SEC ‘Pushing’ for Fiduciary Rule, Clayton Says

Finally, that the SEC, Labor and state regulators "are coordinated in how we approach this" fiduciary regulation, Clayton said.

EDGAR Cyber Breach and the Reserve Fund

In the nearly two-hour long hearing — in which lawmakers also grilled Clayton on the recent cyber hack of the agency's corporate filing system, EDGAR — Clayton also said that he's "worried" about the amount of retail fraud.

Sen. Mike Crapo, R-Idaho, chairman of the Senate Banking Committee, said in his opening remarks that he was "disturbed to learn that the SEC suffered a cyber breach of its EDGAR system in 2016, but did not notify the public, or even all of its commissioners, until it was discovered during your recent review."

Late Monday, the SEC announced two new initiatives: the creation of a Cyber Unit that will focus on targeting cyber-related misconduct as well as a Retail Strategy Task Force that will implement initiatives that directly affect retail investors.

The Retail Strategy Task Force is charged with developing proactive, targeted initiatives to identify misconduct affecting retail investors. 

The retail task force's mission will be to leverage data analytics and technology to identify "large-scale misconduct" affecting retail investors and will include participation from employees in the agency's enforcement, National Exam Program as well as the Office of Investor Education and Advocacy.

Clayton noted during his testimony that the exact month of the 2016 hack of EDGAR is still unknown, but that members of the agency's enforcement division along with the agency's Office of General Counsel and the Office of the Inspector General are conducting an investigation of the hack.

"We believe the 2016 intrusion involved the exploitation of a defect in custom software in the EDGAR system," Clayton said, adding that "the more custom the software, the more likely for it to be vulnerable."

Clayton said that he has "formally requested that the OIG begin a review into what led to the intrusion, the scope of nonpublic information compromised and our efforts in response," and has asked OIG to "provide recommendations for how the SEC should remediate any related system or control deficiencies."

Sen. Jack Reed, D-R.I., urged Clayton to fight to ensure that the $50 million reserve fund that supplies the agency's IT funds isn't eliminated by the Trump administration.

"I would urge you to … resist any attempts" to take away this Reserve Fund, Reed said to Clayton. "The administration has proposed that in 2019, the fund be eliminated. Given the current situation with cybersecurity, you have to have the money," Reed said, noting that the agency can set aside up to $100 million of its registration fees to fund the reserve fund.

"I think we need to spend more money" on IT, Clayton responded. "When I got to the commission, I made some assessments. We went with a flat budget for the next fiscal year; I will not be asking for a flat budget for fiscal year '19. We're going to need more money in the area of cybersecurity and IT generally. I intend to ask for it."

— Check out State-Registered Advisors Need More Cyber Prep on ThinkAdvisor.