EDGAR Next: Preparing for Upcoming Changes to the EDGAR Access Rules

Client Alert  |  December 3, 2024

This update provides a high-level summary of the Amendments and the implementation timeline and explains steps to take now to prepare for the transition to EDGAR Next.

On September 27, 2024, the U.S. Securities and Exchange Commission (the SEC) adopted amendments[1] (the Amendments) to Rules 10 and 11 of Regulation S-T and Form ID to make technical changes to the Electronic Data Gathering, Analysis, and Retrieval System (EDGAR) filer access and account management processes (referred to by the SEC as EDGAR Next). While there will be a steep learning curve associated with these significant procedural changes to EDGAR, they are expected to ultimately result in a filing system that is easier for filers and the individuals acting on their behalf to manage. As discussed in more detail in the section entitled “When Do the Changes Take Effect?” below, EDGAR Next is in a beta testing period now and will go live on March 24, 2025, though legacy EDGAR can still be used to make filings through September 12, 2025.

The Amendments, which received support from all five SEC Commissioners, are intended to enhance the security of EDGAR, improve the ability of filers to securely manage and maintain access to their EDGAR accounts, facilitate the responsible management of filer credentials, and simplify the procedures for accessing EDGAR. Chair Gary Gensler called the Amendments “an important next step for EDGAR account access protocols” and noted that they will benefit the Commission, filers, and investors alike.[2]

The adoption of EDGAR Next will, among other things, require filers to designate individuals to manage the filers’ EDGAR accounts and file on their behalf. To access EDGAR and make filings, these designated individuals will be required to have their own individual account credentials and complete multifactor authentication.

How Does EDGAR Next Work?

Individual Account Credentials Will Replace Filer Password, PMAC, and Passphrase

Currently, each filer, regardless of whether they are a company or an individual, is identified with a central index key (CIK) and has only one set of login credentials, consisting of a password, passphrase, CIK confirmation code (CCC), and password modification authorization code (PMAC). Using a filer’s password and CCC, any individual could access the filer’s EDGAR account and make filings.

EDGAR Next will continue to use the CIK and CCC but will retire the EDGAR password, PMAC, and passphrase (though existing filers’ passphrases will be needed to initially enroll in EDGAR Next, as described in the section entitled “How Does a Filer Enroll in EDGAR Next?” below). Under EDGAR Next, only authorized individuals, such as account administrators and authorized users, may access a filer’s EDGAR account and make filings on their behalf. To access a filer’s account, authorized individuals will need to log in to EDGAR with their own individual account credentials (obtained through Login.gov, a sign-in service of the U.S. government), complete multifactor authentication, and enter the relevant filer’s CIK and CCC. By limiting access to a filer’s account to only those individuals directly authorized by the filer and requiring such individuals to have their own personal EDGAR accounts, EDGAR Next’s updated access protocols provide additional security and traceability as compared to legacy EDGAR.[3]

Filers Will Be Required to Identify Individuals Authorized to Manage the Account

Under EDGAR Next, filers will be required to designate individuals to serve in the following roles, with each role having different responsibilities and privileges related to the filer’s EDGAR account: account administrator, user, technical administrator, and delegated entity. The Adopting Release provides the following chart depicting the key functions of each role:

Role Submit filings, view CCC Generate/
change CCC		 Manage account administrators, users, technical administrators, and delegated entities Delegate to another filer Manage delegated users Manage filer API token[4] Manage user API token
Account Administrator

X

X

X

X

X
User

X

X
Technical Administrator

X
Delegated Administrator

X

X

X
Delegated User

X

X

Each role serves the following purposes:

