SEC building

Registered investment companies have more time to comply with the filing requirement of the N-Port form through the EDGAR system. Filing of N-PORTs through EDGAR will begin in April 2019 for larger-fund groups and in April 2020 for smaller-fund groups, according to Advise Technologies.

The decision comes in the wake of the Securities and Exchange Commission (SEC) recently announcing that EDGAR experienced a breach in 2016. N-Port, part of the SEC reporting modernization reforms, requires investment companies registered in the US to report calculations assessing risk to changing market conditions.

“EDGAR is not secure enough to receive the information,” Jeanette Turner, managing director and chief regulatory officer at Advise Technologies, told Legaltech News about why the SEC made the decision this month. “The SEC is essentially asking for nine additional months before N-PORT information is submitted via EDGAR. The N-PORT requirement itself is not delayed. Firms must still complete the form. But, instead of submitting the filing via EDGAR, they will hold it in their own records, available to the SEC for exam.”

When making the announcement, SEC Chair Jay Clayton said the action is a “prudent step as we continue our work to uplift EDGAR and other systems and assess our data needs, including how and when we collect market-sensitive data.” He also noted that “larger fund groups maintain—and commission staff have access to—the information required on Form N-PORT.”

“As of the end of 2016, 11,548 of the 17,072 funds registered with the SEC were required to file Form N-PORT,” Turner said. “Form N-PORT includes monthly reporting of portfolio holdings, something the industry considers sensitive.”

When the SEC adopted the rule that created N-PORT, the commission “felt that it would be ready for the June 2018 compliance deadline,” Turner said. “The industry had concerns about the SEC's readiness to protect such information and in July an industry group (ICI) sent a letter to the SEC, expressing concerns around the SEC's ability, 'to protect the valuable and sensitive portfolio holdings information that funds will be required to report monthly,' noting that a hack of Form N-PORT data could make funds vulnerable to predatory trading practices, which would be at the expense of fund shareholders.”

In September, Clayton announced that EDGAR had been hacked. The data breach was initially detected in 2016, but in August 2017, the SEC learned that the information may have been traded on, Turner said.

“The SEC attributed the breach to software vulnerability in the test filing component of EDGAR,” Turner added. “The SEC is working on improving EDGAR and has hired consultants to help. Clayton has assured Congress and the industry that the SEC will not take data unless he is sure that it is secure.”

However, firms should be careful about reading the wrong message from the announcement. “Some firms will see this as a chance to relax and breathe easy,” Turner said. “But they are wrong.”

“Form N-PORT requires heavy lifting up front,” she added. “In order to make the tight 30-day deadline each month, firms must automate data feeds from numerous third parties, and clean up the data so that they can run calculations as needed to answer the questions on the form. This process must be automated, as there is no time to check your work.”

She further cautioned that the SEC's modification “does not alleviate this burden for firms. The modification only mitigates the additional stress of generating an XML that passes validation tests.”

“Firms now have a chance to perfect their automated workflow and their methodologies and calculations without worrying about technical problems,” she advised. “They should take advantage of this window.”

During the first nine months, firms “should generate XMLs and test their systems and workflows even though XML submission is not required. This way they will be ready to go when they must report on EDGAR,” she said. “In addition, due to the modification, during the first nine months of reporting, firms must report both N-PORT and NQ. There is overlap in information reported on these two forms. But N-Q is reported less frequently and with a 60-day deadline (compared to N-PORT's 30-day deadline). For some firms, reporting both forms will be a burden on resources.”