"[T]he burden is both on the firm as well as on the regulator to try to parse through these very large sets of data," said Robert Cruz.