  • Account administrators will manage the filer’s EDGAR account and serve as the points of contact for questions from the SEC staff regarding the filer’s account.[5] All entity filers are required to maintain at least two account administrators, and all individual filers (including single-member companies) are required to have one account administrator. Up to 20 account administrators may be assigned for each filer.[6] Account administrators are also responsible for managing the filer’s dashboard; adding and removing other account administrators, technical administrators, and users; creating and editing groups of users; and delegating filing authority to a delegated entity (such as a filing agent). Additionally, account administrators are responsible for performing an annual confirmation, which involves confirming the accuracy of the filer’s account information.[7]
    • Entity Filers. An account administrator for a filer that is an entity could be an employee of the filer or the filer’s affiliate or an individual holding a notarized power of attorney authorizing them to serve as account administrator.[8]
    • Individual Filers. Individual filers, such as Section 16 filers, may authorize relevant individuals at their filing agents, related issuers, or other representative entities to act as their account administrator. If an individual filer chooses not to make such an authorization, the individual will be responsible for managing his or her own account and filings.
  • Users are individuals authorized by a filer’s account administrator to make EDGAR submissions on the filer’s behalf.
  • Technical administrators are responsible for managing the technical aspects of a filer’s connection to EDGAR’s APIs (as discussed in more detail below).
  • Delegated entities are entities that another filer authorizes to make filings on its behalf. Since delegated entities must have their own EDGAR accounts, they must comply with the same requirements applicable to all filers, maintaining their own accounts with their own account administrators, users, and technical administrators. A delegated entity can be any EDGAR account, including but not limited to filing agents,[9] issuers making submissions on behalf of Section 16 filers, and parent companies of large groups of related filers. Delegated entities may receive delegated authority to file for an unlimited number of filers. In response to comments from filing agents, the dashboard will be enhanced to enable prospective delegated entities to send delegation requests to filers. Once a delegated entity has accepted a delegation, all the delegated entity’s account administrators will automatically become delegated administrators for the filer. These delegated administrators will then be able to authorize delegated users.

How Does a Filer Enroll in EDGAR Next?

Existing EDGAR Filers: Must Enroll by December 19, 2025 to Avoid the Need to Submit an Amended Form ID

Access to the EDGAR Next dashboard will be available starting March 24, 2025. Existing EDGAR filers who enroll in EDGAR Next by December 19, 2025 will generally not be required to submit a new Form ID. However, if an existing filer fails to enroll by December 19, 2025, the filer will be required to submit an amended Form ID to apply for EDGAR Next access.

To enroll, a person authorized by the filer will log in to the EDGAR Next dashboard using his or her individual account credentials and will verify their authorization by entering the filer’s CIK, CCC, and passphrase.[10] (This will be the last time the filer’s passphrase is needed.) Once verified, the individual will provide information on the individuals that will serve as the filer’s account administrators. If the above information is accurate and entered correctly, enrollment could be effective the same day that it is submitted.[11]

For individual filers, such as Section 16 filers, the same process applies. However, to alleviate the burden of enrollment and account management on individual and single-member company filers, EDGAR Next will allow these filers to, initially, authorize an individual at their filing agent or other third party to enroll them in EDGAR Next and, subsequently, authorize one or more individuals at these entities to act as their account administrators. A power of attorney is not required to permit an individual to enroll on the filer’s behalf. Instead, entering the filer’s CIK, CCC, and passphrase will act as validation of the filer’s intent.[12] This ability to delegate the enrollment and management of a filer’s account will be particularly helpful to Section 16 and Form 144 filers, reducing the burden of compliance with EDGAR Next. The practical effect of this is that, during the enrollment period, Section 16 and Form 144 filers can be enrolled in EDGAR Next by individuals working at the companies with which they are associated so long as those individuals have been authorized by the individual filer and have access to the individual filers’ legacy EDGAR access codes. Individual filers will need to authorize individuals to act on their behalf but will not be required to create their own credentials or have any direct involvement with EDGAR. If a filer does not act by December 19, 2025 and as a result is required to apply for access on amended Form ID, the filer must provide a signed and notarized power of attorney to permit a third party to enroll the filer on their behalf.

A person responsible for enrolling multiple filers in EDGAR Next (e.g., someone responsible for a company and its subsidiaries and/or all of a company’s Section 16 filers) will have the option of using bulk enrollment, a process by which multiple accounts can be enrolled by completing and uploading a spreadsheet template with the required information for each account.

New EDGAR Applicants: Form ID Will Be Amended to Require Certain Additional Information from EDGAR Applicants

Form ID is an online form used to apply for EDGAR access. Currently, to complete the Form ID, an applicant must provide the following: information about the applicant and filer, relevant contact information, and the signature of an authorized individual (such as the CEO or secretary of the company for an entity filer).

