EDGAR Next: SEC Adopts Improvements to EDGAR Filer Access and Account Management

On September 27, 2024, the Securities and Exchange Commission (the “SEC”) adopted rule and form amendments to enhance the security and account management of its electronic filing system called EDGAR (i.e., Electronic Data Gathering, Analysis, and Retrieval system). The amendments, collectively referred to as “EDGAR Next,” aim to address current security flaws in EDGAR access, especially the inability to trace filings by electronic filers (“filers”) to specific individuals and the lack of multifactor authentication. Under current rules, any individual in possession of a filer’s EDGAR access codes could file on behalf of the filer, even if unauthorized to do so. EDGAR Next will also facilitate machine-to-machine communication with EDGAR that would provide filers with more efficient and automated filing options through application programming interfaces (“APIs”).

The amendments require filers to authorize EDGAR access to their accounts for only individuals with individual account credentials, authorize administrators for their accounts, and confirm their account information annually, all through a new EDGAR dashboard function (the “dashboard”). Filers who choose to use the optional APIs for machine-to-machine communication with EDGAR will also need to authorize technical administrators, subject to certain exceptions, and use security tokens to communicate with EDGAR. The amendments also amend Form ID, the application form for EDGAR access, to require additional information, including about initial account administrators.

Transition Timeline

On March 24, 2025, the amendments will be effective, the dashboard will become active, prospective new filers will be required to comply with the amended Form ID, and existing filers may begin enrolling in EDGAR Next using the dashboard.

Filing through the EDGAR Next process will, however, not be required until September 15, 2025, when individual account credentials will be required to access all EDGAR websites, current EDGAR access codes will no longer be used for access, and the current EDGAR access process will cease.

Filers will have from March 24, 2025, through December 19, 2025 (three months after EDGAR Next compliance takes effect), to enroll in EDGAR Next. Although existing filers who have not enrolled by September 15, 2025 may continue to enroll during that three-month period, they will not be able to file until they enroll. After December 19, 2025, unenrolled existing filers will need to submit the amended Form ID to obtain filing access.

To help filers prepare for the transition, the SEC has opened a beta filing testing platform that will be available until at least December 19, 2025. The SEC also maintains this webpage to provide filers with a variety of EDGAR Next resources, including links to videos on some EDGAR Next topics.

The EDGAR Next Changes to EDGAR

We discuss the EDGAR Next changes to EDGAR in more detail below.

Individual Account Credentials

• Filers must authorize only individuals who have obtained individual account credentials from Login.gov, a U.S. government sign-in service that employs multifactor authentication, to act on their behalf on EDGAR.

Account Administrators

• Filers must authorize and maintain at least two individuals as account administrators to manage their EDGAR accounts (or, in the case of individual or single-member company filers, at least one account administrator).
• An account administrator will oversee a filer’s EDGAR account through the dashboard, including by authorizing additional account administrators, authorizing and de-authorizing users (i.e., individuals who may make submissions on EDGAR on the filer’s behalf), managing user groups, managing the filer’s EDGAR access codes (including generating a new CIK confirmation code (“CCC”)), and designating the filer’s delegated entities (discussed below), managing the filer’s API tokens.
• Account administrators must also ensure that filers’ information on EDGAR is accurate and current and securely maintain information relevant to accessing filers’ EDGAR accounts.

Delegated Entities

• A filer’s account administrator may delegate filing authority to another EDGAR account through a dashboard function, enabling the other EDGAR account (the “delegated entity”) to make filings on the filer’s behalf. For example, through this function, filers will be able to delegate authority to filing agents, such as financial printers or law firms, individuals reporting under Section 16 of the Securities Exchange Act of 1934 will be able to delegate authority to the relevant issuers, and affiliated companies will be able to delegate authority to parent companies.

Technical Administrators and APIs

• Filers that choose to connect to EDGAR APIs must authorize at least two technical administrators to manage the technical aspects of the APIs, unless the filer makes the API connections through a delegated entity that complies with the requirement to maintain at least two technical administrators.

Annual Confirmation

• Filers, through their account administrators, must annually confirm that all account administrators, users, technical administrators, and delegated entities reflected on the dashboard are authorized to act on the filer’s behalf and that all information about the filer is accurate.

Form ID Amendments

• The Form ID amendments require additional information on Form ID, including the designation of initial account administrators, the applicant's Legal Entity Identifier, if any, and more specific contact information.
• Applicants must also disclose whether any individuals associated with the application have been criminally convicted or civilly or administratively enjoined, barred, suspended, or banned as a result of federal or state securities law violations. According to the SEC, this information will allow its staff to determine (including by contacting the relevant individual) whether such bars or prohibitions are relevant to the application for EDGAR access.
• If the applicant is a company, it must also disclose whether it is in good standing in its state or country of incorporation. According to the SEC, while the lack of good standing will not prevent a company from obtaining EDGAR access, the information may be relevant in determining whether additional documentation needs to be reviewed in assessing the application.

What Filers Should Be Doing Now

Filers should start preparing now for the kick-off of EDGAR Next enrollment on March 24, 2025, by:

• locating and securing their current EDGAR access codes (i.e., their CCC, password and passphrase);
• deciding who to authorize as their initial account administrators, users, technical administrators (if applicable), and delegated entities;
• ensuring that their initial account administrators, users, and technical administrators obtain individual account credentials from Login.gov and securely maintain those credentials; and
• testing EDGAR Next functionalities using the SEC’s beta platform.

***

If you would like to follow up regarding any of the matters covered by this Alert, please contact your usual Ropes & Gray attorney.