Concept Release on Consolidated Audit Trail and Other Audit Trails and Data Sources

Document Headings

Document headings vary by document type but may contain the following:

1. the agency or agencies that issued and signed a document
2. the number of the CFR title and the number of each part the document amends, proposes to amend, or is directly related to
3. the agency docket number / agency internal file number
4. the RIN which identifies each regulatory action listed in the Unified Agenda of Federal Regulatory and Deregulatory Actions

See the Document Drafting Handbook for more details.

Securities and Exchange Commission

1. 17 CFR Parts 240 and 242
2. [Release No. 34-105251; File No. S7-2026-12]
3. RIN 3235-AN54

AGENCY:

Securities and Exchange Commission.

ACTION:

Concept release; request for comments.

SUMMARY:

The Securities and Exchange Commission (the “Commission”) is publishing this concept release to solicit comments in support of a comprehensive review of the Consolidated Audit Trail and other audit trails and related data sources currently used in the regulation of U.S. ( printed page 20946) securities markets, including comments regarding the funding mechanisms for these audit trails and/or related data sources. There have been several developments since the Commission last evaluated the scope and sufficiency of these audit trails and related data sources. These developments have prompted the Commission to consider whether changes should be made to the rules and regulations governing existing audit trails and related data sources to better respond to and reflect current market conditions; demonstrated regulatory needs; civil liberty, privacy, and confidentiality concerns; cost-efficient technology solutions; and cybersecurity considerations.

DATES:

Comments should be received on or before June 22, 2026.

ADDRESSES:

Comments may be submitted by any of the following methods:

Electronic Comments

• Use the Commission's internet comment form (https://www.sec.gov/rules/submitcomments.htm); or
• Send an email torule-comments@sec.gov. Please include File Number S7-2026-12 on the subject line.

Paper Comments

• Send paper comments to Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549-1090.

All submissions should refer to File Number S7-2026-12. This file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method of submission. The Commission will post all comments on the Commission's website ( https://www.sec.gov/rules-regulations/rulemaking-activity). All comments received will be posted without change. Do not include personally identifiable information in submissions; you should submit only information that you wish to make available publicly. The Commission may redact in part or withhold entirely from publication submitted material that is obscene or subject to copyright protection.

Studies, memoranda, or other substantive items may be added by the Commission or staff to the comment file during this rulemaking. A notification of the inclusion in the comment file of any such materials will be made available on the Commission's website. To ensure direct electronic receipt of such notifications, sign up through the “Stay Connected” option at www.sec.gov to receive notifications by email.

FOR FURTHER INFORMATION CONTACT:

David Hsu, Assistant Director, and Erika Berg, Special Counsel, at (202) 551-5500, Office of Market Supervision, Division of Trading and Markets, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549.

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Introduction

II. Current Audit Trails and Data Sources Utilized by Regulators

A. The CAT

B. EBS System

C. Other Audit Trails and Related Data Sources

III. Request for Comment

A. Regulatory Purpose of the CAT

B. Structure and Governance of the CAT

CAT NMS Plan

Operating Committee

Advisory Committee

C. CAT Funding and Cost Management

Cost Management

Funding Model and Allocation of Fees

Reserve Funds

Section 31 Fees and Alternative Methods of Funding the CAT

D. CAT Design and Scope

Scope

General Functionality

Lifecycle Linkage and Processing Timelines

Data Storage and Retention

CCID Generation

E. Previous Changes to CAT Requirements

Verbal Activity on Exchange Floors

Not Immediately Actionable Electronic Requests for Quotes

Port-Level Settings

Representative Order Linkage

F. Potential Changes to Other Data Sources and Related Rules

Retirement of Partially Duplicative Systems

Modification and/or Replacement of the EBS System

LTID

G. Civil Liberties and Privacy Considerations

H. Cybersecurity

The CAT

EBS

R&R System

LOPR

Other Audit Trails and/or Related Data Sources

I. Transparency and Process of Comprehensive Review

IV. General Request for Comment

V. Other Matters

VI. Conclusion

I. Introduction

The Securities and Exchange Act of 1934 (the “Exchange Act”), as amended,[1] tasks the Commission with overseeing the U.S. securities markets, including supervising certain market participants such as broker-dealers, clearing agencies, and national securities exchanges.[2] The Exchange Act further provides that specified entities, including national securities exchanges and registered securities associations, fall within the definition of a self-regulatory organization (“SRO”).[3] As an SRO, each national securities exchange and national securities association must comply, and enforce the compliance by its members and associated persons, with the Exchange Act, the Commission's rules and regulations thereunder, and the SRO's own rules.[4]

