70. The proposed amendments contain a description of how the Plan
Processor would generate a Customer-ID, which would be made available
to Regulatory Staff for queries, by using a two-phase transformation
process that does not require ITINs, SSNs, or EINs to be reported to
the CAT. Is the description of this process sufficient for a clear
understanding of the process? Is the description of the process
sufficient for a clear understanding of the process for generating a
Customer-ID for a Customer that does not have an ITIN/SSN (e.g., a non-
U.S. citizen Customer)? Would additional detail be beneficial for
understanding the process? If so, please explain what kind of detail
would be helpful.
    71. The proposed amendments state that Industry Members or
Regulatory Staff will transform the ITINs, SSNs, or EINs of a Customer
using the CCID Transformation Logic into a Transformed Value, which
will be submitted to the CCID Subsystem with any other information and
additional elements required by the Plan Processor to establish a
linkage between the Customer-ID and Customer and Account attributes.
Are there other factors that would impact the ability of Industry
Members or Regulatory Staff to execute the transformation process as
described and to submit Transformed Values to the CCID Subsystem? If
so, please explain.
    72. For Industry Members, the proposed amendments state that the
CCID Transformation Logic will be either embedded in the CAT Reporter
Portal or used by the Industry Member in machine-to-machine processing.
Would additional detail be helpful for understanding the process? Do
commenters understand what is meant by machine-to-machine processing?
Please explain what kind of additional detail would be helpful.
    73. Do commenters agree that requiring the CCID Subsystem to be
implemented using network segmentation principles to ensure that
traffic can be controlled between the CCID Subsystem and other
components of the CAT System, with strong separation of duties between
it and all other elements of the CAT System, would be an effective
mechanism to provide protection against unlawful access to the CCID
Subsystem and any other component of the CAT System? Would additional
requirements be beneficial? If so, please specify and explain why it
would be appropriate to include them.
    74. As proposed, the Participants would be required to meet certain
standards with respect to the process for creating Customer-IDs, i.e.,
ensuring the timeliness, accuracy, completeness, and integrity of a
Transformed Value, and ensuring the accuracy and overall performance of
the CCID Subsystem. Do commenters agree that these standards would
serve to accomplish the purpose of accurately attributing order flow to
a Customer-ID? If not, please specify how the standards could be
modified to achieve their intended goal and explain why it would be
appropriate to impose these modified standards.
    75. As proposed, the Participants are required to assess both (1)
the overall performance and design of the CCID Subsystem, and (2) the
process for creating Customer-IDs annually as part of each annual
Regular Written Assessment. Are there other specific aspects of the
CCID Subsystem or the Customer-ID creation process that might benefit
from regular assessment? If so, please specify and explain why it would
be appropriate to include them.
3. Plan Processor Functionality To Support the Creation of Customer-
ID(s)
    The CCID Subsystem needs to function appropriately and be
sufficiently secure. Therefore, the Commission proposes amendments to
Article VI, Section 6 to add a new Section 6.1(v) that would require
the Plan Processor to develop, with the prior approval of the Operating
Committee, specific functionality to implement the process for creating
a Customer-ID(s), consistent with both Section 6.1 and Appendix D,
Section 9.1.\215\ With respect to the CCID Subsystem specifically, the
proposed amendments would also require the Plan Processor to develop
functionality to: Ingest Transformed Value(s) and any other required
information and convert the Transformed Value(s) into an accurate
Customer-ID(s); validate that the conversion from the Transformed
Value(s) to the Customer-ID(s) is accurate and reliable; and transmit
the Customer-ID(s), consistent with Appendix D, Section 9.1, to CAIS or
a Participant's SAW.\216\
---------------------------------------------------------------------------

    \215\ See proposed Section 6.1(v) (Plan Processor).
    \216\ See proposed Section 6.1(v).
---------------------------------------------------------------------------

    The Commission also preliminarily believes that it is appropriate
to require the Plan Processor to develop the functionality by the CCID
Subsystem to ingest the Transformed Value(s), along with any other
information and additional events as may be prescribed by the Plan
Processor that would enable the final linkage between the Customer-ID
and the Customer Account Attributes and convert the Transformed
Value(s) into an accurate and reliable Customer-ID(s); to validate that
the conversion from the Transformed Value(s) to the Customer-ID(s) is
accurate and reliable; and to transmit the Customer-ID(s) to CAIS or a
Participant's SAW because these are the critical operational phases
that must be performed by the CCID Subsystem in order to facilitate the
creation of accurate Customer-IDs.
    The Commission requests comment on the proposed amendments that
would serve to impose specific obligations on the Plan Processor that
will support the revised reporting requirements and creation of
Customer-ID(s). Specifically, the Commission solicits comment on the
following:
    76. The proposed amendments require the Plan Processor to develop,
with the prior approval of the Operating Committee, the functionality
to implement the process for creating Customer-IDs consistent with this
section and Appendix D, Section 9.1. Are the details provided in
relation to developing this functionality between this section and
Appendix D, Section 9.1 sufficient for purposes of implementation?
Would additional detail be beneficial? If so, please explain.
    77. With respect to the CCID Subsystem, the proposed amendments
require the Plan Processor to develop functionality to (1) ingest
Transformed Values and any other required information to convert the
Transformed Values into an accurate and reliable Customer-IDs, (2)
validate that that conversion from the Transformed Values to the
Customer-IDs is accurate, and (3) transmit the Customer-IDs, consistent
with Appendix D, Section 9.1, to CAIS or a Participant's SAW. Should
the proposed amendments be

more specific about what kind of functionality must be provided by the
Plan Processor? If so, please explain what kinds of details would be
helpful.
4. Reporting Transformed Value
    The Commission proposes to amend Article VI, Section 6.4 of the CAT
NMS Plan to adopt Article VI, Section 6.4(d)(ii)(D) to require Industry
Members to report on behalf of all Customers that have an ITIN/SSN/EIN
the Transformed Value for that Customer's ITIN/SSN/EIN.\217\ The
Commission preliminarily believes these amendments are appropriate
because they reflect the fact that Industry Members will be required to
report the Transformed Value for their Customers in order to create the
Customer-IDs for natural person and legal entity Customers, rather than
the ITIN/SSN/EIN of such a Customer.
---------------------------------------------------------------------------

    \217\ See proposed Section 6.4(d)(ii)(D); see also infra Part
II.K (Firm Designated ID and Allocation Reports) for a discussion
that addresses another proposed amendment to Section 6.4(d)(ii),
specifically a proposed amendment that would require Customer and
Account Attributes and Firm Designated IDs associated with
Allocation Reports to be reported.
---------------------------------------------------------------------------

    The Commission requests comment on the proposed amendments that
relate to reporting required Industry Member Data in Section
6.4(d)(ii). Specifically, the Commission solicits comment on the
following:
    78. The proposed amendments require Industry Members to report on
behalf of all Customers that have an ITIN/SSN/EIN the Transformed Value
for that Customer's ITIN/SSN/EIN. Are there any factors that could
impact the ability of Industry Members to report the Transformed Value?
Please explain.
5. Data Availability Requirements
    Appendix D, Section 6.2 (Data Availability Requirements) of the CAT
NMS Plan generally addresses the processing of information identifying
Customers that is reported by Industry Members to the CAT, the
reporting timeframes for such information that must be met by Industry
Members, and the availability of such information to regulators.\218\
The Commission proposes to amend this section to require that (i)
Industry Members submit Customer and Account Attributes and Transformed
Values to the CCID Subsystem and CAIS, which are a part of the Central
Repository, by the same deadline already required by the CAT NMS Plan
(no later than 8:00 a.m. Eastern Time on T+1); \219\ (ii) the CAT NMS
Plan's validation; generation of error reports; processing and
resubmission of data; correction of data; and resubmission of corrected
data requirements in Appendix D, Section 6.2 apply to the CCID
Subsystem and CAIS, which are part of the Central Repository, and (iii)
Customer and Account Attributes and Customer-IDs be available to
regulators immediately upon receipt of initial data and corrected data,
pursuant to security policies for retrieving Customer and Account
Attributes and Customer-IDs.\220\ Finally, the Commission proposes to
replace references to the term ``PII'' in this section with references
to ``Customer and Account Attributes.''
---------------------------------------------------------------------------

    \218\ See CAT NMS Plan, supra note 3, at Appendix D, Section
6.2.
    \219\ See proposed Appendix D, Section 6.2.
    \220\ Previously, this section of Section 6.2 of Appendix D
required that PII must be must be available to regulators
immediately upon receipt of initial data and corrected data,
pursuant to security policies for retrieving PII. See CAT NMS Plan,
supra note 3, at Appendix D, Section 6.2. Raw unprocessed data that
has been ingested by the Plan Processor must be available to
Participants' regulatory staff and the SEC prior to 12:00 p.m.
Eastern Time on T+1. Access to all iterations of processed data must
be available to Participants' regulatory staff and the SEC between
12:00 p.m. Eastern Time on T+1 and T+5. See CAT NMS Plan, supra note
3, at Appendix D, Section 6.2. Processing timelines start on the day
the order event is received by the Central Repository for
processing. Most events must be reported to the CAT by 8:00 a.m.
Eastern Time the Trading Day after the order event occurred, which
is referred to as the transaction date. See CAT NMS Plan, supra note
3, at Appendix D, Section 6.1.
---------------------------------------------------------------------------

    In order to provide Regulatory Staff with access to Customer and
Account Attributes in a timely manner, the Commission believes it is
appropriate for the proposed amendments to set forth the requirements
for (i) processing Customer and Account Attributes and Transformed
Value(s) that are reported by Industry Members to the CAT, (ii) the
reporting timeframes for such information identifying a Customer(s)
that must be met by Industry Members, and (iii) the availability of
such information to regulators.
6. Customer and Account Attributes in CAIS and Transformed Values
    Appendix D, Section 9.1 of the CAT NMS Plan (Customer and Customer
Account Information Storage) generally addresses the attributes
identifying a Customer that are required to be reported to and
collected by the Plan Processor; the validation, maintenance and
storage of such attributes; the creation and use of a Customer-ID; and
the manner in which attributes identifying a Customer should initially
be reported to the Central Repository.\221\ Appendix D, Section 9.2
generally lists the account attributes that would be reported to and
collected by the Central Repository.\222\ The Commission proposes to
combine those sections into one section that would comprehensively list
all the Customer and Account Attributes that Industry Members must
report to CAT and clarify existing requirements in the CAT NMS Plan.
Accordingly, Section 9.2 will reflect the entire list of Customer and
Account Attributes and other identifiers associated with a Customer
(e.g., Firm Designated IDs) that must be reported by Industry Members.
The Commission also proposes that for the name field, the first,
middle, and last name must be reported; and for the address field, the
street number, street name, street suffix and/or abbreviation (e.g.,
road, lane, court, etc.), city, state, zip code, and country must be
provided.\223\ The Commission also proposes changes that would organize
the attributes reported by Industry Members so that all attributes
identifying a Customer would be grouped together and all attributes
identifying an account would be grouped together (including any
attributes currently listed in Sections 9.1 and 9.2 of the CAT NMS
Plan).
---------------------------------------------------------------------------

    \221\ See CAT NMS Plan, supra note 3, at Appendix D, Section
9.1. The Central Repository includes the CAIS system. The CAT NMS
Plan defines ``Central Repository'' to mean ``the repository
responsible for the receipt, consolidation, and retention of all
information reported to the CAT pursuant to SEC Rule 613 and this
Agreement.'' See CAT NMS Plan, supra note 3 at Section 1.1.
    \222\ See CAT NMS Plan, supra note 3, at Appendix D, Section
9.2.
    \223\ See proposed Appendix D, Section 9.2.
---------------------------------------------------------------------------

    The proposed amendments also would address the storage of Customer
Account Attributes by requiring that ``[t]he CAT must collect and store
Customer and Account Attributes in a secure database physically
separated from the transactional database'' and would require that
``[t]he Plan Processor must maintain valid Customer and Account
Attributes for each trading day and provide a method for Participants'
Regulatory Staff and SEC staff to easily obtain historical changes to
Customer-IDs, Firm Designated IDs, and all other Customer and Account
Attributes.'' \224\ The proposed amendments also would require that
Industry Members initially submit full lists of Customer and Account
Attributes, Firm Designated IDs, and Transformed Values for all active
accounts and submit updates and changes on a daily basis.\225\ In
addition, the proposed amendments would require that the Plan Processor
must have a process to periodically receive updates, including a full
refresh of all Customer and Account Attributes, Firm Designated IDs,
and Transformed Values to ensure the completeness and

accuracy of the data in CAIS, and would require that the Central
Repository must support account structures that have multiple account
owners and associated Customer and Account Attributes, and must be able
to link accounts that move from one Industry Member to another.\226\
Finally, the proposed amendments would delete the requirement that
previous name and previous address be reported to the CAT.\227\
---------------------------------------------------------------------------

