Regulation S-P

Separately from its privacy notices, what does Regulation S-P require a broker-dealer to do about the security of customer information?

1. A.Encrypt every electronic communication sent to a customer, whatever information it contains.Wrong. The requirement is a reasonably designed programme rather than one prescribed technical measure applied universally.
2. B.Store all customer records with an unaffiliated third-party custodian approved by the firm's examining authority.Wrong. No such outsourcing or approval requirement exists anywhere in the regulation.
3. C.Obtain a customer's written consent before storing any of that customer's information electronically.Wrong. Consent governs certain sharing decisions and has nothing to do with how records are secured.
4. D.Adopt written policies reasonably designed to protect customer records against anticipated threats and unauthorised access.Correct. This safeguards obligation addresses accidental and unauthorised loss, a failure mode the notice rules never touch.

Why: Regulation S-P contains a safeguards requirement obliging a firm to adopt written policies and procedures reasonably designed to ensure the security and confidentiality of customer records and information, to protect against anticipated threats to their security or integrity, and to protect against unauthorised access or use that could result in substantial harm or inconvenience to a customer. This operates independently of the notice and opt-out provisions, which govern deliberate sharing; safeguards govern accidental or unauthorised loss. The regulation also requires proper disposal of consumer report information, since discarded records leak just as readily as breached ones. A firm can therefore comply perfectly with its notice obligations and still violate the regulation by leaving customer data unprotected.

Delacourt Securities opens a mutual fund account for Winifred on the 8th of the month. Under Regulation S-P, the firm's initial privacy notice describing what personal information it collects and how it may be shared must be delivered:

1. A.Only if the firm intends to share her information with nonaffiliated third partiesThat condition governs the OPT-OUT notice, not the privacy notice. Every customer gets a privacy notice even at a firm that shares nothing.
2. B.Within 30 days after the customer's first securities transactionNothing in Regulation S-P keys the initial notice to a trade. The customer is entitled to know the firm's practices before the relationship begins, not after activity has started.
3. C.On an annual basis only, beginning with the first calendar year end after openingAnnual delivery is a separate ongoing obligation with its own conditions. It does not replace the notice owed when the relationship is established.
4. D.No later than the time the customer relationship is establishedCorrect. The initial privacy notice is owed at account opening, before the relationship is under way, and is required regardless of the firm's sharing practices.

Why: Regulation S-P requires a broker-dealer to give a clear and conspicuous initial privacy notice to a customer no later than the time the customer relationship is established. The notice is owed whether or not the firm intends to share anything with outside parties; the opt-out notice is the separate document that becomes necessary only when nonaffiliated sharing is planned.

A broker-dealer wants to share its retail customers account information with an unaffiliated marketing company. Under Regulation S-P, before sharing the firm must:

1. A.Obtain each customer affirmative written opt-in consentReg S-P is opt-out, not opt-in - silence after proper notice permits the sharing.
2. B.Nothing, provided Social Security numbers are excluded from the dataThe rule covers nonpublic personal information broadly - account and holdings data included - not just identifiers.
3. C.Give customers a privacy notice describing the sharing and a reasonable opportunity to opt outCorrect - notice plus a reasonable opt-out window is the Reg S-P precondition for nonaffiliated sharing.
4. D.Obtain SEC approval of the marketing arrangementNo regulator pre-approves information-sharing arrangements; compliance runs through notices and opt-outs.

Why: Regulation S-P requires the firm to provide a privacy notice describing its sharing practices and give customers a reasonable opportunity to opt out before nonpublic personal information goes to nonaffiliated third parties. Review: Regulation S-P privacy requirements.

Thackery Securities is emptying a storage room containing paper consumer credit reports it obtained on customers years ago. Under the disposal provisions of Regulation S-P, before discarding them the firm must:

1. A.Return the reports to the consumer reporting agency that supplied themNo rule requires returning consumer reports to their source. The obligation is to dispose of them safely, not to send them back.
2. B.Take reasonable measures to protect against unauthorised access to the information in connection with its disposal, such as shredding or burning the documentsCorrect. The disposal rule requires reasonable measures against unauthorised access, and destruction that prevents reconstruction is the standard way to meet it.
3. C.Obtain each customer's written consent before destroying records that concern themConsent governs certain kinds of information SHARING under Regulation S-P. Destroying the firm's own copies at the end of their useful life needs no customer approval.
4. D.Keep the reports for six years and then discard them by any convenient meansEven records that have outlived their retention period remain sensitive. The disposal rule applies regardless of how long the firm was required to keep them.

Why: Regulation S-P requires a broker-dealer to take reasonable measures to protect against unauthorised access to or use of consumer report information in connection with its disposal. In practice that means burning, pulverising or shredding paper records, and erasing or destroying electronic media, so that the information cannot be reconstructed.