Upon Written Request, Copies Available From: Securities and Exchange Commission, Office of FOIA Services, 100 F Street NE, Washington, DC 20549-2736.
Regulation S-ID, SEC File No. 270-644, OMB Control No. 3235-0692.
Notice is hereby given that, pursuant to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.), the Securities and Exchange Commission (the “Commission”) has submitted to the Office of Management and Budget a request for extension of the previously approved collection of information discussed below.
Regulation S-ID (17 CFR 248), including the information collection requirements thereunder, is designed to better protect investors from the risks of identity theft. Under Regulation S-ID, SEC-regulated entities are required to develop and implement reasonable policies and procedures to identify, detect, and respond to relevant red flags (the “Identity Theft Red Flags Rules”) and, in the case of entities that issue credit or debit cards, to assess the validity of, and communicate with cardholders regarding, address changes. Section 248.201 of Regulation S-ID includes the following information collection requirements for each SEC-regulated entity that qualifies as a “financial institution” or “creditor” under Regulation S-ID and that offers or maintains covered accounts: (i) Creation and periodic updating of an identity theft prevention program (“Program”) that is approved by the board of directors, an appropriate committee thereof, or a designated senior management employee; (ii) periodic staff reporting to the board of directors on compliance with the Identity Theft Red Flags Rules and related guidelines; and (iii) training of staff to implement the Program. Section 248.202 of Regulation S-ID includes the following information collection requirements for each SEC-regulated entity that is a credit or debit card issuer: (i) Establishment of policies and procedures that assess the validity of a change of address notification if a request for an additional or replacement card on the account follows soon after the address change; and (ii) notification of a cardholder, before issuance of an additional or replacement card, at the previous address or through some other previously agreed-upon form of communication, or alternatively, assessment of the validity of the address change request through the entity's established policies and procedures.
SEC staff estimates of the hour burdens associated with section 248.201 under Regulation S-ID include the one-time burden of complying with this section for newly-formed SEC-regulated entities, as well as the ongoing costs of compliance for all SEC-regulated entities.
All newly-formed financial institutions and creditors would be required to conduct an initial assessment of covered accounts, which SEC staff estimates would entail a one-time burden of 2 hours. Staff estimates that this burden would result in a cost of $802 to each newly-formed financial institution or creditor.
To the extent a financial institution or creditor offers or maintains covered accounts, SEC staff estimates that the financial institution or creditor also would also incur a one-time burden of 25 hours to develop and obtain board approval of a Program, and a one-time burden of 4 hours to train the financial institution's or creditor's staff, for a total of 29 additional burden hours. Staff estimates that these burdens would result in additional costs of $14,266 for each financial institution or creditor that offers or maintains covered accounts.
Start Printed Page 16724
SEC staff estimates that approximately 613 SEC-regulated financial institutions and creditors are newly formed each year.
Each of these 613 entities will need to conduct an initial assessment of covered accounts, for a total of 1,226 hours at a total cost of $491,626.
Of these 613 entities, staff estimates that approximately 90% (or 552) maintain covered accounts.
Accordingly, staff estimates that the additional initial burden for SEC-regulated entities that are likely to qualify as financial institutions or creditors and maintain covered accounts is 16,008 hours at an additional cost of $7,874,832.
Thus, the total initial estimated burden for all newly-formed SEC-regulated entities is 17,234 hours at a total estimated cost of $8,366,458.
Each financial institution and creditor would be required to conduct periodic assessments to determine if the entity offers or maintains covered accounts, which SEC staff estimates would entail an annual burden of 1 hour per entity. Staff estimates that this burden would result in an annual cost of $401 to each financial institution or creditor.
To the extent a financial institution or creditor offers or maintains covered accounts, staff estimates that the financial institution or creditor also would incur an annual burden of 2.5 hours to prepare and present an annual report to the board, and an annual burden of 7 hours to periodically review and update the Program (including review and preservation of contracts with service providers, as well as review and preservation of any documentation received from service providers). Staff estimates that these burdens would result in additional annual costs of $7,874 for each financial institution or creditor that offers or maintains covered accounts.
SEC staff estimates that there are 9,922 SEC-regulated entities that are either financial institutions or creditors, and that all of these will be required to periodically review their accounts to determine if they offer or maintain covered accounts, for a total of 9,922 hours for these entities at a total cost of $3,978,722.
Of these 9,922 entities, staff estimates that approximately 90 percent, or 8,930, maintain covered accounts, and thus will need the additional burdens related to complying with the rules.
Accordingly, staff estimates that the additional annual burden for SEC-regulated entities that qualify as financial institutions or creditors and maintain covered accounts is 84,835 hours at an additional cost of $70,314,820.
Thus, the total estimated ongoing annual burden for all SEC-regulated entities is 94,757 hours at a total estimated annual cost of $74,293,542.
The collections of information required by section 248.202 under Regulation S-ID will apply only to SEC-regulated entities that issue credit or debit cards. SEC staff understands that SEC-regulated entities generally do not issue credit or debit cards, but instead partner with other entities, such as banks, that issue cards on their behalf. These other entities, which are not regulated by the SEC, are already subject to substantially similar change of address obligations pursuant to other federal regulators' identity theft red flags rules. Therefore, staff does not expect that any SEC-regulated entities will be subject to the information collection requirements of section 248.202, and accordingly, staff estimates that there is no hour burden related to section 248.202 for SEC-regulated entities.
In total, SEC staff estimates that the aggregate annual information collection burden of Regulation S-ID is 111,991 hours (17,234 hours + 94,757 hours). This estimate of burden hours is made solely for the purposes of the Paperwork Reduction Act and is not derived from a quantitative, comprehensive, or even representative survey or study of the burdens associated with Commission rules and forms. Compliance with Start Printed Page 16725Regulation S-ID, including compliance with the information collection requirements thereunder, is mandatory for each SEC-regulated entity that qualifies as a “financial institution” or “creditor” under Regulation S-ID (as discussed above, certain collections of information under Regulation S-ID are mandatory only for financial institutions or creditors that offer or maintain covered accounts). Responses will not be kept confidential. An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid control number.
The public may view the background documentation for this information collection at the following website, www.reginfo.gov. Comments should be directed to: (i) Desk Officer for the Securities and Exchange Commission, Office of Information and Regulatory Affairs, Office of Management and Budget, Room 10102, New Executive Office Building, Washington, DC 20503, or by sending an email to: Lindsay.M.Abate@omb.eop.gov; and (ii) Charles Riddle, Acting Director/Chief Information Officer, Securities and Exchange Commission, c/o Candace Kenner, 100 F Street NE, Washington, DC 20549 or send an email to: PRA_Mailbox@sec.gov. Comments must be submitted to OMB within 30 days of this notice.
Dated: April 17, 2019.
Jill M. Peterson,
[FR Doc. 2019-08038 Filed 4-19-19; 8:45 am]
BILLING CODE 8011-01-P