Provides financial services, in the United States

15 U.S.C. § 1691(d); 12 CFR § 1002.9 · Read the law's page

• Notify the applicant within 30 days after taking adverse action on an incomplete application (unless you send a notice of incompleteness), within 30 days after taking adverse action on an existing account, and within 90 days after notifying the applicant of a counteroffer that the applicant does not expressly accept or use (12 CFR 1002.9(a)(1)(ii) to (iv)).
• When you take adverse action (a denial or revocation of credit, a change in the terms of an existing credit arrangement, or a refusal to grant credit in substantially the amount or on substantially the terms requested), give the applicant a written notice that states the action taken, your name and address, the ECOA notice substantially similar to the model text in Regulation B, and the name and address of the Federal agency that administers compliance with respect to you (15 U.S.C. 1691(d)(6); 12 CFR 1002.9(a)(2), (b)(1)).
• In that notice, either state the specific reasons for the action taken, or disclose the applicant's right to a statement of specific reasons within 30 days if the applicant requests it within 60 days of your notification, with the name, address and telephone number of the person or office from which the statement can be obtained (15 U.S.C. 1691(d)(2); 12 CFR 1002.9(a)(2)).
• State reasons that are specific and indicate the principal reasons for the adverse action; a statement that the action was based on your internal standards or policies, or that the applicant failed to achieve a qualifying score on your credit scoring system, is insufficient (15 U.S.C. 1691(d)(3); 12 CFR 1002.9(b)(2)).
• State only reasons that relate to and accurately describe the factors you actually considered or scored; where a credit scoring system produced the denial or other adverse action, the reasons must relate only to the factors actually scored in the system, and no factor that was a principal reason for the adverse action may be excluded from the disclosure (12 CFR 1002.9(b)(2) and its official interpretation).
• If you give the reasons orally, also disclose the applicant's right to have them confirmed in writing within 30 days of receiving the applicant's written request for confirmation (15 U.S.C. 1691(d)(2); 12 CFR 1002.9(a)(2)).
• For credit to a business with gross revenues in excess of $1 million in its preceding fiscal year, and for trade credit, credit incident to a factoring agreement and similar business credit, notify the applicant within a reasonable time, orally or in writing, and provide the written statement of reasons and the ECOA notice if the applicant makes a written request within 60 days of your notification (12 CFR 1002.9(a)(3)(ii)).
• If you did not act on more than 150 applications during the calendar year before the calendar year of the adverse action, you may give the statement of reasons by verbal statements or notifications (15 U.S.C. 1691(d)(5)).
• It reaches you if you operate as a creditor: a person who regularly extends, renews, or continues credit, who regularly arranges for credit to be extended, renewed, or continued, or who, in the ordinary course of business, regularly participates in a credit decision, including setting the terms of the credit, but not a person whose only participation in a credit transaction involves honoring a credit card. The duty is triggered by adverse action, which does not include a refusal to extend additional credit under an existing credit arrangement where the applicant is delinquent or otherwise in default, or where the additional credit would exceed a previously established credit limit (15 U.S.C. 1691(d)(6)). A creditor must notify an applicant of the action taken within 30 days after receiving a completed application (15 U.S.C. 1691(d)(1); 12 CFR 1002.9(a)(1)(i)).

31 U.S.C. § 5318(g)(2); 31 CFR § 1020.320 · Read the law's page

• It reaches you if you operate as a bank as 31 CFR 1010.100 defines the term: each agent, agency, branch or office within the United States of a person doing business as a commercial bank or trust company, a private bank, a savings and loan association or building and loan association, an insured institution, a savings bank, industrial bank or other thrift institution, a credit union, or another listed capacity. File a SAR with FinCEN for a transaction conducted or attempted by, at, or through the bank that involves or aggregates at least $5,000 in funds or other assets and that the bank knows, suspects, or has reason to suspect falls within 31 CFR 1020.320(a)(2)(i), (ii) or (iii). A bank is not required to file a SAR for a robbery or burglary committed or attempted that is reported to appropriate law enforcement authorities, or for lost, missing, counterfeit, or stolen securities with respect to which the bank files a report under 17 CFR 240.17f-1 (31 CFR 1020.320(c)).
• File the SAR no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing; where no suspect was identified on that date you may delay filing an additional 30 calendar days to identify a suspect, but never more than 60 calendar days after initial detection (31 CFR 1020.320(b)(3)).
• Where a violation requires immediate attention, such as an ongoing money laundering scheme, notify an appropriate law enforcement authority by telephone immediately, in addition to filing a SAR on time (31 CFR 1020.320(b)(3)).
• Keep a copy of every SAR filed and the original or business record equivalent of the supporting documentation for five years from the date of filing; identify and maintain the supporting documentation as such, since it is deemed filed with the SAR, and make it available on request to FinCEN, to any Federal, State, or local law enforcement agency, and to the regulators named in paragraph (d) (31 CFR 1020.320(d)).
• Do not notify any person involved in the transaction that it has been reported, and do not otherwise reveal any information that would reveal that it has been reported; the prohibition binds the bank, its directors, officers, employees and agents, and any current or former contractor for the bank (31 U.S.C. 5318(g)(2)(A)(i)).
• Treat a SAR, and any information that would reveal the existence of a SAR, as confidential: no bank, and no director, officer, employee, or agent of any bank, may disclose either except as paragraph (e) authorizes (31 CFR 1020.320(e)(1)(i)).
• Disclose a SAR, or information that would reveal that one exists, only to the recipients paragraph (e)(1)(ii) allows: FinCEN; a Federal, State, or local law enforcement agency; a Federal regulatory authority that examines the bank for compliance with the Bank Secrecy Act; a State regulatory authority administering a State law that requires the bank to comply with it; or, within the bank's corporate organizational structure, for purposes consistent with Title II of the Bank Secrecy Act. The underlying facts, transactions and documents on which a SAR is based may be disclosed, including to another financial institution for a joint SAR and in certain employment references or termination notices to the full extent 31 U.S.C. 5318(g)(2)(B) authorizes, provided that no person involved in the reported transaction is notified that it has been reported (31 CFR 1020.320(e)(1)(ii)).
• If you are subpoenaed or otherwise requested to disclose a SAR or information that would reveal one, decline to produce it, citing 31 CFR 1020.320 and 31 U.S.C. 5318(g)(2)(A)(i), and notify FinCEN of the request and your response (31 CFR 1020.320(e)(1)(i)).

