routed order.'' The Commission believes these changes from the proposal
are appropriate because they conform Rule 613(j)(9) to the provisions
of Rule 613(c)(7). Specifically, Rule 613(c)(7) is structured around
each ``reportable event;'' therefore, audit trail data is listed
according to the data that must be reported upon ``original receipt or
origination'' of an order (Rule 613(c)(7)(i)); ``routing'' of an order
(Rule 613(c)(7)(ii)); ``receipt of an order that has been routed''
(Rule 613(c)(7)(iii)); ``modification or cancellation'' of an order
(Rule 613(c)(7)(iv)); and ``execution'' of an order (Rule 613(c)(7)(v)
and (vi)).
    As noted above, the Commission received comments on the information
proposed to be recorded and reported to the central repository with
each reportable event (i.e., the consolidated audit trail data
elements) and, in response, is adopting the Rule with certain
modifications from the proposed Rule with respect to certain of the
consolidated audit trail data elements. In so adopting the Rule, the
Commission acknowledges that costs will be incurred by SROs and their
members to record and report this information to the central repository
and by the central repository to receive, consolidate, store and make
accessible such information.\286\ However, the Commission believes that
the costs to SRO members for reporting this information, and the costs
to the central repository for collecting and storing this information,
will significantly depend on the exact details of how this information
will be gathered and transmitted by the various types of market
participants covered by Rule 613. The Commission is therefore requiring
the SROs to include as part of the NMS plan submitted to the Commission
for its consideration pursuant to the Rule, details of how each of the
different data elements would be recorded, reported, collected, and
stored, as well as cost estimates for the proposed solution, and a
discussion of the costs and benefits of alternate solutions considered
but not proposed. The Commission also notes that the SROs are not
prohibited from proposing additional data elements not specified in
Rule 613 if the SROs believe such data elements would further, or more
efficiently, facilitate the requirements of the Rule.
---------------------------------------------------------------------------

    \286\ In particular, the Commission acknowledges that certain
elements are not collected by existing audit trails and thus SROs
and members would incur additional costs to record and report such
information. The Commission also acknowledges that there might be
additional costs with respect to assigning customer identifiers, the
broker-dealer identifiers and the order identifiers because such
assignments might, depending on the NMS plan, require coordination
amongst various different entities and possibly further systems
changes.
---------------------------------------------------------------------------

    Once the SROs have submitted an NMS plan with these details, the
Commission will be able to use this information to determine whether to
approve the NMS plan. The Commission at this time is only directing the
SROs to develop and submit a detailed NMS plan that includes each of
the data elements. The Commission is not making a final determination
of the nature and scope of the data elements to be included in the
consolidated audit trail--as discussed above, these determinations will
be made after the SROs submit the NMS plan, and the Commission and
public have had an opportunity to consider the proposed data elements.
    Rather, at this time the Commission is only making a more limited
determination. The benefits the Commission and the public will receive
from being able to consider the detailed costs and benefits of the
specific set of data elements submitted to the Commission for its
consideration pursuant to the Rule justify the costs of preparing the
NMS plan with such data elements included.
    A discussion of these consolidated audit trail data elements
follows.
i. Material Terms of the Order
    As proposed, Rule 613 would have required broker-dealers to report
the material terms of the order upon origination or receipt of an order
and upon routing, modification, and cancellation of an order.\287\
Proposed Rule 613(j)(3) (renumbered as Rule 613(j)(7)) defined material
terms of the order to include, but not be limited to, the following
information: (1) The NMS security symbol; (2) the type of security; (3)
price (if applicable); (4) size (displayed and non-displayed); (5) side
(buy/sell); (6) order type; (7) if a sell order, whether the order is
long, short, or short exempt; \288\ (8) if a short sale,

the locate identifier; (9) open/close indicator; (10) time in force (if
applicable); (11) whether the order is solicited or unsolicited; (12)
whether the account has a prior position in the security; (13) if the
order is for a listed option, option type (put/call), option symbol or
root symbol, underlying symbol, strike price, expiration date, and
open/close; and (14) any special handling instructions.
---------------------------------------------------------------------------

    \287\ See proposed Rules 613(c)(7)(i)(I), 613(c)(7)(ii)(G),
613(c)(7)(iii)(F), and 613(c)(7)(iv)(D).
    \288\ A broker or dealer currently must mark all sell orders of
any equity security as long, short, or short exempt. See Rule
200(g)(1) under the Exchange Act, 17 CFR 242.200(g)(1). A sell order
may be marked short exempt only if the conditions of Rule 201(c) or
(d) under the Exchange Act are met (17 CFR 242.201(c) and (d)). See
Rule 200(g)(2) under the Exchange Act, 17 CFR 242.200(g)(2).
---------------------------------------------------------------------------

    The Commission requested comment on whether there are any items of
information that are required to be recorded and reported by existing
audit trail rules, or to be provided to the SROs or the Commission upon
request, that were not proposed but should have been included in the
Rule. One commenter suggested that two data elements be added to aid
regulators in detecting the original source of orders that violate laws
or are involved in market manipulations.\289\ Specifically, this
commenter recommended that the proposed Rule should capture the
identity of the individual who originated the order (in addition to
identifying the firm) and the system he or she used to originate the
order.\290\ Another commenter questioned the need for information
regarding whether an account has a prior position in a security.\291\
The commenter expressed skepticism about the value of knowing, in real
time, whether the customer has a prior position in the security, since
the length of time the position has been held would not be captured.
This commenter also questioned how the Commission's requirement that
the prior position in a security be reported would work in the
situation where a client has multiple accounts but it is the first time
the client has opened a position in one of the accounts.\292\ Another
commenter provided specific information on the exact data elements that
it could incorporate into the consolidated audit trail if it were
chosen as the central processor under Rule 613.\293\
---------------------------------------------------------------------------

    \289\ See Kumaraguru Letter, p. 1.
    \290\ Id.
    \291\ See Ameritrade Letter, p. 3.
    \292\ Id.
    \293\ See FINRA Proposal Letter, Appendix A.
---------------------------------------------------------------------------

    The Commission considered the views of the commenter that
questioned the value of knowing whether a customer has a prior position
in a security. The Commission also considered the commenter's concern
about potential reporting complications for clients with multiple
accounts, as well as general comments urging the Commission to reduce
the burdens of the Rule, and is adopting proposed Rule 613(j)(3)
(renumbered as Rule 613(j)(7)) with modifications to delete certain
data elements.
    After considering the commenters' views, and re-evaluating the
necessity of requiring certain specific data elements, the Commission
has determined not to require the locate identifier (if a short sale);
whether the order is solicited or unsolicited; and whether the account
has a prior position in the security. The Commission believes the
consolidated audit trail can still achieve significant benefits without
requiring the routine recording and reporting of these specific data
elements to the central repository.\294\ While this information may be
useful for certain investigations and market analyses, the Commission
believes that this additional data could be readily obtained from a
follow-up request to a broker-dealer if the other data required by
proposed Rule 613(j)(3), particularly relating to the customer behind
the order, is included in the consolidated audit trail. Thus, the
Commission believes that it is unnecessary to require this additional
data to be reported as a standard part of the consolidated audit trail.
In effect, the Commission believes that the benefits of having these
specific audit trail data elements are minimal. As such, the Commission
does not believe the benefits to the Commission and the public to
consider the detailed costs and benefits of such data elements justify
the costs to SROs for including them in their NMS plan submission.
---------------------------------------------------------------------------

    \294\ See Section II.A.2., supra.
---------------------------------------------------------------------------

    In response to the commenter who recommended that the proposed Rule
should capture the identity of the individual who originated the order
(in addition to identifying the firm) and the system he or she used to
originate the order,\295\ the Commission notes that Rule 613 defines
``customer'' as: ``(i) The account holder(s) of the account at a
registered broker-dealer originating the order; and (ii) any person
from whom the broker-dealer is authorized to accept trading
instructions for such account, if different from the account
holder(s).'' \296\ The Rule does not require the identification of the
individual registered representative who placed the order.\297\
Further, the Commission does not believe that ``the system he or she
used to originate the order'' is of significant enough regulatory value
to require that information to be recorded and reported under Rule 613
at this time.
---------------------------------------------------------------------------

    \295\ See Kumaraguru Letter, p. 1.
    \296\ See Rule 613(j)(3); see also Section
III.B.1.d.iii.(C).(2)., infra (discussing the definition of
``customer'' as applied to investment advisers).
    \297\ See Section III.B.1.d.ii., infra, for a discussion of the
proposed requirement to report the unique identifier of the
registered representative receiving or originating an order.
---------------------------------------------------------------------------

(A) Order Type
    As proposed, the Rule would have required that members report the
order type as an element of the material terms of an order. In the
Proposing Release, the Commission explained that the proposed Rule does
not specify the exact order types (e.g., market, limit, stop, pegged,
stop limit) that could be reported under the Rule in recognition that
order types may differ across markets and an order type with the same
title may have a different meaning at different exchanges.\298\ The
Commission also noted that markets are frequently creating new order
types and eliminating existing order types. Thus, the Commission
preliminarily believed that it would not be practical to include a list
of order types in the proposed Rule as part of the required information
to be reported to the central repository.
---------------------------------------------------------------------------

    \298\ See Proposing Release, supra note 4, at 32575.
---------------------------------------------------------------------------

    The Commission received one comment in response to its request for
comment on its proposed approach to handling order types. This
commenter believed that the Commission did not think that order types
were needed for the consolidated audit trail, and argued that this
information is ``essential for any attempts to use the order data to
reconstruct the state of the limit order book at any point in time.''
\299\ The Commission agrees that information about an order's type is
important and notes that the Rule, as proposed, did require order types
to be reported.\300\ Thus, the Commission is adopting the Rule, as
proposed, to require plan sponsors to include in the NMS plan submitted
to the Commission for its consideration a requirement for SROs and
members to report the order type as an element of the material terms of
an order. The Rule, however, does not provide an exhaustive list of
order types, as the Commission continues to believe that it is not
feasible to do so in its Rule, for the reasons stated in the Proposing
Release.\301\ Rather, the Commission believes the plan sponsors should
be responsible for determining how to describe and categorize specific
order types in the NMS plan or in the NMS plan's technical
specifications, as there is more flexibility to amend such

documents and the SROs would have the most familiarity with the
variations among the order types on their markets. The Commission notes
that specific order types may differ across markets, and even an order
type with the same title may have a different meaning at different
exchanges. Further, SROs regularly develop new order types to respond
to changes in market structures and trading strategies, and any list of
order types will likely need to be updated over time.
---------------------------------------------------------------------------

    \299\ See Angel Letter, p. 2-3.
    \300\ Order type information is important because it reflects
the intention of the person originating an order with regard to how
an order should be handled, and also provides information regarding
the potential impact of orders on the market.
    \301\ See Proposing Release, supra note 4, at 32575.
---------------------------------------------------------------------------

(B) Special Handling Instructions
    The proposed Rule also would have required that that any special
handling instructions be reported as part of the material terms of an
order.\302\ The Commission specifically requested comment in the
Proposing Release on whether the Rule should require, as part of the
disclosure of special handling instructions, the disclosure of an
individual algorithm that may be used by a member or customer to
originate or execute an order, and, if so, how such an algorithm should
be identified. The Commission received one comment noting the
importance of requiring the special handling instructions to be
included in the consolidated audit trail.\303\ This commenter believed
that special handling instructions were important for reconstructing
the limit order book.\304\ Regarding algorithms, commenters generally
were not in favor of unique identifiers for algorithms.\305\ One
commenter urged against requiring customer information at the level of
``individual strategy, trading desk, or particular algorithm * * *.''
\306\ Another commenter stated that the proposed rule should not
require that unique customer identifiers be affixed to computer
algorithms.\307\ This commenter pointed out that algorithms change
daily, which would result in uncertainty about whether new identifiers
are needed. Further, the commenter argued that firms would need to
develop safeguards to ensure proprietary algorithms and trading
strategies are not appropriated by competitors. This commenter
suggested that, instead of requiring a unique customer identifier, the
Commission could require that a ``flag'' be appended to orders
generated by an algorithm.
---------------------------------------------------------------------------

