---------------------------------------------------------------------------

    \294\ Id. at Section 11.1(a).
    \295\ Id.
---------------------------------------------------------------------------

    Subject to certain funding principles set forth in Article XI, the
Operating Committee will have discretion to establish funding for the
Company, including: (1) Establishing fees that the Participants will
pay; and (2) establishing fees for Industry Members that will be
implemented by Participants.\296\ In establishing the funding of the
Company, the Operating Committee will seek to: (1) Create transparent,
predictable revenue streams for the Company that are aligned with the
anticipated costs to build, operate and administer the CAT and the
other costs of the Company; (2) establish an allocation of the
Company's related costs among Participants and Industry Members that is
consistent with the Exchange Act, taking into account the timeline for
implementation of the CAT and distinctions in the securities trading
operations of Participants and Industry Members and their relative
impact upon Company resources and operations; (3) establish a tiered
fee structure in which the fees charged to: (a) CAT Reporters that are
Execution Venues, including Alternative Trading Systems (``ATSs''), are
based upon the level of market share, (b) Industry Members' non-ATS
activities are based upon message traffic, and (c) the CAT Reporters
with the most CAT-related activity (measured by market share and/or
message traffic, as applicable) are generally comparable (where, for
these comparability purposes, the tiered fee structure takes into
consideration affiliations between or among CAT Reporters, whether
Execution Venues and/or Industry Members); (4) provide for ease of
billing and other administrative functions; (5) avoid any disincentives
such as placing an inappropriate burden on competition and a reduction
in market quality; and (6) build financial stability to support the
Company as a going concern.\297\ The Participants will file with the
SEC under Section 19(b) of the Exchange Act any such fees on Industry
Members that the Operating Committee approves, and such fees will be
labeled as ``Consolidated Audit Trail Funding Fees.'' \298\
---------------------------------------------------------------------------

    \296\ Id. at Section 11.1(b).
    \297\ Id. at Section 11.2.
    \298\ Id. at Section 11.1(b).
---------------------------------------------------------------------------

    To fund the development and implementation of the CAT, the Company
will time the imposition and collection of all fees on Participants and
Industry Members in a manner reasonably related to the timing when the
Company expects to incur such development and implementation
costs.\299\ In determining fees for Participants and Industry Members,
the Operating Committee shall take into account fees, costs and
expenses (including legal and consulting fees and expenses) incurred by
the Participants on behalf of the Company prior to the Effective Date
in connection with the creation and implementation of the CAT, and such
fees, costs and expenses shall be fairly and reasonably shared among
the Participants and Industry Members.\300\ Consistent with Article XI,
the Operating Committee will adopt policies, procedures, and practices
regarding the budget and budgeting process, assignment of tiers,
resolution of disputes, billing and collection of fees, and other
related matters.\301\ As a part of its regular review of fees for the
CAT, the Operating Committee will have the right to change the tier
assigned to any particular Person pursuant to this Article XI.\302\ Any
such changes will be effective upon reasonable notice to such
Person.\303\
---------------------------------------------------------------------------

    \299\ Id. at Section 11.1(c).
    \300\ Id.
    \301\ Id. at Section 11.1(d).
    \302\ The Commission notes that Section 11.1(b) of the CAT NMS
Plan states that the Participants would file fees for Industry
Members approved by the Operating Committee with the Commission. The
Operating Committee may only change the tier to which a Person is
assigned in accordance with a fee schedule filed with the
Commission.
    \303\ See CAT NMS Plan, supra note 5, at Section 11.1(d).
---------------------------------------------------------------------------

    The Operating Committee will establish fixed fees to be payable by
Execution Venues as follows. Each Execution Venue that executes
transactions, or, in the case of a national securities association, has
trades reported by its members to its trade reporting facility or
facilities for reporting transactions effected otherwise than on an
exchange, in NMS Stocks or OTC Equity Securities will pay a fixed fee
depending on the market share of that Execution Venue in NMS

Stocks and OTC Equity Securities.\304\ The Operating Committee will
establish at least two and no more than five tiers of fixed fees, based
on an Execution Venue's NMS Stocks and OTC Equity Securities market
share.\305\ For these purposes, market share will be calculated by
share volume.\306\ In addition, each Execution Venue that executes
transactions in Listed Options will pay a fixed fee depending on the
Listed Options market share of that Execution Venue.\307\ The Operating
Committee will establish at least two and no more than five tiers of
fixed fees, based on an Execution Venue's Listed Options market share,
with market share calculated by contract volume.\308\ Changes to the
number of tiers after approval of the Plan would require a
Supermajority Vote of the Operating Committee and Commission approval
under Section 19(b) of the Exchange Act, as would the establishment of
the initial fee schedule and any changes to the fee schedule within the
tier structure.\309\
---------------------------------------------------------------------------

    \304\ Id. at Section 11.3(a)(i).
    \305\ Id.
    \306\ Id.
    \307\ Id. at Section 11.3(a)(ii).
    \308\ Id.
    \309\ The Commission notes that the Participants could choose to
submit the proposed fee schedule to the Commission as individual
SROs pursuant to Rule 19b-4 or jointly as Participants to an NMS
plan pursuant to Rule 608 of Regulation NMS. Because the proposed
fee schedule would establish fees, whether the Participants
individually file it pursuant to Section 19(b)(3)(A)(ii) of the Act,
or jointly file it pursuant to Rule 608(b)(3)(i) of Regulation NMS,
the proposed fee schedule could take effect upon filing with the
Commission. See 15 U.S.C. 78s(b)(3)(A)(ii); 17 CFR 242.608(b)(3)(i);
see also Section IV.F, infra.
---------------------------------------------------------------------------

    The Operating Committee also will establish fixed fees payable by
Industry Members, based on the message traffic generated by such
Industry Member.\310\ The Operating Committee will establish at least
five and no more than nine tiers of fixed fees, based on message
traffic.\311\ For the avoidance of doubt, the fixed fees payable by
Industry Members pursuant to this paragraph will, in addition to any
other applicable message traffic, include message traffic generated by:
(1) An ATS that does not execute orders that is sponsored by such
Industry Member; and (2) routing orders to and from any ATS system
sponsored by such Industry Member.\312\
---------------------------------------------------------------------------

    \310\ See CAT NMS Plan, supra note 5, at Section 11.3(b).
    \311\ Id.
    \312\ Id.
---------------------------------------------------------------------------

    Furthermore, the Operating Committee may establish any other fees
ancillary to the operation of the CAT that it reasonably determines
appropriate, including: fees for the late or inaccurate reporting of
information to the CAT; fees for correcting submitted information; and
fees based on access and use of the CAT for regulatory and oversight
purposes (and not including any reporting obligations).\313\
---------------------------------------------------------------------------

    \313\ As it relates to fees that the Operating Committee may
impose for access and use of the CAT for regulatory and oversight
purposes, the Commission interprets the provisions in the Plan
relating to the collection of fees as applying only to Participants
and Industry Members, and thus the Commission would not be subject
to such fees. See Section IV.F, infra, for further discussion
regarding the funding of the Company.
---------------------------------------------------------------------------

    The Company will make publicly available a schedule of effective
fees and charges adopted pursuant to the Plan as in effect from time to
time.\314\ Such schedule will be developed after the Plan Processor is
selected.\315\ The Operating Committee will review the fee schedule on
at least an annual basis and will make any changes to such fee schedule
that it deems appropriate.\316\ The Operating Committee is authorized
to review the fee schedule on a more regular basis, but will not make
any changes on more than a semi-annual basis unless, pursuant to a
Supermajority Vote, the Operating Committee concludes that such change
is necessary for the adequate funding of the Company.\317\
---------------------------------------------------------------------------

    \314\ See CAT NMS Plan, supra note 5, at Section 11.3(d).
    \315\ Id.
    \316\ Id.; see also supra note 309.
    \317\ Id.
---------------------------------------------------------------------------

    The Operating Committee will establish a system for the collection
of fees authorized under the Plan.\318\ The Operating Committee may
include such collection responsibility as a function of the Plan
Processor or another administrator.\319\ Alternatively, the Operating
Committee may use the facilities of a clearing agency registered under
Section 17A of the Exchange Act to provide for the collection of such
fees.\320\
---------------------------------------------------------------------------

    \318\ Id. at Section 11.4.
    \319\ Id.
    \320\ Id.
---------------------------------------------------------------------------

    Each Participant will require each Industry Member to pay all
applicable fees authorized under Article XI within thirty days after
receipt of an invoice or other notice indicating payment is due (unless
a longer payment period is otherwise indicated).\321\ If an Industry
Member fails to pay any such fee when due, such Industry Member will
pay interest on the outstanding balance from such due date until such
fee is paid at a per annum rate equal to the lesser of: (1) The Prime
Rate plus 300 basis points; or (2) the maximum rate permitted by
applicable law.\322\ Each Participant will pay all applicable fees
authorized under Article XI as required by Section 3.7(b).\323\
---------------------------------------------------------------------------

    \321\ Id.
    \322\ Id.
    \323\ Id.
---------------------------------------------------------------------------

    Disputes with respect to fees the Company charges Participants
pursuant to Article XI will be determined by the Operating Committee or
a Subcommittee designated by the Operating Committee.\324\ Decisions by
the Operating Committee on such matters shall be binding on
Participants, without prejudice to the rights of any Participant to
seek redress from the SEC pursuant to SEC Rule 608 or in any other
appropriate forum.\325\ The Participants will adopt rules requiring
that disputes with respect to fees charged to Industry Members pursuant
to Article XI be determined by the Operating Committee or a
Subcommittee.\326\ Decisions by the Operating Committee or Subcommittee
on such matters will be binding on Industry Members, without prejudice
to the rights of any Industry Member to seek redress from the SEC
pursuant to SEC Rule 608 or in any other appropriate forum.\327\
---------------------------------------------------------------------------

    \324\ Id. at Section 11.5.
    \325\ Id.
    \326\ Id.
    \327\ Id.
---------------------------------------------------------------------------

7. Amendments

    Section 12.3 of the CAT NMS Plan, which governs amendments to the
Plan, states that, except with respect to the addition of new
Participants (Section 3.3), the transfer of Company Interest (Section
3.4), the termination of a Participant's participation in the Plan
(Section 3.7), amendments to the Selection Plan (Section 5.3 [sic]) and
special allocations (Section 8.2), any change to the Plan requires a
written amendment authorized by the affirmative vote of not less than
two-thirds of all of the Participants, or with respect to Section 3.8
by the affirmative vote of all the Participants.\328\ Such proposed
amendment must be approved by the Commission pursuant to Rule 608 or
otherwise becomes effective under Rule 608.\329\ Notwithstanding the
foregoing, to the extent that the Commission grants exemptive relief
applicable to any provision of the LLC Agreement, Participants and
Industry Members will be entitled to comply with such provision
pursuant to the terms of the exemptive relief so granted at the time
such relief is granted irrespective of whether the LLC Agreement has
been amended.\330\
---------------------------------------------------------------------------

    \328\ Id. at Section 12.3.
    \329\ Id.
    \330\ Id.

---------------------------------------------------------------------------

8. Compliance Rule Applicable to Industry Members

    Under Article III, each Participant agrees to comply with and
enforce compliance by its Industry Members with the provisions of Rule
613 and the Plan, as applicable, to the Participant and its Industry
Members.\331\ Accordingly, the Participants will endeavor to promulgate
consistent rules (after taking into account circumstances and
considerations that may impact Participants differently) requiring
compliance by their respective Industry Members with the provisions of
Rule 613 and the Plan.\332\
---------------------------------------------------------------------------

    \331\ Id. at Section 3.11.
    \332\ Id.
---------------------------------------------------------------------------

9. Plan Appendices

    The Plan includes three appendices.\333\ Appendix A provides the
Consolidated Audit Trail National Market System Plan Request for
Proposal, as issued February 26, 2013 and subsequently updated. In
addition, Rule 613(a)(1) requires that the Plan discuss twelve
considerations that explain the choices made by the Participants to
meet the requirements specified in Rule 613 for the CAT. In accordance
with this requirement, the Participants have addressed each of the
twelve considerations in Appendix C. Finally, Appendix D describes the
technical requirements for the Plan Processor.
---------------------------------------------------------------------------

    \333\ Appendix B is reserved for future use.
---------------------------------------------------------------------------

    As mentioned, Appendix C discusses the various ``considerations''
regarding how the Participants propose to develop and implement the CAT
required to be discussed by Rule 613.\334\ These considerations,
include: (i) The reporting of data to the Central Repository, including
the sources of the data and the manner in which the Central Repository
will receive, extract, transform, load, and retain the data; (ii) the
time and method by which the data in the Central Repository will be
made available to regulators; (iii) the reliability and accuracy of the
data reported to and maintained by the Central Repository throughout
its lifecycle; (iv) the security and confidentiality of the information
reported to the Central Repository; (v) the flexibility and scalability
of the systems used by the Central Repository to collect, consolidate
and store CAT Data; (vi) the feasibility, benefits and costs of broker-
dealers reporting certain information to the CAT in a timely manner;
(vii) an analysis of expected benefits and estimated costs for
creating, implementing, and maintaining the CAT pursuant to the
proposed CAT NMS Plan; (viii) an analysis of the proposed CAT NMS
Plan's impact on competition, efficiency, and capital formation; (ix) a
plan to eliminate rules and systems that will be rendered duplicative
by the CAT; (x) objective milestones to assess progress toward the
implementation of the proposed CAT NMS Plan; (xi) the process by which
Participants solicited views of members and other parties regarding
creation, implementation, and maintenance of CAT and a summary of these
views and how the Participants took them into account in preparing the
CAT NMS Plan; and (xii) a discussion of reasonable alternative
approaches that the Participants considered to create, implement, and
maintain the CAT.\335\
---------------------------------------------------------------------------