    \224\ See id.
    \225\ See id.
    \226\ See id.
    \227\ See id.
---------------------------------------------------------------------------

    The Commission preliminarily believes that the proposed amendments
to Section 9.2 of Appendix D are appropriate because the CAT NMS Plan
currently includes an incomplete list of all the Customer and Account
Attributes that must be reported to the CAT. The proposed amendments
would provide a list of all of the Customer and Account Attributes that
Industry Members must report and would retain existing requirements in
the CAT NMS Plan related to the availability of historical changes and
the assignment of Customer-IDs, as well as reflect new definitions and
reporting requirements (e.g., the requirement to report the Transformed
Value to the CCID Subsystem). The proposed amendments also would update
the CAT NMS Plan's requirement regarding the initial submission of full
lists of Customer and Account Attributes and subsequent updates and
refreshes of such information to reflect that these requirements would
apply to Customer and Account Attributes, Firm Designated IDs, and
associated Transformed Values.
    The Commission also believes that it is appropriate to amend the
CAT NMS Plan to require that the name field for Customers include the
Customer's first name, middle name, and last name, and that the address
field include the street number, street name, street suffix and/or
abbreviation (e.g., road, lane, court, etc.), city, state, zip code,
and country.\228\ The Commission understands that such specificity is
already collected by broker-dealer databases identifying individuals
and believes that this level of specificity is required to facilitate
regulatory or surveillance efforts, and could diminish the need to
conduct broader searches of CAIS in order to identify an individual of
regulatory interest because such specificity would enable more focused
searches of CAT Customer and Account Attributes. Deleting the
requirement for previous name and previous address fields to be
reported is also appropriate because such information can be determined
by the Plan Processor when providing historical information for the
name and address attributes, as required by the proposed amendments to
this section.
---------------------------------------------------------------------------

    \228\ See proposed Appendix D, Section 9.2.
---------------------------------------------------------------------------

    The Commission requests comment on the proposed amendments that
would combine Sections 9.1 and 9.2 of Appendix D of the CAT NMS Plan
and the proposed revisions therein. Specifically, the Commission
solicits comment on the following:
    79. For natural persons, Appendix D, Section 9.1 requires a name
attribute to be captured and stored. For implementation purposes, the
proposed amendments would specify that all of the aspects of the
``Name'' attribute must be captured, including first, middle, and last
name, as separate fields within the attribute. Do commenters agree that
adding specificity to the ``Name'' attribute would aid in facilitating
regulatory or surveillance efforts by enhancing the ability for
regulators to search the data? Would it be helpful to add more
specificity to any other attributes in proposed Appendix D, Section 9.1
for implementation purposes? For example, would it be helpful to add a
name suffix (e.g., Jr.)?
    80. For both natural persons and legal entities, Appendix D,
Section 9.1 requires an address attribute to be captured and stored.
For implementation purposes, the proposed amendments would specify that
all of the aspects of the ``Address'' attribute must be captured,
including street number, street name, street suffix and/or abbreviation
(e.g., road, lane, court, etc.), city, state, zip code, and country, as
separate fields within the attribute. Do commenters agree that adding
specificity to the ``Address'' attribute would aid in facilitating
regulatory or surveillance efforts by enhancing the ability for
regulators to search the data? Alternatively, could this search
capability be a function of the CAIS/CCID Subsystem Regulator Portal
rather than a reporting requirement for Industry Members?
    81. Would it be helpful to add more specificity to any other
attributes in proposed Appendix D, Section 9.2 for implementation
purposes? For example, would it be helpful to add the last four digits
to the zip code in the address attribute, so that the full nine digit
zip code would be captured? Please identify what separate fields could
be included within the attribute, and why it would be appropriate to
include them.
    82. Appendix D, Section 9.1 requires full account lists for all
active accounts and subsequent updates and changes to be submitted to
the Plan Processor. As part of the process for periodically receiving
updates, the proposed amendments would require the Plan Processor to
have a process to periodically receive updates, rather than full
account lists, which could include a full refresh of all Customer and
Account Attributes, Firm Designated IDs, and Transformed Values. Would
it be appropriate to require the Plan Processor to have a process to
periodically receive a full refresh update?
7. Customer-ID Tracking
    Appendix D, Section 9.3 (Customer-ID Tracking) generally describes
the creation, linking, and persistence of a Customer-ID for use by
regulators.\229\ The Commission proposes to amend this section to
require that Customer-IDs would be created based on the Transformed
Value, rather than the ITIN/SSN of a natural person Customer, and that
the Customer-ID for a legal entity would be based on the EIN for the
legal entity Customer, as discussed above.\230\ The Commission also
proposes to amend the CAT NMS Plan to require the Plan Processor to
resolve discrepancies in the Transformed Values.\231\ The Commission
preliminarily believes these amendments are appropriate because they
reflect the fact that ITINs/SSNs will no longer be reported to the CAT
but that Transformed Values will be reported to and collected by the
CAT, and that existing requirements regarding Customer-IDs and their
function will continue to be required for natural person Customers and
Customers that are legal entities under the amendments proposed by the
Commission. In addition, the CAT NMS Plan currently requires that the
Participants and the SEC must be able to use the unique CAT-Customer-ID
to track orders from any Customer or group of Customers, regardless of
what brokerage account was used to enter the order. The Commission
proposes to amend this section to explicitly require that Participants
and the SEC be able to use

the unique Customer-ID to track allocations to any Customer or group of
Customers over time, regardless of what brokerage account was used to
enter the order as well. The Commission believes these changes are
appropriate so that regulators can track Customer-IDs over time.
---------------------------------------------------------------------------

    \229\ Currently, Section 9.3 of Appendix D provides that ``The
Plan Processor will assign a CAT-Customer-ID for each unique
Customer. The Plan Processor will determine a unique Customer using
information such as SSN and DOB for natural persons or entity
identifiers for Customers that are not natural persons and will
resolve discrepancies. Once a CAT-Customer-ID is assigned, it will
be added to each linked (or unlinked) order record for that
Customer. Participants and the SEC must be able to use the unique
CAT-Customer-ID to track orders from any Customer or group of
Customers, regardless of what brokerage account was used to enter
the order.'' See CAT NMS Plan, supra note 3, at Appendix D, Section
9.3.
    \230\ See supra Part II.E.2.
    \231\ See proposed Appendix D, Section 9.3.
---------------------------------------------------------------------------

    The Commission requests comment on the proposed amendments to
Appendix D, Section 9.3 (Customer-ID Tracking) of the CAT NMS Plan.
Specifically, the Commission solicits comment on the following:
    83. Are there any factors that could impact the ability of the Plan
Processor to resolve discrepancies in the Transformed Values?
8. Error Resolution for Customer Data
    Appendix D, Section 9.4 (Error Resolution for Customer Data)
currently addresses the Plan Processor's general obligations with
respect to errors, and minor and material inconsistencies.\232\ Section
9.4 of Appendix D requires the Plan Processor to design and implement
procedures and mechanisms to handle both minor and material
inconsistencies in Customer information, and to accommodate minor data
discrepancies such as variations in road name abbreviations in
searches.\233\ This section of the CAT NMS Plan further provides that
material inconsistencies such as two different people with the same SSN
must be communicated to the submitting CAT Reporters and resolved
within the established error correction timeframe as detailed in
Section 8.\234\ Regarding the audit trail showing the resolution of all
errors, this provision also requires that the audit trail include
certain information including, for example, the CAT Reporter; the
initial submission date and time; data in question or the ID of the
record in question; and the reason identified as the source of the
issue.\235\
---------------------------------------------------------------------------

    \232\ See CAT NMS Plan, supra note 3, at Appendix D, Section
9.4.
    \233\ See id.
    \234\ See id.
    \235\ See id.
---------------------------------------------------------------------------

    The Commission preliminarily believes that it is appropriate to
apply the error resolution process to the CCID Subsystem and CAIS; to
provide details as to how the existing validation requirements of
Section 7.2 of Appendix D relate to the CCID Subsystem and CAIS; and to
amend the existing audit trail requirements addressing the resolution
of all errors to take into account the revised reporting requirements
that would require the submission of Transformed Values by Industry
Members and Participants.
    Accordingly, the proposed amendments to Section 9.4 would require
that the CCID Subsystem and CAIS support error resolution functionality
which includes the following components: Validation of submitted data,
notification of errors in submitted data, resubmission of corrected
data, validation of corrected data, and a full audit trail of actions
taken to support error resolution.\236\ The proposed amendments also
would require, consistent with Section 7.2, the Plan Processor to
design and implement a robust data validation process for all ingested
values and functionality including, at a minimum: The ingestion of
Transformed Values and the creation of Customer-IDs through the CCID
Subsystem; the transmission of Customer-IDs from the CCID Subsystem to
CAIS or a Participant's SAW; and the transmission and linking of all
Customer and Account Attributes and any other identifiers (e.g.,
Industry Member Firm Designated ID) required by the Plan Processor to
be reported to CAIS.\237\ The proposed amendments also provide that at
a minimum, the validation process should identify and resolve errors
with an Industry Member's submission of Transformed Values, Customer
and Account Attributes, and Firm Designated IDs including where there
are identical Customer-IDs associated with significantly different
names, and identical Customer-IDs associated with different years of
birth, or other differences in Customer and Account Attributes for
identical Customer-IDs.\238\ The Commission also proposes to amend
Section 9.4 to require that the proposed validations must result in
notifications to the Industry Member to allow for corrections,
resubmission of corrected data and revalidation of corrected data, and
to note that as a result of this error resolution process there will be
accurate reporting within a single Industry Member as it relates to the
submission of Transformed Values and the linking of associated Customer
and Account Attributes reported.\239\
---------------------------------------------------------------------------

    \236\ See id.
    \237\ See id.
    \238\ See id.
    \239\ See id.
---------------------------------------------------------------------------

    Timely, accurate, and complete CAT Data is essential so that
Regulatory Staff and SEC staff can rely on CAT Data in their regulatory
and oversight responsibilities.\240\ Therefore, the Commission
preliminarily believes that these proposed amendments addressing how
the Plan Processor must address errors in data reported to CAIS and the
CCID Subsystem are appropriate. The proposed amendments also set out
the key components that such error resolution functionality must
address, namely the validation of submitted data; notification of error
in submitted data, resubmission of corrected data, validation of
corrected data, and an audit trail of actions taken to support error
resolution. Error resolution for each of these key functionalities will
help ensure that CAT Data is timely, accurate and complete.
---------------------------------------------------------------------------

    \240\ See CAT NMS Plan Approval Order, supra note 3, at Part
III.19 ``Error Rates.''
---------------------------------------------------------------------------

    Section 7.2 of Appendix D already requires that CAT Data be
validated.\241\ The proposed amendments to Section 9.4 provide detail
as to how the existing validation process in Section 7.2 of Appendix D
should apply to the revised reporting requirements applicable to
Industry Members and the process for creating Customer-IDs through the
CCID Subsystem. As proposed, the amendments specify that the validation
process must address the ingestion of Transformed Values and the
creation of Customer-IDs through the CCID Subsystem; the transmission
of Customer-IDs to CAIS or the Participant's SAW; and the linking
between the Customer-IDs and the Customer and Account Attributes within
CAIS.\242\ Each of those requirements addresses key reporting
requirements and operations that must be validated by the Plan
Processor as part of the validation process of CAT Data as required by
Section 7.2 of Appendix D. The Commission also believes that the
examples of what the validation process should, at a minimum, address
is appropriate because these examples relate to the new reporting
requirements related to Transformed Values and Customer and Account
Attributes, and therefore were not discussed in the CAT NMS Plan. The
Commission also preliminarily believes that it is appropriate to amend
the CAT NMS Plan to require that the Plan Processor notify Industry
Members of errors so that they can correct them. This notification
facilitates a process for reporting corrected data to the CAT.
---------------------------------------------------------------------------

    \241\ See CAT NMS Plan, supra note 3, Appendix D Section 7.2.
    \242\ See proposed Appendix D Section 9.4.
---------------------------------------------------------------------------

    Finally, the Commission also believes that it is appropriate to
modify the existing CAT NMS Plan requirement that the Central
Repository have an audit trail showing the resolution of all errors,
including material inconsistencies, occurring in the CCID Subsystem and
CAIS. Article VI, Section 6.5(d) of the CAT NMS Plan requires that CAT
Data be accurate, which would

include data that is reported to the CCID Subsystem and CAIS.\243\ The
Commission is proposing that there be an audit trail showing the
resolution of all errors, including material inconsistencies, occurring
in the CCID Subsystem and CAIS because tracking error resolution will
assist in identifying compliance issues with CAT Reporters, and
therefore help ensure that CAT Data is accurate.
---------------------------------------------------------------------------