    \302\ See proposed Rule 613(j)(3).
    \303\ See Angel Letter, p. 2-3.
    \304\ Id.
    \305\ See Managed Funds Association Letter, p. 2; SIFMA Letter,
p. 11; SIFMA Drop Copy Letter, p. 2.
    \306\ See Managed Funds Association Letter, p. 2.
    \307\ See SIFMA Letter, p. 11. SIFMA subsequently submitted an
alternative proposal that did not include a flag for algorithms,
citing lack of clarity in the Commission's definition of algorithmic
order, and stating that the FIX standard lacks existing fields to
flag such orders. Id. at 2.
---------------------------------------------------------------------------

    The Commission agrees with the commenter that supported the
proposed requirement that special handling instructions be reported
\308\ and is adopting this requirement as proposed.\309\ The Commission
believes that such information will be useful to regulators in
attempting to recreate an SRO's limit order book for market
reconstructions. When performing market reconstructions, it is
important for regulators not only to have information regarding what
orders were on the book, but the conditions or special instructions
attached to those orders. Such information can be of key importance in
determining the amount of accessible liquidity at any price point and
whether or not certain orders were entitled to be executed at various
price levels.
---------------------------------------------------------------------------

    \308\ See Angel Letter, p. 2-3.
    \309\ See Rule 613(j)(7).
---------------------------------------------------------------------------

    Additionally, the Commission considered the comments received
regarding whether an individual algorithm should be reported and
identified as part of an order's special handling instructions, and has
determined not to adopt that requirement in recognition that algorithms
change frequently and therefore it may be difficult to determine when
and if new algorithm identifiers are necessary. The Commission also
considered one commenter's concern regarding the proprietary nature of
algorithms and the risk of competitors appropriating algorithms if they
were required to be identified in the consolidated audit trail.
However, the Commission notes that, because the disclosure of whether
an order is a result of an algorithm that makes trading decisions based
on a programmed investment strategy might be useful for the Commission
and the SROs to sort or filter trade data to re-construct market events
or to better evaluate potentially manipulative behavior or intent, the
SROs may want to consider whether it would be feasible to include a
``flag'' or other indicator that would reveal whether an order was the
result of an algorithmic trading calculation. Such a flag would not
identify the actual algorithm used, but could instead indicate whether
the order was the result of an algorithmic trade. Appending such a
``flag'' or indicator may aid regulatory authorities in their efforts
to make preliminary assessments about market activity and better allow
the SROs and the Commission to monitor the usage of algorithms over
time. The Commission acknowledges that by not requiring that algorithms
be recorded and reported to the central repository, the consolidated
audit trail may not contain an audit trail data element that might
prove useful to regulatory authorities. The Commission, however,
believes that, should regulatory authorities need such information,
regulators can submit a request for this information and obtain the
information about whether the order was the result of an algorithm
readily from the broker-dealer that handled the order.
ii. Unique National Securities Exchange, National Securities
Association and Broker-Dealer Identifiers
    The Commission proposed to require each member originating or
receiving an order from a customer, and each national securities
exchange, national securities association, and member that subsequently
handles the order to report its own unique identifier to the central
repository. Proposed Rule 613(c)(7)(i)(E) (renumbered as
613(c)(7)(i)(C)) would have provided that any member of an SRO, that
originally receives from a customer or originates a principal order,
shall collect and electronically report ``the unique identifier of the
broker-dealer receiving or originating the order.'' Similarly, proposed
Rule 613(c)(7)(ii)(D) provided that the SRO or any member of such SRO
that routes an order shall collect and electronically report ``the
unique identifier of the broker-dealer or national securities exchange
routing the order.'' Proposed Rule 613(c)(7)(ii)(E) provided that the
SRO or any member of such SRO routing an order shall collect and
electronically report ``the unique identifier of the broker-dealer or
national securities exchange receiving the order.'' Proposed Rule
613(c)(7)(iii)(D) provided that the SRO or any member of such SRO that
receives an order shall collect and electronically report ``the unique
identifier of the broker-dealer or national securities exchange
receiving the order.'' Proposed Rule 613(c)(7)(iii)(E) provided that
the SRO or any member of such SRO that receives an order shall collect
and electronically report ``the unique identifier of the broker-dealer
or national securities exchange routing the order.'' Proposed Rule
613(c)(7)(iv)(E) required, for a modification or a cancellation of an
order, the identity of the person giving such instruction. Proposed
Rule 613(c)(7)(v)(F) provided that the SRO or any member of such SRO
that executes an order in whole or part report ``the unique identifier
of the broker-dealer or national securities

exchange executing the order.'' Further, the Commission proposed to
require a member receiving an order from a customer to report, if
applicable, ``the unique identifier of the branch office and the
registered representative receiving or originating the order.'' \310\
---------------------------------------------------------------------------

    \310\ See Proposed Rule 613(c)(7)(i)(F).
---------------------------------------------------------------------------

    Commenters generally supported the proposed use of unique
identifiers for exchanges and broker-dealers.\311\ One commenter
explained that cross-market surveillance efforts are unduly complicated
if a single market participant has a different identifier for each
market, and stated that the current market participant identifier
(``MPID'') system needed to be updated.\312\ This commenter, however,
questioned whether it was necessary for branch office and registered
representative information to be included in the consolidated audit
trail, stating that the information would increase the amount of data
reported to the consolidated audit trail, but would be useful only in
certain circumstances.\313\ In another letter, the same commenter
proposed to use Central Registration Depository (``CRD'') numbers to
uniquely identify broker-dealers.\314\ Under this system, the commenter
suggested that SROs would be required to link the CRD numbers to unique
MPIDs to create a cross-referenced database, so that data could be
searched and retrieved at the firm level (by CRD number) or by the
unique market center identifiers used by firms for each transaction on
a specific market center.\315\ For activity not occurring on a national
securities exchange, the commenter proposed continued reporting with
MPIDs currently used for OATS reporting.\316\ Another commenter
supported the use of MPIDs as unique identifiers for broker-dealers,
suggesting that the MPIDs of the firms originating each order should be
added to the trade report, but stated that only FINRA and the
Commission should be allowed to access this information.\317\
---------------------------------------------------------------------------

    \311\ See SIFMA Letter, p. 12; Liquidnet Letter, p. 6; FINRA
Letter, p. 4; FINRA Proposal Letter, p. 6.
    \312\ See FINRA Letter, p. 4 (explaining that ``multiple firms
can currently be represented by a single MPID that is used for
market access arrangements and is assigned to another firm that has
no direct relationship to the trading activity being reported under
that MPID''). This commenter also supported the use of more specific
``sub-identifiers'' to allow regulators to distinguish between desks
or trading units within a firm.
    \313\ Id. at p. 9. FINRA also requested that the Commission
reconsider the need for reporting the identification of the
beneficial owner, the identification of the person exercising
investment discretion, and the unique identifier of the branch
office and registered representative. For further discussion of this
comment, see note 170 supra and accompanying text.
    \314\ See FINRA Proposal Letter, p. 6, 13. The CRD is the
central licensing and registration system operated by FINRA which
contains employment, qualification and disciplinary histories for
securities industry professionals who do business with the public.
    \315\ See FINRA Proposal Letter, p. 6, 13.
    \316\ Id. at p. 6.
    \317\ See Angel Letter, p. 2.
---------------------------------------------------------------------------

    After considering commenters' views requesting additional
flexibility with respect to the unique identifiers requirement for
national securities exchanges, national securities associations, and
members, the Commission has determined to adopt the Rule to require
plan sponsors to include in the NMS plan submitted to the Commission
for its consideration a requirement for such unique identifiers,
substantially as proposed. The Commission, however, has made two
technical changes to the Rule text from the proposal to: (1) Add a
defined term, ``CAT-Reporter-ID,'' in adopted Rule 613(j)(2) to refer
to these unique identifiers, and (2) expressly permit that a ``code''
be used that uniquely and consistently identifies the national
securities exchange, national securities association, or member.
Specifically, adopted Rule 613(j)(2) provides that ``[t]he term CAT-
Reporter-ID shall mean, with respect to each national securities
exchange, national securities association, and member of a national
securities exchange or national securities association, a code that
uniquely and consistently identifies such person for purposes of
providing data to the central repository.''
    In response to the commenters that stated that firms' current MPIDs
or CRD numbers may work as a viable unique broker-dealer identifier,
the Commission believes it is appropriate to leave the decision of
whether to specify an existing identifier, such as a firm's MPID or CRD
number, or some other identifier such as one created under the unique
legal entity identifier (LEI) standard under development by the
International Standards Organization (``ISO'') (ISO 17442),\318\ as the
unique broker-dealer identifier, to the plan sponsors to assess and
propose in the NMS plan. Therefore, while the adopted Rule continues to
require the NMS plan to require these unique identifiers, the Rule does
not specify which identifier to use, nor does the Rule specify the
process for assigning unique broker-dealer identifiers.\319\ In this
regard, the Commission expects the plan sponsors to establish a
process, to be described in the NMS plan, by which every national
securities exchange, and every member of a national securities exchange
or national securities association, can obtain a CAT-Reporter-ID.
---------------------------------------------------------------------------

    \318\ This standard is being developed by Technical Committee 68
(TC68) of ISO, in whose meetings a Commission staff representative
participates. Its final publication is subject to the resolution of
specific issues on implementation, operating procedures, and the
need to coordinate with a global legal entity identifier initiative
conducted by the global regulatory community, in which a Commission
staff representative is also participating.
    \319\ One commenter requested the Commission consider how the
Department of the Treasury's newly-created Office of Financial
Research (``OFR'') would impact reporting requirements imposed by
the consolidated audit trail. See SIFMA Letter, p. 22-23. The
commenter noted that the collection powers granted to the OFR, as
well as its authority to require standardized reporting of data,
could affect how data is submitted to the consolidated audit trail.
Id. at p. 22. The commenter suggested that any information that is
provided to the consolidated audit trail should not be required to
be provided to the OFR again or in a different format. Id. The
Commission understands that the OFR has been participating in and
encouraging efforts by interested parties to have a standard for
assigning unique entity identifiers created by an internationally
recognized standards body (``IRSB'') and that the ISO has issued a
draft ISO standard, ISO 17442, for the financial services industry
that is proposed to provide a viable global solution for the
accurate and unambiguous identification of legal entities engaged in
financial transactions. See ISO Press Release ``ISO Financial
Services Standard Wins Industry Support Six Months Ahead of
Publication,'' July 25, 2011. Because the ISO standard is still in
draft form and issues of implementation, governance and operating
procedures remain to be resolved, the Commission does not believe
that it is appropriate for it to mandate the use of the ISO standard
at this time. The Commission notes, however, that to the extent that
unique entity identifiers become available from an IRSB, Rule 613
provides SROs with sufficient flexibility to submit, if they so
chose, an NMS plan that makes use of those identifiers and requires
all or some reporting parties to obtain such identifiers, assuming
such identifiers otherwise meet the requirements of the Rule.
---------------------------------------------------------------------------

    The Commission also is adopting, substantially as proposed, rules
requiring the NMS plan submitted to the Commission for its
consideration to require each SRO and its members to report the unique
identifier of the broker-dealer or SRO for each reportable event in the
life of an order to the central repository, except to make two
technical changes: to include the new defined term, ``CAT-Reporter-ID''
and to require the CAT-Reporter-ID or Customer-ID, if applicable, of
the person giving a cancellation or modification instruction.\320\
Specifically, Rule 613(c)(7)(i)(C), as adopted, provides that any
member of an SRO that originally receives from a customer or originates
a principal order shall record and report ``[t]he CAT-Reporter-ID of
the broker-dealer receiving or originating the order.'' Rule
613(c)(7)(ii)(D) provides that any national securities exchange or

any member of an SRO that routes an order shall record and report
``[t]he CAT-Reporter-ID of the broker-dealer or national securities
exchange routing the order.'' Rule 613(c)(7)(ii)(E) provides that any
national securities exchange or member of an SRO that routes an order
shall record and report ``[t]he CAT-Reporter-ID of the broker-dealer,
national securities exchange, or national securities association to
which the order is being routed.'' Rule 613(c)(7)(iii)(D) provides that
the SRO or any member of an SRO that receives a routed order shall
record and report ``[t]he CAT-Reporter-ID of the broker-dealer,
national securities exchange, or national securities association
receiving the order.'' Rule 613(c)(7)(iii)(E) provides that the SRO or
any member of an SRO that receives a routed order shall record and
report ``[t]he CAT-Reporter-ID of the broker-dealer or national
securities exchange routing the order.'' Rule 613(c)(7)(iv)(F) provides
that the SRO or any member of an SRO that receives an instruction to
modify or cancel an order shall record and report ``[t]he CAT-Reporter-
ID of the broker-dealer or Customer-ID of the person giving the
modification or cancellation instruction.'' Rule 613(c)(7)(v)(F)
provides that the national securities exchange or any member of an SRO
that executes an order in whole or part shall record and report ``[t]he
CAT-Reporter-ID of the broker-dealer or national securities exchange
executing the order.'' Rule 613(c)(7)(vi)(B) provides that, if an order
is executed in whole or part, a member of an SRO shall record and
report ``[t]he CAT-Reporter-ID of the clearing broker or prime broker,
if applicable.''
---------------------------------------------------------------------------