Beginning on March 24, 2025, the amended Form ID will become effective and will require applicants, among other things and in addition to previous requirements, to do the following:

  1. Designate account administrators and provide a power of attorney for each designated account administrator that is not the applicant (for an individual applicant) or an employee of the applicant or the applicant’s affiliate (for an entity applicant). As mentioned above, account administrators must have individual account credentials, at least two must be assigned per filer (or one in the case of individual or single member company filers), and up to 20 can be assigned.
  2. Provide its Legal Entity Identifier (LEI), if any. (The LEI is a global alphanumeric identifier used to uniquely and unambiguously identify a legal entity, which can be obtained through any Global Legal Entity Identifier Foundation (GLEIF) accredited organization.) Applicants that have not yet obtained an LEI will not be required to do so to submit Form ID.
  3. Provide more specific contact information about the filer, its account administrators, the individual authorized to sign Form ID on the filer’s behalf, and the billing contact responsible for filing fees.
  4. Provide a history of past securities law violations, specifically whether the applicant, its account administrator, the individual authorized to sign Form ID on the filer’s behalf, the billing contact, or the person signing a power of attorney has been criminally convicted or enjoined, barred, suspended, or banned in any capacity as a result of a securities law violation.
  5. Indicate whether the applicant is in good standing with its state or country of incorporation.[13]

The person submitting a Form ID on a prospective filer’s behalf need not be one of the applicant’s prospective account administrators. Once the Form ID application is granted, account administrators will be able to log in to EDGAR with their individual credentials obtained through Login.gov to access the filer’s dashboard and generate a CCC. Once the account administrators have access to the filer’s dashboard, they can add additional account administrators without the need to provide additional powers of attorney for each new non-employee administrator.

How Can a Filer Minimize Their Manual Interaction with EDGAR?

While the Amendments aim to make EDGAR Next user-friendly, they also provide a way for filers to limit their need to interact with the system altogether. EDGAR Next will include optional Application Program Interfaces (APIs), which allow machine-to-machine authentication—a process commonly used by filing agents—as an alternative to making filings through the EDGAR website. EDGAR Next will include a total of 15 optional APIs.[14] Among other things, these APIs will allow filing applications (such as those created and operated by DFIN, Workiva, Toppan Merrill, and other filing agents) to replicate much of the dashboard account management functionality, allowing filers to manage their EDGAR accounts with minimal manual interaction with EDGAR. For example, APIs will allow filers to make live and test submissions on EDGAR, check the status of an EDGAR submission, and check EDGAR operational status. According to SEC Chair Gary Gensler, these APIs “will help enhance how filers, including registrants and their agents, can access EDGAR, retrieve information, and submit bulk filings” and will “promote efficiency for filers and the Commission alike.” To use and manage these APIs, filers will be required to designate two individuals as technical administrators.[15]

When Do the Changes Take Effect?

  • September 30, 2024: Beta testing opened on September 30, 2024, and will continue until at least December 19, 2025. During this period, filers are able to test the EDGAR Next changes in the “Adopting Beta” environment, a testing environment that is separate from the live EDGAR system.[16] This period can also be used to prepare for the implementation of EDGAR Next. For example, among other things, filers can determine their account administrators, encourage the relevant individuals to obtain their individual account credentials through Login.gov, and gather information needed to enroll prior to EDGAR Next’s launch on March 24, 2025.
  • March 24, 2025: The new EDGAR Next dashboard will go live on March 24, 2025, and existing filers (or individuals authorized to act on their behalf) will obtain access by enrolling on the dashboard using the filers’ legacy EDGAR access codes. New filers (and existing filers unable to enroll) must complete the newly amended Form ID, the application for access to EDGAR Next. Once live, the dashboard will be available during EDGAR operating hours, 6 a.m. to 10 p.m. Eastern Time each day except Saturdays, Sundays, and Federal holidays. To access the EDGAR Next dashboard, individuals will be required to log in with the individual account credentials obtained through Login.gov.
  • September 15, 2025: Compliance with EDGAR Next will be required in order to file beginning September 15, 2025. Filers may continue to enroll (but not file) using legacy EDGAR access codes until December 19, 2025. However, we recommend enrolling well in advance of any anticipated filings in order to avoid last-minute issues. Beginning December 22, 2025, as discussed above, existing filers who have not enrolled or been granted access on the amended Form ID will be required to submit the amended Form ID to access their EDGAR account.

What Should I Be Doing Now?

While EDGAR Next is intended to make managing an EDGAR account easier, the transition to EDGAR Next will involve certain administrative burdens for filers and individuals acting on their behalf. To be ready for the transition, we recommend the following:

