[Federal Register Volume 88, Number 183 (Friday, September 22, 2023)]
[Proposed Rules]
[Pages 65524-65575]
[FR Doc No: 2023-20268]

Vol. 88

Friday,

No. 183

September 22, 2023

Part III

Securities and Exchange Commission

-----------------------------------------------------------------------

17 CFR Parts 232, 239, 249, et al.

EDGAR Filer Access and Account Management; Proposed Rule

Federal Register / Vol. 88, No. 183 / Friday, September 22, 2023 /
Proposed Rules

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

17 CFR Parts 232, 239, 249, 269, and 274

[Release Nos. 33-11232; 34-98368; 39-2551; IC-34996; File No. S7-15-23]
RIN 3235-AM58

EDGAR Filer Access and Account Management

AGENCY: Securities and Exchange Commission.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Securities and Exchange Commission (``Commission'') is
proposing rule and form amendments concerning access to and management
of accounts on the Commission's Electronic Data Gathering, Analysis,
and Retrieval system (``EDGAR'') that are related to potential
technical changes to EDGAR (collectively referred to as ``EDGAR
Next''). We propose to require that electronic filers (``filers'')
authorize and maintain designated individuals as account administrators
and that filers, through their account administrators, take certain
actions to manage their accounts on a dashboard on EDGAR. Further, we
propose that filers may only authorize individuals as account
administrators or in the other roles described herein if those
individuals first obtain individual account credentials in the manner
to be specified in the EDGAR Filer Manual. As part of the EDGAR Next
changes, the Commission would offer filers optional Application
Programming Interfaces (``APIs'') for machine-to-machine communication
with EDGAR, including submission of filings and retrieval of related
information. If the proposed rule and form amendments are adopted, the
Commission would make corresponding changes to the EDGAR Filer Manual
and implement the potential technical changes.

DATES: Comments should be received on or before November 21, 2023.

ADDRESSES: Comments may be submitted by any of the following methods:

Electronic Comments

     Use the Commission's internet comment form (https://www.sec.gov/rules/submitcomments.htm); or
     Send an email to [email protected]. Please include
File Number S7-15-23 on the subject line.

Paper Comments

     Send paper comments to Secretary, Securities and Exchange
Commission, 100 F Street NE, Washington, DC 20549.

All submissions should refer to File Number S7-15-23. This file number
should be included on the subject line if email is used. To help the
Commission process and review your comments more efficiently, please
use only one method of submission. The Commission will post all
submitted comments on the Commission's website (https://www.sec.gov/rules/proposed.shtml). Comments are also available for website viewing
and printing in the Commission's Public Reference Room, 100 F Street
NE, Washington, DC 20549, on official business days between the hours
of 10 a.m. and 3 p.m. Operating conditions may limit access to the
Commission's Public Reference Room. Do not include personal
identifiable information in submissions; you should submit only
information that you wish to make available publicly. We may redact in
part or withhold entirely from publication submitted material that is
obscene or subject to copyright protection.
    Studies, memoranda, or other substantive items may be added by the
Commission or staff to the comment file during this rulemaking. A
notification of the inclusion in the comment file of any such materials
will be made available on our website. To ensure direct electronic
receipt of such notifications, sign up through the ``Stay Connected''
option at www.sec.gov to receive notifications by email.

FOR FURTHER INFORMATION CONTACT: Rosemary Filou, Deputy Director and
Chief Counsel; Daniel K. Chang, Senior Special Counsel; E. Laurita
Finch, Senior Special Counsel; Jane Patterson, Senior Special Counsel;
Margaret Marrero, Senior Counsel; Lidian Pereira, Senior Special
Counsel; EDGAR Business Office at<PHONE_NUMBER>, Securities and Exchange
Commission, 100 F Street NE, Washington, DC 20549.

SUPPLEMENTARY INFORMATION: The Commission is proposing amendments to 17
CFR 232.10 (``Rule 10'') and 17 CFR 232.11 (``Rule 11'') under 17 CFR
232.10 through 232.903 (``Regulation S-T''); and amendments to Form ID
(referenced in 17 CFR 239.63, 17 CFR 249.446, 17 CFR 269.7, and 17 CFR
274.402).

Table of Contents

I. Introduction
II. Background
    A. Current EDGAR Access and Account Management
    B. The Commission's September 2021 Request for Comment
III. Discussion
    A. Individual Account Credentials
    B. Individual Roles: Account Administrator, User, Technical
Administrator
    1. Account Administrators
    2. Users
    3. Technical Administrators
    C. Delegated Entities
    1. Delegating Authority To File
    2. Separation of Authority of Filer and Delegated Entity
    3. Delegated Entities
    4. Delegated Users
    5. User Groups at Delegated Entities
    6. Technical Administrators at Delegated Entities
    D. Application Programming Interfaces
    1. Submission API
    2. Submission Status API
    3. EDGAR Operational Status API
    E. Proposed Amendments to Rules and Forms
    1. Rule 10 Under Regulation S-T
    2. Rule 11 Under Regulation S-T
    3. Form ID
    F. Transition Process
    1. Individual Account Credentials
    2. Enrollment
    3. Compliance
    G. General Request for Comment and EDGAR Next Proposing Beta
IV. Economic Analysis
    A. Introduction
    B. Baseline
    C. Consideration of Benefits and Costs as Well as the Effects on
Efficiency, Competition, and Capital Formation
    1. Benefits
    2. Costs
    3. Effects on Efficiency, Competition, and Capital Formation
    D. Reasonable Alternatives
    1. Require Personally Identifiable Information in Addition to
Individual Account Credentials
    2. Requirements for Individual and Small Filers
    3. Implementing Performance-Based Standards
    4. Institute Phased Compliance Dates by Filer Category or Form
Type
    E. Requests for Comment
V. Paperwork Reduction Act
    A. Form ID
    B. The Dashboard
    C. Request for Comment
VI. Small Business Regulatory Enforcement Act
VII. Initial Regulatory Flexibility Analysis
    A. Reasons for, and Objectives of, the Proposed Action
    B. Legal Basis
    C. Small Entities Subject to the Proposed Rule and Form
Amendments
    D. Reporting, Recordkeeping, and Other Compliance Requirements
    E. Duplicative, Overlapping, or Conflicting Federal Rules
    F. Significant Alternatives
    G. Request for Comment
Statutory Authority
Appendix A

I. Introduction

    We are seeking comment on proposed rule and form amendments
concerning EDGAR filer access and account

management. Separately, we welcome feedback on related EDGAR technical
functionality.
    The Commission is seeking to enhance the security of EDGAR, improve
the ability of filers \1\ to securely manage and maintain access to
their EDGAR accounts, facilitate the responsible management of filer
credentials, and simplify procedures for accessing EDGAR.\2\ In
furtherance of these goals, on September 30, 2021, the Commission
issued a Request for Comment on Potential Technical Changes to EDGAR
Filer Access and Filer Account Management Processes (``2021 Request for
Comment'').\3\ The Commission received comments from and engaged in a
dialogue with interested parties, considered feedback from these
parties, and gathered additional information about filers' interactions
with EDGAR.\4\ The rule and form amendments we are proposing in this
release and the related technical changes seek to achieve the
Commission's goals for secure EDGAR access and account management while
addressing many of the comments and concerns expressed in response to
the 2021 Request for Comment.
---------------------------------------------------------------------------

    \1\ For purposes of this release, we use the term ``filer'' to
mean ``electronic filer,'' as defined in Rule 11 of Regulation S-T:
``A person or an entity that submits filings electronically pursuant
to Rules 100 or 101 of Regulation S-T.''
    \2\ Please refer to proposed Rule 11 of Regulation S-T, set
forth in this release, for definitions of the terms used in this
release, including ``account administrator,'' ``dashboard,''
``user,'' ``delegated entity,'' ``APIs,'' and ``technical
administrator.''
    \3\ In the 2021 Request for Comment, we referred to filer
administrators. That term has been changed herein to refer to
account administrators, which we believe is in keeping with industry
nomenclature and is less confusing in context. See Potential
Technical Changes to EDGAR Filer Access and Filer Account Management
Processes, Release No. 33-10993 (Sept. 30, 2021) [86 FR 55029 (Oct.
5, 2021)].
    \4\ Comment letters related to the 2021 Request for Comment are
available at https://www.sec.gov/comments/s7-12-21/s71221.htm.
---------------------------------------------------------------------------

    The obligations for filers contemplated by EDGAR Next would
generally be codified in Rule 10 of Regulation S-T.\5\ Form ID would be
amended to implement those changes and require information about, among
other things, the filer's account administrators,\6\ and to improve the
utility of the form for Commission staff. Moreover, Rule 11 of
Regulation S-T would be amended to provide clarity regarding certain
new terms related to the proposed rule and form amendments.\7\
---------------------------------------------------------------------------

    \5\ In addition to the changes discussed below, Rule 10 would
also be amended to implement certain technical and conforming
changes. See Section III.E.1.
    \6\ We are proposing amendments to Rule 11 under Regulation S-T
to define an ``account administrator'' as an individual authorized
by an electronic filer to manage the electronic filer's EDGAR
account on EDGAR, and to make filings on EDGAR on the electronic
filer's behalf. See the discussion of proposed amendments to Rule 11
in Section III.E.2.
    \7\ The amendments to Rule 11 would also update or delete
outdated terminology and clarify the definition of the EDGAR Filer
Manual.
---------------------------------------------------------------------------

    Under proposed Rule 10(d)(1), only those individuals who obtained
individual account credentials \8\ could be authorized to act on the
filer's behalf on a dashboard \9\ on the EDGAR Filer Management
website.\10\
---------------------------------------------------------------------------

    \8\ We are proposing amendments to Rule 11 under Regulation S-T
to define ``individual account credentials'' as credentials issued
to individuals for purposes of EDGAR access, as specified in the
EDGAR Filer Manual. See the discussion of proposed amendments to
Rule 11 in Section III.E.2. We currently anticipate that, if the
proposal is adopted, the EDGAR Filer Manual would specify that
individual account credentials must be obtained through Login.gov, a
sign in service of the United States Government that employs multi-
factor authentication.
    \9\ We are proposing amendments to Rule 11 under Regulation S-T
to define the ``dashboard'' as an interactive function on EDGAR
where electronic filers manage their EDGAR accounts and individuals
that electronic filers authorize may take relevant actions for
electronic filers' accounts. See the discussion of proposed
amendments to Rule 11 in Section III.E.2.
    \10\ See EDGAR Filer Management website at https://www.filermanagement.edgarfiling.sec.gov.
---------------------------------------------------------------------------

    Proposed Rule 10(d)(2) would require each filer to authorize and
maintain individuals as its account administrators \11\ to manage the
filer's EDGAR account on the filer's behalf, in accord with the EDGAR
account access and account management requirements set forth in this
proposal and in the EDGAR Filer Manual. The filer could authorize
someone who is not an employee of the filer \12\ as the filer's account
administrator, if the authorized individual for the filer \13\ provided
a relevant notarized power of attorney authorizing that individual to
be the filer's account administrator.\14\
---------------------------------------------------------------------------

    \11\ Applicants (individuals and companies) for EDGAR access
would designate account administrators on Form ID. See proposed Form
ID.
    \12\ For example, if a filer wished to authorize an individual
employed by its filing agent to act as the filer's account
administrator, the authorized individual for the filer would be
required to upload a notarized power of attorney authorizing the
individual to be the filer's account administrator. See proposed
Form ID, Part 3.
    \13\ We are proposing amendments to Rule 11 under Regulation S-T
to define ``authorized individual.'' See the discussion of proposed
amendments to Rule 11 in Section III.E.2.
    \14\ Foreign filers who do not have access to a U.S. notary
public could use the foreign local equivalent of a notary public
(e.g., apostille) or obtain notarization by a remote online notary
recognized by the law of any State or territory in the U.S. or the
District of Columbia. See EDGAR Filer Manual, Volume I, at Section
3.
---------------------------------------------------------------------------