    \320\ See proposed Rule 613(c)(7)(iv)(E) (requiring the
reporting of the identity of the person giving a modification or
cancellation instruction for an order); adopted Rule
613(c)(7)(iv)(F) (requiring the CAT-Reporter-ID or Customer-ID of
such person instead).
---------------------------------------------------------------------------

    The Commission notes that CAT-Reporter-IDs will be reported to the
central repository for each reportable event that the member or SRO is
reporting to the central repository. The requirement to report CAT-
Reporter-IDs in this manner will help ensure that regulators can
determine which market participant took action with respect to an order
at each reportable event. The Commission does not believe that the CAT-
Reporter-ID of each member or market that touches an order needs to be
tagged to and travel with an order for the life of the order, as long
as the CAT-Reporter-ID of the member or exchange taking the action is
reported to the central repository, and an order identifier(s) is
reported at every reportable event of the order. The Commission
believes the details of how these data are reported to the central
repository, and the specific methodologies used by the central
repository to assemble time-sequenced records of the full life-cycle of
an order, is best left to the expertise of the SROs as they develop the
NMS plan to be submitted to the Commission for its consideration.
Instead, as adopted, Rule 613 requires that data in the central
repository be made available to regulators in a linked fashion so that
each order can be tracked from origination through modification,
cancellation, or execution, and that the parties routing or receiving
routes, or otherwise performing such actions, are identified for every
reportable event.
    After considering the comment opposing the requirement to report to
the central repository the unique identifier of the branch office and
registered representative receiving or originating an order,\321\ the
Commission has reconsidered the requirement in proposed Rule
613(c)(7)(i)(F) and is not adopting this requirement.\322\ While this
audit trail data may be useful in the context of certain investigations
or market analyses, upon further consideration, the Commission believes
that this information need not be required by Rule 613 because it is
not critical information to help identify the customer responsible for
trading a security, nor to capturing the entire life of an order as it
moves from origination to execution or cancellation. In addition, the
Commission believes that a requirement that a unique identifier of the
branch office and registered representative receiving or originating
the order be reported may not provide enough information in an initial
assessment of whether illegal or manipulative activity is occurring in
the marketplace to warrant that this information be required in the
audit trail created by Rule 613. Further, should regulators determine
that the identity of the branch office and registered representative
receiving or originating the order is needed to follow-up on a specific
issue, they may request the information directly from the broker-dealer
as broker-dealers are required to make and keep records identifying the
registered representative that receives an order pursuant to Exchange
Act Rules 17a-3(a)(6)(i) \323\ and 17a-4(b)(1).\324\ As such, the
Commission does not believe the benefits of including this information
in the consolidated audit trail justify the costs to SROs for requiring
them to devise a methodology to identify the branch offices and
registered representatives receiving or originating an order, and a
mechanism for reporting this type of data to the central repository.
---------------------------------------------------------------------------

    \321\ See note 313, supra.
    \322\ See proposed Rule 613(c)(7)(i)(F).
    \323\ 17 CFR 240.17a-3(a)(6)(i).
    \324\ 17 CFR 240.17a-4(b)(1).
---------------------------------------------------------------------------

iii. Unique Customer Identifier
(A) Proposed Rule
    As proposed, Rule 613 would have required every SRO and broker-
dealer to report a unique customer identifier to the central repository
for any order originated by or received from such customer.\325\
Specifically, proposed Rule 613(c)(7)(i)(B) (renumbered as Rule
613(c)(7)(i)(A)) would have required that a national securities
exchange, national securities association or any member of such
exchange or association that originally receives or originates an order
to collect and electronically report ``a unique customer identifier for
each customer.'' In the Proposing Release, the Commission noted that
the unique customer identifier should remain constant for each
customer, and have the same format, across all broker-dealers.\326\
---------------------------------------------------------------------------

    \325\ See Rule 613(j)(3) for a definition of ``customer.''
    \326\ See Proposing Release, supra note 4, at 32573; proposed
Rule 613(c)(7)(i)(B).
---------------------------------------------------------------------------

    The Commission requested comment on possible ways to develop and
implement unique customer identifiers. For example, the Commission
solicited input about who should be responsible for generating the
identifier; whether a unique customer identifier, together with the
other information with respect to the customer that would be required
to be provided under the proposed Rule, would be sufficient to identify
individual customers; and whether there were any concerns about how the
customer information would be protected. The Commission specifically
requested comment on what steps should be taken to ensure that
appropriate safeguards are implemented with respect to the submission
of customer information, as well as the receipt, consolidation, and
maintenance of such information in the central repository.
(B) Comments on Proposed Rule 613(c)(7)(i)(B)
    The Commission received comments that supported the general notion
that identifying customers in an audit trail would be beneficial for
regulatory purposes.\327\ One commenter stated that a customer
identifier on an order-by-order basis would ``enhance significantly the
audit trails of the

markets.'' \328\ Similarly, another commenter agreed that identifying
the customer would be useful to regulators for purposes of market
surveillance and enforcement.\329\ Another commenter noted that it
``fully supports more granularity in an order audit trail, such as
obtaining high-level customer identity information (e.g., large trader
identification), so that patterns of trading across multiple market
centers can be quickly and readily identified, and [the commenter]
agrees that the timeframe needed to identify customers should be
greatly reduced; however, [the commenter] question[s] the utility of
receiving the identity of both the beneficial owner and the person
exercising the investment discretion, if different, for each and every
order reported to the consolidated audit trail.'' \330\
---------------------------------------------------------------------------

    \327\ See CBOE Letter, p. 2; Managed Funds Association Letter,
p. 2; FINRA Letter, p. 9; SIFMA Drop Copy Letter, p. 1; SIFMA
Letter, p. 9.
    \328\ See CBOE Letter, p. 2.
    \329\ See Managed Funds Association Letter, p. 2.
    \330\ See FINRA Letter, p. 9.
---------------------------------------------------------------------------

    However, other commenters disagreed with the need for a unique
customer identifier and the proposed Rule's requirements for reporting
a unique customer identifier with every order. These commenters
generally focused on the complexity and cost of the systems changes
required to implement the unique customer identifier requirement for
every customer; \331\ the complexity in the process for assigning
unique customer identifiers; \332\ the alternative ways that a customer
could be identified without requiring a unique customer identifier as
proposed; \333\ and the concerns about how the privacy of customers
might be compromised if every customer was assigned a unique customer
identifier.\334\
---------------------------------------------------------------------------

    \331\ See SIFMA Drop Copy Letter, p. 1. See also SIFMA Letter,
p. 9.
    \332\ See Liquidnet Letter, p. 4; SIFMA Letter, p. 10-11; Knight
Letter, p. 2; Scottrade Letter, p. 1; Direct Edge Letter, p. 3;
FINRA Proposal Letter, p. 4.
    \333\ See Angel Letter, p. 2; FIF Letter, p. 2; BOX Letter, 2.
    \334\ See SIFMA Letter, p. 10; Wells Fargo Letter, p. 3; Ross
Letter, p. 1; ICI Letter, p. 3; FIF Letter, p. 2.
---------------------------------------------------------------------------

    One commenter discussed the complexity and cost of the systems
changes required to implement the unique customer identifier
requirement, as set forth in the Rule.\335\ This commenter, who did not
believe the Commission should require a unique customer identifier for
every customer, noted the ``complexity of the technology development
work involved'' in adding this identifier to the audit trail.\336\ The
commenter added that the work required to update internal architecture
to report customer identifiers would be ``substantial'' because broker-
dealer systems and processes may access and maintain customer (and
proprietary) identification information in different ways and at
different levels of specificity, and that sales and trading systems
would need to be modified to report the unique customer identifiers
with every order. This commenter also noted the ``significant costs''
generally associated with requiring a unique customer identifier.\337\
---------------------------------------------------------------------------

    \335\ See SIFMA Drop Copy Letter, p. 1. See also SIFMA Letter,
p. 9.
    \336\ Id.
    \337\ See SIFMA Letter p. 9, 10.
---------------------------------------------------------------------------

    A few commenters also submitted their views on the complexity of
the process for assigning unique customer identifiers.\338\ One
commenter noted that the process for assigning unique customer
identifiers that the Commission discussed in the Proposing Release
(i.e., generating unique customer identifiers based on the input by a
broker-dealer of a customer's social security number or tax
identification number) would not create an administrative burden on
individuals and non-broker-dealer entities.\339\ Another commenter,
however, noted difficulties associated with implementing a centralized
process for assigning, storing and utilizing standardized customer
identifiers \340\ and another commenter characterized the
``implementation of a centralized customer identification system'' as a
``monumental task.'' \341\ Another commenter believed that to satisfy
the Rule's requirements, the industry would need to implement a
completely new market-wide system to satisfy the unique customer
identifier requirement, noting that this might not be feasible on the
proposed timeline.\342\ Another commenter characterized the collection
of a unique customer identifier as a ``significant project unto
itself.'' \343\ One commenter observed that given the large number of
retail investors (some with multiple accounts), the complexities
associated with tracking retail investors' accounts, and the relatively
small and infrequent amount of trading by typical retail investors, the
Rule should not require unique customer identifiers for every
customer.\344\ Another commenter urged the Commission to specify
whether the process required that a unique customer identifier be
submitted at the time an order is originated or received and the
procedure to be followed if an identifier is not available.\345\
---------------------------------------------------------------------------

    \338\ See Liquidnet Letter, p. 4; SIFMA Letter, p. 10-11; Knight
Letter, p. 2; Scottrade Letter, p. 1; Direct Edge Letter, p. 3;
FINRA Proposal Letter, p. 4; SIFMA Letter, p. 11.
    \339\ See Proposing Release, supra note 4, at 32573; Liquidnet
Letter, p. 4.
    \340\ See SIFMA Letter, p. 10.
    \341\ See Knight Letter, p. 2.
    \342\ See Scottrade Letter, p. 1. See also Knight Letter, p. 2;
Direct Edge Letter, p. 4.
    \343\ See Direct Edge Letter, p. 3.
    \344\ See FINRA Proposal Letter, p. 4.
    \345\ See SIFMA Letter, p. 11.
---------------------------------------------------------------------------

    A few commenters suggested alternative ways to identify a customer,
rather than through a unique customer identifier.\346\ One commenter
suggested that customers could be identified by amending the current
trade report.\347\ Another commenter believed that ``sophisticated
analysis could identify trading activity that might be coordinated,
without using an account identifier, and that regulators could then
perform further analysis to determine who traded by using [EBS] and
other methods already available to the staff.'' \348\ Another commenter
noted that a possible method for identifying customers could be by
linking customer information in EBS to trading information in
OATS.\349\ Another commenter noted that ``[i]t makes economical sense
to use the current OATS and COATS audit trails and to expand those
audit trails to include additional customer information, thereby
providing a more complete audit trail for regulatory oversight for post
trade analysis rather than building another audit trail system.'' \350\
---------------------------------------------------------------------------

    \346\ See Angel Letter, p. 2; FIF Letter, p. 2; BOX Letter, p 2.
    \347\ See Angel Letter, p. 2. This commenter stated that ``[i]t
would be relatively simple and cheap to add four fields to each
trade report that would contain the account numbers of the buyer and
seller and the Market Participant Identifier (MPID) for the original
order entry firms.''
    \348\ See FIF Letter, p. 2. This commenter recommended that the
requirement for such unique customer identifiers be tabled until
after regulators have experience using CAT without this identifier.
    \349\ See FIF Letter, p. 2.
    \350\ See BOX Letter, p. 2.
---------------------------------------------------------------------------

