FINRA Rule 6880

The customer and account information test environment specifically, covering the data elements addressed in Rule 6840, became available to Industry Members in January 2022, reflecting the later, more gradual rollout of CAT's customer-level reporting relative to its order and execution-level reporting. This staggered timeline meant firms were not asked to simultaneously validate every category of CAT reporting at once; instead, testing access opened in phases roughly tracking the same phased implementation structure that governs substantive compliance dates under Rule 6895, giving firms a testing runway calibrated to when each corresponding reporting obligation would actually become live.

The Ongoing Testing Participation Obligation

Beyond this historical timeline, Rule 6880 also imposes a continuing, forward-looking obligation: each Industry Member must participate in testing related to the Central Repository, including any industry-wide disaster recovery testing, pursuant to whatever schedule is established under the CAT NMS Plan. This is not a one-time obligation satisfied once during initial onboarding; it requires ongoing firm participation whenever FINRA and the CAT NMS Plan's Operating Committee schedule subsequent testing exercises, including disaster recovery scenarios designed to confirm the Central Repository's resilience and Industry Members' own ability to continue functioning, or to resume reporting promptly, following a significant systems disruption.

This ongoing obligation reflects the reality that CAT is not a static system that, once built and tested, requires no further validation. As the Central Repository's own infrastructure evolves, as new reporting requirements are added through the kind of amendments discussed throughout the other Rule 6800 Series entries in this dictionary, and as the overall CAT ecosystem matures, Industry Members need to remain available and responsive to periodic testing exercises confirming that their own systems continue to interact correctly with an evolving Central Repository, rather than assuming initial certification at CAT's launch permanently establishes ongoing compliance without further validation.

The Access and Authentication Infrastructure Supporting Testing

Practical participation in CAT testing, and later in live CAT reporting itself, depends on a specific access and authentication framework FINRA built around the CAT Reporter Portal, a framework firms needed to establish correctly before any actual testing or reporting activity could begin. Firms must establish a Super Account Administrator, or SAA, serving as the primary entitlement contact responsible for provisioning CAT access to other users within the firm, leveraging any existing SAA relationship the firm already maintains under FINRA's broader Entitlement Program where one exists, or establishing a new one specifically for CAT purposes where it does not. The Reporter Portal itself requires multi-factor authentication beyond a standard user ID and password, with the second authentication factor provided through a dedicated authentication service requiring users to enroll a smartphone, tablet, or hardware security key before they can access the portal at all.

This authentication infrastructure applies consistently across both the testing environment and the live production environment, meaning a firm's investment in properly provisioning and training its staff on CAT Reporter Portal access during the testing phase carries forward directly into its ongoing live reporting operations, rather than representing a separate, testing-specific technical requirement that firms could treat as disposable once live reporting began.

Connecting Testing Obligations to Feedback Management

FINRA's own examination guidance ties Rule 6880's testing infrastructure directly to a firm's ongoing error correction obligations discussed elsewhere in this dictionary, particularly the T+3 correction deadlines addressed in the Rule 6830 and Rule 6840 entries, illustrating that testing infrastructure and ongoing operational compliance are not two separate, unrelated concerns but rather two stages of the same continuous compliance lifecycle. FINRA's 2026 Annual Regulatory Oversight Report specifically identifies archiving CAT feedback within a defined ninety-day window as a recommended practice, ensuring firms retain the error and validation feedback CAT generates long enough to actually submit any necessary corrections within the applicable deadlines, rather than losing access to that feedback data prematurely and finding themselves unable to properly investigate or correct an identified discrepancy.

This feedback-archiving practice connects conceptually back to Rule 6880's underlying testing infrastructure, since the same error correction tools and reporting mechanisms firms first encounter and validate during the CAT testing phases are the tools they continue relying on throughout ongoing live operations to manage feedback and corrections. A firm that treated its Reporter Portal familiarity as a one-time testing exercise, rather than an ongoing operational competency requiring continued attention, is poorly positioned to actually make effective use of the feedback and correction tools Rule 6880's testing framework was originally designed to help firms master.

Why the Phased Approach Mattered

The multi-year, staggered testing rollout documented in Rule 6880 was not simply an administrative convenience; it reflected a considered response to the scale of what CAT represented relative to anything the industry had previously built. Unlike OATS, which covered a narrower scope limited to order events in NMS securities and OTC Equity Securities and excluded options and customer-level identifying data entirely, CAT was designed from the outset to capture a dramatically broader universe of information, spanning NMS Securities, OTC Equity Securities, and Listed Options, plus detailed customer and account identification data that OATS never required. Attempting to test and validate a system of this scope all at once, across every Industry Member simultaneously, would have created an enormous, concentrated risk of systemic failure during the critical early rollout period.

By instead phasing testing access, first for file submission and data integrity, then for the Reporter Portal and its error correction tools, and only later for the more sensitive customer and account information environment, FINRA and the CAT NMS Plan's Operating Committee allowed problems discovered during earlier testing phases to be identified and resolved before firms began testing the next, more complex layer of functionality. This sequencing also gave FINRA and the Plan Processor an opportunity to build genuine operational experience supporting a smaller, initial population of testing firms before the testing population expanded to include the full universe of Industry Members, reducing the risk that early-stage technical or operational problems would simultaneously affect every firm in the industry at once.