    On the dashboard, account administrators would take actions on
behalf of the filer to add and remove authorized users, account
administrators, and technical administrators; and annually confirm the
accuracy of the filer's information on the dashboard.
    Additionally, on the dashboard, account administrators could
delegate authority to file on behalf of the filer to any other EDGAR
account, such as a filing agent, making that account a delegated entity
of the filer, and could remove a delegated entity's authority to file
on the filer's behalf. A delegated entity would have its own EDGAR
account and dashboard to manage its account. Because it would itself be
a filer, a delegated entity would be subject to the same requirements
as other filers. Through its dashboard, a delegated entity could manage
the delegated authority it received from filers. If a delegated entity
accepted a delegation from a filer, the delegated entity's account
administrators would become delegated administrators with respect to
that filer. Each delegated administrator could thereafter manage which
of the users of the delegated entity would become delegated users for
particular filers. A delegated entity could not further delegate
authority to file on behalf of that filer, nor could delegated
administrators take action on the filer's dashboard. Similarly, the
filer's account administrators could not view or take action on the
delegated entity's dashboard.\15\
---------------------------------------------------------------------------

    \15\ Please see the illustration in diagram 3 in Section III.C.
---------------------------------------------------------------------------

    As proposed, Rule 10(d)(4) would require each filer, through its
authorized account administrators, to confirm annually that all account
administrators, users,\16\ delegated entities,\17\ and technical
administrators \18\ reflected on the dashboard for the filer's EDGAR
account are authorized by the filer and that all information regarding
the filer on the dashboard is accurate (generally including the filer's
corporate and contact information).
---------------------------------------------------------------------------

    \16\ We are proposing amendments to Rule 11 under Regulation S-T
to define a ``user'' as an individual that the filer authorizes on
the dashboard to make submissions on EDGAR on the filer's behalf.
See the discussion of proposed amendments to Rule 11 in Section
III.E.2.
    \17\ We are proposing amendments to Rule 11 under Regulation S-T
to define a ``delegated entity'' as an electronic filer that another
electronic filer authorizes, on the dashboard, to file on EDGAR on
its behalf. See the discussion of proposed amendments to Rule 11 in
Section III.E.2.
    \18\ We are proposing amendments to Rule 11 under Regulation S-T
to define a ``technical administrator'' as an individual that the
filer authorizes on the dashboard to manage the technical aspects of
the filer's use of EDGAR Application Programming Interfaces on its
behalf. See the discussion of proposed amendments to Rule 11 in
Section III.E.2.
---------------------------------------------------------------------------

    Pursuant to proposed Rule 10(d)(5), each filer, through its
authorized

account administrators, would further be required to maintain accurate
and current information about the filer on EDGAR, and, pursuant to
proposed Rule 10(d)(6), to securely maintain information relevant to
the ability to access the filer's EDGAR account.
    As part of EDGAR Next, the Commission would offer filers optional
APIs \19\ to facilitate machine-to-machine communication with EDGAR,
including submission of filings and retrieval of related information.
Pursuant to proposed Rule 10(d)(3), if the filer decided to use an
optional API, the filer would be required to authorize two individuals
to be technical administrators to manage the API.\20\ In addition, the
filer would present security tokens to EDGAR, which would be reissued
annually, and which the technical administrators would manage on the
filer's dashboard. Individuals using the APIs would be required to sign
in with their individual account credentials and complete multi-factor
authentication on a monthly basis.
---------------------------------------------------------------------------

    \19\ We are proposing amendments to Rule 11 under Regulation S-T
to define an ``Application Programming Interface'' or ``API'' as a
software interface that allows computers or applications to
communicate with each other. See the discussion of proposed
amendments to Rule 11 in Section III.E.2.
    \20\ See proposed Rule 10(d)(3).
---------------------------------------------------------------------------

    The Commission intends to make available to filers an EDGAR Next
Proposing Beta environment \21\ that reflects the proposed rule and
form amendments and related technical changes. In addition to public
comment on the proposed rule and form amendments, the Commission
welcomes feedback from filers about the technical aspects of EDGAR
Next.\22\
---------------------------------------------------------------------------

    \21\ The Commission staff will make available an EDGAR Next
Proposing Beta environment shortly after the issuance of this
release, and it will remain open to filers for at least 6 months
thereafter.
    The EDGAR Next Proposing Beta will reflect the proposed rule and
form changes as well as the technical changes to EDGAR set forth in
this release. The EDGAR Next Proposing Beta environment will
therefore contain functionality, including APIs, not included in the
2021 Request for Comment beta environment.
    If the Commission later adopts the proposed rule and form
changes set forth in this release, staff would make available to
filers an EDGAR Next Adopting Beta environment that reflects the
rule and form changes as adopted and the technical changes to EDGAR
to be made in connection with adoption. The EDGAR Next Adopting Beta
would allow filers to prepare for the transition to the rule and
form changes as adopted and the final version of the technical
changes to EDGAR.
    \22\ Technical feedback may be submitted to the public comment
file.
---------------------------------------------------------------------------

II. Background

A. Current EDGAR Access and Account Management

    Presently, those seeking to file on EDGAR apply for access pursuant
to Rule 10 of Regulation S-T by completing the Form ID application for
access on the EDGAR Filer Management website and submitting a notarized
copy of that application signed by an authorized individual of the
filer.\23\ Form ID is an online fillable form that requires the
applicant to provide the applicant's name and contact information, the
applicant's point of contact for EDGAR information, inquiries, and
access codes (``EDGAR POC''), and its contact for SEC account
information and billing invoices (``billing contact'').\24\ Further,
when the applicant entity or individual submits the Form ID, the
applicant must create and retain a passphrase to be used to create
access codes if the application is granted.
---------------------------------------------------------------------------

    \23\ See EDGAR Filer Manual, Volume I, at Section 3. The EDGAR
Filer Manual specifies the instructions filers must follow when
making electronic filings on EDGAR and is incorporated by reference
in the Code of Federal Regulations by 17 CFR 232.301 (Rule 301 of
Regulation S-T). Rule 10 of Regulation S-T and the EDGAR Filer
Manual permit manual, electronic, and remote online notarizations,
authorized by the law of any State or territory of the United States
or the District of Columbia. See 17 CFR 232.10 and EDGAR Filer
Manual, Volume I, at Section 3. An ``authorized individual'' for
purposes of the Form ID notarization process is an individual with
the authority to legally bind the applicant, or an individual with a
power of attorney from an individual with the authority to legally
bind the applicant. See EDGAR Filer Manual, Volume I, at Section 3.
    \24\ 17 CFR 239.63, 249.446, 269.7, and 274.402.
---------------------------------------------------------------------------

    If Commission staff approves the Form ID application, an account in
the filer's name is opened on EDGAR, denoted by a central index key
number (``CIK'') unique to that filer, if needed.\25\ The EDGAR POC may
then generate access codes to allow the filer to make submissions on
its EDGAR account. To do so, the EDGAR POC uses the CIK provided in an
email from EDGAR and the passphrase the filer created on EDGAR when the
filer submitted the Form ID to generate a password, central index key
confirmation code (``CCC''), and password modification authorization
code (``PMAC'').\26\ Together with the CIK, the filer's password,
passphrase, CCC, and PMAC constitute the EDGAR access codes.
---------------------------------------------------------------------------

    \25\ While most applicants that submit Form ID have not
previously been assigned a CIK, a small number of other applicants
have already been assigned a CIK but have not filed electronically
on EDGAR. These applicants continue to use the same CIK when they
receive access to EDGAR and are not assigned a new CIK.
    \26\ See EDGAR Filer Manual, Volume I, at Section 4. For a
discussion of the functions of these access codes, please see the
``Understand and utilize EDGAR CIKs, passphrases, and access codes''
section of the ``EDGAR--How Do I'' FAQs, at https://www.sec.gov/edgar/filer-information/how-do-i.
---------------------------------------------------------------------------

    Filers make submissions on EDGAR using their CIK, password, and
CCC. Filings on EDGAR are therefore traceable to the filer's CIK. EDGAR
does not presently issue identifying credentials to individuals making
filings on EDGAR; an individual's authority to file on EDGAR is
predicated on possession of the password and CCC. Thus, filings are not
easily traceable to individuals, and the Commission currently does not
provide a technical solution through which filers may manage
individuals who make submissions on filers' behalf. As a result,
Commission staff and affected filers often encounter delays in
addressing potentially problematic filings.
    Because filers are required to securely maintain their EDGAR access
codes,\27\ Commission staff understands that many filers have devised
their own internal methods of tracking the individuals who possess the
password and CCC. Other filers, however, may not have closely tracked
the individuals who possess the password and CCC and/or otherwise
maintained secure access to filers' EDGAR accounts. For example,
Commission staff understands that some filers have shared EDGAR access
codes with co-registrants, filing agents, and various employees through
non-secure means and without tracking or recording the names and
identities of the recipients.
---------------------------------------------------------------------------

    \27\ See EDGAR Filer Manual, Volume I, at 4 (``Filers must
securely maintain all EDGAR access codes and limit the number of
persons who possess the codes.'').
---------------------------------------------------------------------------

    EDGAR does not currently employ multi-factor authentication. As
noted, if an individual has the password and CCC, then no other
authentication is required to access EDGAR. Multi-factor authentication
would increase the level of assurance that an individual is indeed the
person authorized to access an account by requiring provision of an
additional data point to gain access.
    Filers routinely hire filing agents, which include law firms and
third-party software providers, to assist with filing on EDGAR. Indeed,
EDGAR data reveals that, at a minimum, more than 60% of filings on
EDGAR are made by a filing agent on the filer's behalf,\28\ and

commenters have indicated that 81-90% of EDGAR filings are not manually
submitted to EDGAR.\29\ While EDGAR does not require the use of filing
agents, a filer may decide to hire a filing agent to assist with EDGAR
filing.
---------------------------------------------------------------------------

    \28\ In calendar year 2021, 63% of all EDGAR submissions were
made by filers that identified themselves as ``filing agents.''
Because filing agents are not required to self-identify in EDGAR as
such, however, and instead could simply identity themselves as a
``filer,'' the actual percentage of EDGAR submissions made by filing
agents may be significantly higher.
    \29\ See Workiva Comment Letter (Nov. 30, 2021) (``Workiva
Comment Letter''); XBRL US Comment Letter (Dec. 1, 2021) (``XBRL
Comment Letter'').
---------------------------------------------------------------------------

    Further, as noted in comments submitted in response to the 2021
Request for Comment, individual filers who are officers and/or
directors with obligations to file on EDGAR pursuant to section 16 of
the Securities Exchange Act of 1934 (``Exchange Act'') \30\ routinely
rely upon the companies for which they serve as officers and/or
directors to make filings on their behalf on EDGAR.\31\ Likewise, other
filers may make filings on behalf of affiliated or related entities,
such as asset-backed securities issuers on behalf of their serial
companies.\32\
---------------------------------------------------------------------------

    \30\ 15 U.S.C. 78p.
    \31\ See Orrick, Herrington & Sutcliffe LLP Comment Letter (Feb.
23, 2022) (``Orrick Comment Letter''); McGuireWoods, LLP and
Brownstein Hyatt Farber Schreck, LLP (Dec. 1, 2021) (``McGuireWoods
Comment Letter''); Brandon Norman Egren, Associate General Counsel &
Assistant Secretary, Verizon (Dec. 1, 2021) (``Verizon Comment
Letter''); Toppan Merrill (Nov. 22, 2021) (``Toppan Comment
Letter'').
    \32\ See Donnelly Financial Solutions Comment Letter (Dec. 1,
2021) (``DFIN Comment Letter''); XBRL Comment Letter.
---------------------------------------------------------------------------

    Filers make submissions on EDGAR through one of three web-based
user interfaces, depending on the type of submission made.\33\
Commission staff is aware that filers and filing agents have for years
sought to automate submissions on EDGAR so as not to rely upon web-
based interfaces, and many filers and filing agents have engineered
their own automated processes to make submissions and otherwise
interact with EDGAR. These filers and filing agents extract data and
content from, or ``scrape,'' the EDGAR filing websites and use that
data to create custom software that allows them to interact with the
websites in a machine-to-machine fashion to accomplish tasks such as
scheduling filings and making a large volume of submissions on numerous
different CIK accounts.\34\
---------------------------------------------------------------------------

    \33\ See EDGAR Filer Management website at https://www.filermanagement.edgarfiling.sec.gov; EDGAR Filing website at
https://www.edgarfiling.sec.gov/Welcome/EDGARLogin.htm; and EDGAR
Online Forms website at https://www.edgarfiling.sec.gov/Welcome/EDGAROnlineFormsLogin.htm.
    \34\ See CompSci Comment Letter (Nov. 19, 2021); Workiva Comment
Letter (Nov. 30, 2021); CompSci Resources LLC Comment Letter (Nov.
19, 2021).
---------------------------------------------------------------------------

    Filers and filing agents must modify their custom software
periodically to accord with underlying changes to EDGAR code.
Similarly, when Commission staff makes EDGAR software changes, staff
has coordinated with filers and filing agents using custom software to
prevent filing disruptions. As a result, efficient implementation of
certain technical changes in EDGAR may be delayed while such
coordination and software adjustments take place.

