shall ``[s]pecify a process for identifying and correcting errors in
the data reported to the central repository pursuant to [Rule 613(c)(3)
and (c)(4)], including the process for notifying the national
securities exchanges, national securities associations, and members who
reported erroneous data to the central repository about such errors, to
help ensure that such errors are promptly corrected by the reporting
entity, and for disciplining those who repeatedly report erroneous
data; and * * * [s]pecify the time by which data that has been
corrected will be made available to regulators.'' \647\
---------------------------------------------------------------------------

    \645\ See Aditat Letter, p. 2; FIF Letter, p. 4; FINRA Letter,
p. 11; Nasdaq Letter I, p. 8.
    \646\ See Rule 613(e)(6)(i). The term ``error rate'' is defined
in Rule 613(j)(6) to mean ``[t]he percentage of reportable events
collected by the central repository in which the data reported does
not fully and accurately reflect the order event that occurred in
the market.'' The SROs should consider calculating an aggregate
error rate as well as error rates for subcategories such as trade
reporting and quote reporting.
    \647\ See Rule 613(e)(6)(iii) through (iv).
---------------------------------------------------------------------------

    As noted above, the Commission believes the availability of
accurate consolidated data is a critical component of a useful and
effective audit trail. Ideally, there would be no errors in the
recording or reporting of any audit trail data element, and every data
element of every reportable event would be accurately recorded by the
SROs and their members, and then accurately reported to the central
repository under Rule 613, resulting in a consolidated audit trail that
reflects all actions relating to every order in the market for
securities. However, because the Commission understands that, to some
extent, errors in reporting audit trail data to the central repository
will occur, the Commission believes it is appropriate to adopt a
provision in Rule 613 that requires the NMS plan to set forth the
maximum error rate to be tolerated by the central repository in the
reporting of audit trail data, as well as to specify a process for
identifying and correcting such errors.\648\
---------------------------------------------------------------------------

    \648\ See Rule 613(e)(6).
---------------------------------------------------------------------------

    The Commission notes that the Rule leaves to the plan sponsors the
ability to determine the acceptable maximum error rate, although the
Rule does require that the NMS plan must explain the basis for
selecting such rate. The Rule also requires the NMS plan submitted to
the Commission for its consideration to set forth how the plan sponsors
will seek to reduce such maximum error rate over time, thereby
increasing the accuracy of audit trail data. Further, the Rule requires
the NMS plan to have in place a means to ensure compliance with the
maximum error rate so that SROs and their members are incentivized to
comply with the maximum error rate, and to set forth a plan for
promptly remedying the causes for any noncompliance.
    Since the Rule leaves many of the specific details regarding error
rates and error-correction processes for the plan sponsors to
determine, and because the accuracy and completeness of data ultimately
received by regulators is of such significance to the effective use of
a consolidated audit trail, the Commission, as well as the public,
would likely consider such details very important in their overall
evaluation of the submitted plan. Furthermore, given that the approval
of any plan by the Commission would, in part, be based on expectations
of maximum error rates, the Commission believes it is equally important
for objective measures to be reported that track how well the plan is
meeting such expectations. Thus, to ensure the accuracy of the audit
trail data generally meets these expectations, Rule 613(e)(6)(ii) also
requires that the error rate identified in the NMS plan be measured
each business day and that remedial action be taken if, on any given
day, the error rate exceeds the maximum error rate set forth in the NMS
plan.\649\
---------------------------------------------------------------------------

    \649\ The Commission recognizes that in any complex system there
is always a risk of occasional unexpected errors, or errors caused
by rare and unexpected events. However, the Commission believes
that, by tracking error rates on a daily basis, the SROs, and the
Commission would be able to observe any repeated patterns or longer-
term trends that suggest more systematic problems or concerns with
data collection, reporting, or consolidation processes.
---------------------------------------------------------------------------

    The Commission also believes it is appropriate to require the SROs
to formulate a process for identifying and dealing with errors, and to
require that the SROs or the members reporting erroneous data be
notified that an error

in reporting has occurred.\650\ In addition, the Commission believes it
is appropriate to require the SROs to develop a process to help ensure
that errors are promptly corrected by the reporting SRO or member. The
Commission understands that requirements similar to these are currently
implemented by FINRA as part of their OATS process, though cross-firm
errors, such as those leading to irreconcilable or unmatched routes,
are not generally corrected under the OATS process.\651\ The Commission
further believes that disciplining SROs and members that repeatedly
report erroneous audit trail data, as required by Rule 613(e)(6)(iii),
is appropriate given the need to maintain an accurate consolidated
audit trail for regulatory purposes. Finally, given that the NMS plan
submitted to the Commission for its consideration is required to
specify a process for correcting errors, the Commission also believes
it is appropriate to require, pursuant to Rule 613(e)(6)(iv), that the
NMS plan submitted to the Commission for its consideration specify the
time by which data that has been corrected will be made available to
regulators. In reviewing the NMS plan submitted for its consideration,
the Commission will therefore be able to consider the time that
uncorrected but consolidated data (which was reported to the central
repository by 8:00 a.m. Eastern Time on the trading day following the
day such information was recorded) would be available for use by
regulators, the expected error rate of this data, and the time at which
a corrected version of this data would be made available to regulators.
These three parameters will help inform regulators as to the potential
effectiveness of starting different types of surveillance and
monitoring activities at different times.\652\
---------------------------------------------------------------------------

    \650\ See Rule 613(e)(6)(iii) through (iv).
    \651\ See Commission Staff Memorandum, supra note 64.
    \652\ See Rule 613(a)(1)(ii).
---------------------------------------------------------------------------

    The Commission acknowledges there would be costs to the central
repository associated with developing policies and procedures related
to the timeliness, accuracy, integrity, and completeness of data,
including, but not limited to, processes for identifying and correcting
errors in the audit trail data received, and measuring the error rate
on a daily basis. However, the size of these costs depends
significantly on the specific details of the NMS plan submitted to the
Commission for its consideration. Once the SROs submit the NMS plan to
the Commission for its consideration specifying the details,
parameters, and estimated costs of such processes, as well as the
maximum error rate expected under such processes, the Commission and
the public will be able to consider this information when determining
whether to approve the NMS plan.
d. Access to the Central Repository and Consolidated Audit Trail Data
for Regulatory and Oversight Purposes
    As proposed, each national securities exchange and national
securities association, as well as the Commission, would have had
access to the central repository for the purposes of performing its
respective regulatory and oversight responsibilities pursuant to the
federal securities laws, rules, and regulations.\653\ This access would
have included all systems of the central repository, and the data
reported to and consolidated by the central repository.\654\ In
addition, the Commission proposed to require that the NMS plan include
a provision requiring the creation and maintenance by the central
repository of a method of access to the consolidated data.\655\ This
method of access would have been required to be designed to include
search and reporting functions to optimize the use of the consolidated
data. The Commission requested comment on whether it should allow the
consolidated audit trail data to be made available to third parties,
such as for academic research.
---------------------------------------------------------------------------

    \653\ See proposed Rule 613(e)(2).
    \654\ Id.
    \655\ See proposed Rule 613(e)(3).
---------------------------------------------------------------------------

    One commenter supported limiting access to the consolidated audit
trail data to the Commission and SROs for regulatory purposes, but
suggested it would also be appropriate to share the data with the
CFTC.\656\ Other commenters supported the idea of providing
``anonymized'' data for academic use, as long as appropriate controls
were established to assure regulators and market participants that
confidential trading information could not be revealed.\657\
Specifically, one commenter endorsed the use of the data ``with
appropriate safeguards'' by academic researchers, explaining that it
will ``promote understanding of the markets,'' and ``lead to better
policy decisions and thus more fair and orderly markets.'' \658\
Similarly, another commenter also supported the use of the data by
certain third parties and stated that ``[a]ccess to real-world data can
help research immensely.'' \659\
---------------------------------------------------------------------------

    \656\ See Liquidnet Letter, p. 8-9. See also SIFMA Letter, p.
19.
    \657\ See Angel Letter, p. 3; Albany Letter, p.1-4; and TIAA-
CREF Letter, p.4.
    \658\ See Angel Letter, p. 3.
    \659\ See Albany Letter, p. 1-3. This commenter acknowledged the
privacy concerns involved in making the data available for academic
research, but stated that researchers have faced similar challenges
before and researchers are capable of developing a way to access and
share information without the risk of divulging trading strategies
or identities. The commenter also stated that data released after a
delay would limit the data's usefulness.
---------------------------------------------------------------------------

    The Commission also received a comment that argued for extending
access to the consolidated audit trail data to certain individuals who
have a fiduciary responsibility to shareholders of a company. This
commenter explained that such access would allow them to audit all
trading activity in the equity or other derivative securities of that
company.\660\
---------------------------------------------------------------------------

    \660\ See Van Bokkelen Letter, p. 1.
---------------------------------------------------------------------------

    The Commission recognizes there may be certain benefits to the
types of expanded access to data in the central repository that has
been suggested by various commenters, but, for the reasons discussed
below, it is adopting the provisions in Rule 613 regarding access by
regulatory authorities at the SROs and the Commission to the systems
operated by the central repository, and to the data received,
consolidated, and retained by the central repository, substantively as
proposed in Rule 613(e)(3), but with one clarification regarding the
requirement for access by regulators.\661\ Specifically, Rule
613(e)(3), as adopted, provides that ``[t]he national market system
plan submitted pursuant to this section shall include a provision
requiring the creation and maintenance by the plan processor of a
method of access to the consolidated data stored in the central
repository that includes the ability to run searches and generate
reports.'' As proposed, Rule 613(e)(3) would have provided that the
central repository must have a ``reporting function.'' The Commission
believes that this language is ambiguous and may have implied that the
central repository was required to do more than respond to search
queries. Accordingly, the Commission is replacing the requirement in
proposed Rule 613(e)(3) that the central repository provide ``search
and reporting functions'' with the requirement that there be ``the
ability to run searches and generate reports.'' The change in language
from that contained in the Rule, as proposed, is not intended to

change the substance of the requirement.
---------------------------------------------------------------------------

    \661\ See Rule 613(e)(3). See also Rule 613(a)(1)(ii) (requiring
the NMS plan to detail how readily the NMS plan will allow data in
the central repository to be accessed by regulators, as well as the
regulators' manner of access); see also Section III.C.2.a.i., infra.
---------------------------------------------------------------------------

    In response to the commenter who suggested sharing data with the
CFTC, the Commission notes that it has shared information with the CFTC
in the past and that it intends to continue sharing information when
the situation so warrants. The Commission notes that, among other
arrangements, it currently has information-sharing agreements with
other regulators. The Commission also agrees with commenters that there
may be benefits to allowing academics or other third parties to have
access to data collected by the central repository. Academic and other
third-party analyses are helpful to the Commission in performing its
own evaluation of the economic costs and benefits of regulatory policy.
The Commission also notes that one commenter believes that the ability
of companies to detect manipulative trading activity in their
securities could be enhanced if certain individuals, who have a
fiduciary responsibility to shareholders, were given access to limited
consolidated audit trail data. However, because the creation and
implementation of the consolidated audit trail is in the formative
stage, and in light of commenters' concerns about the privacy and
security of the information, the Commission believes it is premature to
require that the NMS plan require the provision of data to third
parties.
    Though the Commission is not specifying a particular process, or
any details, regarding the mechanism(s) by which regulators will access
data in the central repository, the Rule requires the SROs to provide
such details and cost estimates in its NMS plan submitted to the
Commission for its consideration.\662\ Further, as discussed below in
Section III.C.2.c., the Commission is providing the SROs with detailed
regulator use cases for how regulators would likely make use of the
data in the central repository. These regulator use cases are designed
to help the SROs respond with sufficient details in the NMS plan
submitted to the Commission for its consideration so that, along with
associated cost estimates also required to be provided by the SROs, the
Commission and the public will be able to fully consider the NMS plan
submitted.
---------------------------------------------------------------------------