    \243\ See CAT NMS Plan, supra note 3, Article VI, Section
6.5(d).
---------------------------------------------------------------------------

    84. The proposed amendments would require the Plan Processor to
design and implement a robust data validation process for all ingested
values and functionality, consistent with Appendix D, Section 7.2. Are
the minimum requirements set forth for inclusion in this data
validation process sufficiently detailed for the purposes of
implementing such a process? Should the proposed amendments be more
specific about what kind of capability must be provided by the Plan
Processor? If so, please explain what kinds of details would be
helpful.
    85. The proposed amendments would require the CCID Subsystem and
CAIS to support error resolution functionality which includes the
following components: Validation of submitted data, notification of
errors in submitted data, resubmission of corrected data, validation of
corrected data, and an audit trail of actions taken to support error
resolution. Do the proposed amendments set forth the components of the
error resolution functionality that must be supported by the CCID
Subsystem and CAIS with an appropriate amount of detail? If not, should
other details be added or are some not necessary?
    86. Appendix D, Section 9.4 requires the Central Repository to have
an audit trail showing the resolution of all errors. The proposed
amendments would require the audit trail to show the resolution of all
errors, including material inconsistencies, occurring in the CCID
Subsystem and CAIS. Do the proposed amendments set forth the components
of the audit trail requirements with an appropriate amount of detail?
If not, what details should be added or are some not necessary?
    87. Should the proposed amendments address error resolution
requirements with respect to Transformed Values and Customer and
Account Attributes, and reporting Transformed Values to the CCID
Subsystem and Customer and Account Attributes to CAIS? If error
resolution requirements are not applied to Transformed Values and
Customer and Account Attributes, and reporting Transformed Values to
the CCID Subsystem and Customer and Account Attributes to CAIS, how
would errors in those data elements be identified and corrected? Please
be specific in your response.
9. CAT Reporter Support and CAT Help Desk
    Currently, Appendix D, Section 10.1 of the CAT NMS Plan addresses
the technical, operational, and business support being offered by the
Plan Processor to CAT Reporters as applied to all aspects of reporting
to CAT, and Section 10.3 of Appendix D addresses the responsibilities
of the CAT Help Desk to support broker-dealers, third party CAT
Reporters, and Participant CAT Reporters with questions and issues
regarding reporting obligations and the operation of the CAT.\244\ The
Commission proposes to amend the CAT NMS Plan to add the requirements
that (i) the Plan Processor would also provide CAT Reporter Support and
Help Desk support for issues related to the CCID Transformation Logic
and reporting required by the CCID Subsystem, and (ii) the Plan
Processor would have to develop tools to allow each CAT Reporter to
monitor the use of the CCID Transformation Logic, including the
submission of Transformed Values to the CCID Subsystem.\245\ The
Commission believes these amendments are appropriate so that all CAT
Reporters who must submit Transformed Values to the CCID Subsystem can
get the assistance that they need should any problems arise with their
efforts to report the required data to the CAT.
---------------------------------------------------------------------------

    \244\ See CAT NMS Plan, supra note 3, at Appendix D, Sections
10.1 and 10.3.
    \245\ See proposed Appendix D, Sections 10.1 and 10.3.
---------------------------------------------------------------------------

    The Commission requests comment on the proposed amendments that
would amend Appendix D, Sections 10.1 and 10.3 of the CAT NMS Plan.
Specifically, the Commission solicits comment on the following:
    88. With respect to CAT Reporter support, the proposed amendments
would require the Plan Processor to develop functionality that allows
each CAT Reporter to monitor the use of the CCID Transformation Logic
including the submission of Transformed Values to the CCID Subsystem.
Should the proposed amendments be more specific about what kind of
functionality must be provided by the Plan Processor? If so, please
explain what kinds of details would be helpful.
    89. The proposed amendments would require the CAT Help Desk to
support responding to questions from and providing support to CAT
Reporters regarding all aspects of the CCID Transformation Logic and
CCID Subsystem. Are there any specific aspects that should be
enumerated in relation to CAT Help Desk support?

F. Customer Identifying Systems Workflow

    The CAT NMS Plan currently requires Industry Members to report PII
\246\ to the CAT, and states that such ``PII can be gathered using the
`PII workflow' described in Appendix D, Data Security, PII Data
Requirements.'' \247\ However, the ``PII workflow'' was neither defined
nor established in the CAT NMS Plan.\248\ While the modifications
proposed by the Commission in Part II.E no longer require a Customer's
ITIN(s)/SSN(s), account number and date of birth be reported to and
collected by the CAT, Customer and Account Attributes, as described in
Part II.E., are still reported to and collected by the CAT and could be
used to attribute order flow to a single Customer across broker-
dealers.\249\ The collection of Customer and Account Attributes and
access to such attributes will facilitate the ability of Regulatory
Staff to carry out their regulatory and oversight obligations.\250\
Therefore, the Commission is proposing to amend the CAT NMS Plan to
define the Customer Identifying Systems Workflow for accessing Customer
and Account Attributes, and to establish restrictions governing such
access. Accordingly, the Commission proposes to amend the CAT NMS Plan
to (1) specify how existing data security requirements apply to
Customer and Account Attributes; (2) define the Customer Identifying
Systems; (3) establish general requirements that must be met by
Regulatory Staff before accessing the Customer Identifying Systems,
which access will be divided between two types of access--manual access
and programmatic access; and (4) establish the specific requirements
for each type of access to the Customer Identifying Systems.\251\
---------------------------------------------------------------------------

    \246\ See supra note 10.
    \247\ See CAT NMS Plan, supra note 3, at Appendix D, Section
4.1.6.
    \248\ Id.
    \249\ See supra Part II.E; see also proposed Section 1.1 for the
proposed definition of ``Customer and Account Attributes.''
    \250\ See supra Part II.E for a discussion of the changes to the
data collected by the CAT that would identify an individual or legal
entity, and the associated defined term ``Customer and Account
Attributes.''
    \251\ See proposed Appendix D, Section 4.1.6 (Customer
Identifying Systems Workflow).

---------------------------------------------------------------------------

1. Application of Existing Plan Requirements to Customer and Account
Attributes and the Customer Identifying Systems
    Appendix D, Section 4.1.6 of the CAT NMS Plan currently requires
that PII must be stored separately from other CAT Data, and that PII
must not be accessible from public internet connectivity.\252\ The CAT
NMS Plan also states that PII data must not be included in the result
set(s) from online or direct query tools, reports, or bulk data
extraction; instead, results are to display existing non-PII unique
identifiers (e.g., Customer-ID or Firm Designated ID).\253\ The PII
corresponding to these identifiers can be gathered using a ``PII
workflow.'' \254\ The CAT NMS Plan also provides that by default, users
entitled to query CAT Data are not authorized for PII access, and that
furthermore the process by which someone becomes entitled to PII
access, and how they then go about accessing PII data, must be
documented by the Plan Processor.\255\ The chief regulatory officer, or
other such designated officer or employee at each Participant must
review and certify that people with PII access have the appropriate
level of access for their role at least annually.\256\ The CAT NMS Plan
also provides that a full audit trail of PII access (i.e., who accessed
what data, and when) must be maintained, and that the Chief Compliance
Officer and the Chief Information Security Officer must have access to
daily PII reports that list all users who are entitled to PII access,
as well as the audit trail of all PII access that has occurred for the
day being reported upon.\257\ In other sections of the CAT NMS Plan,
PII data is also required to be ``masked'' unless a user has permission
to view it.\258\
---------------------------------------------------------------------------

    \252\ See CAT NMS Plan, supra note 3, Appendix D, Section 4.1.6.
    \253\ See id.
    \254\ See id.
    \255\ See id.
    \256\ See id.
    \257\ See id.
    \258\ See CAT NMS Plan, supra note 3, at Section 6.10(c)(ii) and
Appendix D, Section 8.2.2.
---------------------------------------------------------------------------

    The Commission proposes to amend these provisions to replace the
term ``PII'' with ``Customer and Account Attributes'' and to reflect
that Customer Identifying Systems, including CAIS, would now contain
the information that identifies a Customer.\259\ Accordingly, the
proposed amendments to Appendix D, Section 4.1.6 would provide that
Customer and Account Attributes data must be stored separately from
other CAT Data within the CAIS, that Customer and Account Attributes
cannot be stored with the transactional CAT Data in the Central
Repository, and that Customer and Account Attributes must not be
accessible from public internet connectivity. Similarly, the proposed
amendments would provide that Customer and Account Attributes must not
be included in the result set(s) from online or direct query tools,
reports, or bulk data extraction tools used to query transactional CAT
Data. Instead, query results of transactional CAT Data would display
unique identifiers (e.g., Customer-ID or Firm Designated ID) and the
Customer and Account Attributes corresponding to these identifiers
could be gathered by accessing CAIS in accordance with the ``Customer
Identifying Systems Workflow,'' as described in the proposed amendments
and discussed below. The proposed amendments would provide that, by
default, users entitled to query CAT Data would not be authorized to
access Customer Identifying Systems, and the process by which someone
becomes entitled to Customer Identifying Systems and how an authorized
person then could access Customer Identifying Systems, would have to be
documented by the Plan Processor. The proposed amendments also would
modify the CAT NMS Plan to require that a similarly designated head(s)
of regulation or the designee of the chief regulatory officer or such
similarly designated head of regulation must, at least annually, review
and certify that people with Customer Identifying Systems access have
the appropriate level of access for their role, in accordance with the
Customer Identifying Systems Workflow, as discussed and described
below.\260\
---------------------------------------------------------------------------

    \259\ See supra Part II.E.1; see also proposed Appendix D,
Section 4.1.6.
    \260\ Other provisions of the CAT NMS Plan that refer to PII are
also proposed to be similarly modified to remove the term ``PII''
and instead refer to ``Customer and Account Attributes'' or
``Customer Identifying Systems'' as appropriate. See, e.g., Appendix
D, Sections 4.1.6 and 8.2.2.
---------------------------------------------------------------------------

    The proposed amendments also would modify the requirement related
to maintaining a full audit trail to require that the audit trail must
reflect access to the Customer Identifying Systems by each Participant
and the Commission (i.e., who accessed what data, and when), and to
require that the Plan Processor provide to each Participant and the
Commission the audit trail for their respective users on a monthly
basis. In addition, the proposed amendments would require that the
Chief Compliance Officer and Chief Information Security Officer have
access to daily reports that list all users who are entitled to
Customer Identifying Systems access, and that such reports must be
provided to the Operating Committee on a monthly basis.\261\
---------------------------------------------------------------------------

    \261\ See proposed Appendix D, Section 4.1.6.
---------------------------------------------------------------------------

    The Commission believes that the proposed amendments are
appropriate because storing Customer and Account Attributes separately
from other CAT Data would aid in protecting the confidentiality of
Customer identifying information that is reported to and collected by
the CAT, and would reflect what the CAT NMS Plan currently requires for
PII.\262\ Moreover, Customer and Account Attributes should neither be
stored with transactional CAT Data nor be accessible by public internet
in order to further aid in protecting this information. Similarly, to
help safeguard Customer and Account Attributes, such attributes should
not be included in result set(s) obtained from online or direct query
tools or bulk extraction tools. The proposed amendments that would
permit a designated head of regulation similar to the chief regulatory
officer, or his or her designee, to at least annually review and
certify that people with Customer Identifying Systems Access have the
appropriate level of access for their role in accordance with the
Customer Identifying Systems Workflow are appropriate because this
change will serve to ease any potential delays in the annual review and
certification process. The proposed amendments would accomplish this by
expanding the pool of individuals that are authorized to conduct such
reviews and certifications.
---------------------------------------------------------------------------

    \262\ The CAT NMS Plan presently requires PII to be stored
separately from other CAT Data. See Appendix D, Section 4.1.6.
---------------------------------------------------------------------------

    In addition, the proposed amendments deleting ``masked'' Customer
and Account Attributes are appropriate because ``masked'' Customer and
Account Attributes implies that certain Customer and Account Attributes
(i.e., ``masked'' Customer and Account Attributes) would be made
available to certain Regulatory Staff outside of the access
requirements set forth in these proposed amendments. The Commission
believes that if Regulatory Staff do not meet the requirements to be
entitled to access Customer and Account Attributes, then Regulatory
Staff should not be allowed to access those Customer and Account
Attributes, even if such data were to be masked.
    The Commission preliminarily believes it is appropriate to require
the Plan Processor to provide the audit trail of access to Customer
Identifying Systems by each Participant and the Commission (who
accessed what data and when), and to require the Plan