B. The Commission's September 2021 Request for Comment

    The 2021 Request for Comment sought feedback from filers about
potential technical changes to EDGAR access and account management,
including the addition of individual account credentials with multi-
factor authentication, a dashboard on EDGAR where a filer would manage
its EDGAR account, administrators to manage the filer's account and
annually confirm the filer's information, and the time period required
to implement the potential technical changes. To assist filers in
assessing the potential technical changes, the Commission provided
filers access to a beta environment that reflected the majority of the
potential technical changes.
    The Commission received over forty comment letters in response to
the 2021 Request for Comment.\35\ Commenters were generally supportive
of the Commission's objectives,\36\ but were concerned about certain
aspects of the potential technical changes.
---------------------------------------------------------------------------

    \35\ Twenty of these letters were form letters that requested an
extension of the deadline to provide comments, as opposed to
providing substantive comments.
    \36\ See, e.g., Verizon Comment Letter (Dec. 1, 2021); XBRL US
Comment Letter; Workiva Comment Letter; Davis Polk Comment Letter
(Dec. 1, 2021).
---------------------------------------------------------------------------

    With respect to requiring individual account credentials, many
commenters expressed the view that the potential technical changes
would prevent filers and filing agents from continuing to use their
custom third-party software to make machine-to-machine submissions on
EDGAR. Several commenters estimated that currently 81-90% of EDGAR
filings are submitted to EDGAR directly through third-party filing
systems rather than manually uploaded on an individual basis via EDGAR
filing websites.\37\ Commenters stated that the Login.gov multi-factor
authentication process does not support automated machine-to-machine
authentication and requested that the Commission consider machine-to-
machine authentication to facilitate the ability to pre-schedule and
perform bulk filings, reduce the potential for error due to manual
processing, reduce the risk of missing deadlines, and decrease the cost
of compliance.\38\ One commenter conducted a survey of filers wherein
70% of respondents believed that the increased time required to submit
filings due to the loss of direct submission capability from third-
party filing systems would be ``very impactful'' or ``extremely
impactful'' to their filing success.\39\
---------------------------------------------------------------------------

    \37\ See Workiva Comment Letter; XBRL US Comment Letter.
    \38\ See, e.g., Workiva Comment Letter; XBRL US Comment Letter.
    \39\ See Workiva Comment Letter (the filer survey included 660
responses from Nov. 15-27, 2021).
---------------------------------------------------------------------------

    The Commission also requested comment on whether filers should
authorize administrators to manage filers' EDGAR accounts. Certain
commenters expressed concerns about the impact that the institution of
administrators would have on individual officer and director filers
pursuant to section 16 of the Exchange Act.\40\ Commenters recommended
that the Commission allow a company to create and manage a company-
specific account for an individual non-employee director or section 16
officer.\41\ These commenters further suggested that each company be
required to obtain a notarized power of attorney from the individual so
that the company could create and maintain the company-specific account
on behalf of the individual.\42\
---------------------------------------------------------------------------

    \40\ See, e.g., Workiva Comment Letter; XBRL US Comment Letter.
    \41\ See McGuire Woods, LLP and Brownstein Hyatt Farber Schreck,
LLP Comment Letter (Dec. 1, 2021) (``McGuire/Brownstein Comment
Letter''); Orrick, Herrington & Sutcliffe LLP Comment Letter (Feb.
23, 2022) (``Orrick Commenter Letter'') (reiterating the concern
that the new filer administrator position would create an
administrative burden on section 16 filers and endorsing instead the
company-specific account approach outlined in the McGuire/Brownstein
Comment Letter).
    \42\ These commenters also recommended ``grandfathering''
issuers with existing powers of attorney for section 16 officers and
directors. Alternatively, they recommended a ``negative consent''
construct, according to which a company would be deemed to have
authority to create a new company-specific account unless an officer
or director expressly objected during a set period of time. See
McGuire/Brownstein Comment Letter; Orrick Comment Letter.
---------------------------------------------------------------------------

    With respect to the Commission's request for comment on a
requirement to annually confirm users and administrators, commenters
generally did not support the requirement,\43\

noting that it would increase the number of required confirmations,
would be duplicative, and would necessitate additional management
effort for filers, thus increasing the administrative burden.\44\
Certain commenters recommended limiting confirmation to
administrators.\45\ Others suggested that the Commission implement an
active notification process to inform filers of impending expiration
\46\ and recommended a grace period after failure to make a
confirmation.\47\ Several commenters recommended that denying EDGAR
access until the administrator has reconfirmed would be less burdensome
than deactivating accounts.\48\
---------------------------------------------------------------------------

    \43\ See, e.g., McGuire/Brownstein Comment Letter; XBRL US
Comment Letter. A few commenters also requested enhancement of the
beta environment to reflect ``a complete testing environment'' or
the ``full life cycle of an SEC EDGAR filing which would enable full
and appropriate analysis.'' See, e.g., Toppan Comment Letter (Nov.
30, 2021); Donnelley Financial Solutions Comment Letter (Nov. 18,
2021).
    \44\ See XBRL US Comment Letter; Workiva Comment Letter; DFIN
Comment Letter.
    \45\ See XBRL US Comment Letter; Workiva Comment Letter; DFIN
Comment Letter.
    \46\ See DFIN Comment Letter; Workiva Comment Letter.
    \47\ See DFIN Comment Letter; Workiva Comment Letter; XBRL US
Comment Letter.
    \48\ See Workiva Comment Letter; XBRL US Comment Letter.
---------------------------------------------------------------------------

    With respect to the time period required to effectuate the
potential technical changes to EDGAR access and account management, one
commenter indicated that 66% of its surveyed respondents expressed the
view that an appropriate transition period would be 1-3 years,\49\ one
commenter suggested a transition period of 18-24 months, and another
commenter recommended a transition period of at least one year.\50\
---------------------------------------------------------------------------

    \49\ Workiva Comment Letter (referencing the same filer survey
discussed above).
    \50\ See XBRL US Comment Letter; McGuire/Brownstein Comment
Letter.
---------------------------------------------------------------------------

    The staff engaged in additional dialogue with commenters and other
interested parties regarding the 2021 Request for Comment and further
approaches to EDGAR access improvements.\51\ Among the topics discussed
were APIs for submission and for checking accession numbers (numbers
filers receive from EDGAR indicating receipt of a filing), filing
status, and other information; annual confirmation of individuals
authorized to make submissions on a filer's behalf; whether accession
numbers should be traceable to the individuals making submissions or
instead to the CIK numbers associated with the submissions; bulk
submissions and user group functionality; delegation of authority to
file; a potential transition process to implement the changes
contemplated by the 2021 Request for Comment; and other technical
topics.
---------------------------------------------------------------------------

    \51\ Staff invited interested parties to participate in the
dialogue through the Commission's EDGAR Next web page.
---------------------------------------------------------------------------

    Having considered the significant additional information provided
by commenters in response to the 2021 Request for Comment and the
subsequent dialogue with interested parties, we are contemplating a
number of changes in connection with the EDGAR Next project, including
proposed amendments to Rules 10 and 11 under Regulation S-T and to Form
ID; changes to enhance dashboard functionality; and the addition of
optional APIs to allow machine-to-machine submissions on EDGAR as an
alternative to submission through the EDGAR filing websites.

III. Discussion

    We are proposing amendments to Rule 10 under Regulation S-T
concerning EDGAR filer access and account management and related
matters; Form ID, the application for EDGAR access; and Rule 11 under
Regulation S-T, containing the definitions of terms in Regulation S-T.
Proposed amendments to Rule 10 and Form ID would set forth requirements
for each EDGAR filer to authorize and maintain individual account
administrators to manage the filer's EDGAR account on a dashboard on
EDGAR, and to authorize account administrators, users, and technical
administrators only if those individuals obtained individual account
credentials.\52\ Each filer, through its account administrators, would
be required to confirm annually that all account administrators, users,
technical administrators, and delegated entities reflected on the
filer's dashboard are authorized by the filer to act on its behalf, and
that all information about the filer on the dashboard is accurate;
maintain accurate and current information on EDGAR concerning the
filer's account; and securely maintain information relevant to the
ability to access the filer's EDGAR account.
---------------------------------------------------------------------------

    \52\ We are proposing amendments to Rule 11 under Regulation S-T
to define ``individual account credentials'' as credentials issued
to individuals for purposes of EDGAR access. See the discussion of
proposed amendments to Rule 11 in Section III.E.2.
---------------------------------------------------------------------------

    On the dashboard, account administrators could add and remove
authorized users, account administrators, and technical administrators;
delegate and remove delegated authority to file to other EDGAR
accounts; and annually confirm the accuracy of all information on the
dashboard. The dashboard would contain the filer's corporate and
contact information, generally corresponding to the company information
currently maintained on EDGAR.\53\ The dashboard would be available
during EDGAR operating hours,\54\ such that filers could manage their
EDGAR accounts during the same time period that they would file on
EDGAR.
---------------------------------------------------------------------------

    \53\ The information corresponds to information that filers
presently amend through a ``Company Update'' or ``COUPDAT''
submission. Filers would continue to be able to edit their company
information through COUPDATs under the EDGAR Next changes.
    \54\ Regulation S-T provides that filings ``may be submitted to
the Commission each day, except Saturdays, Sundays, and Federal
holidays, from 6 a.m. to 10 p.m., Eastern Standard Time or Eastern
Daylight Saving Time, whichever is currently in effect.'' 17 CFR
232.12(c). The dashboard would be available from 6.a.m.-10 p.m. as
described above, so that filers could manage their accounts during
the period when EDGAR filings could be submitted.
---------------------------------------------------------------------------

    The Commission would provide optional APIs for machine-to-machine
communication with EDGAR, including to submit filings and to facilitate
filers' retrieval of information regarding their submissions. To use
APIs, filers would be required to authorize two technical
administrators and present certain tokens to EDGAR that we plan to
specify in the EDGAR Filer Manual. Filers who did not wish to use the
APIs would not need to do so and therefore would not need to comply
with the API-related requirements. Those filers could continue to make
submissions through the web-based EDGAR filing websites.