    \662\ See Sections III.C.2.a.i through ii., infra; Rule
613(a)(1)(ii) through (vii).
---------------------------------------------------------------------------

e. Confidentiality of Consolidated Data
    Rule 613(e)(4)(i), as proposed, would have required that the NMS
plan include policies and procedures, including standards, to be used
by the plan processor to ensure the security and confidentiality of all
information reported to, and maintained by, the central repository. The
plan sponsors and employees of the plan sponsors and central repository
would have been required to agree to use appropriate safeguards to
ensure the confidentiality of such data, and not to use such data other
than for surveillance and regulatory purposes.\663\ As proposed, Rule
613 also would have required the NMS plan to include mechanisms to
ensure compliance by the plan sponsors and their members with the
requirements of the plan.\664\
---------------------------------------------------------------------------

    \663\ See proposed Rule 613(e)(4)(i). However, a plan sponsor
also would be permitted to use the data it submits to the central
repository for commercial or other purposes as otherwise permitted
by applicable law, rule or regulation. Id.
    \664\ See proposed Rule 613(h)(3), Rule 613(g)(4).
---------------------------------------------------------------------------

    In the Proposing Release, the Commission solicited comments
regarding what steps should be taken to ensure appropriate safeguards
with respect to the submission of customer information, as well as the
receipt, consolidation, and maintenance of such information in the
central repository. The Commission requested comment on the issue of
appropriate safeguards to be put in place by the SROs and the central
repository to help ensure confidentiality. The Commission also asked
whether the proposed Rule should: (1) Require that SROs put in place
specific information barriers or other protections to help ensure that
data is used only for regulatory purposes; (2) provide for an audit
trail of the SROs' personnel access to, and use of, information in the
central repository to help monitor for compliance with appropriate
usage of the data; and (3) include a requirement that the NMS plan
include policies and procedures to be used by the plan processor to
ensure the security and confidentiality of information reported to, and
maintained by, the central repository be expanded to include the
content of any searches or queries performed by the SROs or the
Commission on the data.\665\
---------------------------------------------------------------------------

    \665\ See Proposing Release, supra note 4, at 32582.
---------------------------------------------------------------------------

    Several commenters expressed concern about how to best ensure the
confidentiality of the data collected.\666\ One commenter generally
argued that safeguards for the audit trail data had not been
sufficiently addressed in the Proposing Release.\667\ Another commenter
recommended that the operator of the central repository and the SROs be
required to implement security policies, processes, and practices
consistent with industry best practices for the protection of sensitive
information and that such policies, processes, and practices be audited
on an annual basis by a third-party expert.\668\ Similarly, one
commenter suggested that vendors also should implement best practices
with regard to security, reliability, and integrity of data.\669\
Another commenter stated that SROs should be subject to the same
privacy and data protection standards as those to which broker-dealers
are subject, and that SRO members should not be held responsible, and
be indemnified by the SROs, for any breaches of customer or firm
information.\670\
---------------------------------------------------------------------------

    \666\ See Scottrade Letter, p. 2 (expressing concern that
trading strategies and confidential customer information could be at
risk from cyber-attacks or accidental data breaches); ICI Letter, p.
2-4; Ross Letter, p. 1; Liquidnet Letter, p. 4. See also Ameritrade
Letter, p. 3; Thomson Reuters Letter, p. 4; BATS Letter, p. 3;
Managed Funds Association Letter, p. 2-3.
    \667\ See Ameritrade Letter, p. 3-4.
    \668\ See Liquidnet Letter p. 4.
    \669\ See Thomson Reuters Letter, p. 4.
    \670\ See TIAA-CREF Letter, p. 4.
---------------------------------------------------------------------------

    One commenter offered several specific recommendations for
enhancing the security of audit trail information.\671\ This commenter
suggested that the Commission should expressly state who would have
access to the data, when they could access it, and how they could use
it, and further recommended that all data sent to the central
repository be encrypted, and that certain fields be ``masked'' or be
subject to delayed end-of-day reporting.\672\ In addition, this
commenter suggested that the Commission and each SRO should adopt a
robust information security program, and that the Commission should
explain how it intends to treat requests for audit trail data.\673\
---------------------------------------------------------------------------

    \671\ See ICI Letter, p. 2-4.
    \672\ Id. at 3.
    \673\ Id.
---------------------------------------------------------------------------

    Another commenter suggested that the Rule more explicitly enunciate
permissible and impermissible uses of the consolidated audit trail and
suggested including a requirement regarding the SROs' personnel access
to and use of audit trail data, as well as a commitment by the
Commission to review each SRO with respect to the adequacy of
information barriers.\674\ Similarly, a commenter suggested that access
to audit trail data be limited to employees of regulators whose
function is to monitor and surveil that market.\675\ This commenter
supported the restriction that consolidated audit trail

data only be used for regulatory purposes.\676\
---------------------------------------------------------------------------

    \674\ See BATS Letter, p. 3.
    \675\ See Managed Funds Association Letter, p. 2-3.
    \676\ Id.
---------------------------------------------------------------------------

    One commenter asked how and at what level customer data would be
encrypted.\677\ This commenter listed specific aspects of data
encryption that would need to be addressed, and noted that potential
burdens could be associated with encryption.\678\ Finally, one
commenter recommended that the Commission express its intention to
withhold audit trail data from the public pursuant to Freedom of
Information Act (``FOIA'') \679\ exemptions.\680\
---------------------------------------------------------------------------

    \677\ See Ross Letter, p. 1.
    \678\ Id.
    \679\ 5 U.S.C. 552.
    \680\ See ICI Letter, p. 4.
---------------------------------------------------------------------------

    The Commission considered the concerns expressed by commenters
about the sensitivity of much of the information that will be
consolidated by the central repository, and believes that maintaining
the confidentiality of customer and other information reported to the
central repository is essential. Without adequate protections, market
participants would risk the exposure of highly-confidential information
about their trading strategies and positions.
    The Commission notes that it currently has controls and systems for
its own use and handling of audit trail information. Nevertheless,
given the sensitivity of certain information that will be produced by
the consolidated audit trail--as well as the fact that such information
should be more readily available and provided in a more usable format
than existing audit trail information--the Commission intends to review
the controls and systems that it currently has in place for the use and
handling of audit trail information. The Commission further intends to
evaluate whether any additional controls and systems may be required to
adequately protect the sensitive information provided to it under the
consolidated audit trail.\681\
---------------------------------------------------------------------------

    \681\ For example, appropriate confidentiality protections will
need to be programmed in any Commission systems that collect, store,
or access data collected from the central repository. In addition,
it may be appropriate to establish multiple access levels for
Commission staff so that staff members are allowed only as much
access as is reasonably necessary in connection with their duties.
---------------------------------------------------------------------------

    In addition, adopted Rule 613(e)(4)(i) requires that the NMS plan
include policies and procedures that are designed to ensure
implementation of the privacy protections that are necessary to assure
regulators and market participants that the NMS plan provides for
rigorous protection of confidential information reported to the central
repository. Specifically, adopted Rule 613(e)(4)(i)(A) requires that
``[a]ll plan sponsors and their employees, as well as all employees of
the central repository, agree to use appropriate safeguards to ensure
the confidentiality of such data and agree not to use such data for any
purpose other than surveillance and regulatory purposes, provided that
nothing in [Rule 613(e)(4)(i)(A)] shall be construed to prevent a plan
sponsor from using the data that it submits to the central repository
for regulatory, surveillance, commercial, or other purposes as
otherwise permitted by applicable law, rule, or regulation.'' Further,
in response to a comment,\682\ adopted Rule 613(e)(4)(i)(B) adds the
requirement to the Rule, as proposed, that the plan sponsors adopt and
enforce rules that: (1) Require information barriers between regulatory
staff and non-regulatory staff with regard to access and use of data in
the central repository, and (2) permit only persons designated by plan
sponsors to have access to the data in the central repository.\683\ In
addition, the Commission is modifying the Rule, as proposed, to require
that the plan processor must: (1) develop and maintain a comprehensive
information security program, with dedicated staff, that is subject to
regular reviews by the central repository's CCO, (2) require the
central repository to have a mechanism to confirm the identity of all
persons permitted to access the data, and (3) maintain a record of all
instances where such persons access the data.\684\
---------------------------------------------------------------------------

    \682\ See ICI Letter, p. 3
    \683\ Rule 613(e)(4)(i)(B); see ICI Letter, p. 3 (recommending
that ``the confidential nature of the information supports limiting
access to the CAT data to regulators and repository staff'').
    \684\ See Rule 613(e)(4)(i)(C). The Commission expects that the
central repository's CCO would be responsible for determining the
frequency of these regular reviews in the first instance, in
accordance with industry standards for the review of information
security, taking into account the sensitivity of the data stored in
the central repository. See Rule 613(b)(5) for a description of the
CCO.
---------------------------------------------------------------------------

    The Commission believes these provisions should create a framework
for the SROs to establish a thorough and exacting process for helping
ensure the continued effectiveness of the confidentiality safeguards.
Further, the Commission believes these additional provisions are
appropriate because they clarify the types of confidentiality
safeguards that the NMS plan submitted to the Commission for its
consideration must have to preserve the confidentiality of the
information that is received, consolidated, and retained by the central
repository. The provision requiring information barriers is designed
to, for example, protect and prevent audit trail data, which are to be
used only for regulatory purposes, from being communicated to any
personnel at an SRO that are engaged in non-regulatory or business
activities. Additionally, the Rule's requirement that policies and
procedures submitted as part of the NMS plan provide that: (i) Only
persons designated by the plan sponsors have access to the central
repository data, (ii) the plan processor have a mechanism to confirm
the identity of all persons permitted access to the data, and (iii) the
plan processor maintain a record of all instances where such persons
access the data. These provisions are designed to assure regulators and
market participants that only designated persons are allowed access to
the consolidated audit trail data, and that the central repository will
have a method to track such access. With respect to the commenter that
suggested the Commission more explicitly enunciate permissible and
impermissible uses of the consolidated audit trail,\685\ the Commission
notes that any security and confidentiality provisions included in the
NMS plan approved by the Commission will be subject to the Commission's
inspection and examination program of SROs to ensure that they are
implemented fairly in a manner consistent with the Exchange Act.\686\
---------------------------------------------------------------------------

    \685\ See BATS Letter, p. 3. See also Managed Funds Association
Letter, p. 2-3.
    \686\ The Commission notes that, as part of its inspection and
examination program, its staff has the authority to examine the
application of any security and confidentiality provisions in the
NMS plan to determine whether they have been applied fairly. In this
manner, the Commission will be able to monitor how the plan sponsors
have applied any such provisions set out in the NMS plan approved by
the Commission, and whether their uses of the consolidated audit
trail were consistent with the plan and the Exchange Act.
---------------------------------------------------------------------------

    The Commission believes that an outline or overview description of
the policies and procedures that would be implemented under the NMS
plan submitted to the Commission for its consideration would be
sufficient to satisfy the requirement of the Rule. The Commission
believes it is important for the NMS plan submitted to the Commission
to establish the fundamental framework of these policies and
procedures, but recognizes the utility of allowing the plan sponsors
flexibility to subsequently delineate them in greater detail with the
ability to make modifications as needed.
    The Commission considered the comment that asked when and at what
level customer information would be encrypted.\687\ The Commission
notes

that, while Rule 613 does not require that this information be
encrypted, the Rule contains several safeguards, discussed in this
section, to ensure the privacy and confidentiality of the audit trail
data. Based on these provisions,\688\ the Commission believes that plan
sponsors would need to make sure customer information is protected,
which could be accomplished by data encryption, if they so choose.
Additionally, the Commission notes that the unique customer identifier
is only reported once to the central repository--by the broker-dealer
that is either originating the order or is the original recipient of
the order. Because the unique customer identifier does not travel with
the order as it is routed to other market participants, only the
originating broker-dealer should be able to determine the identity of
the customer of the order. The Commission considered the comment that
recommended that the Commission express its intention to withhold audit
trail data from the public pursuant to FOIA.\689\ The adopted Rule
places no affirmative obligations on the Commission to provide
information to any third parties. Further, the Commission believes
there are bases under FOIA to withhold customer information, including
5 U.S.C. 552(b)(4) (trade secrets, commercial or financial
information), 5 U.S.C. 552(b)(6) (personal information affecting an
individual's privacy), and 5 U.S.C. 552(b)(8) (records related to
examinations of financial institutions). The Commission intends to
assert all appropriate exemptions in response to a FOIA request for
information related to the consolidated audit trail's customer
information.
---------------------------------------------------------------------------

