AGENCY:

Securities and Exchange Commission.

ACTION:

Final rule.

SUMMARY:

The Securities and Exchange Commission (“Commission”) is adopting a new rule that specifies several actions that the Commission, in its administration of the Electronic Data Gathering, Analysis, and Retrieval system (“EDGAR”), may take to promote the reliability and integrity of EDGAR submissions. The new rule establishes a process for the Commission to notify filers and other relevant persons of its actions under the rule as soon as reasonably practicable. In addition, the Commission is adopting amendments to delegate authority to the Director of the Commission's EDGAR Business Office to take actions pursuant to the new rule and two current rules relating to filing date adjustments and the continuing hardship exemption.

DATES:

This rule is effective February 3, 2021.

FOR FURTHER INFORMATION CONTACT:

Rosemary Filou, Chief Counsel; Monica Lilly, Senior Special Counsel; or Jane Patterson, Senior Counsel; EDGAR Business Office, at 202-551-3900, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549.

SUPPLEMENTARY INFORMATION:

The Commission is adopting new rule 17 CFR 232.15 (“Rule 15”) under 17 CFR 232.10 through 232.903 (“Regulation S-T”), and new rule 17 CFR 200.30-19 (“Rule 30-19”) under 17 CFR 200.1 through 200.800, the Commission's Rules of Organization and Program Management.

I. Introduction and Background

Regulation S-T addresses, among other things, certain administrative issues related to EDGAR submissions.^[1] For example, Regulation S-T allows a filer to submit an amendment to, or a notice of withdrawal of, the filer's submission to remedy a submission issue (“filer corrective disclosure”).^[2] In recent years, as the volume of EDGAR submissions has grown, the Commission has increasingly confronted administrative issues that impact the Commission's ability to promote the reliability and integrity of EDGAR submissions and that are not easily addressed by existing rules or filer corrective disclosure. When these issues arise, they can create confusion for filers, investors, and other users of EDGAR.

To promote the reliability and integrity of EDGAR submissions and to provide transparency about our practices, the Commission proposed Rule 15 under Regulation S-T on August 21, 2020, to specify actions that the Commission may take to facilitate the resolution of administrative issues.^[3] Proposed Rule 15 provided that, in its administration of EDGAR, the Commission may take the following actions to promote the reliability and integrity of EDGAR submissions:

• Redact, remove, or prevent dissemination of personally identifiable information that if released may result in financial or personal harm to an individual (“Sensitive PII”);
• Prevent submissions that pose a cybersecurity threat;
• Correct system or Commission staff errors;
• Remove or prevent dissemination of submissions made under an incorrect EDGAR identifier;
• Prevent the ability to make submissions when there are disputes over the authority to use EDGAR access codes;
• Prevent acceptance or dissemination of an attempted submission that it has reason to believe may be misleading or manipulative while evaluating the circumstances surrounding the submission, and allow acceptance or dissemination if its concerns are satisfactorily addressed;
• Prevent an unauthorized submission or otherwise remove a filer's access; and
• Remedy similar administrative issues relating to submissions.

Moreover, the proposed rule sets forth a process for the Commission to notify filers and other “relevant persons” (as defined below) of its actions under the rule as soon as reasonably practicable.

We received several comment letters in response to the proposal.^[4] A few commenters were generally supportive of the proposed rule, but expressed concern that the Commission may redact information from a submission without first contacting the filer.^[5] These commenters requested that filers be notified prior to any Commission action under the proposed rule, if possible. These commenters also requested that the Commission always consider an issuer's vendor or supplier to be a relevant person when the Commission provides notice of its actions to a filer and any relevant person.

Another commenter was generally supportive of the proposed Commission action when a submission contains Sensitive PII.^[6] The commenter suggested that the Commission “interpret the definition of Sensitive PII broadly.” The commenter also suggested that the Commission provide that filers may initiate a request for redaction or removal of information from a submission containing Sensitive PII and that the Commission redact or remove such information if the filer demonstrates that the submission contains Sensitive PII.

After consideration of the comments received, we are adopting Rule 15 substantially as proposed.^[7] The rule codifies and clarifies the existing approach the Commission may take to address administrative issues that arise in connection with EDGAR submissions. By adopting Rule 15, we believe there will be increased transparency for filers, investors, and other users of EDGAR about the actions the Commission may take to promote the reliability and integrity of EDGAR submissions and improved efficiency in the Commission's administration of EDGAR.