    \334\ 17 CFR 242.613(a).
    \335\ See CAT NMS Plan, supra note 5, at Appendix C, Sections
A.1-6, B.7-8, C.9-10.
---------------------------------------------------------------------------

    The technical requirements discussed in Appendix D to the CAT NMS
Plan, CAT NMS Plan Processor Requirements, include an outline of
minimum functional and technical requirements established by the
Participants of the CAT NMS Plan for the Plan Processor. Appendix D
provides the Plan Processor with details and guidelines for compliance
with the requirements contained in Article VI that are not expressly
stated therein.
    Appendix D also outlines technical architecture, capacity and data
retention requirements for the Central Repository,\336\ as well as
describes the types of data that would be reported to the Central
Repository and the sources of such information.\337\ The Appendix
outlines specific requirements relating to reporting data, linking
data, validating and processing data and timing for availability to
regulators.\338\ Appendix D further discusses how regulators would be
able to access and use the data.\339\ It also provides requirements
related to data security, and specific requirements governing how
Customer and Customer Account Information must be captured and stored,
separate from transactional data.\340\ Appendix D outlines requirements
for the Plan Processor's disaster recovery and business continuity
plans.\341\ Finally, Appendix D describes plans for technical,
operational, and business support to CAT Reporters for all aspects of
reporting, and describes how upgrades and new functionality would be
incorporated.\342\
---------------------------------------------------------------------------

    \336\ Id. at Appendix D, Sections 1.1, 1.3-1.4.
    \337\ Id. at Appendix D, Section 2.1.
    \338\ Id. at Appendix D, Sections 3, 6.1-6.2, 7.2.
    \339\ Id. at Appendix D, Section 8.1.
    \340\ Id. at Appendix D, Sections 4.1, 9.1.
    \341\ Id. at Appendix D, Sections 5.3-5.4.
    \342\ Id. at Appendix D, Sections 10, 11.
---------------------------------------------------------------------------

10. Reporting Procedures

    The CAT NMS Plan requires CAT Reporters to comply with specific
reporting procedures when reporting CAT Data to the Central
Repository.\343\ Specifically, CAT Reporters must format CAT Data to
comply with the format specifications approved by the Operating
Committee.\344\ CAT Reporters must record CAT Data contemporaneously
with the applicable Reportable Event \345\ and report such data to the
Central Repository by 8:00 a.m. ET on the next Trading Day.\346\ The
obligation to report CAT Data applies to ``each NMS Security registered
or listed for trading on [a national securities] exchange or admitted
to unlisted trading privileges on such exchange,'' and ``each Eligible
Security for which transaction reports are required to be submitted to
such [national securities] association.'' \347\ Further, the
Participants are required to adopt Compliance Rules \348\ that require
Industry Members, subject to their SRO jurisdiction, to report CAT
Data.\349\
---------------------------------------------------------------------------

    \343\ Id. at Sections 6.3-6.4; Appendix D, at Section 2.1.
    \344\ Id. at Sections 6.3(a), 6.4(a). The CAT NMS Plan also
requires that the Operating Committee-approved format must be a
format specified by the Plan Processor and Rule 613 compliant.
    \345\ Id. at Sections 6.3(b)(i), 6.4(b)(i).
    \346\ Id. at Sections 6.3(b)(ii); 6.4(b)(ii); Appendix C,
Section A.1(a)(ii). Participants may voluntarily report CAT Data
prior to the 8:00 a.m. ET deadline. Id. The CAT NMS Plan defines
``Trading Day'' as the date ``as is determined by the Operating
Committee.'' The CAT NMS Plan also provides that ``the Operating
Committee may establish different Trading Days for NMS Stocks (as
defined in SEC Rule 600(b)(47), Listed Options, OTC Equity
Securities, and any other securities that are included as Eligible
Securities from time to time.'') Id. at Section 1.1.
    \347\ See CAT NMS Plan, supra note 5, at Sections 6.3(c)(i)-
(ii), 6.4(c)(i)-(ii).
    \348\ The CAT NMS Plan defines the ``Compliance Rule'' to mean
``with respect to a Participant, the rules promulgated by such
Participant as contemplated by Section 3.11.'' Id. at Section 1.1.
Section 3.11 of the CAT NMS Plan provides that ``each Participant
shall comply with and enforce compliance, as required by SEC Rule
608(c), by its Industry Members with the provisions of SEC Rule 613
and of [the LLC Agreement], as applicable, to the Participant and
its Industry Members. The Participants shall endeavor to promulgate
consistent rules (after taking into account circumstances and
considerations that may impact Participants differently) requiring
compliance by their respective Industry Members with the provisions
of SEC Rule 613 and [the LLC Agreement].'' Id. at Section 3.11.
    \349\ See id. at Section 6.4(c)(i)-(ii).
---------------------------------------------------------------------------

    The CAT NMS Plan requires specific data elements of CAT Data that
must be recorded and reported to the Central Repository upon: (i)
``original receipt or

origination of an order,'' \350\ (ii) ``routing of an order,'' \351\
and (iii) ``receipt of an order that has been routed.'' \352\
Additionally, the CAT NMS Plan requires that a CAT Reporter must record
and report data related to an ``order [that] is modified or
cancelled,'' \353\ and an ``order [that] is executed, in whole or in
part,'' \354\ as well as ``other information or additional events as
may be prescribed in Appendix D, Reporting and Linkage Requirements.''
\355\ The CAT NMS Plan also requires Industry Member CAT Reporters to
report additional data elements for (i) an ``order [that] is executed,
in whole or in part,'' \356\ (ii) a ``trade [that] is cancelled,''
\357\ or (iii) ``original receipt or origination of an order.'' \358\
Further, each Participant shall, through Compliance Rules, require
Industry Members to record and report to the Central Repository
information or additional events as may be prescribed to accurately
reflect the complete lifecycle of each Reportable Event.\359\
---------------------------------------------------------------------------

    \350\ For ``original receipt or origination of an order,'' the
CAT NMS Plan specifies the following data elements: (i) Firm
Designated ID(s) for each Customer; (ii) CAT-Order-ID; (iii) SRO-
Assigned Market Participant Identifier of the Industry Member
receiving or originating the order; (iv) date of order receipt or
origination; (v) time of order receipt or origination (using
timestamps pursuant to Section 6.8 of the CAT NMS Plan); and (vi)
Material Terms of the Order. Id. at Section 6.3(d)(i).
    \351\ For ``routing of an order,'' the CAT NMS Plan specifies
the following data elements: (i) CAT-Order-ID; (ii) date on which
the order is routed; (iii) time at which the order is routed (using
timestamps pursuant to Section 6.8 of the CAT NMS Plan); (iv) SRO-
Assigned Market Participant Identifier of the Industry Member or
Participant routing the order; (v) SRO-Assigned Market Participant
Identifier of the Industry Member or Participant to which the order
is being routed; (vi) if routed internally at the Industry Member,
the identity and nature of the department or desk to which the order
is routed; and (vii) Material Terms of the Order. Id. at Section
6.3(d)(ii).
    \352\ For ``receipt of an order that has been routed,'' the CAT
NMS Plan specifies the following data elements: (i) CAT-Order-ID;
(ii) date on which the order is received; (iii) time at which the
order is received (using timestamps pursuant to Section 6.8); (iv)
SRO-Assigned Market Participant Identifier of the Industry Member or
Participant receiving the order; (v) SRO-Assigned Market Participant
Identifier of the Industry Member or Participant routing the order;
and (vi) Material Terms of the Order. Id. at Section 6.3(d)(iii).
    \353\ For an ``order [that] is modified or cancelled,'' the CAT
NMS Plan specifies the following data elements: (i) CAT-Order-ID;
(ii) date the modification or cancellation is received or
originated; (iii) time at which the modification or cancellation is
received or originated (using timestamps pursuant to Section 6.8 of
the CAT NMS Plan); (iv) price and remaining size of the order, if
modified; (v) other changes in the Material Terms of the Order, if
modified; and (vi) whether the modification or cancellation
instruction was given by the Customer or was initiated by the
Industry Member or Participant. Id. at Section 6.3(d)(iv).
    \354\ For an ``order [that] is executed, in whole or in part,''
the CAT NMS Plan specifies the following data elements: (i) CAT-
Order-ID; (ii) date of execution; (iii) time of execution (using
timestamps pursuant to Section 6.8 of the CAT NMS Plan); (iv)
execution capacity (principal, agency or riskless principal); (v)
execution price and size; (vi) SRO-Assigned Market Participant
Identifier of the Participant or Industry Member executing the
order; and (vii) whether the execution was reported pursuant to an
effective transaction reporting plan or the Plan for Reporting of
Consolidated Options Last Sale Reports and Quotation Information.
Id. at Section 6.3(d)(v).
    \355\ See id. at Section 6.3(d)(vi).
    \356\ For an ``order [that] is executed, in whole or in part,''
the CAT NMS Plan specifies the following additional data elements:
(i) an Allocation Report; (ii) SRO-Assigned Market Participant
Identifier of the clearing broker or prime broker, if applicable;
and (iii) CAT-Order-ID of any contra-side order(s). Id. at Section
6.4(d)(ii)(A).
    \357\ For a ``trade [that] is cancelled,'' the CAT NMS Plan
specifies the following additional data element: a cancelled trade
indicator. Id. at Section 6.4(d)(ii)(B).
    \358\ For ``original receipt or origination of an order,'' the
CAT NMS Plan specifies the following additional data element(s): the
Firm Designated ID, Customer Account Information, and Customer
Identifying Information for the relevant Customer. Id. at Section
6.4(d)(ii)(C).
    \359\ Id. at Appendix D, Section 3.
---------------------------------------------------------------------------

11. Timeliness of Data Reporting

    Section 6.3(b)(ii) of the CAT NMS Plan requires each Participant to
report Participant Data to the Central Repository by 8:00 a.m. ET on
the Trading Day following the day the Participant records such
data.\360\ Additionally, a Participant may voluntarily report such data
prior to this deadline.\361\ Section 6.4(b)(ii) states that each
Participant shall, through its Compliance Rule, require its Industry
Members to report Recorded Industry Member Data to the Central
Repository by 8:00 a.m. ET on the Trading Day following the day the
Industry Member records such data, and Received Industry Member Data to
the Central Repository by 8:00 a.m. ET on the Trading Day following the
day the Industry Member receives such data.\362\ Section 6.4(b)(ii) of
the CAT NMS Plan also states that each Participant shall, through its
Compliance Rule, permit its Industry Members to voluntarily report such
data prior to the applicable 8:00 a.m. ET deadline.\363\
---------------------------------------------------------------------------

    \360\ Id. at Section 6.3(b)(ii); see also id. at Appendix C,
Section A.1(a)(ii); Appendix D, Sections 3.1, 6.1.
    \361\ Id. at Section 6.3(b)(ii).
    \362\ Id. at Section 6.4(b)(ii).
    \363\ Id.
---------------------------------------------------------------------------

12. Uniform Format

    The CAT NMS Plan does not mandate the format in which data must be
reported to the Central Repository.\364\ Appendix D states that the
Plan Processor will determine the electronic format in which data must
be reported, and that the format will be described in the Technical
Specifications.\365\ Appendix C specifies that CAT Reporters could be
required to report data either in a uniform electronic format, or in a
manner that would allow the Central Repository to convert the data to a
uniform electronic format, for consolidation and storage.\366\
Similarly, Sections 6.3(a) and 6.4(a) of the CAT NMS Plan require that
CAT Reporters report data to the Central Repository in a format or
formats specified by the Plan Processor, approved by the Operating
Committee, and compliant with Rule 613.\367\
---------------------------------------------------------------------------

    \364\ Id. at Appendix C, Section D.12(f); see also id. at
Appendix C, Section A.1(a).
    \365\ Id. at Appendix D, Section 2.1. Appendix D states that
more than one format may be allowed to support the various market
participants that would report information to the Central
Repository. Id.; see also id. at Section 6.9.
    \366\ Id. at Appendix C, Section A.1(b).
    \367\ Id. at Sections 6.3(a), 6.4(a).
---------------------------------------------------------------------------

    The CAT NMS Plan requires that data reported to the Central
Repository be stored in an electronic standard format.\368\
Specifically, Section 6.5(b)(i) of the CAT NMS Plan requires the
Central Repository to retain the information collected pursuant to Rule
613(c)(7) and (e)(7) in a convenient and usable standard electronic
data format that is directly available and searchable electronically
without any manual intervention by the Plan Processor for a period of
not less than six (6) years.\369\ Such data must be linked when it is
made available to the Participant's regulatory Staff and the
Commission.\370\
---------------------------------------------------------------------------