A. Individual Account Credentials

    Under proposed Rule 10(d)(1), a filer could only authorize an
individual to perform functions on the dashboard on the filer's behalf
if the individual possessed individual account credentials, obtained in
the manner specified in the EDGAR Filer Manual. This requirement would
pertain to all existing filers and all individuals acting on behalf of
those filers, as well as all applicants for access to EDGAR.
    We anticipate requiring, through the EDGAR Filer Manual, that
individual account credentials be obtained through Login.gov, a secure
sign in service of the U.S. General Services Administration.\55\
Login.gov is used by participating Federal agencies, as well as State,
local, and territorial governments to provide a secure login process
and to allow members of the public to use a single account that is
protected by encryption, multi-factor authentication, and additional
safeguards.\56\
---------------------------------------------------------------------------

    \55\ https://www.login.gov/.
    \56\ See Login.gov, ``About us,'' at https://www.login.gov/about-us/.
_____________________________________-

    On the Login.gov website, the individual would respond to prompts
to provide an email address and select a multi-factor authentication
option.\57\

The email address provided to Login.gov would be required to match the
email address the filer provides to EDGAR, for example, on Form ID.\58\
After the individual confirmed her email address and completed multi-
factor authentication, Login.gov would issue individual account
credentials to the individual to sign in to EDGAR.
---------------------------------------------------------------------------

    \57\ As of the date of this proposal, Login.gov multi-factor
authentication options include: (1) a security key; (2) Government
employee or military PIV or CAC cards; (3) authentication
application; (4) text message/SMS or telephone call; and (5) backup
codes, with (1), (2), and (3) being the most secure methods, and (5)
being the least secure authentication option according to Login.gov.
See generally Login.gov, Authentication Options at https://www.login.gov/help/get-started/authentication-options/. See also
generally Login.gov, ``Privacy and security: Our security
practices,'' at https://login.gov/policy/our-security-practices/ for
information on Login.gov's security practices.
    \58\ While Login.gov permits multiple email addresses to be
associated with a single Login.gov account, EDGAR would require a
single email address related to the need to access EDGAR be
associated with the individual account credentials. To change an
email address (for example, because of a change of domain name), the
individual would change the email in the dashboard and then change
it on Login.gov to maintain access to EDGAR.
---------------------------------------------------------------------------

    In accord with proposed Rule 10(d), all account administrators,
users, and technical administrators would be required to use their
individual account credentials, and multi-factor authentication, to
sign into all EDGAR filing websites. After entering the Login.gov
username and password, each individual would be prompted to enter a
one-time passcode received through the multi-factor authentication
option the individual selected when obtaining individual account
credentials at Login.gov.\59\
---------------------------------------------------------------------------

    \59\ If the individual lost or forgot her Login.gov password,
the individual would reset the password through Login.gov,
simplifying and automating the process of password retrieval.
---------------------------------------------------------------------------

    Individual account credentials would enhance EDGAR security and
improve the ability of filers to securely maintain access to their
EDGAR accounts. As noted, filers currently share access codes among
multiple individuals, making it difficult to track with whom the codes
are shared or to trace a filing to a specific individual. The use of
individual account credentials would enable Commission staff and filers
to easily determine the individuals making specific filings on EDGAR.
Linking individuals to the filings they make would be particularly
useful for filers and Commission staff when problematic filings are
made on EDGAR and would enhance the security and integrity of the
system.
    The use of individual account credentials would provide additional
assurance that only individuals who have been properly authorized by
the filer or the filer's account administrator could take actions on
the filer's behalf on EDGAR. Currently, the process of filing on EDGAR
requires the filer to use certain EDGAR access codes. EDGAR Next would
enhance security by requiring an individual seeking to make a filing on
EDGAR to sign in with individual account credentials, complete multi-
factor authentication, be authorized by the filer or the filer's
account administrator, and enter the filer's CIK and CCC.
    Multi-factor authentication for individual accounts would be
required to access EDGAR. Multi-factor authentication is a widely
accepted security tool that would improve the security of access to
EDGAR by adding a layer of validation each time an individual signed
into EDGAR. Consistent with general industry practice, and standard
Login.gov processes, individuals could check a box labeled ``remember
this browser'' during the Login.gov sign-in process to preserve their
multi-factor authentication for 30 days if they used the same web
browser for login.\60\
---------------------------------------------------------------------------

    \60\ Consistent with current practice, an individual logged into
EDGAR would be automatically logged out if the individual were idle
for more than 60 minutes, as well as at the end of EDGAR's hours of
operation (10:00 p.m. ET on business days). In each of those cases,
the individual would need to complete multi-factor authentication in
order to log back into EDGAR unless the individual had successfully
signed into EDGAR and checked the ``remember this browser'' box
within the last 30 days.
---------------------------------------------------------------------------

    Under EDGAR Next, the EDGAR password, PMAC, and passphrase would no
longer be used. The historic use of several codes with differing
functions is not in accord with standard access processes. The use of
individual account credentials aligns more closely with streamlined,
modern access processes, including individual login using multi-factor
authentication. The CCC would persist as the code required for filing,
but, as noted, individuals seeking to file would also need to sign in
with individual account credentials, complete multi-factor
authentication, and be authorized by the filer or an account
administrator for the filer. Because of these additional safeguards,
the filer's CCC would be displayed on the dashboard for account
administrators and users.
Requests for Comment
    1. Should we require the use of individual account credentials, as
proposed under Rule 10(d)(1), and multi-factor authentication for all
existing filers, individuals acting on their behalf, and applicants for
access to EDGAR?
    2. Does the filing community have experience with obtaining account
credentials from third-party service providers including or similar to
Login.gov that the Commission should consider? If so, which third-party
service party service providers, and what experience? Would the use of
third-party service providers give rise to any security concerns for
individual or entity filers?
    3. Would the use of individual account credentials give rise to any
concerns regarding costs, confusion, or complexity for individual or
entity filers? Are there specific concerns for individual or entity
filers that make filings with respect to more than one subject company
(e.g., an individual filer who is a board member for more than one
company)? If so, what concerns? Please be specific.

B. Individual Roles: Account Administrator, User, Technical
Administrator

    Under proposed Rule 10(d)(2), each filer would be required as an
initial matter to authorize and maintain at least two individuals with
individual account credentials as account administrators to manage the
filer's EDGAR account and to make submissions on EDGAR on behalf of the
filer,\61\ unless the filer were an individual or single-member
company,\62\ in which case it would be required to authorize and
maintain at least one individual with individual account credentials as
an account administrator.
---------------------------------------------------------------------------

    \61\ See EDGAR Filer Manual, Volume I, at Section 4.
    \62\ As defined in proposed Rule 11 and proposed Form ID, a
``single-member company'' would be a company that has a single
individual who acts as the sole equity holder, director, and officer
(or, in the case of an entity without directors and officers, holds
position(s) performing similar activities as a director and
officer).
---------------------------------------------------------------------------

    Using the dashboard on EDGAR, account administrators, acting on
behalf of the filer, would authorize individuals with individual
account credentials to be users, additional account administrators, or
technical administrators for the filer, as needed. This process is
illustrated in diagram 1 below. Further, account administrators could
de-authorize account administrators, users, and technical
administrators for the filer.

[GRAPHIC] [TIFF OMITTED] TP22SE23.001

    Individuals in each role would perform different functions for the
filer, and an individual's dashboard would display functionality that
corresponded to the respective individual's role, as explained more
fully below.
    An individual could be authorized to perform more than one role for
a filer. For example, one individual could be both an account
administrator and a technical administrator, or one individual could be
both a technical administrator and a user. An account administrator
could not be a user, however, given that account administrators are
able to perform all the functions of a user, including the ability to
file on EDGAR, themselves.
    Analogous additional roles would exist at delegated entities--
filers, including filing agents, to which another filer delegates
authority to file on its behalf. Specifically, the delegated entity's
account administrators would become delegated administrators for the
filer, and delegated administrators would have the ability to authorize
one or more of the delegated entity's users as delegated users who
could make submissions on behalf of that filer.
    The key functions that could be performed by each role are
illustrated in diagram 2 below.

                                                         Diagram 2--Key Functions for Each Role
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Manage account    Delegate  to/
                                                                                administrators,        accept
                                                        Submit     Generate/    users, technical     delegated        Manage       Manage       Manage
                        Role                           filings,   change  CCC   administrators,    entity status    delegated    filer API     user API
                                                      view  CCC                  and delegated      from another      users        token        token
                                                                                entities           filer
--------------------------------------------------------------------------------------------------------------------------------------------------------
Account Administrator..............................           X            X                  X                X   ...........  ...........           X
User...............................................           X   ...........  .................  ...............  ...........  ...........           X
Technical Administrator............................  ...........  ...........  .................  ...............  ...........           X   ...........
Delegated Administrator............................           X   ...........  .................  ...............           X   ...........           X
Delegated User.....................................           X   ...........  .................  ...............  ...........  ...........           X
--------------------------------------------------------------------------------------------------------------------------------------------------------

1. Account Administrators
    Proposed Rule 10 paragraphs (d)(4), (d)(5), and (d)(6) would
require that the filer, through its account administrators, be
responsible to maintain accurate and current information on EDGAR
concerning the filer's account and to confirm that information
annually, as well as to securely maintain information relevant to the
ability to access the filer's EDGAR account, including but not limited
to access through any APIs.
    Under EDGAR Next, account administrators, on behalf of the filer,
would be responsible for the security of the filer's EDGAR account and
the accuracy of the filer's information on EDGAR. Account
administrators would manage the filer's account on the dashboard, which
would display relevant functionality for them to:
     Add and remove users, account administrators, and
technical administrators (including removing themselves as account
administrators);
     Create and edit groups of users;
     Delegate filing authority to other EDGAR accounts, such as
a filing agent's account, and remove such delegations;
     Make the required annual confirmation of all of the
filer's information on the dashboard;
     Generate a new CCC for the filer; and
     View and correct their own profile information (name,
address, phone number, etc.).
    Account administrators could also make submissions on behalf of the
filer on EDGAR, allowing filers to make submissions on EDGAR through
their account administrators without adding individuals as users on the
account.
    In addition, account administrators would serve as the points of
contact for questions from Commission staff regarding the filer's
account.\63\
---------------------------------------------------------------------------

    \63\ Technical administrators would serve as the Commission
staff's points of contact regarding the filer's use of the APIs. See
infra Section III.B.3.a.
---------------------------------------------------------------------------

    Each account administrator would be co-equal, possessing the same
authority and responsibility to manage the filer's EDGAR account. There
would be no primary account administrator. All actions that would be
required to be

performed by account administrators could be performed by any of them
individually and would not require joint action by the filer's account
administrators.
a. Filer Authorization of Account Administrators
    Under the proposal, prospective EDGAR filers would designate on
Form ID the individuals that the filer authorized as account
administrators.\64\ As noted above, pursuant to proposed Rule 10(d)(1),
the filer could only authorize individuals as account administrators if
those individuals had obtained individual account credentials in the
manner specified in the EDGAR Filer Manual.
---------------------------------------------------------------------------

    \64\ A unique process would be employed to transition existing
filers, as discussed in the transition section below (see Section
III.F).
---------------------------------------------------------------------------

    Prospective company filers could authorize as account
administrators either (i) individuals employed at the filer or an
affiliate of the filer or (ii) any other individual, provided the filer
submitted a notarized power of attorney authorizing such other
individual to be its account administrator. Prospective individual
filers could authorize as account administrators either (i) themselves
or (ii) any other individual, provided the filer submitted a notarized
power of attorney authorizing such other individual to be the
individual filer's account administrator.
    A prospective account administrator would complete the prospective
filer's Form ID and electronically submit it, and also upload a
notarized copy of the prospective filer's Form ID signed by an
authorized individual of the prospective filer, as currently required.
The signature of the authorized individual would constitute the filer's
authorization of the account administrators listed on Form ID.
    If the prospective filer sought to authorize another individual as
an account administrator, the prospective filer would additionally be
required to provide Commission staff with a notarized power of attorney
executed by an authorized individual of the prospective filer granting
authority to that individual to be an account administrator. The power
of attorney would be uploaded with the prospective filer's completed,
notarized Form ID.\65\
---------------------------------------------------------------------------

    \65\ Currently, a person with a power of attorney from an
individual filer may sign the Form ID application for the individual
filer; in that case, the power of attorney document must accompany
the notarized Form ID application. See EDGAR Filer Manual, Volume I,
at Section 3. Existing Commission practice also permits the Form ID
to be signed by an individual with a power of attorney from a filing
entity, such as a corporation.
---------------------------------------------------------------------------