    \687\ See Ross Letter, p. 1.
    \688\ Specifically, adopted Rule 613(e)(4) requires the NMS plan
to include policies and procedures, including standards, to be used
by the plan processor to ensure the security and confidentiality of
all information submitted to the central repository. In addition,
one of the considerations the NMS plan must address is how the
security and confidentiality of all information, including customer
information, submitted to the central repository, will be ensured.
See Rule 613(a)(1)(iv).
    \689\ See ICI Letter, p. 4.
---------------------------------------------------------------------------

    The Rule, as adopted, also states that the NMS plan must require
the SROs to adopt penalties for non-compliance with any policies and
procedures of the plan sponsors or central repository, described above,
with respect to information security.\690\ The Commission believes this
provision is appropriate because it provides an incentive to SROs to
comply with the central repository's information security program. The
Commission encourages SROs to include in their comprehensive
information security program developed and maintained by the plan
processor provisions for notifying any customer or other market
participant whose information may have been compromised by a security
breach, so that appropriate remedial steps may be taken.
---------------------------------------------------------------------------

    \690\ See Rule 613(e)(4)(i)(D).
---------------------------------------------------------------------------

    Additionally, given the importance of the security of data
consolidated in the central repository, and in response to the
commenter who recommended an annual third-party audit of the security
of the central repository,\691\ the Commission has added Rule 613(e)(5)
to require the NMS plan submitted to the Commission for its
consideration to address whether there will be an annual, independent
evaluation of the security of the central repository and (1) if so,
provide a description of the scope of such planned evaluation, and (2)
if not, provide a detailed explanation of the alternative measures for
evaluating the security of the central repository that are planned
instead. As with most information technology systems, the central
repository's system will include measures to assure regulators and
market participants of the security of the system. An independent
evaluation of the security of the central repository could aid the
central repository in identifying and correcting potential areas of
weakness or risk. While the Commission is leaving it to the plan
sponsors to determine whether the NMS plan will require an annual
audit, given the confidential nature of information that will be stored
at the central repository, the Commission believes that the NMS plan
submitted to the Commission for its consideration must, at a minimum,
address whether such an audit is appropriate.
---------------------------------------------------------------------------

    \691\ See Liquidnet Letter, p. 4.
---------------------------------------------------------------------------

    The Commission also notes that, as discussed below,\692\ it is
adding a specific provision that requires the NMS plan submitted to the
Commission for its consideration to discuss the security and
confidentiality of the information reported to the central
repository.\693\ With this information, the Commission, as well as the
public, will be able review in detail how the NMS plan proposes to
ensure the security and confidentiality of such information in deciding
whether to approve the NMS plan.
---------------------------------------------------------------------------

    \692\ See Section III.C.2.a.i., infra.
    \693\ See Rule 613(a)(1)(iv).
---------------------------------------------------------------------------

    The Commission believes that, collectively, these provisions are
appropriate because of the confidential and commercially valuable
information that the central repository will contain. The Commission
believes that the purpose and efficacy of the consolidated audit trail
would be compromised if the Commission, the SROs and their members
could not rely on the confidentiality and security of the information
stored in the central repository. The Commission acknowledges there
would be costs associated with a comprehensive information security
program, including, but not limited to, compensating a CCO and a
dedicated staff, and establishing policies and procedures, as well as
for an annual, independent evaluation of the central repository's
security (if such an evaluation is required by the NMS plan submitted
to the Commission for its consideration) or alternative measures (if
such an evaluation is not). Once the SROs have submitted the NMS plan
to the Commission that, as required, contains details about the
security and confidentiality of the audit trail data, the Commission
and the public will be able to consider this information when
evaluating the NMS plan.
3. Other Required Provisions of the NMS Plan
a. Compliance With the NMS Plan
1. Exchanges and Associations
    As proposed, Rule 613(h) would have provided that each plan sponsor
shall comply with the provisions of an NMS plan submitted pursuant to
the proposed Rule and approved by the Commission.\694\ In addition, the
proposed Rule would have provided that any failure by a plan sponsor to
comply with the provisions of the NMS plan could be considered a
violation of the proposed Rule.\695\ The proposed Rule also would have
required that the NMS plan include a mechanism to ensure compliance by
the sponsors with the requirements of the plan.\696\
---------------------------------------------------------------------------

    \694\ See proposed Rule 613(h)(1).
    \695\ See proposed Rule 613(h)(2).
    \696\ See proposed Rule 613(h)(3).
---------------------------------------------------------------------------

    One commenter expressed concern that there would be competitive
implications if the NMS plan were to include provisions that would
permit SROs to assess penalties against one another for non-
compliance.\697\ This commenter recommended, instead, that the NMS plan
include a ``fee recoupment'' provision so the plan administrator could
recoup costs incurred as a result of an error by a particular SRO.\698\
The commenter maintained that a ``fee recoupment'' provision, coupled
with the risk of Commission disciplinary action for a ``pattern or
practice'' of non-

compliance, would be a sufficient penalty.\699\
---------------------------------------------------------------------------

    \697\ See Nasdaq Letter I, p. 13.
    \698\ Id.
    \699\ Id.
---------------------------------------------------------------------------

    After considering the comment received on the issue of compliance
with the NMS plan by exchanges and associations,\700\ the Commission is
adopting Rule 613(h) substantially as proposed, with a modification to
Rule 613(h)(3) to specify that a mechanism to ensure compliance by the
sponsors of the NMS plan with the requirements of the plan ``may
include penalties where appropriate'' and a technical modification to
proposed Rule 613(h)(1) and (2).\701\ The Commission believes that
specifying that the mechanism to ensure compliance by the sponsors of
the NMS plan may include a penalty provision where appropriate provides
the plan sponsors with an appropriate tool--including potential
disciplinary action--to help ensure compliance by SROs with the terms
and provisions of the NMS plan.\702\ The Commission notes that a
penalty provision could provide an incentive for each SRO to comply
with all the provisions of the NMS plan because each SRO will seek to
avoid incurring any penalty under the Rule. The incentive to avoid a
penalty could also reduce the risk of non-compliance with the Rule. The
Commission notes, however, that the adopted Rule does not mandate that
the NMS plan's enforcement mechanism include penalties, as there might
be other mechanisms to enforce or encourage compliance with the Rule,
and the Commission believes that the SROs, in the first instance,
should design such mechanisms in their role as plan sponsors. However,
the Commission expects that if the SROs design compliance mechanisms
that do not incorporate penalties, they would explain in the NMS plan
how such mechanisms are expected to help ensure compliance by SROs with
the terms and provisions of the NMS plan.\703\
---------------------------------------------------------------------------

    \700\ Id.
    \701\ This technical modification simplifies the language of
Rule 613(h)(1) and (2) from the proposal. Adopted Rule 613(h)(1) and
(2) deletes the language ``submitted pursuant to this section'' and
``of which it is a sponsor.'' Adopted Rule 613(h)(1) and (2), like
the proposed Rule, requires each SRO to comply with the provisions
of the NMS plan ``approved by the Commission.'' Because each SRO
will be a member of the NMS plan approved by the Commission, it is
not necessary to include the phrases not adopted.
    \702\ Any such provision would be subject to notice and comment
pursuant to Rule 608 of Regulation NMS.
    \703\ The Commission notes that any failure by a national
securities exchange or national securities association to comply
with the provisions of the NMS plan approved by the Commission will
be considered a violation of Rule 613, and that the Commission could
take appropriate steps to address such a violation, including
imposing penalties as appropriate. See Rule 613(h)(2).
---------------------------------------------------------------------------

    With respect to the comment concerning the potential competitive
implications of allowing the plan sponsors to impose penalties against
each other for non-compliance, the Commission notes that it will
carefully review the NMS plan submitted for its consideration,
including any proposed mechanisms to help ensure compliance with the
NMS plan and the adopted Rule, to help ensure that penalty provisions,
if any, are designed to be applied fairly and in a manner consistent
with the Exchange Act.\704\ As the central repository will be a
facility \705\ of the SROs, the rules governing it must be consistent
with the Exchange Act. In addition, any future amendment to the penalty
provisions applicable to the SROs would either be reviewed as an
amendment to the NMS plan (effected through public notice and comment
and taking into account the relevant considerations contemplated by
Rule 613(a)(1)) or, because the central repository is a facility of the
SROs, as a proposed rule change of the central repository under Section
19 of the Exchange Act.
---------------------------------------------------------------------------

    \704\ See Section III.B.2.a., supra.
    \705\ See supra note 581 (describing the nature of a
``facility'').
---------------------------------------------------------------------------

    The Commission notes that the Commission's examination authority
under Section 17 of the Exchange Act \706\ extends to the central
repository because it is a facility of the SROs and, thus, the
Commission will have the opportunity to inspect the central repository
and its books and records for compliance with any penalty provisions
set out in the NMS plan. Additionally, the Commission has the authority
to review any actions taken under the NMS plan, pursuant to Rule
608(d)(1) of Regulation NMS,\707\ for burdens on competition, among
other matters.\708\
---------------------------------------------------------------------------

    \706\ 15 U.S.C. 78q.
    \707\ 17 CFR 242.608(d)(1).
    \708\ Id.
---------------------------------------------------------------------------

    In response to the comment suggesting a ``fee recoupment''
provision in the NMS plan, the Commission notes that Rule 613(b)(4), as
adopted, provides that ``[t]he national market system plan submitted
pursuant to this section shall include a provision addressing the
manner in which the costs of operating the central repository will be
allocated among the national securities exchanges and national
securities associations that are sponsors of the plan, including a
provision addressing the manner in which costs will be allocated to new
sponsors to the plan.'' In this regard, to the extent a ``fee
recoupment'' is a method for recouping costs incurred by the central
repository as a result of an error in reporting to the consolidated
audit trail, as stated by a commenter,\709\ the Commission notes that,
pursuant to Rule 613(b)(4), the plan sponsors may, if they deem it
appropriate, include a fee recoupment provision in the NMS plan
submitted to the Commission for its consideration.\710\
---------------------------------------------------------------------------

    \709\ See Nasdaq Letter I, p. 13.
    \710\ Any such provision would be subject to notice and comment
pursuant to Rule 608 of Regulation NMS.
---------------------------------------------------------------------------

2. Members
    Proposed Rule 613(g) would have included provisions to subject
members of each SRO to the requirements of Rule 613. Specifically, as
proposed, the Rule would have required each SRO to file with the
Commission, pursuant to Section 19(b)(2) of the Exchange Act \711\ and
Rule 19b-4 thereunder,\712\ a proposed rule change to require its
members to comply with the requirements of the proposed Rule and the
NMS plan.\713\ Further, the proposed Rule directly would have required
each member to (1) collect and submit to the central repository the
information required by the Rule, and (2) comply with the clock
synchronization requirements of the proposed Rule.\714\ The proposed
Rule also would have required that the NMS plan include a provision
that each SRO, by subscribing to and submitting the plan to the
Commission, agrees to enforce compliance by its members with the
provisions of the plan.\715\ Finally, the proposed Rule would have
required the NMS plan to include a mechanism to ensure compliance with
the requirements of the plan by the members of each SRO that is a
sponsor of the NMS plan submitted pursuant to this Rule and approved by
the Commission.\716\
---------------------------------------------------------------------------

    \711\ 15 U.S.C. 78s(b)(2).
    \712\ 17 CFR 240.19b-4.
    \713\ See proposed Rule 613(g)(1). This provision in the
proposed Rule echoes the requirement contained in Rule 608 that
``each self-regulatory organization also shall, absent reasonable
justification or excuse, enforce compliance with any such plan by
its members and persons associated with its members.'' 17 CFR
242.608(c).
    \714\ See proposed Rule 613(g)(2).
    \715\ See proposed Rule 613(g)(3).
    \716\ See proposed Rule 613(g)(4).
---------------------------------------------------------------------------

    One commenter expressed the view that ``enforcement of [the
consolidated audit trail] . . . should be accomplished through a
policies and procedures rule framework--similar to that of Regulation
NMS. To enforce the rule from a strict liability perspective would
simply be the wrong approach and would result in thousands of technical