    \368\ Pursuant to the Plan, for data consolidation and storage,
as noted above, such data must be reported in a uniform electronic
format or in a manner that would allow the Central Repository to
convert the data to a uniform electronic format. Id. at Appendix C,
Section A.1(b).
    \369\ Id. at Section 6.5(b)(i).
    \370\ Id.
---------------------------------------------------------------------------

13. Symbology

    The CAT NMS Plan also addresses the symbology that CAT Reporters
must use when reporting CAT Data. The CAT NMS Plan requires CAT
Reporters to report data using the listing exchange's symbology. The
CAT NMS Plan requires the Plan Processor to create and maintain a
symbol history and mapping table, as well as provide a tool to
regulators and CAT Reporters showing the security's complete symbol
history, along with a start-of-day and end-of-day list of reportable
securities for use by CAT Reporters, in .csv format, by 6:00 a.m. on
each trading day.\371\ The Participants will be responsible for
providing the Plan Processor with issue symbol information, and issue
symbol validation must be included in the

processing of data submitted by CAT Reporters.\372\
---------------------------------------------------------------------------

    \371\ Id. at Appendix D, Section 2.
    \372\ Id. at Appendix C, Section A.1(a).
---------------------------------------------------------------------------

14. CAT-Reporter-ID

    Sections 6.3 and 6.4 of the CAT NMS Plan require CAT Reporters to
record and report to the Central Repository an SRO-Assigned Market
Participant Identifier \373\ for orders and certain Reportable Events
to be used by the Central Repository to assign a unique CAT-Reporter-ID
\374\ for purposes of identifying each CAT Reporter associated with an
order or Reportable Event (the ``Existing Identifier Approach'').\375\
The CAT NMS Plan requires the reporting of SRO-Assigned Market
Participant Identifiers of: The Industry Member receiving or
originating an order; \376\ the Industry Member or Participant from
which (and to which) an order is being routed; \377\ the Industry
Member or Participant receiving (and routing) a routed order; \378\ the
Industry Member or Participant executing an order, if an order is
executed; \379\ and the clearing broker or prime broker, if applicable,
if an order is executed.\380\ An Industry Member would report to the
Central Repository its existing SRO-Assigned Market Participant
Identifier used by the relevant SRO specifically for transactions
occurring at that SRO.\381\ Similarly, an exchange reporting CAT
Reporter information would report data using the SRO-Assigned Market
Participant Identifier used by the Industry Member on that exchange or
its systems.\382\ Over-the-counter (``OTC'') orders and Reportable
Events would be reported with an Industry Member's FINRA SRO-Assigned
Market Participant Identifier.\383\
---------------------------------------------------------------------------

    \373\ The CAT NMS Plan defines an ``SRO-Assigned Market
Participant Identifier'' as ``an identifier assigned to an Industry
Member by an SRO or an identifier used by a Participant.'' Id. at
Section 1.1.
    \374\ Rule 613 defines a CAT-Reporter-ID as ``a code that
uniquely and consistently identifies [a CAT Reporter] for purposes
of providing data to the central repository.'' 17 CFR 242.613(j)(2).
    \375\ The SROs requested exemptive relief from Rule 613 so that
the CAT NMS Plan may permit the Existing Identifier Approach, which
would allow a CAT Reporter to report an existing SRO-Assigned Market
Participant Identifier in lieu of requiring the reporting of a
universal CAT-Reporter-ID. See Exemptive Request Letter, supra note
21, at 19. The Commission granted exemptive relief on March 1, 2016
in order to allow this alternative to be included in the CAT NMS
Plan and subject to notice and comment. See Exemption Order, supra
note 21.
    \376\ See CAT NMS Plan, supra note 5, at Sections 6.3(d)(i),
6.4(d)(i).
    \377\ Id. at Sections 6.3(d)(ii), 6.4(d)(i).
    \378\ Id. at Sections 6.3(d)(iii), 6.4(d)(i).
    \379\ Id. at Sections 6.3(d)(v), 6.4(d)(i).
    \380\ Id. at Section 6.4(d)(ii)(A)(2). Industry Members are
required by the CAT NMS Plan to record and report this information.
Id. at Section 6.4(d)(ii).
    \381\ See Exemption Order, supra note 21, at 31-41.
    \382\ See id. at 20.
    \383\ Id.
---------------------------------------------------------------------------

    The CAT NMS Plan requires the Plan Processor to develop and
maintain the mechanism to assign (and to change, if necessary) CAT-
Reporter-IDs.\384\ For the Central Repository to link the SRO-Assigned
Market Participant Identifier to the CAT-Reporter-ID, each SRO must
submit, on a daily basis, all SRO-Assigned Market Participant
Identifiers used by its Industry Members (or itself), as well as
information to identify the corresponding market participant (for
example, a CRD number or Legal Entity Identifier (``LEI'') to the
Central Repository.\385\ Additionally, each Industry Member shall be
required to submit to the Central Repository information sufficient to
identify such Industry Member (e.g., CRD number or LEI, as noted
above).\386\ The Plan Processor would use the SRO-Assigned Market
Participant Identifiers and identifying information (i.e., CRD number
or LEI) to assign a CAT-Reporter-ID to each Industry Member and SRO for
internal use across all data within the Central Repository.\387\ The
Plan Processor would create and maintain a database in the Central
Repository that would map the SRO-Assigned Market Participant
Identifiers to the appropriate CAT-Reporter-ID.\388\
---------------------------------------------------------------------------

    \384\ See CAT NMS Plan, supra note 5, at Appendix D, Section
10.1. Changes to CAT-Reporter-IDs must be reviewed and approved by
the Plan Processor. Id. The CAT NMS Plan also requires the Central
Repository to generate and assign a unique CAT-Reporter-ID to all
reports submitted to the system based on sub-identifiers that are
currently used by CAT Reporters in their order handling and trading
processes (described in the Exemption Request as SRO-assigned market
participant identifiers). Id. at Appendix D, Section 3; see also
Exemption Order, supra note 21, at 31-41.
    \385\ See CAT NMS Plan, supra note 5, at Section 6.3(e)(i).
    \386\ Id. at Section 6.4(d)(vi).
    \387\ See Exemption Order, supra note 21, at 31-41.
    \388\ Id. at 20.
---------------------------------------------------------------------------

    The CAT must be able to capture, store, and maintain current and
historical SRO-Assigned Market Participant Identifiers.\389\ The SRO-
Assigned Market Participant Identifier must also be included on the
Plan Processor's acknowledgment of its receipt of data files from a CAT
Reporter or Data Submitter,\390\ on daily statistics provided by the
Plan Processor after the Central Repository has processed data,\391\
and on a secure Web site that the Plan Processor would maintain that
would contain each CAT Reporter's daily reporting statistics.\392\ In
addition, data validations by the Plan Processor must include
confirmation of a valid SRO-Assigned Market Participant
Identifier.\393\
---------------------------------------------------------------------------

    \389\ Id. at Appendix D, Section 2.
    \390\ See id. at Appendix D, Section 7.1.
    \391\ See id. at Appendix D, Section 7.2.
    \392\ See id. at Appendix D, Section 10.1.
    \393\ See id. at Appendix D, Section 7.2. The CAT NMS Plan also
notes that both the CAT-Reporter-ID and the SRO-Assigned Market
Participant Identifier would be data fields for the online targeted
query tool described in the CAT NMS Plan as providing authorized
users with the ability to retrieve processed and/or validated
(unlinked) data via an online query screen. See id. at Appendix D,
Section 8.1.1.
---------------------------------------------------------------------------

15. Customer-ID

a. Customer Information Approach
    Rule 613(c)(7)(i)(A) requires that for the original receipt or
origination of an order, a CAT Reporter report the ``Customer-ID(s) for
each Customer.'' \394\ ``Customer-ID'' is defined in Rule 613(j)(5) to
mean ``with respect to a customer, a code that uniquely and
consistently identifies such customer for purposes of providing data to
the Central Repository.'' \395\ Rule 613(c)(8) requires that ``[a]ll
plan sponsors and their members shall use the same Customer-ID and CAT-
Reporter-ID for each customer and broker-dealer.'' \396\
---------------------------------------------------------------------------

    \394\ 17 CFR 242.613(c)(7)(i)(A).
    \395\ 17 CFR 242.613(j)(5).
    \396\ 17 CFR 242.613(c)(8).
---------------------------------------------------------------------------

    In Appendix C, the Participants describe the ``Customer Information
Approach,'' \397\ an alternative approach to the requirement that a
broker-dealer report a Customer-ID for every Customer upon original
receipt or origination of an order.\398\ Under the Customer Information
Approach, the CAT NMS Plan would require each broker-dealer to assign a
unique Firm Designated ID to each Customer.\399\ As the Firm Designated
ID, broker-dealers would be permitted to use an account number or any
other identifier defined by the firm,

provided each identifier is unique across the firm for each business
date (i.e., a single firm may not have multiple separate customers with
the same identifier on any given date).\400\ According to the CAT NMS
Plan, broker-dealers would submit an initial set of Customer
information to the Central Repository, including, as applicable, the
Firm Designated ID, the Customer's name, address, date of birth,
individual tax payer identifier number (``ITIN'')/social security
number (``SSN''), individual's role in the account (e.g., primary
holder, joint holder, guardian, trustee, person with power of attorney)
and LEI,\401\ and/or Large Trader ID (``LTID''), if applicable, which
would be updated as set forth in the CAT NMS Plan.\402\
---------------------------------------------------------------------------

    \397\ The SROs requested exemptive relief from Rule 613 so that
the CAT NMS Plan may permit the Customer Information Approach, which
would require each broker-dealer to assign a unique Firm Designated
ID to each trading account and to submit an initial set of
information identifying the Customer to the Central Repository, in
lieu of requiring each broker-dealer to report a Customer-ID for
each Customer upon the original receipt or origination of an order.
See Exemptive Request Letter, supra note 21, at 12. The Commission
granted exemptive relief on March 1, 2016 in order to allow this
alternative to be included in the CAT NMS Plan and subject to notice
and comment. See Exemption Order, supra note 21.
    \398\ See CAT NMS Plan, supra note 5, at Appendix C, Section
A.1(a)(iii).
    \399\ Id. The CAT NMS Plan defines a ``Firm Designated ID'' as
``a unique identifier for each trading account designated by
Industry Members for purposes of providing data to the Central
Repository, where each such identifier is unique among all
identifiers from any given Industry Member for each business date.''
See id. at Section 1.1.
    \400\ Id. at Appendix C, Section A.1(a)(iii).
    \401\ The CAT NMS Plan provides that where a validated LEI is
available for a Customer or entity, this may obviate a need to
report other identifier information (e.g., Customer name, address,
EIN). Id. at Appendix C, Section A.1(a)(iii) n.31.
    \402\ The CAT NMS Plan states that the Participants anticipate
that Customer information that is initially reported to the CAT
could be limited to Customer accounts that have, or are expected to
have, CAT Reportable Event activity. For example, the CAT NMS Plan
notes accounts that are considered open, but have not traded
Eligible Securities in a given time frame, may not need to be pre-
established in the CAT, but rather could be reported as part of
daily updates after they have CAT Reportable Event activity. Id. at
Appendix C, Section A.1(a)(iii) n.32.
---------------------------------------------------------------------------

    Under the Customer Information Approach, broker-dealers would be
required to report only the Firm Designated ID for each new order
submitted to the Central Repository, rather than the ``Customer-ID'' as
defined by Rule 613(c)(j)(5) and as required by Rule 613(c)(7)(i)(A),
and the Plan Processor would associate specific Customers and their
Customer-IDs with individual order events based on the reported Firm
Designated IDs.\403\ Within the Central Repository, each Customer would
be uniquely identified by identifiers or a combination of identifiers
such as an ITIN/SSN, date of birth, and, as applicable, LEI and
LTID.\404\ The Plan Processor would be required to use these unique
identifiers to map orders to specific Customers across all broker-
dealers.\405\ To ensure information identifying a Customer is updated,
broker-dealers would be required to submit to the Central Repository
daily updates for reactivated accounts, newly established or revised
Firm Designated IDs, or associated reportable Customer
information.\406\
---------------------------------------------------------------------------

    \403\ See id. at Appendix C, Section A.1(a)(iii). The CAT NMS
Plan also requires Industry Members to report ``Customer Account
Information'' upon the original receipt of origination of an order.
See CAT NMS Plan, supra note 5, at Sections 1.1, 6.4(d)(ii)(C).
    \404\ See CAT NMS Plan, supra note 5, at Appendix C, Section
A.1(a)(iii).
    \405\ Id.
    \406\ The CAT NMS Plan notes that because reporting to the CAT
is on an end-of-day basis, intra-day changes to information could be
captured as part of the daily updates to the information. To ensure
the completeness and accuracy of Customer information and
associations, in addition to daily updates, broker-dealers would be
required to submit periodic full refreshes of Customer information
to the CAT. The scope of the ``full'' Customer information refresh
would need to be further defined, with the assistance of the Plan
Processor, to determine the extent to which inactive or otherwise
terminated accounts would need to be reported. Id. at Appendix C,
Section A.1(a)(iii) n.33.
---------------------------------------------------------------------------

