SEC Securities Lending Rule: Increased Transparency and the Risk of Information Leakage

On Oct. 13, 2023, the SEC adopted new Rule 10c-1a under the Securities Exchange Act of 1934, as amended (“Exchange Act”), which the Federal Register officially published on Nov. 3, 2023.[1] The Adopting Release states that Exchange Act Rule 10c-1a (“Rule 10c-1a”) is designed to “increase the transparency and efficiency of the securities lending market” by requiring the reporting, and subsequent public dissemination, of information on “covered securities loans.”[2] Rule 10c-1a represents a significant expansion of broker-dealer and securities lender intermediary regulatory reporting obligations and may have significant unintended consequences on private fund securities lending programs. Additionally, Rule 10c-1a, in conjunction with the Institutional Investment Manager Short Reporting Rule (Rule 13f-2),[3] dramatically increases the risk that competitors may be able to reverse engineer and anticipate a market participant’s trading strategy. While “covered persons” will not need to begin reporting loan information under Rule 10c-1a until early 2026 (at the earliest), firms that anticipate having substantial reporting obligations under the rule may want to begin planning in the near term.

As adopted, Rule 10c-1a represents an entirely new regulatory reporting regime, effectively requiring that all securities loans be reported to FINRA[4] on the day the loan is entered into or modified. Information about such loans, including aggregated loan activity by security, will be made publicly available by no later than the morning of the following business day.

We anticipate that the majority of reporting under Rule 10c-1a will be conducted by broker-dealers and securities lending intermediaries. Due to the same-day reporting requirement and inconsistency between how the rule is structured and how securities lending markets currently operate, these entities will likely need to make significant technological and compliance investments to comply with Rule 10c-1a. Private funds and other persons who operate securities lending programs or agree to a covered securities loan on behalf of a lender (e.g., private fund advisers) may discover that their current lending program does not comport with the allocation of reporting responsibility provisions in Rule 10c-1a and may become primarily liable for reporting certain securities lending transactions.

Regardless of whether a market participant engages in securities lending activity, competitors may be able to reverse engineer their trading strategies and expose them to risks of coordinated short squeezes and front running attempts. To mitigate these risks, private fund advisers and other market participants may need to re-examine their securities lending and borrowing relationships and should actively engage with FINRA in connection with implementing the data collection and public dissemination requirements of Rule 10c-1a. Schulte will issue a subsequent Alert once FINRA’s rule proposal is announced.

Rule 10c-1a will go into effect on Jan. 2, 2024, although, as noted above, “covered persons” will not need to begin reporting information to FINRA until early 2026 (at the earliest).

Who is Required to Report

Rule 10c-1a requires “covered persons” to report any “covered securities loan” to FINRA by no later than the end of the day on which the covered securities loan was effected. A covered person is defined in Rule 10c-1a(j)(1) as: “(i) [a]ny person that agrees to a covered securities loan on behalf of a lender (“intermediary”) other than a clearing agency when providing [certain defined services]; (ii) [a]ny person that agrees to a covered securities loan as a lender when an intermediary is not used unless [clause (iii)] applies; or (iii) [a] broker or dealer when borrowing fully paid or excess margin securities pursuant to Rule 15c3-3(b)(3) of the Exchange Act.”

Importantly, where an “intermediary” agrees to a covered securities loan,[5] or a broker-dealer borrows fully paid or excess margin securities from a lender, the underlying lender has no reporting obligation under Rule 10c-1a (although, if structured as a back-to-back loan, the underlying lender or other person may have a reporting obligation on the separate loan). The underlying lender does not, for instance, have to ensure that the intermediary or broker-dealer reports the covered securities loan or otherwise complies with Rule 10c-1a (the SEC recognized that, where an intermediary arranges a loan or a broker-dealer borrows fully paid or excess margin securities, the underlying lender may not realize its securities have been loaned).