Processor to provide to each Participant and the Commission the audit
trail for their respective users on a monthly basis because providing
such information may increase the accountability and transparency into
the justification(s) for each Participant's access to Customer
Identifying Systems. The benefit of providing the audit trail of
Customer Identifying Systems access to each Participant is that it
would enable each Participant to monitor use in accordance with their
data confidentiality policies, procedures, and usage restriction
controls. Similarly, the Commission could use such data in support of
their internal policies governing access to Customer Identifying
Systems.\263\ The Commission also believes that providing the daily
reports of all users entitled to access the Customer Identifying
Systems to the Operating Committee on a monthly basis would enable
Participants and the Operating Committee to verify that only Regulatory
Staff who are entitled to access Customer Identifying Systems have such
access.
---------------------------------------------------------------------------

    \263\ See also Part II.N. infra, for a discussion of how the
proposed amendments would apply to Commission staff. The Commission
understands that a full audit trail of all access to Customer
Identifying Systems is required by NIST 800-53.
---------------------------------------------------------------------------

    The Commission requests comment on the continued application of
existing provisions of Appendix D, Section 4.1.6 to help ensure the
security and confidentiality of the information reported to and
collected by the Customer Identifying Systems. Specifically, the
Commission solicits comment on the following:
    90. Existing provisions of the CAT NMS Plan address the security
and confidentiality of CAT Data by requiring that PII must be stored
separately from other CAT Data. These provisions also specifically
require that PII cannot be stored with transactional CAT Data and that
PII must not be accessible from public internet connectivity. Should
the existing provisions of Appendix D, Section 4.1.6 continue to apply
so as to require: (i) That Customer and Account Attributes data are
stored separately from other CAT Data within the CAIS, (ii) that
Customer and Account Attributes cannot be stored with the transactional
CAT Data in the Central Repository, and (iii) that Customer and Account
Attributes must not be accessible from public internet connectivity?
Why or why not? Please explain with specificity why such provisions
should or should not apply.
    91. Should existing provisions of Appendix D, Section 4.1.6
continue to apply so as to require that Customer and Account Attributes
must not be included in the result set(s) from online or direct query
tools, reports, or bulk data extraction tools used to query
transactional CAT Data? In addition, is it appropriate to amend the CAT
NMS Plan to require that query results of transactional CAT Data will
display unique identifiers (e.g., Customer-ID or Firm Designated ID)?
If such unique identifiers are not displayed, what should be provided
in result set(s) from online or direct query tools, reports, or bulk
data extraction tool queries?
    92. Is it appropriate to amend the CAT NMS Plan to state that by
default, users entitled to query CAT Data are not authorized to access
Customer Identifying Systems? Why or why not? Please explain with
specificity why this provision should or should not apply and what
other process would be appropriate to ensure that only authorized users
access the Customer Identifying systems.
    93. The existing CAT NMS Plan requires that the Chief Regulatory
Officer or another such designated officer or employee at each
Participant must at least annually review and certify that people with
PII access have the appropriate level of access in light of their
respective roles. The proposed amendments state that the review and
certification must be made by the Chief Regulatory Officer or similarly
designated head(s) of regulation, or his or her designee, at each
Participant, and that the Chief Regulatory Officer or similarly
designated head(s) of regulation, or his or her designee must, at least
annually, review the list of people who have access to Customer
Identifying Systems at their organization, the role of each person on
the list and the level of access of each person. Based on that review,
the Chief Regulatory Office must certify that people with Customer
Identifying Systems access have the appropriate level of access for
their role, in accordance with the Customer Identifying Systems
Workflow. Is it appropriate to continue to facilitate oversight
regarding who has access to the Customer Identifying Systems by
applying these requirements to the Customer Identifying Systems
Workflow? Why or why not? Please explain with specificity why such
provisions should or should not apply.
    94. Appendix D, Section 4.1.6 of the CAT NMS Plan requires a full
audit trail of access to PII (who accessed what data, and when) to be
maintained. Should the proposed amendments require that the Plan
Processor maintain a full audit trail of access to Customer Identifying
Systems by each Participant and the Commission (who accessed what data
and when), and require that the Plan Processor provide to each
Participant and the Commission the audit trail for their respective
users on a monthly basis? Furthermore, should the proposed amendments
require that the Chief Compliance Officer and the Chief Information
Security Officer l have access to daily reports that list all users who
are entitled to Customer Identifying Systems access, and for such
reports to be provided to the Operating Committee on a monthly basis?
Why or why not? Is there another means of providing information to the
Participants and the Operating Committee to facilitate their review of
access to Customer Identifying Systems? If so, please identify this
means and explain why it would be an appropriate way to facilitate
review of access to Customer Identifying Systems.
2. Defining the Customer Identifying Systems Workflow and the General
Requirements for Accessing Customer Identifying Systems
    Given that Regulatory Staff may seek to access both CAIS and the
CCID Subsystem (collectively, the Customer Identifying Systems) in
order to carry out their regulatory and oversight responsibilities, the
Commission preliminarily believes that it is appropriate to establish
access requirements that would apply to both systems. Accordingly, the
Commission proposes to amend Section 4.1.6 of Appendix D to require
that access to Customer Identifying Systems be subject to the following
restrictions, many of which already exist in the CAT NMS Plan today, as
discussed below.\264\
---------------------------------------------------------------------------

    \264\ See proposed Appendix D, Section 4.1.6 (Customer
Identifying Systems Workflow, Access to Customer Identifying
Systems).
---------------------------------------------------------------------------

    First, only Regulatory Staff may access Customer Identifying
Systems and such access would have to follow the ``least privileged''
practice of limiting access to Customer Identifying Systems as much as
possible.\265\ Second, using the role based access control (``RBAC'')
model described in the CAT NMS Plan, access to Customer and Account
Attributes would have to be configured at the Customer and Account
Attributes level.\266\ Third, all queries of Customer Identifying
Systems would have to be based on a ``need to know''

the data \267\ in the Customer Identifying Systems, and queries must be
designed such that the query results would contain only the Customer
and Account Attributes that Regulatory Staff reasonably believes will
achieve the regulatory purpose of the inquiry or set of inquiries,
consistent with Article VI, Section 6.5(g) of the CAT NMS Plan.\268\
Fourth, Customer Identifying Systems would have to be accessed through
a Participant's SAW.\269\ Fifth, access to Customer Identifying Systems
would be limited to two types of access: Manual access (which would
include Manual CAIS Access and Manual CCID Subsystem Access, as further
discussed below) and programmatic access (which would include
Programmatic CAIS Access and Programmatic CCID Subsystem Access, as
further discussed below). Lastly, authorization to use Programmatic
CAIS Access or Programmatic CCID Subsystem Access would have to be
requested and approved by the Commission, pursuant to the process as
further described in the proposed amendments below.\270\
---------------------------------------------------------------------------

    \265\ The CAT NMS Plan currently states that ``[u]sing the RBAC
model described above, access to PII data shall be configured at the
PII attribute level, following the `least privileged' practice of
limiting access as much as possible.'' See CAT NMS Plan, supra note
3, Appendix D, Section 4.1.6 (PII Data Requirements).
    \266\ See proposed Appendix D, Section 4.1.6.
    \267\ The Participants stated that they ``anticipate that access
to PII will be limited to a `need-to-know' basis. Therefore, it is
expected that access to PII associated with customers and accounts
will have a much lower number of registered users, and access to
this data will be limited to Participants' staff and the SEC who
need to know the specific identity of an individual.'' See CAT NMS
Plan, supra note 3, Appendix C, Section A.4.(b). The Plan also
states that ``[t]he Participants are requiring multi-factor
authentication and Role Based Access Control for access to PII,
separation of PII from other CAT Data, restricted access to PII
(only those with a `need to know' will have access), and an
auditable record of all access to PII data contained in the Central
Repository.'' See CAT NMS Plan Appendix C, Section D.12.(e).
    \268\ See id.
    \269\ See id. For a discussion of the requirements related to
SAWs, see infra Part II.C.
    \270\ See proposed Appendix D, Section 4.1.6 (Customer and
Accounts Attributes Data Requirements).
---------------------------------------------------------------------------

    The Commission preliminarily believes that the proposal to
establish rules applicable to all forms of access to the Customer
Identifying Systems by all Participants would facilitate the
application of the same requirements and standards across all
Regulatory Staff at each Participant seeking access to Customer
Identifying Systems. Furthermore, restricting access to Regulatory
Staff is appropriate because such staff are required to report directly
to the Participant's Chief Regulatory Officer (or similarly designated
head(s) of regulation), or to persons within the Participant's Chief
Regulatory Officer's (or similarly designated head(s) of regulation's)
reporting line, and because such staff must be specifically identified
and approved in writing by the Participant's Chief Regulatory Officer
(or similarly designated head(s) of regulation).\271\ Thus, the
proposed amendments would help to ensure that the Participant's staff
accessing Customer and Account Attributes and other identifying
information about a Customer are doing so for regulatory--not
commercial--purposes, and that sufficient oversight of such access by
the Participant's Chief Regulatory Officer exists.\272\ In addition, by
allowing a similarly designated head(s) of regulation to also approve
such access, the Commission preliminarily believes that any operational
issues in obtaining such approval should be minimized.
---------------------------------------------------------------------------

    \271\ See proposed Section 6.5(g).
    \272\ See Part II.H.1, infra, for a discussion of proposed
amendments related to restricting access to CAT Data solely for
regulatory purposes. Access to Customer and Account Attributes,
which are a subset of CAT Data, would be subject to these
restrictions.
---------------------------------------------------------------------------

    The Commission also preliminarily believes that it is appropriate
to limit access to Customer Identifying Systems to the minimum level of
access that will achieve the Participant's regulatory purposes.\273\
For example, a regulator investigating alleged fraud against senior
investors may only need the year of birth to investigate such matters;
thus, under the ``least privileged practice'' model, such Regulatory
Staff would only be entitled to view year of birth from CAIS in
response to queries, and would only access the minimum amount of CAT
Data, including Customer and Account Attributes, that would be required
to conduct their investigation.
---------------------------------------------------------------------------

    \273\ See CAT NMS Plan Approval Order, supra note 3 at note
1299.
---------------------------------------------------------------------------

    The RBAC model, which is already an access requirement contained in
the CAT NMS Plan, requires that the Plan Processor grant permission to
access certain CAT Data based on the user's regulatory role.\274\ The
Commission believes it is appropriate to apply the same RBAC model to
access to Customer and Account Attributes because not all Regulatory
Staff will need to access Customer and Account Attributes, and
limitations on such access should be based on the role that such
Regulatory Staff fill for the Participant.
---------------------------------------------------------------------------

    \274\ See CAT NMS Plan, supra note 3, Appendix D, Section 4.1.4
(Data Access).
---------------------------------------------------------------------------

    The Commission also preliminarily believes that it is appropriate
to require that all queries of the Customer Identifying Systems be
based on a regulator's ``need to know'' the data in the Customer
Identifying Systems, and to require that queries be designed such that
query results contain only the Customer and Account Attributes that
Regulatory Staff reasonably believes will achieve the regulatory
purpose of the inquiry or set of inquiries, consistent with Article VI,
Section 6.5(g) of the CAT NMS Plan.\275\ The Participants stated that
they intended the CAT NMS Plan to require that a regulator ``need to
know'' the Customer and Account Attributes, and thus only those users
who have ``need to know'' the Customer and Account Attributes will be
granted access to the Customer and Account Attributes.\276\ The
Commission believes that incorporating the ``need to know'' standard in
the proposed amendments would require Regulatory Staff to articulate
their reasons for needing access to search CAIS or use the CCID
Subsystem. These proposed amendments also would help to limit the
results of queries to containing only the Customer and Account
Attributes that Regulatory Staff reasonably believes will achieve the
regulatory purpose of the inquiry or set of inquiries that are being
pursued by Regulatory Staff, which would be consistent with the
requirements set forth in Article VI, Section 6.5(g) of the CAT NMS
Plan.\277\
---------------------------------------------------------------------------

    \275\ See proposed Appendix D, Section 4.1.6 (Customer
Identifying Systems Workflow, Access to Customer Identifying
Systems).
    \276\ See CAT NMS Plan, supra note 3, Appendix C, Section
A.4(b); see also CAT NMS Plan Appendix C, Section D.12.(e).
    \277\ See proposed Appendix D, 4.1.6 (Customer Identifying
Systems Workflow).
---------------------------------------------------------------------------