    Appendix C provides additional requirements that the Plan Processor
must meet under the Customer Information Approach.\407\ The Plan
Processor must maintain information of sufficient detail to uniquely
and consistently identify each Customer across all CAT Reporters, and
associated accounts from each CAT Reporter, and must document and
publish, with the approval of the Operating Committee, the minimum list
of attributes to be captured to maintain this association.\408\ In
addition, the Plan Processor must maintain valid Customer and Customer
Account Information \409\ for each trading day and provide a method for
Participants and the Commission to easily obtain historical changes to
that information (e.g., name changes, address changes).\410\ The Plan
Processor also must design and implement a robust data validation
process for submitted Firm Designated IDs, Customer Account Information
and Customer Identifying Information, and be able to link accounts that
move from one CAT Reporter to another due to mergers and acquisitions,
divestitures, and other events.\411\ Under the Customer Information
Approach, Industry Members will initially submit full account lists for
all active accounts to the Plan Processor and subsequently submit
updates and changes on a daily basis.\412\ Finally, the Plan Processor
must have a process to periodically receive full account lists to
ensure the completeness and accuracy of the account database.\413\
---------------------------------------------------------------------------

    \407\ See id. at Appendix C, Section A.1(a)(iii).
    \408\ Id. Section 9.1 of Appendix D also addresses, among other
things, the minimum attributes that CAT must capture for Customers
and the validation process for such attributes. Id. at Appendix D,
Section 9.1.
    \409\ Id. at Appendix D, Section 9.1. In relevant part,
``Customer Account Information'' is defined in the Plan to include,
but not be limited to, account number, account type, customer type,
date account opened, and large trader identifier (if applicable).
See id. at Section 1.1.
    \410\ See id. at Appendix C, Section A.1(a)(iii).
    \411\ Id. The CAT NMS Plan defines ``Customer Identifying
Information'' to mean ``information of sufficient detail to identify
a Customer, including, but not limited to, (a) with respect to
individuals: Name, address, date of birth, individual tax payer
identification number (``ITIN'')/social security number (``SSN''),
individual's role in the account (e.g., primary holder, joint
holder, guardian, trustee, person with the power of attorney); and
(b) with respect to legal entities: Name, address, Employer
Identification Number (``EIN'')/LEI) or other comparable common
entity identifier, if applicable; provided, however, where the LEI
or other common entity identifier is provided, information covered
by such common entity identifier (e.g., name, address) would not
need to be separately submitted to the Central Repository.'' See id.
at Section 1.1.
    \412\ Id. at Appendix C, Section A.1(a)(iii).
    \413\ Id.
---------------------------------------------------------------------------

b. Account Effective Date vs. Account Open Date

    Rule 613(c)(7)(viii)(B) requires broker-dealers to report to the
Central Repository ``Customer Account Information'' upon the original
receipt or origination of an order.\414\ The CAT NMS Plan defines
``Customer Account Information'' to include, in part, the Customer's
account number, account type, customer type, date account opened and
LTID (if applicable).\415\ The Plan, however, provides that in two
limited circumstances, a broker-dealer could report the ``Account
Effective Date'' in lieu of the date an account was opened.\416\ The
first circumstance is where a relationship identifier--rather than an
actual parent account--has been established for an institutional
Customer relationship.\417\ In this case, no account open date is
available for the institutional Customer parent relationship because
there is no parent account, and for the same reason, there is no
account number or account type available.\418\ Thus, the Plan provides
that in this circumstance, a broker-dealer could report the ``Account
Effective Date'' of the relationship in

lieu of an account open date.\419\ Further, the Plan provides that
where such an institutional Customer relationship was established
before the broker-dealer's obligation to report audit trail data, the
``Account Effective Date'' would be either (i) the date the broker-
dealer established the relationship identifier, or (ii) the date when
trading began (i.e., the date the first order was received) using the
relevant relationship identifier, and if both dates are available and
differ, the earlier date.\420\ Where such relationships are established
after the broker-dealer's obligation to report audit trail data is
required, the ``Account Effective Date'' would be the date the broker-
dealer established the relationship identifier and would be no later
than the date the first order was received.\421\ Regardless of when the
relationship was established for such institutional Customers, the Plan
provides that broker-dealers may report the relationship identifier in
place of Rule 613(c)(7)(viii)(B)'s requirement to report the ``account
number,'' and report ``relationship'' in place of ``account
type.''\422\
---------------------------------------------------------------------------

    \414\ 17 CFR 242.613(c)(7)(viii)(B). ``Customer Account
Information'' is defined in Rule 613(j)(4) to ``include, but not be
limited to, account number, account type, customer type, date
account opened, and large trader identifier (if applicable).'' 17
CFR 242.613(j)(4).
    \415\ See CAT NMS Plan, supra note 5, at Section 1.1.
    \416\ Id. The SROs requested exemptive relief from Rule 613 so
that the CAT NMS Plan may permit broker-dealers to report to the
Central Repository the ``effective date'' of an account in lieu of
requiring each broker-dealer to report the date the account was
opened in certain limited circumstances. See Exemptive Request
Letter, supra note 21, at 13. The Commission granted exemptive
relief on March 1, 2016 in order to allow this alternative to be
included in the CAT NMS Plan and subject to notice and comment. See
Exemption Order, supra note 21.
    \417\ See Exemption Order, supra note 21; see also September
2015 Supplement, supra note 21, at 4-5.
    \418\ See September 2015 Supplement, supra note 21, at 6.
    \419\ See CAT NMS Plan, supra note 5, at Section 1.1.
    \420\ Id.
    \421\ Id.
    \422\ Id.
---------------------------------------------------------------------------

    The second circumstance where a broker-dealer may report the
``Account Effective Date'' rather than the date an account was opened
as required in Rule 613(c)(7)(viii)(B) is when particular legacy system
data issues prevent a broker-dealer from providing an account open date
for any type of account (i.e., institutional, proprietary or retail)
that was established before the CAT's implementation.\423\ According to
the Plan, these legacy system data issues may arise because:
---------------------------------------------------------------------------

    \423\ Id.; see also September 2015 Supplement, supra note 21, at
7-9.
---------------------------------------------------------------------------

    (1) A broker-dealer has switched back office providers or clearing
firms and the new back office/clearing firm system identifies the
account open date as the date the account was opened on the new system;
    (2) A broker-dealer is acquired and the account open date becomes
the date that an account was opened on the post-merger back office/
clearing firm system;
    (3) Certain broker-dealers maintain multiple dates associated with
accounts in their systems and do not designate in a consistent manner
which date constitutes the account open date, as the parameters of each
date are determined by the individual broker-dealer; or
    (4) No account open date exists for a proprietary account of a
broker-dealer.\424\
---------------------------------------------------------------------------

    \424\ See CAT NMS Plan, supra note 5, at Section 1.1.
---------------------------------------------------------------------------

    Thus, when legacy systems data issues arise due to one of the four
reasons above and no account open date is available, the Plan provides
that broker-dealers would be permitted to report an ``Account Effective
Date'' in lieu of an account open date.\425\ When the legacy systems
data issues and lack of account open date are attributable to above
reasons (1) or (2), the ``Account Effective Date'' would be the date
the account was established, either directly or via a system transfer,
at the relevant broker-dealer.\426\ When the legacy systems data issues
and lack of account open date are attributable to above reason (3), the
``Account Effective Date'' would be the earliest available date.\427\
When the legacy systems data issues and lack of account open date are
attributable to above reason (4), the ``Account Effective Date'' would
be (i) the date established for the proprietary account in the broker-
dealer or its system(s), or (ii) the date when proprietary trading
began in the account, i.e., the date on which the first order was
submitted from the account.\428\
---------------------------------------------------------------------------

    \425\ Id.
    \426\ Id.
    \427\ Id.
    \428\ Id.
---------------------------------------------------------------------------

c. Modification/Cancellation
    Rule 613(c)(7)(iv)(F) requires that ``[t]he CAT-Reporter-ID of the
broker-dealer or Customer-ID of the person giving the modification or
cancellation instruction'' be reported to the Central Repository.\429\
Because the Customer Information Approach no longer requires, as
permitted by the Exemption Order, that a Customer-ID be reported upon
original receipt or origination of an order, and because reporting the
Customer-ID of the specific person that gave the modification or
cancellation instruction would result in an inconsistent level of
information regarding the identity of the person giving the
modification or cancellation instruction versus the identity of the
Customer that originally received or originated an order, Section
6.3(d)(iv)(F) of the CAT NMS Plan modifies the requirement in Rule 613
and instead requires CAT Reporters to report whether the modification
or cancellation instruction was ``given by the Customer or was
initiated by the Industry Member or Participant.''\430\
---------------------------------------------------------------------------

    \429\ 17 CFR 242.613(c)(7)(iv)(F) (emphasis added).
    \430\ See CAT NMS Plan, supra note 5, at Section 6.3(d)(iv)(F).
The SROs requested exemptive relief from Rule 613 so that the CAT
NMS Plan may permit CAT Reporters to report whether a modification
or cancellation instruction was given by the Customer associated
with the order, or was initiated by the broker-dealer or exchange
associated with the order, in lieu of requiring CAT Reporters to
report the Customer-ID of the person giving the modification or
cancellation instruction. See Exemptive Request Letter, supra note
21, at 12-13. The Commission granted exemptive relief on March 1,
2016 in order to allow this alternative to be included in the CAT
NMS Plan and subject to notice and comment. See Exemption Order,
supra note 21.
---------------------------------------------------------------------------

16. Order Allocation Information

    Section 6.4(d)(ii)(A)(1) of the CAT NMS Plan provides that each
Participant through its Compliance Rule must require that Industry
Members record and report to the Central Repository an Allocation
Report that includes the Firm Designated ID when an execution is
allocated in whole or part.\431\ The CAT NMS Plan defines an Allocation
Report as ``a report made to the Central Repository by an Industry
Member that identifies the Firm Designated ID for any account(s),
including subaccount(s), to which executed shares are allocated and
provides the security that has been allocated, the identifier of the
firm reporting the allocation, the price per share of shares allocated,
the side of shares allocated, the number of shares allocated to each
account, and the time of the allocation.'' \432\ The CAT NMS Plan
explains, for the avoidance of doubt, that an Allocation Report shall
not be required to be linked to particular orders or executions.\433\
---------------------------------------------------------------------------

    \431\ See CAT NMS Plan, supra note 5, at Section
6.4(d)(ii)(A)(1); see also April 2015 Supplement, supra note 21. The
SROs requested exemptive relief from Rule 613 so that the CAT NMS
Plan may permit Industry Members to record and report to the Central
Repository an Allocation Report that includes the Firm Designated ID
when an execution is allocated in whole or part in lieu of requiring
the reporting of the account number for any subaccount to which an
execution is allocated, as is required by Rule 613. See Exemptive
Request Letter, supra note 21, at 26-27. The Commission granted
exemptive relief on March 1, 2016 in order to allow this alternative
to be included in the CAT NMS Plan and subject to notice and
comment. See Exemption Order, supra note 21.
    \432\ See CAT NMS Plan, supra note 5, at Section 1.1; see also
April 2015 Supplement, supra note 21.
    \433\ See CAT NMS Plan, supra note 5, at Section 1.1.
---------------------------------------------------------------------------

17. Options Market Maker Quotes

    Section 6.4(d)(iii) of the CAT NMS Plan states that, with respect
to the reporting obligations of an Options Market Maker under Sections
6.3(d)(ii) and (iv) regarding its quotes\434\ in Listed

Options, such quotes shall be reported to the Central Repository by the
relevant Options Exchange in lieu of reporting by the Options Market
Maker.\435\ Section 6.4(d)(iii) further states that each Participant
that is an Options Exchange shall, through its Compliance Rule, require
its Industry Members that are Options Market Makers to report to the
Options Exchange the time at which a quote in a Listed Option is sent
to the Options Exchange (and, if applicable, the time of any subsequent
quote modification and/or cancellation where such modification or
cancellation is originated by the Options Market Maker).\436\ Such time
information also shall be reported to the Central Repository by the
Options Exchange in lieu of reporting by the Options Market Maker.\437\
---------------------------------------------------------------------------

    \434\ Rule 613(c)(7) provides that the CAT NMS Plan must require
reporting of the details for each order and each Reportable Event,
including the routing and modification or cancellation of an order.
17 CFR 242.613(c)(7). Rule 613(j)(8) defines ``order'' to include
``any bid or offer.'' 17 CFR 242.613(j)(8).
    \435\ See CAT NMS Plan, supra note 5, at Section 6.4(d)(iii).
The SROs requested exemptive relief from Rule 613 so that the CAT
NMS Plan may permit Options Market Maker quotes to be reported to
the Central Repository by the relevant Options Exchange in lieu of
requiring that such reporting be done by both the Options Exchange
and the Options Market Maker, as is required by Rule 613. See
Exemptive Request Letter, supra note 21, at 2. In accord with the
exemptive relief requested, the SROs committed to require Options
Market Makers to report to the Exchange the time at which a quote in
a Listed Option is sent to the Options Exchange. Id. at 3. The
Commission granted exemptive relief on March 1, 2016 in order to
allow this alternative to be included in the CAT NMS Plan and
subject to notice and comment. See Exemption Order, supra note 21.
    \436\ See CAT NMS Plan, supra note 5, at Section 6.4(d)(iii).
    \437\ Id.
---------------------------------------------------------------------------

