Ketchum: What this industry is missing when it comes to CARDS

Finra chief Richard Ketchum says industry groups like SIFMA are overlooking the investor protection benefit of Finra's controversial data-collection proposal.

Finra must demonstrate how its controversial data-collection system will benefit investors in order to quell mounting criticism of the proposal, the organization’s leader said Friday.
“We think the benefits are absolutely obvious, but we recognize it’s always our obligation to look closely at costs,” said Richard Ketchum, Financial Industry Regulatory Authority Inc. chairman and chief executive.
“We’d be delighted to quantify [the benefits],” he said at a Consumer Federation of America conference in Washington. “I think that’s in the hundreds of millions of dollars from the standpoint of potentially averted investor harm.”
The industry-funded broker-dealer regulator has received 67 comment letters regarding its massive Comprehensive Automated Risk Data System, most of them opposed to the idea.
None of the missives was more pointed than the one from the Securities Industry and Financial Markets Association, a group representing a wide swath of the financial services industry. SIFMA urged Finra to withdraw the CARDS proposal, asserting that it would substantially increase regulatory costs for financial firms while potentially exposing sensitive customer information to cyberattacks.
“The only thing that frustrates me about the SIFMA comment letter is the seeming inattention to the benefits from an investor-protection standpoint,” Mr. Ketchum said on the sidelines of the conference.
During the CFA meeting, Mr. Ketchum asserted that CARDS, which would collect reams of customer-account data from clearing firms and brokerages on a monthly basis, would enable the regulator to detect dangerous industry trends and harmful product-sales practices more quickly.
Among the examples Mr. Ketchum gave during a panel discussion were instances where a brokerage suddenly starts selling penny stocks, unregistered securities and complex products in order to boost its revenue, or begins perpetrating fraud.
The way Finra currently operates, it can only catch such activities by doing firm-by-firm reviews and industry sweeps. With CARDS, Mr. Ketchum said, Finra would be able to target a problem as it arises.
Sitting a couple feet away from Mr. Ketchum on the CFA panel, Ira Hammerman, SIFMA executive vice president and general counsel, said aggregating detailed customer account information — other than names and Social Security numbers and other identity tags — in one repository makes it a tempting target for hackers.
“The bad guys will find a way to link all that raw data that’s sitting at Finra and find out who’s behind that data,” Mr. Hammerman said. “The concept of having all of that big data for Finra to troll through in one place causes us a little bit of anxiety. It’s not just us … our customers get anxious.”
A CFA official dismissed SIFMA’s concerns as disingenuous hand-wringing.
Barbara Roper, CFA director of investor protection, said brokerages don’t bat an eye in developing potentially vulnerable sophisticated technology systems to generate more business. But the industry is digging in against CARDS, which won’t include personally identifiable information or the ability to conduct transactions.
“When the purpose of gathering the data is to protect investors … then the privacy and security risks become paramount,” Ms. Roper said at the CFA event. “I think that’s fundamentally inconsistent.”
Originally introduced as a concept release a year ago, CARDS is now in its second iteration. Comments on the latest proposal were due last Monday.
After sifting through the letters, Finra may modify the proposal. It has promised a thorough cost-benefit analysis. The Finra board would have to sign off on CARDS and then send it to the Securities and Exchange Commission for final approval.
Mr. Ketchum didn’t offer a timeline.
“This is an important proceeding, but it’s even more important to get it right,” he said. “We’ll take whatever time it takes to go through this next process.”
SIFMA plans to resist CARDS at each step.
“Our members will take every action that they feel is appropriate under the rules of procedure,” SIFMA chief executive Kenneth Bentsen Jr. said in a Dec. 4 media briefing. “I feel quite confident we’ll comment with the SEC and we’ll see where it ends up.”