Notwithstanding the foregoing, Rule 10c-1a does not provide a de minimis exemption from the definition of covered person. Accordingly, a person who arranges for a loan of a reportable security (whether as lender or intermediary) must, under Rule 10c-1a, report all required information to FINRA or arrange for a reporting agent to report on such person’s behalf, even on isolated transactions. As such, private funds and their advisers may wish to engage a “reporting agent” to ensure they have the capability to comply with Rule 10c-1a and, as further discussed below, relieve themselves of certain obligations under the rule.

What Type of Securities Loans are In-Scope

Rule 10c-1a requires the reporting of all “covered securities loans” agreed to by any covered person. Subject to certain exceptions,[6] a covered securities loan is defined as “[a] transaction in which any person on behalf of itself or one or more other persons, lends a reportable security to another person.” (Emphasis added). Accordingly, key to determining what types of securities lending transactions are in-scope of the rule are the definitions of “reportable security” and “lends.”

Reportable Security

“Reportable security” is defined in Rule 10c-1a(j)(3) as any security that is required to be reported under (i) the CAT NMS Plan (“CAT”), (ii) FINRA’S Trade Reporting and Compliance Engine (“TRACE”), or (iii) the MSRB’s Real-Time Transaction Reporting System (“RTRS”).[7] The Adopting Release expressly notes that the term incorporates any exclusions from those reporting regimes (e.g., securities that fall outside of the existing reporting regimes would not be reportable securities under Rule 10c-1a). This may ease the compliance burden for broker-dealers that separately report securities transactions to these systems, although covered persons who are not broker-dealers will likely need to develop processes and procedures to track the universe of reportable securities (particularly covered persons that may not otherwise be familiar with those reporting systems and related rules).

Lends

While a threshold concept for purposes of Rule 10c-1a, the SEC elected not to define the term “loan” or what it means to “lend” a reportable security to another person. Rather, the SEC noted that certain factors flagged by commenters were not necessarily dispositive in determining whether a transaction represented a loan for purposes of Rule 10c-1a, including (i) whether the transaction was recorded as a loan, (ii) the fee arrangement associated with the transaction (including the absence of any fee or rebate),[8] (iii) whether collateral was provided,[9] (iv) whether the parties were affiliates,[10] (v) whether there was a loss of voting right,[11] and (vi) whether the transaction was for a “permitted purpose” under Regulation T.[12]

Notwithstanding the above, the Adopting Release states that repurchase transactions (“repos”) are not subject to the reporting requirements of Rule 10c-1a,[13] although the Adopting Release seems to indicate that functionality equivalent transactions may be within scope.[14]

Given the lack of clarity under Rule 10c-1a and the Adopting Release, Private Fund Advisers and other market participants may want to review whether certain funding transactions are considered “loans” by their counterparties and adopt policies and procedures to address potential questions from regulators.

Covered Person Reporting Requirements

Timing

Rule 10c-1a requires that covered persons report all required data elements to FINRA by the end of the day on any day on which a covered securities loan was agreed to. Certain modifications to covered securities loans[15] must also be reported to FINRA by the end of the day on any day on which the modification occurred. Notably, Rule 10c-1a uses the term “day” rather than “business day” when discussing the reporting requirements applicable to covered persons and reporting agents under sections (c) (initial reporting) and (d) (reporting of loan modifications) of the rule, which indicates that loans entered into on non-business days may still be subject to end of reporting, notwithstanding that the rule only requires that FINRA publish information by “not later than the morning of the business day” following such covered securities loan (or, where applicable, not later than the “twentieth business day after the covered securities loan is effected…”). While this may be addressed in the FINRA rulemaking, it may represent an oversight by the SEC, as Rule 10c-1a(g)(1)(i) notes that FINRA’s reporting obligations apply to “each covered securities loan effected on the previous business day….”

Additionally, while only “finalized loan terms” must be reported,[16] intra-day modifications to loans must be reported even if such modifications result in multiple reports for the same covered securities loan on a given day.

Rule 10c-1 does not define “end of the business day” or what holidays should not be considered a “business day.” Rather, this and other terms remain subject to FINRA rulemaking.

