information to ensure FINRA can continue to perform its surveillance
with CAT Data rather than OATS data and can, thus, more quickly
eliminate OATS and the OATS Rules.
---------------------------------------------------------------------------

    \3921\ SEC Rule 613(c)(7) lists the minimum order information
that must be reported to the CAT and specifies the information that
must be included in the CAT NMS Plan. The Commission noted in the
Adopting Release that ``the SROs are not prohibited from proposing
additional data elements not specified in Rule 613 if the SROs
believe such data elements would further, or more efficiently,
facilitate the requirements of [SEC Rule 613].'' Adopting Release at
45750.
---------------------------------------------------------------------------

    The purpose of OATS is to collect data to be used by FINRA staff
to conduct surveillance and investigations of member firms for
potential violations of FINRA rules and federal securities laws and
regulations. SEC Rule 613 requires the Participants to include in
the CAT NMS Plan a requirement that all Industry Members report
information to the Central Repository within three years after the
Effective Date. Consistent with this provision, under the terms of
Sections 6.4 and 6.7 of the CAT NMS Plan, some Reporting Members
will not be reporting information to the Central Repository until
three years after the Effective Date. Because FINRA must continue to
perform its surveillance obligations without interruption, OATS
cannot be entirely eliminated until all FINRA members who currently
report to OATS are reporting CAT Data to the Central Repository.
However, FINRA will monitor its ability to integrate CAT Data with
OATS data to determine whether it can continue to perform its
surveillance obligations. If it is practicable to integrate the data
in a way that ensures no interruption in FINRA's surveillance
capabilities, FINRA will consider exempting firms from the OATS
Rules provided they report data to the Central Repository pursuant
to the CAT NMS Plan and any implementing rules.
    FINRA's ability to eliminate OATS reporting obligations is
dependent upon the ability of the Plan Processor and FINRA to work
together to integrate CAT Data with the data collected by OATS.
FINRA is committed to working diligently with the Plan Processor to
ensure this process occurs in a timely manner; however, it is
anticipated that Reporting Members will have to report to both OATS
and the Central Repository for some period of time until FINRA can
verify that the data into the Central Repository is of sufficient
quality for surveillance purposes and that all reporting
requirements meet the established steady state Error Rates set forth
in Section A.3(b). Once this is verified, FINRA's goal is to
minimize the dual-reporting requirement.
    Finally, the Participants note that, pursuant to Section 19 of
the Exchange Act, the amendment or elimination of the OATS Rules can
only be done with Commission approval. Approval of any such filings
is dependent upon a number of factors, including public notice and
comment and required findings by the Commission before it can
approve any amendments; therefore, FINRA cannot speculate how long
this process may ultimately take.

Objective Milestones to Assess Progress (SEC Rule 613(a)(1)(x))

    As required by SEC Rule 613(a)(1)(x), this section sets forth a
series of detailed objective milestones, with [projected] required
completion dates, toward implementation of the consolidated audit
trail.

[ssquf] Publication and Implementation of the Methods for Providing
Information to the Customer-ID Database
---------------------------------------------------------------------------

    \3922\ Small broker-dealers are defined SEC Rule 0-10(c).

------------------------------------------------------------------------
               Milestone                   [Projected] completion date
------------------------------------------------------------------------
                       Selection of Plan Processor
------------------------------------------------------------------------
Participants jointly select the Initial  No later than 2 months after
 Plan Processor pursuant to the process   Effective Date
 set forth in Article V of the CAT NMS
 Plan.
------------------------------------------------------------------------
       Industry Members (other than Small Industry Members \3922\)
------------------------------------------------------------------------
Plan Processor begins developing the     No later than 15 months before
 procedures, connectivity requirements    Industry Members (other than
 and Technical Specifications for         Small Industry Members) are
 Industry Members to report Customer      required to begin reporting
 Account Information and Customer         data to the Central Repository
 Identifying Information to the Central
 Repository.
Plan Processor publishes iterative       As needed before publishing the
 drafts of the procedures, connectivity   final documents
 requirements and Technical
 Specifications for Industry Members to
 Report Customer Account Information
 and Customer Identifying Information
 to the Central Repository.
Plan Processor publishes the             No later than 6 months before
 procedures, connectivity requirements    Industry Members (other than
 and Technical Specifications for         Small Industry Members) are
 Industry Members to report Customer      required to begin reporting
 Account Information and Customer         data to the Central Repository
 Identifying Information to the Central
 Repository.
Industry Members (other than Small       No later than 3 months before
 Industry Members) begin connectivity     Industry Members (other than
 and acceptance testing with the          Small Industry Members) are
 Central Repository.                      required to begin reporting
                                          data to the Central Repository

Industry Members (other than Small       No later than 1 month before
 Industry Members) begin reporting        Industry Members (other than
 customer/institutional/firm account      Small Industry Members) are
 information to the Central Repository    required to begin reporting
 for processing.                          data to the Central Repository
------------------------------------------------------------------------
                         Small Industry Members
------------------------------------------------------------------------
Small Industry Members begin             No later than 3 months before
 connectivity and acceptance testing      Small Industry Members are
 with the Central Repository.             required to begin reporting
                                          data to the Central Repository
Small Industry Members begin reporting   No later than 1 month before
 customer/institutional/firm account      Small Industry Members are
 information to the Central Repository    required to begin reporting
 for processing.                          data to the Central Repository
------------------------------------------------------------------------

[ssquf] Submission of Order and MM Quote Data to Central Repository

------------------------------------------------------------------------
               Milestone                   [Projected] completion date
------------------------------------------------------------------------
                              Participants
------------------------------------------------------------------------
Plan Processor begins developing         No later than 10 months before
 Technical Specification(s) for           Participants are required to
 Participant submission of order and MM   begin reporting data to the
 Quote data.                              Central Repository
Plan Processor publishes iterative       As needed before publishing of
 drafts of Technical Specification(s).    the final document
Plan Processor publishes Technical       No later than 6 months before
 Specification(s) for Participant         Participants are required to
 submission of order and MM Quote data.   begin reporting data to the
                                          Central Repository
Plan Processor begins connectivity       No later than 3 months before
 testing and accepting order and MM       Participants are required to
 Quote data from Participants for         begin reporting data to the
 testing purposes.                        Central Repository
Plan Processor plans specific testing    No later than [Beginning] 3
 dates for Participant testing of order   months before Participants are
 and MM Quote submission.                 required to begin reporting
                                          data to the Central Repository
------------------------------------------------------------------------
          Industry Members (other than Small Industry Members)
------------------------------------------------------------------------
Plan Processor begins developing         No later than 15 months before
 Technical Specification(s) for           Industry Members (other than
 Industry Members submission of order     Small Industry Members) are
 data.                                    required to begin reporting
                                          data to the Central Repository
Plan Processor publishes iterative       As needed before publishing of
 drafts of Technical Specification(s).    the final document
Plan Processor publishes Technical       No later than 1 year before
 Specification(s) for Industry Member     Industry Members (other than
 submission of order data.                Small Industry Members) are
                                          required to begin reporting
                                          data to the Central Repository
Participant exchanges that support       No later than 6 months before
 options MM quoting publish               Industry Members (other than
 specifications for adding Quote Sent     Small Industry Members) are
 time to Quoting APIs.                    required to begin reporting
                                          data to the Central Repository
Plan Processor makes the testing         No later than 6 months before
 environment available on a voluntary     Industry Members (other than
 basis and begins connectivity testing    Small Industry Members) are
 and accepting order data from Industry   required to begin reporting
 Members (other than Small Industry       data to the Central Repository
 Members) for testing purposes.
Plan Processor and Industry Members      No later than [Beginning] 3
 begin coordinated and structured         months before Industry Members
 [plans specific testing dates for        (other than Small Industry
 Industry Members (other than Small       Members) are required to begin
 Industry Members)] testing of order      reporting data to the Central
 submission.                              Repository
Participant exchanges that support       No later than 1 month before
 options MM quoting begin accepting       Industry Members (other than
 Quote Sent time on Quotes.               Small Industry Members) are
                                          required to begin reporting
                                          data to the Central Repository
------------------------------------------------------------------------
                         Small Industry Members
------------------------------------------------------------------------
Plan Processor makes the testing         No later than 6 months before
 environment available on a voluntary     Small Industry Members are
 basis and begins connectivity testing    required to begin reporting
 and accepting order data from Small      data to the Central Repository
 Industry Members for testing purposes.
Plan Processor and Small Industry        No later than [Beginning] 3
 Members begin coordinated and            months before Small Industry
 structured [Plan Processor plans         Members are required to begin
 specific testing dates for Small         reporting data to the Central
 Industry Members] testing of order       Repository
 submissions.
------------------------------------------------------------------------

[ssquf] Linkage of Lifecycle of Order Events

------------------------------------------------------------------------
               Milestone                   [Projected] completion date
------------------------------------------------------------------------
                              Participants
------------------------------------------------------------------------
Using order and MM Quote data submitted  No later than 3 months before
 during planned testing, Plan Processor   Participants are required to
 creates linkages of the lifecycle of     begin reporting data to the
 order events based on the received       Central Repository
 data.

Participants must synchronize Business   No later than 4 months after
 Clocks in accordance with Section 6.8    effectiveness of the CAT NMS
 of the CAT NMS Plan.                     Plan
------------------------------------------------------------------------
          Industry Members (other than Small Industry Members)
------------------------------------------------------------------------
Using order and MM Quote data submitted  No later than 6 months before
 during planned testing, Plan Processor   Industry Members (other than
 creates linkages of the lifecycle of     Small Industry Members) are
 order events based on the received       required to begin reporting
 data.                                    data to the Central Repository
Industry Members must synchronize        No later than 4 months after
 Business Clocks in accordance with       effectiveness of the CAT NMS
 Section 6.8 of the CAT NMS Plan.         Plan
------------------------------------------------------------------------
                         Small Industry Members
------------------------------------------------------------------------
Using order and MM Quote data submitted  No later than 6 months before
 during planned testing, Plan Processor   Small Industry Members are
 creates linkages of the lifecycle of     required to begin reporting
 order events based on the received       data to the Central Repository
 data.
Industry Members must synchronize        No later than 4 months after
 Business Clocks in accordance with       effectiveness of the CAT NMS
 Section 6.8 of the CAT NMS Plan.         Plan
------------------------------------------------------------------------

[ssquf] Access to the Central Repository for Regulators

------------------------------------------------------------------------
               Milestone                   [Projected] completion date
------------------------------------------------------------------------
Plan Processor publishes a draft         No later than 6 months before
 document detailing methods of access     Participants are required to
 to the Central Repository for            begin reporting data to the
 regulators.                              Central Repository
Plan Processor publishes a finalized     No later than 1 month before
 document detailing methods of access     Participants are required to
 to the Central Repository for            begin reporting data to the
 regulators, including any relevant       Central Repository
 APIs, GUI descriptions, etc. that will
 be supplied for access.
Plan Processor provides (1) test         No later than 1 month before
 information, either from Participant     Participants are required to
 testing or from other test data, for     begin reporting data to the
 regulators to test use of the Central    Central Repository
 Repository and (2) regulators
 connectivity to the Central Repository
 test environment and production
 environments.
Plan Processor provides regulators       No later than 6 months before
 access to test data for Industry         Industry Members (other than
 Members (other than Small Industry       Small Industry Members) are
 Members).                                required to begin reporting
                                          data to the Central Repository
Plan Processor provides regulators       No later than 6 months before
 access to test data for Small Industry   Small Industry Members are
 Members.                                 required to begin reporting
                                          data to the Central Repository
------------------------------------------------------------------------

[ssquf] Integration of Other Data (``Other Data'' includes, but is not
limited to, SIP quote and trade data, OCC data, trade and quote
information from Participants and reference data)

------------------------------------------------------------------------
               Milestone                   [Projected] completion date
------------------------------------------------------------------------
Operating Committee finalizes Other      No later than 10 months before
 Data requirements.                       Participants are required to
                                          begin reporting data to the
                                          Central Repository
Plan Processor determines methods and    No later than 3 months before
 requirements for each additional data    Participants are required to
 source and publish applicable            begin reporting data to the
 Technical Specifications, if required.   Central Repository
Plan Processor begins testing with       No later than 1 month before
 Other Data sources.                      Participants are required to
                                          begin reporting data to the
                                          Central Repository
Plan Processor begins accepting Other    No later than [C]concurrently
 Data sources.                            when Participants report to
                                          the Central Repository
------------------------------------------------------------------------

    Process Followed to Develop the NMS Plan: These considerations
require the CAT NMS Plan to discuss: (i) the views of the
Participants' Industry Members and other appropriate parties
regarding the creation, implementation, and maintenance of the CAT;
and (ii) the alternative approaches to creating, implementing, and
maintaining the CAT considered and rejected by the Participants.