(non-material) violations, which is clearly not the intent of the
rule.'' \717\
---------------------------------------------------------------------------

    \717\ See Knight Letter, p. 3.
---------------------------------------------------------------------------

    After considering the comment regarding Rule 613's provisions on
compliance with the Rule by members of the SROs, the Commission is
adopting Rule 613(g) substantially as proposed, with technical
modifications to proposed Rule 613(g). These technical modifications
simplify the language of Rule 613(g). Adopted Rule 613(g) does not
include the phrase that applied the requirements therein to each member
of an SRO ``that is a sponsor of the national market system plan
submitted pursuant to this section and approved by the Commission.''
Because each SRO will be a member of the NMS plan approved by the
Commission, it is not necessary to include the deleted language.
    In addition, the Commission modified Rule 613(g)(2) as proposed to
provide that, ``[e]ach member of a national securities exchange or
national securities association shall comply with all the provisions of
any approved national market system plan applicable to members.'' This
change requires members to comply with all applicable provisions of the
NMS plan as approved by the Commission instead of with the specific
provisions contained in the Rule relating to recording and reporting
data and clock synchronization since the requirements contained in the
NMS plan may differ or be more specific than the requirements stated in
the Rule.
    To be in compliance with the NMS plan, members must record and
report all data elements required by the NMS plan within the time
specified in the plan. To this end, the plan sponsors must develop a
way to ensure that each member that takes action with respect to an
order (e.g., originates, receives, routes, modifies, cancels or
executes an order) records and reports all required elements associated
with a reportable event, as the plan sponsors must also develop a
mechanism to address any lapses in compliance with the NMS plan with a
goal of ensuring the central repository is receiving a complete record
of the life of an order.
    The Commission does not agree with the commenter that believed that
enforcement of the consolidated audit trail will necessarily ``result
in thousands of technical (non-material) violations, which is clearly
not the intent of the rule.'' \718\ The Commission notes that the
adopted Rule does not address the means of achieving compliance with
the requirements of the consolidated audit trail. Rather, adopted Rule
613(g) simply provides that the SROs must submit proposed rule changes
to require their members to comply with the requirements of an NMS plan
approved by the Commission.
---------------------------------------------------------------------------

    \718\ See Knight Letter, p. 3.
---------------------------------------------------------------------------

    The Commission acknowledges there would be costs to the SROs for
filing with the Commission proposed rule changes to require their
members to comply with Rule 613 and the NMS plan approved pursuant
thereto. The Commission, however, believes that the Rule should include
these rule filing requirements for the reasons discussed above.
b. Operation and Administration of the NMS Plan
    Proposed Rule 613(b) sets forth requirements concerning the
operation and administration of the NMS plan. As proposed, Rule
613(b)(1) would have required that the NMS plan include a governance
structure to ensure fair representation of the plan sponsors and
provisions governing the administration of the central repository,
including the selection of a plan processor. Rule 613(b)(2), as
proposed, also would have required the plan sponsors to include in the
NMS plan a provision addressing the requirements for the admission of
new sponsors to the plan and the withdrawal of sponsors from the plan.
In addition, proposed Rule 613(b)(3) would have required the NMS plan
to include a provision addressing the percentage of votes required by
the plan sponsors to effectuate amendments to the plan, and proposed
Rule 613(b)(4) would have required that the plan sponsors develop a
process for allocating among themselves the costs associated with
creating and maintaining the central repository, including a provision
addressing the manner in which such costs would be allocated to
sponsors who join the plan after it has been approved.
    Finally, proposed Rule 613(b)(5) would have required the NMS plan
to require the appointment of a CCO to regularly review the operation
of the central repository to assure its continued effectiveness in
light of market and technological developments, and make any
appropriate recommendations to the plan sponsors for enhancement to the
nature of the information collected and the manner in which it is
processed. In the Proposing Release, the Commission stated that it
expected the CCO would establish the procedures necessary to ensure
that the operations of the central repository keep pace with technical
developments and to make any necessary upgrades or changes to the
central repository to maintain its efficacy.\719\
---------------------------------------------------------------------------

    \719\ See Proposing Release, supra note 4, at 32585.
---------------------------------------------------------------------------

    The Commission received comments addressing the proposed
requirements for operation and administration of the NMS plan.\720\ One
commenter suggested that the NMS plan should contain a voting mechanism
that requires less than unanimity, and with an effective tie breaking
mechanism.\721\ This commenter also recommended that the governance
structure ``limit the ability of individual SROs to make modifications
on a unilateral basis that could escalate costs by forcing the operator
and firms to absorb costs that do not advance the interests of
investors.'' \722\
---------------------------------------------------------------------------

    \720\ See Nasdaq Letter I, p. 3, 13; Direct Edge Letter, p. 5;
FIF Letter, p. 1, 8; FINRA Letter, p. 15; SIFMA February 2012
Letter, p. 1.
    \721\ See Nasdaq Letter I, p. 3, 13.
    \722\ Id. at p. 3.
---------------------------------------------------------------------------

    Two commenters expressed views on the selection and role of the
plan processor.\723\ One suggested that the SROs should select the
processor through a ``request for proposal.'' \724\ Another commenter
generally believed that the allocation of plan processor costs
warranted more consideration.\725\ This commenter expressed concern
with regard to the SROs owning the plan processor, noting in particular
that unanimous consent would be required for all board actions.\726\
This commenter stated that the plan processor alone should handle
rulemaking and compliance, subject to oversight by an ``industry
group.'' \727\ Another commenter stated that, ``[r]egarding the
governance of the national market system plan [contemplated] by the
proposal, we wish to reiterate that the SEC should provide the broker-
dealer industry with an official `seat at the table' alongside the
SROs, so that [the broker-dealers] can review and comment on system
requirements as they are being developed and vote on plan amendments
going forward.'' \728\
---------------------------------------------------------------------------

    \723\ See FIF Letter, p. 1; Direct Edge Letter, p. 5.
    \724\ See FIF Letter, p. 8.
    \725\ See Direct Edge Letter, p. 4-5.
    \726\ Id. at p. 5.
    \727\ Id.
    \728\ See SIFMA February 2012 Letter, p. 1.
---------------------------------------------------------------------------

    After considering these comments, for the reasons discussed below,
the Commission is adopting Rule 613(b) as proposed, but with the
addition of two new requirements. Specifically, in addition to the
provisions included in the proposed rule,\729\ Rule 613(b), as

adopted, provides that the national market system plan submitted shall
include: ``a provision requiring the plan sponsors to provide to the
Commission, at least every two years after effectiveness of the
national market system plan, a written assessment of the operation of
the consolidated audit trail * * *, [and] an Advisory Committee * * *
includ[ing] representatives of the member firms of the plan
sponsors.''\730\
---------------------------------------------------------------------------

    \729\ Proposed Rule 613(b) required that the NMS plan include
``a governance structure to ensure fair representation of the plan
sponsors, and administration of the central repository, including
the selection of the plan processor, * * * [a] provision addressing
the requirements for the admission of new sponsors of the plan and
the withdrawal of existing sponsors from the plan, * * * [a]
provision addressing the percentage of votes required by the plan
sponsors to effectuate amendments to the plan, * * * [a] provision
addressing the manner in which the costs of operating the central
repository will be allocated among the national securities exchanges
and national securities associations that are sponsors of the plan,
including a provision addressing the manner in which costs will be
allocated to new sponsors to the plan* * * [and the] appointment of
a Chief Compliance Officer to regularly review the operation of the
central repository to assure its continued effectiveness in light of
market and technological developments, and make any appropriate
recommendations for enhancements to the nature of the information
collected and the manner in which it is processed.''
    \730\ See Rule 613(b)(6); Rule 613(b)(7).
---------------------------------------------------------------------------

    The requirement that the NMS plan require the appointment of a CCO
to regularly review the operation of the central repository and make
any appropriate recommendations for enhancements \731\ is one method to
facilitate the consolidated audit trail's ability to evolve over time
in terms of technology, functionality, and accuracy. Adopted Rule
613(b)(6) supplements this requirement by now requiring that the NMS
plan ``include a provision requiring the plan sponsors to provide to
the Commission, at least every two years after effectiveness of the
national market system plan, a written assessment of the operation of
the consolidated audit trail. Such document shall include, at a
minimum: (i) [a]n evaluation of the performance of the consolidated
audit trail including, at a minimum, with respect to data accuracy
(consistent with [Rule 613(e)(6)]), timeliness of reporting,
comprehensiveness of data elements, efficiency of regulatory access,
system speed, system downtime, system security (consistent with [Rule
613 (e)(4)]), and other performance metrics to be determined by the
Chief Compliance Officer, along with a description of such metrics;
(ii) [a] detailed plan, based on such evaluation, for any potential
improvements to the performance of the consolidated audit trail with
respect to any of the following: improving data accuracy; shortening
reporting timeframes; expanding data elements; adding granularity and
details regarding the scope and nature of Customer-IDs; expanding the
scope of the NMS plan to include new instruments, and new types of
trading and order activities; improving the efficiency of regulatory
access; increasing system speed; reducing system downtime; and
improving performance under other metrics to be determined by the Chief
Compliance Officer; (iii) [a]n estimate of the costs associated with
any such potential improvements to the performance of the consolidated
audit trail, including an assessment of the potential impact on
competition, efficiency, and capital formation; and (iv) [a]n estimated
implementation timeline for any such potential improvements, if
applicable.'' \732\ The Commission believes these provisions will help
plan sponsors understand and evaluate any deficiencies in the operation
of the consolidated audit trail and to propose potential enhancements
to the NMS plan, as appropriate, taking cost effectiveness into
consideration. These provisions also will allow the Commission to
assess any such potential improvements, accounting for the
considerations contemplated by Rule 613(a)(1), the specific
requirements of the approved NMS plan, and any changes or additions to
these requirements that the Advisory Committee, the SROs, or the
Commission may wish to consider in the future. The Commission believes
that such enhancements, if any, to the consolidated audit trail could
improve the ability of the SROs and the Commission to conduct effective
market oversight by keeping up with continually-changing technologies
and markets, by, for example, allowing the SROs and the Commission to
conduct their market oversight more quickly, accurately, and/or
comprehensively, as well as possibly at lower costs. Similarly, the
Commission believes that adding granularity and details regarding the
scope and nature of Customer-IDs, adding new instruments, or including
new trading or order activities could allow regulators to have a more
complete picture of the markets and market participants, which could
also lead to more effective market oversight. The Commission believes
that performing this assessment no later than every two years is
reasonable given the rapid speed at which the markets and related
technologies are evolving. The Commission also believes that the
written assessment, required by Rule 613(b)(6), will help inform the
Commission about the likely feasibility, costs, and impact of, and the
plan sponsors' approach to, the consolidated audit trail evolving over
time. The Commission would expect to make the document publicly
available on its Web site.
---------------------------------------------------------------------------

    \731\ See Rule 613(b)(5).
    \732\ See Rule 613(b)(6). The written assessment could also
further inform the extent to which it could be appropriate to share
certain information collected by the consolidated audit trail with
third parties. See Section III.B.2.d.
---------------------------------------------------------------------------