Comparing This Approach to the Retired OATS Testing Framework

Candidates and practitioners familiar with the retired Order Audit Trail System, discussed in depth in the Rule 7400 entry elsewhere in this dictionary, may find it useful to compare CAT's phased testing approach against OATS's own historical implementation. OATS, when it launched in the late 1990s, followed its own phased rollout, with clock synchronization requirements taking effect before the substantive electronic order reporting phases that followed. CAT's Rule 6880 testing framework echoes this same underlying philosophy of phasing technical infrastructure requirements ahead of the substantive reporting obligations those requirements ultimately support, a pattern that recurs because it reflects a sound general principle for implementing large-scale, mandatory market infrastructure: verify the foundational technical capability first, then build the substantive reporting requirements on top of a foundation firms have already had the opportunity to validate.

This continuity in implementation philosophy across two entirely different systems, separated by roughly two decades, suggests FINRA has internalized real lessons about how to successfully roll out large-scale, mandatory industry-wide reporting infrastructure without overwhelming the industry's collective capacity to adapt all at once. Firms that participated in both the original OATS rollout and the later CAT rollout may have recognized this structural similarity directly, even though the two systems differ enormously in their ultimate scope and complexity.

Relevance Across FINRA's Exam Programs

The SIE, Series 63, and Series 65 do not test Rule 6880's development and testing requirements, since these exams do not reach into CAT's technical onboarding and testing infrastructure. A Series 7 candidate is unlikely to encounter this rule directly, though understanding that a system as significant as CAT required a multi-year, carefully phased testing rollout before firms began live reporting provides useful context for appreciating the scale and complexity of the infrastructure underlying modern market surveillance.

A Series 24 candidate supervising a firm's CAT compliance program should understand Rule 6880's ongoing testing participation obligation as a continuing responsibility rather than a completed, historical milestone, ensuring the firm remains prepared to participate in future disaster recovery or other testing exercises as FINRA and the Operating Committee schedule them. A principal should also ensure the firm's Super Account Administrator and Reporter Portal access provisioning remains current and properly staffed, since access and authentication gaps at critical moments, whether during a scheduled testing exercise or when responding to a time-sensitive CAT feedback item, can create their own distinct operational and compliance friction independent of whatever underlying substantive reporting issue might be at stake. A Series 57 candidate is less directly implicated by this particular rule's historical testing timeline, though should understand that the Reporter Portal tools available today trace back to this testing infrastructure and represent the same tools relied upon for ongoing feedback review and error correction in current live operations, meaning familiarity with these tools carries direct, practical value for a trader's own order reporting responsibilities.

Practical Guidance for Firms

Firms should treat Rule 6880's ongoing testing participation obligation as a standing item requiring periodic internal readiness review, rather than assuming the firm's original CAT onboarding and testing experience permanently established its capability to participate effectively in any future testing exercise FINRA or the Operating Committee might schedule. Given that meaningful staff turnover can occur between CAT's original rollout period and any subsequent testing exercise, firms should periodically confirm that current staff maintain genuine familiarity with the firm's testing participation obligations, rather than relying on institutional knowledge that may have departed the firm along with the specific individuals who handled the original onboarding process years earlier.

Firms should also maintain active, current Super Account Administrator and Reporter Portal user provisioning as an ongoing administrative responsibility, specifically building this into new employee onboarding and departing employee offboarding processes for any staff involved in CAT compliance functions. A firm that discovers, only when an urgent CAT-related issue arises, that its designated portal administrators have since left the firm without a properly provisioned replacement faces an entirely preventable access gap at precisely the moment prompt access matters most.

Firms new to the securities industry, or firms newly required to begin CAT reporting for the first time following a change in their business model, should not assume that the historical phased testing timeline documented in Rule 6880 remains directly applicable to their own onboarding experience today. A firm beginning CAT compliance now enters an established, mature testing and production environment rather than the original, industry-wide phased rollout the rule's historical text describes, meaning such a firm's own testing and certification process, while still governed by the ongoing participation obligation, will look considerably different in practice from the original multi-year rollout sequence FINRA and the industry collectively worked through between 2019 and 2022.

Firms should also recognize that the disaster recovery testing obligation under Rule 6880 deserves genuine operational attention rather than being treated as a routine, low-priority compliance formality. A firm's actual ability to demonstrate resilience during a scheduled disaster recovery exercise reflects real information about how that firm would perform during an actual, unplanned disruption affecting either its own systems or the Central Repository itself, and firms should treat their participation and performance in these exercises as a genuine test of operational readiness rather than merely another item to check off on a compliance calendar. A firm that performs poorly during a scheduled disaster recovery test has learned something valuable about a genuine vulnerability in its own systems or processes, information considerably more useful to discover during a planned exercise than during an actual, unplanned crisis when the stakes of failure are meaningfully higher.

Compliance teams should periodically review whether their firm's internal documentation of its CAT testing history, and the specific configurations and validations completed during that original testing period, remains accurate and accessible, since this historical record can prove valuable context if a question arises during a later examination about how and when the firm first validated a particular aspect of its CAT reporting capability. A firm that has lost or never properly documented its own original testing history may find itself unable to answer straightforward questions about its own CAT compliance timeline during a subsequent regulatory inquiry, an entirely avoidable gap given how thoroughly documented the original industry-wide testing rollout itself was by FINRA and the CAT NMS Plan.