Effective market oversight by the Commission and SROs relies on, among other things, access by regulatory users at the Commission and the SROs to accurate and timely market data. Because the vast majority of securities transactions in modern markets occur electronically, at high speeds and volumes and across trading venues, cross-market audit trails and related data sources have come to play an important role in the oversight of securities markets. Such audit trails and related data sources aid regulators in conducting robust cross-market surveillances, investigations, enforcement activities, and engaging in cross-market reconstructions and analyses, as appropriate.

For several decades, broker-dealers furnished information to the Commission and the SROs through questionnaires known as “blue sheets” due to the color on which the forms were printed. In the late 1980s, as the volume of trading and securities transactions dramatically increased, the Commission and the SROs worked together to develop and implement a request-and-response system with a universal electronic format, commonly known as the “electronic blue sheet” or ( printed page 20947) “EBS” system, to replace the paper-based process.[5] The Commission and the SROs also obtained data through other methods—including manual requests to market participants, daily reports produced by clearing agencies that provide aggregated information to the SROs and the Commission, market-specific matching engines and/or order book feeds, market-specific audit trails, trade reporting facilities, proprietary data feeds made available by SROs and/or off-exchange trading venues, and publicly-available consolidated data feeds provided by securities information processors.[6]

Regulators also obtained data through audit trails. For example, in 1996, the National Association of Securities Dealers (n/k/a FINRA) was required, pursuant to a settled order, to design and implement an audit trail to provide an accurate, time-sequenced record of orders and transactions on Nasdaq-listed equities, which came to be known as the Order Audit Trail System (“OATS”).[7] OATS was later expanded to include over-the-counter equity securities [8] and all NMS stocks.[9] FINRA also created an internal process by which it augmented the data it collected via OATS with order and trade execution data collected from other SROs with which it had regulatory services agreements.[10] Similarly, in 2000, a group of options exchanges was required, pursuant to a settled order, to design and implement an audit trail to provide an accurate, time-sequenced record of orders, quotations, and transactions on those options exchanges.[11] That audit trail became known as the Consolidated Options Audit Trail System (“COATS”) and was later expanded to incorporate reporting for activity on additional options exchanges.[12]

Although these audit trails and related data sources were useful, they did not produce a comprehensive cross-market audit trail. Even with augmented OATS data, assembling a consolidated audit trail from the various data sources described above was a cumbersome, complex, and time-consuming process that was prone to error.[13]

To improve the accuracy, completeness, accessibility, and timeliness of the data available to regulators, in 2012, the Commission adopted Rule 613 to require the SROs to jointly develop and submit to the Commission a national market system plan to create, implement, and maintain a consolidated audit trail (the “CAT”).[14] In proposing and adopting Rule 613, the Commission stated that the increasingly high-speed, electronic, and widely dispersed markets had given rise to a need for efficient access to a more robust and comprehensive, cross-market audit trail, explaining that existing audit trails and/or data sources were otherwise limited in their scope and effectiveness.[15] The national market system plan submitted by the SROs—the CAT NMS Plan—was approved by the Commission in 2016.[16] On July 15, 2024, the SROs represented to the Commission that the CAT had been fully implemented.[17]

There have been a number of developments in the nearly ten years since the Commission approved the CAT NMS Plan. Chief amongst these developments is the implementation and operation of the CAT itself in accordance with the CAT NMS Plan and its amendments. Once it was able to determine that its members were effectively reporting to the CAT and that the CAT's accuracy and reliability met certain standards, FINRA retired OATS, effective as of September 1, 2021.[18] Other data sources, such as the EBS system, remain operational. The Commission has also provided exemptive relief and approved amendments to the CAT NMS Plan to enable the SROs to remove personally-identifiable information (“PII”) from the CAT, meaning that regulators have continued to rely on alternative data sources (including the EBS system) for fulfilling their regulatory obligations compared to what was contemplated by the Commission when it approved the CAT NMS Plan in 2016.[19]