    In response to the comment requesting that the broker-dealer
industry receive a ``seat at the table'' regarding governance of the
NMS plan,\733\ the adopted Rule requires that the NMS plan submitted to
the Commission for its consideration include a provision requiring the
creation of an Advisory Committee, composed at least in part by
representatives of the members of the plan sponsors, ``to advise the
plan sponsors on the implementation, operation and administration of
the central repository.'' \734\ Further, the adopted Rule requires that
the NMS plan submitted to the Commission for its consideration require
that ``[m]embers of the Advisory Committee shall have the right to
attend any meetings of the plan sponsors, to receive information
concerning the operation of the central repository, and to provide
their views to the plan sponsors.'' \735\ Pursuant to the Rule, the NMS
plan also shall set forth the term and composition of the Advisory
Committee, which composition shall include representatives of the
member firms of the plan sponsor.\736\ The Rule further provides that
the plan sponsors may meet without the Advisory Committee members in
executive session if, by affirmative vote of a majority of the plan
sponsors, the plan sponsors determine that such an executive session is
required.\737\ The Commission believes that, given the scope of the
Rule, both in terms of the market participants that may be affected by
the Rule and the breadth of the audit trail information that will be
collected, it is important that the plan sponsors solicit input from
their members because this could help inform the plan sponsors of any
expected or unexpected operational or technical issues that may arise
in the implementation of the Rule and/or the operation of the central
repository, and help assure the Commission and market participants that
any requirements imposed on SRO members will be

accomplished in a manner that takes into account the burdens on SRO
members. The Commission believes that the Advisory Committee could
provide members of the SROs with a forum for informing the plan
sponsors of any potential implementation or operational issues faced by
them in connection with the consolidated audit trail. Plan sponsors
also will be able to draw on the knowledge and experience of these
members to help assure the Commission and market participants that any
requirements imposed on SRO members will be accomplished in a manner
that takes into account the costs to SRO members. The Commission also
believes that an Advisory Committee could help foster industry
consensus on how to approach and resolve possible issues that may be
disputed, and approaches that may conflict, regarding operation of the
consolidated audit trail. In this regard, the Commission encourages the
plan sponsors to, in the NMS plan, provide for an Advisory Committee
whose composition includes SRO members from a cross-section of the
industry, including representatives of small-, medium- and large-sized
broker-dealers.
---------------------------------------------------------------------------

    \733\ See SIFMA February 2012 Letter, p. 1.
    \734\ See Rule 613(b)(7)(i).
    \735\ See Rule 613(b)(7)(ii).
    \736\ See Rule 613(b)(7)(i).
    \737\ See Rule 613(b)(7)(ii).
---------------------------------------------------------------------------

    The Commission believes the requirement for the NMS plan to create
the Advisory Committee, as well as the requirement in Rule
613(a)(1)(xi), discussed below, that requires the NMS plan to require a
discussion of the process by which the plan sponsors solicited the
views of their members on the creation, implementation, and maintenance
of the consolidated audit trail, a summary of those views, and how the
plan sponsors took those views into account when preparing the NMS
plan, are responsive to commenters' views that more input by industry
representatives, such as members of the SROs who are subject to the
requirements of Rule 613, would be advantageous to the creation,
implementation, and maintenance of the consolidated audit trail.\738\
---------------------------------------------------------------------------

    \738\ See Rule 613(a)(1)(xi); Section III.C.2.a.iii.c., infra,
for a discussion of the tenth consideration.
---------------------------------------------------------------------------

    In addition, because the members of the Advisory Committee will
have the right to attend all meetings of the plan sponsors (with the
exception of executive sessions), to receive information concerning the
operation of the central repository, and to provide their views to the
plan sponsors, the governance process of the central repository will be
more transparent to all market participants that will be affected by
Rule 613. Further, the Commission believes the inclusion of SRO members
on the Advisory Committee will increase the efficacy of the central
repository. These market participants will have first-hand experience
with the operation of the central repository, as they are required to
report data to the facility, allowing them to provide informed input on
any problems currently facing the central repository of which they are
aware, and on any future actions that the central repository might or
should take to address such problems. Finally, the Commission believes
that an Advisory Committee structure that also permits the plan
sponsors to meet in executive session without members of the Advisory
Committee appropriately balances the need to provide a mechanism for
industry input into the operation of the central repository, against
the regulatory imperative that the operations and decisions regarding
the consolidated audit trail be made by SROs who have a statutory
obligation to regulate the securities markets, rather than by members
of the SROs, who have no corresponding statutory obligation to oversee
the securities markets.
    The Commission also considered the comment that provided other
suggestions on the governance of the NMS plan and believes that the
commenter's concerns regarding a unanimity requirement in the NMS plan
have merit.\739\ Accordingly, the Commission urges the SROs to take
into account the need for efficient and fair operation of the NMS plan
governing the consolidated audit trail, and consider the
appropriateness of a unanimity requirement and the possibility of a
governance requirement other than unanimity, or even super-majority
approval, for all but the most important decisions. The Commission
believes that an alternate approach may be appropriate to avoid a
situation where a significant majority of plan sponsors--or even all
but one plan sponsor--supports an initiative but, due to a unanimous
voting requirement, action cannot be undertaken.\740\ Therefore, the
Commission believes the SROs should consider alternative governance
structures that would ensure that decisions made by the SROs are both
achieved and implemented efficiently, in the interest of advancing the
Commission's mission. The Commission notes that the NMS plan submitted
to the Commission for its consideration will be published for public
comment, and industry participants will have an opportunity at that
time to submit comments on the governance structures proposed by the
plan sponsors. Further, the Commission believes, as discussed above,
that unanimity need not be the standard for decision-making with regard
to matters relating to the operation of the consolidated audit trail.
Thus, the plan sponsors have flexibility under the Rule to determine
the governance structures that will facilitate the effective and
efficient oversight of the plan processor.
---------------------------------------------------------------------------

    \739\ See Nasdaq Letter I, p. 3, 13.
    \740\ See, e.g., Options Order Protection and Locked/Crossed
Market (Securities Exchange Act Release No. 60405 (July 30, 2009),
74 FR 39362 (August 6, 2009)) (including a unanimous voting
requirement).
---------------------------------------------------------------------------

    In response to the comments regarding the selection and role of the
plan processor,\741\ the Commission believes that the SROs, as the plan
sponsors of the NMS plan governing the operation of the consolidated
audit trail, should retain the authority to select and oversee the plan
processor. The Commission believes that the SROs are in the best
position to understand how the plan processor should operate and to
address the need for changes when necessary. The SROs also have the
flexibility under the Rule to consult the Advisory Committee, for
example, to assist the SROs in their selection process and in their
determination of whether modifications are necessary to address
innovations in the industry if they believe that such participation is
needed.
---------------------------------------------------------------------------

    \741\ See FIF Letter, p. 1; Direct Edge Letter, p. 5.
---------------------------------------------------------------------------

    The Commission acknowledges that, in addition to the many costs and
burdens associated with the creation, implementation, and maintenance
of a consolidated audit trail, with regards to the specific
requirements discussed in this section, there would be costs to the
SROs for appointing a CCO to the central repository, providing the
Commission with the written assessment of the operation of the
consolidated audit trail, and creating an Advisory Committee.\742\ For
the reasons discussed above, the Commission believes these requirements
are important to the efficient operation and practical evolution of the
consolidated audit trail, and are responsive to many commenters'
concerns about governance structure, cost allocations, and the
inclusion of SRO members as part of the planning process. The
Commission is therefore requiring the SROs to include these
requirements in the NMS plan submitted to the Commission for its
consideration. After the SROs submit

the NMS plan, the Commission and the public will have more detailed
information in evaluating the NMS plan.
---------------------------------------------------------------------------

    \742\ As discussed and for the reasons set forth in Section I.,
supra, in light of the multi-step process for developing and
approving an NMS plan that will govern the creation, implementation,
and maintenance of a consolidated audit trail, the Commission is
deferring a detailed analysis of costs and benefits of this
requirement of the Rule until after the NMS plan has been submitted.
---------------------------------------------------------------------------

c. Surveillance
    As proposed, Rule 613(f) would have required each SRO subject to
the Rule to develop and implement a surveillance system, or enhance
existing surveillance systems, reasonably designed to make use of the
consolidated audit trail data. The Rule, as proposed, also would have
required each SRO to implement its new or enhanced surveillance system
within fourteen months after the effectiveness of the NMS plan.\743\
---------------------------------------------------------------------------

    \743\ See proposed Rule 613(a)(3)(iv).
---------------------------------------------------------------------------

    Commenters generally expressed support for the proposal's
requirement that SROs implement surveillance systems that make use of
the consolidated information.\744\ One commenter stated that the
enhanced surveillance that could be achieved with the audit trail would
likely attract additional trading volume to the U.S. markets and that
the consolidated audit trail would benefit the SROs by permitting them
to conduct surveillance themselves, thus ``reducing their risks and
their costs.'' \745\ Another commenter noted that the proposed
consolidated audit trail would be a ``critical first step toward
consolidated market surveillance,'' and would lower costs for markets
and their participants through economies of scale.\746\ A third
commenter opined that a centralized database such as the consolidated
audit trail is necessary to bring together data from exchanges, ECNs,
and dark pools to properly regulate trading.\747\ However, one
commenter maintained that a ``Commission-mandated market regulator''
would be costly for the securities industry and create the potential
for a lack of surveillance innovation.\748\ A commenter recommended
that the Commission monitor the surveillance systems and provide
guidance to the SROs in establishing their surveillances.\749\ Finally,
one commenter suggested that outsourcing surveillance to regulators
could result in lower costs for markets, and recommended several
specific security and analytical features for such a surveillance
system.\750\
---------------------------------------------------------------------------

    \744\ See Nasdaq Letter I, p. 10; Thomson Reuters Letter, p. 4.
    \745\ See Thomson Reuters Letter, p. 4.
    \746\ See FINRA/NYSE Euronext Letter, p. 3-4. See also Nasdaq
Letter I, p. 8.
    \747\ See IAG Letter, p. 2.
    \748\ See BATS Letter, p. 2-3.
    \749\ See Nasdaq Letter I, p. 10.
    \750\ See iSys Letter, p. 2-3.
---------------------------------------------------------------------------

    After considering the comments, for the reasons discussed below,
the Commission is adopting Rule 613(f) as proposed. Specifically, the
Rule requires that each SRO develop and implement a surveillance
system, or enhance existing surveillance systems, reasonably designed
to make use of the consolidated information contained in the
consolidated audit trail.\751\ The Commission believes that it is
appropriate to require SROs to enhance their surveillance programs to
make full use of the increased functionalities and the timeliness of
the consolidated audit trail. Additionally, because trading and
potentially manipulative activities could take place across multiple
markets, the Commission supports efforts to coordinate surveillance
among the SROs, such as through a plan approved pursuant to Rule 17d-2
under the Exchange Act,\752\ or through regulatory services agreements
between SROs. In this regard, as commenters have noted, SROs could
``outsource'' surveillance efforts to another SRO, if there are
efficiencies to be gained. With respect to the comment regarding the
benefits to be gained by creating a ``single market regulator,'' the
Commission believes that mandating such an entity or structure goes
beyond the scope of the Rule.\753\
---------------------------------------------------------------------------

    \751\ See Rule 613(f).
    \752\ 17 CFR 240.17d-2.
    \753\ The Commission has examined the issue of a single market
regulator in the past, specifically in the Intermarket Trading
Concept Release (see Securities Exchange Act Release No. 47849 (May
14, 2003), 68 FR 27722 (May 20, 2003)); however, a single regulator
structure is not suggested by the adopted Rule.
---------------------------------------------------------------------------

    The Commission notes that it intends to review its own surveillance
activities in light of the consolidated audit trail and intends to take
steps to enhance its surveillance capabilities to take advantage of
consolidated audit trail data. The Commission anticipates that such
steps will be informed by--and may in turn help inform--the
surveillance enhancement measures required to be taken by the SROs
under adopted Rule 613(f).
    The Commission also is adopting Rule 613(a)(3)(iv) as proposed,
which requires the NMS plan to require each SRO to implement its new or
enhanced surveillance system within fourteen months after the
effectiveness of the NMS plan. Since Rule 613(a)(3)(iii) will require
the NMS plan to require SROs to begin reporting to the central
repository within one year after effectiveness of the NMS plan, the
Commission believes the two additional months provided by this
timeframe is reasonable and sufficient to allow SROs to update their
surveillance systems and allow for testing of new surveillances.
    The Commission acknowledges there would be costs to the SROs for
developing and implementing surveillance systems, or enhancing existing
surveillance systems, reasonably designed to make use of the
consolidated audit trail. However, the Commission believes it may be
possible for SROs to retire some of their existing, and perhaps less-
efficient, audit trail and surveillance systems once the consolidated
audit trail is operational. As discussed in Section III.C.a.iv. below,
the adopted Rule requires the SROs to consider and discuss the
potential for costs savings if other SRO systems, and their associated
surveillances, were migrated to the consolidated audit trail.\754\ Once
such information is submitted in the NMS plan submitted to the
Commission for its consideration, the Commission and the public will be
able to consider the information in evaluating the NMS plan.
---------------------------------------------------------------------------