Rule 15 will not change filers' obligations under the Federal securities laws to ensure the accuracy and completeness of information in their EDGAR submissions. Moreover, in the vast majority of administrative and substantive EDGAR submission issues, filers will continue to address an error by submitting a filer corrective disclosure and nothing in Rule 15 will prevent a filer from continuing to do so.^[8] We intend to continue to rely upon filer corrective disclosure to remedy most submission errors.

Additionally, the Commission is adopting new Rule 30-19 to delegate authority to the Director of the Commission's EDGAR Business Office to take actions pursuant to the following rules under Regulation S-T: Rule 15, 17 CFR 232.13(b) (“Rule 13(b)”) (relating to adjustment of filing dates), and 17 CFR 232.202 (“Rule 202”) (relating to the continuing hardship exemption).

II. Discussion of the Final Rules

A. Adoption of Rule 15

Rule 15 specifies that, in its administration of EDGAR, the Commission may take actions to promote the reliability and integrity of EDGAR submissions. Below we discuss the types of actions the Commission may take pursuant to Rule 15 to achieve those objectives.

1. Sensitive Personally Identifiable Information

We are adopting as proposed 17 CFR 232.15(a)(1) (“Rule 15(a)(1)”), which specifies that the Commission may, with regard to submissions on its public website: (i) Redact submissions containing Sensitive PII; (ii) remove submissions containing Sensitive PII; and/or (iii) prevent dissemination of submissions containing this information.^[9] Pursuant to the rule, the Commission may take further steps to ensure that Sensitive PII does not reside in EDGAR and communicate as necessary with filers to facilitate submissions in which Sensitive PII is redacted.^[10] Whether the Commission removes, redacts, or prevents dissemination of the Sensitive PII in the submission will be based on when the Commission first becomes aware of the Sensitive PII.

One commenter suggested that the Commission interpret the definition of Sensitive PII broadly to include additional categories of information that reflect modern expectations of privacy and physical and financial security risks.^[11] The commenter discussed the personal and financial harm that would result from the disclosure of such information. The commenter also noted the regulatory trends in favor of expanding the categories of information that are considered “sensitive” or “personal” and facilitating safeguards for personally identifiable information generally.^[12]

The Commission has sought to reduce the risk that Sensitive PII included in EDGAR submissions may result in financial or personal harm to individuals, and will continue to do so.^[13] We believe that the description of Sensitive PII in Rule 15(a)(1) as proposed is broad enough to encompass the examples provided by the commenter in relevant circumstances and to provide the Commission with the flexibility to reduce the risk of financial or personal harm to individuals.^[14] We believe it is appropriate to retain flexibility in the description as the categories of what constitutes Sensitive PII continue to evolve in light of new technology and expectations of privacy.

The same commenter also suggested that the Commission provide that filers may initiate a request for redaction or removal of information from a submission containing Sensitive PII, including from any submissions made prior to the effectiveness of the rule. The commenter stated that the inclusion of Sensitive PII in historical EDGAR submissions (whether inadvertent or intentional) cannot be retroactively corrected by making an additional filer corrective disclosure. Moreover, the commenter suggested that the rule require the Commission to redact or remove such information if the filer demonstrates that the submission contains Sensitive PII.^[15]

The Commission currently receives requests from filers for redaction or removal of information from submissions containing Sensitive PII, and we anticipate continuing to receive and evaluate such requests. We do not believe, however, that the Commission should be required to redact or remove Sensitive PII each time a filer requests it. We believe it is appropriate to retain the flexibility to consider the accuracy of EDGAR information publicly disseminated on the Commission's website, the nature of and circumstances surrounding the Sensitive PII at issue, and the Commission's administrative and technical capacity to address the request. If a filer demonstrates that a submission contains Sensitive PII, the Commission will initially work with the filer to facilitate submission of a version in which the Sensitive PII is redacted. The Commission will then exercise its discretion to determine whether the redacted submission would be adequate or whether additional steps need to be taken pursuant to 17 CFR 232.15(a)(8) (“Rule 15(a)(8)”) (as described below), including potentially removing information from the Commission's website.^[16] In any event, regardless of whether there is a request from a filer, the Commission may act to remove, redact, or prevent dissemination of Sensitive PII in a submission pursuant to Rule 15(a)(1) without first notifying the filer or the individual who could experience financial or personal harm if such information was released on EDGAR. The Commission's interest in avoiding a situation in which such information is used to create financial or personal harm may outweigh the need to give notice prior to Commission action, depending on the circumstances.^[17] We are therefore adopting this provision of the rule as proposed.

