data will be available for use for regulatory purposes only by the SRO regulatory staff and the SEC.

Who will evaluate bids and select the winning Bidder?

A Selection Committee comprised of the SROs that are the CAT NMS Plan Participants, subject to certain recusal provisions, has been evaluating the bids and will be selecting the winning Bidder. The process the SROs have developed to review bids and select a Plan Processor for the CAT is set forth in the CAT NMS Plan and was previously established in a CAT NMS Selection Plan approved by the SEC.

Will bidding SROs have to recuse themselves from the Selection Committee?

Per the Selection Plan and the CAT NMS Plan, Bidding SROs must recuse themselves from any Selection Committee votes.

Will submitted bids be made public?

No, submitted bids will not be made public.

Have the SROs decided how the CAT will be funded?

The SROs have proposed a tiered fixed fee funding model in the filed CAT NMS Plan, which aligns with the funding principles adopted by the Participants. This model establishes tiers of fixed fees based on message volume for broker-dealers (other than ATSs) and market share for Execution Venues. A pre-determined percentage of the CAT’s costs will be charged to each tier. CAT Reporters will be billed by a new CAT utility that will handle all financial aspects of the CAT. The Participants understand that the details regarding the tiers and the related fees are important considerations in the funding model and thus, are actively developing the tiers and other aspects of the funding model.

How will the SROs enforce parties that do not contribute or fall in arrears?

Each SRO may adopt a CAT fee rule which would provide for procedures if parties fail to make CAT payments.

Is a reserve fund being set up to provide a cushion and to ensure that CAT expenses are met while fees are being collected? Who is contributing to that fund and how much?

The CAT NMS Plan anticipates that the CAT LLC will establish an operational reserve funded by CAT Fees.

What are the requirements for accessing historical data? Is five years of data expected to be available online or can it be held offline?

SEC Rule 613 requires CAT data to be available and searchable without manual intervention for a minimum period of five years. Broker-dealers are currently required to retain data for six years under the Exchange Act. The Plan Processor will be required to keep all data in the central repository, which will be hosted in the cloud. The CAT is not intended to and will not relieve Broker-Dealers from their existing record-keeping obligations.

Will a participants’ or CAT Reporters’ CAT data be made available to that participant via bulk download?

In addition to targeted analysis of data from the Central Repository, Participants and other regulators will need the ability to do bulk extraction and download of data, based on a specified date or time range, market, security, and Customer-ID. The Plan Processor must provide for bulk extraction and download of data in industry standard formats.

The SROs are supportive of allowing CAT Reporters access to their submitted data, and will work with the Plan Processor to determine the feasibility of this after the CAT is operational.

Will there be third-party auditing requirements to make sure the CAT is working properly?

As required by the CAT NMS Plan, CATLLC is required to retain an appropriately qualified independent auditor of national recognition (subject to the approval of the Operating Committee by Supermajority Vote, the "Independent Auditor") and, in collaboration with such Independent Auditor, create and implement an annual audit plan (subject to the approval of the Operating Committee) which shall at a minimum include a review of all Plan Processor policies, procedures and control structures.

Additionally, Data Centers housing CAT Systems (whether public or private) must, at a minimum, be AICPA SOC 2 certified by a qualified third-party auditor that is not an affiliate of any of the Participants or the CAT Processor. The frequency of the audit must be at least once per year.

Will the CAT be a standalone legal entity?

The CAT will be structured as an LLC and intends to operate in a manner such that it qualifies as a "business league" within the meaning of Section 501(c) (6) of the Internal Revenue Code.

Will the CAT processor be in a position to enforce a standard for data interfaces?

The CAT Plan Processor will be responsible for developing uniform detailed data and interface specifications for the CAT data submissions that will be presented to the CAT NMS Plan Participants for approval. CAT Reporters will be required to submit data to the CAT in accordance with these uniform interface and technical specifications.

Are you going to publish usage statistics?

The Plan Processor will maintain records of usage statistics to identify trends and processing peaks. Once in effect, the Operating Committee will make the decision regarding publishing any usage statistics.

Do we have any information as to what the SEC’s needs are with respect to accessing the CAT data (e.g., how many users)?

The SROs anticipate there will be approximately 3,000 authorized users that will have access to CAT data, including SRO regulatory staff and SEC staff. It is expected that significantly fewer users will have access to personally identifiable information (PII) associated with customers and accounts.