12 U.S.C. § 1831p-1; 12 CFR part 30, appendix A; 12 CFR part 208, appendix D-1; 12 CFR part 364, appendix A · Read the law's page

• It reaches you if you are an insured depository institution, the class of institution for which section 39 of the Federal Deposit Insurance Act requires each appropriate Federal banking agency to prescribe safety and soundness standards.
• An institution should have internal controls and information systems appropriate to the size of the institution and the nature, scope and risk of its activities, providing for clear lines of authority and responsibility for monitoring adherence to established policies, effective risk assessment, timely and accurate financial, operational and regulatory reports, adequate procedures to safeguard and manage assets, and compliance with applicable laws and regulations (Guidelines section II.A).
• An institution should have an internal audit system appropriate to its size and the nature and scope of its activities, providing for adequate monitoring of the system of internal controls through an internal audit function (or, where its size, complexity or scope of operations does not warrant a full scale internal audit function, a system of independent reviews of key internal controls), independence and objectivity, qualified persons, adequate testing and review of information systems, adequate documentation of tests and findings and any corrective actions, verification and review of management actions to address material weaknesses, and review by its audit committee or board of directors of the effectiveness of the internal audit systems (Guidelines section II.B).

18 U.S.C. 2721 to 2725 · Read the law's page

• Do not knowingly obtain or disclose personal information from a motor vehicle record (a record of a motor vehicle operator's permit, title, registration or identification card issued by a department of motor vehicles) for any use the Act does not permit, and do not make a false representation to obtain it. Personal information does not include information on vehicular accidents, driving violations, and driver's status.
• Use such information only for a purpose section 2721(b) lists, for example use by a government agency, safety, recall and theft matters, verifying the accuracy of information an individual gave your business (and, if it is wrong, getting the correct information only to prevent fraud, pursue legal remedies or recover a debt or security interest against the individual), court and arbitral proceedings, research and statistical reports (so long as the information is not published, redisclosed or used to contact individuals), or a use for which you hold the individual's written consent.
• If you are an insurer, an insurance support organization or a self-insured entity (or its agent, employee or contractor), you may use personal information from a motor vehicle record in connection with claims investigation activities, antifraud activities, rating or underwriting under section 2721(b)(6), and for any other purpose only if another paragraph of section 2721(b) permits it.
• Do not use personal information from a motor vehicle record for bulk distribution for surveys, marketing or solicitations unless the State has obtained the express consent of the person to whom the information pertains (section 2721(b)(12)); express consent means consent in writing, including consent conveyed electronically that bears an electronic signature, and a recipient under section 2721(b)(12) may resell or redisclose the information only under that paragraph.
• If you resell or redisclose such information, do so only for a use section 2721(b) permits (but not for uses under section 2721(b)(11) or (12)), unless you obtained it under section 2721(b)(11), in which case you may resell or redisclose it for any purpose, or under section 2721(b)(12), in which case only as that paragraph permits; keep for 5 years records identifying each person or entity that receives it and the permitted purpose (a recipient under section 2721(b)(11) is exempt from that duty), and make the records available to the motor vehicle department on request.
• If you are a State department of motor vehicles, or an officer, employee or contractor of one, do not knowingly disclose or make available personal information obtained in connection with a motor vehicle record except as section 2721(b) permits, and do not disclose highly restricted personal information (a photograph or image, social security number, or medical or disability information) without the individual's express consent in writing, except for the uses in section 2721(b)(1), (4), (6) and (9).when it serves a public body

Interagency Guidelines Establishing Information Security Standards, 12 CFR Part 30 Appendix B, 12 CFR Part 225 Appendix F and 12 CFR Part 364 Appendix B · Read the law's page