    The Commission believes that the proposed amendments would result
in Regulatory Staff continually assessing whether there is a need to
know the volume of Customer and Account Attributes that may be returned
in response to a query in light of the regulatory purpose of the query
being submitted, and whether the query results contain only the
Customer and Account Attributes that Regulatory Staff reasonably
believes will achieve the regulatory purpose of the Regulatory Staff's
inquiry or set of inquiries. The same requirement applies when
Regulatory Staff utilizes programmatic access; to the extent
applications to query Customer and Account Attributes are developed as
part of programmatic access, such applications must support a design
that limits Customer and Account Attributes to only those which
Regulatory Staff reasonably believes are needed to achieve the
regulatory purpose of the inquiry or set of inquiries. The Commission
also expects that this assessment would operate as a useful check on
the scope of the queries being submitted by Regulatory Staff, and that
this requirement would complement the proposed amendments

that address access-level requirements, as discussed above (i.e., that
only Regulatory Staff may access Customer Identifying Systems and such
access must follow the ``least privileged'' practice of limiting access
to Customer Identifying Systems as much as possible).\278\
---------------------------------------------------------------------------

    \278\ Similar to the requirement that applications developed in
connection with programmatic access must support a design that
limits the Customer and Account Attributes to only that which
Regulatory Staff reasonably believes are needed to achieve the
regulatory purpose of the inquiry or set of inquiries as discussed
above, these applications also must support all elements of the
Customer Identifying Systems Workflow (e.g., following the ``least
privileged'' practice of limiting access to Customer Identifying
Systems as much as possible).
---------------------------------------------------------------------------

    The Commission also believes that it is appropriate to require that
Customer Identifying Systems must be accessed through a Participant's
SAW.\279\ As described above in Part II.C.3., each Participant's SAW is
a secure analytic environment that would be part of the CAT System and
therefore subject to the CISP.\280\ This provision together with
Proposed Section 6.13(a)(i)(A) establishes the SAW as the only means of
accessing and analyzing Customer and Account Attributes and applies the
security safeguards implemented in a Participant's SAW to protect all
access to Customer Identifying Systems, leveraging security controls
and related policies and procedures that are consistent with those that
protect the Central Repository.\281\ Requiring access through a
Participant's SAW also would enable the Plan Processor to capture
information about CAT Data usage by Participants, which would assist
Participants in analyzing such usage to determine whether CAT Data is
being used for legitimate regulatory or oversight purposes.
---------------------------------------------------------------------------

    \279\ See Part II.C. supra for a discussion of the proposed
SAWs.
    \280\ See proposed Section 6.13.
    \281\ See proposed Appendix D, Section 4.1.6 (Customer
Identifying Systems Workflow).
---------------------------------------------------------------------------

    The Commission also preliminarily believes that it is appropriate
to limit access to the Customer Identifying Systems to two types of
access--manual and programmatic.\282\ As noted above, the CAT NMS Plan
currently follows the ``least privileged'' practice of limiting access
to information identifying a Customer to the greatest extent
possible.\283\ The Commission believes that applying this same security
focused, minimum access approach to the data in the Customer
Identifying systems is appropriate in order to safeguard the Customer
information contained in each system from bad actors who obtain such
information through a data breach. The Commission believes that the
``least privileged practice'' approach also means that only Regulatory
Staff will be permitted to access Customer Identifying Systems.\284\
Accordingly, the Commission is proposing to limit access to those
systems to two methods: Manual access (which would include Manual CAIS
Access and Manual CCID Subsystem Access) and programmatic access (which
would include Programmatic CAIS Access and Programmatic CCID Subsystem
Access), which would be subject to an approval process, as further
described below, and only granted if certain circumstances are
met.\285\
---------------------------------------------------------------------------

    \282\ See proposed Appendix D, Section 4.1.6 (Customer
Identifying Systems Workflow).
    \283\ See supra note 273.
    \284\ See also Part II.H.1, infra, for a discussion of proposed
amendments requiring need for regulatory purpose for access to
Customer and Account Attributes.
    \285\ See proposed Appendix D, Section 4.1.6.
---------------------------------------------------------------------------

    Finally, the Commission preliminarily believes that Programmatic
CAIS Access and Programmatic CCID Subsystem Access, as further detailed
below, should only be used by Participants if requested and approved by
the Commission.\286\ Indeed, the Participants represented in the CAT
NMS Plan that ``general queries can be carried out using the Customer-
ID without the need to know specific, personally-identifiable
information (i.e., who the individual Person or legal entity associated
with the Customer-ID is). The Customer-ID will be associated with the
relevant accounts of that Person; thus, the use of Customer-ID for
querying will not reduce surveillance.'' \287\ Thus, the Commission
preliminarily believes that it is appropriate to require Regulatory
Staff to use manual access to Customer Identifying Systems in order to
carry out their regulatory responsibilities because such access should
meet the regulatory purpose of their inquiry or set of inquiries--and
only access CAIS and the CCID Subsystem programmatically if authorized
by the Commission.\288\
---------------------------------------------------------------------------

    \286\ See infra Part II.F.5.
    \287\ See CAT NMS Plan Approval Order, supra note 3, at 84983
note 826.
    \288\ See proposed Appendix D, Section 4.1.6 (Customer
Identifying Systems Workflow).
---------------------------------------------------------------------------

    The Commission requests comment on the proposed amendments to
define the Customer Identifying Systems Workflow and the requirements
for accessing Customer Identifying Systems. Specifically, the
Commission solicits comment on the following:
    95. Do Commenters agree that it is necessary to define and set
forth the requirements for the Customer Identifying Systems Workflow?
If not, what provisions of the CAT NMS Plan apply to govern access to
Customer Identifying Systems? Please be specific about those provisions
and explain how they protect the information reported to and collected
by the Customer Identifying Systems.
    96. Is there a different set of requirements that should be applied
to the proposed Customer Identifying Systems Workflow? If yes, please
describe with specificity what those requirements are and how they
would operate to support the security and confidentiality of the
information reported to and collected by the Customer Identifying
Systems.
    97. The proposed amendments require that only Regulatory Staff may
access Customer Identifying Systems and such access must follow the
``least privileged'' practice of limiting access to Customer
Identifying Systems as much as possible. What are the advantages to
limiting access to the Customer Identifying Systems in this manner? Are
there other standards of access to Customer Identifying Systems that
would be appropriate? If so, what are those standards? Please be
specific in your response.
    98. The proposed amendments require that access to Customer and
Account Attributes shall be configured at the Customer and Account
Attributes level using the Role Based Access Model in the Customer
Identifying Systems Workflow. Is there another more appropriate way to
configure access to Customer and Account Attributes? Should access to
identifiers in the transaction database (e.g., Customer-ID(s) or
Industry Member Firm Designated ID(s)) be permitted, or entitled,
separately such that Regulatory Staff would need specific permissions
to access these identifiers? If so, how would regulatory use of CAT
Data still be accomplished? Please discuss implementation details
addressing both security and usability.
    99. The proposed amendments require that all queries of Customer
Identifying Systems must be based on a ``need to know'' data in the
Customer Identifying Systems. Is there a different standard that should
apply to queries of the Customer Identifying Systems and if so, why is
that standard more appropriate? Please be specific in your response.
    100. The proposed amendments state that the standard for assessing
the Customer and Account Attributes that can be returned in response to
a query is what Regulatory Staff reasonably believes will achieve the
regulatory purpose of the inquiry or set of inquiries in the Customer
Identifying Systems Workflow. Is this standard appropriate?

Why or why not? If there is another standard that should apply, what
should that standard be? Please be specific in your response.
    101. The proposed amendments require that Customer Information
Systems must be accessed through a Participant's SAW in the Customer
Identifying Systems Workflow. Should the proposed amendments permit
access other than through a Participant's SAW? If so, is there another
way to subject the accessing and analyzing of Customer and Account
Attributes to the CISP?
    102. The proposed amendments state that access to Customer
Identifying Systems will be limited to two types of access: Manual
access (which would include Manual CAIS Access and Manual CCID
Subsystem Access) and programmatic access (which would include
Programmatic CAIS Access and Programmatic CCID Subsystem Access). Are
these methods of access appropriate for facilitating the ability of
Regulatory Staff to fulfill their regulatory and oversight obligations?
Please explain.
    103. The proposed amendments require that authorization to use
Programmatic CAIS Access or Programmatic CCID Subsystem Access must be
requested and approved by the Commission pursuant to the Customer
Identifying Systems Workflow. Do Commenters agree that it is
appropriate to require Commission authorization to use Programmatic
Access to the CAIS and the CCID Subsystem?
3. Introduction to Manual and Programmatic Access
    As noted above, the proposed amendments would limit access to
Customer Identifying Systems to two general methods of access--manual
and programmatic access. Accordingly, the Commission is proposing
amendments to the CAT NMS Plan that would define and set forth the
requirements for (1) Manual CAIS Access and Manual CCID Subsystem
Access; and (2) Programmatic CAIS Access and Programmatic CCID
Subsystem Access. A description of the requirements applicable to each
method of access follows.
4. Manual CAIS Access
    The Commission proposes to amend the CAT NMS Plan to define Manual
CAIS Access to mean ``[w]hen used in connection with the Customer
Identifying Systems Workflow, as defined in Appendix D, shall mean the
Plan Processor functionality to manually query CAIS, in accordance with
Appendix D, Data Security, and the Participants' policies as set forth
in Section 6.5(g).'' \289\ Under the proposed amendments, if Regulatory
Staff have identified a Customer(s) of regulatory interest through
regulatory efforts and require additional information from the CAT
regarding such Customer(s), then they may use Manual CAIS Access.\290\
The proposed amendments also would provide that additional information
about Customer(s) may be accessed through Manual CAIS Access by (1)
using identifiers available in the transaction database (e.g.,
Customer-ID(s) or Industry Member Firm Designated ID(s)) to identify
Customer and Account Attributes associated with the Customer-ID(s) or
Industry Member Firm Designated ID(s), as applicable; or (2) using
Customer Attributes in CAIS to identify a Customer-ID(s) or Industry
Member Firm Designated ID(s), as applicable, associated with the
Customer Attributes, in order to search the transaction database.\291\
The proposed amendments would not permit open-ended searching of
parameters not specific to a Customer(s).\292\
---------------------------------------------------------------------------

    \289\ See proposed Section 1.1.
    \290\ See proposed Appendix D, Section 4.1.6 (Customer
Identifying Systems Workflow).
    \291\ See id.
    \292\ See id.
---------------------------------------------------------------------------

    In addition, the Commission proposes to amend the CAT NMS Plan to
require that Manual CAIS Access must provide Regulatory Staff with the
ability to retrieve data in CAIS via the CAIS/CCID Subsystem Regulator
Portal with query parameters based on data elements including Customer
and Account Attributes and other identifiers available in the
transaction database (e.g., Customer-ID(s) or Industry Member Firm
Designated ID(s)).\293\
---------------------------------------------------------------------------

    \293\ See id.
---------------------------------------------------------------------------

    Finally, the proposed amendments would require that the performance
requirements for Manual CAIS Access be consistent with the criteria set
out in Appendix D, Functionality of the CAT System, Online Targeted
Query Tool Performance Requirements.\294\
---------------------------------------------------------------------------

    \294\ See id. ``Performance requirements'' refers to the
response times Online Targeted Queries. See CAT NMS Plan, supra note
3, Appendix D Section 8.1.2. Pursuant to Appendix D, Section 8.1.2,
the performance requirement for Manual CAIS Access must generally be
in increments of less than one minute. Id.
---------------------------------------------------------------------------

    These proposed amendments reflect a principle that underlies the
required use of manual access to CAIS (and manual access to the CCID
Subsystem, as further discussed below) that if Regulatory Staff have
already identified a Customer(s) of interest based on their regulatory
efforts and Regulatory Staff have a ``need to know'' additional
identifying information about the Customer(s), then manual access may
be used to obtain such information.\295\ For example, manual access
would be appropriate if Regulatory Staff have the Customer-ID of a
Customer or the Industry Member Firm Designated ID of Customer as a
result of a search of the transactional CAT database in furtherance of
a regulatory purpose, and Regulatory Staff require additional Customer
and Account Attributes associated with that Customer (e.g., the name
and address associated with that Customer-ID). Manual CAIS Access also
would be appropriate if Regulatory Staff have identifying information
that are Customer and Account Attributes (e.g., name or address of a
natural person Customer) and have a regulatory ``need to know'' that
Customer's Customer-ID in order to search the transactional CAT
Data.\296\
---------------------------------------------------------------------------

    \295\ See Part II.G.2., infra for a discussion of policies and
procedures relating to access to and use of CAT Data.
    \296\ Manual CAIS Access is distinct from Programmatic CAIS
Access and Programmatic CCID Subsystem Access, as discussed infra
Part II.F.6 (Programmatic CAIS Access) and Part II.F.7 (Programmatic
CCID Subsystem Access).
---------------------------------------------------------------------------