18. Primary Market Transactions, Debt Securities and Futures

    Rule 613 and the CAT NMS Plan do not require the reporting of audit
trail data for Primary Market Transactions,\438\ debt securities, and
futures. However, Rule 613(i) requires that, within six months after
the effective date of the CAT NMS Plan, the SROs shall jointly provide
to the Commission ``a document outlining how such exchanges and
associations could incorporate into the consolidated audit trail
information with respect to equity securities that are not NMS
securities,\439\ debt securities, primary market transactions in equity
securities that are not NMS securities, and primary market transactions
in debt securities, including details for each order and reportable
event that may be required to be provided, which market participants
may be required to provide the data, an implementation timeline, and a
cost estimate.'' \440\
---------------------------------------------------------------------------

    \438\ The CAT NMS Plan defines ``Primary Market Transaction'' to
mean ``any transaction other than a secondary market transaction and
refers to any transaction where a Person purchases securities in an
offering.'' Id. at Section 1.1.
    \439\ The Commission notes that in the CAT NMS Plan some non-NMS
equities (specifically, OTC equity securities) are required to be
reported. Id. at Sections 1.1, 6.3 (requiring Eligible Securities
data to be reported, and where Eligible Securities is defined as all
NMS securities and all OTC equity securities).
    \440\ See 17 CFR 242.613(i); see also CAT NMS Plan, supra note
5, at Section 6.11. The CAT NMS Plan defines ``NMS Securities'' to
mean ``any security or class of securities for which transaction
reports are collected, processed, and made available pursuant to an
effective transaction reporting plan, or an effective national
market system plan for reporting transactions in Listed Options.''
See CAT NMS Plan, supra note 5, at Section 1.1. The CAT NMS Plan
defines ``OTC Equity Securities'' as ``any equity security, other
than an NMS Security, subject to prompt last sale reporting rules of
a registered national securities association and reported to one of
such association's equity trade reporting facilities.'' Id.
---------------------------------------------------------------------------

19. Error Rates

    The CAT NMS Plan defines Error Rate as ``the percentage of
[R]eportable [E]vents collected by the [C]entral [R]epository in which
the data reported does not fully and accurately reflect the order event
that occurred in the market.'' \441\ Under the CAT NMS Plan, the
Operating Committee sets the maximum Error Rate that the Central
Repository would tolerate from a CAT Reporter reporting data to the
Central Repository.\442\ The Operating Committee reviews and resets the
maximum Error Rate, at least annually.\443\ If a CAT Reporter reports
CAT Data to the Central Repository with errors such that their error
percentage exceeds the maximum Error Rate, then such CAT Reporter would
not be in compliance with the CAT NMS Plan or Rule 613.\444\ As such,
``the Participants as Participants or the SEC may take appropriate
action for failing to comply with the reporting obligations under the
CAT NMS Plan and SEC Rule 613.'' \445\ The CAT NMS Plan, however, does
not detail what specific compliance enforcement provisions would apply
if a CAT Reporter exceeds the maximum Error Rate.\446\
---------------------------------------------------------------------------

    \441\ See CAT NMS Plan, supra note 5, at Section 1.1; see also
Rule 613(j)(6).
    \442\ Id. at Section 6.5(d)(i).
    \443\ Id. at Appendix C, Section A.3(b).
    \444\ Id. at Appendix C, Section A.3(b); Rule 613(g)-(h).
    \445\ Id. at Appendix C, Section A.3(b).
    \446\ See Notice, supra note 5, at 30645.
---------------------------------------------------------------------------

    The CAT NMS Plan sets the initial maximum Error Rate at 5% for any
data reported pursuant to subparagraphs (3) and (4) of Rule
613(c).\447\ The SROs highlight that ``the Central Repository will
require new reporting elements and methods for CAT Reporters and there
will be a learning curve when CAT Reporters begin to submit data to the
Central Repository'' in support of a 5% initial rate.\448\ Further, the
SROs state that ``many CAT Reporters may have never been obligated to
report data to an audit trail.'' \449\ The SROs believe an initial
maximum Error Rate of 5% ``strikes the balance of making allowances for
adapting to a new reporting regime, while ensuring that the data
provided to regulators will be capable of being used to conduct
surveillance and market reconstruction.'' \450\ In the CAT NMS Plan,
the Participants compared the contemplated Error Rates of CAT Reporters
to the error rates of OATS reporters in the time periods immediately
following three significant OATS releases in the last ten years.\451\
The Participants state that for the three comparative OATS releases
\452\: An average of 2.42% of order events did not pass systemic
validations; an average of 0.36% of order events were not submitted in
a timely manner; an average of 0.86% of orders were unsuccessfully
matched to a trade reporting facility trade report; an average of 3.12%
of OATS Route Reports were unsuccessfully matched to an exchange order;
and an average of 2.44% of OATS Route Reports were unsuccessfully
matched to a report by another reporting entity.\453\
---------------------------------------------------------------------------

    \447\ See CAT NMS Plan, supra note 5, at Section 6.5(d)(i).
    \448\ Id. at Appendix C, Section A.3(b).
    \449\ Id.
    \450\ Id.
    \451\ Id. The SROs note that the three comparative releases are
known as ``(1) OATS Phase III, which required manual orders to be
reported to OATS; (2) OATS for OTC Securities which required OTC
equity securities to be reported to OATS; and (3) OATS for NMS which
required all NMS stocks to be reported to OATS.'' Id.
    \452\ Id. The SROs note that the calculated ``combined average
error rates for the time periods immediately following [the OATS]
release across five significant categories for these three
releases'' was used in setting in the initial maximum Error Rate.
Id.
    \453\ Id.
---------------------------------------------------------------------------

    The Participants, moreover, anticipate reviewing and resetting the
maximum Error Rate once Industry Members (excluding Small Industry
Members) begin to report to the Central Repository and again once Small
Industry Members report to the Central Repository.\454\
---------------------------------------------------------------------------

    \454\ Id.
---------------------------------------------------------------------------

    The Participants thus propose a phased approach to lowering the
maximum Error Rates among CAT Reporters based on the period of time
reporting to the Central Repository and whether the CAT Reporters are
Participants, large broker-dealers or

small broker-dealers.\455\ The Plan sets forth a goal of the following
maximum Error Rates \456\ where ``Year(s)'' refers to year(s) after the
CAT NMS Plan's date of effectiveness:
---------------------------------------------------------------------------

    \455\ Id.
    \456\ Id.

                                      Table 1--Maximum Error Rates Schedule
----------------------------------------------------------------------------------------------------------------
                                                                                Three years
                                                   One year (%)    Two years (%)        (%)       Four years (%)
----------------------------------------------------------------------------------------------------------------
Participants....................................               5               1               1               1
Large Industry Members..........................             N/A               5               1               1
Small Industry Members..........................             N/A             N/A               5               1
----------------------------------------------------------------------------------------------------------------

    The CAT NMS Plan requires the Plan Processor to: (i) Measure and
report errors every business day; \457\ (ii) provide CAT Reporters
daily statistics and error reports as they become available, including
a description of such errors; \458\ (iii) provide monthly reports to
CAT Reporters that detail a CAT Reporter's performance and comparison
statistics; \459\ (iv) define educational and support programs for CAT
Reporters to minimize Error Rates; \460\ and (v) identify, daily, all
CAT Reporters exceeding the maximum allowable Error Rate.\461\ To
timely correct data-submitted errors to the Central Repository, the
Participants require that the Central Repository receive and process
error corrections at all times.\462\ Further, the CAT NMS Plan requires
that CAT Reporters be able to submit error corrections to the Central
Repository through a web-interface or via bulk uploads or file
submissions, and that the Plan Processor, subject to the Operating
Committee's approval, support the bulk replacement of records and the
reprocessing of such records.\463\ The Participants, furthermore,
require that the Plan Processor identify CAT Reporter data submission
errors based on the Plan Processor's validation processes.\464\
---------------------------------------------------------------------------

    \457\ Id. The CAT NMS Plan sets forth that the Plan Processor
shall provide the Operating Committee with regular Error Rate
reports. Id. at Section 6.1(o)(v). The Error Rate reports shall
include each of the following--if the Operating Committee deems them
necessary or advisable--``Error Rates by day and by delta over time,
and Compliance Thresholds by CAT Reporter, by Reportable Event, by
age before resolution, by symbol, by symbol type (e.g., ETF and
Index) and by event time (by hour and cumulative on the hour)[.]''
Id.
    \458\ See id. at Appendix C, Section A.3(b).
    \459\ See id.
    \460\ See id. at Appendix D, Section 10.1. The CAT NMS Plan sets
forth support programs that shall include educational programs,
including FAQs, a dedicated help desk, industry-wide trainings,
certifications, industry-wide testing, maintaining Technical
Specifications with defined intervals for new releases/updates,
emailing CAT Reporter data outliers, conducting annual assessments,
using test environments prior to releasing new code to production,
and imposing CAT Reporter attendance requirements for testing
sessions and educational and industry-wide trainings. Id.
    \461\ See id. at Appendix D, Section 10.4.
    \462\ See id. at Appendix C, Section A.3(b).
    \463\ See id.
    \464\ See id. At a minimum, the processes would include
validating the data's file format, CAT Data format, type,
consistency, range, logic, validity, completeness, timeliness and
linkage. See id. at Appendix D, Section 7.2.
---------------------------------------------------------------------------

20. Retirement of Existing Trade and Order Data Rules and Systems

a. Duplicative or Partially Duplicative Rules and Systems
    As required by Rule 613(a)(1)(ix),\465\ the CAT NMS Plan provides a
plan to eliminate rules and systems that will be rendered duplicative
by the CAT.\466\ Under the CAT NMS Plan, each Participant will initiate
an analysis of its rules and systems to determine which require
information that is duplicative of the information available to the
Participants through the Central Repository. The CAT NMS Plan states
that each Participant has begun reviewing its rulebook and is waiting
for the publication of the final reporting requirements to the Central
Repository to complete its analysis. According to the Plan, each
Participant should complete its analysis within twelve months after
Industry Members (other than Small Industry Members) are required to
begin reporting data to the Central Repository (or a later date to be
determined by each Participant if sufficient data is not available to
complete the analysis in that timeframe).\467\
---------------------------------------------------------------------------

    \465\ 17 CFR 242.613(a)(1)(ix).
    \466\ See CAT NMS Plan, supra note 5, at Section 6.7(d);
Appendix C, Section C.9.
    \467\ Id. at Appendix C, Section C.9.
---------------------------------------------------------------------------

    Similarly, the CAT NMS Plan provides that each Participant will
analyze which of its rules and systems require information that is
partially duplicative of the information available to the Participants
through the Central Repository.\468\ According to the CAT NMS Plan,
this analysis should include a determination as to: (i) Whether the
Participant should continue to collect the duplicative information
available in the Central Repository; (ii) whether the Participant can
use the duplicative information made available in the Central
Repository without degrading the effectiveness of the Participant's
rules or systems; and (iii) whether the Participant should continue to
collect the non-duplicative information or, alternatively, whether it
should be added to information collected by the Central Repository. The
CAT NMS Plan states that each Participant has begun reviewing its
rulebook and is waiting for the publication of the final reporting
requirements to the Central Repository to complete its analysis.
According to the Plan, each Participant should complete this analysis
within eighteen months after Industry Members (other than Small
Industry Members) are required to begin reporting data to the Central
Repository (or a later date to be determined by each Participant if
sufficient data is not available to complete the analysis in that
timeframe).\469\
---------------------------------------------------------------------------

    \468\ Id.
    \469\ Id.
---------------------------------------------------------------------------

    The CAT NMS Plan also discusses the elimination of specific trade
and order data collection systems that may be duplicative or partially
duplicative of CAT.\470\ With respect to FINRA's OATS, the CAT NMS Plan
notes that FINRA's ability to retire OATS is dependent on whether the
Central Repository contains complete and accurate CAT Data that is
sufficient to ensure that FINRA can effectively conduct surveillance
and investigations of its members for potential violations of FINRA
rules and federal laws and regulations.\471\ Based on an analysis
conducted by the Participants, there are 33 data elements currently
captured in OATS that are not specified in SEC Rule 613. The Plan notes
that the Participants believe it is appropriate to incorporate data
elements into the Central Repository that are necessary to retire OATS,
and that these additional data elements will increase the likelihood
that the Central

Repository will include sufficient order information to ensure that
FINRA can continue to perform its surveillance with CAT Data rather
than OATS data and can more quickly eliminate OATS. However, the Plan
notes that OATS cannot be entirely eliminated until all FINRA members
who currently report to OATS are reporting to the Central Repository,
and that there will likely be some period of dual reporting until FINRA
can verify that the data in the Central Repository is of sufficient
quality for surveillance purposes and that data reported to the Central
Repository meets the Error Rate standards set out in the CAT NMS
Plan.\472\ With respect to rules and systems other than OATS, the CAT
NMS Plan notes that based on preliminary industry analyses, broker-
dealer recordkeeping and large trader reporting requirements under SEC
Rule 17h-1 could potentially be eliminated. The Plan, however, notes
that large trader self-identification and reporting responsibilities on
Form 13H appear not be covered by the CAT.\473\
---------------------------------------------------------------------------

    \470\ Id.
    \471\ Id.
    \472\ Id.
    \473\ Id.
---------------------------------------------------------------------------

