The Securities and Exchange Commission provided an exemption from the requirement to report certain personally identifiable information (PII) – names, addresses, and years of birth – to the Consolidated Audit Trail (CAT) for natural persons.  Bad actors have become increasingly sophisticated and, in the event of a breach, may be able to use the names, addresses, and years of birth to impersonate a customer or broker-dealer and gain access to a customer’s account. Providing an exemption from the requirement to report this PII to the CAT will help mitigate potential security risks.

Today we put the CAT on a diet. It will no longer be able to hoover up Americans' personally identifiable information: https://t.co/6dm3UgWXel

— Hester Peirce (@HesterPeirce) February 10, 2025

“Over 12 years ago, the CAT was designed with the goal of creating a modernized audit trail system to enable regulators to analyze and reconstruct market events,” said SEC Acting Chairman Mark Uyeda. “The exemptive order eliminates the requirement to report names, addresses, and years of birth for any U.S. natural person who trades in the stock market and recognizes that such information is not necessary to achieve CAT’s objectives. Despite today’s action, bad actors and other miscreants who engage in insider trading, market manipulation, and other schemes should be forewarned that the Commission has more than sufficient investigative tools to hold them accountable.”

Names, addresses, and years of birth were originally required to be collected in the CAT to facilitate the generation of unique anonymized customer IDs and to help regulators identify the person(s) responsible for a trade.

In 2020, the Commission issued an order exempting the reporting of some of the most sensitive PII, including social security numbers. Today, the Commission issued an order exempting additional PII from the CAT.

The CAT will still be able to generate reliable and consistent anonymized customer IDs even if such PII is not reported to the CAT.

Source: SEC

SIFMA Statement on SEC’s Exemption from the Requirement to Report Certain Personally Identifiable Information to the Consolidated Audit Trail

SIFMA issued the following statement from president and CEO Kenneth E. Bentsen, Jr. on the exemption from the requirement to report certain personally identifiable information to the Consolidated Audit Trail which was provided today by the Securities and Exchange Commission:

“SIFMA applauds the Securities and Exchange Commission (SEC) for taking this appropriate action to exempt the reporting of American investors’ personally identifiable information (PII) to the Consolidated Audit Trail (CAT).  For a decade, SIFMA has expressed strong concerns on behalf of the industry and investors that the information in the CAT—the largest database of retail and institutional trading ever created—was a ripe target for cyber criminals and collecting PII put investors’ data at risk.  We have repeatedly called on the SEC to prohibit the collection of investors’ personal information and proposed alternatives that address the Commission’s enforcement concerns without the need to collect such data.  This bold decision by the Commission is entirely appropriate and long overdue.”

Source: SIFMA