  1. Collect legacy EDGAR access codes. Existing filers or individuals authorized to act on their behalf will need to use the filers’ legacy EDGAR access codes (specifically their CIK, CCC, and passphrase) to enroll in EDGAR Next once it goes live. Check to make sure you have the codes of any entities or individual filers for which you are responsible and confirm that the codes work and have not expired. If any of your EDGAR access codes have been lost, you may reset them here.[17]
  2. Identify individuals who will serve in various roles. Decide now who will serve as account administrators, users, and technical administrators for the EDGAR accounts of any entities or individual filers for which you are responsible. You can also decide which individuals will handle enrollment for the filers. It is common for multiple companies to handle EDGAR submissions for Section 16 filers who are directors or more than 10% holders, so those companies and the Section 16 filer will need to coordinate to determine who is going to enroll the filer in EDGAR Next once it goes live and who will serve as account administrator(s) for the Section 16 filer. If an individual filer authorizes multiple account administrators, the individual filer should consider which of the account administrators will perform the annual confirmation on the filer’s behalf and communicate that to the various account administrators.
  3. Determine how filers will authorize individuals to enroll them in EDGAR Next and serve as account administrators. As noted above, during the enrollment period, presentation of a power of attorney for the person performing enrollment or being authorized as an account administrator will not be necessary (entering the CIK, CCC, and passphrase will serve as validation of the filer’s intent); however, the Adopting Release urges all filers to carefully coordinate regarding the person they will authorize to enroll them. For any filers for which you are responsible, decide in advance the process whereby entities and individual filers will authorize an individual at their filing agent or other third party to enroll them in EDGAR and designate individual account administrator(s) (e.g., power of attorney, email, some other form of writing).
  4. Encourage individuals to obtain Login.gov credentials. All individuals who make submissions on behalf of a company or its Section 16 filers, or who manage the EDGAR access codes of those filers (likely members of the legal and financial reporting teams), should obtain Login.gov account credentials well before March 24, 2025. This will allow them to test the Adopting Beta and also hit the ground running when EDGAR Next goes live.
  5. Take Advantage of the Adopting Beta. If you expect to be tasked with managing a filer’s EDGAR account, consider familiarizing yourself with EDGAR Next via the Adopting Beta environment. Everything you need to access the Adopting Beta can be found at this website. A few things to note:
    • The Adopting Beta is separate from the live EDGAR system—anything in Adopting Beta is fictional and won’t carry over.
    • Users should use an email they intend to use for EDGAR Next when creating Login.gov credentials for the Adopting Beta. These credentials can be reused for EDGAR Next once it goes live.
    • To test in the Adopting Beta, users submit a Form ID to get a fictitious CIK and “account admin” role, which is only for the Adopting Beta.
    • Only enter fictional info in the Adopting Beta, except for real names/emails for Login.gov.

While users of the Adopting Beta are encouraged to report technical bugs to the SEC, the utility of the Adopting Beta is much broader than this, and we think it is worth taking advantage of the opportunity to try out EDGAR Next before it goes live.

  1. Update onboarding process to account for amended Form ID. After March 24, 2025, any new Section 16 filers will need to designate account administrators and provide certain other information (e.g., information regarding history of past securities law violations and good standing) in connection with the amended Form ID. To prepare for this, onboarding processes can be adjusted now to request this information.
  2. Coordinate with filing agents. You should coordinate with any filing agents you currently use to ensure that the filing agent is implementing appropriate processes to prepare for a smooth transition. The filing agents should be able to explain how they expect to manage your EDGAR account through the various APIs available and what they will need you to do to authorize them to act on your behalf.

What Other Resources are Available?

Instructional Videos. Videos introducing EDGAR Next topics and providing step-by-step instructions are available on the SEC’s YouTube channel:

Other Online Resources. The SEC’s dedicated EDGAR Next website includes detailed discussions regarding the transition to EDGAR Next and the Adopting Beta, among other topics. The EDGAR Business Office has also published this guide intended to help with enrolling individual filers (e.g., Section 16 filers) in EDGAR Next.

Contact Info. Finally, filers may email [email protected] or call Filer Support at (202) 551-8900 Option #2 for additional assistance.

What’s Next?

We will be monitoring further developments as the SEC transitions to and implements EDGAR Next. Commissioner Mark T. Uyeda noted that “[o]ver the next 15 months, the [SEC] staff will need to work with filers, filing agents, and the rest of the filing community to carry out—and implement changes from—additional beta testing of EDGAR Next functionalities.”[18] Commissioner Uyeda’s statement suggests that the SEC staff will be taking feedback from filers during the beta testing period and implementing further changes.

Our Securities Regulation and Corporate Governance attorneys are available to assist with any questions on relating to the transition to EDGAR Next.

[1] See SEC Release No. 33-11313, EDGAR Filer Access and Account Management (the Adopting Release), available here.

[2] See Chair Gary Gensler “Statement on EDGAR” available here.