Data Elements

For each finalized covered securities loan or modification, a covered person must report public data elements, a delayed reporting data element and confidential data elements to FINRA on the day of the loan.

Public Data Elements

Each of the below elements becomes publicly available on a loan-by-loan basis the business day after the covered securities loan has been agreed to:

• The legal name of the security issuer, and the Legal Entity Identifier (“LEI”) of the issuer, if the issuer has a non-lapsed LEI;
• The ticker symbol, International Securities Identification Number (“ISIN”), Committee on Uniform Securities Identification Procedures (“CUSIP”), or Financial Instrument Global Identifier (“FIGI”) of the security, or other security identifier;
• The date the covered securities loan was effected;
• The time the covered securities loan was effected;
• The name of the platform or venue where the covered securities loan was effected;
• The type of collateral used to secure the covered securities loan;
• For a covered securities loan collateralized by cash, the rebate rate or any other fee or charges;[17]
• For a covered securities loan not collateralized by cash, the securities lending fee or rate, or any other fee or charges;
• The percentage of collateral to value of reportable securities loaned required to secure such covered securities loan;
• The termination date of the covered securities loan; and
• Whether the borrower is a broker or dealer, a customer (if the person lending securities is a broker or dealer), a clearing agency, a bank, a custodian or other person.

Delayed Reporting Data Element (Loan Size)

Covered persons must also report the “amount, such as size, volume, or both, of the reportable securities loaned” to FINRA. While this information will be reported to FINRA along with the public data elements, FINRA will delay the public dissemination and enrichment of loan-by-loan data with respect to the size of the loan[18] for a period of 20 business days.

Confidential Data Elements

While not intended to become public, covered persons must also report the following data elements to FINRA on the day the covered securities loan has been agreed to.

• If known, the legal name of each party to the covered securities loan, including the person’s CRD or IARD No., MPID and LEI, and whether such person is the lender, the borrower or the intermediary;
• If the person lending securities is a broker or dealer and the borrower is its customer, whether the security is loaned from a broker’s or dealer’s securities inventory to a customer of such broker or dealer; and
• If known, whether the covered securities loan is being used to close out a fail to deliver (whether pursuant to Regulation SHO or otherwise).

While the confidential data elements are not intended to ever become publicly available, FINRA may share such data with the SEC and such “other persons as the Commission may designate by order upon a demonstrated regulatory need.”

Loan Modifications

A supplemental report must be made to FINRA on the day that any modification is made to a loan that impacts any previously reported “data element” (that is, the public data elements and Delayed Reporting Data Element discussed above). Modification reports must note (i) the date and time of the modification, (ii) the data element being modified, including the “specific modification” thereof (e.g., the amount of the security loaned increased by 200 shares, rather than a general description of the modification), and (iii) the unique identifier assigned to the original covered securities loan by FINRA (discussed below).

Similar to the data elements on the initial report, the modification of any Public Data Element will be made public by FINRA on a loan-by-loan basis on the day after the modification and a modification to the Delayed Reporting Data Element (Loan Size) will be made publicly available by FINRA 20 business days later.

Aggregate Reporting by FINRA

In addition to the publication of loan-by-loan information on a T+1 and T+20 basis by FINRA, FINRA will also make publicly available the aggregate transaction activity and distribution of loan rates for each reportable security that is derived from the reports submitted by covered persons. Such aggregated data will be made publicly available by FINRA not later than the morning of the business day after the covered securities loan is effected (e.g., on a “T+1” basis). For clarity, this means that while the size of an individual covered securities loan will not be made publicly available until the twentieth business day after the covered securities loan is effected, aggregate loan activity on a security-by-security basis will be available on T+1.

