Privacy Concerns Over SEC’s Audit Trail

The Blockchain Association and the DeFi Education Fund highlight privacy issues with the U.S. SEC’s new database affecting millions and potentially involving digital assets.

In 2012, the SEC adopted Rule 613 in response to the financial crisis, mandating national securities exchanges and the Financial Industry Regulatory Authority (FINRA) to create a consolidated audit trail (CAT). This system aims to provide regulators with a comprehensive view of securities markets, as stated by former SEC Chair Jay Clayton in 2017.

As reported by the Securities Industry and Financial Markets Association, the Consolidated Audit Trail became fully operational at the end of May 2024.

While the 351-page rule does not specifically mention digital assets, both crypto organizations suggest the SEC considers many crypto participants as exchanges or brokers required to report to the CAT.

According to the groups’ amicus brief filed on Thursday, the CAT could transform blockchains into a vast, deanonymized government database accessible without a warrant.

They argue that due to blockchain technology’s nature, accessing one identity record could reveal unrelated financial transactions of that user, open to federal oversight and third-party access.

This amicus brief was submitted in April as part of a class-action lawsuit against the SEC and its chair, Gary Gensler. The lawsuit was initiated by the National Center for Public Policy Research along with two Texas residents, Erik Davidson and John Restivo. The American Securities Association also submitted an amicus brief to the U.S. District Court for the Western District of Texas.

The SEC has pursued numerous cases against crypto firms, alleging some like Coinbase and Kraken operate as unregistered exchanges and brokers.

Amanda Tuminelli, Chief Legal Officer of the DeFi Education Fund, expressed concerns in a statement regarding the SEC’s stance on digital assets. She emphasized that the SEC may compel digital asset trading platforms to submit detailed transaction reports to the CAT, which includes personally identifiable information linked to transactions.

Tuminelli highlighted severe privacy concerns, stating that the CAT could become a repository for user data tied to specific wallet addresses.

Additionally, both organizations warned of potential vulnerabilities to hacks, raising alarms about the risk that data submitted to the CAT database might be exposed through accidents or malicious activities, particularly given the rise in data breaches despite increased cybersecurity spending.

The SEC declined to comment on this issue.