SEC Proposes New EDGAR Rules

On September 13, 2023, the SEC proposed rule and form amendments to the EDGAR system dubbing the updates as EDGAR Next.  The rule changes are meant to enhance security and improve access to the EDGAR system.  My view is that will accomplish the former and not the latter. The changes would require EDGAR filers to authorize identified individuals who would be responsible for managing the filers’ EDGAR accounts. Individuals acting on behalf of filers on EDGAR would need individual account credentials to access those EDGAR accounts and make filings. As part of the proposed rule changes, the SEC is making a beta software public for testing and feedback which software would eventually be used by filers if the proposed new rules are implemented.

The proposed rules would amend Rules 10 and 11 of Regulation S-T and amend Form ID.  Only the identified authorized individuals would be able to access a filer’s EDGAR account.  The authorized individual(s) need not be an employee of the filer, but the filer would need to provide a notarized power of attorney to appoint someone.

Through the new software, a filer would have a dashboard for their EDGAR account.  On the dashboard, account administrators would take actions on behalf of the filer to add and remove authorized users, account administrators, and technical administrators; and annually confirm the accuracy of the filer’s information on the dashboard.  Under the new rules, each EDGAR filer would be required to maintain current accurate information about the filer and its authorized administrator.

Also, on the dashboard, account administrators could delegate authority to file on behalf of the filer to any other EDGAR account, such as a filing agent, making that account a delegated entity of the filer, and could remove a delegated entity’s authority to file on the filer’s behalf.  The filing agent, like any other EDGAR filer, would also need to have appointed individual authorized administrators.  The filing agent would process filings through its own dashboard and not the main filer’s dashboard.

If the rules are implemented the SEC will offer filers optional API’s to facilitate machine-to-machine communication with EDGAR, including submission of filings and retrieval of related information.  A company using the API will need to authorize two individuals to be technical administrators to manage the API.

I suspect this will increase the costs associated with EDGAR filings as filers will likely still use EDGAR filing agents who in turn will have to maintain more complex controls and procedures, especially over individual staff, in managing multiple accounts.

Background

Currently a filer gains access to the EDGAR system by completing and submitting an online fillable Form ID.  The Form ID requires the applicant’s name and contact information, the applicant’s point of contact for EDGAR information, inquiries, and access codes (“EDGAR POC”), its contact for SEC account information and billing invoices (“billing contact”) and a passphrase.  Upon approval the SEC will issue a a central index key number (“CIK”) unique to that filer, access codes (called central index key confirmation code (“CCC”)), and a password modification authorization code (“PMAC”). Any person with the access codes would have the ability to make filings on EDGAR for that EDGAR filer.

Although a filer is required to maintain their codes in a secure location, in practice many do not.  Moreover, many companies provide multiple individuals and/or filing agents with their codes with no real traceability.

In 2021, the SEC issued a Request for Comment on Potential Technical Changes to EDGAR Filer Access and Filer Account Management Processes (“2021 Request for Comment”).  The 2021 Request for Comment sought comments on many items including the addition of individual account credentials with multi-factor authentication, a dashboard on EDGAR where a filer would manage its EDGAR account, administrators to manage the filer’s account and annually confirm the filer’s information, and the time period required to implement the potential technical changes, all of which are part of the new proposed rule changes.

Proposed Rule Changes

The SEC is proposing amendments to Rule 10 under Regulation S–T concerning EDGAR filer access and account management and related matters; Form ID, the application for EDGAR access; and Rule 11 under Regulation S–T, containing the definitions of terms in Regulation S–T.  Proposed amendments to Rule 10 and Form ID would set forth requirements for each EDGAR filer to authorize and maintain individual account administrators to manage the filer’s EDGAR account on a dashboard on EDGAR, and to authorize account administrators, users, and technical administrators only if those individuals obtained individual account credentials.

Each filer, through its account administrators, would be required to confirm annually that all account administrators, users, technical administrators, and delegated entities reflected on the filer’s dashboard are authorized by the filer to act on its behalf, and that all information about the filer on the dashboard is accurate; maintain accurate and current information on EDGAR concerning the filer’s account; and securely maintain information relevant to the ability to access the filer’s EDGAR account.

On the dashboard, account administrators could add and remove authorized users, account administrators, and technical administrators; delegate and remove delegated authority to file to other EDGAR accounts; and annually confirm the accuracy of all information on the dashboard.  The SEC would also provide an optional API for machine-to-machine communication with EDGAR, including to submit filings.  To use APIs, filers would be required to authorize two technical administrators and present certain tokens to EDGAR (the SEC giving an example of a “utility token!”).

An account administrator would be able to delegate authority to make filings on behalf of an EDGAR filer.  Delegated entities would be required to comply with the same requirements applicable to all filers.  Delegated entities generally will include EDGAR filing agents, issuers and others making submission on behalf of individuals pursuant to Section 16 of the Exchange Act and parent companies handling the filings for subsidiaries.

If a delegated entity accepted a delegation from a filer, the delegated administrators could authorize specific users at the delegated entity to become delegated users with respect to that filer.  If delegated administrators wanted all of their users to become delegated users with respect to a filer, the delegated administrators could check a box to automatically designate all of the users at the delegated entity as delegated users for the filer.

The SEC anticipates a tiered roll out of the new system if adopted.  Users would need to begin registering as soon as one month after adoption of the new system with a compliance period beginning six months following the opening of enrollment.