( printed page 20948)

Importantly, the annual costs of maintaining and operating the CAT have grown well beyond the Commission's 2016 estimate of approximately $55.8 million,[20] increasing to over $248 million per year in the 2025 budget initially approved by the SROs.[21] Markets have experienced much higher volumes and more trading activity than the Commission anticipated in 2016, which has contributed to increased costs associated with storage, data processing, and message traffic.[22] Recently, trading venues have also pushed to extend trading hours,[23] which could further increase trading volumes.[24] Although steps have been taken by the Commission and the SROs to manage and contain costs,[25] the 2026 budget approved by the SROs of approximately $156 million [26] remains significantly in excess of the operational costs estimated by the Commission when it approved the CAT NMS Plan in 2016.[27]

In addition, the Commission has received suggestions from the SROs and other market participants about potential considerations for, and improvements to, audit trails and/or related data sources,[28] including petitions for rulemaking related to the operation and funding of the CAT.[29]

To further consider these market developments, as well as suggestions received from and concerns raised by the SROs and other market participants, the Commission has determined to conduct a comprehensive review of the CAT and other audit trails and related data sources currently used by securities regulators, including regulatory users at the SROs. This review will allow the Commission to examine the effectiveness, regulatory use, and costs of these data sources and to obtain crucial feedback regarding whether changes should be made to their structure, scope, functionality, and security, including changes that would strike a different balance between privacy considerations and regulatory need.

This concept release begins with a brief overview of the audit trails and data sources used by the Commission ( printed page 20949) and the SROs to meet market oversight responsibilities. The release then solicits comments on whether changes should be made to the rules and regulations governing existing audit trails and related data sources to better respond to and reflect current market conditions, demonstrated regulatory needs, civil liberty and privacy concerns, cost-efficient technology solutions, and cybersecurity considerations.

II. Current Audit Trails and Data Sources Utilized by Regulators

Pursuant to Section 17 of the Exchange Act,[30] the Commission can request books and records to monitor and oversee trading in the securities markets under its jurisdiction. Each SRO has its own recordkeeping rules and similarly can request books and records from its members.[31] The Commission and the SROs have used these powers to create audit trails and/or data sources and/or to obtain data for market oversight purposes as follows.

A. The CAT

The CAT is intended to furnish both the Commission and the SROs with timely access to a comprehensive, uniform, accurate, and linked set of trading data that allows them to efficiently retrieve relevant information about the full lifecycle of all orders in NMS and OTC Equity Securities [32] across the markets and trading centers that comprise the national market system.[33] The CAT collects data from both SROs and Industry Members [34] about the original receipt or origination of an order, the routing of an order and the receipt of an order that has been routed, executions, modifications, and cancellations.[35] The Plan Processor,[36] FINRA CAT, LLC (“FINRA CAT”), uses this data to “link and create the order lifecycle” using a “daisy chain approach,” in which “a series of unique order identifiers, assigned to all order events handled by CAT Reporters[,] are linked together by the Central Repository[[37] ] and assigned a single CAT-generated CAT-Order-ID that is associated with each individual order event and used to create the complete lifecycle of an order.” [38] In addition to this linked data, the CAT is required to provide regulators with SIP Data.[39]

Although the CAT is no longer required to collect customer and account-level information pursuant to an amendment to the CAT NMS Plan approved by the Commission on January 13, 2026,[40] the CAT's architecture of identifiers and lifecycle linkage enables regulators with a specific regulatory purpose to analyze a particular customer's trading activity for Eligible Securities [41] across markets, brokers, and/or accounts through generation of a CAT Customer ID (“CCID”).[42] This transactional data may only be associated with customer and account-level information if such information is obtained separately from Industry Members through a manual request.[43]

B. EBS System

Requests for data outside of the CAT system are predominantly made through the EBS system. In 2001, the Commission adopted Rule 17a-25 under the Exchange Act to codify and enhance the EBS system.[44] Rule 17a-25 requires firms to report to the Commission standard data elements for proprietary securities transactions such as security symbol, date executed, amount traded, type of transaction, transaction price, account number, execution venue, and identification information for the parties on either side of the transaction.[45] For customer securities transactions, Rule 17a-25 further requires firms to include the customer name, address, branch office number, registered representative number, type of order, date account opened, taxpayer identification number, employer name, and the role of the intermediary (agent or principal) if any.[46] This kind of customer information is no longer required to be collected or stored by the CAT and is therefore only accessible through the EBS system or manual requests.[47]