2. Cybersecurity Threats

We are adopting as proposed 17 CFR 232.15(a)(2), which specifies that the Commission may prevent the submission to EDGAR of any submission that poses a cybersecurity threat, including but not limited to, those containing any malware or virus, and communicate as necessary with the filer regarding the submission. As discussed in the Proposing Release, Commission action to address cybersecurity threats in EDGAR submissions will benefit all EDGAR users and promote the reliability and integrity of EDGAR submissions.^[18] We received no comments on this aspect of the proposal.

3. System and Commission Staff Errors

We are adopting as proposed 17 CFR 232.15(a)(3), which specifies that if the Commission determines that a submission has not been processed by EDGAR, has been processed incorrectly by EDGAR, or contains an error attributable to the Commission staff, the Commission may correct and/or prevent dissemination of the submission and communicate as necessary with the filer to facilitate filer corrective disclosure. In each of these circumstances, the Commission typically first attempts to correct the error without unduly burdening filers.^[19] When necessary, the Commission may work proactively with filers to accomplish filer corrective disclosure.^[20] We received no comments on this aspect of the proposal.

4. Incorrect EDGAR Identifiers

We are adopting as proposed 17 CFR 232.15(a)(4), which specifies that the Commission may remove and/or prevent public dissemination of a submission made under an incorrect EDGAR unique identifying number ^[21] and communicate as necessary with the filer and others to facilitate a filer corrective disclosure. Sometimes, filers make submissions that are not associated with the correct unique identifying number. These errors can create confusion for filers, investors, and other EDGAR users. The Commission may remove the erroneous submission when such errors cannot be resolved by filer corrective disclosure. We received no comments on this aspect of the proposal.

5. EDGAR Access Code Disputes

We are adopting as proposed 17 CFR 232.15(a)(5), which specifies that the Commission may prevent a filer's ability to make submissions if the Commission determines that a dispute exists as to which persons have the authority to make submissions on behalf of the filer, until the dispute is resolved by the disputing parties or by a court of competent jurisdiction. These disputes may arise, for example, when two or more parties each claim control of a filing entity and each demand access to the entity's EDGAR account. Resolution of such disputes often turns on matters of state corporation law or other factors outside the scope of the Federal securities laws. Under existing practice, the Commission staff has asked the disputing parties to either resolve the dispute themselves or have the matter adjudicated under the relevant state corporation law.^[22] The final rule affirms the Commission's ability to take action to ensure that only authorized persons make submissions on behalf of the filer. We received no comments on this aspect of the proposal.

6. Potential Manipulation

We are adopting a modification to proposed Rule 15(a)(6). The proposed rule specified that if the Commission has reason to believe that a submission or an attempted submission may be misleading or manipulative, the Commission may prevent acceptance or dissemination of the submission while evaluating the circumstances surrounding the submission.^[23] The proposed rule also specified that the Commission may allow acceptance or dissemination if its concerns are satisfactorily addressed.^[24]

After further consideration, we are slightly modifying proposed Rule 15(a)(6) to clarify that the Commission may continue to prevent acceptance or dissemination after it has evaluated the circumstances surrounding the submission if its concerns have not been satisfactorily addressed. If the Commission allows acceptance or dissemination of the submission, the initial or initially attempted filing date will be assigned to the submission, assuming the submission does not implicate other provisions of Rule 15. We received no comments on this aspect of the proposal.

7. Unauthorized Submissions

We are adopting as proposed 17 CFR 232.15(a)(7), which specifies that the Commission may prevent the use of EDGAR access codes if it has reason to believe that there has been an unauthorized submission or an attempt to make an unauthorized submission on EDGAR. Under existing practice, when questions arise as to whether a particular submission or attempted submission was authorized, the Commission seeks to better understand the circumstances surrounding the submission and evaluate what steps, if any, to take in response. Rule 15 specifies that, in such situations, the Commission may prevent any further submissions by the filer or otherwise remove the filer's access to EDGAR. If its concerns are satisfactorily addressed, the Commission will allow the use of EDGAR access codes and permit the submission to proceed, assuming the submission does not implicate other provisions of Rule 15. We received no comments on this aspect of the proposal.