Key Considerations

Cross-Border Implications

In the Adopting Release, the SEC discussed the intended cross-border application of Rule 10c-1a. As may be expected, the SEC views Rule 10c-1a’s reach as fairly extensive such that the rule’s reporting requirements may be triggered “whenever a covered person effects, accepts, or facilitates (in whole or in part) in the US a lending or borrowing transaction.”[19]

Notably, the SEC stated that loans involving non-US persons are not excluded from Rule 10c-1a’s scope, nor are loan transactions that are subject to a separate reporting regime (e.g., loans by EU or UK lenders that are subject to reporting under the EU or UK SFTR).

Information Leakage

While the Adopting Release attempted to allay market participants’ concerns by noting that short sales are not required to be reported under Rule 10c-1a, loans used in connection with short sales are reportable. As the majority of short sales are settled through the delivery of borrowed shares, this reporting regime has the potential to leak sensitive information relating to market participant’s short positions and trading strategies. Given advancements in the use of predictive data analytics, artificial intelligence, machine learning and similar technologies, private fund advisers and other market participants who wish to keep their securities positions and trading strategies confidential and avoid coordinated short-squeeze attacks and front-running attempts may need to adapt their trading strategies to these new disclosure requirements.

Operational Burdens

For broker-dealers and other firms that anticipate having reporting obligations under Rule 10c-1a (whether as covered persons or by providing reporting agent services, further discussed herein), the rule represents a new comprehensive regulatory reporting regime with which they will have to comply. While firms will not have to begin reporting loan information to FINRA until early 2026 (at the earliest), compliance with the reporting requirements may require complicated system buildouts, as well as coordination among compliance, legal, and business groups. Further, specifics of the reporting requirements remain subject to FINRA rulemaking, which may not be finalized until early 2025. Accordingly, broker-dealers and other covered persons may find themselves pressed for time to ensure compliance by the initial reporting date.

As noted above, as a result of the SEC’s failure to include a de minimis exemption or similar carve-out from the requirement of Rule 10c-1a, covered persons without the institutional sophistication or resources necessary to build complex reporting systems may nevertheless find themselves subject to Rule 10c-1a’s reporting requirements. We expect most such entities will elect to utilize a “reporting agent” to satisfy their reporting obligations under Rule 10c-1a. While Rule 10c-1a relieves a covered person from liability if they utilize a reporting agent, the relief is only available if (i) the covered person has entered into a written agreement with the reporting agent and (ii) the covered person actually provides such reporting agent with timely access to the necessary Rule 10c-1a information. Further, simply providing a reporting agent will timely access to the data elements on a covered securities loan is not necessarily sufficient to ensure the covered person has complied with its obligations under Rule 10c-1a; rather, covered persons will still need to ensure they have processes in place to identify covered securities loan for which they have a reporting obligation.

FINRA Rulemaking

As noted above, specifics around the manner in which data elements will be reported and disseminated by FINRA remain subject to FINRA rulemaking.[20] Accordingly, covered persons and other interested parties should review FINRA’s rulemaking around the requirements, which must be proposed for comment no later than four months after the effective date of Rule 10c-1a.[21]

Of particular interest is the process by which FINRA will collect and disseminate the unique identifiers associated with each covered securities loan. As required by Rule 10c-1a, FINRA is required to assign a unique identifier to each covered securities loan and covered persons and reporting agents must utilize that same unique identifier whenever the loan is modified. Commenters requested that the Commission allow flexibility in the implementation of this requirement such that market participants could create their own unique identifiers that would be used by FINRA as the publicly reportable unique loan identifier.[22] While the SEC acknowledged that it was indifferent to how unique loan identifiers would be generated, it left the decision to FINRA. Given the potential for information leakage, participants concerned about the use of non-randomized identifiers may wish to flag to such concerns to FINRA.

Compliance Timeline

Rule 10c-1a will go into effect on Jan. 2, 2024. FINRA must propose rules pursuant to final Rule 10c-1a(f) within four months of the rule’s effective date (presumably, April 2024). Final FINRA rules must be adopted within 12 months of Rule 10c-1a’s effective date (in or prior to January 2025).

Regardless of the date the final FINRA rules are adopted, covered persons will not have to report Rule 10c-1a information to FINRA until the first business day 24 months after the effective date of final Rule 10c-1a (January 2026).