    The Commission preliminarily believes these proposed amendments are
appropriate because they describe the specific circumstances under
which Regulatory Staff may use Manual CAIS Access. In accordance with
the proposed amendments, if Regulatory Staff have already identified a
Customer of regulatory interest, Manual CAIS Access may be used. If a
Customer of regulatory interest has been identified, Regulatory Staff
could access CAIS manually to seek additional information about that
identified Customer. CAIS would contain Customer and Account Attributes
and other identifiers associated with a Customer (e.g., Customer-ID and
Industry Member Firm Designated ID).
    Consistent with this approach, the proposed amendments permit
wildcard searches based on multiple spellings of the known Customer's
name (e.g., Jone or Jones) or multiple spellings of a street associated
with a known Customer's name (e.g., the name ``Sally Jones'' could be
searched with ``Fis?her Street'' to identify individuals with that name
that live on either ``Fisher'' or ``Fischer'' Street). However, open-
ended searching of parameters that are not specific to an identified
Customer would be prohibited. Similarly, Regulatory Staff without
additional Customer identifying information would not be permitted to
search for all people sharing a common zip code, birth year or street.
The Commission preliminarily believes this proposed provision is
appropriate

because it extends the principle that Regulatory Staff must already
have identified a Customer of regulatory interest pursuant to
regulatory efforts before Manual CAIS Access will be permitted.
    The Commission also preliminarily believes that the proposed
amendments requiring that Manual CAIS Access be provided by the Plan
Processor via the CAIS/CCID Subsystem Regulator Portal are appropriate
because they set forth access and use restrictions, while at the same
time facilitating regulatory use. Specifically, the proposed
requirement specifies how such manual access must be implemented (i.e.,
through the CAIS/CCID Subsystem Regulatory Portal) by the Plan
Processor for access by Regulatory Staff. The CAIS/CCID Subsystem
Regulator Portal must facilitate query parameters based on data
elements in Customer and Account Attributes and other identifiers
available in the transaction database (e.g., Customer-ID(s) or Industry
Member Firm Designated ID(s)).\297\
---------------------------------------------------------------------------

    \297\ See supra Part II.E.1; see also proposed Appendix D,
Section 4.1.6 (Manual CAIS Access).
---------------------------------------------------------------------------

    Finally, the Commission preliminarily believes that it is
appropriate to amend the CAT NMS Plan to adopt performance requirements
for Manual CAIS Access so that there is a baseline performance metric
to assess the operation of Manual CAIS Access, and to facilitate the
return of query results within a timeframe that facilitates the
usefulness of the data obtained by Regulatory Staff from CAIS. Further,
the Commission also believes that it is appropriate to base the Manual
CAIS Access performance requirements on the Online Targeted Query Tool
Performance Requirements because the Online Targeted Query Tool enables
Regulatory Staff to retrieve transactional CAT Data using an on-line
query screen and includes the ability to choose from a variety of pre-
defined selection criteria, which is similar in operation to Manual
CAIS Access.
    The Commission requests comment on the proposed amendments to
define Manual CAIS Access and the requirements for using Manual CAIS
Access. Specifically, the Commission solicits comment on the following:
    104. The proposed amendments require Manual CAIS Access to be used
if Regulatory Staff, having identified Customers of regulatory interest
through regulatory efforts, require additional information from the CAT
regarding such Customers. Are the circumstances in which Manual CAIS
Access will be used clearly defined? If not, what additional detail
would be helpful? Are there any other circumstances in which Manual
CAIS Access might be appropriate? Please be specific in your response.
    105. The proposed amendments establish that additional information
about Customers may be accessed through Manual CAIS Access by (1) using
identifiers available in the transaction database to identify Customer
and Account Attributes associated with the Customer-IDs or industry
member Firm Designated IDs, as applicable; or (2) using Customer
Attributes in CAIS to identify Customer-IDs or industry member Firm
Designated IDs, as applicable, associated with the Customer Attributes,
in order to search the transaction database. Should requirements be
added in relation to accessing additional information about Customers
through Manual CAIS Access, e.g., limiting the number of records that
may be accessed? What limitation would be appropriate? Please be
specific and describe the impact that any limitation on record numbers
would have on regulatory value.
    106. The proposed amendments prohibit open-ended searching of
parameters not specific to Customers in Manual CAIS Access. Is it clear
to Commenters what an open-ended search is? Please explain what
commenters understand the term to mean. Should open-ended searches be
limited by other conditions in addition to the condition that it be
specific to a Customer? Please be specific in your response and explain
why any change to the proposed prohibition on open-ended searching
would be appropriate.
    107. The proposed amendments require Manual CAIS Access to provide
Regulatory Staff with the ability to retrieve data in CAIS via the
CAIS/CCID Subsystem Regulator Portal. Is the CAIS/CCID Subsystem
Regulator Portal an appropriate mechanism by which to require
Regulatory Staff to retrieve data in CAIS? Are there any other
appropriate means of providing Manual CAIS Access? If so, please
explain how those other means would operate and be implemented.
    108. The proposed amendments require query parameters for Manual
CAIS Access to be based on data elements including Customer and Account
Attributes and other identifiers available in the transaction database
(e.g., Customer-IDs or Firm Designated IDs). Should the query
parameters for Manual CAIS Access be based on these data elements? If
not, why not? Are there other query parameters that are more
appropriate? If so, why? Please be specific in your response.
    109. The proposed amendments require the Performance Requirements
for Manual CAIS Access to be consistent with the criteria set out in
Appendix D, Functionality of the CAT System, Online Targeted Query Tool
Performance Requirements. Is there another more appropriate performance
requirement in the CAT NMS Plan that should apply to Manual CAIS
Access? Why would alternative performance requirements more
appropriate? Please be specific in your response.
5. Manual CCID Subsystem Access
    The Commission also proposes to amend the CAT NMS Plan to include
requirements for manual access to the CCID Subsystem. ``Manual CCID
Subsystem Access'' would be defined to mean ``when used in connection
with the Customer Identifying Systems Workflow, as defined in Appendix
D, shall mean the Plan Processor functionality to manually query the
CCID Subsystem, in accordance with Appendix D, Data Security, and the
Participants' policies as set forth in Section 6.5(g).'' \298\ In
addition, the Commission proposes to amend the CAT NMS Plan to state
that if Regulatory Staff have the ITIN(s)/SSN(s)/EIN(s) of a
Customer(s) of regulatory interest identified through regulatory
efforts outside of the CAT and now require additional information from
the CAT regarding such Customer(s), then they may use Manual CCID
Subsystem Access.\299\ The proposed amendments also state that Manual
CCID Subsystem Access must allow Regulatory staff to convert ITIN(s)/
SSN(s)/EIN(s) into Customer-ID(s) using the CCID Subsystem, and that
Manual CCID Subsystem Access will be limited to 50 ITIN(s)/SSN(s)/
EIN(s) per query.\300\ The Commission also proposes to amend the CAT
NMS Plan to state that Manual CCID Subsystem Access must allow
Regulatory Staff to retrieve data from the CCID Subsystem via the CAIS/
CCID Subsystem Regulator Portal based on ITIN(s)/SSN(s)/EIN(s) \301\
where the CCID Transformation Logic is embedded in the client-side code
of the CAIS/CCID Regulator Portal.\302\ The Commission also proposes to
require that the performance requirements for the conversion of
ITIN(s)/SSN(s)/EIN(s) to Customer-ID(s) shall be consistent with the
criteria set out in Appendix D,

Functionality of the CAT System, Online Targeted Query Tool Performance
Requirements.\303\
---------------------------------------------------------------------------

    \298\ See proposed Section 1.1.
    \299\ See proposed Appendix D, Section 4.1.6 (Manual CCID
Subsystem Access).
    \300\ See id.
    \301\ Id.
    \302\ See proposed Appendix D, Section 4.1.6 (Manual CCID
Subsystem Access).
    \303\ See id.
---------------------------------------------------------------------------

    The Commission preliminarily believes the proposed amendments to
adopt Manual CCID Subsystem Access are appropriate because such access
would provide a way for Regulatory Staff that have the ITIN(s)/SSN(s)/
EIN(s) of a natural person or legal entity Customer as a result of
regulatory efforts outside of the CAT (e.g., from regulatory data, a
tip, complaint, referral, or from other data in the possession of
Regulatory Staff) to transform such ITIN(s)/SSN(s)/EIN(s) into
Customer-ID(s) and subsequently obtain other information identifying a
Customer that is associated with the Customer-ID, if that is in
furtherance of a regulatory purpose. The Commission also preliminarily
believes that limiting Manual CCID Subsystem Access to the submission
of 50 SSN(s)/ITIN(s)/EIN(s) per query is appropriate because in the
Commission's experience, 50 SSN(s)/ITIN(s)/EIN(s) is sufficient to
accommodate the needs of most regulatory examinations or investigations
involving SSN(s)/ITIN(s)/EIN(s).
    The Commission also preliminarily believes that it is appropriate
to specify, as the proposed amendments would, that Manual CCID
Subsystem access must be enabled through the CAIS/CCID Subsystem
Regulatory Portal, and that Transformation Logic must be embedded in
the client-side code of the CAIS/CCID Subsystem Regulator Portal. By
embedding the Transformation Logic in the client-side code of the CAIS/
CCID Subsystem Regulator Portal, the proposed amendments would help to
prevent the ITIN/SSIN/EIN of a Customer from entering any component of
the CAT System.
    Finally, the Commission is amending the CAT NMS Plan to adopt
performance requirements for Manual CCID Subsystem Access so that there
is a baseline performance metric to assess the operation of Manual CCID
Subsystem Access, and to facilitate the return of query results within
a timeframe that facilitates the usefulness of the data obtained by
Regulatory Staff from the CCID Subsystem.\304\ The Manual CCID
Subsystem Access performance requirements are based on the Online
Targeted Query Tool Performance Requirements because the Online
Targeted Query Tool, which provides Regulatory Staff with the ability
to retrieve transactional CAT Data using an on-line query screen and
includes the ability to choose from a variety of pre-defined selection
criteria, is most similar in operation to Manual CCID Subsystem Access.
In addition, the Commission believes that the query performance
requirement for the Online Targeted Query Tool is a reasonable
performance requirement for Manual CCID Subsystem Access because that
the Online Targeted Query Tool performance requirement of a one minute
query response time is drawn from targeted queries that return less
than 1 million rows of data based on a dataset covering less than a day
for a single CAT Reporter whereas the Manual CCID Subsystem Access is
transforming no more than 50 ITIN(s)/SSN(s)/EIN(s) per query.
---------------------------------------------------------------------------

    \304\ See supra note 294.
---------------------------------------------------------------------------

    The Commission requests comment on the proposed amendments to
define Manual CCID Subsystem Access and the requirements for using
Manual CCID Subsystem Access. Specifically, the Commission solicits
comment on the following:
    110. The proposed amendments require that Manual CCID Subsystem
Access will be used when Regulatory Staff have the ITIN(s)/SSN(s)/
EIN(s) of a Customer(s) of regulatory interest obtained through
regulatory efforts outside of CAT and now require additional
information from CAT regarding such Customer(s). Are the circumstances
in which Manual CCID Subsystem Access will be used clearly defined? If
not, what additional detail would be helpful? Are there any other
circumstances in which Manual CCID Subsystem Access might be
appropriate? Please be specific in your response.
    111. The proposed amendments require that Manual CCID Subsystem
Access will be limited to 50 ITIN(s)/SSN(s)/EIN(s) per query. Is this
limitation appropriate? If not, what number limitation would be
appropriate and why? Please be specific in your response and please
explain how a different threshold would not compromise the security of
the CCID Transformation Logic algorithm.
    112. The proposed amendments require that Manual CCID Subsystem
Access must provide Regulatory Staff with the ability to retrieve data
from the CCID Subsystem via the CAIS/CCID Subsystem Regulator Portal
with the ability to query based on ITIN(s)/SSN(s)/EIN(s) where the CCID
Transformation Logic is embedded in the client-side code of the CAIS/
CCID Subsystem Regulator Portal. Are there any other appropriate means
of providing Manual CCID Subsystem Access that also would not require
ITIN(s)/SSN(s) being reported to CAT? Please be specific in your
response.
    113. For Manual CCID Subsystem Access, should the CCID
Transformation Logic be embedded in the client-side code of the CAIS/
CCID Subsystem Regulator Portal? If not, where should it be embedded
and how would that prevent the reporting and collection of ITIN(s)/
SSN(s) to CAT?
    114. Is it appropriate to require that the performance requirements
for Manual CCID Subsystem Access be consistent with the criteria set
out in the Online Targeted Query Tool Performance Requirements set out
in Appendix D, Functionality of the CAT System? Is there another more
appropriate performance requirement in the CAT NMS Plan that should
apply to Manual CCID Subsystem Access? Why is that alternative
performance requirement more appropriate? Please be specific in your
response.
6. Programmatic Access--Authorization for Programmatic CAIS Access and
Programmatic CCID Subsystem
    While the Commission believes that manual access to both CAIS and
the CCID Subsystem will satisfy the vast majority of Participant use
cases, the Commission preliminarily believes that certain regulatory
inquiries based on the investigation of potential rule violations and
surveillance patterns depend on more complex queries of Customer and
Account Attributes and transactional CAT Data. Such inquiries could
involve regulatory investigations of trading abuses and other practices
proscribed by Rule 10b-5 under the Exchange Act,\305\ Section 17(a) of
the Securities Act,\306\ Rule 30(a) of Regulation SP \307\ and Rule 201
of Regulation S-ID,\308\ and Sections 206 and 207 of the Advisers
Act.\309\ Detecting and investigating trading based on hacked
information in violation of Rule 10b-5 and Section 17(a) of the
Exchange Act, for example, will often require the inclusion of
transactional and customer criteria in misconduct detection queries
with transactional and customer attributes in query result sets. With
CAT Data, determining the scope and nature of hacking and associated
trading misconduct could depend on tailored programmatic access to
transactional CAT Data and information identifying a Customer collected
in the CAT. Similar forms of complex queries and query result sets also
will facilitate detection

and investigation of insider trading, including identifying potential
illegal tippers. Complex query result sets that include transactional
data and customer attributes also can advance regulatory investigations
of unfair trade allocation practices (``cherry-picking''). In order to
address these needs, the Commission preliminary believes it is
appropriate to require the Plan Processor to provide programmatic
access to the Customer Identifying Systems, as further described below.
---------------------------------------------------------------------------