8. Additional Remedial Steps

The Commission cannot anticipate every administrative submission issue that may arise in the future. Thus, we are adopting as proposed Rule 15(a)(8), which specifies the circumstances in which the Commission may take further appropriate steps to address a matter and communicate as necessary with the filer regarding a submission. Specifically, under the rule, the Commission may take such further steps if the Commission has reason to believe that, to promote the reliability and integrity of EDGAR submissions, it must address a submission issue that cannot be addressed solely by filer corrective disclosure or by the actions set forth in paragraphs (a)(1) through (7) of Rule 15. We received no comments on this aspect of the proposal.

9. Notice

Finally, we are adopting as proposed Rule 15(b), which provides that the Commission may act without advance notice to filers or any other person. Specifically, Rule 15(b) provides a method for the Commission to provide notice of its actions under the rule to a filer and any person the Commission determines is relevant to the matter (“relevant person”) as soon as practicable after those actions are taken. In response to commenters, we are clarifying that the term “relevant person” encompasses, in appropriate circumstances, a filer's vendor or supplier that made the related submission on behalf of the filer.^[25] In addition, relevant persons could include, but are not limited to, parties other than the filer that are involved in code disputes and parties other than the filer that are involved in submissions made in another entity's account. Rule 15(b) provides that the Commission will send written notice and a brief factual statement of the basis for the action by electronic mail to the email address on record in the filer's EDGAR account, and the email address of any relevant persons. The Commission may also send, if necessary, the notice and factual statement by registered, certified, or express mail to the physical address on record in the filer's EDGAR account and the physical address of any relevant persons. The notice provides the filer and relevant persons an opportunity to bring pertinent information to the Commission's attention and will help facilitate prompt resolution of submission issues.

Three commenters were generally supportive of the proposed rule but expressed concern that the Commission may redact information from a submission without first contacting the filer.^[26] The commenters requested that filers be notified prior to any Commission action in the proposed rule, if possible. The commenters recognized, however, that there may be situations where advance notification would not be feasible and, in such situations, they agreed with the Commission's proposal to notify the filer and relevant persons as soon as possible after the action is taken.

As discussed in the Proposing Release, the Commission typically communicates and works with filers to address submission issues, and the Commission anticipates that it generally will continue to work with filers in advance of taking action under the rule.^[27] At the same time, the final rule allows the Commission the necessary flexibility to take action promptly to avoid harm to investors and other EDGAR users who depend upon the accuracy of the information disseminated by EDGAR.^[28] For example, as discussed above, the Commission has sought to reduce the risk that Sensitive PII included in EDGAR submissions may result in financial or personal harm to individuals.^[29] Immediate Commission action may also be necessary to avoid potential threats to EDGAR, to prevent the dissemination of unauthorized or potentially false or misleading submissions, or to prevent the improper use of filers' EDGAR accounts.^[30] In addition, we are mindful that administrative actions under the proposed rule should not unduly hinder or delay the EDGAR submission process.^[31] We believe that Rule 15, including its notice provision, balances the need to reduce the risk of financial or personal harm to individuals from the disclosure of Sensitive PII, address potential threats, and other circumstances as described above with the need to timely disseminate EDGAR submissions. We are therefore adopting this provision of the rule as proposed.

B. Amendment to the Delegations of the Authority of the Commission

The Commission is adopting new Rule 30-19 of the Rules of Organization and Program Management to delegate authority to the Director of the EDGAR Business Office to take action under Rule 15 and two other rules in Regulation S-T: (i) Rule 13(b), to adjust the filing date of an electronic filing; and (ii) Rule 202, to set the terms of, and grant or deny as appropriate, continuing hardship exemptions from the electronic submission requirements.^[32] This delegated authority is designed to conserve Commission resources by permitting Commission staff to carry out the Commission's efficient administration of EDGAR. The Commission staff may nevertheless submit matters to the Commission for consideration, as it deems appropriate.