    Based on these analyses of duplicative or partially duplicative
rules, the CAT NMS Plan provides that each Participant will prepare
appropriate rule change filings to implement the rule modifications or
deletions that can be made.\474\ The rule change filings should
describe the process for phasing out the requirements under the
relevant rule. Under the CAT NMS Plan, each Participant will file with
the SEC the relevant rule change filing to eliminate or modify its
rules within six months of the Participant's determination that such
modification or deletion is appropriate.\475\ Similarly, the CAT NMS
Plan provides that each Participant will analyze the most appropriate
and expeditious timeline and manner for eliminating duplicative and
partially duplicative rules and systems. Upon the Commission's approval
of relevant rule changes, each Participant will implement this
timeline. In developing these timelines, each Participant must consider
when the quality of CAT Data will be sufficient to meet the
surveillance needs of the Participants (i.e., to sufficiently replace
current reporting data) before existing rules and systems can be
eliminated.\476\
---------------------------------------------------------------------------

    \474\ Id.
    \475\ Id.
    \476\ Id.
---------------------------------------------------------------------------

b. Non-Duplicative Rules and Systems
    The CAT NMS Plan provides that each Participant will conduct an
analysis to determine which of its rules and systems related to
monitoring quotes, orders, and executions provide information that is
not rendered duplicative by the CAT.\477\ Under the CAT NMS Plan, each
Participant must analyze: (i) Whether collection of such information
remains appropriate; (ii) if still appropriate, whether such
information should continue to be separately collected or should
instead be incorporated into the consolidated audit trail; and, (iii)
if no longer appropriate, how the collection of such information could
be efficiently terminated, the steps the Participants would need to
take to seek Commission approval for the elimination of such rules and
systems, and a timetable for such elimination. Each Participant should
complete this analysis within eighteen months after Industry Members
(other than Small Industry Members) are required to begin reporting
data to the Central Repository (or a later date to be determined by
each Participant if sufficient data is not available to complete the
analysis in that timeframe).\478\
---------------------------------------------------------------------------

    \477\ Id.
    \478\ Id.
---------------------------------------------------------------------------

c. Elimination of SEC Rules
    In addition, to the extent that the Commission eliminates rules
that require information that is duplicative of information available
through the Central Repository, the CAT NMS Plan provides that each
Participant will analyze its rules and systems to determine whether any
modifications to such rules or systems are necessary (e.g., to delete
references to outdated SEC rules) to support data requests made
pursuant to such SEC rules.\479\ Each Participant should complete its
analysis within three months after the SEC approves the deletion or
modification of an SEC rule related to the information available
through the Central Repository. The CAT NMS Plan also provides that
Participants will coordinate with the Commission regarding modification
of the CAT NMS Plan to include information sufficient to eliminate or
modify those Exchange Act rules or systems that the Commission deems
appropriate.\480\
---------------------------------------------------------------------------

    \479\ Id.
    \480\ Id.
---------------------------------------------------------------------------

21. Regulatory Access

    Under Section 6.5(c) of the CAT NMS Plan and as discussed above,
the Plan Processor must provide regulators access to the Central
Repository for regulatory and oversight purposes and create a method of
accessing CAT Data that includes the ability to run complex searches
and generate reports.\481\ Section 6.10(c) requires regulator access by
two different methods: (1) An online targeted query tool with
predefined selection criteria to choose from; and (2) user-defined
direct queries and bulk extractions of data via a query tool or
language allowing querying of all available attributes and data
sources.\482\ Additional requirements concerning regulator access
appear in Section 8 of Appendix D.\483\
---------------------------------------------------------------------------

    \481\ Id. at Section 6.5(c). Appendix C provides objective
milestones to assess progress concerning regulator access to the
Central Repository. See id. at Appendix C, Section C.10(d).
    \482\ Id. at Section 6.10(c). Section 6.10(c) also requires the
Plan Processor to reasonably assist regulatory Staff with queries,
submit queries on behalf of regulatory Staff as requested, and
maintain a help desk to assist regulatory Staff with questions
concerning CAT Data. Id.
    \483\ See id. at Appendix D, Section 8.
---------------------------------------------------------------------------

    The CAT NMS Plan requires that the CAT must support a minimum of
3,000 regulatory users and at least 600 such users accessing the CAT
concurrently without an unacceptable decline in performance.\484\
Moreover, the CAT must support an arbitrary number of user roles and,
at a minimum, include defined roles for both basic and advanced
regulatory users.\485\
---------------------------------------------------------------------------

    \484\ Id. at Appendix D, Section 8.1.
    \485\ Id.
---------------------------------------------------------------------------

a. Online Targeted Query Tool
    Sections 8.1.1, 8.1.2, and 8.1.3 of Appendix D contain further
specifications for the online targeted query tool.\486\ The tool must
allow for retrieval of processed and/or validated (unlinked) data via
an online query screen that includes a choice of a variety of pre-
defined selection criteria.\487\ Targeted queries must include date(s)
and/or time range(s), as well as one or more of a variety of fields
listed in Section 8.1.1 (e.g., product type, CAT-Reporter-ID, and
Customer-ID).\488\ Targeted queries would be logged such that the Plan
Processor could provide monthly reports to the SROs and the SEC
concerning metrics on performance and data usage of the search
tool.\489\ The CAT NMS Plan further requires that acceptable response
times for the targeted search be in increments of less than one minute;
for complex queries scanning large volumes of data or large result sets
(over one million records) response times must be available within 24
hours of the request; and queries for data within one business date of
a 12-month period must return results within

three hours regardless of the complexity of criteria.\490\ Under the
CAT NMS Plan, regulators may access all CAT Data except for PII data
(access to which would be limited to an authorized subset of
Participant and Commission employees) and the Plan Processor must work
with regulators to implement a process for providing them with access
and routinely verifying a list of active users.\491\
---------------------------------------------------------------------------

    \486\ Id. at Appendix D, Sections 8.1.1-8.1.3.
    \487\ Id. at Appendix D, Section 8.1.1.
    \488\ Id.
    \489\ Id.
    \490\ Id. at Appendix D, Section 8.1.2. Appendix D, Section
8.1.2 contains further performance requirements applicable to data
and the architecture of the online query tool. Id.
    \491\ Id. at Appendix D, Section 8.1.3.
---------------------------------------------------------------------------

b. User-Defined Direct Queries and Bulk Extraction of Data
    Section 8.2 of Appendix D outlines the requirements for user-
defined direct queries and bulk extraction of data, which regulators
would use to obtain large data sets for internal surveillance or market
analysis.\492\ Under the CAT NMS Plan, regulators must be able to
create, save, and schedule dynamic queries that would run directly
against processed and/or unlinked CAT Data.\493\ Additionally, CAT must
provide an open application program interface (``API'') that allows use
of analytic tools and database drivers to access CAT Data.\494\ Queries
submitted through the open API must be auditable and the CAT System
must contain the same level of control, monitoring, logging, and
reporting as the online targeted query tool.\495\ The Plan Processor
must also provide procedures and training to regulators that would use
the direct query feature.\496\ Sections 8.2.1 and 8.2.2 of Appendix D
contain additional specifications for user-defined direct queries and
bulk data extraction, respectively.\497\
---------------------------------------------------------------------------

    \492\ Id. at Appendix D, Section 8.2.
    \493\ Id.
    \494\ Id.
    \495\ Id. Direct queries must not return or display PII data but
rather display non-PII unique identifiers (e.g., Customer-ID or Firm
Designated ID). The PII corresponding to these identifiers could be
gathered using the PII workflow described in Appendix D, Data
Security, PII Data Requirements. See id. at Appendix D, Section
4.1.6.
    \496\ Id. at Appendix D, Section 8.2.
    \497\ Id. at Appendix D, Sections 8.2.1 and 8.2.2.
---------------------------------------------------------------------------

c. Regulatory Access Schedule
    Section A.2 of Appendix C addresses the time and method by which
CAT Data would be available to regulators.\498\ Section A.2(a) requires
that data be available to regulators any point after the data enters
the Central Repository and passes basic format validations.\499\ After
errors are communicated to CAT Reporters on T+1, CAT Reporters would be
required to report corrected data back to the Central Repository by
8:00 a.m. ET on T+3.\500\ Regulators must then have access to corrected
and linked order and Customer data by 8:00 a.m. ET on T+5.\501\ Section
A.2(b) generally describes Bidders' approaches regarding regulator
access and use of CAT Data and notes that although the SROs set forth
the standards the Plan Processor must meet, they do not endorse any
particular approach.\502\ Section A.2(c) outlines requirements the Plan
Processor must meet for report building and analysis regarding data
usage by regulators, consistent with, and in addition to, the
specifications outlined in Section 8 of Appendix D.\503\
---------------------------------------------------------------------------

    \498\ Id. at Appendix C, Section A.2.
    \499\ Id. at Appendix C, Section A.2(a). Appendix C, Section
A.3(e) indicates this would be no later than noon EST on T+1. Id. at
Appendix C, Section A.3(e).
    \500\ Id. at Appendix C, Section A.1(a)(iv); Appendix D, Section
6.1.
    \501\ Id. at Appendix C, Section A.2(a).
    \502\ Id. at Appendix C, Section A.2(b).
    \503\ Id. at Appendix C, Section A.2(c). Appendix C, Section
A.2(d) addresses system service level agreements that the SROs and
Plan Processor would enter into. Id. at Appendix C, Section A.2(d).
---------------------------------------------------------------------------

22. Upgrades and New Functionalities

    Under Article VI of the CAT NMS Plan, the Plan Processor is
responsible for consulting with the Operating Committee and
implementing necessary upgrades and new functionalities. In particular,
the Plan Processor would be required to, consistent with Appendix D,
Upgrade Process and Development of New Functionality, design and
implement appropriate policies and procedures governing the
determination to develop new functionality for the CAT including, among
other requirements, a mechanism by which changes can be suggested by
Advisory Committee members, Participants, or the SEC.\504\ The Plan
Processor shall, on an ongoing basis and consistent with any applicable
policies and procedures, evaluate and implement potential system
changes and upgrades to maintain and improve the normal day-to-day
operating function of the CAT System.\505\ In consultation with the
Operating Committee, the Plan Processor shall, on an as-needed basis
and consistent with any applicable operational and escalation policies
and procedures, implement such material system changes and upgrades as
may be required to ensure effective functioning of the CAT System.\506\
Also in consultation with the Operating Committee, the Plan Processor
shall, on an as-needed basis, implement system changes and upgrades to
the CAT System to ensure compliance with applicable laws, regulations
or rules (including those promulgated by the Commission or any
Participant).\507\
---------------------------------------------------------------------------

    \504\ Id. at Section 6.1(d)(iv). Such policies and procedures
also shall: (A) Provide for the escalation of reviews of proposed
technological changes and upgrades (including as required by Section
6.1(i) and Section 6.1(j) or as otherwise appropriate) to the
Operating Committee; and (B) address the handling of surveillance,
including coordinated, SEC Rule 17d-2 or RSA surveillance queries
and requests for data. Id.
    \505\ Id. at Section 6.1(i). Section 11 of Appendix D sets out
the obligations of the Plan Processor with respect to the
requirements discussed above (e.g., to develop a process to add
functionality to CAT, including reviewing suggestions submitted by
the Commission). The Plan Processor must create a defined process
for developing impact assessments, including implementation
timelines for proposed changes, and a mechanism by which functional
changes that the Plan Processor wishes to undertake could be
reviewed and approved by the Operating Committee. Section 11 further
states that the Plan Processor must implement a process to govern
changes to CAT (including ``business-as-usual'' changes and isolated
infrastructure changes). Further, Section 11 states that the Plan
Processor is required to implement a process governing user testing
of changes to CAT functionality and infrastructure. See id. at
Appendix D, Section 11.
    \506\ Id. at Section 6.1(j).
    \507\ Id. at Section 6.1(k).
---------------------------------------------------------------------------

    Appendix D provides additional detail about the obligations of the
Plan Processor with respect to CAT Functional Changes, CAT
Infrastructure Changes, and Testing of New Changes.\508\ In particular,
the Plan Processor is required to propose a process for considering new
functions, which must include a mechanism for suggesting changes to the
Operating Committee from Advisory Committee members, the Participants
and the Commission. The process must also include a method for
developing impact assessments, including implementation timelines for
proposed changes, and a mechanism by which functional changes that the
Plan Processor wishes to undertake could be reviewed and approved by
the Operating Committee.\509\
---------------------------------------------------------------------------

    \508\ Id. at Appendix D, Section 11.
    \509\ Id. at Appendix D, Section 11.1.
---------------------------------------------------------------------------

    The CAT NMS Plan also requires that the Plan Processor develop a
similar process to govern the changes to the Central Repository--i.e.,
business-as-usual changes that could be performed by the Plan Processor
with only a summary report to the Operating Committee, and
infrastructure changes that would require approval by the Operating
Committee.\510\ Finally, a process for user testing of new changes must
be developed by the Plan Processor.\511\
---------------------------------------------------------------------------

    \510\ Id. at Appendix D, Section 11.2.
    \511\ Id. at Appendix D, Section 11.3.
---------------------------------------------------------------------------

    In addition, the CAT NMS Plan requires that the Plan Processor
ensure that the Central Repository's technical

infrastructure is scalable (to increase capacity to handle increased
reporting volumes); adaptable (to support future technology
developments so that new requirements could be incorporated); and
current (to ensure, through maintenance and upgrades, that technology
is kept current, supported, and operational).\512\
---------------------------------------------------------------------------