    \305\ 17 CFR 240.10b-5.
    \306\ 15 U.S.C.77q.
    \307\ 17 CFR 248.30(a).
    \308\ 17 CFR 248.201.
    \309\ 15 U.S.C.80b-6; 15 U.S.C.80b-7.
---------------------------------------------------------------------------

    In order to enable Regulatory Staff to carry out the regulatory
responsibilities to enforce the statutes and rules noted above, among
others, and to be consistent with and extend the ``least privileged''
practice of limiting access to Customer and Account Attributes, the
Commission preliminarily believes it is appropriate to limit use of
programmatic access to CAIS and the CCID Subsystem only to those
Participants that receive Commission approval for programmatic access
to those systems. Accordingly, the Commission is proposing to amend
Appendix D, Section 4.1.6 of the CAT NMS Plan to require a Participant
to submit an application, approved by the Participant's Chief
Regulatory Officer (or similarly designated head(s) of regulation) to
the Commission for authorization to use Programmatic CAIS Access or
Programmatic CCID Subsystem Access if a Participant requires
programmatic access.\310\
---------------------------------------------------------------------------

    \310\ See proposed Appendix D, Section 4.1.6.
---------------------------------------------------------------------------

    The application would seek three sets of information: (1)
Identification of the system for which programmatic access is being
requested (i.e., Programmatic CAIS Access and/or Programmatic CCID
Subsystem Access); (2) discussion of the need for programmatic access;
and (3) specifics on the regulatory purpose and systems that require
programmatic access, including: (a) The Participant's rules that
require programmatic access for surveillance and regulatory purposes;
(b) the regulatory purpose of the inquiry or set of inquires requiring
programmatic access; \311\ (c) a detailed description of the
functionality of the Participant's system(s) that will use data from
CAIS or the CCID Subsystem; (d) a system diagram and description
indicating architecture and access controls to the Participant's system
that will use data from CAIS or the CCID Subsystem; and (e) the
expected number of users of the Participant's system that will use data
from CAIS or the CCID Subsystem.
---------------------------------------------------------------------------

    \311\ Id. While the application addresses the inquiries or set
of inquiries that will be performed using programmatic access, the
Customer Identifying Systems Workflow applies at the query level.
Each query must be designed such that query results would contain
only the Customer and Account Attributes that Regulatory Staff
reasonably believes will achieve the regulatory purpose of the
inquiry or set of inquiries.
---------------------------------------------------------------------------

    The Commission also proposes amendments that would provide the
process for Commission consideration of the application for
Programmatic CAIS Access or Programmatic CCID Subsystem Access.
Specifically, the Commission proposes that SEC staff shall review the
application and may request supplemental information to complete the
review prior to Commission action.\312\ Once the application is
completed, the proposed amendments would provide that the Commission
shall approve Programmatic CAIS Access or Programmatic CCID Subsystem
Access if it finds that such access is generally consistent with one or
more of the following standards: That such access is designed to
prevent fraudulent and manipulative acts and practices; to promote just
and equitable principles of trade; to foster cooperation and
coordination with persons engaged in regulating, clearing, settling,
processing information with respect to, and facilitating transactions
in, securities; to remove impediments to and perfect the mechanism of a
free and open market and a national market system; and, in general, to
protect investors and the public interest.\313\ The proposed amendments
further would provide that the Commission shall issue an order
approving or disapproving a Participant's application for Programmatic
CAIS Access or Programmatic CCID Subsystem Access within 45 days of
receipt of a Participant's application, which can be extended for an
additional 45 days if the Commission determines that such longer period
of time is appropriate and provides the Participant the reasons for
such determination.\314\
---------------------------------------------------------------------------

    \312\ Id.
    \313\ Id.
    \314\ Id.
---------------------------------------------------------------------------

    The Commission preliminarily believes that each requirement
proposed for the application would elicit the essential information
that the Commission needs in order to assess whether to grant
programmatic access to CAIS or the CCID Subsystem, as further discussed
below. As such, the application requirements are designed to require
each Participant that applies for programmatic access to provide
detailed and thorough information that is tailored to explain why
programmatic access is required by such Participant in order to achieve
that Participant's unique regulatory and surveillance purposes, and why
such access to transactional CAT Data and Customer and Account
Attributes will be responsive to a Participant's inquiry or set of
inquiries. These requirements are designed to set a high bar for
granting an application for programmatic access so that such access is
only granted when there is a demonstrated need and ability to use such
access responsibly.
    The Commission preliminarily believes that approval of the
application process by the Participant's Chief Regulatory Officer (or
similarly designated head(s) of regulation) is appropriate because the
Participant's Chief Regulatory Officer has the best understanding of
how programmatic access to CAIS or the CCID Subsystem fits into the
overall regulatory program and surveillance needs of the Participant.
Approval by the Chief Regulatory Officer also would help to ensure that
the need for programmatic access is assessed without any undue business
pressures or concerns.\315\
---------------------------------------------------------------------------

    \315\ Importantly, the Chief Regulatory Office is subject to
oversight by the Regulatory Oversight Committee, which provides a
governance structure for the Chief Regulatory Officer.
---------------------------------------------------------------------------

    Because there are two systems that contain information identifying
Customers, the Commission also preliminarily believes that it is
appropriate to require the Participant to indicate whether it is
seeking Programmatic CAIS Access and/or Programmatic CCID Subsystem
Access. Such identification would also enable the Commission to assess
whether the type of access being requested by the Participant is
consistent with the regulatory purpose of the inquiry or set of
inquiries being pursued by the Participant's Regulatory Staff. The
Commission preliminarily believes that given the different
functionality of the two systems, separate applications and
demonstrations of need and the ability to secure the data are required.
    As previously discussed, the CAT NMS Plan adheres to the ``least
privileged'' practice of limiting access to Customer Identifying
Systems as much as possible. Therefore, the Commission believes that it
is appropriate to require the Participant's application for
programmatic access to indicate why manual access to CAIS and the CCID
Subsystem cannot achieve the regulatory purpose of an inquiry or set of
inquiries being pursued by Regulatory Staff before permitting
programmatic access to CAIS and the CCID Subsystem. Requiring this
information also would help the Participant's Chief Regulatory Officer
(or similarly designated head(s) of

regulation) to conduct a fulsome analysis of his or her Regulatory
Staff's need for programmatic access. The Commission preliminarily
believes manual access will be sufficient in many cases and that need
for programmatic access must be justified based on current and intended
practices.
    The Commission also preliminarily believes that it is appropriate
to require the Participant's application to identify the Participant's
specific rules that necessitate Programmatic Access for surveillance
and regulatory purposes. For example, programmatic access to CAIS might
be reasonable if the investigation into the potential violation of such
rule would require knowledge of Customer and Account Attributes and
transactional CAT Data to identify misconduct. The Participants should
be specific in their justification for Programmatic Access; generally
stating that programmatic access is required for member regulation, for
example, would not be sufficient to justify Programmatic Access. The
Participants must identify the nature of the specific rules or
surveillance patterns that they believe require programmatic access.
The Commission preliminarily believes that many forms of misconduct can
be addressed using manual access and that programmatic access will not
be necessary.
    After considering the specific rule(s) that the Participant
represents necessitates programmatic access, the Commission
preliminarily believes that the next logical step in the assessment of
whether programmatic access should be granted is to consider the
regulatory purpose of the inquiry or set of inquires being conducted by
Regulatory Staff; if a regulatory purpose for the inquiry or set of
inquiries cannot be articulated, programmatic access cannot be
justified. Therefore, the Commission preliminarily believes that a
clear statement by a Participant that explicitly articulates the
reasons that access should be granted and for what purposes, in light
of the Participant's rule(s) that required programmatic access, is
appropriate. If SEC staff believes that sufficient detail is lacking,
staff may request additional information, as described below.
    While all access and analysis of Customer and Account Attributes
must occur within the SAW, the Commission must be assured that Customer
and Account Attributes will be incorporated securely into the
Participant's system before granting programmatic access. Therefore,
the Commission also preliminarily believes that sufficient information
about how a Participant intends to incorporate data from the Customer
Identifying Systems into the Participant's system is needed in order to
assess whether programmatic access should be granted. The Commission
preliminarily believes that in addition to detailed description of
functionality, requiring a system diagram and description indicating
architecture and access controls at the Participant's system would
provide a sufficient starting point to assess whether access should be
granted; if needed, SEC staff would request additional information from
the Participant. The Commission preliminarily believes that only
Participants who demonstrate they have the surveillance and technical
expertise to use programmatic access in a secure manner may be granted
programmatic access.
    While the Commission does not believe there is a number of users
that is appropriate for all Participants and all regulatory inquiries,
the number of users at a Participant that are performing inquiries can
be relevant to data security concerns (i.e., the ability to protect the
data in the Customer Identifying Systems can be affected by the number
of users with access to the data in the Customer Identifying Systems).
Therefore, the Commission preliminarily believes that information about
the expected number of users for the Participant's system that would
use data from CAIS or the CCID Subsystem is an appropriate data point
to solicit from the Participants.
    The Commission also believes it is appropriate to amend the CAT NMS
Plan to provide that SEC staff may request supplemental information to
complete the review prior to Commission action. Given the scope of data
that can be accessed from the Customer Identifying Systems under
programmatic access, the Commission believes that it is vital to the
approval process that the Participant clearly assess and articulate its
need for programmatic access, and that the Commission receive and
understand the Participant's need for programmatic access. The
information solicited by the application process would help to ensure
that programmatic access follows the ``least privileged'' practice of
limiting access to Customer Identifying Systems as much as possible, is
based on a ``need to know'' the data in the Customer Identifying
Systems, and contains only the data from the Customer Identifying
Systems that Regulatory Staff reasonably believes will achieve the
regulatory purpose of the inquiry or set of inquiries; however, should
SEC staff require additional information, the Commission believes that
the CAT NMS Plan should allow SEC staff to request additional
information about the programmatic application from the submitting
Participant.\316\
---------------------------------------------------------------------------

    \316\ Should a Participant receive approval for Programmatic
Access, such Participant would not be precluded from incorporating
in its analytical tools the ability to manually query CAIS and the
CCID Subsystem.
---------------------------------------------------------------------------