    Commenters also discussed the need for both a large trader
identification number under Rule 13h-1 under the Exchange Act, the
Commission's Rule implementing the large trader reporting system,\351\
and a unique customer identifier under Rule 613.\352\ One commenter
stated that the Commission could alleviate some of the burdens of the
proposed Rule, and increase the effectiveness of an identification
system, if it required only large trader identification numbers to be
reported instead of requiring a unique customer identifier for every
customer.\353\ This commenter believed that the Commission and the SROs
are unlikely

to be interested in routine transactions by small investors and would
much more likely need accurate information about the orders of large
traders because they are most likely to engage in transactions large
enough to impact prices.\354\ Another commenter noted that an
alternative would be to only identify entities that have sponsored or
direct access to market centers via a relationship with a sponsoring
market participant and to identify customers whose trading activity
would be required to be disclosed pursuant to Rule 13h-1.\355\
---------------------------------------------------------------------------

    \351\ See Section II.A.3., supra.
    \352\ See SIFMA Letter, p. 11; FINRA Proposal Letter, p. 6-7.
    \353\ See SIFMA Letter, p. 11.
    \354\ Id. See also FINRA Proposal Letter, Appendix B (setting
forth a method for identifying large traders through the
``registration of unique market participant identifiers rather than
by requiring broker-dealers to provide the CAT processor with any
large trader numbers assigned by the SEC in order reports, thereby
minimizing the ability of market participants to reverse engineer a
large trader's identity or trading strategy'').
    \355\ See FINRA Proposal Letter, p. 6-7.
---------------------------------------------------------------------------

    Certain commenters discussed concerns about how the privacy of
customers might be compromised if every customer was assigned a unique
customer identifier.\356\ One commenter, noting the Commission's
discussion in the Proposing Release that the unique customer
identifiers could be based on a customer's social security number or
taxpayer identification number, believed that the Commission's approach
raises ``serious privacy concerns.'' \357\ Another commenter noted that
``there is a legitimate privacy concern with having the unique customer
identifier available to the marketplace, and creating a means to
protect that privacy would add tremendous incremental cost to the
[consolidated audit trail].'' \358\ One commenter questioned how long
and at what level customer information would be encrypted,\359\ and
another noted that ``[t]he proposal needs to clarify who will have
access to customer data and how confidentiality will be ensured.''
\360\
---------------------------------------------------------------------------

    \356\ See SIFMA Letter, p. 10; Wells Fargo Letter, p. 3; Ross
Letter, p. 1; ICI Letter, p. 2; FIF Letter, p. 2.
    \357\ See SIFMA Letter, p. 10 (noting that ``in recent years,
increased concerns about identity theft and client confidentiality
have led the securities industry to move away from using social
security identification numbers or taxpayer identification numbers
as a way to monitor clients and customers. The SEC has affirmed that
it would guard access to customer social security and taxpayer
identification numbers with even more safeguards than it does other
information in the central repository of the consolidated audit
trail. Although the SEC has a strong record of protecting investor
privacy, the very presence of potentially billions of unique
customer identifiers tied to personal information in a central
repository would create a substantial risk of misuse and identity
theft. The risk of unique customer identifiers being stolen or
misused would be magnified in a real-time reporting system'').
    \358\ See Wells Fargo Letter, p. 3. However, this commenter also
noted that, ``[w]hile the full panoply of privacy concerns that flow
from having a unique order identifier being available to every
participant in the order execution process may be difficult to
assess, creating a system that has that unique identifier available
for primarily the post trade review likely solves both the privacy
and cost issues in a manner reasonable for both clients, market
participants and regulators.'' Id.
    \359\ See Ross Letter, p. 1 (asking at what level of security to
encrypt customer data, and for how long to encrypt it for, as well
as how long the Commission would need to decrypt the customer's
name--whether on a real time or overnight basis, and noting that
data encryption is expensive and could enlarge message sizes.) See
also ICI, p. 3 (suggesting that the Commission expressly state who
would have access, when they could access it, and how they could use
it; and also recommending requiring that all data sent to the
central repository be encrypted and that certain fields be
``masked'' or that reporting of information in such fields be
delayed until end-of-day to reduce concerns about leaked information
being used for frontrunning).
    \360\ See FIF Letter, p. 2.
---------------------------------------------------------------------------

(C) Adopted Rule
(1) Need for a Unique Customer Identifier
    The Commission recognizes that the implementation of the unique
customer identifier requirement may be complex and costly, and the
reporting of a unique customer identifier will require SROs and their
members to modify their systems to comply with the Rule's requirements.
The Commission, however, believes that unique customer identifiers are
vital to the effectiveness of the consolidated audit trail. The
inclusion of unique customer identifiers should greatly facilitate the
identification of the orders and actions attributable to particular
customers and thus substantially enhance the efficiency and
effectiveness of the regulatory oversight provided by the SROs and the
Commission. Without the inclusion of unique customer identifiers, many
of the benefits of a consolidated audit trail as described above in
Section II.2. would not be achievable.
    For example, unique customer identifiers will make regulatory
inquiries and investigations more efficient by eliminating delays
resulting from the current need to send information requests to
individual market participants in search of this key information, as
well as reducing the burden on regulators and market participants of
such requests.\361\ The identity of the customer is often necessary to
tie together potential manipulative activities that occur across
markets and through multiple accounts at various broker-dealers.
Existing audit trails, however, do not identify the customer
originating the order and thus do not allow SRO and Commission
regulatory staff to quickly and reliably track a person's trading
activity wherever it occurs in the U.S. securities markets. A unique
customer identifier connected to each order will allow the SROs and the
Commission to more quickly identify the customer that originated each
order and therefore potentially more quickly and efficiently stop
manipulative behavior through the submission of orders. In certain
cases this might limit the losses of parties injured by malfeasance who
currently may suffer losses during the weeks or months that it can
currently take for regulators to obtain customer information through
written requests for information.
---------------------------------------------------------------------------

    \361\ Because existing SRO audit trails do not require customer
information to be reported, regulators must request that information
identifying the customer, often from a multitude of sources, which
can result in significant delays in investigating market anomalies
or violative trading. Additionally, indirect access to an exchange
(such as ``sponsored access'' arrangements) also has made it more
difficult to use the current EBS system and Rule 17a-25 to identify
the originating customer because the broker-dealer through whom an
order is sent to an exchange may not know or have direct access to
information identifying the customer who originally submitted the
order.
---------------------------------------------------------------------------

    Further, unique customer identifiers will aid regulators in
reconstructing broad-based market events. Specifically, having unique
customer identifiers will aid regulators in determining how certain
market participants behaved in response to market conditions and may
even reveal the identity of the market participant(s) who caused or
exacerbated a broad-based market event. More so, unique customer
identifiers would enable regulators to disaggregate the market activity
of different participants in ways that could help address many
important questions related to equity and equity options market
structure, ranging from more detailed analyses of the potential impacts
of high frequency trading, to studies of market liquidity, to trend
analyses of the trading costs and general efficiency by which investors
use our public markets to acquire or dispose of their securities
holdings.
    The Commission has considered commenters' concerns about the
complexity of the process for creating and assigning unique customer
identifiers and understands and acknowledges that the process of
creating and assigning unique customer identifiers may not be simple
and may result in additional costs to SROs and their members.\362\ The
Commission also considered the commenters' views that there may be
alternative ways to identify the customer responsible for orders, and
that, in the view of some

commenters, every individual customer need not be identified for
purposes of an audit trail. As noted above, the Commission believes
that the identification of each customer responsible for every order is
critical to the effectiveness of a consolidated audit trail and does
not agree that the commenters' alternative means of identifying a
customer would be as effective as the method proposed by Rule 613. For
example, the Commission considered the comment that customers could be
identified by amending the trade report, but this approach would fail
to identify customers associated with orders that are not
executed.\363\ Additionally, account numbers are assigned by broker-
dealers for their own customers only, and account numbers vary between
broker-dealers. Thus, the identity of a customer from a specific
account number would not be apparent to regulators without the time-
consuming requests for information Rule 613 specifically is seeking to
avoid. The use of unique customer identifiers would permit regulators
to readily trace market activity by the same customer back to that
unique customer identifier even if such market activity were affected
across multiple accounts and broker-dealers.
---------------------------------------------------------------------------

    \362\ See notes 331-334, supra, and accompanying text.
    \363\ See Angel Letter, p. 2.
---------------------------------------------------------------------------

    The Commission also considered the recommendations of some
commenters that the consolidated audit trail should use the large
trader identifier instead of a unique customer identifier.\364\ The
Commission, however, does not believe that the commenters' approach
will address the regulatory need to obtain information on and to
identify the holders of accounts for all order activity in the market
for NMS securities because the use of the large trader identifier alone
would identify only those traders that self-report as ``large traders''
pursuant to Rule 13h-1 and are assigned a large trader unique
identifier. Thus, under the commenters' suggested approach, only a very
small portion of customers--the very largest traders in the market--
would be assigned a unique identifier for purposes of the consolidated
audit trail. Smaller traders, however, also can be perpetrators of
illegal activity, or otherwise impact the market. Accordingly, the
Commission believes that information on all customers is necessary to
achieve the goal of Rule 613.
---------------------------------------------------------------------------

    \364\ See SIFMA Letter, p. 9-11; FINRA Proposal Letter, p. 4 and
6.
---------------------------------------------------------------------------

    Despite the wide and disparate array of views from commenters on
the costs, complexities, and most efficient methodologies to generate
and collect unique customer identifiers, the Commission believes that
the potential benefits of including this information in the
consolidated audit trail justify the costs to the SROs in requiring
that they develop and include a detailed framework for unique customer
identification as part of the NMS plan to be submitted for
consideration by the Commission and the public. Therefore, the
Commission is adopting the Rule substantially as proposed to provide
that the NMS plan must require every member to report a unique customer
identifier to the central repository upon origination or receipt of an
order as required by Rule 613(c)(7)(i)(A). The Commission, however, is
changing the term ``unique customer identifier,'' as used in the
proposed Rule, to the term ``Customer-ID.'' Adopted Rule 613(j)(5)
defines the term ``Customer-ID'' to mean, ``with respect to a customer,
a code that uniquely and consistently identifies such customer for
purposes of providing data to the central repository.'' \365\
---------------------------------------------------------------------------

    \365\ For purposes of the following discussion, the Commission
will use the terms ``unique customer identifier'' and ``Customer-
ID'' interchangeably.
---------------------------------------------------------------------------

    Given the complexity and the various existing options for
identifying a customer, the Commission believes that the plan sponsors,
by engaging in a detailed process that combines their own expertise
with that of other market participants, are in the best position to
devise a methodology for, and estimate the costs of, including customer
identifiers in the consolidated audit trail. Once the NMS plan was
submitted, the Commission and the public would then be able to consider
the details and costs of such a framework.
    The Commission notes that the Rule does not specify the process for
assigning the unique customer identifiers, or the format for such
identifiers; rather, the Rule contemplates that the plan sponsors have
the flexibility to determine the precise way to assign or ``code''
these identifiers. In this regard, the Commission expects the plan
sponsors to establish a process by which every broker-dealer can, in a
cost-effective manner, obtain a unique customer identifier, or
Customer-ID, for each of their customer(s).\366\ The Commission also
expects the plan sponsors to establish a process by which unique
customer identifiers are reported to the central repository, and how
this information is linked to the name and address of customers as
stored in the central repository. The Commission further notes that
Rule 613 does not specify that unique customer identifiers must be
attached to every reportable event as orders are routed from one market
or broker-dealer to another, or that these identifiers are reported at
the same time and fashion as other customer-identifying information.
Rather, the Commission is relying on the SROs, and other market
participants,\367\ to develop a proposal that maximizes efficiency and
security, and that data in the central repository be made available to
regulators in a linked fashion so that each order, and all subsequent
reportable events, can be readily traced back to one or more customers
through their unique identifiers.
---------------------------------------------------------------------------

    \366\ Under the Rule, each customer would be assigned a unique
customer identifier, or Customer-ID. However, an order may have more
than one Customer-ID if the account holder differs from the person
from whom the broker-dealer is authorized to take trading
instructions or if more than one person is an account holder for the
account or is authorized to give trading instructions for the
account.
    \367\ See Rule 613(a)(1)(xi).
---------------------------------------------------------------------------