    \754\ These cost savings may accrue to any SRO that would no
longer need to operate a retired system, as well as to any SRO
members that would no longer be required to report to such systems.
---------------------------------------------------------------------------

C. NMS Plan Process

    As proposed, Rule 613(a)(1) would have required each SRO to jointly
file on or before 90 days from approval of the Rule an NMS plan to
govern the creation, implementation, and maintenance of a consolidated
audit trail and a central repository. Section III.A. above discusses
the use of an NMS plan to create, implement, and maintain a
consolidated audit trail. This Section focuses on the process the SROs
must follow when submitting to the Commission the NMS plan that
satisfies the requirements discussed in Section III.B. above and the
process the Commission will undergo when evaluating whether to approve
the NMS plan.
1. Comments on the NMS Plan Process
    The Commission received several comments regarding how best to
develop an NMS plan that will govern the creation and implementation of
a consolidated audit trail, as well as the time needed to do so.
Several commenters suggested that the Commission undergo a RFP or RFI
process to create a consolidated audit trail.\755\ Specifically, one
commenter suggested that the Commission outline a set of goals it
intends to achieve through creation of a consolidated audit trail and
allow an industry working group to

determine the data elements that must be reported and other technical
requirements.\756\ Another commenter opined that an RFP process would
facilitate the identification of the costs and benefits of the audit
trail, as well as the consideration of a wider range of technological
solutions.\757\ Further, some commenters requested more specific
information about the audit trail system to determine the best approach
for implementing the consolidated audit trail.\758\
---------------------------------------------------------------------------

    \755\ See FIF Letter, p. 1, 9; FIF Letter II, p. 1-2; STA
Letter, p. 2; Direct Edge Letter, p. 2-3, 5. See also Section
II.C.3.
    \756\ See FIF Letter II, p. 2.
    \757\ Id. at p. 3.
    \758\ See Broadridge Letter, p. 2; FIF Letter, p. 8. See also
Ross Letter, p. 1 (discussing examples of information security
details to consider); Nasdaq Letter I, p. 6 (stating that the
proposed Rule provided ``incomplete technical information on which
design and features make the most sense'').
---------------------------------------------------------------------------

    Some of these commenters stressed that more time should be allotted
for the planning and design of the NMS plan due to the comprehensive
business analysis that would be needed in the initial stages of the
consolidated audit trail.\759\ Commenters recommended extensive, ``up-
front business analysis,'' \760\ explaining that if conducted ``during
the CAT plan development process, [they] are confident that issues
would emerge earlier in the process, leading to more efficient and
cost-effective solutions.'' \761\ The commenters believed that the
business analysis would require many discussions involving the
Commission, the SROs and teams comprising members of the securities
industry.\762\ The commenters also suggested that the business analysis
could include an RFI ``to engage potential solution providers early in
the process,'' \763\ and stated that the time needed to perform the
analysis to produce a ``detailed blueprint for CAT'' \764\ would be
closer to six months,\765\ rather than the proposed 90 days.\766\ As a
basis for their suggestions, one of the commenters provided a breakdown
of the time and the types of work needed for FINRA's expansion of OATS
to all NMS securities.\767\ This commenter noted that over one-third of
the time required for the project was spent on conducting business
analysis, and that one-third of the time was spent on project
development.\768\
---------------------------------------------------------------------------

    \759\ See FIF Letter II, p. 2-3; STA Letter, p. 2. See also
Nasdaq Letter I, p. 6.
    \760\ See FIF Letter II, p. 1, 3; STA Letter, p. 1, 3. See also
Nasdaq Letter I, p. 6.
    \761\ See FIF Letter II, p. 2; STA Letter, p. 1.
    \762\ See FIF Letter II, p. 1; STA Letter, p. 1-2.
    \763\ See FIF Letter II, p. 2; STA Letter, p. 2.
    \764\ See FIF Letter II, p. 1-2; STA Letter, p. 2.
    \765\ See FIF Letter II, p. 2; STA Letter, p. 2-3.
    \766\ See proposed Rule 613(a)(1).
    \767\ See FIF Letter II, p. 3. The commenter also provided the
cost to the industry for the expansion of OATS to all NMS stocks--
$48 million. The Commission notes that this is the cost for the
project as a whole, not solely for the planning phase, and therefore
is not entirely attributable to the cost of the creation and filing
of the NMS plan required by Rule 613.
    \768\ The time remaining was spent on ``testing and other
activities.'' See FIF Letter II, p. 3.
---------------------------------------------------------------------------

    In addition, some commenters noted that a consolidated audit trail
could be implemented in a number of ways, and thus recommended that the
Commission replace the specific system requirements of the proposed
Rule with more general ``end-user'' requirements, perform an analysis
of how existing audit trail systems do and do not meet the needs of
regulators, and perhaps even engage in a formal RFP process.\769\
---------------------------------------------------------------------------

    \769\ See Nasdaq Letter I, p. 12; FIF Letter II, p. 2-3; STA
Letter, p. 1-3; Direct Edge Letter, p. 2-3, 5.
---------------------------------------------------------------------------

2. Adopted Rule
    After considering the comments regarding the NMS plan process, the
Commission is adopting proposed Rule 613(a)(1) with modifications.
First, the Rule now requires the SROs to provide much more information
and analysis to the Commission as part of their NMS plan submission.
These requirements have been incorporated into the adopted Rule as
``considerations'' that the SROs must address, and generally mandate
that the NMS plan discuss: (1) The specific features and details of the
NMS plan (e.g., how data will be transmitted to the central repository,
and when linked data will be available to regulators); (2) the SROs'
analysis of NMS plan costs and impact on efficiency, competition, and
capital formation; (3) the process followed by the SROs in developing
the NMS plan (e.g., solicitation of input from members of the SROs);
and (4) the information about the implementation and milestones of the
consolidated audit trail. Second, the Commission is furnishing further
details about how it envisions regulators would use, access, and
analyze consolidated audit trail data through a number of ``use
cases.'' Third, the Commission is extending the amount of time allowed
for the SROs to submit the NMS plan from 90 days from the date of
approval of Rule 613 to 270 days from the date of publication of the
Adopting Release in the Federal Register. A discussion of these
modifications and the ``use cases'' follows.
a. NMS Plan Considerations
    As noted above,\770\ the Commission believes that the collective
effect of the modifications and additions described above will be to
significantly expand the solution set that could be considered by the
SROs for creating, implementing, and maintaining the consolidated audit
trail and provide the SROs with increased flexibility in how they
choose to meet the requirements of the adopted Rule. Further, given
these changes to the Rule discussed above and the wide array of
commenter's views on how to best implement a consolidated audit
trail,\771\ the Commission expects that the SROs will seriously
consider various options as they develop the NMS plan to be submitted
to the Commission for its consideration. The costs and benefits of the
consolidated audit trail are highly dependent on the specific solutions
proposed by SROs.
---------------------------------------------------------------------------

    \770\ See Section I., supra.
    \771\ See, e.g., FINRA Letter, p. 14 (advocating that SROs build
off existing audit trails to develop a consolidated audit trail) and
Nasdaq Letter I, p. 11-12 (arguing against building off existing
audit trail systems and supporting the development of new system to
establish a consolidated audit trail). See also Section II.C.4.,
supra.
---------------------------------------------------------------------------

    Accordingly, as part of the multi-step process for developing and
approving an NMS plan that will govern the creation, implementation,
and maintenance of a consolidated audit trail, the Commission is
deferring its economic analysis of the actual creation, implementation,
and maintenance of a consolidated audit trail itself (in contrast to
the costs of the actions the SROs are required to take upon approval of
the adopted Rule \772\) until such time as it may approve the NMS plan
submitted to the Commission for its consideration. In light of the
expanded set of solutions that should be available as a result of the
changes described above and to facilitate a more robust economic
analysis, the adopted Rule now requires the SROs to provide much more
information and analysis to the Commission as part of their NMS plan
submission. The Commission is therefore requiring the SROs to discuss,
as part of their NMS plan ``considerations'' that detail how the SROs
propose to implement the requirements of the plan, cost estimates for
the proposed solution, and a discussion of the costs and benefits of
alternate solutions considered but not proposed.
---------------------------------------------------------------------------

    \772\ These actions include the requirement that the SROs
develop an NMS plan, utilizing their own resources and undertaking
their own research that addresses the specific details, cost
estimates, considerations, and other requirements of the Rule.
---------------------------------------------------------------------------

    This additional information and analysis are intended to ensure
that the Commission and the SROs have sufficiently detailed information
to carefully consider all aspects of the NMS plan ultimately submitted
by the SROs, facilitating an analysis of the extent to which the NMS
plan would allow regulators to effectively and

efficiently carry out their responsibilities. The NMS plan submitted by
the SROs will be published for public comment and reviewed by the
Commission for consistency with the Exchange Act and the rules
thereunder. As a result, all interested persons, including market
participants, regulatory authorities, and the general public, will have
an opportunity to provide meaningful comments on the details and costs
of the NMS plan submitted, which the Commission will review and
consider.
i. Features and Details of the NMS Plan
    The first six considerations the Rule requires the SROs to address
in the NMS plan relate to the features and details of the NMS plan.
These six considerations require the NMS plan to specify and explain
the choices made by the SROs to meet the requirements specified in the
Rule for the consolidated audit trail. The Commission intends to use
the discussion of these considerations to evaluate the NMS plan
submitted for its consideration and how well it meets the objectives
described in Section II.B.2.

 Rule 613(a)(1)(i)

    Rule 613(a)(1)(i) requires the NMS plan submitted to discuss
``[t]he method(s) by which data is reported to the central repository,
including, but not limited to, the sources of such data and the manner
in which the central repository will receive, extract, transform, load
and retain such data. * * *'' The Rule also requires the NMS plan to
discuss the basis for selecting such method(s).
    The Commission believes that requiring that the NMS plan discuss
the method(s) by which data is reported to the central repository is
important because the method for reporting data and the source of the
data are significant to the effectiveness of the consolidated audit
trail and could affect, and potentially enhance, the reliability and
the accuracy of the data that is reported to the central
repository.\773\ Discussing such method(s), as well as the basis for
selecting such method(s), should help assure the Commission that the
plan sponsors have considered the various alternatives and selected the
method(s) that best achieves the objectives of the consolidated audit
trail in a cost-effective manner.\774\ In addition, Rule 613(a)(1)(i)
requires that the NMS plan describe how the central repository will
receive, extract, transform, load, and retain data because the
Commission believes that this information is integral to a
comprehensive understanding of the operation of the central repository
proposed in the NMS plan.
---------------------------------------------------------------------------

    \773\ See Section III.B.2.c., supra.
    \774\ The Commission notes that another related consideration
that must be discussed by the NMS plan includes the alternative
approaches to creating the consolidated audit trail that the plan
sponsors considered. See Rule 613(a)(1)(xii).

---------------------------------------------------------------------------
 Rule 613(a)(1)(ii)

    Rule 613(a)(1)(ii) requires the NMS plan to address ``[t]he time
and method by which the data in the central repository will be made
available to regulators, in accordance with [Rule 613(e)(1)] to perform
surveillance or analyses, or for other purposes as part of their
regulatory and oversight responsibilities.''
    The time and method by which data will be made available to
regulators are fundamental to the utility of the consolidated audit
trail because the purpose of the consolidated audit trail is to assist
regulators in fulfilling their responsibilities to oversee the
securities markets and market participants.\775\ The NMS plan submitted
should discuss these issues in detail, guided, in particular, by the
issues and questions raised in the ``Regulator Use Cases'' described in
Section III.C.2.b., below.
---------------------------------------------------------------------------

    \775\ See Section II.A., supra, for additional discussion of the
timeliness of access to current audit trail data.
---------------------------------------------------------------------------

    The importance of this consideration was discussed in the Proposing
Release.\776\ The Commission emphasized the necessity of the data being
in a uniform electronic format so that regulators would be able, among
other things, to effectively and efficiently detect and investigate
illegal trading across markets, without having to spend valuable time
and resources reconciling audit trail formatting differences in the
data.\777\ In addition, the Proposing Release noted that requiring the
order and trade data to be collected in one location in a single format
would allow regulators ready access to the data for use in market
reconstructions, market analyses, surveillance and investigations,\778\
as regulators could then retrieve the information that they need much
faster than the current process of requesting data from multiple
parties without having to reconcile disparate audit trail information.
Also, in the Proposing Release, the Commission noted the importance of
SRO regulatory staff having direct access to consolidated audit trail
data.\779\ The Commission continues to believe that it is vital that
regulators have ready access to the consolidated audit trail data in
the central repository so that this information can be effectively and
efficiently used in fulfilling their regulatory responsibilities.
---------------------------------------------------------------------------

    \776\ See Proposing Release, supra note 4, at 32564.
    \777\ Id. at 32564-32565 and 32594. Differences in audit trail
data requirements between markets can hinder the ability of
regulators to piece together related illegal trading activity
occurring across several markets.
    \778\ Id. at 32594.
    \779\ Id. at 32567.

