A Form of Lunacy Has Overtaken the SEC

A form of lunacy has overtaken the Securities and Exchange Commission. Those in charge seem to have lost any concept of how to rationally manage a finite amount of resources -- both human and otherwise. Unwilling or incapable of stopping, the SEC continues its excessive resort to rulemaking and rule-amending.

There is reach.

There is grasp.

Virtually none of the more recent rule proposals are within the SEC's reach; and, at this moment in history, none seem capable of coming within the federal regulator's grasp.

The SEC crypto agenda is not one of accomplishment but of delay and failure.

Staff morale is reported to be at historic lows.

Hardcore enforcement in furtherance of investor protection seems to be sacrificed on the altar of generating press and marketing the illusion of regulation.

On March 15th, while the markets fell nearly 2% amid a perceived banking crisis, the SEC issued four press releases about rulemaking and amending.  The SEC's focus should -- must -- be on consumer protection and going after fraudsters in court; instead, we get social media and the reallocation of lawyers and investigators to drafting proposals and cite checking. Indeed, there is magic in the air but that is little more than misdirection, smoke, and mirrors.  

SEC Proposes New Requirements to Address Cybersecurity Risks to the U.S. Securities Markets
(SEC Release / March 15, 2023)
https://www.sec.gov/news/press-release/2023-52
The SEC  proposed a new cybersecurity-risks rule, form, and amendments for broker-dealers, clearing agencies, major security-based swap participants, the Municipal Securities Rulemaking Board, national securities associations, national securities exchanges, security-based swap data repositories, security-based swap dealers, and transfer agents (collectively, “Market Entities”)
https://www.sec.gov/rules/proposed/2023/34-97142.pdf . In part, the SEC Release asserts that: 

Market Entities increasingly rely on information systems to perform their functions and provide their services and thus are targets for threat actors who may seek to disrupt their functions or gain access to the data stored on the information systems for financial gain. Cybersecurity risk also can be caused by the errors of employees, service providers, or business partners. The interconnectedness of Market Entities increases the risk that a significant cybersecurity incident can simultaneously impact multiple Market Entities causing systemic harm to the U.S. securities markets.

The proposal would require all Market Entities to implement policies and procedures that are reasonably designed to address their cybersecurity risks and, at least annually, review and assess the design and effectiveness of their cybersecurity policies and procedures, including whether they reflect changes in cybersecurity risk over the time period covered by the review. The proposal — through new notification requirements applicable to all Market Entities and additional reporting requirements applicable to Market Entities other than certain types of small broker-dealers (collectively, “Covered Entities”) — would improve the Commission’s ability to obtain information about significant cybersecurity incidents affecting these entities. Further, new public disclosure requirements for Covered Entities would improve transparency about the cybersecurity risks that can cause adverse impacts to the U.S. securities markets.

SEC Reopens Comment Period for Proposed Cybersecurity Risk Management Rules and Amendments for Registered Investment Advisers and Funds
(SEC Release / March 15, 2023)
https://www.sec.gov/news/press-release/2023-54
Ummm, lemme see here . . . what? First, the SEC posts a Press Release (see above) announcing a new cybersecurity proposal; however, upon further reflections (belated as it is), the SEC seems to feel that it may have rushed into its first batch of cybersecurity rules/amendments because the federal regulator is now reopening the earlier comment period. As asserted in part in the SEC Release:

The Securities and Exchange Commission today reopened the comment period on proposed rules and amendments related to cybersecurity risk management and cybersecurity-related disclosure for registered investment advisers, registered investment companies, and business development companies that were proposed by the Commission on February 9, 2022. The initial comment period ended on April 11, 2022.

The reopened comment period will allow interested persons additional time to analyze the issues and prepare comments in light of other regulatory developments, including whether there would be any effects of other Commission proposals related to cybersecurity risk management and disclosure that the Commission should consider. 

SEC Proposes Changes to Reg S-P to Enhance Protection of Customer Information
(SEC Release / March 15, 2023)
https://www.sec.gov/news/press-release/2023-51
The SEC  proposed amendments to Regulation S-P,
https://www.sec.gov/rules/proposed/2023/34-97141.pdf which is further explained, in part, in the SEC Release:

Regulation S-P currently requires broker-dealers, investment companies, and registered investment advisers to adopt written policies and procedures for the protection of customer records and information (“safeguards rule”). Regulation S-P also requires the proper disposal of consumer report information (“disposal rule”). Today’s proposal, if adopted, would update the rule’s requirements to address the expanded use of technology and corresponding risks since the Commission originally adopted Regulation S-P in 2000.