    In response to the commenter that questioned what should happen if
a unique customer identifier was not available,\368\ the Commission
notes that the Rule does not set out a process for addressing a
situation where a unique customer identifier is not available to a
broker-dealer and/or customer. Instead, the Commission believes that
the plan sponsors are in the best position to address this situation as
they develop the overall process for assigning unique customer
identifiers. In response to the comment that requested the Commission
specify whether a unique customer identifier is required to be reported
at the time an order is originated or received,\369\ the Commission
notes that Rule 613(c)(7)(i)(A) requires that the NMS plan require that
this information be recorded contemporaneously with the reportable
event, but permits the reporting of the identifier by 8:00 a.m. Eastern
Time on the trading day following the day such information has been
recorded.\370\ In addition, in response to the commenter that believed
that the consolidated audit trail should identify market participants
with direct or sponsored access to markets,\371\ the Commission notes
that under the Rule, to assure the Commission and the SROs of an
accurate and complete audit trail for every action that every market
participant takes with respect to an order, the sponsored party will be
assigned a Customer-ID and the

sponsoring broker-dealer will be assigned a CAT-Reporter ID under Rule
613.
---------------------------------------------------------------------------

    \368\ See SIFMA Letter, p. 11.
    \369\ See SIFMA Letter, p. 11.
    \370\ See Section III.B.1.e., infra.
    \371\ See FINRA Letter, p. 8-9.
---------------------------------------------------------------------------

    The Commission also considered the privacy and security concerns
that commenters raised with respect to the use of Customer-IDs.\372\ In
response to these comments, the Commission is revising proposed Rule
613, as discussed in more detail in Section III.B.2.e. below, to
include additional mechanisms to safeguard the privacy and
confidentiality of the audit trail data, including the Customer-ID, in
large part to address the privacy concerns raised by commenters.\373\
In response to the commenter that questioned when and at what level
customer information would be encrypted,\374\ the Commission notes
that, while Rule 613 does not explicitly require that this information
be encrypted, the Rule contains several safeguards to ensure the
privacy and confidentiality of the audit trail data. Specifically,
adopted Rule 613(e)(4) requires the NMS plan to include policies and
procedures, including standards, to be used by the plan processor to
ensure the security and confidentiality of all information reported to
the central repository. In addition, one of the considerations the NMS
plan must address is how the security and confidentiality of all
information, including customer information, reported to the central
repository, will be ensured.\375\ Based on these provisions, the
Commission believes that plan sponsors would need to make sure customer
information is protected, and the plan sponsors could require such data
to be encrypted.
---------------------------------------------------------------------------

    \372\ See ICI Letter, p. 2-4; SIFMA Letter, p. 10-11; Angel
Letter, p. 2; Ross Letter, p. 1.
    \373\ See Section III.B.2.e., infra.
    \374\ See Ross Letter, p. 1.
    \375\ See Rule 613(a)(1)(iv).
---------------------------------------------------------------------------

    Additionally, the Commission believes that privacy concerns also
could be mitigated if the plan sponsors determine, as permitted by Rule
613, that the unique customer identifiers not travel with the order,
and instead be reported to the central repository only upon the receipt
or origination of an order. Therefore, if the plan sponsors make this
decision, the SROs and their members will not be able to use the unique
customer identifier to track the identity of a customer(s) or a
customer's order flow.\376\ While the unique customer identifier will
be linked to information that is sufficient to identify a customer
(e.g., the name and address of the customer) and customer account
information \377\ at the central repository, this information will be
accessible only by regulators for regulatory purposes.\378\ The
Commission also notes that the plan sponsors could determine not to
require that a customer's social security number or tax identification
number be used as a customer's unique identifier to the extent they
believe that there are privacy and confidentiality concerns.
---------------------------------------------------------------------------

    \376\ See also Section III.B.2.e., infra, for a discussion of
the provisions in the NMS plan designed to protect the privacy and
confidentiality of the consolidated audit trail data.
    \377\ See Rule 613(j)(4).
    \378\ See Rule 613(e)(2). See also Section III.B.2.d., infra.
---------------------------------------------------------------------------

(2) Definition of ``Customer''
    As proposed, Rule 613(j)(1) (renumbered as Rule 613(j)(3)) defined
``customer'' as ``[t]he beneficial owner(s) of the account originating
the order; and [t]he person exercising investment discretion for the
account originating the order, if different from the beneficial
owner(s).'' The Commission received two comments regarding the
inclusion of beneficial owners in the definition of customer. One
commenter questioned the use of a unique customer identifier for both a
beneficial owner of an account and the person exercising investment
discretion, if different, and noted that if a trade comes into
question, the person exercising investment discretion, not the
beneficial owner, likely will be the ``first person of interest in any
type of review or investigation of such trading activity.'' \379\
Another commenter requested further clarity regarding the definition of
``customer'' for purposes of Rule 613, and suggested that the
Commission should define ``beneficial owner'' to be sure this term is
applied correctly.\380\ This commenter specifically stated that ``[t]he
SEC should also provide a definition for the terms `beneficial owner'
and `customer' to eliminate any doubts as to whom these labels apply.
For example, is the `customer' the entity directing the trade or the
beneficial owner of the account?'' and added that, ``for registered
investment advisers, the unique customer identifier should be
associated with the investment adviser rather than the underlying
beneficial owner. Frequently, investment advisers aggregate orders for
multiple beneficial owners in `bulk' orders that are routed together
and allocated on an average-priced basis to ensure best execution.''
\381\
    In response to commenters' concerns about the use of the term
``beneficial owner,'' the Commission is revising Rule 613(j)(1), as
proposed (renumbered as Rule 613(j)(3)), to state that ``[t]he term
`customer' shall mean: (i) [t]he account holder(s) of the account at a
registered broker-dealer originating the order; and (ii) [a]ny person
from whom the broker-dealer is authorized to accept trading
instructions for such account, if different from the account
holder(s).'' The Commission believes that the revised Rule will provide
it with the customer information required to achieve the objectives of
the consolidated audit trail.\382\
---------------------------------------------------------------------------

    \379\ See FINRA Letter, p. 9.
    \380\ See SIFMA Letter, p. 11.
    \381\ Id.
    \382\ The Commission also notes that it retains the authority to
request additional information from broker-dealers (and other market
participants it regulates) where information about a customer of a
broker-dealer beyond that required by Rule 613(j)(3) is needed to
fulfill its mission.
---------------------------------------------------------------------------

    In adopting this revised definition, the Commission is clarifying
its intent that, with respect to the ``account holder'' reference under
Rule 613(j)(3), the NMS plan submitted to the Commission for its
consideration must require broker-dealers to capture information on
only the individuals or entities that currently are required to be
recorded in the books and records of the broker-dealer pursuant to Rule
17a-3(a)(9) under the Exchange Act.\383\ Because this provision does
not require broker-dealers to obtain information about their account
holders beyond what they are required to obtain today, the Commission
believes the modification to the proposed Rule is appropriate because
it will reduce the proposed Rule's burden on broker-dealers in
recording and reporting information about a ``customer,'' as that term
will be defined under Rule 613(j)(3). The Commission notes that, under
the Rule, as adopted, for joint accounts--where two individuals are
required to provide information under Rule 17a-3 of the Exchange Act
for one account--information for both persons listed on the joint
account would be recorded and reported under Rule 613.\384\
---------------------------------------------------------------------------

    \383\ Rule 17a-3(a)(9), among other things, requires a broker-
dealer to make and keep a record of the name and address of the
``beneficial owner'' of each cash or margin account with the broker-
dealer. 17 CFR 240.17a-3(a)(9). Rule 613 is not intended to alter in
any way the information that a broker-dealer is currently required
to obtain under Rule 17a-3(a)(9).
    \384\ The Commission notes that, under Rule 613, both joint
account holders would also receive their own unique customer
identifier.
---------------------------------------------------------------------------

    The Commission also believes that it is important to capture the
person that has authority to give trading instructions to a broker-
dealer for an account, if different from the account holder, because
such person likely will be of interest in a review or investigation of
activity in such account.

Thus, the Commission is modifying the proposed Rule to clarify its
intent that under Rule 613 the NMS plan also must capture, in the
definition of customer, ``[a]ny person from whom the broker-dealer is
authorized to accept trading instructions, if different from the
account holder(s).'' \385\ Knowing the identity of the person who is
authorized to give the broker-dealer trading instructions for an
account, whether the account holder or an adviser or other third party,
is a vital component in the investigative process. Further, when
investigating violations of the federal securities laws, it is
important to promptly identify all potentially relevant parties who may
have made trading or investment decisions, which could include both the
person authorized to give the broker-dealer trading instructions for
such account and the account holder.\386\
---------------------------------------------------------------------------

    \385\ See Rule 613(j)(3)(ii).
    \386\ For the purpose of Rule 613(j)(3), natural persons who are
employed by an entity that is an account holder, and who are
authorized to trade for that account, are not considered different
from the account holders, and are therefore not covered by Rule
613(j)(3)(i).
---------------------------------------------------------------------------

    Pursuant to the revised definition of ``customer'' under adopted
Rule 613, for example, if an order is entered to buy or sell securities
for the account of an investment company or other pooled investment
vehicle (a ``fund''), the Rule will capture, in the definition of
customer, the fund itself or, if the account at the broker-dealer is
held only in the name of the fund's investment adviser from whom the
broker-dealer is authorized to accept trading instructions, the Rule
will capture the investment adviser.\387\ If the account at the broker-
dealer is held in the name of the fund itself, the Rule will capture
both the name of the fund (pursuant to Rule 613(j)(3)(i)), as well as
the name of the fund's investment adviser from whom the broker-dealer
is authorized to accept trading instructions (pursuant to Rule
613(j)(3)(ii)). In addition, if an adviser enters an order on behalf of
clients that each maintain separate accounts at the broker-dealer
originating the order, using those accounts, the Rule would capture
both the adviser--as the person providing trading instructions to the
broker-dealer (pursuant to Rule 613(j)(3)(ii))--and the clients, who
are the account holders at the broker-dealer (pursuant to Rule
613(j)(3)(i)). If an adviser instead enters an order to buy or sell
securities using its own account held at the broker-dealer originating
the order, the Rule would capture the adviser (pursuant to Rule
613(j)(3)(i)) but would only capture any client accounts to which the
adviser allocates executed trades (pursuant to Rule 613(c)(7)(vi)) if
those client accounts were held separately at the same broker-dealer as
well.
---------------------------------------------------------------------------

    \387\ Pursuant to the definition of ``customer'' under adopted
Rule 613, the Rule would not capture owners of a fund because they
are not the account holders at the broker-dealer.
---------------------------------------------------------------------------

    Furthermore, in cases where multiple individuals in the same
trading firm transact through a single account maintained at a broker-
dealer in the name of that trading firm, the Rule will require the NMS
plan to require recording and reporting of the Customer-ID of the
trading firm associated with that account, and not the Customer-IDs of
the individual traders who had placed the orders.\388\ The Commission
understands that in some cases broker-dealers may have knowledge of the
individual traders transacting within the same firm-wide account, and
may even provide reports to the firm holding the account that
summarizes trade activity according to individual trader. Because such
information is not captured by the Rule, but may be useful in informing
regulators about the potential manipulative activities, the SROs may
wish to consider how such information might be incorporated into the
consolidated audit trail in the future.
---------------------------------------------------------------------------

    \388\ This is because, for the purpose of Rule 613(j)(3),
natural persons who are employed by an entity that is an account
holder, and who are authorized to trade for that account, are not
considered different from the account holders, and are therefore not
covered by Rule 613(j)(3)(ii).
    If an individual creates and operates two separate entities (as
an employee of each such entity) that each maintain a trading
account at one or more broker-dealers, the broker-dealers would be
required to record and report the Customer-IDs of those entities,
and not the customer ID of the individual trader.
---------------------------------------------------------------------------

