FR 2025-05198

The document in question is a notice from the Securities and Exchange Commission (SEC) published in the Federal Register. The SEC is inviting public comments on the extension of information collection requirements under Regulation S-ID. This regulation aims to protect investors from identity theft by mandating SEC-regulated financial institutions and creditors to establish policies to identify and respond to identity theft red flags. Additionally, these entities must communicate with cardholders regarding any changes of address. The regulation requires periodic assessments and board reports, which entail certain costs and hours of work.

General Summary

Regulation S-ID focuses on combating identity theft in financial institutions regulated by the SEC. The SEC is seeking public input on the continuation of data collection requirements that help identify and mitigate identity theft risks. These rules stipulate that entities develop and maintain programs, train staff, and ensure board oversight, especially when they hold accounts susceptible to identity theft. The SEC is particularly interested in determining if entities agree with the necessity and utility of the information being collected and the accuracy of the estimated compliance burdens.

Significant Issues and Concerns

Several issues emerge from the document:

1. Assumption about Credit/Debit Card Issuance: The document assumes SEC-regulated entities generally do not issue credit or debit cards, but this may not reflect all entities accurately, potentially overlooking some burdens.

2. Cost and Hour Estimations: The estimated costs rely on specific hourly rates that might not consistently reflect the variation across different entities, risking inaccurate cost assessments.

3. High Percentage Estimation of Covered Accounts: The estimation that 90% of financial institutions or creditors maintain covered accounts lacks recent empirical validation.

4. Ambiguity in Terminology: Terms like "reasonable" and "appropriate" lack specific definitions, which could lead to interpretation challenges in compliance.

5. Complexity for Smaller Entities: The document is complex and lengthy, possibly causing smaller entities difficulties in comprehending and meeting the requirements without additional support.

Impact on the Public and Stakeholders

Broad Public Impact:

From a consumer standpoint, the regulation is crucial in ensuring that financial institutions have processes in place to prevent identity theft, which is becoming a significant issue in finance. The notice implies a sustained effort by the SEC to protect investor interests, which could bolster public confidence in regulated financial institutions.

Impact on Specific Stakeholders:

• Smaller Entities: Smaller SEC-regulated entities might face heavier burdens due to high compliance costs relative to their size. The complexity of the document might necessitate additional resources to grasp and implement the requirements thoroughly.

• SEC-regulated Entities: Larger entities might find it easier to absorb the compliance costs due to economies of scale. However, the lack of current data on certain assumptions may result in some entities feeling underserved by the blanket estimates and projections.

Overall, the document sets the stage for public and industry input to fine-tune regulations supporting identity theft prevention while attempting to address the cost-benefit balance of implementing such measures.

The document from the Securities and Exchange Commission (SEC) addresses the financial burden associated with complying with Regulation S-ID, designed to protect investors from identity theft. The financial implications for SEC-regulated entities primarily involve costs related to developing and maintaining identity theft prevention programs. These costs are primarily for newly formed financial institutions or creditors and those that maintain covered accounts, which are financial accounts that entail risk of identity theft.

Initial Financial Burden on Newly Formed Entities

The SEC estimates that 539 newly formed financial institutions and creditors each year will need to conduct an initial assessment of covered accounts, leading to a total of 1,078 hours. This translates into a total cost of $550,858. For those entities maintaining covered accounts, an additional 14,065 hours and $8,235,300 is projected. Thus, the total initial cost for all newly formed SEC-regulated entities is estimated at $8,786,158.

This financial allocation is critical as it underscores the initial compliance burden on new entities. However, the concern arises from the assumption that these entities may all uniformly bear these costs without considering the potential variation in expenses based on size or operational efficiency.

Ongoing Annual Financial Commitment

Annually, each financial institution or creditor incurs an ongoing burden estimated at 96,030 hours, costing approximately $90,470,555. This includes 10,055 hours simply to periodically review accounts and additional costs for maintaining and updating identity theft programs. For institutions maintaining covered accounts, an extra 85,975 hours at a cost of $85,332,450 is calculated.

The annual financial burden is significant, particularly in light of the SEC's assumption that 90% of these entities maintain covered accounts. This projection may lack sufficient recent empirical data, potentially overestimating the required compliance burden for many entities.

Specific Costs and Methodologies

An hourly rate of $511 for internal counsel is applied in these calculations, along with a rate of $5,085 for board members' time. The cost justification for these rates is not thoroughly discussed, which could lead to deviations in real-world scenarios. This raises an issue where not all entities may pay these rates due to differences in market wages or operational costs.

Additionally, assumptions that SEC-regulated entities typically do not issue credit or debit cards, partnering instead with other entities that handle these, could lead to inadequate representation of the actual compliance costs for some financial entities that might issue cards directly.

Conclusion

Overall, while the SEC provides specific estimates for the financial costs associated with Regulation S-ID compliance, there exist concerns regarding the basis of these calculations, primarily the high percentage estimate of institutions maintaining covered accounts and the standardized cost application across varied entities. The heavy reliance on specific internal cost assumptions raises questions about their applicability universally, underscoring the need for perhaps a more tailored approach considering entity size and business model. The complexity and specificity of these financial burdens could disproportionately impact smaller entities or those with limited resources.