---------------------------------------------------------------------------
 Rule 613(a)(1)(iii)

    Rule 613(a)(1)(iii) requires the NMS plan to address ``[t]he
reliability and accuracy of the data reported to and maintained by the
central repository throughout its lifecycle, including transmission and
receipt from market participants; data extraction, transformation and
loading at the central repository; data maintenance and management at
the central repository; and data access by regulators.''
    The Commission believes the reliability and accuracy of the data is
a critical aspect of the consolidated audit trail, because the
usefulness of the data to regulators would be significantly impaired if
it is unreliable or inaccurate. If the reliability and accuracy of
reported data is not maintained by the central repository during the
period it is required to be retained and throughout the various uses to
which it may be put by regulators, then its value to regulators will be
substantially diminished.
    Accordingly, the NMS plan submitted should discuss in detail, among
other things, how the consolidated audit trail envisioned by the
sponsors would be designed, tested, and monitored to ensure the
reliability and accuracy of the data collected and maintained by the
central repository (e.g., during transmission from the SRO or member to
receipt by the central repository,\780\ data extraction, transformation
and loading at the central repository,\781\ data maintenance and
management at the central repository,\782\ and data access by
regulators \783\).
---------------------------------------------------------------------------

    \780\ ``Transmission from the SRO or member to receipt by the
central repository'' refers to the process through which SROs and
their members report data to the central repository.
    \781\ ``Data extraction, transformation and loading at the
central repository'' is the process during which the central
repository accepts data reported by the SROs and their members,
converts it into a uniform electronic format, if necessary, and
receives it into the central repository's internal systems.
    \782\ ``Data maintenance and management at the central
repository'' refers to the process for storing data at the central
repository, indexing the data for linkages, searches, and retrieval,
dividing the data into logical partitions when necessary to optimize
access and retrieval, and the creation and storage of data backups.
    \783\ As noted in Section III.B.1.d.iv., supra, for example,
regardless of whether the NMS plan elects to use a series of order
identifiers or a unique order identifier, it will be very important
to demonstrate how the approach selected in the NMS plan will ensure
that information about all events pertaining to an order will be
reliably and accurately linked together in a manner that allows
regulators efficient access to complete order information.

---------------------------------------------------------------------------

    The Commission notes that, when proposing Rule 613, it highlighted
the importance of this consideration by emphasizing that the
reliability and accuracy of the data are critical to the integrity and
effectiveness of the consolidated audit trail.\784\ Indeed, Rule
613(e)(4)(ii), like the proposed Rule, specifically requires the plan
sponsors to establish policies and procedures for the plan processor to
ensure the timeliness, accuracy, and completeness of the audit trail
data reported to the central repository.
---------------------------------------------------------------------------

    \784\ See Proposing Release, supra note 4, at 32582, 32596.

---------------------------------------------------------------------------
 Rule 613(a)(1)(iv)

    Rule 613(a)(1)(iv) requires the NMS plan to discuss ``[t]he
security and confidentiality of the information reported to the central
repository.''
    The Commission is including this consideration because it believes
that keeping the data secure and confidential is crucial to the
efficacy of the consolidated audit trail and the confidence of market
participants. Exposure of highly-confidential information about the
trading strategies and positions of market participants through a
security breach, for example, could impact the confidence of the public
in the central repository and in trading on the U.S. markets. The
Commission understood the importance of security and confidentiality
provisions when it proposed Rule 613(e)(4) to require the NMS plan to
include policies and procedures, including standards, to be used by the
plan processor to ensure the security and confidentiality of all
information reported to, and maintained by, the central
repository.\785\ Numerous commenters also noted the importance of
maintaining the security and the confidentiality of the data collected
pursuant to the proposed Rule.\786\

    \785\ In addition, proposed Rule 613(e)(4)(i) required plan
sponsors, and employees of the plan sponsors and central repository
to agree to use appropriate safeguards to ensure the confidentiality
of such data, and not to use such data other than for surveillance
and regulatory purposes.
    \786\ See Scottrade Letter, p. 2; ICI Letter, p. 2-4; Liquidnet
Letter, p. 4; Ameritrade Letter, p. 3; Thomson Reuters Letter, p. 4;
BATS Letter, p. 3; Managed Funds Association Letter, p. 2-3; Ross
Letter, p. 1. The Commission notes that it is adopting Rule
613(e)(4) with modifications--the Commission has added provisions to
the Rule to help ensure the confidentiality of the data submitted to
and retained by the central repository. See Section III.B.2.e.,
supra.
---------------------------------------------------------------------------

 Rule 613(a)(1)(v)

    Rule 613(a)(1)(v) requires the NMS plan to address ``[t]he
flexibility and scalability of the systems used by the central
repository to collect, consolidate and store consolidated audit trail
data, including the capacity of the consolidated audit trail to
efficiently incorporate, in a cost-effective manner, improvements in
technology, additional capacity, additional order data, information
about additional securities or transactions, changes in regulatory
requirements, and other developments.''
    The Commission believes that the flexibility and scalability of the
systems used by the central repository are important to the
effectiveness of the consolidated audit trail, and, accordingly, the
Commission believes the NMS plan under Rule 613 should address
potential ``built-in'' obsolescence that may arise as a result of the
SROs' choice of systems or technology. For this reason, the NMS plan
should address how, taking into consideration the costs and benefits,
including the potential impact on competition, efficiency, and capital
formation, the consolidated audit trail systems might be designed to
accommodate: (1) Potential growth in the trading volume or message
traffic relating to NMS securities; (2) possible expansion to include
other non-NMS securities; \787\ (3) additional data fields that the
SROs or the Commission might determine to require in the future (such
as new order characteristics); and (4) potential technological
developments that might allow the consolidated audit trail to be
operated in a more timely, reliable, and cost-effective manner.
---------------------------------------------------------------------------

    \787\ Rule 613(i) requires the NMS plan to include a provision
requiring each SRO to jointly provide to the Commission a document
outlining how the consolidated audit trail could be expanded to
products other than NMS securities. See also Section III.B.1.a.,
supra. The consideration of flexibility and scalability of the
systems requires the SROs to address whether the system proposed in
the SRO's NMS plan submission can accommodate the expansion, while
the document required by Rule 613(i) will discuss more broadly how
the SROs could incorporate into the consolidated audit trail
information with respect to equity securities that are not NMS
securities, debt securities, primary market transactions in equity
securities that are not NMS securities, and primary market
transactions in debt securities, including details for each order
and reportable event that may be required to be provided, which
market participants may be required to provide the data, an
implementation timeline, and a cost estimate.
---------------------------------------------------------------------------

    As noted in the Commission's Concept Release on equity market
structure,\788\ the market for trading securities has changed
dramatically in recent years and, as technology advances, trading
systems and trading strategies also change. The Commission believes
that it is important for the consolidated audit trail to keep pace with
market developments. It must be designed in a way that allows it to do
so efficiently and in a cost-effective manner to assure regulators of
its continued usefulness. Thus, the Commission has identified the
flexibility and scalability of the systems used by the central
repository to collect, consolidate, and store audit trail data as a
consideration that must be discussed in the NMS plan submitted to the
Commission for its consideration. To sufficiently address this
consideration, the Commission expects the NMS plan to describe in
detail how the consolidated audit trail envisioned by the sponsors
would be designed to accommodate additional message traffic for orders
in NMS securities, how readily capacity could be expanded, and the
existence of any capacity limits. The Commission also would expect the
NMS plan to discuss in detail the extent to which the proposed
consolidated audit trail could accommodate potential additional data
elements, order characteristics, and other types of securities such as
non-NMS securities, debt securities, primary market transactions in
equity securities that are non-NMS securities, and primary market
transactions in debt securities, how quickly this could be done, and
whether any limits exist on the ability of the proposed system to
accommodate these types of changes. Additionally, the Commission would
expect the NMS plan to further discuss whether and how the consolidated
audit trail could be upgraded to keep pace with improvements in
technology, such as improvements to the speed of systems processing.
---------------------------------------------------------------------------

    \788\ See Concept Release on Equity Market Structure, supra note
87.
---------------------------------------------------------------------------

    The Commission believes these descriptions are important because,
otherwise, what initially appears to be an effective and cost-effective
NMS plan could become significantly less so over time as markets evolve
and if, for example, order volumes increase, new order types are
developed, and additional data elements or other types of securities,
such as non-NMS securities, debt securities, primary market
transactions in equity securities that are non-NMS securities, and
primary market transactions in debt securities, are potentially
incorporated into the consolidated audit trail.
    The Commission notes that issues relating to the potential
flexibility and scalability of the consolidated audit trail were raised
in the Proposing Release. For example, the Commission stated that,
while the proposal was limited to NMS securities, the Commission
ultimately intended the consolidated

audit trail to cover secondary market transactions in other securities
and information on primary market transactions.\789\ In fact, as
discussed above, the Commission specifically proposed that the NMS plan
contain provisions relating to the possible expansion of the
consolidated audit trail to products other than NMS securities.\790\ In
addition, in the Proposing Release, the Commission specifically noted
its concerns with the lack of scalability of the existing EBS system
and the fact that the volume of transaction data subject to reporting
under the EBS system can be significantly greater than the system was
intended to accommodate in a typical request for data.\791\
---------------------------------------------------------------------------

    \789\ See Proposing Release, supra note 4, at 32568-32569.
    \790\ Id. at 32569-70.
    \791\ Id. at 32567.

---------------------------------------------------------------------------
 Rule 613(a)(1)(vi)

    Rule 613(a)(1)(vi) requires the NMS plan to address ``[t]he
feasibility, benefits, and costs of broker-dealers reporting to the
consolidated audit trail in a timely manner: (A) [t]he identity of all
market participants (including broker-dealers and customers) that are
allocated NMS securities, directly or indirectly, in a primary market
transaction; (B) [t]he number of such securities each such market
participant is allocated; and (C) [t]he identity of the broker-dealer
making each such allocation.''
    In the Proposing Release, the Commission stated that ``it would be
beneficial to provide for the possible expansion of the consolidated
audit trail to include information on primary market transactions in
NMS stocks'' and required in proposed Rule 613 that the plan sponsors
address such expansion in a document provided to the Commission within
two months after effectiveness of the NMS plan.\792\ The Commission
continues to believe, for the reasons set forth below, that a potential
expansion of the consolidated audit trail to cover primary market
transactions would be beneficial. Specifically, the Commission believes
that the SROs should address--at the time of the submission of the NMS
plan to the Commission, rather than as part of a later expansion plan--
the feasibility, benefits, and costs of recording and reporting
information about allocations of NMS securities in primary market
transactions as part of the consolidated audit trail.
---------------------------------------------------------------------------

    \792\ See Proposing Release, supra note 4, at 32569 and 32610.
The Commission noted in the Proposing Release that a ``primary
market transaction is any transaction other than a secondary market
transaction and refers to any transaction where a person purchases
securities in an offering.'' Proposing Release at n. 167.
---------------------------------------------------------------------------