    If, after reviewing the Form ID application, Commission staff
granted access to EDGAR to the filer, EDGAR would email the account
administrators listed on Form ID the filer's CIK number and a link to
the relevant EDGAR website, similar to the current process. The account
administrators could then access the filer's dashboard by logging into
EDGAR with their individual account credentials and completing multi-
factor authentication.
    On the dashboard, account administrators could generate a CCC for
the newly issued CIK. The CCC would be securely saved in the dashboard
and would be visible to all account administrators and users, delegated
administrators, and delegated users for that CIK to facilitate their
ability to make submissions on behalf of the filer.
    Account administrators could authorize additional account
administrators via the dashboard. Thus, if the initial account
administrators are determined to be properly authorized to act for the
filer on EDGAR, those initial account administrators would be
authorized to add account administrators.
b. Number of Account Administrators
    As proposed in Rule 10(d)(2), filers who are individuals or single-
member companies would be required to authorize and maintain at least
one account administrator; all other filers would be required to
authorize and maintain at least two account administrators. On the
dashboard, any account administrator could add account administrators
to the filer's EDGAR account; the maximum number of account
administrators would be twenty. After an account administrator invited
the individual on the dashboard, EDGAR would send an email invitation
to the individual at the email address used to create individual
account credentials.
    Requiring most filers to authorize at least two account
administrators would increase the ability of filers to manage their
EDGAR accounts without interruption. Thus, if an account administrator
unexpectedly resigned or otherwise ceased to be available to manage the
filer's account, the remaining account administrators would continue to
manage the filer's account and could authorize additional account
administrators. If the account administrator who sought to resign was
one of the required two account administrators for an entity filer,
then that account administrator could not be removed from the filer's
EDGAR account unless the filer first added another account
administrator through the dashboard to meet the required minimum of two
account administrators. For individual filers and single-member
companies, at least one account administrator would always be required
because those filers typically consist of only one individual. A limit
of twenty account administrators would likely be sufficient to allow
for management of large accounts, while avoiding the confusion that a
larger number of account administrators might cause.
    If all the account administrators for a filer ceased to be
available to manage the filer's account, the filer would be required to
submit a new Form ID to authorize new account administrators.
c. Account Administrator Authorization and Removal of Users, Technical
Administrators, and Other Account Administrators
    An account administrator could add an individual as a user, account
administrator, or technical administrator for an EDGAR account through
the dashboard. The account administrator would enter on the dashboard
the prospective individual's first and last name and email address, and
EDGAR would send an email invitation to that address. The email address
would be required to match the email address provided by the individual
when they obtained individual account credentials. In addition, EDGAR
would send a notification to the individual through the dashboard if
the individual to be added had existing access to the dashboard for
another role or filer. The individual's designation as user, account
administrator, or technical administrator would be effective when the
individual accepted the invitation. Individuals would have fourteen
days within which to accept the invitation.\66\ If the individual did
not accept within that time period, the individual would not be added,
and the invitation would become void. The account administrator could
re-initiate the invitation thereafter, however, to afford the
individual another opportunity to accept.
---------------------------------------------------------------------------

    \66\ If the deadline fell upon a day when the dashboard was not
available (e.g., a holiday or weekend), the deadline would be
deferred until the following business day.
---------------------------------------------------------------------------

    Account administrators could change roles of individuals who had
already been authorized to act on behalf of the filer, by adding or
removing roles as account administrator, user, and/or technical
administrator. The relevant individuals would not be required to accept
additional invitations or de-

authorizations for their role to be changed. An account administrator
could perform all the functions of a user, therefore, an account
administrator could not also be a user since it would be redundant for
an individual to hold both roles for the same filer. An individual
could, however, be both an account administrator and a technical
administrator for the same filer, or a user and a technical
administrator for the same filer.
d. Account Administrator Performance of Annual Confirmation
    As proposed under Rule 10(d)(4), each filer would be required to
perform an annual confirmation on EDGAR of all of the filer's users,
account administrators, technical administrators, and delegated
entities, as well as any other information related to the filer
appearing on the dashboard.\67\ Account administrators would act for
the filer to carry out this function.\68\ Annual confirmation would
assist the filer in tracking those authorized to file on EDGAR and
would provide an opportunity for account administrators to confirm the
accuracy of those individuals and delegated entities associated with
the filer and to remove those no longer authorized.
---------------------------------------------------------------------------

    \67\ As discussed above, the dashboard would contain the filer's
corporate and contact information. See supra text accompanying note
53. If the filer's information contained in the dashboard was not
correct, that information could be updated via a COUPDAT submitted
by the filer's account administrator or user. Proposed paragraph
(d)(4) is analogous to the requirements currently set forth in the
EDGAR Filer Manual, Volume I, to securely maintain EDGAR access and
to maintain accurate company information on EDGAR. See EDGAR Filer
Manual, Volume I, at Sections 4 and 5.
    \68\ As discussed above, in the 2021 Request for Comment, the
Commission sought comment on requiring confirmations to be made by
both account administrators and users. Several commenters objected
to this requirement on the grounds that it would be duplicative and
unduly burdensome for account administrators to confirm all users
authorized to act on behalf of the filer, and for those users to
separately have to confirm their own authorizations. See supra note
45. Other commenters recommended limiting confirmation to
administrators. See supra note 45. To address these commenters'
concerns, our proposal includes the latter group of commenters'
recommendation, requiring only account administrators to confirm
users, account administrators, technical administrators,
delegations, and other information on the filer's dashboard. We
believe that limiting the confirmation to account administrators
should address the concerns from these commenters.
---------------------------------------------------------------------------

    To provide flexibility to filers, EDGAR would allow account
administrators to select one of four quarterly dates as the filer's
ongoing confirmation deadline: March 31, June 30, September 30, and
December 31 (or the next business day, if the date fell upon a weekend
or holiday when EDGAR was not operating). An account administrator need
not wait until the deadline to confirm and could confirm at any earlier
date. An account administrator could further change the quarter when
confirmation was due by confirming the account at a date in a quarter
earlier than the currently selected deadline quarter. Confirmation in
an earlier quarter would result in a confirmation deadline one year
after the end of the quarter in which the early confirmation occurred.
For example, if a December 31 confirmation deadline was selected by the
account administrator for the initial annual confirmation, but the
account administrator submitted the confirmation for the following year
in August, the filer's annual confirmation deadline for the next year
would be September 30 (or the next business day, if the date fell upon
a weekend or holiday when EDGAR was not operating).
    EDGAR would provide several periodic notices to account
administrators of the upcoming confirmation deadline, as well as notice
of completion of confirmation or failure to timely confirm.\69\ There
would also be a two-week grace period following the confirmation
deadline, during which account administrators would receive a final
series of notices reminding them to complete annual confirmation.\70\
---------------------------------------------------------------------------

    \69\ As discussed above, in response to the 2021 Request for
Comment, some commenters suggested that the Commission implement an
active notification process to inform filers of impending
expiration, and the proposed process would follow that approach. See
supra note 46.
    \70\ These notices would be provided in the dashboard and also
be sent via email to all account administrators' email addresses
(e.g., the confirmation deadline notices would be periodically
provided in both email and via the dashboard multiple times leading
up to the deadline to ensure that the account administrators were
fully aware of the pending deadlines). See infra Section III.B.1.f
(discussing notifications to account administrators).
---------------------------------------------------------------------------

    If no account administrator performed the annual confirmation by
the end of the grace period, EDGAR would deactivate the filer's access
and the filer would be required to submit a new Form ID application to
request access to file on EDGAR.\71\ If Commission staff approved the
Form ID application, the filer would continue to have the same CIK
previously assigned and its filing history would be maintained. The
filer's account administrators listed on Form ID would be required,
however, to invite through the dashboard, as if to a new account, any
additional account administrators, technical administrators, and users.
Although the need to reapply for access and, in particular, the need to
invite account administrators, users, and technical administrators
anew, would impose an additional burden on filers, failure to perform
annual confirmation could signal that the filer was no longer managing
or controlling the account. Removing individuals from the filer's
account upon deactivation would safeguard information regarding
individuals whose information was listed on the filer's dashboard. For
example, if someone other than the original filer's account
administrators submitted a Form ID application for access to the
account, and the original account administrators did not respond to
Commission staff's inquiries regarding the new Form ID, the process
outlined above would prevent the new account holder from accessing the
names, addresses, and contact information of the individuals formerly
associated with the account.
---------------------------------------------------------------------------

    \71\ As discussed above, in response to the 2021 Request for
Comment, several commenters urged the Commission to provide a grace
period to filers that failed to perform annual confirmation timely
(as opposed to immediately removing access) and separately requested
that the Commission deny EDGAR access until the administrator
performed annual confirmation (as opposed to inactivating the EDGAR
account). See supra notes 47-48. As discussed below, as part of the
EDGAR Next changes, we would provide multiple notices of the
impending confirmation deadline to account administrators on the
dashboard and by email and also provide a two-week grace period that
would include a series of reminder notices. Collectively, we believe
this would ensure that the filer's account administrators would
receive adequate notice and opportunity to timely perform
confirmation. Deactivating the account due to failure to provide
confirmation therefore would immediately protect the filer because
failure to perform the required confirmation could be a sign that
the account may no longer be managed or controlled by the filer.
---------------------------------------------------------------------------

e. User Groups
    The dashboard would allow an account administrator to group subsets
of the filer's users into user groups. User groups would:
     Be created by an account administrator;
     Consist only of users, not account administrators or
technical administrators;
     Contain only users for the same EDGAR account;
     Contain up to 500 users (corresponding to the maximum
number of users per filer that would be allowed); and
     Not be subject to any numerical limit (i.e., there could
be an unlimited number of user groups).
    The user group function would primarily assist delegated entities
to authorize certain delegated users to file on EDGAR for specific
filers, as explained in the Delegated Entities section below. By
employing user groups, the delegated administrator could add or remove
the ability to file

for a certain filer to all users in the group at once, leading to
efficiencies of time in managing users.
    If an account administrator added an individual to a user group,
the individual would receive an invitation to join the user group. If
the individual accepted, the individual would become a member of the
user group.
2. Users
    Under EDGAR Next, account administrators could authorize
individuals with individual account credentials as users able to make
submissions on EDGAR on behalf of the filer.
a. Authority of Users
    Users would be able to make submissions on EDGAR on the filer's
behalf. On the dashboard, account administrators and Commission staff
could determine which users made which submissions; however, this
information would not be made public on EDGAR. In addition, on the
dashboard, users could:
     Remove themselves as a user for a filer;
     If using APIs, generate, view, and copy their user API
tokens (as discussed further in Section III.D below); and
     View basic information about the filer's account,
including the filer's name, CIK, CCC, and corporate information and
contact information, as well as the contact information for the account
administrators.
    Users could not, however, add or remove individuals from the
dashboard other than themselves. Further, users could not generate a
new CCC.
    Separately, users could submit COUPDATs to update filer information
such as name, address, and state of incorporation, as filers currently
do.
    As part of the login and authentication process for the EDGAR
filing websites, a user would be able to select the CIK of the filer
for which submissions were being made, and that CIK would be reflected
in the accession number \72\ for each of the user's submissions
(``login CIK''). Users could change their login CIK at any time to any
other CIK for which they were authorized.
---------------------------------------------------------------------------