11. Process by Which Participants Solicited Views of Members and Other
Appropriate Parties Regarding Creation, Implementation, and Maintenance
of CAT; Summary of Views; and How Sponsors Took Views Into Account in
Preparing NMS Plan (SEC Rule 613(a)(1)(xi))

[ssquf] Process Used to Solicit Views:

    When the Participants first began creating a CAT pursuant to SEC
Rule 613, the Participants developed the following guiding
principles (the ``Guiding Principles''):
    i. The CAT must meet the specific requirements of SEC Rule 613
and achieve the primary goal of creating a single, comprehensive
audit trail to enhance regulators' ability to surveil the U.S.
markets in an effective and efficient way.
    ii. The reporting requirements and technology infrastructure
developed must be adaptable to changing market structures and

reflective of trading practices, as well as scalable to increasing
market volumes.
    iii. The costs of developing, implementing, and operating the
CAT should be minimized to the extent possible. To this end,
existing reporting structures and technology interfaces will be
utilized where practicable.
    iv. Industry input is a critical component in the creation of
the CAT. The Participants will consider industry feedback before
decisions are made with respect to reporting requirements and cost
allocation models.
    The Participants explicitly recognized in the Guiding Principles
that meaningful input by the industry was integral to the successful
creation and implementation of the CAT, and as outlined below, the
Participants have taken numerous steps throughout this process to
ensure the industry and the public have a voice in the process.

12. General Industry Solicitation

    SEC Rule 613 was published in the Federal Register on August 1,
2012, and the following month, the Participants launched the CAT NMS
Plan Website, which includes a dedicated email address for firms or
the public to submit views on any aspect of the CAT. The CAT NMS
Plan Website has been used as a means to communicate information to
the industry and the public at large since that time. Also beginning
in September 2012, the Participants hosted several events intended
to solicit industry input regarding the CAT NMS Plan. A summary of
the events is provided below: \3923\
---------------------------------------------------------------------------

    \3923\ These events are also described on the CAT NMS Plan
Website at www.catnmsplan.com. See SEC Rule 613: Consolidated Audit
Trail (CAT), Past Events and Announcements (last updated Dec. 10,
2014), available at http://catnmsplan.com/PastEvents/.

CAT Industry Call (September 19, 2012). The Participants provided an
overview of SEC Rule 613, the steps the Participants were taking to
develop a CAT NMS Plan as required by SEC Rule 613, and how the
Participants planned to solicit industry comments and feedback on
---------------------------------------------------------------------------
key implementation issues.

CAT Industry Events (October 2012). The Participants provided an
overview of SEC Rule 613 and the steps the Participants were taking
to develop an NMS Plan as required by SEC Rule 613. The events
included an open Q & A and feedback session so that Industry Members
could ask questions of the Participants and share feedback on key
implementation issues. Two identical sessions were held on October
15, 2012 from 2:00 p.m. to 4:00 p.m. and on October 16, 2012 from
10:00 a.m. to 12:00 p.m. A total of 89 Industry Members attended the
October 15 event in person, and a total of 162 Industry Members
attended it by phone. A total of 130 Industry Members attended the
October 16 event in person, and a total of 48 Industry Members
attended it by phone.
CAT Industry Call and WebEx (November 29, 2012). The Participants
provided an update on CAT NMS Plan development efforts including the
process and timeline for issuing the RFP to solicit Bids to build
and operate the CAT.
CAT Industry Events (February 27, 2014 and April 9, 2014). During
these two events, the Participants provided an overview of the
latest progress on the RFP process and the overall development of
the NMS Plan. A total of 120 Industry Members attended the February
event in person, and a total of 123 Industry Members attended it by
phone. A total of 46 Industry Members attended the April event in
person, and a total of 76 Industry Members attended it by phone.
CAT Cost Study Webinars (June 25, 2014 and July 9, 2014). The
Participants hosted two Webinars to review and answer questions
related to the Reporter Cost Study. There were approximately 100 to
120 Industry Members on each call.
CAT Industry Call and WebEx (December 10, 2014). The Participants
provided an update on CAT NMS Plan development efforts, including
filing of the CAT NMS Plan on September 30, 2014, the development of
a funding model, and the PPR, which documents additional
requirements for the CAT.

    For the above events, documentation was developed and presented
to attendees, as well as posted publicly on the CAT NMS Plan
Website.
    In addition to the above events, some Participants individually
attended or participated in additional industry events, such as
SIFMA conferences and FIF working groups, where they provided
updates on the status of CAT NMS Plan development and discussed
areas of expected CAT functionality.
    The Participants received general industry feedback from broker-
dealers and software vendors.\3924\ The Participants reviewed such
feedback in detail, and addressed as appropriate while developing
the RFP.
---------------------------------------------------------------------------

    \3924\ See generally Industry Feedback on the Consolidated Audit
Trail (last updated Feb. 17, 2015), available at http://catnmsplan.com/industryFeedback/.
---------------------------------------------------------------------------

    The Participants also received industry feedback in response to
solicitations by the Participants for industry viewpoints as
follows:

Proposed RFP Concepts Document (published December 5, 2012, updated
January 16, 2013). The Participants published via the CAT NMS Plan
Website this document to solicit feedback on the feasibility and
cost of implementing the CAT reporting requirements being considered
by the Participants. Feedback was received from seven organizations,
including software vendors, industry associations and broker-
dealers, and the Participants discussed and addressed the feedback
as appropriate in the final RFP document.
Representative Order Scenarios Solicitation for Feedback (February
1, 2013). The Participants solicited feedback via the CAT NMS Plan
Website on potential CAT reporting requirements to facilitate the
reporting of representative orders. Approximately 30 responses were
received.
CAT Industry Solicitation for Feedback Concerning Selected Topics
Related to NMS Plan (April 22, 2013). The Participants solicited
feedback via the CAT NMS Plan Website on four components of the CAT
NMS Plan: (1) Primary Market Transactions; (2) Advisory Committee;
(3) Time Stamp Requirement; and (4) Clock Synchronization.
Approximately 80 Industry Members provided responses. FIF, SIFMA,
and Thomson Reuters submitted detailed responses to the request for
comments.
CAT Industry Solicitation for Feedback Concerning Selected Topics
Related to NMS Plan (June 2013). The Participants solicited feedback
via the CAT NMS Plan Website concerning Customer identifiers,
Customer information, CAT-Reporter-IDs, CAT-Order-IDs, CAT intra-
firm order linkages, CAT inter-firm order linkages, broker-dealer
CAT order-to-exchange order linkages, data transmission, and error
correction.
CAT Industry Feedback on Clock Drift and Time Stamp Issues
(September 2013). The Participants solicited feedback via the DAG
concerning the implementation impact associated with a 50
millisecond clock drift requirement for electronic orders and
executions.
Cost Survey on CAT Reporting of Options Market Maker Quotes
(November 2013). The Participants solicited feedback via the DAG
concerning the implementation impact and costs associated with
reporting of quotes by options market makers to the Central
Repository.
Cost Estimates for CAT Exemptive Relief (December 2014). The
Participants solicited feedback via the DAG regarding minimum
additional costs to be expected by Industry Members in the absence
of the requested Exemptive Relief.
Cost Estimate for Adding Primary Market Transactions in CAT
(February 2015). The Participants solicited feedback via the DAG
concerning the feasibility and costs of broker-dealers to report to
the Central Repository information regarding primary market
transactions in NMS securities.
Clock Offset Survey (February 2015). The Participants solicited
further feedback via the DAG concerning current broker-dealer clock
synchronization practices and expected costs associated with
complying with a 50ms, 5ms, 1ms, and 100 microsecond clock drift
requirement for electronic orders and executions.

    Feedback on these topics was received primarily through
discussion during meetings of the DAG.

13. The Development Advisory Group (DAG)

    In furtherance of Guiding Principle (iv) above, the Participants
solicited members for the DAG in February 2013 to further facilitate
input from the industry regarding various topics that are critical
to the success of the CAT NMS Plan. Initially, the DAG consisted of
10 firms that represented large, medium, and small broker-dealers,
the Options Clearing Corporation (OCC), a service bureau and three
industry associations: the Security Traders Association (STA),
SIFMA, and FIF.
    In March 2014, the Participants invited additional firms to join
the DAG in an effort to ensure that it reflected a diversity of
perspectives. At this time, the Participants increased the
membership of the DAG to include 12 additional firms. As of January
2015, the DAG consisted of the Participants and Representatives from
24 firms and industry associations.

    The DAG has had 49 meetings since April 2013. Topics discussed
with the DAG have included:

CAT Plan Feedback. The Participants shared draft versions of the CAT
NMS Plan, including the PPR, as it was being developed with the DAG,
who provided feedback to the Participants. The Participants reviewed
and discussed this feedback with the DAG, and incorporated portions
of it into the CAT NMS Plan.
Options Market Maker Quotes. The DAG discussed the impact of options
market maker quotes on the industry. A cost analysis was conducted
by the industry trade associations to analyze the impact of market
maker quote reporting, as well as adding a ``quote sent'' time stamp
to messages sent to exchanges by all options market makers The
Participants included in the Exemptive Request Letters a request for
exemptive relief related to option market maker quotes given that
exchanges will be reporting this data to the CAT.
Customer-ID. The DAG discussed the requirements for capturing
Customer-ID. The Participants proposed a Customer Information
Approach in which broker-dealers assign a unique Firm Designated ID
to each Customer and the Plan Processor creates and stores the
Customer-ID. This concept was supported by the DAG and the
Participants included in the Exemptive Request Letters a request for
exemptive relief related to the Customer-ID to reduce the reporting
on CAT Reporters.
Time Stamp, Clock Synchronization and Clock Drift. The DAG discussed
time stamps in regards to potential exemptive relief on the time
stamp requirements for allocations and Manual Order Events. In
addition, industry clock synchronization processes were discussed as
well as the feasibility of specific clock drift requirements (e.g.,
50ms), with the DAG and the FIF conducting an industry survey to
identify the costs and challenges associated with various levels of
clock synchronization requirements.\3925\ The Participants included
in the Exemptive Request Letters a request for exemptive relief
related to manual time stamps.
---------------------------------------------------------------------------

    \3925\ See FIF, Clock Offset Survey Preliminary Report (last
updated Feb. 17, 2015), available at<EMAIL_ADDRESS>(the
``FIF Clock Offset Survey Preliminary Report'').
---------------------------------------------------------------------------

Exemptive Request Letters. In addition to the specific areas
detailed above (Options Market Maker Quotes, Customer-ID, and Time
Stamp, Clock Synchronization, and Clock Drift), the DAG provided
input and feedback on draft versions of the Exemptive Request
Letters prior to their filing with the SEC, including cost estimates
to firms and the Industry as a whole should the exemptive requests
not be granted. This feedback was discussed by the Participants and
the DAG and incorporated into the Exemptive Request Letters. The DAG
also provided input and feedback on the Exemptive Request Letters
covering Linking Allocations to Executions and Account Effective
Date submitted on April 3, 2015 and September 2, 2015 respectively.
Primary Markets. At the request of the Participants, the DAG
discussed with the Participants the feasibility, costs, and benefits
associated with reporting allocations of NMS Securities in Primary
Market Transactions. The DAG further provided estimated costs
associated with reporting allocations of NMS Securities in Primary
Market Transactions at the top-account and sub-account levels, which
was incorporated into the CAT NMS Plan.\3926\
---------------------------------------------------------------------------

    \3926\ See DAG, Cost Estimate for Adding Primary Market
Transactions into CAT (Feb. 17, 2015), available at http://catnmsplan.com/industryFeedback/P602480.
---------------------------------------------------------------------------

Order Handling Scenarios. The DAG discussed potential CAT reporting
requirements for certain order handling scenarios and additional
corresponding sub-scenarios (e.g., riskless principal order and sub-
scenarios involving post-execution print-for-print matching, pre-
execution one-to-one matching, pre-execution many-to-one matching,
complex options and auctions) An Industry Member and Participant
working group was established to discuss order handling scenarios in
more detail.
Error Handling and Correction Process. The DAG discussed error
handling and correction process. Industry Members of the DAG
provided recommendations for making the CAT error correction
processes more efficient. The Participants have reviewed and
analyzed these recommended solutions for error correction processes
and incorporated them in the requirements for the Plan Processor.
Elimination of Systems. The DAG discussed the gaps between CAT and
both OATS and EBS. An OATS-EBS-CAT gap analysis was developed and
published on the CAT NMS Plan Website to identify commonalities and
redundancies between the systems and the functionality of the CAT.
Additionally, gaps between LTID and the CAT were also developed.
Additional examples of systems and rules being analyzed include, but
are not limited to: CBOE Rule 8.9, PHLX Rule 1022, COATS, Equity
Cleared Reports, LOPR, and FINRA Rule 4560.
Cost and Funding of the CAT. The DAG helped to develop the cost
study that was distributed to Industry Members. Additionally, the
Participants have discussed with the DAG the funding principles for
the CAT and potential funding models.