    The Commission is also modifying a related provision of the Rule,
Rule 613(c)(7)(i)(A), to reflect that more than one Customer-ID must be
provided upon original receipt or origination of an order if the
account holder and the person authorized to give the broker-dealer
trading instructions for such account are different or if more than one
person is an account holder for the account (such as, for example,
joint account holders). Specifically, Rule 613(c)(7)(i)(A) provides
that ``Customer-ID(s)'' (i.e., multiple Customer-IDs) must be provided
for each customer, if that is applicable. In addition, the Commission
notes that every ``customer,'' as defined by Rule 613(j)(3) will be
assigned a Customer-ID; thus, two Customer-IDs maybe associated with
one order under the Rule.
iv. Unique Order Identifier
    As proposed, the Rule would have required the NMS plan to require
each member of an exchange or FINRA to attach, to each order received
or originated by the member, a unique order identifier that would be
reported to the central repository and that would remain with that
order throughout its life, including routing, modification, execution,
or cancellation. Specifically, proposed Rule 613(c)(7)(i)(D)
(renumbered as Rule 613(c)(7)(i)(B)) would have provided that the
national market system plan shall require each national securities
exchange, national securities association, and any member of such
exchange or association to collect and electronically provide to a
central repository details for each order and each reportable event,
including, but not limited to, ``a unique identifier that will attach
to the order at the time the order is received or originated by the
member and remain with the order through the process of routing,
modification, cancellation, and execution (in whole or in part).'' In
the Proposing Release, the Commission stated that the use of such an
identifier would allow the SROs and the Commission to efficiently link
all events in the life of an order and help create a complete audit
trail across all markets and broker-dealers that handle the order.\389\
Proposed Rules 613(c)(7)(ii)(A), 613(c)(7)(iii)(A), and 613(c)(7)(v)(A)
would have required the reporting of a unique order identifier to the
central repository for the reportable events of routing and execution.
The Commission did not propose to mandate the format of such an
identifier or how the identifier would be generated.
---------------------------------------------------------------------------

    \389\ See Proposing Release, supra note 4, at 32576.
---------------------------------------------------------------------------

    The Commission requested comment on whether a unique order
identifier that would remain with the order for its life would be
necessary or useful for an effective consolidated audit trail. The
Commission also specifically requested comment on, among other things,
the feasibility and merits of its proposed approach for attaching a
unique order identifier to an order, as well as on how multiple
``child'' orders that may result if the original ``parent'' order is
subsequently broken up, or an aggregation of multiple original orders
into a single order, should be addressed.
    Several commenters expressed opinions on the proposed unique order
identifier requirement, with some noting that the Commission's proposal
imposed ``significant'' burdens or challenges on market participants,
and others offering alternatives to the

Commission's approach to identifying orders.\390\ For example, some
commenters suggested that the Rule permit the approach used for OATS
reporting, in which the broker-dealer initiating or receiving an order
would generate its own order identifier, but pass on a separate routing
identifier to the entity to which it routes the order, which would
generate its own order identifier, but retain and report that routing
identifier as well, so that information about the order can be linked
together as it is passed from venue to venue.\391\ One of these
commenters also believed that the OATS approach would avoid certain
complexities that could occur with a unique order identifier, such as
when the original order is broken up into multiple ``child''
orders.\392\ In a subsequent comment letter, the commenter stated that
it could require two new order event types that would allow customer
orders handled on a riskless principal or agency basis to be linked to
the related representative orders.\393\ Another of the commenters
suggested that ``the adopted CAT filing should require that an order be
tracked through its lifecycle and [the Commission should] leave the
technical details to [a] requirements analysis.'' \394\
---------------------------------------------------------------------------

    \390\ See Thomson Reuters Letter, p. 3; Liquidnet Letter, p. 6-
7; SIFMA Letter, p. 12; FINRA Letter, p. 7; FIF Letter, p. 3; FIF
Letter II, p. 2.
    \391\ See Liquidnet Letter, p. 6-7; SIFMA Letter, p. 12; FINRA
Letter, p. 7; FIF Letter, p. 3.
    \392\ See FINRA Letter, p. 7-8. FINRA expressed concern that, if
two child orders from the same parent order are sent to the same
market center, regulators would need to look at time stamps and
other attributes, such as share quantity and price, to attempt to
create an accurate linkage for each individual child order. FINRA
stated that this complexity could be avoided if members used a
separate unique routed order identifier for each routed order. Id.
    \393\ See FINRA Proposal Letter, p. 7-8.
    \394\ See FIF Letter II, p. 2.
---------------------------------------------------------------------------

    Another commenter was concerned that, if the originating firm's or
customer's name was used as part of the unique order identifier, this
could create ``potential privacy information risks as every new
destination (both internally across information barriers within a firm
and externally across broker-dealers) would see where an order
originated.'' \395\ Similarly, a third commenter supported the OATS
approach of linking a series of separate order identifiers in part
because it believed that, if a unique identifier were to pass from
firm-to-firm, there was a risk that information about the origin of an
order might be inferred.\396\ Yet another commenter recommended that
the Commission standardize how the order identifier should be
structured to ensure consistent reporting between firms, instead of
leaving this decision to the plan sponsors.\397\
---------------------------------------------------------------------------

    \395\ See SIFMA Letter, p. 12. See also SIFMA Drop Copy Letter,
p. 2 (suggesting a routed order identifier or a child order
identifier which would be separate from the unique order identifier
of the parent order, and would be reported to the consolidated audit
trail separately on a non-real-time basis, as well as linkage
information).
    \396\ See FIF Letter, p. 3 (recommending the linking of the
order information in a fashion similar to OATS whereby the
information would only be available to regulators).
    \397\ See SIFMA Letter, p. 12. In addition, another commenter
suggested that order identifiers should be unique by broker and day,
similar to the approach used by OATS. See Liquidnet Letter, p. 7.
---------------------------------------------------------------------------

    The Commission has considered the comments received regarding the
requirement that the NMS plan mandate a unique order identifier, and is
adopting Rule 613 with significant modifications \398\ that provide
more flexibility for the SROs, as the plan sponsors, to determine
whether the NMS plan will require a single unique order identifier or a
``series of order identifiers.'' Specifically, the Rule, as adopted,
requires that every order have a ``CAT-Order-ID,'' defined as ``a
unique order identifier or series of unique order identifiers that
allows the central repository to efficiently and accurately link all
reportable events for an order, and all orders that result from the
aggregation or disaggregation of the order.'' \399\
---------------------------------------------------------------------------

    \398\ See Rule 613(c)(7)(i)(B); Rule 613(c)(7)(ii)(A); Rule
613(c)(7)(iii)(A); Rule 613(c)(7)(iv)(A); Rule 613(c)(7)(v)(A); Rule
613(c)(7)(vi)(C); and Rule 613(j)(1).
    \399\ See Rule 613(j)(1).
---------------------------------------------------------------------------

    The Commission has modified the Rule from the proposal so that the
SROs can draw upon their own expertise, as well as those of other
market participants, in developing the most accurate and efficient
methodology for tracking an order through its life. Thus, the SROs may
submit an NMS plan in which they require a single unique order ID to
travel with each originating order; the SROs may submit an NMS plan in
which, as suggested by a number of commenters, a series of order IDs,
each generated by different market participants, is reported to the
central repository in a manner that allows for the accurate linking of
reportable events; or the SROs may submit an NMS plan based on any
other methodology that meets the requirements of the Rule.
    The Commission expects that the details of the methodology proposed
by the SROs in the NMS plan will, in part, be based on how the
generation and reporting of order identifiers would interact with other
technical details involving order tracking in the consolidated audit
trail, such as the potential for multiple orders to be aggregated,
routed, and disaggregated. However, though the Commission is not
prescribing a particular methodology, the Rule does require that SROs
take into account a number of considerations, such as accuracy and
cost, in designing their methodology.\400\
---------------------------------------------------------------------------

    \400\ See Section III.C.2.a., infra.
---------------------------------------------------------------------------

    The Commission notes that, with this modification, a wider array of
possible solutions is now available to the SROs as they develop the NMS
plan to be submitted to the Commission for its consideration, including
those that may better accommodate the infrastructure of existing audit
trails and thereby potentially, and possibly significantly, reduce
implementation burdens. As indicated above, several commenters
suggested that the Rule accommodate the linked order identifier
approach, currently used by OATS.\401\ However, the Commission also
notes that, though the adopted Rule could accommodate such an approach,
there historically have been limitations on the accuracy and
reliability of linking orders in OATS.\402\ It will therefore be very
important for the NMS plan to demonstrate how the approach it has
selected will ensure that information about all reporting events
pertaining to an order will be efficiently and accurately linked
together in a manner that allows regulators efficient access to a
complete order audit trail.\403\ As discussed below, the reliability,
accuracy, and confidentiality of the data reported to and maintained by
the central repository, as well as the method by which the data in the
central repository can be accessed by regulators, are considerations
for the Commission in evaluating the NMS plan.\404\
---------------------------------------------------------------------------

    \401\ See FIF Letter, p. 3; Liquidnet Letter, p. 7; SIFMA
Letter, p. 12; SIFMA Drop Copy Letter, p. 12; FINRA Letter, p. 8.
    \402\ See Section II.A., supra.
    \403\ See Rule 613(j)(1). For example, one of the methods that
the SROs could consider using to demonstrate the efficacy of their
approach would be to engage appropriate third party experts to
confirm that the system's proposed design and functionality would
achieve its stated accuracy and reliability benchmarks.
    \404\ See Section III.C.2.a.i., infra; Rule 613(a)(1)(iii) and
(iv).
---------------------------------------------------------------------------

    The Commission emphasizes that, under the adopted Rule, regardless
of the specific method chosen by the SROs, all orders reported to the
central repository must be made available to regulators in a uniform
electronic format and in a form in which all events pertaining to the
same originating order are linked together in a manner that ensures
timely and accurate retrieval of the information for all reportable
events

for that order.\405\ The Commission believes the consolidated audit
trail will still achieve significant benefits with this modification.
---------------------------------------------------------------------------

    \405\ See Rule 613(e)(1).
---------------------------------------------------------------------------

    The Commission recognizes the complexities of order routing in
today's markets, including, as noted by a commenter,\406\ the frequent
splitting of larger orders into numerous ``child'' orders or the
bundling of smaller orders into one larger order. The Commission
believes, however, that since, in today's complex markets, orders are
currently and routinely aggregated and disaggregated, practical
solutions to record such orders can be developed by the plan sponsors
to ensure they are accurately and efficiently tracked through a variety
of aggregation and disaggregation events.
---------------------------------------------------------------------------

    \406\ See FINRA Letter, p. 4-7.
---------------------------------------------------------------------------

    With regard to the concern expressed by a commenter that the use of
an order identifier(s), as required by Rule 613, could provide the
ability to deduce the origin of an order, thereby revealing
confidential trading strategies or raising privacy concerns,\407\ the
Commission notes that this commenter assumed that a unique order
identifier ``would very likely require members to include the
originating firm's or customer's name as part of the identifier.''
\408\ The Commission believes, however, that the SROs will be able to
devise a way to assign order identifiers--through random number
sequences or otherwise--that would protect the identity of broker-
dealers and their customers from disclosure to persons other than
authorized regulatory personnel. The Commission also notes that, as
discussed in Section III.B.2.e. infra, the adopted Rule requires the
NMS plan submitted to the Commission for its consideration to
incorporate a variety of policies and procedures to ensure the security
and confidentiality of all information reported to the central
repository.
---------------------------------------------------------------------------

    \407\ See SIFMA Letter, p. 12. See also FIF Letter, p. 3.
    \408\ See SIFMA Letter, p. 12.
---------------------------------------------------------------------------

    Furthermore, because the Rule requires the SROs to discuss the
details of each aspect of the NMS plan submitted to the Commission for
its consideration, the Commission and the public will be able to
consider how well the methodology the SROs developed to link reportable
events for the same order meets the considerations of accuracy and
reliability, as well as those of security and confidentiality. The
Commission will then be able to use this information in determining
whether to approve the NMS plan submitted.
v. Time Stamp
    The proposed Rule would have required SROs and their members to
report the date and time, to the millisecond, that an order was
originated or received, routed out, and received upon being routed,
modified, cancelled, and executed.\409\ Specifically, proposed Rules
613(c)(7)(i)(H) (renumbered as 613(c)(7)(i)(E)), 613(c)(7)(ii)(C),
613(c)(7)(iii)(C), 613(c)(7)(iv)(B) (renumbered as 613(c)(7)(iv)(C)),
and 613(c)(7)(v)(C) provided that the ``time of order receipt or
origination (in milliseconds)'' would be recorded for every order
originated or received, routed, modified, cancelled or executed, by a
broker-dealer or SRO.
---------------------------------------------------------------------------