    \72\ An accession number is a unique identifier assigned
automatically to EDGAR submissions for tracking and reference
purposes. The first 10 digits comprise the CIK of the entity making
the submission, which may be an entity with reporting obligations or
a third party (such as a filing agent. The next two digits represent
the year. The last series of digits comprise a sequential count of
submitted filings from that CIK. The count is usually, but not
always, reset to zero at the start of each calendar year.
---------------------------------------------------------------------------

b. Becoming Authorized as a User
    Through the dashboard, an account administrator would invite an
individual to be a user for the filer's account, and the prospective
user would receive an email invitation from EDGAR at the email address
associated with the prospective user's individual account credentials.
In addition, if the prospective user had a role for any EDGAR account,
the notification would also appear on the prospective user's dashboard.
The individual would be required to accept the invitation to become a
user. The individual could then sign in as a user to the filer's EDGAR
account by entering her individual account credentials and completing
multi-factor authentication.
c. Number of Users
    There would be no minimum number of users because account
administrators could make submissions on behalf of the filer. There
would be a maximum of 500 users. We anticipate that 500 users would be
sufficient to accommodate sophisticated filers making a large number of
varied filings.
3. Technical Administrators
    In connection with the EDGAR Next changes, filers would have an
option to use a submission API and related informational APIs, and
filers who opted to use the APIs would be required, through their
account administrators, to authorize at least two technical
administrators to manage API tokens and related technology. Technical
administrators could:
     Issue and deactivate filer API tokens on the dashboard;
     Remove themselves as technical administrators for filers;
     View and correct their own profile information; and
     View basic information about each filer for which they are
designated as a technical administrator, including the filer's
corporate information and contact information.
a. Authority of Technical Administrators
    A technical administrator would issue and deactivate filer API
tokens required to use the APIs, as set forth more fully in the API
discussion in Section III.D. Technical administrators would also serve
as points of contact for questions from Commission staff regarding the
filer's use of the APIs.
    A technical administrator could not add or remove individuals on
the dashboard, except to remove themselves as technical administrator.
Nor could a technical administrator make submissions on EDGAR on the
filer's behalf. Additionally, a technical administrator could not
generate CCCs and could not change company information. A technical
administrator could, however, view relevant filer information on the
dashboard.
    An account administrator could authorize technical administrators
to be account administrators or users as well as technical
administrators. To the extent that individuals designated as technical
administrators also had the role of account administrator or user, they
would additionally be able to perform the functions associated with
that role.
b. Becoming a Technical Administrator
    Identical to the process for users, an account administrator would
invite the prospective technical administrator on the dashboard, and
EDGAR would send the invitation to the email address associated with
the prospective technical administrator's individual account
credentials. In addition, if the prospective technical administrator
already had a role for any EDGAR account, a notification of the
invitation would appear on her dashboard. The prospective technical
administrator would be required to accept the invitation to become a
technical administrator.
c. Number of Technical Administrators
    As proposed, if the filer chose to use an API, the filer, acting
through its account administrator, would be required to designate at
least two technical administrators. This minimum would parallel the
minimum number of individuals required to be account administrators (in
the case of filers other than individuals and single-member companies)
and would reduce the chance that the filer's access to the APIs would
be interrupted. There would be no exception to the two technical-
administrator minimum for individuals and single-member companies,
however, because we anticipate that filers that make a large volume of
submissions--typically large filers and filers who use filing agents--
would use the APIs, and those filers would have sufficient staff to
designate two technical administrators.
    Because a filer would be required to have at least two technical
administrators to use the APIs, the dashboard would not allow a
technical administrator to be removed from a filer's account when only
two technical administrators were authorized on the account. An account
administrator would be required to first add another technical
administrator.

    There would be a maximum of ten technical administrators per filer.
This limit would streamline points of contact with the filer and avoid
confusion at the filer regarding API tokens. For example, having more
than ten possible technical administrators could heighten opportunities
for miscommunication between Commission staff and the filer if issues
arose regarding the use of APIs. Moreover, based on our understanding
of filers' current practice, we do not anticipate that a filer would
require more than ten technical administrators to carry out the
functions of managing technical aspects of the APIs.
Requests for Comment
    4. Should we add a required account administrator role to EDGAR, as
set forth in proposed Rule 10(d)? If not, why not?
    5. As stated in proposed Rule 10(d), at least two account
administrators would be required for filing entities (other than
single-member companies) and one account administrator for individual
filers and single-member companies. Are these minimum numbers of
account administrators appropriate? If not, what minimum numbers of
account administrators would be appropriate? Should individual filers
and single-member companies be required to have more than one account
administrator? If so, why?
    6. Should account administrators be permitted to add and/or remove
other account administrators without the filer's consent? If so, why?
If the filer's consent is not required, should the filer be notified
when a new account administrator is added or removed?
    7. Should a prospective filer's Form ID be required to be completed
and submitted by an account administrator, as set forth in proposed
Rule 10(b)? If not, what would be the advantages and disadvantages of
allowing an individual who was not an account administrator to complete
and submit a Form ID on behalf of an applicant? Please be specific.
    8. In proposed Rule 10(d), each filer, through its account
administrators, would be required to confirm annually the accuracy of
the filer's information on the dashboard; maintain accurate and current
information on EDGAR concerning the filer's account; and securely
maintain information relevant to the ability to access the filer's
EDGAR account, including but not limited to access through any EDGAR
APIs. Should any changes or clarifications be made to the proposed
responsibilities of filers to be carried out by account administrators
in proposed Rule 10(d)? If so, how and why should such changes or
clarifications be made? Should any guidance be provided with regards to
any of these responsibilities and, if so, how and why?
    9. Should any changes be made to the authorization process for
account administrators? For example, in the case of company filers,
should employees of the filer's affiliate be required to be
authenticated via a notarized power of attorney? If so, why?
    10. Should any changes be made to the scope of the proposed annual
confirmation requirement set forth in proposed Rule 10(d)? Why? Should
the confirmation be performed annually, more frequently, or less
frequently? Why? As currently contemplated as part of EDGAR Next, in
the case of a failure to satisfy the proposed annual confirmation
requirement, should there be a grace period for the account
administrators to satisfy the confirmation requirements before the
account is deactivated? How long should this grace period be, if
adopted? Regardless of whether a grace period is provided, should
failure to satisfy the proposed annual confirmation requirement result
in deactivation of the account with removal of the individuals
authorized on the dashboard for the filer, as discussed above, or
alternatively, would a temporary suspension of EDGAR access without
removal of any of the individuals authorized on the dashboard for the
filer be more appropriate, until any of the listed account
administrators satisfied the confirmation requirement? Why? How long
should the described temporary suspension be, if adopted? Separately,
if failure to satisfy the proposed annual confirmation requirements
should result in deactivation of the account with removal of the
individuals authorized on the dashboard of the filer, as discussed
above, should delegated entities and delegating filers also be removed
from the dashboard? Why or why not?
    11. Would the annual confirmation requirement create any additional
burden for filers compared to the current annual EDGAR password update
requirement? If so, are there any improvements to the proposed annual
confirmation requirement that would reduce the burden for filers?
Separately, are there any particular concerns for filers who may only
engage in occasional filings, such as filers pursuant to section 16 of
the Securities Exchange Act of 1934 who may make sporadic submissions
of Forms 3, 4, and 5 less than once per year? If so, to what extent
would those concerns be newly implicated by the proposal, given that
currently filers must change their password annually or their access to
EDGAR is deactivated?
    12. Are there any considerations regarding the annual confirmation
requirement that are specific to individual or entity filers that make
filings with respect to more than one subject company (e.g., an
individual filer who is a board member for more than one company)?
Should the confirmation requirement differ for such filers? If so, why?
    13. Should we add a user role to EDGAR? If not, how would we
address our policy concerns regarding the identification and
authorization of individuals who make submissions on the filer's
behalf? Is a limit of 500 authorized users per filer appropriate, or
should that number be increased or decreased? Should account
administrators be able to add users only for a specific filing or for a
specific period of time, after which the user's authorization
automatically expires? Should any changes or clarifications be made to
the scope of authority of users as part of EDGAR Next? If so, how and
why should the scope of authority of users be different, or how could
the tasks within the scope of authority for users be clarified?
    14. Should we add a technical administrator role to EDGAR, as set
forth in proposed Rule 10(d)? If not, how would we address our policy
concerns regarding the identification and authorization of the
individuals who would manage the filer's APIs?
    15. Would the requirement of at least two technical administrators
to manage the filer's APIs, as set forth in proposed Rule 10(d), create
an undue burden for filers? Should this requirement be revised to more
fully parallel the limit for account administrators by requiring only
one technical administrator for filers who are individuals and single-
member companies? Why or why not? Is a maximum number of ten technical
administrators appropriate? Why or why not? Should any changes or
clarifications be made to the scope of authority for technical
administrators as part of the EDGAR Next changes?
    16. For what purposes, if any, would filers need to access the
dashboard when EDGAR filing functionality was not available? If the
dashboard were made available to filers for a period of time outside of
EDGAR operating hours, in addition to during EDGAR operating hours,
would filers be impacted by the unavailability of filer telephone and
email support and EDGAR submission capabilities during that time
period?

How would they be impacted? Please be specific.

C. Delegated Entities

    Under EDGAR Next, a filer could delegate authority to file on its
behalf to any other EDGAR filer, such as a filing agent, which would
become a delegated entity for the filer.
1. Delegating Authority To File
    An account administrator would delegate authority to file by
entering the prospective delegated entity's CIK on the dashboard. EDGAR
would then send an email invitation to all account administrators of
the prospective delegated entity; in addition, the invitation would
appear on the dashboard of the prospective delegated entity's account
administrators.
    One account administrator for the prospective delegated entity
would be required to accept the invitation for the delegation to become
effective. If no account administrator for the prospective delegated
entity accepted within fourteen days of it being issued, the invitation
would lapse; however, the filer could again follow the process outlined
herein to issue another invitation.\73\
---------------------------------------------------------------------------

    \73\ If the deadline fell upon a day when the dashboard was not
available (e.g., a holiday or weekend), the deadline would be
deferred until the following business day.
---------------------------------------------------------------------------

    If the filer's account administrators wished to terminate the
delegation, they could do so on the dashboard by removing the delegated
entity's authority to file. Removal of delegation would not require
acceptance by the delegated entity.
    An account administrator could delegate authority to file to an
unlimited number of EDGAR accounts, allowing filers to delegate to
multiple filing agents, for example, should they so choose.
2. Separation of Authority of Filer and Delegated Entity
    An account administrator could not add or remove individual
delegated users at the delegated entity, nor could the account
administrator access the delegated entity's dashboard or account.
    Delegated administrators and delegated users could file on the
filer's behalf, but they could not take any other actions on behalf of
the filer. Nor could they access the filer's dashboard.\74\ For
example, a delegated administrator could not add, remove, or confirm
account administrators, users, or technical administrators for the
filer. Similarly, delegated administrators would not be able to
generate or reset the filer's CCC, nor would delegated administrators
or delegated users be able to make COUPDAT submissions for the
filer.\75\ Delegated administrators and delegated users would not count
towards the limits of 20 account administrators and 500 users for the
filer under EDGAR Next.\76\
---------------------------------------------------------------------------

    \74\ As discussed further below in Section III.C, the dashboard
would generally be used to manage a filer's EDGAR account, including
management of individuals authorized to act as account
administrators, users, and technical administrators; management of
entities authorized to act as delegated entities; and management of
filer and user API tokens. Delegated entities would not need to
access the filer's dashboard in order to make filings on the filer's
behalf, since filings would be made directly on the EDGAR filing
websites, as opposed to through the filer's dashboard.
    \75\ As currently planned, delegated administrators and
delegated users would not be able to make COUPDAT submissions for
the filer. Delegated administrators and delegated users could,
however, continue to submit series and company update submissions,
or SCUPDATs, for registered investment company clients according to
the present process.
    \76\ See Section III.B.1.b. and III.B.2.c (discussing limits of
account administrators and users per filer).
---------------------------------------------------------------------------

    Delegated entities could receive and provide multiple delegations,
but they could not further delegate authority to file to other entities
on behalf of filers who delegate authority to them. For example, Filer
A could delegate authority to file on its behalf to Filer B.
Separately, Filer B could delegate authority to file on its behalf to
Filer C. In this scenario, however, Filer B could not delegate to Filer
C the authority to file on behalf of Filer A, and Filer C could not
file on behalf of Filer A.
3. Delegated Entities
    As EDGAR filers, delegated entities would be required to comply
with the same requirements applicable to all filers.
    A delegated entity could be any EDGAR account, including but not
limited to:
     Filing agents; \77\
---------------------------------------------------------------------------

    \77\ We are proposing amendments to Rule 11 under Regulation S-T
to define a ``filing agent'' as any person or entity engaged in the
business of making submissions on EDGAR on behalf of filers. This
would include law firms, financial services companies, and other
entities engaged in the business of submitting EDGAR filings on
behalf of their clients. See the discussion of proposed amendments
to Rule 11 in Section III.E.2.
---------------------------------------------------------------------------

     Issuers, broker-dealers, and others making submissions on
behalf of individuals filing pursuant to section 16 of the Securities
Exchange Act of 1934;and
     Parent companies of large groups of related filers.
    A delegated entity would maintain its separate EDGAR account with
its own account administrators, users, and technical administrators.
    A delegated entity could receive delegated authority to file for an
unlimited number of filers.
    We contemplate that individuals with section 16 filing obligations
could delegate authority to file to relevant company filers under the
construct set forth herein, if they wished to do so. In response to the
2021 Request for Comment, several commenters suggested that the
Commission permit the creation of company-specific accounts for each
individual with filing obligations pursuant to section 16 of the
Exchange Act.\78\ Commenters stated that such accounts would allow
individuals to delegate their EDGAR account administration
responsibilities to the companies for which those individuals had
section 16 filing obligations.\79\ This framework would make it
difficult for the Commission and others to track the filings made by a
specific individual, however, since each filing would be made by a
different company-specific account without linking individuals to the
accounts or the filings made therein. The delegation process described
herein would make it easier for individuals to obtain assistance with
their filings, while allowing the Commission and others to determine
filings made by a specific individual. We therefore do not plan to
implement the commenters' suggestion.
---------------------------------------------------------------------------

    \78\ See supra notes 41-42.
    \79\ See supra notes 41-42.
---------------------------------------------------------------------------

    If a filer authorized a delegated entity to file on its behalf, one
of the delegated entity's account administrators would be required to
accept the invitation; further, upon acceptance, all of the delegated
entity's account administrators would automatically become delegated
administrators for the filer. All delegated administrators for the
filer would have co-equal authority with regard to that filer. If the
delegated entity added or removed one of the account administrators for
its own EDGAR account, then that individual would also be added or
removed as a delegated administrator for the filer. These relationships
are illustrated in diagram 3 below.