• This instrument reaches your organization only if it is a national bank, Federal savings association, Federal branch or agency of a foreign bank, bank holding company, FDIC-insured bank that is not a member of the Federal Reserve System, FDIC-insured state savings association, insured state branch of a foreign bank, or a subsidiary of one of them (other than a broker, dealer, person providing insurance, investment company or investment adviser). Declare is_bank where that holds.
• Implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to your size and complexity and the nature and scope of your activities, designed to ensure the security and confidentiality of customer information, protect against anticipated threats or hazards to its security or integrity, protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer, and ensure the proper disposal of customer and consumer information.
• Have your board of directors or an appropriate committee of the board approve the written information security program and oversee its development, implementation, and maintenance, and report to the board or committee at least annually on the status of the program and your compliance.
• Identify reasonably foreseeable internal and external threats to customer information and customer information systems, assess their likelihood and potential damage, and assess the sufficiency of your controls.
• Consider whether the security measures the Guidelines list, among them access controls, encryption of electronic customer information, monitoring to detect actual and attempted attacks and intrusions, and response programs that include appropriate reports to regulatory and law enforcement agencies, are appropriate and, if so, adopt those you conclude are appropriate.
• Exercise appropriate due diligence in selecting your service providers, require them by contract to implement appropriate measures designed to meet the objectives of the Guidelines, and, where your risk assessment indicates, monitor them to confirm that they have met their obligations.

NCUA Security Program and Guidelines for Safeguarding Member Information, 12 CFR 748.0 and Appendix A to Part 748 · Read the law's page

• This instrument reaches your organization only if it is a federally insured credit union, or if it maintains or has access to member information on behalf of one as a service provider. Declare is_bank where either holds.
• If your organization is a federally insured credit union, develop a written security program within 90 days of the effective date of insurance, designed to ensure the security and confidentiality of member records, protect against anticipated threats or hazards to the security or integrity of those records, and protect against unauthorized access to or use of them that could result in substantial harm or serious inconvenience to a member.
• Design the security program to respond to incidents of unauthorized access to or use of member information that could result in substantial harm or serious inconvenience to a member.
• Under the Guidelines in Appendix A, a comprehensive written information security program includes administrative, technical, and physical safeguards appropriate to the size and complexity of the credit union and the nature and scope of its activities.
• The Guidelines say the board of directors or an appropriate committee should approve the written information security policy and program, and should receive a report on its status and the credit union's compliance at least annually.
• Each credit union must consider whether the security measures the Guidelines list, among them access controls, encryption of electronic member information, monitoring to detect attacks and intrusions, and response programs including appropriate reports to regulatory and law enforcement agencies, are appropriate and, if so, adopt those it concludes are appropriate.
• The Guidelines say a credit union should exercise appropriate due diligence in selecting its service providers, require them by contract to implement appropriate measures designed to meet the objectives of the Guidelines, and, where its risk assessment indicates, monitor them.

FTC Safeguards Rule, 16 CFR 314.1 to 314.4(i) and 314.6 · Read the law's page

• This instrument reaches your organization only if it is a financial institution over which the Federal Trade Commission has jurisdiction: an entity whose business is an activity that is financial in nature or incidental to such an activity and that is not subject to another regulator's enforcement authority under the Gramm-Leach-Bliley Act, such as a mortgage lender, mortgage broker, finance company, payday lender, account servicer, check casher, collection agency or tax preparation firm. Declare provides_financial_services where that holds; a bank or federally insured credit union answers to its own regulator's standards instead.
• Develop, implement, and maintain a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of the customer information at issue.
• Designate a Qualified Individual responsible for overseeing, implementing and enforcing the program, and base the program on a written risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, reassessed periodically.
• Implement access controls, identify and manage the data, personnel, devices, systems and facilities that matter to your business, encrypt customer information in transit over external networks and at rest unless your Qualified Individual approves effective alternative compensating controls, adopt secure development practices, and implement multi-factor authentication for any individual accessing any information system unless your Qualified Individual approves in writing a reasonably equivalent or more secure control.
• Monitor and log the activity of authorized users, and regularly test the effectiveness of the safeguards' key controls, systems, and procedures: absent effective continuous monitoring, conduct annual penetration testing and vulnerability assessments at least every six months and whenever material changes occur.
• Provide security awareness training, use qualified information security personnel, oversee service providers by selecting capable ones, requiring safeguards by contract and periodically assessing them, and evaluate and adjust the program in light of testing, material changes and risk assessments.
• Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in your control, and have your Qualified Individual report in writing at least annually to your board of directors or equivalent governing body.
• If you maintain customer information concerning fewer than five thousand consumers, the written risk assessment requirement of section 314.4(b)(1), the testing requirement of section 314.4(d)(2), the written incident response plan of section 314.4(h) and the board reporting of section 314.4(i) do not apply to you.

FINRA Rule 4511 · Read the law's page

• It reaches you if you are a FINRA member firm or a person associated with one, because FINRA may sanction either for a violation of a FINRA rule (Rule 8310(a)): make and preserve the books and records the FINRA rules, the Exchange Act and the applicable Exchange Act rules require (Rule 4511(a)).
• Preserve for at least six years any FINRA book or record for which neither the FINRA rules nor the applicable Exchange Act rules specify a period (Rule 4511(b)).
• Preserve every book and record the FINRA rules require you to make in a format and media that complies with SEA Rule 17a-4 (Rule 4511(c)).