    In addition, a subgroup of the DAG has met six times to discuss
equity and option order handling scenarios, order types, how and
whether the orders are currently reported and how linkages could be
created for the orders within the CAT.

[ssquf] Summary of Views Expressed by Members and Other Parties and How
Participants Took Those Views Into Account in Preparing the CAT NMS
Plan

    The various perspectives of Industry Members and other
appropriate parties informed the Participants' consideration of
operational and technical issues during the development of the CAT
NMS Plan. In addition to the regular DAG meetings and special
industry calls and events noted above, the Participants conducted
multiple group working sessions to discuss the industry's unique
perspectives on CAT-related operational and technical issues. These
sessions included discussions of options and equity order scenarios
and the RFP specifications and requirements.
    Industry feedback was provided to Participants through gap
analyses, cost studies, comment letters and active discussion in DAG
meetings and industry outreach events. Specific topics on which the
industry provided input include:
    Overall Timeline. Industry Members expressed a concern that the
original timeline for implementation of the CAT is significantly
shorter than the timeline for other large scale requirements such as
Large Trader Reporting. The industry requested that, in developing
the overall timeline for development and implementation of the CAT
NMS Plan, the Participants account for additional industry comment/
input on specifications in the official timeline and discussed risk
mitigation strategies for implementation of the Central Repository.
    Request for proposal. The Participants provided relevant
excerpts of the RFP to DAG members for review and input. These
sections were discussed by the Participants, and appropriate
feedback was incorporated prior to publishing the RFP.
    Options Market Maker Quotes. Industry Members expressed the view
that requiring market makers to provide quote information to the CAT
will be duplicative of information already being submitted to the
CAT by the exchanges. Participants worked closely with DAG members
to develop an alternative approach that will meet the goals of SEC
Rule 613, and which is detailed in the Exemptive Request Letter that
the Participants submitted to the Commission related to manual time
stamps.
    Customer-ID. Extensive DAG discussions reviewed the Customer-ID
requirements in SEC Rule 613. The industry expressed significant
concern that the complexities of adding a unique CAT customer
identifier to order reporting would introduce significant costs and
effort related to the system modifications and business process
changes broker-dealers would face in order to implement this
requirement of SEC Rule 613. Working with Industry Members, the
Participants proposed a Customer Information Approach in which
broker-dealers would assign a unique Firm Designated ID to each
Customer which the Plan Processor would retain. Additional feedback
was provided by the DAG for the use of the Legal Entity Identifier
(``LEI'') as a valid unique customer identifier as an alternative to
Tax Identification Numbers to identify non-natural person accounts.
This Customer Information Approach is included in the Exemptive
Request Letters that the Participants submitted to the Commission.
    Error Correction. DAG members discussed the criticality of CAT
Data quality to market surveillance and reconstruction, as well as
the need for a robust process for the timely identification and
correction of errors. Industry Members provided feedback on

error correction objectives and processes, including the importance
of those data errors not causing linkage breaks. This feedback was
incorporated into the RFP and relevant portions of the PPR.
    Industry Members also suggested that CAT Reporters be provided
access to their submitted data. Participants discussed the data
security and cost considerations of this request and determined that
it was not a cost-effective requirement for the CAT.
    Governance of the CAT. Industry Members provided detailed
recommendation for the integration of Industry Members into the
governance of the CAT, including an expansion of the proposed
Advisory Committee to include industry associations such as FIF and
SIFMA. Industry Members also recommended a three-year term with one-
third turnover per year is recommended to provide improved
continuity given the complexity of CAT processing.
    The Participants have discussed CAT governance considerations
with the DAG at several meetings. The Participants incorporated
industry feedback into the CAT NMS Plan to the extent possible in
light of the regulatory responsibilities placed solely upon the
Participants under the provisions of SEC Rule 613. The proposed
structure and composition of the Advisory Committee in Article 4.12
was discussed with the DAG in advance of the submission of this
Plan.
    Role of Operating Committee. The Operating Committee, consisting
of one voting member representing each Participant, is structured to
ensure fair and equal representation of the Participants in
furtherance of SEC Rule 613(b)(1). The overarching role of the
Operating Committee is to manage the Company and the CAT System
similar to the manner in which a board of directors manages the
business and affairs of a corporation. The primary and more specific
role of the Operating Committee is to make all policy decisions on
behalf of the Company in furtherance of the functions and objectives
of the Company under the Exchange Act, any rules thereunder,
including SEC Rule 613, and the CAT NMS Plan. In connection with its
role, the Operating Committee has the right, power and authority to
exercise all of the powers of the Company, to make all decisions,
and to authorize or otherwise approve all actions by the Company,
except as otherwise provided by applicable law or as otherwise
provided in the CAT NMS Plan (Section 4.1 of the CAT NMS Plan). The
Operating Committee also monitors, supervises and oversees the
actions of the Plan Processor, the Chief Compliance Officer and the
Chief Information Security Officer, all of whom are involved with
the CAT System on a more detailed and day-to-day basis.
    The decisions made by the Operating Committee include matters
that are typically considered ordinary course for a governing body
like a board of directors (e.g., approval of compensation of the
Chief Compliance Officer (Section 6.2(a)(iv) the CAT NMS Plan) and
approval to hold an executive session of the Operating Committee
(Section 4.3(a)(v) of the CAT NMS Plan)), in addition to matters
that are specific to the functioning, management and financing of
the CAT System (e.g., changes to Technical Specifications (Sections
4.3(b)(vi)-(vii) of the CAT NMS Plan) and significant changes to the
CAT System (Section 4.3(b)(v) of the CAT NMS Plan)).
    The CAT NMS Plan sets forth a structure for decisions that the
Operating Committee may make after approval of the CAT NMS Plan by
the SEC. These decisions relate to events that may occur in the
future as a result of the normal operation of any business (e.g.,
additional capital contributions (Section 3.8 of the CAT NMS Plan),
approval of a loan to the Company (Section 3.9 of the CAT NMS Plan))
or that may occur due to the operation of the CAT System (e.g., the
amount of the Participation Fee to be paid by a prospective
Participant (Section 3.3(a) of the CAT NMS Plan)). These decisions
cannot be made at the time of approval of the CAT NMS Plan because
the Operating Committee will need to make its determination based on
the facts and circumstances as they exist in the future. For
example, in determining the appropriate Participation Fee, the
Operating Committee will apply the factors identified in Section 3.3
of the CAT NMS Plan (e.g., costs of the Company and previous fees
paid by other new Participants) to the facts existing at the time
the prospective Participant is under consideration. Another example
is the establishment of funding for the Company and fees for
Participants and Industry Members. Section 11.2 of the CAT NMS Plan
sets forth factors and principles that the Operating Committee will
use in determining the funding of the Company. The Operating
Committee then has the ability to review the annual budget and
operations and costs of the CAT System to determine the appropriate
funding and fees at the relevant future time. This approach, which
sets forth standards at the time the CAT NMS Plan is approved that
will be applied to future facts and circumstances, provides the
Operating Committee with guiding principles to aid its decision-
making in the future.
    The Participants also recognize that certain decisions that are
fundamental and significant to the operation of the Company and the
CAT System must require the prior approval of the SEC, such as the
use of new factors in determining a Participation Fee (Section
3.3(b)(v) of the CAT NMS Plan). In addition, any decision that
requires an amendment to the CAT NMS Plan, such as termination of a
Participant (Section 3.7(b) of the CAT NMS Plan), requires prior
approval of the SEC (Section 12.3 of the CAT NMS Plan).
    The Operating Committee has the authority to delegate
administrative functions related to the management of the business
and affairs of the Company to one or more Subcommittees and other
Persons; however, the CAT NMS Plan expressly states that the
Operating Committee may not delegate its policy-making functions
(except to the extent policy-making determinations are already
delegated as set forth in the CAT NMS Plan, which determinations
will have been approved by the SEC) (Section 4.1 of the CAT NMS
Plan). For example, the CAT NMS Plan provides for the formation of a
Compliance Subcommittee to aid the Chief Compliance Officer in
performing compliance functions, including (1) the maintenance of
confidentiality of information submitted to the CAT; (2) the
timeliness, accuracy and completeness of information; and (3) the
manner and extent to which each Participant is meeting its
compliance obligations under SEC Rule 613 and the CAT NMS Plan
(Section 4.12(b) of the CAT NMS Plan). The Operating Committee also
has delegated authority to the Plan Processor with respect to the
normal day-to-day operating function of the Central Repository
(Section 6.1 of the CAT NMS Plan). Nevertheless, decisions made by
the Plan Processor that are more significant in nature remain
subject to approval by the Operating Committee, such as decisions
related to the implementation of policies and procedures (Section
6.1(c) of the CAT NMS Plan), appointment of the Chief Compliance
Officer, Chief Information Officer, and Independent Auditor (Section
6.1(b) of the CAT NMS Plan), Material System Changes or any system
changes for regulatory compliance (Sections 6.1(i) and 6.1(j) of the
CAT NMS Plan). In addition, the Operating Committee will conduct a
formal review of the Plan Processor's performance under the CAT NMS
Plan on an annual basis (Section 6.1(n) of the CAT NMS Plan). As to
Subcommittees that the Operating Committee may form in the future,
the Participants have determined that the Operating Committee will
establish a Selection Subcommittee to select a successor Plan
Processor when the time arises (Section 6.1(t) of the CAT NMS Plan).
In the future, the Operating Committee will take a similar approach
when delegating authority by providing Subcommittees or other
Persons with discretion with respect to administrative functions and
retaining authority to approve decisions related to policy and other
significant matters of the Company and the CAT System.
    The role of the Operating Committee, including the delegation of
its authority to Subcommittees and other limited Persons, as
provided in the CAT NMS Plan is similar to that of other national
market system plans, including the Limited Liability Company
Agreement of the Options Price Reporting Authority, LLC. It also is
based on rules and regulations under the Exchange Act, and general
principles with respect to the governance of a limited liability
company. All decisions made by the Operating Committee will be
governed by the guiding principles of the CAT NMS Plan and SEC Rule
613.
    Voting Criteria of the Operating Committee: This section
describes the voting criteria for decisions made by the Operating
Committee, which consists of a representative for each Participant,
and by any Subcommittee of the Operating Committee in the management
and supervision of the business of the Company and the CAT System.
    A Majority Vote (an affirmative vote of at least a majority of
all members of the Operating Committee or any Subcommittee
authorized to vote on a particular matter) is the default standard
for decisions that are typically considered ordinary course matters
for a governing body like a board of directors or board of managers
or that address the general governance and function of the

