While the SEC's rulemaking largely sticks very closely to the existing broker-dealer framework, the SEC did make a good faith effort to tailor the application of its requirements to the scope of its authority. For example, the SEC did not impose heavy new financial reporting requirements on bank SBSDs, which makes sense as the SEC does not regulate the capital of these entities. Likewise, the SEC did not apply WORM record retention requirements as to the entities that will be newly…

Though the ruling is not yet a final decision on the merits, the case is notable. The Court concluded that data scraping from a public website is probably not a violation of the CFAA and, therefore, such scraped information is not obtained in violation of law (or at least in violation of that law). From a financial regulation perspective, this holding may substantially undermine any claim by regulators or plaintiffs that an algorithmic trading firm that had improperly obtained data it used…

When it comes to capital formation and assisting small businesses, the various U.S. regulators are neither (i) on the same page nor (ii) consistent in between their actions and their deeds. Some of this is a matter of different regulators expressing their individual preferences, and some of it is a matter of individual regulators taking wholly inconsistent positions; e.g., advocating for both assisting small businesses with capital formation and for imposing greater regulation on small…

This enforcement action is an illustration of both (i) what can go wrong in connection with a cybersecurity failure and (ii) how much the task of compliance has changed as a result of the need to deal with cybersecurity, as well as other technology, issues.

The firm's initial problems resulted from the fact that its employees were deemed not be up to their cybersecurity tasks. Allegedly, the firm's IT Manager "had limited training in cybersecurity, and cybersecurity was not broadly…