FINRA ‘Aggressively’ Seeking BD Feedback on CARDS: Ketchum

After pushback, FINRA said in early March that it would modify its original approach by not collecting sensitive personally identifying information (PII) from the data it receives from CARDS, a point that Ketchum noted during his Monday remarks.

"We clarified that PII is not part of the proposal, so CARDS data will not include account names, addresses, tax IDs or Social Security numbers," Ketchum said. "Thus, customer accounts will not be linked across firms. We know that CARDS will be effective without collecting this information."

Ketchum said that the self-regulator has also heard BDs' concerns about the security "of such a large database." However, Ketchum said that FINRA believes the security risk "is very low — and dispute[s] that CARDS could create systemic risk."

Given that FINRA will not be collecting personally identifiable information, he said, "the chance that anyone could exploit what is, in effect, anonymous data for nefarious purposes is very small."

But Paul Tolley, chief compliance officer of Commonwealth Financial Network, noted on a panel discussion about the top 10 regulatory issues that he's "not a fan" of CARDS, particularly due to its "privacy" concerns. "The sheer volume" of data in "such a huge database," if breached, could be a problem, he said. "There are some pretty sophisticated systems that have been breached," noting that such a breach of CARDS could spark market manipulation.

CARDS will also be launched "in stages," Ketchum said, and the CARDS plan has been changed to allow firms to choose how they send data to FINRA. "You can send it to us through a clearing firm, you can send it to us through a service bureau or you can send it to us directly," he said. "It's up to you."

Firms raised concerns about having to send the data through clearing firms, with many BDs worrying about "the cost implications of working with a clearing firm, especially since nearly 2,000 firms don't currently have clearing firm relationships," Ketchum said.

While FINRA will provide firms with a "standardized file specification" for transmitting data, FINRA plans to permit "variability in the format of data related to suitability," Ketchum said, which "stems from comments that introducing firms, in particular, use different terminology with respect to information about their customers."

To address concerns about "direct business data and how the clearing firms would handle that data," Ketchum noted that "in its initial phases, CARDS will not require firms to submit information about products not held at the firm," such as variable annuities, direct participation programs and direct mutual funds. In a later phase, however, Ketchum said that FINRA "may collect this kind of product information through CARDS, but that collection would be pursuant to additional rulemaking — which would provide us with ample opportunity to continue our dialogue and arrive at workable solutions."

Ketchum also addressed the question of why FINRA doesn't first tackle implementing the consolidated audit trail (CAT) before CARDS.

The short answer, Ketchum said: "Unlike CARDS, CAT will not contain the kind of critical information about customer risk appetites, investment objectives, cash movements, margin requirements and position data that we need for our sales practice reviews," he said. "Moreover, CAT needs to function on a near real-time basis. CARDS does not. To have it do so would be light years more costly than our current proposal."