12 CFR 1016.4 to 1016.6, 1016.8 and 1016.9 · Read the law's page

• If you are a financial institution that Regulation P covers, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and give a consumer who is not a customer that notice before you disclose any nonpublic personal information about the consumer to a nonaffiliated third party, other than as sections 1016.14 and 1016.15 authorize.
• You may give a customer the initial notice within a reasonable time after you establish the customer relationship if establishing it is not at the customer's election, or if giving it earlier would substantially delay the customer's transaction and the customer agrees to receive it later.
• Give each customer the notice again at least once in any period of 12 consecutive months during the customer relationship, unless you provide nonpublic personal information to nonaffiliated third parties only as sections 1016.13, 1016.14 or 1016.15 allow and have not changed the disclosure policies and practices in your most recent notice.
• If you lose the annual notice exception, give an annual notice: when you were required to give a revised notice, on the annual schedule treating the revised notice as an initial notice; otherwise within 100 days of the change in your policies or practices.
• Except as otherwise authorized in the rule, do not disclose nonpublic personal information about a consumer to a nonaffiliated third party other than as described in your initial notice unless you have given a clear and conspicuous revised notice that accurately describes your policies and practices and a new opt out notice, have given a reasonable opportunity to opt out, and the consumer does not opt out; give a revised notice before you disclose a new category of information, disclose to a new category of nonaffiliated third party, or disclose information about a former customer who has not had the chance to opt out. A revised notice is not required for a new nonaffiliated third party that your prior notice adequately described.
• State in each notice the categories of nonpublic personal information you collect and disclose; the categories of affiliates and nonaffiliated third parties to which you disclose it; the categories of information about former customers you disclose and the parties you disclose it to; a separate statement of the categories of information and of third parties under contract where you disclose to a service provider or joint marketing partner without an opt out; the consumer's right to opt out and how to exercise it; any notice about opting out of affiliate sharing under the Fair Credit Reporting Act; and your policies and practices for protecting the confidentiality and security of the information. Where you disclose to third parties as sections 1016.14 and 1016.15 authorize, you need not list those exceptions; it is enough to say that you disclose to other nonaffiliated companies for your everyday business purposes, or as permitted by law.
• Deliver each notice so that each consumer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, electronically; an oral explanation alone does not meet the rule. For customers, provide the initial, annual and revised notices so that the customer can retain them or obtain them later in writing or, if the customer agrees, electronically.
• The rule reaches a financial institution, meaning an institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as section 4(k) of the Bank Holding Company Act describes; it covers only information about individuals who obtain financial products or services primarily for personal, family, or household purposes.
• The rule does not apply to certain motor vehicle dealers described in section 1029(a) of the Consumer Financial Protection Act, a financial institution or other person subject to the jurisdiction of the Commodity Futures Trading Commission under 7 U.S.C. 7b-2, a registered broker or dealer, a registered investment adviser with respect to its investment advisory activities, a registered investment company, or an insurance company with respect to its insurance activities that a state insurance regulator supervises.