Operating Committee and its Subcommittees. All actions of the
Company requiring a vote by the Operating Committee or any
Subcommittee requires authorization by a Majority Vote except for
matters specified in certain sections of the CAT NMS Plan described
below, which matters require either a Supermajority Vote or a
unanimous vote. As a general matter, the approach adopted by the
Operating Committee is consistent with the voting criteria of the
NASDAQ Unlisted Trading Privileges Plan (the ``NASDAQ UTP Plan''),
the Limited Liability Company Agreement of the Options Price
Reporting Authority, LLC, the Consolidated Quotation Plan and the
Consolidated Tape Association Plan.
    A Supermajority Vote (an affirmative vote of at least two-thirds
of all of the members of the Operating Committee or any Subcommittee
authorized to vote on a particular matter) is required to authorize
decisions on matters that are outside ordinary course of business
and are considered by the Participants to have a direct and
significant impact on the functioning, management and financing of
the CAT System. This approach was informed by similar plans (e.g.,
the NASDAQ UTP Plan, which requires a unanimous vote in many similar
circumstances); however, the CAT NMS Plan has the lower requirement
of a Supermajority Vote because overuse of the unanimity requirement
makes management and oversight difficult. This approach takes into
account concerns expressed by the Participants regarding management
of the CAT NMS Plan, and is consistent with suggestions in the
Adopting Release for the Participants to take into account the need
for efficient and fair operation of the CAT NMS Plan and to consider
the appropriateness of a unanimity requirement and the possibility
of a governance requirement other than unanimity, or even
supermajority approval, for all but the most important decisions.
    The Participants believe that certain decisions that may
directly impact the functioning and performance of the CAT System
should be subject to the heightened standard of a Supermajority
Vote, such as: selection and removal of the Plan Processor and key
officers; approval of the initial Technical Specifications; approval
of Material Amendments to the Technical Specifications proposed by
the Plan Processor; and direct amendments to the Technical
Specifications by the Operating Committee. In addition, the
Participants believe the instances in which the Company enters into
or modifies a Material Contract, incurs debt, makes distributions or
tax elections or changes fee schedules should be limited, given that
the Company is intended to operate on a break-even basis.
Accordingly, those matters should also require the heightened
standard of a Supermajority Vote.
    A unanimous vote of all Participants is required in only three
circumstances. First, a decision to obligate Participants to make a
loan or capital contribution to the Company requires a unanimous
vote (Section 3.8(a) of the CAT NMS Plan). Requiring Participants to
provide additional financing to the Company is an event that imposes
an additional and direct financial burden on each Participant, thus
it is important that each Participant's approval is obtained.
Second, a decision by the Participants to dissolve the Company
requires unanimity (Section 10.1 of the CAT NMS Plan). The
dissolution of the Company is an extraordinary event that would have
a direct impact on each Participant's ability to meet its compliance
requirements so it is critical that each Participant consents to
this decision. Third, a unanimous vote is required if Participants
decide to take an action by written consent in lieu of a meeting
(Section 4.10 of the CAT NMS Plan). In that case, because
Participants will not have the opportunity to discuss and exchange
ideas on the matter under consideration, all Participants must sign
the written consent. This approach is similar to the unanimity
requirement under the Delaware General Corporation Law for decisions
made by written consent of the directors of a corporation in lieu of
a meeting.
    Voting on Behalf of Affiliated Participants: Each Participant
has one vote on the Operating Committee to permit equal
representation among all the Participants. Initially, the Operating
Committee will have 19 Participants. Of the 19 Participants, there
are five Participants that are part of the Affiliated Participants
Group and five Participants without any Affiliated Participants.
Because of the relationship between the respective Affiliated
Participants and given the large number of Participants on the
Operating Committee, the Participants believe an efficient and
effective way of structuring the Operating Committee in order to
have an orderly and well-functioning committee is to permit but not
require one individual to serve as a voting member for multiple
Affiliated Participants. This approach does not change the standard
rule that each Participant has one vote. This approach provides
Affiliated Participants with the flexibility to choose whether to
have one individual represent one or more of the Affiliated
Participants or to have each of them represented by a separate
individual. Affiliated Participants may likely vote on a matter
similarly, and allowing them to choose the same individual as a
voting member would be a convenient and practical way of having the
Affiliated Participants' votes cast. Because there is no requirement
that the representative of multiple Affiliated Participants cast the
same vote for all represented Participants, there is no practical
difference between this approach and an approach that mandates a
separate representative for each Participant. In addition, the
Participants considered whether this approach would result in less
participation because of a reduced number of individuals on the
Operating Committee. If each group of Affiliated Participants were
to choose one individual to serve as a voting member, there would be
still be 10 individuals on the Operating Committee, which the
Participants do not believe would cause less active representation
or participation or would otherwise lead to unwanted concentration
on the Operating Committee.
    Affiliated Participant Groups and Participants without
Affiliations:

1. New York Stock Exchange LLC; NYSE Arca, Inc.; NYSE MKT LLC
2. The NASDAQ Stock Market LLC; NASDAQ OMX BX, Inc.; NASDAQ OMX PHLX
LLC
3. BATS Exchange, Inc.; BATS Y-Exchange, Inc.; EDGX Exchange, Inc.;
EDGA Exchange, Inc.
4. Chicago Board Options Exchange, Incorporated; C2 Options
Exchange, Incorporated
5. International Securities Exchange, LLC; ISE Gemini, LLC
6. National Stock Exchange, Inc.
7. Chicago Stock Exchange, Inc.
8. BOX Options Exchange LLC
9. Miami International Securities Exchange LLC
10. Financial Industry Regulatory Authority, Inc.

    Conflicts of Interest Definition: The Participants arrived at
the definition of Conflicts of Interest set forth in Article I of
the CAT NMS Plan based on a review of existing rules and standards
of securities exchanges, other plans, including the Selection Plan
as to qualifications of a Voting Senior Officer of a Bidding
Participant, and general corporate and governance principles.
    Transparency in the Bidding and Selection Process: DAG members
requested input into the bidding and selection process for the Plan
Processor, citing the extensive impact of CAT requirements on the
industry as well as proposed cost for compliance. Specifically,
Industry Members requested that non-proprietary aspects of the
responses to the RFP should be available to the public to inform the
discussion regarding the costs and benefits of various CAT features
and the technological feasibility of different solutions.
Participants, working with counsel, determined that such information
could be appropriately shared with DAG members pursuant to the
provisions of a non-disclosure agreement (``NDA'') that was
consistent with the terms of the NDA executed between the
Participants and the Bidders. After extensive discussion, DAG
members declined to sign such an NDA. The Participants continued to
share non-bid specific information and to solicit the views and
perspective of DAG members as it developed a Plan approach and
related solutions.
    Time Stamp Granularity and Clock Synchronization Requirement:
Industry Members recommended a millisecond time stamp for electronic
order and execution events and a time stamp in seconds for manual
order handling. Industry Members suggested a grace period of two
years after the CAT requirements are finalized to allow broker-
dealers sufficient time to meet the millisecond time stamp
granularity. In addition, Industry Members recommended maintaining
the current OATS rule of a one second clock drift tolerance for
electronic order and execution events, citing a significant burden
to Industry Members to comply with a change to the current one-
second clock drift.\3927\ Participants

conducted active discussions with Industry Members on this topic,
and included in the Exemptive Request Letter a request for exemptive
relief related to time stamp granularity for Manual Order Events.
---------------------------------------------------------------------------

    \3927\ See FIF Clock Offset Survey Preliminary Report.
---------------------------------------------------------------------------

    Equitable Cost and Funding: Industry Members expressed the view
that any funding mechanism developed by the Participants should
provide for equitable funding among all market participants,
including the Participants. The Participants recognized the
importance of this viewpoint and have incorporated it within the
guiding principles that were discussed with the Industry.
    Order ID/Linkages: The DAG formed an order scenarios working
group to discuss approaches to satisfy the order linkage
requirements of SEC Rule 613. On the topic of allocations, Industry
Members provided feedback that the order and execution processes are
handled via front office systems, while allocation processes are
conducted in the back office. Industry Members expressed the view
that creating linkages between these systems, which currently
operate independently, would require extensive reengineering of
middle and back office processes not just within a broker-dealer but
across broker-dealers, imposing significant additional costs on the
industry as a whole. Given the widespread use of average price
processing accounts, clearing firms, prime brokers and self-clearing
firm cannot always determine which specific order results in a given
allocation or allocations. Industry Members worked closely with
Participants on a proposed alternative approach which the
Participants submitted to the Commission in the Exemptive Request
Letters.
    Elimination of Systems and Rules: The elimination of duplicative
and redundant systems and rules is a critical aspect of the CAT
development process. Industry DAG members including SIFMA and FIF
provided broad based and comprehensive insight on the list of
existing regulatory systems and Participant rules that they deem to
be duplicative, including, among others, OATS, the EBS reporting
system, and Large Trader reporting. In addition, FIF provided a gap
analysis of CAT requirements against Large Trader transactional
reporting obligations.
    The Participants discussed feedback from the industry in a
variety of forums: (i) during DAG meetings; (ii) in relevant
Subcommittee meetings, depending on the topic; and (iii) at two
multi-day offsite meetings where Representatives of each Participant
gathered in a series of in-person workshops to discuss the
requirements of the Plan Processor, both technical and operational.
This was in addition to numerous video-conference meetings when
Participants discussed and developed the RFP document incorporating,
where appropriate, feedback from the industry.

Discuss Reasonable Alternative Approaches that the Participants
Considered to Create, Implement, and Maintain the CAT (SEC Rule
613(a)(1)(xii))

    The Participants, working as a consortium, selected the approach
reflected in the Plan through a detailed analysis of alternatives,
relying on both internal and external knowledge and expertise to
collect and evaluate information related to the CAT. For some of the
requirements of SEC Rule 613, the Participants' analysis indicated
that the required approach would be unduly burdensome or complex. In
these cases, the Participants have requested exemption from these
requirements in the Exemptive Request Letter, which details the
analysis performed and alternatives considered for these specific
requirements.
    The Participants leveraged their own extensive experience with
regulatory, technical and securities issues in formulating, drafting
and filing the CAT NMS Plan. Specifically, the nineteen Participants
formed various Subcommittees to focus on specific critical issues
during the development of the CAT NMS Plan. The Subcommittees
included:

a Governance Committee, which developed recommendations for
decision-making protocols and voting criteria critical to the
development of the CAT NMS Plan, in addition to developing formal
governance and operating structures for the CAT NMS Plan;
a Technical Committee, which developed the technical scope
requirements of the CAT, the CAT RFP documents, and the PPR;
an Industry Outreach Committee, which provided recommendations on
effective methods for soliciting industry input, in addition to
facilitating industry involvement in CAT-related public events
\3928\ and development of the CAT NMS Plan and the Exemptive Request
Letters;
---------------------------------------------------------------------------

    \3928\ A summary of industry outreach events is included in
Appendix C, General Industry Solicitation.
---------------------------------------------------------------------------

a Press Committee as a Subcommittee of the Industry Outreach
Committee, which coordinated interactions with the press;
a Cost and Funding Committee, which drafted a framework for
determining the costs of the CAT, and provided recommendations on
revenue/funding of the CAT for both initial development costs and
ongoing costs; and
an Other Products Committee, which is designed to assist the SEC, as
necessary, when the SEC is determining whether and how other
products should be added to the CAT.\3929\
---------------------------------------------------------------------------

    \3929\ When adopting the CAT, the Commission directed the
Commission staff ``to work with the SROs, the CFTC staff, and other
regulators and market participants to determine how other asset
classes, such as futures, might be added to the consolidated audit
trail.'' Adopting Release at 45744-5 n.241.

