Consolidated Audit Trail (CAT)

CAT tracks each order through its entire lifecycle from origination to execution or cancellation. This includes:

• Order Origination: The initial receipt of an order by a broker-dealer
• Routing: The path an order takes between venues
• Modification: Any changes to price, size, or terms
• Execution: The final trade, including partial fills
• Cancellation: When and why an order was removed

This end-to-end visibility eliminates the blind spots that existed under the previous fragmented audit trail system, where regulators had to manually reconstruct order flows across multiple disconnected sources.

A defining feature of CAT is the requirement to link every order and trade to a unique Customer-ID (CAT-CID) . This mandates:

• Legal Entity Identifiers (LEIs) for institutional accounts
• Social Security Numbers or Individual Taxpayer Identification Numbers for retail accounts (hashed for privacy)
• Allocation Reports that map executed trades back to specific client accounts

This linkage allows regulators to identify patterns of spoofing, layering, and wash trading at the individual trader level, rather than just at the firm level, dramatically increasing accountability.

CAT mandates nanosecond-level timestamp precision synchronized to coordinated universal time (UTC) with a maximum divergence of 50 milliseconds from the atomic clock standard. Key requirements:

• Order events: Timestamped to the millisecond
• Exchange events: Timestamped to the nanosecond
• Clock drift monitoring: Continuous reporting of any synchronization deviations

This granularity is essential for reconstructing the exact sequence of events in high-frequency trading environments where latency arbitrage and quote stuffing occur at microsecond speeds.

Industry members submit data to the CAT using a standardized Financial Information eXchange (FIX) protocol format with specific extensions. The submission framework includes:

• Real-time reporting: Data must be submitted by 8:00 AM ET on T+1
• Error correction windows: A T+3 deadline for correcting any inaccuracies
• Encryption standards: AES-256 encryption for data in transit and at rest
• Data validation: Automated checks for logical consistency, such as ensuring an execution cannot occur without a preceding order

Non-compliance triggers escalating fines, with the SEC actively enforcing penalties for systematic reporting failures.

Prior to CAT, regulators operated with siloed data from individual exchanges and FINRA's OATS system, which only covered NASDAQ and OTC securities. CAT unifies data across:

• All 16 national securities exchanges (NYSE, NASDAQ, Cboe, etc.)
• Alternative Trading Systems (ATS) and dark pools
• Over-the-counter (OTC) equity and options markets

This consolidation enables the detection of cross-market manipulation schemes, such as simultaneously placing spoof orders on one exchange to move the price of a correlated instrument on another venue—a pattern previously invisible to regulators.

Given the sensitivity of personally identifiable information (PII) within CAT, the system employs a layered security model:

• Tokenization: PII is replaced with surrogate CAT-CIDs before analysis
• Role-based access controls: Only authorized SEC analysts with specific investigative purposes can access unmasked data
• Audit logging: Every query against the database is itself logged and auditable
• Secure data lake: The repository is built on a cloud-native architecture with encryption at rest and strict data retention policies

The SEC has established a Chief Data Officer role specifically to oversee CAT data governance and prevent misuse.