12 CFR 1016.7 and 1016.10 to 1016.15 · Read the law's page

• If you are a financial institution that Regulation P covers, then, except as otherwise authorized in this part, do not, directly or through an affiliate, disclose nonpublic personal information about a consumer to a nonaffiliated third party unless you have given the consumer the initial notice and an opt out notice, have given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out; this applies whether or not the consumer is your customer.
• Give each consumer a clear and conspicuous opt out notice stating that you disclose or reserve the right to disclose nonpublic personal information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means to do so, such as check-off boxes, a reply form, an electronic means or a toll-free telephone number; requiring the consumer to write his or her own letter is not a reasonable means.
• Allow a reasonable opportunity to opt out, such as 30 days from the date you mailed the notices or, for an online account, 30 days after the customer acknowledges receipt of the notices.
• Honor an opt out for all nonpublic personal information you have collected about the consumer, whether you collected it before or after the direction to opt out.
• Comply with a consumer's opt out direction as soon as reasonably practicable after you receive it; let a consumer opt out at any time; treat the direction as effective until the consumer revokes it in writing or, if the consumer agrees, electronically; after a customer relationship ends, the direction continues to apply to the information you collected during or related to that relationship, but it does not apply to a new customer relationship.
• Do not disclose an account number or similar access number or access code for a consumer's credit card, deposit, share or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency. This does not bar disclosure to your agent or service provider solely to perform marketing for your own products or services if it is not authorized to initiate charges to the account, or to a participant in a private label credit card program or an affinity or similar program where the participants are identified to the customer when the customer enters the program. A number or code in encrypted form is not an account number if you give the recipient no means to decode it.
• To provide nonpublic personal information to a nonaffiliated third party that performs services or functions on your behalf without an opt out, give the initial notice and enter into a contract that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed it.
• The notice to a consumer who is not a customer under section 1016.4(a)(2), the opt out requirements of sections 1016.7 and 1016.10, and the service provider and joint marketing requirements of section 1016.13 do not apply when you disclose nonpublic personal information as necessary to effect, administer or enforce a transaction a consumer requests or authorizes, or in connection with servicing or processing a requested financial product or service, maintaining or servicing the consumer's account, or a proposed or actual securitization or secondary market sale (section 1016.14(a)); the notice you owe a customer under section 1016.4(a)(1) still applies.
• The same three requirements (the initial notice requirement in section 1016.4(a)(2), the opt out requirements of sections 1016.7 and 1016.10, and the service provider and joint marketing requirements of section 1016.13) also do not apply to a disclosure made with the consumer's consent or at the consumer's direction (until revoked); to protect the confidentiality or security of your records or against fraud; for required institutional risk control or to resolve consumer disputes or inquiries; to persons holding a legal or beneficial interest relating to the consumer or acting in a fiduciary or representative capacity for the consumer; to insurance rate advisory organizations, guaranty funds or agencies, agencies rating you, persons assessing your compliance with industry standards, and your attorneys, accountants and auditors; to law enforcement agencies, self-regulatory organizations and for an investigation on a matter related to public safety, to the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978; to a consumer reporting agency under the Fair Credit Reporting Act; in connection with a sale, merger, transfer or exchange of a business or operating unit that concerns solely its consumers; or to comply with law, a properly authorized investigation, subpoena or summons, or judicial process (section 1016.15(a)).
• If you receive nonpublic personal information from a nonaffiliated financial institution under an exception, disclose and use it only as section 1016.11 permits: to that institution's affiliates, to your affiliates (which may use it only as you may), and under an exception to carry out the activity covered by the exception under which you received it.
• If you receive nonpublic personal information from a nonaffiliated financial institution outside an exception, disclose it only to that institution's affiliates, to your affiliates (which may disclose it only as you may), and to any other person if the disclosure would be lawful if made directly to that person by the institution that gave it to you.
• The rule reaches a financial institution, meaning an institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as section 4(k) of the Bank Holding Company Act describes; it covers only information about individuals who obtain financial products or services primarily for personal, family, or household purposes. The rule also reaches third parties that are not financial institutions but that receive nonpublic personal information from financial institutions with whom they are not affiliated.
• The rule does not apply to certain motor vehicle dealers described in section 1029(a) of the Consumer Financial Protection Act, a financial institution or other person subject to the jurisdiction of the Commodity Futures Trading Commission under 7 U.S.C. 7b-2, a registered broker or dealer, a registered investment adviser with respect to its investment advisory activities, a registered investment company, or an insurance company with respect to its insurance activities that a state insurance regulator supervises.

FINRA Rule 2210 · Read the law's page

• It reaches you if you are a FINRA member firm or a person associated with one, because FINRA may sanction either for a violation of a FINRA rule (Rule 8310(a)): have an appropriately qualified registered principal approve each retail communication before the earlier of its use or its filing with FINRA's Advertising Regulation Department, unless an exception in Rule 2210(b)(1) applies (Rule 2210(b)(1)(A)).
• Base every communication on principles of fair dealing and good faith, make it fair and balanced, and give it a sound basis for evaluating the facts about any particular security or type of security, industry, or service; do not omit a material fact or qualification if the omission, in light of the context of the material presented, would cause the communication to be misleading (Rule 2210(d)(1)(A)).
• Do not make a false, exaggerated, unwarranted, promissory or misleading statement or claim in any communication, and do not publish, circulate or distribute a communication you know or have reason to know contains an untrue statement of a material fact or is otherwise false or misleading (Rule 2210(d)(1)(B)).
• Do not predict or project performance, imply that past performance will recur, or make an exaggerated or unwarranted claim, opinion or forecast in a communication, other than as Rule 2210(d)(1)(F) permits (Rule 2210(d)(1)(F)).
• Prominently disclose your name in every retail communication and in correspondence (Rule 2210(d)(3)).
• Supervise and review correspondence under Rule 3110(b) and Supplementary Material .06 through .09 to that Rule, and establish written procedures, appropriate to your business, size, structure, and customers, for review by an appropriately qualified registered principal of the institutional communications you and your associated persons use (Rule 2210(b)(2) and (b)(3)).
• Maintain every retail communication and institutional communication for the retention period SEA Rule 17a-4(b) requires and in a format and media that comply with SEA Rule 17a-4, with a copy, the dates of first and last use, the name of any approving registered principal and the date of approval, and the other records Rule 2210(b)(4)(A) lists (Rule 2210(b)(4)(A)).