    Representatives from all Subcommittees met to discuss the
overall progress of the CAT initiative in the Operating Committee.
    To support the Participants' internal expertise, the
Participants also engaged outside experts to assist in formulating
the CAT NMS Plan. Specifically, the Participants engaged the
consulting firm Deloitte & Touche LLP as a project manager, and
engaged the law firm Wilmer Cutler Pickering Hale and Dorr LLP to
serve as legal counsel in drafting the CAT NMS Plan, both of which
have extensive experience with issues raised by the CAT.
Additionally, the Participants engaged the services of the public
relations firm Peppercomm to assist with public relations and press
engagement in formulating the CAT NMS Plan.
    Furthermore, as discussed in more detail above in Appendix C,
Process by Which Participants Solicited Views of Members and Other
Appropriate Parties Regarding Creation, Implementation, and
Maintenance of CAT; Summary of Views; and How Sponsors Took Views
Into Account in Preparing NMS Plan, the Participants engaged in
meaningful dialogue with Industry Members with respect to the
development of the CAT through the DAG and other industry outreach
events.
    Using this internal and external expertise, the Participants
developed a process to identify, evaluate and resolve issues so as
to finalize the CAT NMS Plan. As discussed above in Appendix C, the
Participants have, among other things, developed the Selection Plan
to describe the process for selecting the Plan Processor, created
and published an RFP, evaluated Bids, and chosen a shortlist of
Bids. Contemporaneously, the Participants have drafted the Plan set
forth herein to reflect the recommendations that have resulted from
the approach and analysis described above.
    For certain technical considerations for the development and
maintenance of the CAT that do not materially impact cost, required
functionality or data security, the Participants did not mandate
specific approaches, but rather chose to consider solutions proposed
by the Bidders.

[ssquf] Request for Proposal

    The Participants considered multiple alternatives for the best
approach to gathering the information necessary to determine how to
create, implement and maintain the CAT, including issuance of a
Request for Information (``RFI'') and Request for Proposal
(``RFP''). After due consideration, with a view to meeting the
demanding deadline set forth in SEC Rule 613, the Participants
decided to use their expertise to craft an RFP seeking proposals to
implement the main requirements to successfully build and operate
the CAT. This approach was designed to solicit imaginative and
competitive proposals from the private sector as well as to provide
an adequate amount of insight into the costs associated with
creating, implementing, and maintaining the CAT.
    To design the RFP process, the Participants consulted with their
technology subject matter resources to determine technical
implications and requirements of the CAT and to develop the RFP.
Based on these requirements, the Participants developed the Proposed
RFP Concepts Document,\3930\ which identified the high level
requirements for which potential Bidders would be expected to design
a solution, ahead of publishing the full RFP on February 26, 2013.
The Participants received 31 intents to bid, and then hosted a
Bidder conference on March 8, 2013 to discuss the requirements

and provide additional context to the industry and potential
Bidders. Two additional conference calls to discuss additional
questions on the RFP were held on April 25, 2013 and May 2, 2013.
The Participants also established an e-mail box through which
questions on the RFP were received.
---------------------------------------------------------------------------

    \3930\ See supra note 3692.
---------------------------------------------------------------------------

    Ten competitive proposals were submitted on March 21, 2014. Each
of the ten proposals was carefully reviewed by the Participants,
including in-person meetings with each of the ten Bidders. Following
this review, the Bids were reduced to six proposals in accordance
with the Selection Plan approved by the Commission in February 2014.
In accordance with the Selection Plan Amendment approved by the
Commission on June 23, 2015, the Participants asked the Bidders on
July 14, 2015 to revise their bids to account for the updated
requirements included in the CAT NMS Plan as filed on February 27,
2015, as well as to address specific additional questions and
considerations. As described more fully throughout this Appendix C,
the proposals offer a variety of solutions for creating,
implementing and maintaining the CAT.
    As stated above, the Participants received proposals from ten
Bidders that were deemed qualified, including many from large and
well-respected information technology firms. The open ended nature
of the questions contained in the RFP allowed Bidders to provide
thoughtful and creative responses with regards to all aspects of the
implementation and the operation of the CAT. The RFP process also
resulted in the submission of multiple competitively-priced Bids.
The six Shortlisted Bids remaining under consideration by the
Participants, inclusive of the initial system build and the first
five years of maintenance costs, have ranges between $165 million
and $556 million, and encompass a number of innovative approaches to
meeting the requirements of SEC Rule 613, such as use of non-
traditional database architectures and cloud-based infrastructure
solutions.
    The Participants conducted the RFP process and the review of
Bids pursuant to the Selection Plan approved by the Commission,
which was designed to mitigate the conflicts of interest associated
with Participants that are participating in developing the CAT while
also seeking to become the Plan Processor and to ensure a level
playing field for all potential Bidders to be considered on a fair
and equal basis.

[ssquf] Organizational Structure

    The Participants considered various organizational structures of
the Bidders to assess whether a particular structure would be a
material factor in the ability of a Bidder to effectively operate as
the Plan Processor. Of the Bids submitted, three general
organizational structures for the Plan Processor emerged: (1)
consortiums or partnerships (i.e., the Plan Processor would consist
of more than one unaffiliated entity that would operate the CAT);
(2) single firms (i.e., one entity would be the Plan Processor and
that entity would operate the CAT as part of its other ongoing
business operations); and (3) dedicated legal entities (i.e., CAT
operations would be conducted in a separate legal entity that would
perform no other business activities). Each type of organizational
structure has strengths and limitations, but the Participants did
not find that a particular organizational structure should be a
material factor in selecting a Bidder. Accordingly the Participants
have not mandated a specific organizational structure for the Plan
Processor.

[ssquf] Primary Storage

    The Bidders proposed two methods of primary data storage:
traditionally-hosted storage architecture, and infrastructure-as-a-
service. Traditionally-hosted storage architecture is a model in
which an organization would purchase and maintain proprietary
servers and other hardware to store CAT Data. Infrastructure-as-a-
service is a provisioning model in which an organization outsources
the equipment used to support operations, including storage,
hardware, servers and networking components to a third party who
charges for the service on a usage basis.
    Each data storage method has a number of considerations that the
Participants will take into account when evaluating each Bidder's
proposed solution. Such considerations include the maturity, cost,
complexity, and reliability of the data storage method as used in
each Bidder's proposal. The Participants are not mandating a
specific method for primary data storage provided that the data
storage solution can meet the security, reliability, and
accessibility requirements for the CAT, including storage of PII
data, separately.

[ssquf] Customer and Account Data

    All Bidders proposed solutions consistent with the Customer
Information Approach in which broker-dealers would report a unique
Firm Designated ID for each Customer to the Plan Processor and the
Plan Processor would create and store the CAT Customer-ID without
passing this information back to the broker-dealer. The use of
existing unique identifiers (such as internal firm customer
identifiers) could minimize potentially large overhead in the CAT
System that otherwise would be required to create and transmit back
to CAT Reporters a CAT System-generated unique identifiers. Allowing
multiple identifiers also will be more beneficial to CAT Reporters.
This approach would still require mapping of identifiers to connect
all trading associated with a single Customer across multiple
accounts, but it would also ease the burden on CAT Reporters because
each CAT Reporter would report information using existing
identifiers it currently uses in its internal systems. Moreover,
because the CAT System would not be sending a CAT System-generated
Customer-ID back to the CAT Reporters, CAT Reporters would not need
to process CAT Customer-IDs assigned by the Plan Processor. This
approach would reduce the burden on the CAT Reporters because they
would not need to build an additional process to receive a Customer-
ID and append that identifier to each order origination, receipt or
cancellation. This approach may also help alleviate storage and
processing costs and potentially reduce the security risk of
transmission of the Customer-ID to the CAT Reporter.
    The Participants support the use of the Customer Information
Approach and included the approach in the Exemptive Request Letter
so that the Central Repository could utilize this approach to link
Customer and Customer Account Information. The Participants believe
this approach would be the most efficient approach for both the Plan
Processor and CAT Reporters.

[ssquf] Personally Identifying Information (PII)

    All Bidders proposed encrypting all PII, both at rest and in
motion. This approach allows for secure storage of PII, even if
servers should be compromised or data should be leaked. However,
encryption can be highly complex to implement effectively (e.g., the
poor choice of password salting or an insecure storage of private
keys can compromise security, even without knowledge of the system
administrator).
    All Bidders also proposed imposing a Role Based Access Control
\3931\ to PII. These controls would allow for varying levels of
access depending on user needs, and would allow compartmentalizing
access based on ``need to know.'' However, multiple layers of access
can add further complexity to the implementation and use of a
system.
---------------------------------------------------------------------------

    \3931\ Role Based Access Control (RBAC) is a mechanism for
authentication in which users are assigned to one or many roles, and
each role is assigned a defined set of permissions. Additional
details are provided in Appendix D, Data Security.
---------------------------------------------------------------------------

    Some Bidders also proposed implementing multi-factor
authentication.\3932\ This greatly enhances security and can prevent
a leak of passwords or keys from completely compromising security.
However, it increases system overhead, and increases the difficulty
of accessing data.
---------------------------------------------------------------------------

    \3932\ Multifactor authentication is a mechanism that requires
the user to provide more than one factor (e.g., biometrics/personal
information in addition to a password) in order to be validated by
the system.
---------------------------------------------------------------------------

    The Participants are requiring multi-factor authentication and
Role Based Access Control for access to PII, separation of PII from
other CAT Data, restricted access to PII (only those with a ``need
to know'' will have access), and an auditable record of all access
to PII data contained in the Central Repository. The Participants
believe potential increased costs to the Plan Processor and delays
that this could cause to accessing PII are balanced by the need to
protect PII.

[ssquf] Data Ingestion Format

    Bidders proposed several approaches for the ingestion format for
CAT Data: uniform defined format, use of existing messaging
protocols or a hybrid approach whereby data can be submitted in a
uniform defined format or using existing message protocols. There
are benefits to the industry under any of the three formats. A large
portion of the industry currently reports to OATS in a uniform
defined format. These firms have invested time and resources to
develop a process for reporting to OATS. The uniform formats
recommended by the Bidders would leverage the OATS format and
enhance it to meet the

requirements of SEC Rule 613. This uniform format, therefore, may
reduce the burden on certain CAT Reporters and simplify the process
for those CAT Reporters to implement the CAT. However, some firms
use message protocols, like FIX, as a standard point of reference
with Industry Members that is typically used across the order
lifecycle and within a firm's order management processes. Leveraging
existing messaging protocols could result in quicker implementation
times and simplify data aggregation for Participants, CAT Reporters,
and the Plan Processor, though it is worth noting that message
formats may need to be updated to support CAT Data requirements.
    The Participants are not mandating the data ingestion format for
the CAT. The Participants believe that the nature of the data
ingestion is key to the architecture of the CAT. A cost study of
members of the Participants did not reveal a strong cost preference
for using an existing file format for reporting vs. creating a new
format.\3933\ However, FIF did indicate there was an industry
preference among its members for using the FIX protocol.\3934\
---------------------------------------------------------------------------

    \3933\ See Appendix C, Analysis of the CAT NMS Plan, for
additional details on cost studies.
    \3934\ See FIF Response.
---------------------------------------------------------------------------

[ssquf] Process to Develop the CAT

    Bidders proposed several processes for development of the CAT:
the agile or iterative development model, the waterfall model, and
hybrid models that incorporate aspects of both the waterfall and
agile methodologies. An agile methodology is an iterative model in
which development is staggered and provides for continuous evolution
of requirements and solutions. A waterfall model is a sequential
process of software development with dedicated phases for
Conception, Initiation, Analysis, Design, Construction, Testing,
Production/Implementation and Maintenance. The agile or iterative
model is flexible to changes and facilitates early delivery of
usable software that can be used for testing and feedback, helping
to facilitate software that meets users' needs. However, at the
beginning of an agile or iterative development process, it can be
difficult to accurately estimate the effort and time required for
completion. The waterfall model would provide an up-front estimate
of time and effort and would facilitate longer-term planning and
coordination among multiple vendors or project streams. However, the
waterfall model could be less flexible to changes, particularly
changes that occur between design and delivery (and thereby
potentially producing software that meets specifications but not
user needs).
    The Participants are not mandating a development process. The
Participants believe that either agile or iterative development or
waterfall method or even a combination of both methods could be
utilized to manage the development of CAT.