III. Economic Analysis

We have carefully considered the economic effects of final Rule 15 under Regulation S-T.^[33] The final rule increases transparency for filers, investors, and other users of EDGAR by specifying the actions the Commission may take to resolve certain administrative issues. Increased transparency about Commission actions will create benefits for both filers and users, because filers and users will know the types of actions they can expect the Commission to take to promote the reliability and integrity of EDGAR submissions. However, we anticipate these benefits will be limited as Rule 15 largely codifies actions that the Commission currently takes to promote the reliability and integrity of EDGAR submissions. For the same reason, we do not expect filers to incur additional costs. Further, we anticipate that the final rule will marginally improve efficiency, but will not have a significant effect on competition or capital formation. Because we generally cannot predict the need for or extent of corrective actions the final rule will address, we cannot quantify the anticipated economic effects of future corrective actions. Furthermore, the Commission received no comments responding to the Proposing Release's request for comments on the economic analysis and any relevant empirical data, estimation methodologies, or factual support. Therefore, the analysis that follows provides primarily a qualitative assessment of the likely economic effects.

A. Economic Baseline

The Commission's current processes and procedures for resolving the enumerated administrative issues listed in the final rule and discussed above serve as the baseline against which we assess the final rule. This section discusses, as it relates to this rulemaking, filers' current usage of EDGAR and the Commission's processes for administering EDGAR.

Because of the variety of administrative issues that may arise in connection with EDGAR submissions, the Commission has developed procedures for identifying and addressing the issues described above, although the Commission has not published those procedures. Where possible, the Commission currently communicates with relevant filers to facilitate filer corrective disclosure to address problematic submissions. While filer corrective disclosure addresses the majority of known EDGAR submission issues, there are circumstances in which working with a filer does not address problematic submissions, such as when the filer is uncooperative or the Commission cannot validate a filer's authorization to make submissions. Additionally, in limited cases, the Commission has responded promptly to submission issues without first consulting relevant filers in order to avoid harm to investors and other EDGAR users who depend upon the accuracy of the information disseminated by EDGAR. For these submissions, the Commission acts expediently to minimize the time the public and the Commission are exposed to such harm. While the Commission typically notifies these filers of its actions afterwards, some filers may not know specifically why the Commission took action or the nature of the issue with the submission.

B. Costs and Benefits

The final rule specifies the actions the Commission may take with respect to specific administrative issues that impact the Commission's ability to promote the reliability and integrity of EDGAR submissions. We believe the final rule will provide increased transparency about the Commission's administrative processes, which in turn may benefit filers and improve the Commission's efficiency in administering EDGAR. We believe, however, that Rule 15 would have limited economic effects because the rule largely codifies actions that the Commission may already take.

More transparency into how the Commission administers EDGAR may benefit filers in two ways. First, by specifying the types of issues for which the Commission may take action, the final rule could encourage filers to take additional actions to prevent these issues if they believe the benefits exceed the costs of preventative actions. Second, when the Commission must act to address a problematic submission prior to notifying a filer or when an issue cannot be addressed solely by a filer corrective disclosure, the final rule's formal notification requirement ensures that filers will receive timely notification of Commission action. To the extent that this requirement results in the Commission notifying filers of issues that they can correct, such as incorrect EDGAR identifiers, EDGAR access code disputes, or potentially misleading filings, filers may be able to benefit from rectifying issues sooner than they would have prior to the rule.^[34]

Because the final rule informs filers of possible actions the Commission may take and the Commission's process to promote the reliability and integrity of EDGAR submissions, the final rule will improve the efficiency of administering EDGAR. This benefit is likely to be limited because the Commission will continue to resolve most issues by contacting filers to facilitate filer corrective disclosure. Since filers may submit fewer filings with errors and the Commission and filers will be able to more quickly correct errors, the final rule could lead to more timely and accurate information in EDGAR, benefiting investors, research analysts, data aggregators, and other financial professionals.^[35] Moreover, since the Commission, as the administrator of EDGAR, already takes corrective actions to promote the reliability and integrity of EDGAR submissions, we do not expect filers to incur additional costs in connection with these improvements. The Commission generally cannot predict the need for or the extent of corrective actions, so we cannot quantify the informational efficiency benefits from future corrective actions.