17 CFR 162.30 · Read the law's page

• This binds a financial institution or creditor subject to administrative enforcement of the Fair Credit Reporting Act by the Commodity Futures Trading Commission, which includes a futures commission merchant, retail foreign exchange dealer, commodity trading advisor, commodity pool operator, introducing broker, swap dealer or major swap participant that directly or indirectly holds a transaction account belonging to a consumer (17 CFR 162.30(a) and (b)(7)).
• Periodically determine whether you offer or maintain covered accounts, conducting a risk assessment that considers the methods you provide to open your accounts, the methods you provide to access them, and your previous experiences with identity theft (17 CFR 162.30(c)).
• If you offer or maintain one or more covered accounts, develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account, appropriate to your size and complexity and the nature and scope of your activities (17 CFR 162.30(d)(1)).
• Include in the program reasonable policies and procedures to identify relevant Red Flags, detect them, respond appropriately to them, and update the program periodically (17 CFR 162.30(d)(2)).
• Obtain approval of the initial written program from your board of directors or an appropriate committee, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements (17 CFR 162.30(e)).
• Consider the guidelines in the appendix to the subpart and include in the program those that are appropriate (17 CFR 162.30(f)).

17 CFR 248.201 · Read the law's page

• This binds a financial institution or creditor that is a broker, dealer or other person registered or required to be registered under the Securities Exchange Act of 1934, an investment company registered or required to be registered under the Investment Company Act of 1940, or an investment adviser registered or required to be registered under the Investment Advisers Act of 1940 (17 CFR 248.201(a)).
• Periodically determine whether you offer or maintain covered accounts, conducting a risk assessment that considers the methods you provide to open your accounts, the methods you provide to access them, and your previous experiences with identity theft (17 CFR 248.201(c)).
• If you offer or maintain one or more covered accounts, develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account, appropriate to your size and complexity and the nature and scope of your activities (17 CFR 248.201(d)(1)).
• Include in the program reasonable policies and procedures to identify relevant Red Flags, detect them, respond appropriately to them, and update the program periodically (17 CFR 248.201(d)(2)).
• Obtain approval of the initial written program from your board of directors or an appropriate committee, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements (17 CFR 248.201(e)).
• Consider the guidelines in the appendix to the subpart and include in the program those that are appropriate (17 CFR 248.201(f)).

FINRA Rule 3110 · Read the law's page

• It reaches you if you are a FINRA member firm or a person associated with one, because FINRA may sanction either for a violation of a FINRA rule (Rule 8310(a)): establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance with applicable securities laws and regulations and with applicable FINRA rules; final responsibility for proper supervision rests with the member (Rule 3110(a)).
• Establish, maintain, and enforce written procedures to supervise the types of business in which you engage and the activities of your associated persons, reasonably designed to achieve compliance with applicable securities laws and regulations and with applicable FINRA rules (Rule 3110(b)(1)).
• Include in those procedures a review of incoming and outgoing written (including electronic) correspondence and internal communications relating to your investment banking or securities business, appropriate for your business, size, structure, and customers; a registered principal must conduct the review and evidence it in writing, and merely opening a communication is not sufficient review (Rule 3110(b)(4) and Supplementary Material .07).
• Have a registered principal review all transactions relating to your investment banking or securities business, evidenced in writing; a reasonably designed risk-based review system may be used in place of a detailed review of each transaction (Rule 3110(b)(2) and Supplementary Material .05).
• Retain the internal communications and correspondence of associated persons relating to your investment banking or securities business for the period and with the accessibility SEA Rule 17a-4(b) specifies, keeping the names of the persons who prepared and who reviewed outgoing correspondence ascertainable from the retained records (Supplementary Material .09).
• Promptly amend your written supervisory procedures to reflect changes in applicable securities laws or regulations, including FINRA rules, and as changes occur in your supervisory system, and promptly communicate the procedures and amendments to the associated persons they concern (Rule 3110(b)(7)).
• Review the businesses in which you engage at least annually (on a calendar-year basis), inspect every office of supervisory jurisdiction annually, and reduce each inspection to a written report kept on file for a minimum of three years (or, for a non-branch location inspected less often than every three years, until the next inspection report is written) (Rule 3110(c)(1) and (c)(2)).

SEC Regulation SCI SCI event notices, 17 CFR 242.1002(b) and (c) · Read the law's page

• This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
• Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
• Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
• Until the SCI event is resolved and your investigation is closed, provide updates to the Commission on a regular basis, or at the frequency the Commission reasonably requests, to correct materially incorrect information or when new material information is discovered.
• If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
• For an SCI event with no or a de minimis impact, keep records and submit a quarterly report within 30 calendar days after the end of each calendar quarter summarizing the systems disruptions and systems intrusions.
• Promptly after responsible SCI personnel conclude that an SCI event that is a systems disruption or systems compliance issue has occurred, disseminate the affected systems and a summary description to the members or participants who may have been affected, and to all members or participants for a major SCI event. For a systems intrusion, disseminate a summary description and the corrective action taken unless you determine and document that dissemination would likely compromise security or an investigation.

SEC Regulation SCI policies and procedures, 17 CFR 242.1000 and 242.1001 · Read the law's page

• This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
• Establish, maintain, and enforce written policies and procedures reasonably designed to ensure that your SCI systems and, for security standards, your indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain your operational capability and promote fair and orderly markets.
• Include in those policies and procedures, at a minimum, regular reviews and testing of the systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters, and monitoring of the systems to identify potential SCI events.
• Include business continuity and disaster recovery plans reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption.
• Periodically review the effectiveness of the policies and procedures and take prompt action to remedy deficiencies. Policies and procedures consistent with current SCI industry standards are deemed reasonably designed, though compliance with those standards is not the exclusive means to comply.