[ssquf] Industry Testing

    Bidders also proposed a range of approaches to industry testing,
including dedicated environments, re-use of existing environments,
scheduled testing events, and ongoing testing.
    Dedicated industry test environments could provide the
possibility of continuous testing by participants, rather than allow
for testing only on scheduled dates. Use of dedicated industry test
environments also would not impact other ongoing operations (such as
disaster recovery sites). However, developing and maintaining
dedicated test environments would entail additional complexity and
expense. Such expenses may be highest in hosted architecture systems
where dedicated hardware would be needed, but potentially rarely
used.
    The re-use of existing environments, such as disaster recovery
environment, would provide simplicity and lower administrative
costs. However, it could impact other ongoing operations, such as
disaster recovery.
    Scheduled testing events (which might be held, for example, on
weekends only, or on specific dates throughout the year) could
provide for more realistic testing by involving multiple market
participants. This approach also would not require the test
environment to be available at all times. However, scheduled events
would not allow users to test on the CAT System until a dedicated
time window is open.
    Ongoing testing would allow users to test the CAT System as
often as needed. However, this approach would require the test
environment to be available at all times. It also may lead to lower
levels of test participation at any given time, which may lead to
less realistic testing.
    The Participants are requiring that the CAT provide a dedicated
test environment that is functionally equivalent to the production
environment and available on a 24x6 basis. The Participants believe
that an ongoing testing model will be more helpful to the industry
because it will provide an environment in which to test any internal
system changes or updates that may occur in the course of their
business that may affect reporting to the CAT. Additionally, this
environment will provide a resource through which the CAT Reporters
can continually test any CAT System mandated or rule associated
changes to identify and reduce data errors prior to the changes
being implemented in the production environment.

[ssquf] Quality Assurance (QA)

    The Participants considered a number of QA approaches and
methodologies, informed by the Bidder's proposals as well as
discussions with the Participants' own subject matter resources.
Some of the approaches considered included ``continuous
integration,'' where developer working copies are merged into the
master and tested several times a day, test automation, and various
industry standards such as ISO 20000/ITIL. The Participants are not
mandating a single approach to QA beyond the requirements detailed
in the RFP, for which each Bidder provided a detailed approach.
    One key component of the QA approaches proposed by the Bidders
was the staffing levels associated with QA. Initial QA proposals
from Bidders included staffing ranges from between 2 and 90 FTEs,
although some Bidders indicated that their QA function was directly
incorporated into their development function. Some Bidders proposed
allocating QA resources after the third month. A larger number of QA
resources may facilitate structured, in-depth testing and validation
of the CAT System. However, a larger set of QA resources could lead
to higher fixed costs and administrative overhead.
    The Participants are not mandating the size for QA staffing;
however, the Participants will consider each Bidder's QA staffing
proposals in the context of the overall Bid, and the selected Bidder
must ensure that its QA staffing is sufficient to perform the
activities required by the CAT NMS Plan. The Participants believe
the QA staffing numbers varied in the Bids because they are largely
dependent on both the staffing philosophy of the Bidder as well as
the organizational structure for the proposed Central Repository.

[ssquf] User Support and Help Desk

    The RFP required that the CAT Help Desk be available on a 24x7
basis, and that it be able to manage 2,500 calls per month. To
comply with these requirements, Bidders proposed user support
staffing ranges from five to 36 FTEs. They also proposed dedicated
support teams and support teams shared with other groups.
    A larger number of FTE user support staff could provide a higher
level and quality of support. However, a higher number of staff
would impose additional overhead and administrative costs.
Additionally, as the support organization grows, it may become less
closely integrated with the development team, which could decrease
support effectiveness.
    A dedicated CAT support team would facilitate deep knowledge of
the CAT System and industry practices. However, it would create
additional overhead and costs. Additionally, management of support
teams may not be the managing firm's primary business, which could
lead to inefficiencies. A support staff shared with non-CAT teams
could provide for increased efficiency, if the team has greater
experience in support more broadly. However, support resources may
not have the depth of knowledge that dedicated support teams could
be expected to develop.
    The Participants are not requiring specific FTEs for user
support staffing; however, the Participants will consider each
Bidder's user support staffing proposals in the context of the
overall Bid, and the selected Bidder must ensure that its staffing
is sufficient to perform the activities required by the CAT NMS
Plan. The Participants believe that the number of FTEs varied in the
Bids because they are largely dependent on both the staffing
philosophy of the Bidder as well as the organizational structure for
the proposed Central Repository.
    Some Bidders proposed a US-based help desk, while others
proposed basing it offshore. A U.S.-based help desk could facilitate
a higher level of service, and could provide a greater level of
security (given the sensitive nature of the CAT). However, a U.S.-
based help desk may have greater labor

costs. An offshore help desk would potentially have lower labor
costs, but could provide (actual or perceived) lower level of
service, and could raise security concerns (particularly where the
help desk resources are employed by a third-party).
    The Participants are not requiring a specific location for the
help desk. The Participants believe that as long as the Bidder's
solution meets the service and security requirements of the CAT, it
is not necessary to prescribe the location.

[ssquf] CAT User Management

    Bidders proposed several approaches to user management \3935\:
help desk creation of user accounts, user (e.g., broker-dealer)
creation of accounts, and multi-role. Help desk creation of accounts
would allow for greater oversight and validation of user creation.
However, it would increase administrative costs, particularly in the
early stages of the CAT (as an FTE must setup each user). User
creation of accounts would require lower staffing levels but would
provide less oversight and validation of user creation.
---------------------------------------------------------------------------

    \3935\ User management is a business function that grants,
controls, and maintains user access to a system.
---------------------------------------------------------------------------

    A multi-role approach would allow for a blended approach in
which the Plan Processor could, for example, set up an administrator
at each broker-dealer, and then allow the broker-dealer to set up
additional accounts as needed. This approach could allow users with
different levels of access to be provisioned differently, with those
requiring greater oversight being provisioned manually. However, it
would add complexity to the user creation system, and would provide
less oversight and validation than would a fully manual system.
    For CAT Reporters entering information into the CAT, the
Participants are requiring that each user be validated by the Plan
Processor to set-up access to the system. However, for staff at
regulators that will be accessing the information for regulatory
purposes only, the Plan Processor can establish a set-up
administrator who has the ability to provide access to other users
within its organization. However, such administrators cannot set up
access for PII information. Staff at regulators who need access to
PII information must go through an authentication process directly
with the Plan Processor. The Participants believe that this approach
balances the demand on the staff at the Plan Processor with the need
to ensure proper oversight and validation for users of the CAT.

[ssquf] Required Reportable Order Events

    The Participants considered multiple order event types for
inclusion in the Plan. Of the order event types considered, the
results order event type and the CAT feedback order event were not
required. The Participants determined that a results order event
type would not provide additional value over a ``daisy chain''
linkage method. A CAT feedback order event can be generated by the
Plan Processor, thereby removing the reporting burden from reporting
firms. Therefore the Participants are not requiring CAT Reporters to
provide data for these two event types to the CAT. The required
reportable order events are listed in Section 6.3(d).

[ssquf] Data Retention Requirements

    SEC Rule 613(e)(8) requires data to be available and searchable
for a period of not less than five years. Broker-dealers are
currently required to retain data for six years under the Exchange
Act Rule 17a-4(a).
    The Participants support the use of a six year retention
timeframe as it complies with Exchange Act Rule 17a-4(a). The
Participants are requiring data for six years to be kept online in
an easily accessible format to enable regulators to have access to
six years of audit trail materials for purposes of its regulation.
    The Participants understand that requiring this sixth year of
data storage may increase the cost to run the CAT; however, they
believe the incremental cost would be outweighed by the needs of
regulators to have access to the information. An analysis of the six
Shortlisted Bidder proposals indicated that the average expected
year-on-year annual cost increase during years four and five (i.e.,
once all reporters were reporting to the Central Repository) was
approximately 4%. Extending this increase to another year would
result in incremental annual costs to the Plan Processor ranging
from approximately $1.15 million to $4.44 million depending upon the
Bidder. Based on the assumption that the cumulative annual cost
increase from year five to year six will also be 4% (including all
the components provided by the Bidders in their respective cost
schedules \3936\), the maximum cost increase for data retention for
an additional year would be 4%.
---------------------------------------------------------------------------

    \3936\ RFP at 57.
---------------------------------------------------------------------------

[ssquf] Data Feed Connectivity

    Bidders proposed either real-time SIP connectivity or end-of-day
batch SIP connectivity. Real-time SIP connectivity would provide for
more rapid access to SIP Data, but may require additional processing
support to deal with out-of-sequence or missing records. End-of-day
batch SIP connectivity provides the possibility of simpler
implementation, but data from SIPs would not be available in the CAT
until after overnight processing. Because CAT Reporters are only
required to report order information on a next-day basis, the
Participants are not requiring that the Plan Processor have real-
time SIP connectivity.

[ssquf] Disaster Recovery

    Participants discussed two commonly accepted structures for
disaster recovery: hot-hot \3937\ and hot-warm.\3938\ While hot-hot
allows for immediate cutover, the Participants agreed that real-time
synchronization was not required, but rather that data must be kept
synchronized to satisfy disaster recovery timing requirements (e.g.,
48 hour cutover). A hot-warm structure meets the requirements of SEC
Rule 613, and costs for hot-hot were considered to be higher than
hot-warm. Therefore, the Participants are requiring a hot-warm
disaster recovery structure, provided it meets the requirements set
forth in Appendix D, BCP/DR Process.
---------------------------------------------------------------------------

    \3937\ In a hot-hot disaster recovery design, both the
production site as well as the backup site are live, and the backup
can be brought online immediately.
    \3938\ In a hot-warm disaster recovery design, the backup site
is fully equipped with the necessary hardware. In the event of a
disaster, the software and data would need to be loaded into the
backup site for it to become operational.
---------------------------------------------------------------------------

[ssquf] Synchronization of Business Clocks

    The Participants considered multiple levels of precision for the
clock synchronization standard set forth in the plan, ranging from 1
second (s) to 100 microseconds ([mu]s). The Participants determined
based on their expertise and feedback from industry that an initial
clock synchronization of 50 milliseconds (ms) would be the most
practical and effective choice and represents the current industry
standard. Pursuant to SEC Rule 613(d), the initial standard of 50ms
will be subject to annual analysis as to whether or not a more
stringent clock synchronization tolerance could be implemented
consistent with changes in industry standards.
    In order to identify the industry standard the Participants and
Industry Members reviewed their own internal technology around
Network Time Protocol (``NTP'') and Precision Time Protocol
(``PTP''),\3939\ potentially used in conjunction with Global
Positioning System (``GPS'').\3940\ In reviewing internal
infrastructure, the Participants and Industry Members noted that the
majority of firms had indicated that they leveraged at least NTP
clock synchronization technology. In addition, the FIF conducted a
clock synchronization survey \3941\ (``FIF Clock Offset Survey'') of
28 firms to identify costs and challenges associated with clock
synchronization tolerances of 50ms, 5ms, 1ms, and 100[mu]s. The FIF
Clock Offset Survey indicated that 93% of responding firms leverage
NTP technology, while fewer than half of responding firms use SNTP,
PTP, or GPS. In reviewing the standards for NTP technology, the
Participants determined that this technology can accommodate a 50ms
tolerance. In addition, the FIF Clock Offset Survey demonstrated
that 60% of responding firms currently synchronize their clocks with
an offset of 50ms or greater, with approximately 20% of responding
firms currently using an offset of 50ms. Only 18% of responding
firms used a clock offset of 30ms or less. In light of these reviews
and the survey data, the Participants concluded that a clock offset
of 50ms represents an aggressive, but achievable, industry standard.
---------------------------------------------------------------------------

    \3939\ NTP and PTP are protocols used to synchronize clocks
across a computer network.
    \3940\ GPS is a radio navigation system that can be used to
capture a precise determination of time.
    \3941\ FIF Clock Offset Survey Preliminary Report.
---------------------------------------------------------------------------

    In addition to determining current industry clock offset
standards used in the industry, the FIF Clock Offset Survey
indicated that the costs to survey respondents were as follows:
\3942\
---------------------------------------------------------------------------

    \3942\ The Participants consider the estimates provided to be
conservative as a majority of the study respondents fell into the
category of large broker-dealers.