    \512\ See id. at Appendix C, Section A.5(a).
---------------------------------------------------------------------------

23. Business Continuity and Disaster Recovery

    The CAT NMS Plan provides that the Plan Processor must develop
disaster recovery and business continuity plans to support the
continuation of CAT business operations.\513\ The Plan Processor is
required to provide the Operating Committee with regular reports on the
CAT System's operation and maintenance that specifically address
Participant usage statistics for the Plan Processor and the Central
Repository, including capacity planning studies and daily reports
called for by Appendix D, as well as business continuity planning and
disaster recovery issues for the Plan Processor and the Central
Repository, taking into account the business continuity planning and
disaster recovery requirements in the Business Continuity Planning/
Disaster Recovery (``BCP/DR'') Process set forth in Appendix D.\514\
---------------------------------------------------------------------------

    \513\ Id. at Appendix D, Sections 5.3-5.4.
    \514\ Id. at Section 6.1(o)(iii).
---------------------------------------------------------------------------

    The CAT NMS Plan requires the Business Continuity Plan to address
protection of data, service for data submissions, processing, data
access, support functions and operations.\515\ Additionally, the Plan
Processor must develop a process to manage and report breaches.\516\ A
secondary site that is fully equipped for immediate use must be
selected to house critical staff necessary for CAT business operations,
and planning should consider operational disruption and significant
staff unavailability, but the Business Continuity Plan must also
establish an effective telecommuting solution for critical staff which
must ensure that CAT Data may not be downloaded to equipment that is
not CAT-owned or compliant with CAT security requirements.\517\ The
Business Continuity Plan will include a bi-annual test of CAT
operations from the secondary site, and CAT operations staff must
maintain and annually test remote access to ensure smooth operations in
case of a ``site un-availability event.'' \518\ The Business Continuity
Plan must also identify critical third-party dependencies to be
involved in tests on an annual basis, and the Plan Processor will
develop and annually test a crisis management plan to be invoked in
specified circumstances.\519\ The Plan Processor must also conduct the
following: An annual Business Continuity Audit using an Independent
Auditor approved by the Operating Committee; and regular third party
risk assessments to verify that security controls are in accordance
with NIST SP 800-53.\520\ Appendix C mandates the use of a hot-warm
structure for disaster recovery, where in the event of a disaster, the
software and data would need to be loaded into the backup site for it
to become operational.\521\
---------------------------------------------------------------------------

    \515\ Id. at Appendix D, Section 5.1.
    \516\ Id. at Appendix D, Section 5.2.
    \517\ Id. at Appendix D, Section 5.3.
    \518\ Id.
    \519\ Id.
    \520\ Id.
    \521\ Id. at Appendix C, Section 12(o). Appendix D, Section 5,
provides details on how the CAT's BCP/DR process would be
structured. In part, Appendix D states, ``[a] secondary processing
site must be capable of recovery and restoration of services at the
secondary site within a minimum of 48 hours, but with the goal of
achieving next day recovery after a disaster event. The selection of
the secondary site must consider sites with geographic diversity
that do not rely on the same utility, telecom and other critical
infrastructure services. The processing sites for disaster recovery
and business continuity must adhere to the ``Interagency Paper on
Sound Practices to Strengthen the Resilience of the U.S. Financial
System.'' Id. at Appendix D, Section 5.1.
---------------------------------------------------------------------------

    Appendix D also requires that the Plan Processor provide an
industry test environment that is discrete and separate from the
production environment, but functionally equivalent to the production
environment. The industry test environment must have end-to-end
functionality meeting the standards of the production SLA, the
performance metrics of the production environment, and management with
the same information security policies applicable to the production
environment.\522\ The industry test environment must have minimum
availability of 24x6, and must support such things as: Testing of
technical upgrades by the Plan Processor, testing of CAT code releases
impacting CAT Reporters, testing of changes to industry data feeds,
industry-wide disaster recovery testing, individual CAT Reporter and
Data Submitter testing of their upgrades against CAT interfaces and
functionality, and multiple, simultaneous CAT Reporter testing.\523\
The Plan Processor must provide the linkage processing of data
submitted during industry-wide testing, as well as support for industry
testing.\524\
---------------------------------------------------------------------------

    \522\ Id. at Appendix D, Section 1.2.
    \523\ Id.
    \524\ Id.
---------------------------------------------------------------------------

24. Records and Accounting and Dissolution and Termination of the
Company

    Article IX of the CAT NMS Plan sets forth the Company's obligations
and policies related to books and records, accounting, company funds
and tax matters.\525\ The CAT NMS Plan provides that the Company must
maintain complete and accurate books and records of the Company in
accordance with Rule 17a-1.\526\ The CAT NMS Plan further provides that
books and records will be maintained and be made available at the
office of the Plan Processor and/or such other Company designated
locations.\527\ The CAT NMS Plan specifies that all CAT Data and other
Company books and records are the property of the Company (and not the
property of the Plan Processor), and to the extent in the possession of
the Plan Processor, they will be made available to the Commission upon
reasonable request.\528\
---------------------------------------------------------------------------

    \525\ Id. at Article IX.
    \526\ 17 CFR 240.17a-1. Upon request, representative copies of
books and records maintained under Rule 17a-1 must be furnished to
the Commission. 17 CFR 240.17a-1(c); see also CAT NMS Plan, supra
note 5, at Section 9.1.
    \527\ See CAT NMS Plan, supra note 5, at Section 9.1.
    \528\ Id.
---------------------------------------------------------------------------

    Article IX also includes a confidentiality provision (subject to
several express carve-outs) wherein the Receiving Party (the Company or
a Participant) must hold in confidence information received from a
Disclosing Party (the Company or any other Participant); and the
Receiving Party may only disclose such information if prior written
approval from the Disclosing Party is obtained.\529\ The
confidentiality provision applies to information that is disclosed in
connection with the CAT NMS Plan or the CAT System but expressly carves
out the following: (i) CAT Data or information otherwise disclosed
pursuant to the requirements of Rule 613; \530\ (ii) any information
that was already lawfully in the Receiving Party's possession and, to
the knowledge of the Receiving Party, free from any confidentiality
obligation to the Disclosing Party at the time of receipt from the
Disclosing Party; (iii) any information that is, now or in the future,

public knowledge; (iv) any information that was lawfully obtained from
a third party having the right to disclose it free from any obligation
of confidentiality; or (v) any information that was independently
developed by the Receiving Party prior to disclosure by a Disclosing
Party.\531\ Finally, the CAT NMS Plan provides that the confidentiality
provision does not restrict disclosures required by: (i) Applicable
laws and regulations, stock market or exchange requirements or the
rules of any self-regulatory organization having jurisdiction; (ii) an
order, subpoena or legal process; or (iii) for the conduct of any
litigation or arbitral proceeding among the Participants (and their
respective representatives) and/or the Company.\532\
---------------------------------------------------------------------------

    \529\ Id. at Section 9.6. The CAT NMS Plan states that the
information is disclosed by or on behalf of the Company or a
Participant (the ``Disclosing Party'') to the Company or any other
Participant (the ``Receiving Party'') in connection with the
Agreement or the CAT System, but excludes any CAT Data or
information otherwise disclosed pursuant to the requirements of Rule
613. See CAT NMS Plan, supra note 5, at Section 9.6(a).
    \530\ 17 CFR 242.613.
    \531\ See CAT NMS Plan, supra note 5, at Section 9.6(a).
    \532\ Id.
---------------------------------------------------------------------------

    The CAT NMS Plan includes provisions relating to the dissolution of
the Company.\533\ Any dissolution of the Company requires SEC approval
and must be as a result of one of the following events (a ``Triggering
Event''): (i) Unanimous written consent of the Participants; (ii) an
event makes it unlawful or impossible for the Company business to be
continued; (iii) the termination of one or more Participants such that
there is only one remaining Participant; or (iv) a decree of judicial
dissolution.\534\ If a Triggering Event has occurred and the SEC
approves the Company's dissolution, the Operating Committee would act
as liquidating trustee and liquidate and distribute the Company
pursuant to the following necessary steps under the CAT NMS Plan: (i)
Sell the Company's assets; and (ii) apply and distribute the sale
proceeds by first, paying the Company's debts and liabilities; second,
establishing reasonably necessary reserves for contingent recourse
liabilities and obligations; and third, making a distribution to the
Participants in proportion to the balances in their positive Capital
Accounts.\535\
---------------------------------------------------------------------------

    \533\ Id. at Article X.
    \534\ Id. at Section 10.1.
    \535\ Id. at Section 10.2.
---------------------------------------------------------------------------

25. Security of Data

    The CAT NMS Plan provides that the Plan Processor is responsible
for the security and confidentiality of all CAT Data received and
reported to the Central Repository, including during all communications
between CAT Reporters and the Plan Processor, data extraction, data
manipulation and transformation, loading to and from the Central
Repository, and data maintenance by the Central Repository.\536\ The
Plan Processor must, among other things, require that individuals with
access to the Central Repository agree to use CAT Data only for
appropriate surveillance and regulatory activities and to employ
safeguards to protect the confidentiality of CAT Data.\537\
---------------------------------------------------------------------------

    \536\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(i),
(iv)(A).
    \537\ Id. at Section 6.5(f)(i)(A).
---------------------------------------------------------------------------

    In addition, the Plan Processor must develop a comprehensive
information security program as well as a training program that
addresses the security and confidentiality of all information
accessible from the CAT and the operational risks associated with
accessing the Central Repository.\538\ The Plan Processor must also
designate one of its employees as CISO; among other things, the CISO is
responsible for creating and enforcing appropriate policies,
procedures, and control structures regarding data security.\539\ The
Technical Specifications, which the Plan Processor must publish, must
include a detailed description of the data security standards for
CAT.\540\ Appendix D of the CAT NMS Plan sets forth minimum data
security requirements for CAT that the Plan Processor must meet.\541\
---------------------------------------------------------------------------

    \538\ Id. at Sections 6.1(m), 6.12.
    \539\ Id. at Section 6.2(b)(i), (v).
    \540\ Id. at Section 6.9(b)(xi).
    \541\ Id. at Appendix D, Section 4.
---------------------------------------------------------------------------

a. General Standards
    The CAT NMS Plan provides that the data security standards of the
CAT System shall, at a minimum satisfy all applicable regulations
regarding database security, including provisions of Reg SCI.\542\
Appendix D of the CAT NMS Plan contains a partial list of industry
standards to which the Plan Processor will adhere, including standards
issued by the NIST; \543\ by the Federal Financial Institutions
Examination Council,\544\ and the International Organization for
Standardization.\545\
---------------------------------------------------------------------------

    \542\ 17 CFR 242.1000-1007; see also CAT NMS Plan, supra note 5,
at Section 6.9(b)(xi).
    \543\ Standards issued by NIST that are explicitly listed in the
CAT NMS Plan include NIST Security and Privacy Controls for Federal
Information Systems and Organizations (Special Publication 800-53
Rev. 4); NIST Contingency Planning Guide for Federal Information
Systems (Special Publication 800-34 Rev. 1), particularly Chapters
3, 4 & 5; NIST Guidelines to Federal Organizations on Security
Assurance and Acquisition/Use of Test/Evaluated Products (Special
Publication 800-23); NIST Technical Guide to Information Security
Testing and Assessment (Special Publication 800-115); NIST Guide to
Enterprise Password Management (Special Publication 800-118); NIST
Recommendation for Cryptographic Key Generation (Special Publication
800-133); and NIST Information Security Continuous Monitoring for
Federal Information Systems and Organizations (Special Publication
800-137). See CAT NMS Plan, supra note 5, at Appendix D, Sections
4.2, 5.2 and 5.3.
    \544\ Standards issued by the Federal Financial Institutions
Examination Council that are explicitly listed in the CAT NMS Plan
include FFIEC Authentication Best Practices, and the Federal
Financial Institutions Examination Council, Supplement to
Authentication in an Internet Banking Environment (June 22, 2011).
See CAT NMS Plan, supra note 5, at Appendix D, Sections 4.1.1, 4.2.
    \545\ Standards issued by the International Organization for
Standardization that are explicitly listed in the CAT NMS Plan
include ISO/IEC 27001--Information Security Management. See CAT NMS
Plan, supra note 5, at Appendix D, Section 4.2. The CAT NMS Plan
also states that the CAT System must adhere to the 2003 Interagency
White Paper on Sound Practices to Strengthen the Resilience of the
U.S. Financial System, Securities Exchange Act Release No. 47638
(April 8, 2003), 68 FR 17809 (April 11, 2003). See CAT NMS Plan,
supra note 5, at Appendix D, Section 5.3.
---------------------------------------------------------------------------

    The CAT NMS Plan specifies that the Plan Processor is responsible
for the security and confidentiality of all CAT Data received and
reported to the Central Repository, including during all communications
between CAT Reporters and the Plan Processor, data extraction, data
manipulation and transformation, loading to and from the Central
Repository, and data maintenance by the Central Repository.\546\ The
Plan Processor must also designate one of its employees as the CISO;
among other things, the CISO is responsible for creating and enforcing
appropriate policies, procedures, and control structures regarding data
security.\547\
---------------------------------------------------------------------------