Finally, FINRA will not publicly report Rule 10c-1a information until 90 calendar days after covered persons are required to start reporting Rule 10c-1a information to FINRA.

Authored by Marc E. Elovitz, Julian Rainero, William J. Barbera and Derek N. Lacarrubba.

If you have any questions concerning this Alert, please contact your attorney at Schulte Roth & Zabel or one of the authors.

---

[1] Reporting of Securities Loans, 88 Fed. Reg. 75644 (Nov. 3, 2023), available at https://www.govinfo.gov/content/pkg/FR-2023-11-03/pdf/2023-23052.pdf.

[2] Exchange Act Release No. 34-98737 (Oct. 13, 2023), at 1, 16, available at https://www.sec.gov/files/rules/final/2023/34-98737.pdf (“Adopting Release”).

[3] See Short Position and Short Activity Reporting by Institutional Investment Managers, 88 Fed. Reg. 75100 (Nov. 1, 2023), available at https://www.govinfo.gov/content/pkg/FR-2023-11-01/pdf/2023-23050.pdf.

[4] In its capacity as the sole existing national securities association.

[5] “A beneficial owner cannot assign the reporting obligation when an intermediary is used, as the intermediary has the reporting obligation under final Rule 10c-1a(j)(1)(i).” Adopting Release at 27 n.115.

[6] Rule 10c-1a(j)(2)(ii) and (iii) excludes “a position at a clearing agency that results from central counterparty services pursuant to Rule 17Ad-22(a)(2) of the Exchange Act or central securities depository services pursuant to Rule 17Ad-22(a)(3) of the Exchange Act” and “the use of margin securities, as defined in § 240.15c3-3(a)(4) … by a broker or dealer” (except lending margin securities to another person) from the definition of a covered securities loan. See Adopting Release at 79-85.

[7] Including any successor system(s).

[8] Adopting Release at 71-72.

[9] Adopting Release at 70-71.

[10] Adopting Release at 67.

[11] Adopting Release at 78.

[12] Adopting Release at 81.

[13] “Accordingly, at this time, it is not necessary to include repos within the scope of the final rule’s information reporting requirements…” Adopting Release at 74.

[14] Adopting Release at 84-85.

[15] Generally, modifications to any of the public data elements, including the delayed reporting data element.

[16] Adopting Release at 134-35.

[17] While Rule 10c-1a requires that covered persons report the loan fee or rebate rate for a covered securities loan, the rule does not dictate how such information should be reported. For instance, where a loan fee or rebate rate is structured as a spread to an identified benchmark, whether covered persons will be required to only report the spread and relevant benchmark, or if covered persons will instead be required to separately report the total fee (which would result in significantly more frequent modification submissions), remains subject to FINRA rulemaking.

[18] While Rule 10c-1 requires that a covered person report the size of a covered securities loan, how that data is reported for different types of securities (e.g., par value of debt securities) remains subject to FINRA rulemaking.

[19] Adopting Release at 165.

[20] “Because an RNSA would be required to implement rules regarding the format and manner to administer the collection of information, proposed Rule 10c-1 lists the data elements that persons would be required to provide to an RNSA, but does not specify granular instructions for data elements or the formatting required for submission of the information to an RNSA.” Adopting Release at 87.

[21] FINRA rulemaking will be subject to notice, public comment, and Commission review pursuant to section 19(b) and Rule 19b-4 prior to implementation.

[22] E.g., by including the identifier when reporting the covered securities loan to FINRA, and effectively having FINRA report back the same identifier to the covered person or reporting agent.

---

This communication is issued by Schulte Roth & Zabel LLP for informational purposes only and does not constitute legal advice or establish an attorney-client relationship. In some jurisdictions, this publication may be considered attorney advertising. © 2023 Schulte Roth & Zabel LLP. All rights reserved. SCHULTE ROTH & ZABEL is the registered trademark of Schulte Roth & Zabel LLP.