----------------------------------------------------------------------------------------------------------------
                                                                                Estimated annual
                 Proposed clock offset                   Estimated implementation cost (per    maintenance cost
                                                                        firm)                     (per firm)
----------------------------------------------------------------------------------------------------------------
50ms...................................................                           $554,348             $313,043
5ms....................................................                           $887,500             $482,609
1ms....................................................                         $1,141,667             $534,783
100[mu]s...............................................                         $1,550,000             $783,333
----------------------------------------------------------------------------------------------------------------

    As indicated in the above table, annual maintenance costs of
survey respondents for a 50ms standard would be on average 31%
higher than current costs, and would escalate to 102%, 123%, and
242% increases over current maintenance costs as clock
synchronization standards move to 5ms, 1ms, and 100[mu]s
respectively, indicating that maintenance costs rapidly escalate as
clock synchronization standards increase beyond 50ms. Survey
respondents also indicated that increasing clock synchronization
requirements would require escalating technology changes, including
significant hardware changes (such as installation of dedicated GPS
or other hardware clocks and network architecture redesign),
migration to new time synchronization standards, and widespread
upgrades of operating systems and databases currently in use. For
example, to achieve a 5ms clock offset would require firms to
install GPS clocks in all locations and migrate from NTP to PTP. The
Participants believe, based on the FIF Clock Offset Survey, that
fewer than half of firms currently leverage GPS technology or PTP
for clock synchronization.
    As noted in Article VI, Section 6.8, the Participants, working
with the Processor's Chief Compliance Officer, shall annually
evaluate and make recommendations as to whether industry standards
have evolved such that changes to the clock synchronization
standards should be changed. It is the belief of the Participants
that, while setting an initial clock synchronization of 5ms lower
than 50ms may be achievable, it does not represent current industry
standard and there may be challenges with small broker-dealers'
potentially substantial costs. However, once both large and small
broker-dealers begin reporting data to the Central Repository, and
as increased time synchronization standards become more mature, the
Participants will assess the ability to tighten the clock
synchronization standards to reflect changes in industry standards
in accordance with SEC Rule 613.

[ssquf] Reportable Securities

    SEC Rule 613(c)(6) requires NMS Securities to be reported the
Central Repository and SEC Rule 613(i) requires the Participants to
detail a plan outlining how non-NMS Securities, debt securities, and
Primary Market Transactions in equity securities that are not NMS
Securities can be reported to the Central Repository in the future.
The Participants considered whether to require including OTC Equity
Securities, non NMS Securities, in a future phase of the CAT NMS
Plan, as contemplated by the Commission in SEC Rule 613, or
accelerating their inclusion into the first phase of the Plan. As
part of this consideration, Participants weighed heavily the
feedback from the DAG and other market participants of the
considerations associated with the two alternatives, and made the
determination to include OTC Equities in the requirements under the
CAT NMS Plan.

APPENDIX D

CAT NMS Plan Processor Requirements

    Appendix D, CAT NMS Plan Processor Requirements, outlines
minimum functional and technical requirements established by the
Participants of the CAT NMS Plan for the Plan Processor. Given the
technical nature of many of these requirements, it is anticipated,
as technology evolves, that some may change over time. The
Participants recognize that effective oversight of, and a
collaborative working relationship with, the Plan Processor will be
critical to ensure the CAT achieves its intended purpose, namely
enhanced investor protection, in an efficient and cost-effective
manner. The Participants also recognize that maintaining the
efficiency and cost-effectiveness of the CAT requires flexibility to
respond to technological innovations and market changes. For
example, these minimum functional and technical requirements allow
the Plan Processor flexibility to make certain changes to the
Technical Specifications, while limiting others to the Operating
Committee, and anticipate agreement between the Operating Committee
and the Plan Processor on SLAs relating to, among other things,
development, change management, and implementation processes and
timelines. Maintaining such flexibility to adapt in these and other
areas relating to the development and operation of the CAT is a
foundational principle of this Appendix D.

Central Repository Requirements

Technical Architecture Requirements

    The Central Repository must be designed and sized to ingest,
process, and store large volumes of data. The technical
infrastructure needs to be scalable, adaptable to new requirements
and operable within a rigorous processing and control environment.
As a result, the technical infrastructure will require an
environment with significant throughput capabilities, advanced data
management services and robust processing architecture.
    The technical architecture must be scalable and able to readily
expand its capacity to process significant increases in data volumes
beyond the baseline capacity. The baseline capacity requirements are
defined in this document. Once the CAT NMS Plan is approved, the
Operating Committee will define the baseline metrics on an ongoing
basis. CAT capacity planning must include SIP, OPRA and exchange
capacity and growth forecasts. The initial baseline capacity
requirements will be based on twice (2X) the historical peaks for
the most recent six years, and the Plan Processor must be prepared
to handle peaks in volume that could exceed this baseline for short
periods. The SLA(s) will outline details of the technical
performance and scalability requirements, and will be specifically
targeted to the selected Bidder's solution.
    The Central Repository must have the capacity and capability to:

Ingest and process throughput to meet baseline capacity requirements
as well as scalability to meet peak capacity requirements, including
staging, loading, speed of processing, and linking of data;
Accommodate data storage and query compute, such as:

    [cir] Scalable for growth data storage and expansion capability,
including but not limited to, resizing of database(s), data
redistribution across nodes, and resizing of network bandwidth;
    [cir] Robust processes to seamlessly add capacity without
affecting the online operation and performance of the CAT System;
and
    [cir] Quantitative methods for measuring, monitoring, and
reporting of excess capacity of the solution;
Satisfy minimum processing standards as described in the CAT RFP and
that will be further defined in the SLA(s);
Adapt to support future technology developments and new requirements
(including considerations for anticipated/potential changes to
applicable rules and market behavior);
Handle an extensible architecture that is capable of supporting
asset classes beyond the initial scope of NMS Securities and OTC
Equity Securities;
Comply with the clock synchronization standards as set forth in
Article VI, Section 6.8; and
Handle an extensible data model and messaging protocols that are
able to support future requirements such as, but not limited to:
    [cir] Expansion of trading hours, including capability and
support for 24-hour markets;
    [cir] Sessions for securities; \3943\ and
---------------------------------------------------------------------------

    \3943\ Equity markets currently have morning, primary, and
evening sessions. It is possible that over time sessions may cross
into the next calendar day.
---------------------------------------------------------------------------

    [cir] New asset classes, such as debt securities or derivative
instruments.

Technical Environments

    The architecture must include environments for production,
development, quality assurance testing, disaster recovery,

industry-wide coordinated testing, and individual on-going CAT
Reporter testing. The building and introduction of environments
available to CAT Reporters may be phased in to align with the
following agreed upon implementation milestones:

Development environment--the development environment must be created
to build, develop, and maintain enhancements and new requirements.
This environment must be separate from those listed below.
Quality assurance environment--a quality assurance (QA) environment
must be created to allow simulation and testing of all applications,
interfaces, and data integration points contained in the CAT System.
    [cir] The QA environment shall be able to simulate end-to-end
production functionality and perform with the same operational
characteristics, including processing speed, as the production
environment.
    [cir] The QA environment shall support varied types of changes,
such as, but not limited to, the following:
    Application patches;
    Bug fixes;
    Operating system upgrades;
    Introduction of new hardware or software components;
    New functionality;
    Network changes;
    Regression testing of existing functionality;
    Stress or load testing (simulation of production-level usage);
and
    Recovery and failover.
    [cir] A comprehensive test plan for each build and subsequent
releases must be documented.
Production environment--fully operational environment that supports
receipt, ingestion, processing and storage of CAT Data. Backup/
disaster recovery components must be included as part of the
production environment.
Industry test environment--
    [cir] The Plan Processor must provide an environment supporting
industry testing (test environment) that is functionally equivalent
to the production environment, including:
    End-to-end functionality (e.g., data validation, processing,
linkage, error identification, correction and reporting mechanism)
from ingestion to output, sized to meet the standards of the
production SLA;
    Performance metrics that mirror the production environment; and
    Management with the same information security policies
applicable to the production environment.
    [cir] The industry test environment must also contain
functionality to support industry testing, including:
    Minimum availability of 24x6;
    Replica of production data when needed for testing;
    Data storage sized to meet varying needs, dependent upon scope
and test scenarios; and
    Support of two versions of code (current and pending).
    [cir] The industry test environment must support the following
types of industry testing:
    Technical upgrades made by the Plan Processor;
    CAT code releases that impact CAT Reporters;
    Changes to industry data feeds (e.g., SIP, OPRA, etc.);
    Industry-wide disaster recovery testing;
    Individual CAT Reporter and Data Submitter testing of their
upgrades against CAT interfaces and functionality; and
    Multiple, simultaneous CAT Reporter testing.
    [cir] The industry test environment must be a discrete
environment separate from the production environment.
    [cir] The Plan Processor must provide the linkage processing of
data submitted during coordinated, scheduled, industry-wide testing.
Results of the linkage processes must be communicated back to
Participants as well as to the Operating Committee.
    [cir] Data from industry testing must be saved for three months.
Operational metrics associated with industry testing (including but
not limited to testing results, firms who participated, and amount
of data reported and linked) must be stored for the same duration as
the CAT production data.
    [cir] The Plan Processor must provide support for industry
testing, including testing procedures, coordination of industry
testing, publish notifications, and provide help desk support during
industry testing.
    [cir] The Participants and the SEC must have access to industry
test data.

Capacity Requirements

    System capacity must have the following characteristics.\3944\
---------------------------------------------------------------------------

    \3944\ References to data sizing refer to raw, uncompressed data
and do not account for benefits of compression, overhead of data
storage or indices. Data sizing estimates do not include meta-data
and are based on delimited, fixed length data sets. The Plan
Processor is responsible for calculating its platform capacity
capabilities based on its proposed solution. Three years after the
finalization of the CAT NMS Plan, when all CAT Reporters submit
their data to the Central Repository, the Central Repository must be
sized to receive process and load more than 58 billion records per
day.
---------------------------------------------------------------------------

    The Central Repository must be:

Designed such that additional capacity can be quickly and seamlessly
integrated while maintaining system access and availability
requirements;
Able to efficiently and effectively handle data ingestion on days
with peak and above-peak data submission volumes; and
Required to maintain and store data for a 6-year sliding window of
data. System access and availability requirements must be maintained
during the maintenance of the sliding window. It is expected that
the Central Repository will grow to more than 29 petabytes of raw,
uncompressed data.

    The Plan Processor must:

Define a capacity planning process to be approved by the Operating
Committee, with such process incorporating industry utility capacity
metrics; and
Develop a robust process to add capacity, including both the ability
to scale the environment to meet the expected annual increases as
well as to rapidly expand the environment should unexpected peaks in
data volumes breach the defined capacity baseline. Capacity
forecasts from systems, including OPRA, UTP, and CTA, must also be
included for capacity planning purposes. This capacity planning
process must be approved by the Operating Committee.

Monitoring Capacity Utilization and Performance Optimization

    In order to manage the data volume, operational capacity
planning must be conducted on a periodic basis. The Plan Processor
must submit capacity-planning metrics to the Operating Committee for
review to ensure that all parties are aware of the system processing
capabilities and changes to assumptions. Changes to assumptions
could lead to positive or negative adjustments in the costs charged
to CAT Reporters. Reports that capture daily disk space, processing
time, amount of data received and linkage completion times must be
provided by the Plan Processor to the Operating Committee.

Data Retention Requirements

    The Plan Processor must develop a formal record retention policy
and program for the CAT, to be approved by the Operating Committee,
which will, at a minimum:

Contain requirements associated with data retention, maintenance,
destruction, and holds;
Comply with applicable SEC record-keeping requirements;
Have a record hold program where specific CAT Data can be archived
offline for as long as necessary;
Store and retain both raw data submitted by CAT Reporters and
processed data; and
Make data directly available and searchable electronically without
manual intervention for at least six years.