[3] The EDGAR Filer Manual is being amended to clarify that individual account credentials may not be shared with other individuals as these credentials are intended to identify the individual taking action on EDGAR. See Adopting Release at Section II.B.

[4] APIs, or Application Program Interfaces, are discussed below.

[5] EDGAR Next will offer an option to allow account administrators to designate one account administrator as the filer’s primary EDGAR point of contact. The first account administrator listed on Form ID or an existing filer’s enrollment will by default be designated as the primary point of contact. See Adopting Release at Section II.B.1.

[6] The Adopting Release encourages filers to authorize more than the minimum number of account administrators, if possible, because if all account administrators for a filer cease to be available to manage the filer’s account, the filer will be required to submit a new Form ID to authorize new account administrators. See Adopting Release at Section II.B.1.b.

[7] EDGAR will allow account administrators to select one of four quarterly dates as the filer’s ongoing confirmation deadline: March 31, June 30, September 30, and December 31 (or the next business day if the date falls upon a weekend or holiday when EDGAR is not operating); however, an account administrator may choose to perform confirmation at an earlier date within the quarter when confirmation is due. See Adopting Release at Section II.B.1.d.

[8] Filers are required to provide a notarized power of attorney for account administrators only when the account administrators are included on Form ID. There is no such requirement for account administrators added through the filer’s dashboard. See Adopting Release at Section II.B.1.a.

[9] The Amendments define “filing agent” to include law firms, financial services companies, broker dealers when making submissions on behalf of individuals filing pursuant to Section 16 of the Exchange Act, and other entities engaged in the business of submitting EDGAR filings on behalf of their clients. See Adopting Release at Section II.C.3. and fn. 129.

[10] Filers that have lost or forgotten their CCC will be able to reset it by providing their CIK and passphrase and using the “Generate New EDGAR Access Codes” option in the EDGAR Filer Management website until March 21, 2025. Filers that have lost or forgotten their passphrase may automatically reset their passphrase by requesting a security token be sent to their point of contact email address on record in EDGAR, consistent with current practice. See Adopting Release at Section II.H.1.b. and fn. 208.

[11] As a security measure, following a filer’s enrollment in EDGAR Next, the filer’s CCC will be automatically reset. The new CCC will appear on the dashboard for all individuals with the ability to make submissions on the filer’s behalf, so it will not need to be separately communicated.

[12] See Adopting Release text accompanying and following fn. 39.

[13] The Adopting Release notes that “[a]lthough the lack of good standing will not prevent a company from obtaining EDGAR access, this information could be relevant in determining whether it may be appropriate for the staff to review additional documentation as part of its assessment of the application.” Adopting Release at Section II.F.3.

[14] Information regarding the 15 APIs is available here.

[15] The SEC has clarified that “the role of technical administrator could be filled by someone with a primarily administrative background” and that software or other technology expertise is not required. See Adopting Release at Section II.B.3.

[16] More information regarding beta testing can be found in the SEC’s EDGAR Next Filer Testing Guidance, available here.

[17] To generate new a PMAC, password, or CCC, you will need access to your CIK and passphrase. To reset your passphrase, you will need access to your CIK.

[18] See Commissioner Mark T. Uyeda’s “Statement on EDGAR Next” available here.

The following Gibson Dunn lawyers assisted in preparing this update: Mike Titera, Ron Mueller, Tom Kim, Aaron Briggs, Elizabeth Ising, David Korvin, Rob Kelley, Antony Nguyen, and Caroline Bakewell.

Gibson Dunn’s lawyers are available to assist with any questions you may have regarding these developments. To learn more about these issues, please contact the Gibson Dunn lawyer with whom you usually work in the firm’s Securities Regulation and Corporate Governance practice group, the authors, or any of the following practice leaders and members:

Securities Regulation and Corporate Governance:
Elizabeth Ising – Co-Chair, Washington, D.C. (+1 202.955.8287, [email protected])
James J. Moloney – Co-Chair, Orange County (+1 949.451.4343, [email protected])
Lori Zyskowski – Co-Chair, New York (+1 212.351.2309, [email protected])
Brian J. Lane – Washington, D.C. (+1 202.887.3646, [email protected])
Ronald O. Mueller – Washington, D.C. (+1 202.955.8671, [email protected])
Thomas J. Kim – Washington, D.C. (+1 202.887.3550, [email protected])
Michael A. Titera – Orange County (+1 949.451.4365, [email protected])
Aaron Briggs – San Francisco (+1 415.393.8297, [email protected])
Julia Lapitskaya – New York (+1 212.351.2354, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.