Will the CAT data be expected to feed into the surveillance systems that the SROs already have in place?

Scheduled standard data extracts would be available to the SROs for use in their surveillance systems.

Will the SROs need access to uncorrected data for surveillance?

Uncorrected data must be maintained and made available to SRO regulatory staff and the SEC upon request.

Will surveillance be done from a customer perspective or an order perspective?

Surveillance will be the responsibility of each SRO or the SEC, who may perform surveillances from either or both customer and order perspectives.

The CAT processor will be holding Customer IDs. Each account might be associated with multiple Customer IDs, so is it the responsibility of the processor to handle all the Customer IDs?

Yes, the CAT must capture and store all Customer IDs associated with an account. The Plan Processor is responsible for maintaining these IDs, but CAT Reporters will be responsible for reporting and maintaining the accuracy of their existing unique Customer IDs.

Many firms currently reuse account numbers. Will the CAT be expected to identify if an account number has been reused?

The SROs have discussed this and will be using an effective date to determine when account numbers have been reused. The CAT Reporters will ensure that account numbers are not reused (or active) on the same day.

Do you plan to share information about the governance process and Advisory Committee?

The CAT governance structure, including an Advisory Committee, is defined in the CAT NMS Plan. The Advisory Committee will be a key mechanism for the SROs and the Plan Processor to obtain input and feedback from the industry on a number of CAT-related issues. The composition of the Advisory Committee will include:

  • A broker-dealer with no more than 150 Registered Persons
  • A broker-dealer with at least 151 and no more than 499 Registered Persons
  • A broker-dealer with 500 or more Registered Persons
  • A broker-dealer with a substantial wholesale customer base
  • A broker-dealer that is approved by a national securities exchange (A) to effect transactions on an exchange as a specialist, market maker, or floor broker or (B) to act as an institutional broker on an exchange
  • A proprietary-trading broker-dealer
  • A clearing firm
  • An individual who maintains a securities account with a registered broker or dealer but who otherwise has no material business relationship with a broker or dealer or with a Participant
  • A member of academia with expertise in the securities industry or any other industry relevant to the operation of the CAT System
  • Three institutional investors, including an individual trading on behalf of an investment company or group of investment companies registered pursuant to the Investment Company Act of 1940/li>
  • An individual with significant and reputable regulatory expertise
  • A service bureau that provides reporting services to one or more CAT Reporters
Is it still anticipated that market maker quotes be included for submission?

Under the CAT NMS Plan, options market maker quotes will be submitted by exchanges on behalf of options market makers—options market makers will not need to separately report these quotes. Equity market makers will still need to report their quotes.

With regard to surveillance systems running on the CAT, do the SROs anticipate being able to reconstruct the market via the CAT?

The CAT will not be expected to perform market reconstructions, however the data captured by the CAT will be used by SRO regulatory staff and the SEC in performing regulatory analysis and reconstruction of market events.

If the Plan Processor selected is also a Participant, how will payments and funding work?

The Plan Processor, regardless of whether it is a Participant, will be responsible for developing and executing administrative processes and procedures to ensure the smooth functioning of the CAT. These processes and procedures would include, but are not limited to, establishing transparent budget, notice, billing and collection processes.

What steps are being taken to ensure that the CAT is secure given heightened cybersecurity concerns?

The SROs recognize the importance of securing the CAT, and this has been a large focus of their interactions with Bidders. The CAT NMS Plan describes a comprehensive security structure for the CAT, notably requiring the Plan Processor to adopt all relevant standards from the NIST Cyber Security Framework, NIST 800.53 or ISO 27001 that would be appropriate to apply to the Plan Processor. Moreover, because industry standards may evolve over time, the Participants will require that the CAT’s security program align with current industry standards and best practices as they evolve in the future. To this end, the Plan requires that the Plan Processor’s information security program be reviewed at least annually by the Operating Committee.

When can we expect to hear who the winning bidder is? Are the SROs going to use the full two months to name the winning Processor?

The SROs must select the Plan Processor within two months of the CAT NMS Plan Approval, and will provide notice as to the winning Bidder as soon as possible. The SROs are not able to share any specific timeline beyond the two month requirement of Rule 613.