CFTC system safeguards notices, 17 CFR 39.18(g), 38.1051(e) and 37.1401(e) · Read the law's page

• This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
• If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
• If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
• If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
• Give timely advance notice of material planned changes to automated systems that may impact their reliability, security, or capacity, and of material planned changes to your program of risk analysis and oversight.

CFTC system safeguards, 17 CFR 39.18, 38.1051 and 37.1401 · Read the law's page

• This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
• If your organization is a derivatives clearing organization, establish and maintain a program of risk analysis and oversight with respect to your operations and automated systems that identifies and minimizes sources of operational risk, and that addresses information security, business continuity and disaster recovery, capacity and performance planning, systems operations, systems development and quality assurance, and physical security and environmental controls.
• If your organization is a derivatives clearing organization, follow generally accepted standards and industry best practices with respect to the development, operation, reliability, security, and capacity of automated systems, and maintain a business continuity and disaster recovery plan with a recovery time objective of no later than the next business day following a disruption.
• If your organization is a designated contract market or a swap execution facility, maintain a program of risk analysis and oversight with respect to your operations and automated systems that addresses each category of risk analysis and oversight the rule lists, beginning with enterprise risk management and governance and information security.
• If your organization is a designated contract market or a swap execution facility, conduct regular, periodic, objective testing and review of your automated systems to ensure that they are reliable, secure, and have adequate scalable capacity, and regular, periodic testing and review of your business continuity-disaster recovery capabilities.

17 CFR 240.15l-1 · Read the law's page

• It reaches you if you are a broker, a dealer, or a natural person who is an associated person of a broker or dealer and you make a recommendation of any securities transaction or investment strategy involving securities (including account recommendations) to a retail customer, meaning a natural person (or that person's legal representative) who uses the recommendation primarily for personal, family, or household purposes: act in the best interest of the retail customer at the time the recommendation is made, without placing your financial or other interest ahead of the interest of the retail customer (Rule 15l-1(a)(1)).
• Provide the retail customer, prior to or at the time of the recommendation, in writing, full and fair disclosure of all material facts relating to the scope and terms of the relationship (that you act as a broker, dealer, or associated person with respect to the recommendation, the material fees and costs that apply, and the type and scope of services, including any material limitations on what may be recommended) and of all material facts relating to conflicts of interest associated with the recommendation (Rule 15l-1(a)(2)(i)).
• In making the recommendation, exercise reasonable diligence, care, and skill to understand the potential risks, rewards, and costs associated with it and have a reasonable basis to believe that it could be in the best interest of at least some retail customers (Rule 15l-1(a)(2)(ii)(A)).
• Have a reasonable basis to believe that the recommendation is in the best interest of the particular retail customer based on that customer's investment profile and the potential risks, rewards, and costs associated with the recommendation, and that it does not place your financial or other interest ahead of the customer's interest (Rule 15l-1(a)(2)(ii)(B)).
• Have a reasonable basis to believe that a series of recommended transactions, even if in the retail customer's best interest when viewed in isolation, is not excessive and is in the retail customer's best interest when taken together in light of the customer's investment profile (Rule 15l-1(a)(2)(ii)(C)).
• If you are a broker or dealer, establish, maintain, and enforce written policies and procedures reasonably designed to identify and at a minimum disclose, or eliminate, all conflicts of interest associated with recommendations, and to identify and mitigate those that create an incentive for an associated person to place the interest of the broker, dealer, or associated person ahead of the interest of the retail customer (Rule 15l-1(a)(2)(iii)(A) and (B)).
• Identify and disclose any material limitations placed on the securities or investment strategies that may be recommended to a retail customer and any conflicts of interest associated with those limitations, and prevent them from causing recommendations that place the interest of the broker, dealer, or associated person ahead of the retail customer's interest (Rule 15l-1(a)(2)(iii)(C)).
• Identify and eliminate any sales contests, sales quotas, bonuses, and non-cash compensation that are based on the sales of specific securities or specific types of securities within a limited period of time (Rule 15l-1(a)(2)(iii)(D)).
• Establish, maintain, and enforce, in addition to those policies and procedures, written policies and procedures reasonably designed to achieve compliance with Regulation Best Interest (Rule 15l-1(a)(2)(iv)).

