Proposed Collection; Comment Request; Extension: Rule 248.30, 13026-13027 [2022-04891]

Agencies

• SECURITIES AND EXCHANGE COMMISSION

[Federal Register Volume 87, Number 45 (Tuesday, March 8, 2022)]
[Notices]
[Pages 13026-13027]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-04891]


-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[SEC File No. 270-549, OMB Control No. 3235-0610]


Proposed Collection; Comment Request; Extension: Rule 248.30

Upon Written Request, Copies Available From: Securities and Exchange 
Commission, Office of FOIA Services, 100 F Street NE, Washington, DC 
20549-2736

    Notice is hereby given that, pursuant to the Paperwork Reduction 
Act of 1995 (44 U.S.C. 3501 et seq.), the Securities and Exchange 
Commission (the ``Commission'') is soliciting comments on the 
collection of information summarized below. The Commission plans to 
submit this existing collection of information to the Office of 
Management and Budget for extension and approval.
    Rule 248.30 (17 CFR 248.30) under Regulation S-P is titled 
``Procedures to Safeguard Customer Records and Information; Disposal of 
Consumer Report Information.'' Rule 248.30 (the ``safeguard rule'') 
requires brokers, dealers, investment companies, and investment 
advisers registered with the Commission (``registered investment 
advisers'') (collectively ``covered institutions'') to adopt written 
policies and procedures for administrative, technical, and physical 
safeguards to protect customer records and information. The safeguards 
must be reasonably designed to ``insure the security and 
confidentiality of customer records and information,'' ``protect 
against any anticipated threats or hazards to the security and 
integrity'' of those records, and protect against unauthorized access 
to or use of those records or information, which ``could result in 
substantial harm or inconvenience to any customer.'' The safeguard 
rule's requirement that covered institutions' policies and procedures 
be documented in writing constitutes a collection of information and 
must be maintained on an ongoing basis. This requirement eliminates 
uncertainty as to required employee actions to protect customer records 
and information and promotes more systematic and organized reviews of 
safeguard policies and procedures by institutions. The information 
collection also assists the Commission's examination staff in assessing 
the existence and adequacy of covered institutions' safeguard policies 
and procedures.
    We estimate that as of the end of 2020, there are 3,681 broker-
dealers, 2,840 investment companies, and 13,788 investment advisers 
registered with the Commission, for a total of 20,309 covered 
institutions. We believe that all of these covered institutions have 
already documented their safeguard policies and procedures in writing 
and therefore will incur no hourly burdens related to the initial 
documentation of policies and procedures. Although existing covered 
institutions would not incur any initial hourly burden in complying 
with the safeguards rule, we expect that newly registered institutions 
would incur some hourly burdens associated with documenting their 
safeguard policies and procedures. We estimate that approximately 1,375 
broker-dealers, investment companies, or investment advisers register 
with the Commission annually. However, we also expect that 
approximately 20% of these newly registered covered institutions, or 
372 institutions, are affiliated with an existing covered institution, 
and will rely on an organization-wide set of previously documented 
safeguard policies and procedures created by their affiliates. We 
estimate that these affiliated newly registered covered institutions 
will incur a significantly reduced hourly burden in complying with the 
safeguards rule, as they will need only to review their affiliate's 
existing policies and procedures, and identify and adopt the relevant 
policies for their business. Therefore, we expect that newly registered 
covered institutions with existing affiliates will incur an hourly 
burden of approximately 15 hours in identifying and adopting safeguard 
policies and procedures for their business, for a total hourly burden 
for all affiliated new institutions of 5,580 hours. We expect that half 
of this time would be incurred by inside counsel at an hourly rate of 
$455, and half would be by a compliance officer at an hourly rate of 
$400, for a total cost of $2,385,450.
    Finally, we expect that the 1,003 newly registered entities that 
are not affiliated with an existing institution will incur a 
significantly higher hourly burden in reviewing and documenting their 
safeguard policies and procedures. We expect that virtually all of the 
newly registered covered entities that do not have an affiliate are 
likely to be small entities and are likely to have smaller and less 
complex operations, with a correspondingly smaller set of safeguard 
policies and procedures to document, compared to other larger existing 
institutions with multiple affiliates. We estimate that it will take a 
typical newly registered unaffiliated institution approximately 60 
hours to review, identify, and document their safeguard policies and 
procedures, for a total of 60,180 hours for all newly registered 
unaffiliated entities. We expect that half of this time would be 
incurred by inside counsel at an hourly rate of $455, and half would be 
by a compliance officer at an hourly rate of $400, for a total cost of 
$25,726,950.
    Therefore, we estimate that the total annual hourly burden 
associated with the safeguards rule is 65,760 hours at a total hourly 
cost of $28,112,400. We also estimate that all covered institutions 
will be respondents each year, for a total of 20,309 respondents.
    These estimates of average burden hours are made solely for the 
purposes of the Paperwork Reduction Act. An agency may not conduct or 
sponsor, and a person is not required to respond to a collection of 
information unless it displays a currently valid control number. The 
safeguard rule does not require the reporting of any information or the 
filing of any documents with the Commission. The collection of 
information required by the safeguard rule is mandatory.
    Written comments are invited on: (a) Whether the proposed 
collection of information is necessary for the proper performance of 
the functions of the Commission, including whether the information 
shall have practical utility; (b) the accuracy of the Commission's 
estimates of the burden of the proposed collection of information; (c) 
ways to enhance the quality, utility, and clarity of the information 
collected; and (d) ways to minimize the burden of the collection of 
information on respondents, including through the use of automated 
collection techniques or other forms of information technology. 
Consideration will be given to comments and suggestions submitted in 
writing within 60 days of this publication by May 9, 2022.

[[Page 13027]]

    Please direct your written comments to David Bottom, Director/Chief 
Information Officer, Securities and Exchange Commission, C/O John 
Pezzullo, 100 F Street NE, Washington, DC 20549; or send an email to: 
[email protected].

    Dated: March 3, 2022.
J. Matthew DeLesDernier,
Assistant Secretary.
[FR Doc. 2022-04891 Filed 3-7-22; 8:45 am]
BILLING CODE 8011-01-P