Data Management

    The Plan Processor must develop data management policies and
procedures to govern and manage CAT Data, reference data, and
metadata contained in and used by the Central Repository.
    The CAT must capture, store, and maintain current and historical
reference data information. This master/reference database will
include data elements such as, but not limited to, SRO-assigned
market participant identifiers, product type, trading unit size,
trade/quote minimum price variation, corporate actions, symbology
changes, and changes in listings market center. The Plan Processor
must support bi-temporal milestones (e.g., Effective Date and as-of-
date) of the reference data.
    CAT Reporters will submit data to the Central Repository with
the listing exchange symbology format. The Central Repository must
use the listing exchange symbology format for output of the linked
data. Instrument validation must be included in

the processing of data submitted by CAT Reporters.
    The Central Repository must be able to link instrument data
across any time period so that data can be properly displayed and
linked regardless of changes to issue symbols or market class. The
Plan Processor is required to create and maintain a symbol history
and mapping table, as well as to provide a tool that will display a
complete issue symbol history that will be accessible to CAT
Reporters, Participants and the SEC. In addition, the Plan Processor
will be required to create a start-of-day (``SOD'') and end-of-day
(``EOD'') CAT reportable list of securities for use by CAT
Reporters. This list must be available online and in a machine
readable (e.g., .csv) format by 6 a.m. on each Trading Day.
    Queries, reports, and searches for data that span dates where
there are changes to reference data must automatically include data
within the requested date range. For example, if a query is run for
a symbol that had three issue symbol changes during the time window
of the query parameters, the result set must automatically include
data for all three symbols that were in use during the time window
of the query.
    The Plan Processor must also develop an end-to-end process and
framework for technical, business and operational metadata.

Data Types and Sources

    The Plan Processor will be responsible for developing detailed
data and interface specifications for data to be submitted by CAT
Reporters. These specifications will be contained in the Technical
Specifications, the initial version of which will be presented to
the Operating Committee for approval. The Technical Specifications
must be designed to capture all of the data elements required by SEC
Rule 613, as well as other information the Participants determine
necessary to facilitate elimination of reporting systems that the
CAT may cause to be redundant, such as EBS and OATS. In the future,
new data sources such as public news may be added to the
specifications.
    CAT Reporters and Data Submitters will transmit data in an
electronic data format(s) that will be defined by the Plan
Processor. The Technical Specifications must include details for
connectivity and electronic submission, transmission, retransmission
and processing. It is possible that more than one format will be
defined to support the various senders throughout the industry.
    The Participants anticipate that some broker-dealers will not
directly report to the CAT but will rely on other organizations to
report on their behalf. However, the CAT will need to have the
flexibility to adapt on a timely basis to changes in the number of
entities that report CAT Data.

Data Feed Management

    The Plan Processor must monitor and manage incoming and outgoing
data feeds for, at a minimum, the following:

Data files from each CAT Reporter and Data Submitter;
Files that cover multiple trade dates (e.g., to account for clearing
and changes);
Full and partial file submissions that contain corrections from
previously rejected files;
Full and partial file submissions based on CAT Reporter; and
Receipt and processing of market data feeds (SIP, OPRA, OCC).

    The Plan Processor must also develop a process for detecting,
managing, and mitigating duplicate file submissions. It must create
and store operational logs of transmissions, success, and failure
reasons in order to create reports for CAT Reporters, Participants,
and the SEC. Outgoing data feeds must be logged and corresponding
metadata elements must be monitored and captured.

Managing connectivity for data feeds (e.g., SIPs, broker-dealers and
regulators)

    The Plan Processor will be required to ensure that it provides
all CAT Reporters with the ability to transmit CAT Data to the
Central Repository as required to meet the reporting requirements.
The Plan Processer is required to have a robust managed file
transfer (``MFT'') tool, including full monitoring, permissioning,
auditing, security, high availability,\3945\ file integrity checks,
identification of data transmission failures/errors, transmission
performance metrics, multiple transmission protocols, Latency/
network bottlenecks or delays, key management, etc. CAT Reporters
must also have the ability to conduct manual data entry via a GUI
interface or the uploading of a file, subject to a maximum record
capacity, which will be defined by the Plan Processor in
consultation with the Operating Committee.
---------------------------------------------------------------------------

    \3945\ To be defined in the SLAs to be agreed to between the
Participants and the Plan Processor, as detailed in Appendix D,
Functionality of the CAT System.
---------------------------------------------------------------------------

Reporting and Linkage Requirements

    All CAT Data reported to the Central Repository must be
processed and assembled to create the complete lifecycle of each
Reportable Event. Reportable Events must contain data elements
sufficient to ensure the same regulatory coverage currently provided
by existing regulatory reporting systems that have been identified
as candidates for retirement.
    Additionally, the Central Repository must be able to:

Assign a unique CAT-Reporter-ID to all reports submitted to the
system based on sub-identifiers, (e.g., MPIDs, ETPID, trading
mnemonic) currently used by CAT Reporters in their order handling
and trading processes.
Handle duplicate sub-identifiers used by members of different
Participants to be properly associated with each Participant.
Generate and associate one or more Customer-IDs with all Reportable
Events representing new orders received from a Customer(s) of a CAT
Reporter. The Customer-ID(s) will be generated from a Firm
Designated ID provided by the CAT Reporter for each such event,
which will be included on all new order events.
Accept time stamps on order events handled electronically to the
finest level of granularity captured by CAT Reporters. Additionally,
the CAT must be able to expand the time stamp field to accept time
stamps to an even finer granularity as trading systems expand to
capture time stamps in ever finer granularity. The Plan Processor
must normalize all processed date/time CAT Data into a standard time
zone/format.

    In addition, the data required from CAT Reporters will include
all events and data elements required by the Plan Processor in the
Technical Specifications to build the:

Life cycle of an order for defined events within a CAT Reporter;
Life cycle of an order for defined events intra-CAT Reporter; and
State of all orders across all CAT Reporters at any point in time.

    The Plan Processor must use the ``daisy chain approach'' to link
and create the order lifecycle. In the daisy chain approach, a
series of unique order identifiers, assigned to all order events
handled by CAT Reporters are linked together by the Central
Repository and assigned a single CAT-generated CAT-Order-ID that is
associated with each individual order event and used to create the
complete lifecycle of an order.
    By using the daisy chain approach the Plan Processor must be
able to link all related order events from all CAT Reporters
involved in the lifecycle of an order. At a minimum, the Central
Repository must be able to create the lifecycle between:

All order events handled within an individual CAT Reporter,
including orders routed to internal desks or departments with
different functions (e.g., an internal ATS);
Customer orders to ``representative'' orders created in firm
accounts for the purpose of facilitating a customer order (e.g.,
linking a customer order handled on a riskless principal basis to
the street-side proprietary order);
Orders routed between broker-dealers;
Orders routed from broker-dealers to exchanges;
Orders sent from an exchange to its routing broker-dealer;
Executed orders and trade reports;
Various legs of option/equity complex orders; and
Order events for all equity and option order handling scenarios that
are currently or may potentially be used by CAT Reporters,
including:
    [cir] Agency route to another broker-dealer or exchange;
    [cir] Riskless principal route to another broker-dealer or
exchange capturing within the lifecycle both the customer leg and
street side principal leg;
    [cir] Orders routed from one exchange through a routing broker-
dealer to a second exchange;
    [cir] Orders worked through an average price account capturing
both the individual street side execution(s) and the average price
fill to the Customer;
    [cir] Orders aggregated with other orders for further routing
and execution capturing both the street side executions for the
aggregated order and the fills to each customer order;
    [cir] Complex orders involving one or more options legs and an
equity leg, with a

linkage between the option and equity legs;
    [cir] Complex orders containing more legs than an exchange's
order management system can accept, causing the original order to be
broken into multiple orders;
    [cir] Orders negotiated over the telephone or via a negotiation
system;
    [cir] Orders routed on an agency basis to a foreign exchange;
    [cir] Execution of customer order via allocation of shares from
a pre-existing principal order;
    [cir] Market maker quotes; and
    [cir] Complex orders involving two or more options legs.

    Additionally, the Central Repository must be able to:

Link each order lifecycle back to the originating Customer;
Integrate and appropriately link reports representing repairs of
original submissions that are rejected by the CAT due to a failure
to meet a particular data validation;
Integrate into the CAT and appropriately link reports representing
records that are corrected by a CAT Reporter for the purposes of
correcting data errors not identified in the data validation
process;
Assign a single CAT-Order-ID to all events contained within the
lifecycle of an order so that regulators can readily identify all
events contained therein; and
Process and link Manual Order Events with the remainder of the
associated order lifecycle.

Timelines for Reporting

    CAT Data for the previous Trading Day must be reported to the
Central Repository by 8:00 a.m. Eastern Time on the Trading Day
following the day the Industry Member receives such data; however,
the Plan Processor must accept data prior to that deadline,
including intra-day submissions.

Other Items

    The Plan Processor must anticipate and manage order data
processing over holidays, early market closures and both anticipated
and unanticipated market closures. The Plan Processor must allow and
enable entities that are not CAT Reporters (e.g., service bureaus)
to report on behalf of CAT Reporters only upon being permissioned by
the CAT Reporter, and must develop appropriate tools to facilitate
this process.

Required Data Attributes for Order Records Submitted by CAT Reporters

    At a minimum, the Plan Processor must be able to receive the
data elements as detailed in the CAT NMS Plan.

Data Security

Overview

    SEC Rule 613 requires that the Plan Processor ensure the
security and confidentiality of all information reported to and
maintained by the CAT in accordance with the policies, procedures
and standards in the CAT NMS Plan.
    The Plan Processor must have appropriate solutions and controls
in place to ensure data confidentiality and security during all
communication between CAT Reporters and Data Submitters and the Plan
Processor, data extraction, manipulation and transformation, loading
to and from the Central Repository and data maintenance by the CAT
System. The Plan Processor must address security controls for data
retrieval and query reports by Participant and the SEC. The solution
must provide appropriate tools, logging, auditing and access
controls for all components of the CAT System, such as but not
limited to access to the Central Repository, access for CAT
Reporters, access to rejected data, processing status and CAT
Reporter performance and comparison statistics.
    The Plan Processor must provide to the Operating Committee a
comprehensive security plan that covers all components of the CAT
System, including physical assets and personnel, and the training of
all persons who have access to the Central Repository consistent
with Article VI, Section 6.1(m). The security plan must be updated
annually. The security plan must include an overview of the Plan
Processor's network security controls, processes and procedures
pertaining to the CAT Systems. Details of the security plan must
document how the Plan Processor will protect, monitor and patch the
environment; assess it for vulnerabilities as part of a managed
process, as well as the process for response to security incidents
and reporting of such incidents. The security plan must address
physical security controls for corporate, data center, and leased
facilities where Central Repository data is transmitted or stored.
The Plan Processor must have documented ``hardening baselines'' for
systems that will store, process, or transmit CAT Data or PII data.

Connectivity and Data Transfer

    The CAT System(s) must have encrypted internet connectivity. CAT
Reporters must connect to the CAT infrastructure using secure
methods such as private lines or (for smaller broker-dealers)
Virtual Private Network connections over public lines. Remote access
to the Central Repository must be limited to authorized Plan
Processor staff and must use secure multi-factor authentication that
meets or exceeds the Federal Financial Institutions Examination
Council (``FFIEC'') security guidelines surrounding authentication
best practices.\3946\
---------------------------------------------------------------------------

    \3946\ Federal Financial Institutions Examination Council,
Supplement to Authentication in an Internet Banking Environment
(June 22, 2011), available at http://www.ffiec.gov/pdf/Auth-ITS-Final%206-22-11%20(FFIEC%20Formated).pdf.
---------------------------------------------------------------------------

    The CAT databases must be deployed within the network
infrastructure so that they are not directly accessible from
external end-user networks. If public cloud infrastructures are
used, virtual private networking and firewalls/access control lists
or equivalent controls such as private network segments or private
tenant segmentation must be used to isolate CAT Data from
unauthenticated public access.

Data Encryption

    All CAT Data must be encrypted at rest and in flight using
industry standard best practices (e.g., SSL/TLS) including archival
data storage methods such as tape backup. Symmetric key encryption
must use a minimum key size of 128 bits or greater (e.g., AES-128),
larger keys are preferable. Asymmetric key encryption (e.g., PGP)
for exchanging data between Data Submitters and the Central
Repository is desirable.
    [All PII data must be encrypted both at rest and in flight,
including archival data storage methods such as tape backup.]
Storage of unencrypted PII data is not permissible. PII encryption
methodology must include a secure documented key management strategy
such as the use of HSM(s). The Plan Processor must describe how PII