    \409\ See proposed Rules 613(c)(7)(i)(H), 613(c)(7)(ii)(C),
613(c)(7)(iii)(C), 613(c)(7)(iv)(B), 613(c)(7)(v)(C).
---------------------------------------------------------------------------

    Several commenters expressed opinions on the time stamp
requirement. One commenter believed a millisecond standard was not
precise enough, explaining that many exchanges currently execute orders
in less than a millisecond.\410\ This commenter explained that, to
detect the manipulative or fraudulent behavior of high frequency
traders, it is necessary that time stamps be accurate to a level more
detailed than the speed at which trades are executed; otherwise, it
would not be possible to determine the time sequence in which trades
occurred. The commenter suggested that reports from execution venues
(e.g., exchanges, ATSs, dark pools, and large internalizers) should be
required to be accurate to 0.01 milliseconds.\411\ This commenter also
suggested that a more liberal time stamp standard of one second might
be more appropriate for low-volume broker-dealers.\412\ Another
commenter, however, expressed concern about the proposed millisecond
time stamp requirement, explaining that, ``[a]lthough firm systems tend
to capture time stamps in milliseconds, reporting in milliseconds would
require changes to internal systems given that existing audit trails
such as OATS require reporting of time stamps accurate only to the
second.'' \413\ Another commenter believed that, because computers have
a certain rate of error when keeping time (``time drift''), it is
difficult to sequence orders based on millisecond time stamps.\414\ As
a result, according to this commenter, there is ``no real value in
requiring data to this level of specificity [based on milliseconds],
especially if the goal of time stamping is to sequence the lifecycle of
a single order as it moves from origination to execution.'' \415\
---------------------------------------------------------------------------

    \410\ See Endace Letter, p. 1-2.
    \411\ See Endace Letter, p. 1. The Commission notes that this
commenter also suggested that the same time increment be extended to
market data feeds to help increase transparency and deter fraudulent
activity; however, this comment is outside the scope of this
Release.
    \412\ Id. at 2-3.
    \413\ See SIFMA Letter, p. 14.
    \414\ See FIF Letter, p. 6-7.
    \415\ Id. See Section III.B.1.d.v., infra, for further
discussions of ``time drift'' and the issues raised by this
commenter in that regard.
---------------------------------------------------------------------------

    The Commission has considered the comments regarding the precision
of the proposed time stamp requirement for the consolidated audit trail
and is adopting the millisecond time stamp requirement with
modifications from the proposal.\416\ As adopted, the Rule provides
that the NMS plan submitted shall require the time stamps as set forth
in Rule 613(d)(3).\417\ Rule 613(d)(3) provides that the NMS plan must
require each SRO and its members to ``[u]tilize the time stamps
required by paragraph (c)(7) of this section, with at minimum the
granularity set forth in any national market system plan submitted
pursuant to this section, which shall reflect current industry
standards and be at least to the millisecond.'' Rule 613(d)(3) also
provides that, ``[t]o the extent that the relevant order handling and
execution systems of any national securities exchange, national
securities association, or member of such exchange or association
utilize time stamps in increments finer than the minimum required by
the national market system plan, such plan shall require such national
securities exchange, national securities association, or member to
utilize time stamps in such finer increments when providing data to the
central repository, so that all reportable events reported to the
central repository by any national securities exchange, national
securities association, or member can be accurately sequenced.'' Rule
613(d)(3) further provides that ``[t]he national market system plan
shall require the sponsors of the national market system plan to
annually evaluate whether industry standards have evolved such that the
required time stamp standard should be in finer increments.''
---------------------------------------------------------------------------

    \416\ See Proposed Rules 613(c)(7)(i)(H), 613(c)(7)(ii)(C),
613(c)(7)(iii)(C), 613(c)(7)(iv)(B), and 613(c)(7)(v)(C).
    \417\ See Rules 613(c)(7)(i)(E), 613(c)(7)(ii)(C),
613(c)(7)(iii)(C), 613(c)(7)(iv)(C), and 613(c)(7)(v)(C).
---------------------------------------------------------------------------

    The Commission notes that SIPs currently support millisecond time
stamps \418\ and other entities in the

securities industry currently conduct business in millisecond
increments or finer.\419\ The Commission believes that, given the speed
with which the industry currently handles orders and executes trades,
it is important that the consolidated audit trail utilize a time stamp
that will enable regulators to better determine the order in which
reportable events occur. The entry time of orders can be critical to
enforcement cases. For example, the timing between order origination
and order entry is important in investigating possible market abuse
violations, such as trading ahead of a customer order. In general,
determining whether a series of orders rapidly entered by a particular
market participant is manipulative or otherwise violates SRO rules or
federal securities laws, otherwise being able to reconstruct market
activity, or performing other detailed analyses, requires the audit
trail to sequence each order accurately. The Commission believes that,
for many types of common market activities that operate at the level of
milliseconds or less, time stamps in increments greater than a
millisecond would not allow this sequencing with any reasonable degree
of reliability.
---------------------------------------------------------------------------

    \418\ See, e.g., Securities Industry Automated Corporation's
(``SIAC'') Consolidated Quotation System (``CQS'') Output
Specifications Revision 40 (January 11, 2010); SIAC's Consolidated
Tape Service (``CTS'') Output Specifications Revision 55 (January
11, 2010); and Nasdaq's Unlisted Trading Privileges Plan Quotation
Data Feed Interface Specifications Version 12.0a (November 9, 2009).
    \419\ See, e.g., http://batstrading.com/resources/features/bats_exchange_Latency.pdf (describing, among other things, the
time it takes to accept, process, and acknowledge or fill a member
order).
---------------------------------------------------------------------------

    In response to the comment that a millisecond standard is not
sufficiently precise, as many exchanges currently execute orders in
less than a millisecond,\420\ adopted Rule 613(d)(3) provides that the
NMS plan must require that, to the extent that the order handling and
execution systems of any SRO or broker-dealer utilize time stamps in
increments finer than the minimum required by the NMS plan time stamps,
such SRO or member must use time stamps in such finer increments when
reporting data to the central repository, so that reportable events
reported to the central repository by any SRO or member can be
accurately sequenced. The Commission believes this approach will
improve the accuracy of records with respect to the sequencing of
events that occur very rapidly, especially with respect to those market
participants that have elected to use time stamps in increments finer
than a millisecond.
---------------------------------------------------------------------------

    \420\ See Endace Letter, p. 1.
---------------------------------------------------------------------------

    The Commission recognizes, as a commenter noted,\421\ that
computers have a certain rate of deviation when keeping time. The
requirement that clocks be synchronized within a level of granularity
to be specified in the NMS plan \422\ is designed to ensure that time
drift does not exceed a defined level of deviation. However, the
Commission believes that time stamps reported with a millisecond or
finer granularity would still provide significant benefits even,
contrary to one commenter's assertion,\423\ if the time drift between
systems is larger than a millisecond. This is because such time stamps
would still allow an accurate sequencing of reportable events as may
commonly occur within in a single system, tied to a single clock, at
levels of a millisecond or finer (e.g., high-frequency trading
algorithms). Any drift of such a system's clock relative to the clocks
of other systems may of course hinder the time-sequencing of cross-
system events, but it would not preclude the ability of regulators from
performing a detailed, accurate time-sequenced analysis of all the
orders, cancellations, modifications, and executions performed by the
specific system of interest.\424\ In this regard, the Rule is analogous
to the current requirements for OATS reporting: FINRA requires clocks
to be synchronized to the second, and requires time stamps to be
reported to FINRA in seconds, unless those time stamps are captured by
the FINRA member in milliseconds, in which case they must reported to
FINRA in milliseconds (notwithstanding the clock sync remaining at a
second).\425\
---------------------------------------------------------------------------

    \421\ See FIF Letter, p. 7.
    \422\ See Section III.B.1.h., infra, for a discussion of clock
synchronization.
    \423\ See FIF Letter, p. 6-7.
    \424\ Similarly, although reporting in increments finer than a
millisecond would also enable the accurate time-sequencing of events
originating from within a single system or systems operating off the
same clock, the Commission recognizes that the effects of time drift
across the clocks of different systems could limit the efficacy of
time-sequencing sub-millisecond events across those systems.
    \425\ See FINRA's Order Audit Trail System, Frequently Asked
Questions, http://www.finra.org/Industry/Compliance/MarketTransparency/OATS/NMS/P122893 (last visited on May 15, 2012).
---------------------------------------------------------------------------

    The Commission acknowledges that changes (with their associated
costs) might be required to internal broker-dealer systems to comply
with a millisecond time stamp requirement. However, given the benefits
outlined above, and the apparent widespread use of millisecond time
stamps in the industry today,\426\ the Commission believes the cost of
requiring the SROs to develop a plan that provides for millisecond time
stamps, and to discuss the costs and benefits of the specific solution
chosen, is justified.
---------------------------------------------------------------------------

    \426\ See Endace Letter, p. 1 (stating that ``[t]oday Exchanges
such as NYSE Euronext and BATS are claiming that they are executing
orders in less than a millisecond (see Wall Street Journal on the
January 6th 2010) and are displaying details of these trades in
increments of milliseconds on their market data feeds. Clearly from
an Exchange perspective the publishing of trade data at one
millisecond increments is not just possible, its current practice.
However, Endace believes that one millisecond increments is not good
enough''); SIFMA Letter, p. 14 (acknowledging that, ``[a]lthough
firm systems tend to capture time stamps in milliseconds, reporting
in milliseconds would require changes to internal systems given that
existing audit trails such as OATS require reporting of time stamps
accurate only to the second'').
---------------------------------------------------------------------------

    The Commission also acknowledges that broker-dealers who presently
report time stamps to OATS in millisecond increments, but whose systems
direct and capture their order activity in finer time increments, could
incur costs associated with these time stamps being reported to the
central repository with the same granularity at which they are recorded
by the broker-dealers.\427\ The Commission recognizes that there may be
alternatives to reporting events in finer than millisecond increments
that enable the central repository to use a different method for
accurately time-sequencing sub-millisecond events originating from
within a system or systems on a single clock. Therefore, in developing
the NMS plan to be submitted to the Commission for its consideration,
if the SROs identify one or more such alternatives, the Commission
believes that they should address such alternatives in the NMS
plan,\428\ how such alternatives (i.e., an alternative to reporting in
finer than millisecond increments) would ensure that reportable events
may be accurately time-sequenced at the sub-millisecond level, and the
costs associated with such alternatives both on their own terms and
relative to a requirement to report events in the same sub-millisecond
time stamp as used by a broker-dealer for directing and capturing
orders.\429\
---------------------------------------------------------------------------

    \427\ See SIFMA Letter, p. 14.
    \428\ See Rule 613(a)(1)(xii).
    \429\ See Rule 613(a)(1)(vii).
---------------------------------------------------------------------------

    The Commission also notes that, because millisecond time stamps may
become inadequate to investigate trading as technology evolves and
trading speeds increase, the adopted Rule requires that the NMS plan
submitted to the Commission for its consideration require the plan
sponsors to annually evaluate whether industry standards have evolved
such that a finer increment time stamp is appropriate. As this approach
is tied to the then-current industry standard used to assess whether to
shorten the future time stamp increment, the Commission also believes
that this approach helps assure that the time stamps in the
consolidated

audit trail will be in line with technological developments. Should the
industry standard move to a finer time standard, the plan sponsors
could modify the minimum standard required by the NMS plan by
submitting an amendment to the NMS plan under Rule 608 of Regulation
NMS. Such an amendment would need to be considered and would be subject
to approval by the Commission, as well as subject to public notice and
comment.\430\
---------------------------------------------------------------------------

    \430\ See Rule 608(b)(1) under Regulation NMS, 17 CFR
242.608(b)(1).
---------------------------------------------------------------------------

vi. Additional Routing Data Elements
    Proposed Rules 613(c)(7)(ii) and (iii) would have required that
certain additional information be collected and reported specifically
to allow regulators to track the life of an order through the routing
process. The Commission requested comment as to whether information
regarding the routing of orders would be necessary or useful for an
effective consolidated audit trail, and asked if any information, in
addition to the data elements proposed, should be included in the
consolidated audit trail relating to routing.
    One commenter noted that the proposed Rule would capture the
routing of an order internally within a broker-dealer, but not the
routing of an order internally within an exchange from one execution
system to another.\431\ This commenter also noted that, as proposed,
the Rule would not require an SRO or member to report information
indicating that an order was ``flashed'' or otherwise displayed in a
``step-up'' mechanism.\432\ The commenter believed that this
information would be important for the consolidated audit trail to
capture.\433\
---------------------------------------------------------------------------