[GRAPHIC] [TIFF OMITTED] TP22SE23.002

4. Delegated Users
    If a delegated entity accepted a delegation from a filer, the
delegated administrators could authorize specific users at the
delegated entity to become delegated users with respect to that filer.
Delegated users would not count as part of the 500-user limit for the
filer.\80\
---------------------------------------------------------------------------

    \80\ See supra Section III.B.2.c.
---------------------------------------------------------------------------

    Alternately, if delegated administrators wanted all of their users
to become delegated users with respect to a filer, the delegated
administrators could check a box to automatically designate all of the
users at the delegated entity as delegated users for the filer.
    Thus, delegated administrators would have the following options:
     Authorize a subset of the delegated entity's users as
delegated users, through the user group function, as discussed above
and further explained below;
     Authorize all of the delegated entity's users as delegated
users for the filer; or
     Not authorize any delegated users (because the delegated
administrators could file on behalf of the filer \81\).
---------------------------------------------------------------------------

    \81\ For this reason, delegated administrators could not be
designated as delegated users with regards to the delegating filer,
because doing so would be redundant.
---------------------------------------------------------------------------

    Users at the delegated entity would receive notifications if a
delegated administrator added or removed them as a delegated user for a
particular filer, however, users would not need to accept the
notification or take any further action to become a delegated user for
a filer.
    Delegated users could submit filings on behalf of the filer on the
EDGAR filing websites or through the submission API (which would also
require the user to generate and submit a user API token, as discussed
further below).
5. User Groups at Delegated Entities
    We believe that the user group function would provide an efficient
method for delegated administrators to manage delegated users.
Delegated entities, through their delegated administrators, could
employ user groups to assign certain users to different filers for whom
they possessed delegated authority to file. An example is provided in
diagram 4 below.

[GRAPHIC] [TIFF OMITTED] TP22SE23.003

     In diagram 4, the account administrators for Filer A and
Filer B delegated to Filer C. As a result, Filer C's account
administrators became delegated administrators for Filers A and B. In
this example, Filer C might be a filing agent to which Filer A or Filer
B gave authority to make filings on its behalf, and Filer A and Filer B
might be public companies or investment companies.
     A delegated administrator at Filer C created User Group 1
containing Filer C's Users 1, 2, and 3. The delegated administrator
assigned authority to file for Filer A to User Group 1. Users 1, 2, and
3 are thus delegated users for Filer A because they are members of User
Group 1. If additional users from Filer C were added to User Group 1,
those additional users would also become delegated users for Filer A.
     The delegated administrator at Filer C also created User
Group 2 containing Filer C's User 3. The delegated administrator
assigned authority to file for Filer B to User Group 2. User 3 is a
delegated user for Filer B.
     By employing the user group function, the delegated
administrator at Filer C restricted delegated filing permissions for
Filer A to Filer C Users 1, 2, and 3 only (via User Group 1) and
delegated filing permissions for Filer B to Filer C User 3 only (via
User Group 2). Filer C User 4 has not been authorized as a delegated
user for any filers.
     In diagram 4, each user group has only been assigned
authority to file for a single filer, but user groups could be assigned
authority to file for multiple filers.
    Delegated administrators could also designate a default user group
of individuals who would be automatically assigned as delegated users
for all future delegations. The ability to have a default user group
would be an efficient way for delegated administrators to authorize
groups of their users as delegated users for any delegating filer.
    Users would receive notifications when added to or removed from a
user group, and when the user group to which they belonged became
authorized to make submissions for a filer, or when that authorization
was removed. Users would not need to accept or otherwise take any
action on these notifications.
6. Technical Administrators at Delegated Entities
    If the delegated entity chose to use APIs, the delegated entity
would be required to designate its own technical administrators. The
delegated entity's technical administrators would be responsible for
maintaining the API capabilities for filings by the delegated entity.
They would manage the delegated entity's own filer API tokens, as
discussed further in Section III.D.1, and the delegated entity would
use the delegated entity's filer API tokens to make filings for any
filers that delegated authority to it. Technical administrators at the
delegated entity would not manage any APIs in use by the filer itself.
Nor would the technical administrator need different tokens for
different filers that delegated to the delegated entity.
Requests for Comment
    17. Should we add individual roles to EDGAR for delegated
administrators and delegated users? If not, how should we address our
policy concerns regarding the identification and authorization of the
delegated individuals who would submit filings on the filer's behalf?
    18. Should account administrators be able to delegate filing
authority to any EDGAR filer (and remove such delegation)? Do
commenters have any concerns with the delegation function or any
suggested modifications? For example, should delegation be limited to
EDGAR filers that selected ``filing agent'' as the account type on Form
ID when opening the account? Or should delegation be permitted to any
EDGAR account, as proposed? Why?
    19. Would the EDGAR Next delegation framework address concerns
raised by commenters about the impact that the contemplated EDGAR Next
changes would have on individual officer and director filers pursuant
to section 16 of the Exchange Act, in light of the fact that individual
officer and director filers could delegate authority to file on their
behalf to any related companies, law firms, or filing agents? Why or
why not?
    20. Should any changes be made to the authority of delegated
administrators and delegated users under EDGAR Next?
    21. Are there any situations where the EDGAR Next delegation
framework could be streamlined?
    22. Would user group functionality facilitate the ability of
account administrators and delegated

administrators to efficiently add and remove users and delegated users?
Why or why not? Should any changes to user group functionality be made?

D. Application Programming Interfaces

    As part of the EDGAR Next changes, the Commission would offer APIs
to filers to allow machine-to-machine communication with EDGAR. The
Commission plans initially to provide three APIs to allow filers to:
     Make both live and test submissions on EDGAR (``submission
API'');
     Check the status of an EDGAR submission (``submission
status API''); and
     Check EDGAR operational status (``EDGAR operational status
API'').
    Pursuant to proposed Rule 10(d)(3), to use the APIs, filers would
be required to authorize at least two technical administrators.
    Additionally, we plan to specify in the EDGAR Filer Manual that, to
use the APIs, filers would be required to present filer API tokens and
user API tokens to EDGAR that would be generated on the dashboard. The
filer's technical administrators would be required to generate a filer
API token to authenticate the filer. Further, the individual user or
account administrator who submits the filing would be required to
generate a user API token to authenticate herself as an authorized user
or account administrator for the filer. We plan that filer and user API
tokens would be confidential alphanumeric strings of text separately
generated in the dashboard by a technical administrator and a user,
respectively, and each would be valid for one year.\82\ Employing these
tokens would allow automated server-to-server authentication without
the need for manual individual account credential multi-factor
authentication, thus addressing a significant concern raised by
commenters in the 2021 Request for Comment.\83\
---------------------------------------------------------------------------

    \82\ As a security measure, we contemplate that the user API
token would be deactivated if the user had not successfully logged
into the EDGAR Filer Management dashboard or one of the EDGAR filing
websites (EDGAR Filing or EDGAR Online Forms) within the last 30
days.
    \83\ See supra notes 38-39.
---------------------------------------------------------------------------

    In addition, as they would with other similar APIs, filers would
need to create, license, or otherwise obtain software (a ``filing
application'') to interface with the APIs. Additional information
regarding the APIs is available in the Overview of EDGAR Application
Programming Interfaces (``Overview of EDGAR APIs'') located on the
EDGAR Next page on SEC.gov.
    The use of APIs would be optional. Filers that seek to file on
EDGAR, check the status of a submission, or check EDGAR operational
status would continue to be able to do so without using an API, as they
currently do.
1. Submission API
    The submission API would provide filers a new option to submit test
and live filer-constructed EDGAR submissions through a machine-to-
machine connection.\84\ Filers who do not wish to use the API to make
filer-constructed submissions, and filers making other types of
submissions, could file through the web-based EDGAR filing
websites.\85\
---------------------------------------------------------------------------

    \84\ Currently, EDGAR accepts approximately 525 submission
types, of which approximately 500 (95%) permit filer construction.
    \85\ Whether submissions were made through the API or the EDGAR
filing websites, filers would specify the CIK for which they would
be making submissions. That CIK number would be reflected in the
accession number associated with those submissions. Filers could
change the login CIK reflected in the accession number at any time
to any other CIK for which the filer was authorized to file on
EDGAR. For example, a filing agent could choose to submit filings
for a client filer using its own login CIK, or by using its client
filer's login CIK.
---------------------------------------------------------------------------

    To use the optional submission API, filers would be required to
comply with certain requirements. For filer API tokens, we plan that:
     A filer API token would be needed to identify the filer or
filing agent accessing the API.
     Only the filer's authorized technical administrator could
create filer API tokens.
     Filers could have multiple, valid filer API tokens (for
example, to identify different subsidiaries or divisions within the
filer) in use at the same time.
     A technical administrator would need to log into the
dashboard and be authenticated with individual account credentials to
create a filer API token.
     A technical administrator could terminate a filer API
token on the dashboard at any time.
     A filer API token would remain valid for up to one year.
     While valid, a filer API token could be used to submit an
unlimited number of filings.
    For user API tokens, we plan that:
     Only a user, delegated user, or account administrator for
the filer associated with the filer API token could be authorized as a
user for the API.
     A user API token would be needed to identify the user
associated with each submission.
     Users would have only one valid user API token at a given
time.
     A user would log into the dashboard and be authenticated
with individual account credentials to create a user API token.
     A user API token would remain valid for up to one year
provided that the user associated with the token logged into the
dashboard or one of the EDGAR filing websites at least every 30 days.
If the user did not log in at least every 30 days, the user API token
would be deactivated.
     A user could terminate its user API token on the dashboard
at any time.
     While valid, a user API token could be used to submit an
unlimited number of filings.
    The Overview of EDGAR APIs lists certain technical standards for
the submission API, as well as the expected inputs and outputs.
2. Submission Status API
    Currently, EDGAR receives significant network traffic inquiring as
to the status of EDGAR submissions. Many filers check EDGAR submission
status immediately upon making a filing and again regularly until the
submission is accepted and ultimately disseminated, or alternately
suspended. This may result in significant network traffic for EDGAR and
represent a tedious manual process for filers. Providing a submission
status API would allow filers to use their filing application to
simultaneously check the status of multiple submissions in a batch
process, instead of manually logging into EDGAR and individually
checking the status of each submission.
    The Overview of EDGAR APIs lists certain technical standards for
the submission status API, as well as the expected inputs and outputs.
Among other things, the submission status API would require a valid
filer API token; it would not require a user API token. The submission
status API would indicate to the filing application whether each
submission was submitted and accepted, but not yet publicly
disseminated; \86\ submitted and accepted, and publicly disseminated;
or submitted and suspended. In turn, the filing application would
display this information to the filer.
---------------------------------------------------------------------------

    \86\ Generally, filings are first accepted and then subsequently
disseminated. However, certain filings remain nonpublic and are
never disseminated, so those filings will never progress from
accepted to disseminated status.
---------------------------------------------------------------------------

3. EDGAR Operational Status API
    Many filers check EDGAR operational status continuously throughout
the filing day. This may result in significant network traffic for
EDGAR and constitute a tedious manual process for

filers. Providing an EDGAR operational status API would allow filers to
use their filing application to check the operational status of EDGAR
at any given time.
    The Overview of EDGAR APIs lists certain technical standards for
the EDGAR operational status API, as well as the expected inputs and
outputs. Among other things, the EDGAR operational status API would
require a valid filer API token to be submitted by the filing
application; it would not require a user API token. The EDGAR
operational status API would indicate to the filing application whether
EDGAR was fully operational, unavailable (after business hours), or not
fully operational in whatever regard at that point in time (for
example, if EDGAR is not disseminating to SEC.gov). In turn, the filing
application would display this information to the filer.
Requests for Comment
    23. Should we add other EDGAR information that could be accessed
through APIs, and, if so, why? Please rank in terms of priority any
additional information that you would like to see added, and also
estimate how much usage you believe that information API would receive
(for example, in potential hits per day).
    24. The Overview of EDGAR APIs lists certain technical standards
for the planned APIs. Are there any considerations we should take into
account when determining what technical standards should be used for
the planned APIs?

