FINRA has once again identified the Consolidated Audit Trail (CAT) as an ongoing key area of risk in its 2024 Annual Report. In late May, 2024 the industry will complete a timeline spanning over four and a half years to implement CAT and the Customer Account Information System (CAIS).
Rule 3110 (Supervision) and New Considerations for Compliance
Last year, Oyster stressed that firms should evaluate their surveillance program to ensure it is adequately mitigating risk. This year, FINRA has added several references to Rule 3110, better known to the industry as the Supervision Rule, and the following new considerations:
- Periodic evaluation of the firm’s Supervisory controls to confirm these are reasonably designed to ensure compliance with CAT reporting requirements, including record keeping, reporting and clock synchronization
- The number of periodic comparative reviews performed compared to the overall CAT reporting volume of the firm
- If erroneous events were found during these reviews, determine if these were self-reported to FINRA CAT
CAT Effective Practices Updates
There were no changes to the Findings summary provided by the regulatory body but the following important updates were added to Effective Practices.
- CAT Supervision. When relying on a CAT Reporting Agent (“CRA”), firms are reminded that they must maintain a written agreement that specifies the functions and responsibilities for exception management and any error correction.
- CAT Clock Synchronization. When relying on third-party non-broker dealer vendors for synchronization of business clocks, obtaining daily synchronization logs and reviewing them to ensure that the clock drifts are within acceptable tolerances.
Key Takeaways: Evolving Expectations for CAT Reporting
There are several consistent themes for industry members to take away from this new priority list:
- The level of supervision expected by FINRA related to CAT reporting is vastly different than what was historically acceptable for previous order audit trail system (OATS) reporting. Firms must create, implement and maintain policies and procedures that reflect the actions and controls in place to ensure the timeliness, completeness, and accuracy of the firm’s CAT reporting.
- The use of a CRA requires additional due diligence and documentation to mitigate regulatory reporting risk.
- Don’t forget about Clock Synchronization and the related regulatory responsibilities based on by whom and how business clocks are maintained, and validated against the atomic clock.
- CAIS reporting goes into compliance on May 31st, 2024, and will require firms to update their policies, procedures and controls.
Oyster’s CAT reporting experts expect to see regulatory trade reporting inquiries specifically related to CAT and CAIS dramatically increase once CAIS is fully implemented. Whether your firm is self-reporting or uses a CRA, your firm’s supervision must be in line with the stated summary in this latest report, in addition to what is found in FINRA’s NTM 20-31.
Oyster Consulting provides comprehensive consulting for CAT and CAIS reporting, from performing simple due diligence on CAT Reporting Agents to providing a comprehensive assessment of your CAT/CAIS reporting and related policy, procedures and controls.
Our Consolidated Audit Trail reporting software helps firms meet their FINRA CAT reporting obligations.
The Oyster Solutions CAT Reporting Module consolidates CAT reporting events, error analysis and validation data into a central program. Our CAT Application will identify errors, linkage and gaps between your data and CAT reporting data. Our application allows for individual and bulk repairs prior to the FINRA CAT Portal, a feature that enhances the user experience. The Oyster Solutions CAIS module can be used to view CAIS reports and the underlying source data in a single platform. This module allows firms to better prepare for Full CAIS reporting through the Interim Reporting Obligation. This module uses web-based GUI that provides firms with practical data so users can efficiently identify, monitor, and manage errors which may impact their reports.