    \431\ See GETCO Letter, p. 4.
    \432\ Id.
    \433\ Id.
---------------------------------------------------------------------------

    The Commission believes that it is important to capture the routing
of an order internally within a broker-dealer to, for example, evaluate
best execution practices.\434\ Capturing the time at which a broker-
dealer received a customer's order and the time that such order was
executed can help determine if the broker-dealer delayed acting on its
customer's order. The time at which an order was routed can affect the
evaluation of whether the broker-dealer fulfilled its best execution
obligations, and, thus, the Commission believes that this internal
broker-dealer routing information should be captured by Rule 613. The
Commission, however, does not believe that data regarding order
processing (i.e., management of an order) within exchange systems is as
useful as data regarding internal routing within a broker-dealer \435\
because, for example, unlike broker-dealers, exchanges do not have best
execution obligations. Further, any issues with an SRO's internal
processing would occur at a single venue--the SRO--and, thus, there
could be direct follow-up with the SRO. Additionally, the Commission
notes that the consolidated audit trail will not collect information
indicating whether orders were flashed or displayed in a ``step-up''
mechanism as it concerns an exchange's internal processing and
dissemination to its members of an order in the instance when the
exchange cannot execute the order because the exchange does not have
any available trading interest at the NBBO (depending on the side of
the order).\436\ Orders that are flashed or displayed through a ``step-
up'' mechanism are not executable because they are displayed only to
members of an exchange as an indication of a broker-dealer's interest.
The Commission believes it is appropriate not to require the reporting
of these flashed or ``stepped-up'' orders to the central repository
because, as noted above, the Commission believes that the tracing of
processes within an exchange is not as material to regulators as the
routing of orders between markets. Further, as stated, SROs do not have
the same legal obligations with regard to handling customer orders as
broker-dealers; therefore, the Commission does not believe it is
necessary, at this time, to require the consolidated audit trail to
track an SRO's internal processing of orders.
---------------------------------------------------------------------------

    \434\ OATS rules currently require the recording and reporting
of orders routed internally. See FINRA Rule 7440(c).
    \435\ The Commission acknowledges that certain orders received
by an exchange may be routed to another exchange; however, the
routing of such an order to the other exchange is largely subject to
the rules of the exchange and Rule 613 will capture such routing as
a reportable event.
    \436\ In general, flash orders are communicated to certain
market participants and either executed immediately or withdrawn
immediately after communication. The Commission has proposed and
sought comment on whether to amend Rule 602 of Regulation NMS under
the Exchange Act to eliminate an exception for the use of flash
orders by equity and options exchanges. See Securities Exchange Act
Release Nos. 60684 (September 18, 2009), 74 FR 48632 (September 23,
2009); 62445 (July 2, 2010), 75 FR 39625 (July 9, 2010).
---------------------------------------------------------------------------

    The Commission has considered the comments related to the data that
is required to be recorded and reported when an order is routed and is
adopting Rules 613(c)(7)(ii) and (iii) substantially as proposed.\437\
The Commission notes that the Rule requires that the NMS plan require
the broker-dealer routing an order and the broker-dealer receiving a
routed order--both actions that are defined as ``reportable events''
under Rule 613--record and report the CAT-Reporter-ID of the broker-
dealer routing the order and the CAT-Reporter-ID of the broker-dealer
receiving the routed order. The Commission believes the requirement to
report this information on both the routing and receiving end of a
route is not duplicative but, rather, is useful. Specifically,
information regarding when a broker-dealer received a routed order
could prove useful in an investigation of allegations of best execution
violations to see if, for example, there were delays in executing an
order that could have been executed earlier. In addition, if a market
participant is required to report when it receives an order, regulators
could solely rely on information gathered directly from that market
participant when examining or investigating the market participant. For
example, if a regulator needs to investigate a delay between the time a
market participant received an order and the time the market
participant acted on the order, under Rule 613, as adopted, the
regulator could use information recorded and reported by the market
participant itself, rather than rely on information about the receipt
and action taken on the order that would be provided by a third party.
Information from a third party may be less accurate in general and may
not accurately reflect events to the extent there are latencies in
order transmission. In addition, the Commission relies on data such as
that which would be recorded under Rule 613(c)(7)(ii) and (iii) to
improve its understanding of how markets operate and evolve, including
with respect to the development of new trading practices, the
reconstruction of atypical or novel market events, and the implications
of new markets or market rules. For these reasons, the Commission
believes that it is important to have both the routing broker-dealer
and the receiving broker-dealer report their CAT-Reporter-IDs to the
central repository, and that such information could aid regulatory
authorities when analyzing the trades of market participants.\438\
---------------------------------------------------------------------------

    \437\ See Section III.B.1.d.vi., supra, for a discussion of the
modifications to Rule 613(c)(7)(ii) through (iii).
    \438\ The Commission notes that OATS rules also require both the
FINRA reporting member routing an order and the FINRA reporting
member receiving the order to record and report certain audit trail
data. See FINRA Rule 7440(C). See also Rule 613(c)(7)(ii)(D) and
Rule 613(c)(7)(iii)(D) through (E).
---------------------------------------------------------------------------

    To reflect terms that have been modified elsewhere in the Rule as

adopted, the terms ``unique order identifier'' and ``unique
identifier'' in Rule 613(c)(7)(ii) and (iii) have been replaced with
the terms ``CAT-Order-ID'' and ``CAT-Reporter-ID.'' In addition, Rule
613(c)(7)(ii) and (iii) now reflect the new time stamp requirement
contained in Rule 613(d)(3). Specifically, Rules 613(c)(7)(ii)(C) and
613(c)(7)(iii)(C) provide that the time at which an order is routed or
received must be recorded and reported pursuant to Rule 613(d)(3),
rather than simply in milliseconds as proposed. The Commission believes
these conforming changes are appropriate to reflect the revised terms
in the adopted Rule.
vii. Additional Modification, Cancellation, or Execution Data Elements
    In addition to the data elements discussed above, proposed Rules
613(c)(7)(iv) and (v) would have required that certain information be
collected and provided specifically to allow regulators to track the
life of an order through modification, cancellation, or execution. The
Commission requested comment as to whether information required under
the Rule as proposed would be sufficient to create a complete and
accurate consolidated audit trail, and asked if any information, in
addition to the data elements proposed, should be included in the
consolidated audit trail relating to modifications, cancellations, or
executions.
    In response, one commenter noted that broker-dealer order
management systems may differ in their treatment of order modifications
and cancellations, as some, for example, may capture or report only
modified data elements, and not necessarily all of the elements of a
modified order.\439\ The commenter recommended that the consolidated
audit trail accommodate such differences, and further suggested
requiring only the submission of the order identifier for a cancelled
order, not the order's other data elements.\440\ Another commenter
believed that, ``[a]s in the case of the current OATS system, execution
data provided to the consolidated audit trail should identify where the
trade was publicly reported and have a common identifier that links the
audit trail execution reports for the buy and sell orders to the public
trade report.'' \441\
---------------------------------------------------------------------------

    \439\ See SIFMA Drop Copy Letter, p. 4.
    \440\ Id.
    \441\ See Liquidnet Letter, p. 7.
---------------------------------------------------------------------------

    After consideration of the comments regarding the specific audit
trail data required for orders that are modified, cancelled, or
executed, the Commission is adopting Rules 613(c)(7)(iv) and (v)
substantially as proposed, with a modification to require that the NMS
plan include a requirement that the CAT-Order-ID for such orders also
be recorded and reported to the central repository. This modification
is designed to ensure that an order identifier be reported for orders
that have been modified or cancelled. The Commission believes that the
order identifier is a critical piece of information that will
efficiently link an order across markets. Adopted Rules 613(c)(7)(iv)
and (v) will also require that the NMS plan submitted to the Commission
for its consideration require the recording and reporting of the CAT-
Reporter-ID of the broker-dealer or Customer-ID of the person giving
the modification or cancellation instruction to reflect the new
terminology of the adopted Rule. In addition, Rules 613(c)(7)(iv) and
(v) reflect the new time stamp requirement contained in Rule 613(d)(3),
as adopted. Specifically, Rules 613(c)(7)(iv)(C) and 613(c)(7)(v)(C)
provide that the time at which an order is modified, cancelled, or
executed must be recorded and reported pursuant to Rule 613(d)(3),
rather than simply in milliseconds as proposed.
    The Commission believes it is necessary to require the NMS plan to
require the information under Rule 613(c)(7)(iv) and (v) for each order
and reportable event because it will assist the Commission and SROs in
identifying all changes made to an order (including an execution) and
those market participants responsible for the changes (or execution).
The Commission believes this information, in combination with the
proposed information pertaining to order receipt or origination, will
provide regulators with a comprehensive view of all material stages and
participants in the life of an order. Among other things, this order
information should help regulators investigate suspicious trading
activity in a more efficient manner than is currently possible.
Regulators will have access to information identifying the customer
behind the order and will also see how a customer's order is handled
across markets. This data also will improve regulators' understanding
of how markets operate and evolve, including with respect to the
development of new trading practices, the reconstruction of atypical or
novel market events, and the implications of new markets or market
rules. In addition, the Commission believes that most of the data
proposed to be recorded and reported by the Rule for order
modification, cancellation, and execution is data that most broker-
dealers already generate in the course of handling an order pursuant to
the existing audit trail requirements of several SROs.\442\
---------------------------------------------------------------------------

    \442\ See, e.g., FINRA Rule 7440(d); Nasdaq Rule 6950; NYSE Rule
132B.
---------------------------------------------------------------------------

    The Commission notes that regulatory staff at an SRO or the
Commission could use execution information required under Rule
613(c)(7)(v), which will be consolidated with the other audit trail
information required under Rule 613 to, for example, detect patterns of
reported and unreported transactions effected by a broker-dealer in a
particular security by comparing the data reported to the central
repository regarding an execution with information reported pursuant to
a transaction reporting plan or the OPRA Plan. Depending on the results
of that analysis, regulators may undertake further inquiry into the
nature of trading by that broker-dealer to determine whether the public
received accurate and timely information regarding executions, and
whether the broker-dealer complied with the trade reporting obligations
contained in SRO rules. Patterns of reported and unreported
transactions by a particular broker-dealer could also be indicia of
market abuse, including the failure to obtain the best execution for
customer orders, or possible market manipulation. Thus, the ability to
compare the consolidated order execution data, including customer
information, with the trades reported to the consolidated tape would be
an important component of an effective market surveillance program that
is not possible today because regulators currently do not have access
to comprehensive cross-market audit trail data, and the process of
identifying customers is very labor intensive, time-consuming, and
error prone.
    In response to the commenter that recommended that the consolidated
audit trail accommodate differences in the treatment of modifications
by broker-dealer order management systems (i.e., those that report only
the modified data elements, not the entire order), and suggested that
only an order identifier be reported for a cancellation, not the
cancelled order's other data elements,\443\ the Commission notes that
Rule 613 does not require all of the data elements of a modified order
to be reported to the central repository. The Rule only requires the
NMS plan to require the reporting of the CAT-Order-ID; the date and
time the modification

is received or originated; the CAT-Reporter ID of the broker-dealer or
the Customer-ID of the person giving the modification instruction; if
modified, the price and remaining size of the order; and any other
changes to the material terms of the order. The adopted Rule also
requires the NMS plan to require the date and time a cancellation is
received or originated and the CAT-Reporter-ID of the broker-dealer, or
Customer-ID of the person, giving the cancellation instruction to be
reported to the central repository. The Commission believes this will
ensure that regulators can determine the market participant or person
responsible for the cancellation of an order,\444\ and the date and
time of the cancellation.
---------------------------------------------------------------------------

    \443\ See SIFMA Drop Copy Letter, p. 4.
    \444\ See Section III.B.1.iii., supra.
---------------------------------------------------------------------------

    In response to the commenter that suggested that the Rule should
require that the execution data be linked with the public trade report
using a common identifier,\445\ the Commission notes that Rule