    \546\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(i),
(iv)(A).
    \547\ Id. at Section 6.2(b)(i), (v).
---------------------------------------------------------------------------

b. Data Confidentiality
    The CAT NMS Plan also requires that the Plan Processor must develop
a comprehensive information security program, with a dedicated staff
for the Central Repository, that employs state of the art technology,
which program will be regularly reviewed by the CCO and CISO, as well
as a training program that addresses the security and confidentiality
of all information accessible from the CAT and the operational risks
associated with accessing the Central Repository.\548\ The Plan
Processor must also implement and maintain a mechanism to confirm the
identity of all individuals permitted to access the CAT Data stored in
the Central Repository; maintain a record of all instances where such
CAT Data was accessed; and implement and maintain appropriate policies
regarding limitations on trading activities of its employees and
independent contractors

involved with all CAT Data.\549\ The Technical Specifications, which
will be published after the Plan Processor is selected, must include a
detailed description of the data security standards for the CAT.\550\
---------------------------------------------------------------------------

    \548\ Id. at Sections 6.1(m), 6.5(f)(i)(C).
    \549\ Id. at Section 6.5(f)(i)(D), (E).
    \550\ Id. at Section 6.9.
---------------------------------------------------------------------------

    According to the CAT NMS Plan, the Plan Processor must require that
individuals with access to the Central Repository (including the
respective employees and consultants of the Participants and the Plan
Processor, but excluding employees and Commissioners of the SEC) to
agree: (i) To use appropriate safeguards to ensure the confidentiality
of the CAT Data stored in the Central Repository and (ii) to not use
CAT Data stored in the Central Repository for purposes other than
surveillance and regulation in accordance with such individual's
employment duties.\551\ A Participant, however, is permitted to use the
CAT Data it reports to the Central Repository for regulatory,
surveillance, commercial or other purposes as permitted by applicable
law, rule, or regulation.\552\ In addition, the CAT NMS Plan provides
that all individuals with access to the Central Repository (including
the respective employees and consultants of the Participants and the
Plan Processor, but excluding employees and Commissioners of the SEC)
must execute a personal ``Safeguard of Information Affidavit'' in a
form approved by the Operating Committee providing for personal
liability for misuse of data.\553\
---------------------------------------------------------------------------

    \551\ Id. at Section 6.5(f)(i)(A).
    \552\ Id.
    \553\ Id. at Section 6.5(f)(i)(B).
---------------------------------------------------------------------------

c. Data Security
    Appendix D of the CAT NMS Plan sets forth minimum data security
requirements for CAT that the Plan Processor must meet, including
various connectivity, data transfer, and encryption requirements.\554\
---------------------------------------------------------------------------

    \554\ See CAT NMS Plan, supra note 5, at Appendix D, Section 4.
---------------------------------------------------------------------------

    Appendix D states that the CAT Systems must have encrypted internet
connectivity, and that CAT Reporters must connect to the CAT
infrastructure using secure methods such as private lines or, for
smaller broker-dealers, Virtual Private Network connections over public
lines.\555\ Remote access to the Central Repository must be limited to
authorized Plan Processor Staff and must use secure ``Multi-factor
Authentication'' (or ``MFA'') that meets or exceeds Federal Financial
Institutions Examination Council security guidelines surrounding
authentication best practices.\556\ Appendix D also notes that CAT
databases must be deployed within the network infrastructure so that
they are not directly accessible from external end-user networks.\557\
If public cloud infrastructures are used, Appendix D states that
network segments or private tenant segmentation must be used to isolate
CAT Data from unauthenticated public access.\558\
---------------------------------------------------------------------------

    \555\ Id. at Appendix D, Section 4.1.1.
    \556\ Id. Multi-factor authentication, or MFA, is a method
requiring a person to provide more than one factor (e.g.,
biometrics/personal information in addition to a password) in order
to be validated by the system.). See id. at Appendix C, Section
D.12(e), n.250.
    \557\ See id. at Appendix D, Section 4.1.1.
    \558\ Id.
---------------------------------------------------------------------------

    Regarding data encryption, Appendix D states that all CAT Data must
be encrypted in-flight using industry standard best practices (e.g.,
SSL/TLS).\559\ Appendix D provides that symmetric key encryption must
use a minimum key size of 128 bits or greater (e.g., AES-128), though
larger keys are preferable.\560\ Asymmetric key encryption (e.g., PGP)
for exchanging data between Data Submitters and the Central Repository
is desirable.\561\
---------------------------------------------------------------------------

    \559\ Id. at Appendix D, Section 4.1.2.
    \560\ Id.
    \561\ Id.
---------------------------------------------------------------------------

    Appendix D further states that CAT Data stored in a public cloud
must be encrypted at-rest.\562\ Non-personally identifiable information
in CAT Data stored in a Plan Processor private environment is not
required to be encrypted at-rest.\563\ If public cloud managed services
are used that would inherently have access to the data (e.g., BigQuery,
S3, Redshift), then the key management surrounding the encryption of
that data must be documented (particularly whether the cloud provider
manages the keys, or if the Plan Processor maintains that
control).\564\ Auditing and real-time monitoring of the service for
when cloud provider personnel are able to access/decrypt CAT Data must
be documented, as well as a response plan to address instances where
unauthorized access to CAT Data is detected.\565\ Key management/
rotation/revocation strategies and key chain of custody must also be
documented in detail.\566\
---------------------------------------------------------------------------

    \562\ Id.
    \563\ Id.
    \564\ Id.
    \565\ Id.
    \566\ Id.
---------------------------------------------------------------------------

    Regarding CAT Data storage, the CAT NMS Plan states that data
centers housing CAT Systems (whether public or private) must, at a
minimum, be SOC 2 certified by an independent third-party auditor.\567\
The frequency of the audit must be at least once per year.\568\
Furthermore, CAT computer infrastructure may not be commingled with
other non-regulatory systems (or tenets, in the case of public cloud
infrastructure).\569\ Systems hosting the CAT processing for any
applications must be segmented from other systems as far as is feasible
on a network level (firewalls, security groups, ACL's, VLAN's,
authentication proxies/bastion hosts and similar).\570\ In the case of
systems using inherently shared infrastructure/storage (e.g., public
cloud storage services), an encryption/key management/access control
strategy that effectively renders the data private must be
documented.\571\
---------------------------------------------------------------------------

    \567\ Id. at Appendix D, Section 4.1.3.
    \568\ Id.
    \569\ Id.
    \570\ Id.
    \571\ Id.
---------------------------------------------------------------------------

    Appendix D further requires that the Plan Processor must include
penetration testing and an application security code audit by a
reputable (and named) third party prior to the launch of CAT as well as
periodically as defined in the SLAs.\572\ Reports of the audit will be
provided to the Operating Committee as well as a remediation plan for
identified issues.\573\ The penetration test reviews of the Central
Repository's network, firewalls, and development, testing and
production systems should help the CAT evaluate the systems' security
and resiliency in the face of attempted and successful systems
intrusions.\574\
---------------------------------------------------------------------------

    \572\ Id.
    \573\ Id.
    \574\ Id.
---------------------------------------------------------------------------

    The CAT NMS Plan also addresses issues surrounding access to CAT
Data. Among other things, the CAT NMS Plan requires the Plan Processor
to provide an overview of how access to PII and other CAT Data by Plan
Processor employees and administrators is restricted.\575\ This
overview must include items such as, but not limited to, how the Plan
Processor will manage access to the systems, internal segmentation,
MFA, separation of duties, entitlement management, and background
checks.\576\ The Plan Processor must develop and maintain policies and
procedures reasonably designed to prevent, detect, and mitigate the
impact of unauthorized access or usage of data in the Central
Repository.\577\ The CAT NMS Plan also specifically states that a Role
Based Access Control (``RBAC'') model must

be used to permission users with access to different areas of the CAT
System.\578\ The Plan Processor must log every instance of access to
Central Repository data by users.\579\ The CAT NMS Plan also has
specific provisions related to passwords and logins, particularly as
these relate to accessing PII in the Central Repository.\580\ Any login
to the system that is able to access PII data must follow non-PII
password rules and must be further secured via MFA.\581\
---------------------------------------------------------------------------

    \575\ Id. at Appendix D, Section 4.1.4.
    \576\ Id.
    \577\ Id.
    \578\ Id.
    \579\ Id.
    \580\ See id.
    \581\ Id.
---------------------------------------------------------------------------

    Appendix D also addresses what should be done in the event there is
a breach in the security systems protecting CAT Data. Appendix D
requires the Plan Processor to develop policies and procedures
governing its responses to systems or data breaches.\582\ Such policies
and procedures will include a formal cyber incident response plan, and
documentation of all information relevant to breaches.\583\ The cyber
incident response plan will provide guidance and direction during
security incidents, and the plan will be subject to approval by the
Operating Committee.\584\
---------------------------------------------------------------------------

    \582\ Id. at Appendix D, Section 4.1.5.
    \583\ Id.
    \584\ Id.
---------------------------------------------------------------------------

d. Data Access and Use
    The CAT NMS Plan states that the Plan Processor shall provide
Participants and the Commission with access to and use of the CAT Data
stored in the Central Repository solely for the purpose of performing
their respective regulatory and oversight responsibilities pursuant to
federal securities laws, rules and regulations or any contractual
obligations.\585\ The Plan specifies that Participants shall establish,
maintain and enforce written policies and procedures reasonably
designed to ensure the confidentiality of the CAT Data obtained from
the Central Repository and limit the use of CAT Data obtained from the
Central Repository to surveillance and regulatory purposes.\586\ The
CAT NMS Plan provides that Participants must adopt and enforce policies
and procedures that implement effective information barriers between
each Participant's regulatory and non-regulatory Staff with regard to
CAT Data, permit only persons designated by Participants to have access
to the CAT Data stored in the Central Repository; and impose penalties
for Staff non-compliance with any of its or the Plan Processor's
policies and procedures with respect to information security.\587\
However, the Plan provides that a Participant may use the Raw Data
\588\ it reports to the Central Repository for ``commercial or other''
purposes if not prohibited by applicable law, rule or regulation.\589\
---------------------------------------------------------------------------

    \585\ See id. at Section 6.5(c)(i).
    \586\ Id. at Section 6.5(g). The Commission notes that
regulatory purposes includes, among other things, analysis and
reconstruction of market events, market analysis and research to
inform policy decisions, market surveillance, examinations,
investigations, and other enforcement functions. See Notice, supra
note 5, at 30649 n.266.
    \587\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(ii).
    \588\ Raw Data is defined as ``Participant Data and Industry
Member Data that has not been through any validation or otherwise
checked by the CAT System.'' Id. at Section 1.1.
    \589\ Id. at Section 6.5(h).
---------------------------------------------------------------------------

    Article VI of the CAT NMS Plan requires that the Plan Processor
provide regulators access to the Central Repository for regulatory and
oversight purposes and create a method of accessing CAT Data that
includes the ability to run complex searches and generate reports.\590\
Section 6.10(c) of the CAT NMS Plan requires regulator access by two
different methods: (i) An online targeted query tool with predefined
selection criteria to choose from; and (ii) user-defined direct queries
and bulk extractions of data via a query tool or language allowing
querying of all available attributes and data sources.\591\ Appendix D
contains technical details and parameters for use by the Plan Processor
in developing the systems that will allow regulators access to CAT
Data.\592\
---------------------------------------------------------------------------

    \590\ Id. at Section 6.5(c)(i), (ii). Appendix C provides
objective milestones to assess progress concerning regulator access
to the Central Repository. See id. at Appendix C, Section C.10(d).
    \591\ Id. at Section 6.10(c)(i). Section 6.10(c) also requires
the Plan Processor to reasonably assist regulatory Staff with
queries, submit queries on behalf of regulatory Staff as requested,
and maintain a help desk to assist regulatory Staff with questions
concerning CAT Data. Id. at 6.10(c)(iv)-(vi).
    \592\ See id. at Appendix D, Section 8.
---------------------------------------------------------------------------

    Appendix C addresses the time and method by which CAT Data would be
available to regulators.\593\ Specifically, Appendix C requires that
data be available to regulators any point after the data enters the
Central Repository and passes basic format validations.\594\ After
errors are communicated to CAT Reporters on a T+1 basis, CAT Reporters
would be required to report corrected data back to the Central
Repository by 8:00 a.m. ET on T+3.\595\ Regulators must then have
access to corrected and linked order and Customer data by 8:00 a.m. ET
on T+5.\596\ Appendix C further outlines requirements the Plan
Processor must meet for report building and analysis regarding data
usage by regulators, consistent with, and in addition to, the
specifications outlined in Appendix D.\597\
---------------------------------------------------------------------------

    \593\ Id. at Appendix C, Section A.2.
    \594\ Id. at Appendix C, Section A.2(a). Appendix C, Section
A.3(e) indicates this would be no later than noon EST on T+1. Id. at
Appendix C, Section A.3(e).
    \595\ Id. at Appendix C, Section A.1(a)(iv); Appendix D, Section
6.1.
    \596\ Id. at Appendix C, Section A.2(a).
    \597\ Id. at Appendix C, Section A.2(c). Appendix C, Section
A.2(d) addresses system service level agreements that the SROs and
Plan Processor would enter into. See id. at Appendix C, Section
A.2(d).
---------------------------------------------------------------------------

e. Personally Identifiable Information
    According to the CAT NMS Plan, there are two separate categories of