    As with the data sources discussed in Section II.A, the sources of
information currently available to the Commission regarding allocations
of NMS securities in primary market transactions are each limited in
their ability to provide accurate, complete, accessible, and timely
information.\793\ For example, while the Commission and FINRA can
request information about allocations from the books and records of
broker-dealers, such requests are unduly cumbersome for both regulators
and market participants, potentially involving multiple time-consuming
individual requests.\794\ Other sources of information about
allocations of NMS securities in primary market transactions--including
public sources \795\--are also limited in certain respects.\796\
---------------------------------------------------------------------------

    \793\ See Section II.A. for a discussion of these four
qualities.
    \794\ See, e.g., Exchange Act Rules 17a-3 and 17a-4 (requiring
broker-dealers to make and keep ``records of purchases and sales of
securities'').
    \795\ Regulation S-K requires registrants to provide information
related to the number of offered securities that are underwritten by
each syndicate member in an effort to describe the nature of the
obligation of the syndicate members with respect to the offered
securities. See 17 CFR 229.508(a). This information comprises
investor-focused disclosures, rather than information that may be
needed by regulators for investigative and other purposes, such as
the information contemplated by Rule 613(a)(1)(vi).
    \796\ For example, FINRA rules require the lead underwriters of
an IPO to collect and provide issuers--but not the public, FINRA, or
the Commission--with names of institutional investors who received
allocations and aggregated information regarding the allocation to
retail investors. See FINRA Rule 5131(d).
    The Depository Trust Company (``DTC'') also collects information
on some IPO allocations in its IPO Tracking System at the discretion
of the lead underwriter. See 61 FR 25253 (May 20, 1996). However, as
well as being discretionary and therefore only addressing a subset
of primary market transactions, the IPO Tracking System only
includes allocations to persons with DTC accounts, which generally
excludes retail investors.
---------------------------------------------------------------------------

    In light of these limitations, data about the allocations of NMS
securities in primary market transactions could also improve market
analysis by the Commission and the SROs, which could in turn help
better inform rulemaking and other policy decisions. Specifically, such
data might aid the Commission and the SROs in better understanding the
role of such allocations in the capital formation process. Combining
this data with the secondary market data to be collected by the
consolidated audit trail could allow regulators to calculate investor
positions and when and how the investors receiving allocations sell
their securities. Such data could also facilitate a better
understanding of how securities are allocated in a primary market
transaction, how allocations differ across broker-dealers and
investors, and what types of investors are allocated securities. This
analysis is virtually infeasible on a market-wide basis today because
the data collection process using current sources of information is so
cumbersome.
    In addition, if the consolidated audit trail included data
regarding the allocations of NMS securities in primary market
transactions, SROs could be better able to monitor for compliance with
their rules related to such transactions.\797\ The data also could more
broadly assist SROs in their examinations and investigations related to
allocations in initial public offerings (``IPOs'') and other primary
market transactions by providing a richer data set for evaluating
possible compliance issues. For example, the SROs could use IPO
allocation information, combined with the secondary market transaction
information in a consolidated audit trail, to run surveillance on
whether sales in the IPO auction were marked accurately (i.e., ``long''
or ``short'') and in compliance with applicable requirements.\798\
Allocation data could also allow SROs to conduct surveillance for ``red
flags'' they might develop regarding potential suitability issues
related to customer allocations, as well as potentially improper
allocations to customers (such as kickbacks).
---------------------------------------------------------------------------

    \797\ See, e.g., FINRA Rules 5130 and 5131. FINRA Rule 5130
imposes certain restrictions on primary market transactions. FINRA
Rule 5131 prohibits certain allocation practices such as
``spinning,'' which refers to an underwriter's allocation of IPO
shares to directors or executives of investment banking clients in
exchange for receipt of investment banking business. See Securities
Exchange Act Release No. 64521 (May 18, 2011), 76 FR 29808 (May 23,
2011) (Order Approving SR-FINRA-2011-017). Certain ``quid pro quo''
practices are also addressed by FINRA Rule 5131.
    \798\ Currently, SROs must request customer account information
during examinations of broker-dealers to check for compliance with
order marking rules.
---------------------------------------------------------------------------

    The Commission could also enhance its own examination and
investigation processes if data regarding the allocations of NMS
securities in primary market transactions were included in the
consolidated audit trail. Without access to a single centralized
database of allocations, Commission staff must rely on more limited
data sources that generally enable only either broad-based sweeps or
one-off investigations based on particularized suspicion of wrongdoing.
Because the relevant data would be readily available for analysis,
including information about allocations as part of the consolidated
audit trail could facilitate the Commission's identification of
particular risks and exam candidates. Other examinations

undertaken by the Commission staff address whether employees of a
regulated entity are in compliance with the rules applicable to their
transactions related to primary market transactions. Having allocation
information available before such an examination commences could allow
staff to enhance their pre-examination research, better focus on the
sources of potential violations, and ultimately foster more effective
and efficient examinations.
    In investigations related to primary market transactions, the
Commission staff generally must obtain data from underwriters post-
transaction, which can take considerable time owing to the limitations
on current sources of data noted above.\799\ Including data about the
allocations of NMS securities in primary market transactions in the
consolidated audit trail could enable investigations to proceed more
efficiently and to more quickly assess whether alleged violations of
various rules under the Exchange Act, such as Regulation M and Rule
10b-5, warrant investigation.\800\ In addition, the Commission believes
that information about allocations could help the SROs and Commission
investigate allegations of improper allocations, such as allocations
subject to ``spinning'' \801\ or ``laddering.'' \802\ Currently, these
types of investigations would require requesting data from
underwriters, and in some cases, other parties (such as investment
advisors) involved in the primary market transaction.
---------------------------------------------------------------------------

    \799\ This approach also may unduly burden the lead underwriter
as the ``gatekeeper'' of such information and prevents the
Commission and SROs from pursuing investigative techniques that may
rely on reaching out to individual market participants for
preliminary information without using the underwriter.
    \800\ See note 242, supra.
    \801\ See note 795, supra.
    \802\ ``Laddering'' is a practice that generally refers to
inducing investors to give orders to purchase shares in the
aftermarket at particular prices in exchange for receiving IPO
allocations. See NYSE/NASD IPO Advisory Committee report and
Recommendations (May 2003), at 6, available at http://www.finra.org/web/groups/industry/@ip/<EMAIL_ADDRESS>---------------------------------------------------------------------------

    Given these potential benefits, the Commission believes that it is
important--consistent with its view in the Proposing Release--for the
SROs to address the feasibility, benefits, and costs of recording and
reporting information about allocations of NMS securities in primary
market transactions as part of the consolidated audit trail. However,
unlike other potential additions to the consolidated audit trail--e.g.,
the inclusion of debt securities--that will be contemplated later in
expansion plans, allocations of NMS securities in primary market
transactions are uniquely tied to the central element of the NMS plan--
the reporting of data regarding trading in NMS securities. For example,
allocations in primary market transactions may have a significant
impact on trading and other activity in the secondary market, and
behavior in the primary market may influence behavior in the secondary
market through initial pricing and other mechanisms. More broadly, IPOs
and other primary market transactions continue to be a source of
particular interest for market participants and observers because of,
among other things, their role in the capital formation process. In
light of these considerations, the Commission believes it is
appropriate to require the SROs to address allocations of NMS
securities in primary market transactions at the time that the NMS plan
is submitted under adopted Rule 613(a)(1), rather than as part of an
expansion plan under adopted Rule 613(i).
    At the same time, the Commission recognizes that firms may use
systems and methods to handle information regarding allocations of NMS
securities in primary market transactions that differ from those used
to handle information regarding secondary market transactions in such
securities. Such differences may affect the extent to which information
regarding allocations may be readily incorporated into the consolidated
audit trail described by the NMS plan mandated by Rule 613. For
example, the unique features of allocations of NMS securities in
primary market transactions may require different reporting timeframes,
different information security controls, or additional data elements
that would not be required for other information being reported to the
central repository and that are not contemplated by Rule 613. Because
of these potential differences, the Commission believes it is
appropriate to require the SROs to address the feasibility, costs, and
benefits of their members reporting information regarding allocations
of NMS securities in primary market transactions, rather than require
the NMS plan to require such reporting at the outset.
    The Commission acknowledges that plan sponsors nevertheless will
incur costs to address the feasibility, benefits, and costs of
incorporating information about allocations of NMS securities in
primary market transactions into the consolidated audit trail. Among
other things, the plan sponsors will need to undertake an analysis of
technological and computer system acquisitions and upgrades that would
be required to include information about such allocations. However,
given the potential benefits described above of including such
information in the consolidated audit trail, the Commission believes
these costs are justified.
ii. Analysis of the NMS Plan
    As noted above, in consideration of the views expressed,
suggestions for alternatives, and other information provided by those
commenting on the proposed Rule, the Commission is adopting Rule 613
with significant modifications to a number of the proposed
requirements. In certain instances these modifications alter the data
and collection requirements of the proposed Rule. In other instances,
the adopted Rule has been altered to be less prescriptive, and hence
less limiting, in the means the SROs may use to meet certain
requirements. These modifications significantly expand the solution set
that could be considered by the SROs for creating, implementing, and
maintaining a consolidated audit trail and thus provide the SROs with
increased flexibility in how they choose to meet the requirements of
the adopted Rule, relative to the solution set that would have been
available under the requirements of the proposed Rule.
    Because these modifications permit a wider array of solutions to be
considered by the SROs, including solutions that could capitalize on
existing systems and standards,\803\ the assumptions underlying the
Commission's cost estimate in the Proposing Release that new, large-
scale market systems would need to be developed from scratch may no
longer be valid.\804\ Thus, as part of the multi-step process for
developing and approving an NMS plan that will govern the creation,
implementation, and maintenance of a consolidated audit trail, the
Commission is deferring its economic analysis of the actual creation,
implementation, and maintenance of a consolidated audit trail itself
(in contrast to the costs of the actions the SROs are required to take
upon approval of the adopted Rule) \805\ until such time

as it may approve any NMS plan submitted to the Commission for its
consideration--that is, after the NMS plan, together with its detailed
information, including cost estimates for the creation, implementation,
and maintenance of the consolidated audit trail, and analysis, has been
submitted by the SROs to the Commission and there has been an
opportunity for public comment. The Commission believes that the
information and analyses will help inform public comment regarding the
NMS plan and will help inform the Commission as it evaluates whether to
approve the NMS plan. In this way, the Commission can be better
informed about the costs for the development, implementation, and
maintenance of the consolidated audit trail that benefit from cost data
and information provided by the SROs in conjunction with--and guided
by--their development of an NMS plan that complies with the
requirements of the adopted Rule. In addition, as noted above,\806\ the
Rule includes a mandate that in determining whether to approve the plan
and whether the plan is in the public interest, the Commission must
consider the impact of the NMS plan on efficiency, competition, and
capital formation.

    \803\ See, e.g., FINRA Letter, p. 14; SIFMA Letter, p. 16-18.
    \804\ The methodology in the Proposing Release assumed that the
scope of the required systems changes would be comparable to those
made in connection with Regulation NMS. See Proposing Release, supra
note 4, at 32597 n. 352. See also Section I., supra.
    \805\ These actions include the requirement that the SROs
develop an NMS plan, utilizing their own resources and undertaking
their own research that addresses the specific details, cost
estimates, considerations, and other requirements of the Rule.
    \806\ See Section I., supra.

---------------------------------------------------------------------------
 Rule 613(a)(1)(vii)

    Rule 613(a)(1)(vii) requires the NMS plan to include ``[t]he
detailed estimated costs for creating, implementing, and maintaining
the consolidated audit trail as contemplated by the national market
system plan, which estimated costs should specify: (A) [a]n estimate of
the costs to the plan sponsors for creating and maintaining the central
repository; (B) [a]n estimate of the costs to members of the plan
sponsors, initially and on an ongoing basis, for reporting the data
required by the national market system plan; (C) [a]n estimate of the
costs to the plan sponsors, initially and on an ongoing basis, for
reporting the data required by the national market system plan; and (D)
[h]ow the plan sponsors propose to fund the creation, implementation,
and maintenance of the consolidated audit trail, including the proposed
allocation of such estimated costs among the plan sponsors, and between
the plan sponsors and members of the plan sponsors.'' \807\
---------------------------------------------------------------------------

    \807\ See Rule 613(a)(1)(vii).
---------------------------------------------------------------------------