BDs Blast FINRA’s CARDS Plan on Privacy Risk

FSI told FINRA that while CARDS is capable of improving oversight, increasing the efficiency of the examination process and enhancing investor protection, they system as proposed "presents significant challenges due to its ambitious scope and massive scale. These challenges include data standardization, data complexity, data translation, system infrastructure, and the incredible financial costs required to develop, implement and maintain CARDS."

In addition, FSI said that the "collection and centralized warehousing of vast quantities of data raises substantial concerns with regard to data security, privacy, and potential liability in the event of a security breach."

The Securities Industry and Financial Markets Association told FINRA in its comment letter that while SIFMA supports FINRA's goal of utilizing technology to be a more efficient and effective regulator, SIFMA "cannot support" the CARDS concept.

"More information as well as further analysis on how the system would be structured and utilized, and a better understanding of what existing FINRA-mandated systems would be replaced is necessary before proceeding any further," SIFMA said.

The data collected by CARDS would include sensitive information regarding retail customer brokerage accounts, including customer profile information, account activity and account balances and holdings, SIFMA points out.

"CARDS would be a massive and invasive regulatory undertaking with serious privacy implications for the general public and added technology costs and regulatory burdens for the financial industry," said Ira Hammerman, executive vice president and general counsel of SIFMA.

FINRA's concept proposal "raises serious questions about data security and privacy issues for retail investors, as it would create a centralized location for highly personal, private and sensitive consumer financial data," Hammerman continued. "Further, CARDS would require tremendous resources from the financial industry, and it's not clear why existing systems or the new required Consolidated Audit Trail system couldn't be used to accomplish FINRA's goal. Without more information on the intent and structure of CARDS, we cannot do the necessary analysis to support the proposal."