    As proposed, Programmatic CAIS Access and Programmatic CCID
Subsystem Access would be used by certain approved Regulatory Staff in
the Participant's SAW, subject to specific conditions, and focused on a
defined regulatory purpose of an inquiry or set of inquiries. A
Participant's application would be approved if it is generally
consistent with one or more of the criteria. The Commission believes
that this approval standard allows for flexibility and the ability to
tailor access to specific regulatory needs.
    The Commission also believes that requiring the Commission to issue
an order approving or disapproving a Participant's application for
programmatic access within 45 days is appropriate in order to
facilitate a timely decision on the application. However, it is also
appropriate to allow for an extension of time for Commission action if
the Commission needs more time to consider whether the application is
appropriate and provides its reasons for the extension to the
Participant. Allowing extensions of time should help to facilitate a
thorough review of the application by the Commission.
    The Commission understands that a Participant's programmatic access
may evolve over time. As such, the Commission believes that it is
appropriate to require that policies be reasonably designed to
implement and satisfy the Customer and Account Attributes data
requirements of Section 4.1.6 of Appendix D, such that Participants
must be able to demonstrate that a Participant's ongoing use of
programmatic access adheres to the restrictions of the Customer
Identifying Systems Workflow, as set forth in a Participant's Data
Confidentiality Policies governing programmatic access, as required by
Section 6.5(g)(i)(I) of the CAT NMS Plan, described below.\317\ Such
policies also are subject to an annual independent examination, which
will help ensure ongoing effectiveness of a Participant's Data
Confidentiality Policies as they relate to that Participant's
programmatic

access.\318\ In addition and as described above, other proposed
amendments to the Plan will also protect transactional CAT Data and
Customer and Account Attributes accessed through programmatic access;
notably, access would be within the SAW and governed by the CISP, the
organization-wide and system-specific controls and related policies and
procedures required by NIST SP 800-53 and applicable to all components
of the CAT System. Such requirements will enable ongoing oversight of
each approved Participant's programmatic access by the Plan Processor
and the Commission, and will help limit programmatic access to
appropriate use cases initially and on an ongoing basis.
---------------------------------------------------------------------------

    \317\ See infra Part II.G.3.c (Policies and Procedures Relating
to Customer and Account Attributes).
    \318\ See infra Part II.G.4.
---------------------------------------------------------------------------

    The Commission requests comment on the proposed amendments to set
forth the approval process for Programmatic CAIS and Programmatic CCID
Subsystem Access. Specifically, the Commission solicits comment on the
following:
    115. The proposed amendments require that the Participant's
application for programmatic access be approved by the Participant's
Chief Regulatory Officer (or similarly designated head(s) of
regulation). Is the Participant's Chief Regulatory Officer (or
similarly designated head(s) of regulation) the appropriate person to
approve the application? If not, why not? Is there another person or
entity that should approve the Participant's application?
    116. Is it appropriate for the application to require the
Participant to indicate which programmatic access is being requested:
Programmatic CAIS Access and/or Programmatic CCID Subsystem Access? Why
or why not?
    117. The proposed amendments require the Participant to detail in
an application to the Commission why Programmatic CAIS Access or
Programmatic CCID Subsystem is required, and why Manual CAIS Access or
Manual CCID Subsystem Access cannot achieve the regulatory purpose of
an inquiry or set of inquiries. Is this information sufficient to
explain why programmatic access is required? Should Participants have
to provide more than an explanation of why manual access cannot achieve
the regulatory purpose or an inquiry or set of inquiries? What other
information should be solicited? Please be specific in your response.
    118. The proposed amendments require that the application explain
the Participant's rules that require Programmatic Access for
surveillance and regulatory purposes. Should any other aspect of the
Participant rules to be explained in the application? If so, please
explain.
    119. The proposed amendments require that the application explain
the regulatory purpose of the inquiry or set of inquiries requiring
programmatic access. Is there additional detail that could be added to
this standard? If so, what provisions could be added to clarify this
standard? Please be specific in your response.
    120. The proposed amendments require that an application to the
Commission provide a detailed description of the functionality of the
Participant's system(s) that will use data from CAIS or the CCID
Subsystem. Is there anything in addition to the functionality of the
Participant's system(s) that will use the data from CAIS and the CCID
Subsystem that should be provided by the Participant? Please provide
detail about why this additional information is necessary and how it
would be appropriate for the Commission to consider in its assessment
of whether to provide programmatic access to the Participant.
    121. The proposed amendments require that the application provide a
system diagram and description indicating architecture and access
controls to the Participant's system that will use data from CAIS or
the CCID Subsystem. Is there any other information regarding the
Participant's system and the architecture and access controls that
should be provided? Please describe that additional information in
detail and explain how this will be useful in the Commission's
assessment of whether to provide programmatic access to the
Participant.
    122. The proposed amendments require the application to indicate
the expected number of users of the Participant's system that will use
data from CAIS or the CCID Subsystem. Is there any other information
about users in the Participants' system that will use the data that
should be required? Please be specific and explain why it would be
appropriate to add such a requirement.
    123. The proposed amendments provide that the Commission shall
approve Programmatic CAIS Access or Programmatic CCID Subsystem Access
if it finds that such access is generally consistent with one or more
of the following standards: That such access is designed to prevent
fraudulent and manipulative acts and practices; to promote just and
equitable principles of trade; to foster cooperation and coordination
with persons engaged in regulating, clearing, settling, processing
information with respect to, and facilitating transactions in,
securities; to remove impediments to and perfect the mechanism of a
free and open market and a national market system; and, in general, to
protect investors and the public interest. Are there other standards
that should be used by the Commission to assess whether to grant a
Participant's application for Programmatic CAIS Access or Programmatic
CCID Subsystem Access? Please be specific and explain why such other
standards would be more appropriate.
    124. Under the proposed amendments, the Commission shall issue an
order approving or disapproving a Participant's application for
programmatic access within 45 days, which can be extended by the
Commission for an additional 45 days, if the Commission determines that
such longer period of time is appropriate and provides the Participant
with the reasons for such determination. Do commenters believes that 45
days is an appropriate amount of time for Commission action? Is another
time period for Commission action more appropriate? Is another time
period for the extension of time for Commission action more
appropriate? If so, what time would that be? Please be specific and
explain why a different time period would be more appropriate.
    125. Once Commission approval of an application is granted, an
approved Participant would be permitted to use programmatic access
subject to the ongoing restrictions identified in Appendix D, Section
4.1.6 and Article VI, Section 6.5(g), as well as those related to use
of a SAW; however, the proposed amendments would not require an
approved Participant to submit updated applications as its use of
programmatic access evolves. Should updates to application materials be
required in order for Participants to maintain their programmatic
access, or should Participants have to re-apply to maintain their
programmatic access? Or is it sufficient that the policies and
procedures in Section 6.5(g)(i) require the Participants to establish,
maintain and enforce their policies and procedures? If Participants
were required to re-apply to maintain their programmatic access, what
criteria should be used for requiring re-application? For example,
should approval for programmatic access expire after a set amount of
time, so that Participants would have to re-apply at regular intervals
in order to maintain their programmatic access? If so, what time period
would be reasonable? For example, should Participants be required to
re-apply every two years to maintain their programmatic access?

Alternatively, should Participants be required to re-apply for
programmatic access only if there is a material change in their use of
programmatic access?
7. Programmatic CAIS Access
    The Commission believes that it is appropriate to set forth the
circumstances and requirements for Programmatic CAIS Access. The
proposed amendments will define Programmatic Access, when used in
connection with the Customer Identifying Systems Workflow, to mean the
Plan Processor functionality to programmatically query, and return
results that include, data from the CAIS and transactional CAT Data, in
support of the regulatory purpose of an inquiry or set of inquiries, in
accordance with Appendix D, Data Security, and the Participants'
policies as set forth in Section 6.5(g).\319\ The Commission proposes
to amend the CAT NMS Plan to state that Programmatic CAIS Access may be
used when the regulatory purpose of the inquiry or set of inquiries by
Regulatory Staff requires the use of Customer and Account Attributes
and other identifiers (e.g., Customer-ID(s) or Industry Member Firm
Designated ID(s)) to query Customer and Account Attributes and
transactional CAT Data.\320\ In addition, the Commission proposes to
require that the Plan Processor provide Programmatic CAIS Access by
developing and supporting an API that allows Regulatory Staff to use
analytical tools and ODBC/JDBC drivers to access the data in CAIS, and
that the Performance Requirements for Programmatic CAIS Access shall be
consistent with the criteria set out in Appendix D, Functionality of
the CAT System, User-Defined Direct Query Performance
Requirements.\321\
---------------------------------------------------------------------------

    \319\ See CAT NMS Plan, Section 6.5(g)(1).
    \320\ See proposed Appendix D, Section 4.1.6 (Programmatic CAIS
Access).
    \321\ See id.
---------------------------------------------------------------------------

    The Commission preliminarily believes that these proposed
amendments are appropriate because they set forth the parameters for
Programmatic CAIS access, which would permit a programmatic interface
that facilitates the submission of complex queries for both the
transactional CAT Database and the Customer Identifying Systems. For
example, if the regulatory purpose of an inquiry or set of inquiries
being pursued by Regulatory Staff involved insider trading before a
company news release, Programmatic CAIS Access could be an appropriate
method for accessing CAIS because Regulatory Staff could search the
transactional CAT Database for consistently profitable trading activity
and filter the data using the parameters of name and zip code--part of
Customer and Account Attributes--to find Customer-IDs or other
information identifying Customers that might be responsive to the
inquiry or set of inquiries.
    As discussed above, Programmatic CAIS Access must be within the
SAW, adhere to the ``least privileged'' practice of limiting access to
Customer Identifying Systems as much as possible, is based on a ``need
to know'' the data in the Customer Identifying Systems, and must
contain only the data from the Customer Identifying Systems that
Regulatory Staff reasonably believes will achieve the regulatory
purpose of the inquiry or set of inquiries. In addition, as required by
Article VI, Section 6.5(g)(i)(I), the policies of the Participants must
be reasonably designed to implement and satisfy the Customer and
Account Attributes data requirements of Section 4.1.6 of Appendix D
such that Participants must be able to demonstrate that a Participant's
ongoing use of Programmatic CAIS and/or CCID Subsystem access is in
accordance with the Customer Identifying Systems Workflow, which will
enable an ongoing analysis of whether Programmatic CAIS Access is being
used by an approved Participant appropriately.\322\ Therefore, the
Commission believes that these are appropriate limitations on
Programmatic CAIS Access.
---------------------------------------------------------------------------

    \322\ See Part II.G.3.c, infra, for a discussion of the policies
relating to Customer and Account Attributes.
---------------------------------------------------------------------------

    Finally, the Commission preliminarily believes that it is
appropriate to amend the CAT NMS Plan to adopt performance requirements
for Programmatic CAIS Access so that there is a baseline performance
metric to assess the operation of such access, and to facilitate the
return of query results within a timeframe that facilitates the
usefulness of the data obtained by Regulatory Staff from CAIS. The
Commission also believes that it is appropriate to base the
Programmatic CAIS Access performance requirements on the User-Defined
Direct Query Performance Requirements because User-Defined Direct
Queries are the most similar to Programmatic CAIS Access and thus would
provide Regulatory Staff with programmatic interfaces that would enable
and support, for example, complex queries, including the ability to
provide query results that are extractable/downloadable, multistage
queries; and concurrent queries.
    The Commission requests comment on the proposed amendments to
define and set forth the requirements for Programmatic CAIS Access.
Specifically, the Commission solicits comment on the following:
    126. The proposed amendments establish that Programmatic CAIS
Access may be used when the regulatory purpose of the inquiry or set of
inquiries by Regulatory Staff requires the use of Customer and Account
Attributes and other identifiers (e.g., Customer-ID(s) or Firm
Designated ID(s)) to query the Customer and Account Attributes and
transactional CAT Data. Are the circumstances in which Programmatic
CAIS Access may be used clearly defined? If not, what additional detail
would be helpful? Are there any other circumstances in which
Programmatic CAIS Access might be appropriate? Please be specific in
your response.
    127. The proposed amendments require the Plan Processor to provide
Programmatic CAIS Access by developing and supporting an API that
allows Regulatory Staff to use analytical tools and ODBC/JDBC drivers
to access the data in CAIS. Is there another more appropriate method to
allow Regulatory Staff to access the data in CAIS? Please be specific
in your response.
    128. The proposed amendments require that the performance
requirements for Programmatic CAIS Access be consistent with the
criteria in the User-Defined Direct Query Performance Requirements set
out in Appendix D, Functionality of the CAT System. Is there another
more appropriate performance requirement in the CAT NMS Plan that
should apply to Programmatic CAIS Access? Why is that alternative
performance requirement more appropriate? Please be specific in your
response.
8. Programmatic CCID Subsystem Access
    The Commission believes that it is appropriate to amend the CAT NMS
Plan to set forth the circumstances and requirements for Programmatic
CCID Subsystem Access. The proposed amendments would define CCID
Subsystem Access when used in connection with the Customer Identifying
Systems Workflow, to mean the Plan Processor functionality to
programmatically query the CCID Subsystem to obtain Customer-ID(s) from
Transformed Value(s), in support of the regulatory purpose of an
inquiry or set of inquiries, in accordance with Appendix D, Data
Security, and the Participants' policies as set forth in

Section 6.5(g).\323\ The Commission proposes to amend the CAT NMS Plan