The Commission’s proposal would require broker-dealers, investment companies, registered investment advisers, and transfer agents (collectively, “covered institutions”) to adopt written policies and procedures for an incident response program to address unauthorized access to or use of customer information. The proposed amendments would also require, with certain limited exceptions, covered institutions to provide notice to individuals whose sensitive customer information was or is reasonably likely to have been accessed or used without authorization. The proposal would require a covered institution to provide this notice as soon as practicable, but not later than 30 days after the covered institution becomes aware that an incident involving unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.

The proposed amendments would also make a number of additional changes to Regulation S-P, including:

Broadening and aligning the scope of the safeguards rule and disposal rule to cover “customer information,” a new defined term. This change would extend the protections of the safeguards and disposal rules to both nonpublic personal information that a covered institution collects about its own customers and to nonpublic personal information that a covered institution receives about customers of other financial institutions;

Extending the safeguards rule, including the proposed enhancements, to transfer agents registered with the Commission or another appropriate regulatory agency, and expanding the existing scope of the disposal rule to include transfer agents registered with another appropriate regulatory agency rather than only those registered with the Commission; and

Conforming Regulation S-P’s existing provisions relating to the delivery of an annual privacy notice for consistency with a statutory exception created by Congress in 2015.

SEC Proposes to Expand and Update Regulation SCI
(SEC Release / March 15, 2023)
https://www.sec.gov/news/press-release/2023-53 
The SEC  proposed amendments to Regulation Systems Compliance and Integrity ("SCI")
https://www.sec.gov/rules/proposed/2023/34-97143.pdf In part the SEC Release asserts that:

[T]he proposed amendments would expand the scope of SCI entities to include registered security-based swap data repositories; all clearing agencies that are exempt from registration; and certain large broker-dealers, in particular, those that exceed a total assets threshold or a transaction activity threshold in national market system stocks, exchange-listed options contracts, US Treasury securities, or Agency securities.

The proposed amendments would also strengthen the requirements Regulation SCI imposes on SCI entities, including by requiring that an SCI entity’s policies and procedures include the maintenance of a written inventory and classification of all SCI systems and a program for life cycle management; a program to prevent the unauthorized access to such systems and information therein; and a program to manage and oversee certain third-party providers, including cloud service providers, of covered systems.

The proposed amendments would also expand the types of SCI events experienced by an SCI entity that would trigger immediate notification to the Commission, update the rule’s annual SCI review and business continuity and disaster recovery testing requirements, and update certain of the regulation’s recordkeeping provisions.

Bill Singer's Comment: More lunacy from a regulator unaware of the day's headlines and unaware of the depleted state of morale within its ranks. Unable to clean its Augean stable of stale cases, the SEC proposed new rules and rule amendments. Inexplicably, sadly, foolishly, and incompetently, the SEC adds more manure to its pile. No -- I am not arguing against promulgating cybersecurity protections, or reopening what now seems to have been an earlier, premature round of cybersecurity-protection proposals, or enhancing Reg S-P, or updating Reg SCI; however, at some point, an adult must enter the kindergarten and insist that the children take a nap. There is no sense of priority at the SEC. There is no sense of time or place. There is just an unstopped effluent of press releases, podcasts, videos, social media posts, and whatever else is in the arsenal of misguided self promotion. Indeed, at times, enough is, in fact, enough. 

The Tally as of March 16, 2023

As of March 16, 2023, if we just count the number of reported Proposed Rules on the annual "SEC Proposed Rules" webpages, we come up with the following;  

https://www.sec.gov/rules/proposed.shtml

https://www.sec.gov/rules/proposed/proposedarchive/proposed2022.shtml

https://www.sec.gov/rules/proposed/proposedarchive/proposed2021.shtml

https://www.sec.gov/rules/proposed/proposedarchive/proposed2020.shtml

https://www.sec.gov/rules/proposed/proposedarchive/proposed2019.shtml

https://www.sec.gov/rules/proposed/proposedarchive/proposed2018.shtml

https://www.sec.gov/rules/proposed/proposedarchive/proposed2017.shtml

https://www.sec.gov/rules/proposed/proposedarchive/proposed2016.shtml

• SEC
• cybersecurity
• Reg SP
• Regulation SCI
• BrokeAndBroker
• Bill Singer