E. Proposed Amendments to Rules and Forms

1. Rule 10 Under Regulation S-T
    We propose to add new paragraph (d) to Rule 10 to implement the
changes being contemplated as part of EDGAR Next. Proposed paragraphs
(d)(1) through (4), are discussed in full above.\87\
---------------------------------------------------------------------------

    \87\ See supra Section I, III.A, III.B, III.C, and III.D.
---------------------------------------------------------------------------

    We further propose to add new paragraph (d)(5) to require that the
filer, through its authorized account administrators, maintain accurate
and current information on EDGAR concerning the filer's account,
including but not limited to accurate corporate information and contact
information, such as mailing and business addresses, email addresses,
and telephone numbers. This would constitute an ongoing obligation for
the filer to update its information on EDGAR as necessary. Similar to
proposed paragraph (d)(4), proposed paragraph (d)(5) is analogous to
the requirements currently set forth in the EDGAR Filer Manual, Volume
I to securely maintain EDGAR access \88\ and to maintain accurate
company information on EDGAR.\89\ The proposed requirement in paragraph
(d)(5) would allow Commission staff and the public to rely upon the
accuracy of the filer's information contained in EDGAR.
---------------------------------------------------------------------------

    \88\ EDGAR Filer Manual, Volume I, at Section 4.
    \89\ EDGAR Filer Manual, Volume I, at Section 5.
---------------------------------------------------------------------------

    Proposed paragraph (d)(6) would require the filer, through its
authorized account administrators, to securely maintain information
relevant to the ability to access the filer's EDGAR account, including
access through any EDGAR API. This requirement is designed to ensure
that information relevant to the ability to access the filer's account,
such as individual account credentials and API tokens, is securely
maintained and not publicly exposed or otherwise compromised. Similar
to proposed paragraphs (d)(4) and (d)(5), proposed paragraph (d)(6) is
analogous to the requirements currently set forth in the EDGAR Filer
Manual, Volume I to securely maintain EDGAR access and to maintain
accurate company information on EDGAR.
    The Commission also proposes to amend Rule 10 to make certain
technical and conforming changes. Rule 10(b) would be revised to refer
to ``each electronic filer'' who would be required to submit Form ID
before filing on EDGAR, instead of ``each registrant, third party
filer, or filing agent.'' \90\ This change is not intended to alter the
scope of who would be subject to Rule 10(b), but instead clarifies that
all new electronic filers would be required to submit Form ID for
review and approval by Commission staff before they may file on EDGAR.
---------------------------------------------------------------------------

    \90\ Compare Rule 10(b) of Regulation S-T (``Each registrant,
third party filer, or filing agent must, before filing on EDGAR . .
.'' with proposed Rule 10(b) of Regulation S-T (``Each electronic
filer must, before filing on EDGAR . . .'').
---------------------------------------------------------------------------

    In addition, we propose to amend Rule 10(b)(2), which currently
states that an authenticating document for Form ID must be signed by
the applicant, to also state that the authenticating document may be
signed by an authorized individual of the prospective filer.\91\ This
change is intended to conform the language in Rule 10(b)(2) with the
text of the EDGAR Filer Manual, which currently provides that the
authenticating document shall be signed by an authorized individual,
including a person with a power of attorney.\92\
---------------------------------------------------------------------------

    \91\ Compare Rule 10(b)(2) of Regulation S-T (``File . . . a
notarized document, signed by the applicant . . .'' with proposed
Rule 10(b)(2) of Regulation S-T (``File . . . a notarized document,
signed by the electronic filer or its authorized individual . .
.'').
    \92\ See EDGAR Filer Manual, Volume I, at Section 3(a).
---------------------------------------------------------------------------

    Finally, we propose to revise the note to Rule 10 that currently
``strongly urges'' potential applicants for EDGAR access to state that
the Commission staff carefully reviews each Form ID application and
filers should not assume that the Commission staff will automatically
approve the Form ID. Therefore, filers should submit Form ID ``well in
advance'' of their first required filing.\93\ We believe this makes
clear that Commission staff requires time to review the Form ID. Due to
the often high volume of Form ID applications for Commission staff
review, potential applicants should allow sufficient time for the
review process to be conducted in the event that staff is concurrently
reviewing a high volume of applications.
---------------------------------------------------------------------------

    \93\ As proposed, the note states: ``The Commission staff
carefully reviews each Form ID application, and electronic filers
should not assume that the Commission staff will automatically
approve the Form ID upon its submission. Therefore, any applicant
seeking EDGAR access is encouraged to submit the Form ID for review
well in advance of the first required filing to allow sufficient
time for staff to review the application.''
---------------------------------------------------------------------------

Requests for Comment
    25. Do the proposed amendments to Rule 10 described above
appropriately implement the proposed technical and conforming changes?
Should additional or fewer changes be made to Rule 10 and, if so, why?
For example, should specific requirements be added to Rule 10 that
place requirements directly upon users, delegated entities, and
technical administrators, as opposed to placing requirements upon
account administrators to manage users, delegated entities, and
technical administrators? Why or why not? Are there any technical,
conforming, or clarifying changes to Rule 10 that should be made, and
if so, why?
2. Rule 11 Under Regulation S-T
    We also propose to amend Rule 11 under Regulation S-T,
``Definitions of terms used in this part,'' to add and define new terms
discussed in this proposing release and update the definitions of
certain existing terms. The proposed amendments include terms and
definitions specific to the proposed rule and form amendments that
would change how individuals and entities access, file on, and manage
EDGAR accounts.
    Certain terms would define the new roles for individuals
contemplated by EDGAR Next, as follows:

    ``Account administrator'' would mean the individual that the filer
authorizes to manage its EDGAR account and to make filings on EDGAR on
the filer's behalf. The designation of an account administrator would
help ensure that only authorized persons are able to file and take
other actions on behalf of the filer.
    ``Authorized individual'' would mean an individual with the
authority to legally bind the entity or individual applying for access
to EDGAR on Form ID, or an individual with a power of attorney from an
individual with the authority to legally bind the applicant. The power
of attorney document must clearly state that the individual receiving
the power of attorney has general legal authority to bind the applicant
or specific legal authority to bind the applicant for purposes of
applying for access to EDGAR on Form ID.
    ``Delegated entity'' would mean a filer that another filer
authorizes on the dashboard to file on its behalf. As itself a filer, a
delegated entity would be subject to all applicable rules for filing on
EDGAR. Delegated entities would not be permitted to further delegate
authority to file for the delegating filer, nor would they be permitted
to take action on the delegating filer's dashboard.
    ``Filing agent'' would mean any person or entity engaged in the
business of making submissions on EDGAR on behalf of filers. As
discussed above in Section III.C., to act as a delegated entity for a
filer, a filing agent would be a filer with an EDGAR account.
    ``Single-member company'' would describe a company that only has a
single individual who acts as the sole equity holder, director, and
officer (or, in the case of an entity without directors and officers,
holds position(s) performing similar activities as a director and
officer).
    ``Technical administrator'' would mean an individual that the filer
authorizes on the dashboard to manage the technical aspects of the
filer's use of EDGAR APIs on the filer's behalf.
    ``User'' would mean an individual that the filer authorizes on the
dashboard to make submissions on EDGAR on the filer's behalf.
    Other terms would identify new applications and upgrades to access
and maintain filers' accounts on EDGAR, including:
    ``Application Programming Interface'' (API) would be defined as a
software interface that allows computers or applications to communicate
with each other. As discussed in Section III. D., the relevant APIs
would include those that give filers the option to automate submissions
on EDGAR and to retrieve certain submission-related information.
    ``Dashboard'' would mean an interactive function on EDGAR where
filers manage their EDGAR accounts and where individuals that filers
authorize may take relevant actions for filers' accounts.
    ``Individual account credentials'' would mean credentials issued to
individuals for purposes of EDGAR access, as specified in the EDGAR
Filer Manual, and used by those individuals to access EDGAR. (As
previously mentioned, we currently anticipate that the EDGAR Filer
Manual would specify that individual account credentials must be
obtained through Login.gov, a sign-in service of the United States
Government that employs multi-factor authentication.)
    Collectively, these terms would assist in implementing the proposed
rule and form amendments by clarifying how the proposed requirements
would apply.
    The amendments would also update or delete outdated terminology
from certain definitions in Rule 11, such as references to ``telephone
sessions'' in the definition of ``direct transmission.'' \94\ Although
some filers may still use dial-up internet to access EDGAR, we expect
that nearly all filers currently rely on broadband, cable, or other
internet technologies.
---------------------------------------------------------------------------

    \94\ Compare the definition of ``direct transmission'' in Rule
11 of Regulation S-T (``the transmission of one or more electronic
submissions via a telephonic communication session'') with the
definition of ``direct transmission'' in proposed Rule 11 of
Regulation S-T (``the transmission of one or more electronic
submissions'').
---------------------------------------------------------------------------

    Finally, we propose updating the definition of ``EDGAR Filer
Manual'' to more clearly describe its contents. Rule 11 currently
defines ``EDGAR Filer Manual'' as ``. . . setting out the technical
format requirements for an electronic submission.'' The EDGAR Filer
Manual has been updated over time, however, to include additional
requirements for filers, including those pertaining to seeking EDGAR
access, maintaining EDGAR company information, and submitting online
filings. We therefore propose to update the EDGAR Filer Manual
definition accordingly to indicate the inclusion of these procedural
requirements. We believe that the amended definition, if adopted, would
better inform filers of the scope of the EDGAR Filer Manual
requirements.
Requests for Comment
    26. Do the proposed amendments to Rule 11 appropriately define the
necessary terms in EDGAR Next? If not, please explain. Are there any
additional terms that should be defined and, if so, why?
    27. As proposed, should we amend certain terms to update
terminology or more clearly define existing definitions? Are there any
proposed terms that are inconsistent with existing definitions or
concepts or that otherwise should not be defined? Should any additional
terms be revised to update outdated terminology or to clarify existing
definitions? Please be specific.
3. Form ID
    Form ID is an online fillable form that must be completed and
submitted to the Commission by all individuals, companies, and other
organizations who seek access to file electronically on EDGAR.\95\
Among other things, Form ID seeks information about the identity and
contact information of the applicant. The proposed amendments to Form
ID include proposed changes to information required to be reported on
the form as well as technical changes.
---------------------------------------------------------------------------

    \95\ Compare Rule 10(b) (providing that each registrant, third
party filer, or agent seeking EDGAR access must submit Form ID) with
proposed Rule 10(b) (providing that each electronic filer seeking
EDGAR access must submit Form ID).
---------------------------------------------------------------------------

    As outlined above, the proposed amendments to Form ID would require
an applicant for EDGAR access to undertake certain additional
disclosure obligations, including most significantly:
    (1) Designating on Form ID specific individuals the applicant
authorizes to act as its account administrators to manage its EDGAR