The EBS system is also used to process requests made by the Commission for account-level ( printed page 20950) information and transactional data pursuant to Rule 13h-1,[48] which sets forth broker-dealer record-keeping, reporting, and monitoring requirements for large traders.[49] This rule is designed to enable the Commission to promptly and efficiently identify significant market participants and to collect data on their trading activity so that Commission staff can reconstruct market events and conduct investigations.[50] Under Rule 13h-1, large traders are required to identify themselves to the Commission and to make certain disclosures on Form 13H.[51] Upon receipt of Form 13H, the Commission issues a unique identification number to the large trader (“LTID”), which the large trader is then required to provide to those broker-dealers through which it trades.[52] Rule 13h-1 enables the Commission to request account-level information and transactional data from broker-dealers for large traders (as well as Unidentified Large Traders [53] ) via the EBS system and using the EBS reporting template.

Information retrievable through the EBS system is limited to executed trades and does not contain information on orders or quotes, and thus does not contain information on routes, modifications, and cancellations.[54] Such information is available through the CAT and is used to investigate various forms of potential market manipulation like layering and spoofing.

C. Other Audit Trails and Related Data Sources

Regulators may make manual requests for books and records information—for example, by sending emails to broker-dealers requesting the relevant data.[55] In addition, the Commission and the SROs also rely on other data sources to fulfill their regulatory obligations.

One such data source is the National Securities Clearing Corporation's (“NSCC”) equity cleared report,[56] which is generated on a daily basis by the SROs and provided to the NSCC in a database accessible by the Commission. It shows the number of trades and daily volume of all equity securities transacted, sorted by clearing member and searchable by security name and CUSIP number.[57] The Options Clearing Corporation (“OCC”) [58] provides several other reports to regulators, including: (1) the OCC Trades report, which provides similar data as the NSCC's equity cleared report for options securities; (2) the OCC End-of-Day Positions File, which provides the current aggregate position for customer, firm, and market-maker clearing ranges; and (3) the Large Options Position Report (“LOPR”), which provides start-of-day and end-of-day positions per option security on a customer and account-level basis, along with several other reports. OCC generates these reports on a daily basis and provides them to the SROs; the Commission then accesses OCC reports through the FINRA regulatory portal.[59]

Regulators may also obtain data from privately- and publicly-available market data feeds. Specifically, SROs may leverage data feeds from their own, market-specific matching engines and/or order book feeds, data from their own audit trails [60] or other trade reporting or display facilities,[61] data from proprietary feeds made available by other SROs and/or off-exchange execution venues, and/or publicly-available consolidated data feeds provided by various securities information processors that provide top-of-the-book information like quotes, National Best Bid and Offer (“NBBO”), and trade- or last sale-data.[62] The Commission maintains a tool called the Market Information Data Analytics System (“MIDAS”) that similarly collects and processes equity data from the consolidated data feeds as well as from separate proprietary feeds.[63] Even when combined in a tool like MIDAS, though, these data feeds do not provide a comprehensive, cross-market audit trail that would enable regulators to track an order through its entire lifecycle, from order origination through routing and on to execution, modification, or cancellation, because each of the above-described audit trails and/or related data sources has its own limitations.

III. Request for Comment

The Commission encourages comment from all interested parties, including, but not limited to, SROs, broker-dealers, retail and institutional investors and those who represent their interests, academics, economists, technology experts and service providers, trade associations, and civil liberties groups. While the release poses a number of general and specific questions, the Commission also welcomes comments on any other aspects of the audit trails and related data sources currently in use (or comments on any potential audit trails and related data sources that should be created), particularly on any costs, burdens, or benefits that may result from the possible regulatory responses identified in this release or otherwise proposed by commenters.

A. Regulatory Purpose of the CAT

1. What are the regulatory use cases that must be enabled for the Commission and the SROs to fulfill their statutory obligations? Is the CAT necessary to enable those use cases? For example, is the CAT necessary to inform any regulatory decision-making and/or policy-making? Are other audit trails and/or related data sources sufficient to ( printed page 20951) enable necessary regulatory use cases? Why or why not?