To the extent that the final rule reduces the number of cybersecurity threats or reduces the administrative frictions in preventing cybersecurity threats, there may be benefits to the users of EDGAR.^[36] In particular, users, including investors, analysts, asset managers, and data collection companies, may incur fewer costs associated with cleaning or repairing systems and recovering data.^[37] Furthermore, individuals, investors, companies, and asset managers, among others, may benefit from the prevention of cybersecurity attacks that disrupt the dissemination of filings through EDGAR or obtain confidential or protected financial information on the Commission's or users' systems.

Lastly, because EDGAR submissions generally do not require Sensitive PII,^[38] and current Commission practices seek to identify and redact Sensitive PII, we do not anticipate that the final rule specifying that the Commission may redact, remove and/or not disseminate EDGAR submissions containing Sensitive PII will have a substantial economic effect.

IV. Administrative Law Matters

The Commission finds, in accordance with section 553(b)(3)(A) of the Administrative Procedure Act (“APA”), that these amendments relate solely to agency organization, procedure, or practice and do not constitute a substantive rule. They are therefore not subject to the provisions of the APA requiring notice of rulemaking, opportunity for public comment, and advance publication of the amendments prior to their effective date. These changes are effective on February 3, 2021. Additionally, the Regulatory Flexibility Act of 1980 ^[39] therefore does not apply. Nevertheless, we previously determined that it would be useful to publish the proposed amendments for notice and comment before adoption. The Commission has considered all comments received. Because these amendments relate to “agency organization, procedure or practice that does not substantially affect the rights or obligations of non-agency parties,” they are not subject to Small Business Regulatory Enforcement Fairness Act of 1996.^[40] These rules do not contain any collection of information requirements as defined by the Paperwork Reduction Act of 1995.^[41]

V. Statutory Basis and Text of Rule Amendments

The amendments to Regulation S-T—General Rules and Regulations for Electronic Filings are adopted pursuant to statutory authority in Sections 6, 7, 8, 10, and 19(a) of the Securities Act,^[42] Sections 3, 12, 13, 14, 15, 15B, 23, and 35A of the Exchange Act,^[43] Section 319 of the Trust Indenture Act of 1939,^[44] and Sections 8, 30, 31, and 38 of the Investment Company Act.^[45] The amendments to the Commission's Rules of Organization and Program Management are adopted pursuant to statutory authority granted to the Commission, including Section 19 of the Securities Act of 1933, 15 U.S.C. 77s; Sections 4A, 4B, and 23 of the Exchange Act, 15 U.S.C. 78d-1, 78d-2, and 78w; Section 38 of the Investment Company Act of 1940, 15 U.S.C. 80a-37; Section 211 of the Investment Advisers Act of 1940, 15 U.S.C. 80b-11; and Section 3 of the Sarbanes-Oxley Act of 2002, 15 U.S.C. 7202.

List of Subjects

17 CFR Part 200

• Administrative practice and procedure
• Authority delegations (Government agencies)
• Organization and functions (Government agencies)

17 CFR Part 232

• Incorporation by reference
• Reporting and recordkeeping requirements
• Securities

For the reasons discussed above, we are amending 17 CFR chapter II as follows:

PART 200—ORGANIZATION; CONDUCT AND ETHICS; AND INFORMATION AND REQUESTS

Subpart A-Organization and Program Management

1. The general authority citation for part 200, subpart A, continues to read as follows:

Authority: 15 U.S.C. 77c, 77 o, 77s, 77z-3, 77sss, 78d, 78d-1, 78d-2, 78 o-4, 78w, 78 ll (d), 78mm, 80a-37, 80b-11, 7202, and 7211 et seq., unless otherwise noted.

2. Add § 200.30-19 to read as follows:

PART 232—REGULATION S-T—GENERAL RULES AND REGULATIONS FOR ELECTRONIC FILINGS

3. The general authority citation for part 232 continues to read as follows:

Authority: 15 U.S.C. 77c, 77f, 77g, 77h, 77j, 77s(a), 77z-3, 77sss(a), 78c(b), 78 l, 78m, 78n, 78o(d), 78w(a), 78 ll, 80a-6(c), 80a-8, 80a-29, 80a-30, 80a-37, 7201 et seq.; and 18 U.S.C. 1350, unless otherwise noted.

4. Add § 232.15 to read as follows:

Footnotes