Blockchain Association, DeFi Education Fund warn that SEC's consolidated audit trail poses privacy concerns

The Blockchain Association and the DeFi Education Fund say the U.S. Securities and Exchange Commission's newly operational database poses privacy concerns for millions and could loop in digital assets.

The SEC adopted Rule 613 in 2012 following the financial crisis, requiring national securities exchanges and the Financial Industry Regulatory Authority to maintain a consolidated audit trail, or CAT. The goal is to allow regulators to oversee securities markets on a "consolidated basis," said former SEC Chair Jay Clayton in 2017. 

The Consolidated Audit Trail became fully operational at the end of May 2024, according to the Securities Industry and Financial Markets Association. 

The 351-page  rule does not explicitly mention digital assets, but both crypto groups say the SEC believes that many crypto participants are exchanges or brokers, so they will have to report information to the CAT. 

The CAT will turn "blockchains into a massive and fully deanonymized repository for the government to search at will, without any need to show cause to obtain a warrant," the groups said in an amicus brief filed on Thursday. 

"Due to the nature of blockchain technology, accessing even one superficially limited identity record will unlock an unprecedented trove of unrelated financial transactions conducted by that user – past, present, and future – all open for inspection by the federal government, and a host of private parties," they said in the brief. 

The amicus brief was filed in April as part of a class action lawsuit brought by the conservative think tank National Center for Public Policy Research and two Texas residents, Erik Davidson and John Restivo, against the SEC and its chair, Gary Gensler. Others have filed amicus briefs, including the American Securities Association, to the U.S. District Court for the Western District of Texas. 

The SEC has brought a number of cases against crypto firms and entities over the years. For some, including exchanges Coinbase and Kraken, the regulator has alleged in enforcement actions that the firms are operating as unregistered exchanges and brokers. 

"As we explain in our amicus brief, the SEC’s current position on digital assets – as expressed in multiple enforcement actions – will likely result in the SEC telling digital asset trading platforms that they have to report detailed transaction information to the CAT," said the DeFi Education Fund's Chief Legal Officer Amanda Tuminelli in a statement . "Since the CAT also collects personally identifiable information connected to transactions, the great fear that we express to the court is that the CAT will become a repository of user information associated with particular wallet addresses."

"The privacy concerns here are severe," Tuminelli added.

The groups also warned that the CAT database could be vulnerable to hacks. 

"To make things far worse, there is a significant risk that user data submitted to the CAT database will be divulged to outside parties through accidents or nefarious exploits. Data breaches are on a meteoric rise, even though organizations are spending more money than ever on cybersecurity," the brief read. 

The SEC declined to comment to The Block on this matter.