2. Are there features of the CAT that could be eliminated because they are unnecessary or because they could be replaced by other currently-existing audit trails and/or related data sources in an efficient and/or cost-effective manner? If so, please identify such features, explain why they could be eliminated, and, if relevant, identify the alternative data sources that could replace such features.

3. Should the Commission eliminate the CAT in favor of developing a different audit trail and/or data source to enable necessary regulatory use cases? Why or why not? How should a new audit trail and/or data source differ from the CAT? What improvements could be gained by developing a new audit trail and/or data source that could not be achieved through incremental improvement to the CAT?

B. Structure and Governance of the CAT

Historically, the structure and governance of audit trails and/or related data sources has varied. OATS and COATS, for example, were owned, implemented, and operated by the SROs. Commission staff could obtain access to the data supplied by these systems through ad hoc requests. With respect to the EBS system, the Commission promulgated a rule to require broker-dealers to electronically submit specified data to the Commission upon request, in a format set by the SROs,[64] but did not otherwise specify how systems that collect EBS data from broker-dealers should be structured. Currently, Commission staff access EBS data through a system owned, implemented, and operated by FINRA, which licenses use of the system to the Commission. Rule 613 of Regulation NMS,[65] on the other hand, is more specific about the structure of the CAT. It requires the SROs to act jointly to develop a national market system plan to implement the CAT to collect specified data from the SROs and their members [66] and to provide access to such data to each SRO and the Commission “for the purpose of performing . . . regulatory and oversight responsibilities pursuant to the federal securities laws, rules, and regulations.” [67] The rule further requires that each SRO be a sponsor of the CAT NMS Plan [68] and that the CAT NMS Plan “include a governance structure to ensure fair representation of the plan sponsors, and administration of the central repository, including the selection of the plan processor.” [69]

CAT NMS Plan

Under the CAT NMS Plan developed by the SROs and approved by the Commission, the CAT collects data that can be accessed by authorized regulatory users from the SROs and the Commission in a system that is jointly owned by the SROs,[70] but implemented and operated by the Plan Processor. FINRA CAT—a subsidiary of FINRA—is the current Plan Processor and, as such, acts as a vendor to the SROs.

4. What are the advantages and disadvantages of structuring the CAT as a national market system plan (an “NMS plan”)? Should the CAT continue to be structured as an NMS plan? Does the fact that both the SROs and the Commission rely on the CAT to fulfill their regulatory functions counsel for or against structuring the CAT as an NMS Plan?

5. If the CAT should not continue to be structured as an NMS plan, how should the Commission and/or the SROs direct and oversee the operation of the CAT? [71] What specific benefits, actions, and costs would be associated with transitioning to an alternative structure? Would transitioning to an alternative structure for the CAT provide offsetting benefits to the costs of transitioning? For example, would replacing the CAT NMS Plan with an SEC rule requiring the reporting of certain information to the Commission and/or the SROs strengthen the Commission's ability to control the scope and associated costs of the CAT?

Operating Committee

The CAT is governed by the Operating Committee, which is composed of one voting member for each SRO.[72] The CAT NMS Plan, however, does not specify or provide any constraints on who each SRO may choose as its voting member. The Operating Committee generally meets on a bi-weekly basis; except as otherwise provided in the CAT NMS Plan, the Operating Committee makes all decisions and authorizes all actions taken by the Company.[73] Because the CAT NMS Plan allocates votes on the Operating Committee by SRO, affiliated SRO groups may exert a level of control over the operations of the CAT that is not required to be correlated with their market share or their share of operating expenses.[74]

6. Should the Commission amend the CAT NMS Plan to implement a different voting structure? If so, what should this voting structure be and why? What are the advantages and disadvantages, for example, of allocating one vote to each affiliated SRO group and each non-affiliated SRO,[75] as opposed to the current structure of allocating one vote to each SRO regardless of affiliation? [76] ( printed page 20952) If votes should be allocated to each affiliated SRO group and each non-affiliated SRO, are there any circumstances in which an affiliated SRO group or non-affiliated SRO should be given extra votes? [77] If so, please explain what these circumstances are and why they should affect the voting structure of the CAT NMS Plan.

7. Action of the Operating Committee is authorized either by a Majority Vote [78] or a Supermajority Vote [79] of these voting members, as specified by the CAT NMS Plan.[80] Should the Commission amend the CAT NMS Plan to require a different vote threshold—for example, a Majority Vote, Supermajority Vote, or a unanimous vote—for any specific action? [81] If so, what should that vote threshold be, for which actions, and why?

8. Are there measures that could increase transparency and accountability around CAT NMS Plan voting while protecting sensitive information? For example, should more information be made public about the Operating Committee's deliberations? Are there any privacy or security concerns regarding disclosure of such information?

Advisory Committee

Rule 613 requires that the CAT NMS Plan “include an Advisory Committee,” whose purpose “shall be to advise the plan sponsors on the implementation, operation, and administration of the central repository.” [82] The rule states that “[m]embers of the Advisory Committee shall have the right to attend any meetings of the plan sponsors, to receive information concerning the operation of the central repository, and to provide their views to the plan sponsors; provided, however, that the plan sponsors may meet without the Advisory Committee members in executive session if, by affirmative vote of a majority of the plan sponsors, the plan sponsors determine that such an executive session is required.” [83] Members of the Advisory Committee do not have the right to vote,[84] which market participants have stated limits their ability to influence CAT operations.[85] However, in addressing the questions below, commenters are requested to take notice of a decision of the United States Court of Appeals for the District of Columbia Circuit,[86] which held that Section 11A of the Exchange Act [87] does not allow non-SRO representatives to serve as voting representatives on the operating committee of an NMS plan.

9. What powers, responsibilities, or rights should be given to the CAT Advisory Committee? How would such powers, responsibilities, or rights affect the SROs' ability to govern the CAT? Would such powers, responsibilities, or rights raise concerns about conflicts of interest, given that the members of the CAT Advisory Committee are parties regulated by the SROs?

10. Should the membership of the CAT Advisory Committee be reserved for representatives of certain interests or individuals with specific experience? Should the membership of the CAT Advisory Committee be expanded to include any other market participants not currently represented, such as operators of alternative trading systems (“ATSs”), technology experts, or those with technical and operational expertise related to the management of trading, trade processing, and/or trade data management systems? If so, in what way should representation be apportioned?

11. While the CAT Advisory Committee is entitled to “receive the same information concerning the operation of the Central Repository as the Operating Committee,” the Operating Committee “may withhold information it reasonably determines requires confidential treatment.” [88] What non-public information should the CAT Advisory Committee have access to and how should confidentiality of this information be maintained? What is the correct balance between providing the public with transparency into the recommendations of the CAT Advisory Committee (and the Operating Committee's responses to these recommendations) and maintaining the confidentiality of potentially sensitive information about CAT operations?

12. Should additional information about the operation of the CAT, including security measures taken by the SROs to protect CAT Data,[89] be provided to Industry Members beyond those representatives that sit on the Advisory Committee? If so, what information should be provided? How would disclosure of such information affect the security of the CAT?

13. Should the Commission form a separate advisory committee to provide advice and recommendations to it on topics related to the CAT? If so, what are appropriate topics for the advisory committee to consider? For example, should the advisory committee counsel the Commission on matters relating to the CAT's scope, functionality, design, security, cost management, and/or civil liberties and privacy protections? Who should participate as members of this advisory committee? Should it include market participants and others with technical and operational expertise related to the management of trading, trade processing, and/or trade data management systems? Should it include civil liberty and privacy advocates? Should it include representatives of other relevant constituencies? What non-public information should such an advisory committee have access to and ( printed page 20953) how should the confidentiality of this information be maintained?

C. CAT Funding and Cost Management

The CAT is funded by both SROs and Industry Members, in accordance with the funding model recently approved by the Commission (the “2026 Funding Model Order”).[90] There have been legal challenges to the CAT and its funding model,[91] but the Commission has taken the position that it has the requisite authority under Section 17 and Section 11A of the Exchange Act to direct the creation of the CAT.[92] It also maintains that the CAT funding model approved by the 2026 Funding Model Order is a reasonable approach that satisfies the relevant standards set forth in federal statutes, rules, and regulations.