12 CFR Part 53 (OCC); 12 CFR Part 225, Subpart N (Federal Reserve Board); 12 CFR Part 304, Subpart C (FDIC) · Read the law's page

• This instrument reaches your organization only if it is a banking organization under this rule, meaning a national bank, Federal savings association, or Federal branch or agency of a foreign bank; a bank holding company, savings and loan holding company, state member bank, the United States operations of a foreign banking organization, or an Edge or agreement corporation; or an insured state nonmember bank, insured state licensed branch of a foreign bank, or insured State savings association, or if it is a bank service provider that performs services for one of them under the Bank Service Company Act. Declare provides_financial_services where either role holds; no activity stands in for either role, and a designated financial market utility is excluded from both.
• If your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred. A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock.when it serves a financial business
• If your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more. This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within.for a supplier to a financial business
• This bank service provider duty does not apply to scheduled maintenance, testing, or a software update you already communicated to the banking organization customer.for a supplier to a financial business

17 CFR 240.17a-4 · Read the law's page

• It reaches you if you are a member of a national securities exchange that transacts a business in securities directly with others than members of a national securities exchange, a broker or dealer that transacts a business in securities through the medium of such a member, or a broker or dealer registered under section 15 of the Exchange Act (including a security-based swap dealer or major security-based swap participant that is also a registered broker or dealer): preserve for not less than six years, the first two years in an easily accessible place, the records Rule 17a-3(a)(1) through (3), (5), (21) and (22) require, and analogous records created under Rule 17a-3(e) (Rule 17a-4(a)).
• Preserve for not less than three years, the first two years in an easily accessible place, the originals of all communications received and copies of all communications sent (and any approvals thereof) relating to your business as such, including inter-office memoranda and communications and communications subject to the rules of a self-regulatory organization of which you are a member regarding communications with the public (Rule 17a-4(b)(4)).
• Preserve for not less than three years, the first two years in an easily accessible place, the other records Rule 17a-4(b) lists, among them check books, bank statements, cancelled checks and cash reconciliations, bills receivable or payable, written agreements entered into relating to your business, and records of discretionary authority given in respect of any account (Rule 17a-4(b)(2), (3), (6) and (7)).
• Preserve account cards and records that relate to the terms and conditions of opening and maintaining a customer's account for not less than six years after the account is closed (Rule 17a-4(c)).
• If you keep records on an electronic recordkeeping system, use one that either preserves a record for the duration of its retention period with a complete time-stamped audit trail (all modifications to and deletions of the record, the date and time of actions that create, modify, or delete it, and, if applicable, the identity of the individual who did so) or preserves the records exclusively in a non-rewriteable, non-erasable format (Rule 17a-4(f)(2)(i)).
• Make the system verify automatically the completeness and accuracy of the processes for storing and retaining records electronically, and give it the capacity to readily download and transfer copies of a record and its audit trail (if applicable) in a human readable format and in a reasonably usable electronic format (Rule 17a-4(f)(2)(ii) and (iv)).
• Include a backup electronic recordkeeping system that serves as a redundant set of records, or other redundancy capabilities designed to ensure access to the records (Rule 17a-4(f)(2)(v)).
• At all times have available for examination by the staffs of the Commission, the self-regulatory organizations of which you are a member, and any State securities regulator having jurisdiction facilities for immediately producing the records preserved on the system and for producing copies of them, and be ready to provide immediately any record they request (Rule 17a-4(f)(3)(i) and (ii)).
• At all times have filed with your designated examining authority the undertakings Rule 17a-4(f)(3)(v) sets out, signed by a designated executive officer or a designated third party, to furnish the records promptly on request and to download them in a usable format if you fail to (Rule 17a-4(f)(3)(v)).
• If an outside service bureau, depository, bank, or other recordkeeping service prepares or maintains your records, make sure that entity files with the Commission the written undertaking Rule 17a-4(i) requires; the agreement does not relieve you of the responsibility to prepare and maintain the records (Rule 17a-4(i)).
• Furnish promptly to a representative of the Commission legible, true, complete, and current copies of the records required to be preserved under Rule 17a-4, or any other records subject to examination under section 17(b) of the Exchange Act that are requested, and furnish a record and its audit trail (if applicable) in a reasonably usable electronic format if requested (Rule 17a-4(j)).

NCUA Cyber Incident Notification Requirements, 12 CFR 748.1(c) · Read the law's page

• This instrument reaches your organization only if it is a federally insured credit union. Declare is_bank where that holds; a credit union that is not federally insured is outside this paragraph.
• If your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident.
• Where the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner.
• A cyber incident performed in good faith by an entity in response to a specific request by the owner or operators of the system is not a reportable cyber incident.

16 CFR Section 314.4(j) · Read the law's page

• Notify the FTC within 30 days of discovering a security event that has compromised unencrypted customer information for 500 or more consumers.when it serves a financial business

12 CFR Part 1033 · Read the law's page

• If you are a data provider (a financial institution, a card issuer, or any other person that controls or possesses information about a Regulation E account, a Regulation Z credit card, or the facilitation of payments from either), make covered data available on request to the consumer and to an authorized third party in an electronic form they can use, including the most recently updated data you hold and information about authorized transactions not yet settled (12 CFR 1033.111, 1033.201(a), (b)).
• Maintain a consumer interface and a developer interface, make covered data available in a machine-readable file on request, and impose no fee or charge on a consumer or an authorized third party for the interfaces or for requests (12 CFR 1033.301(a) to (c)).
• Take no action with the intent of evading the rule, and no action you know or should know is likely to render covered data unusable or to prevent, interfere with, or materially discourage a consumer or authorized third party from accessing it (12 CFR 1033.201(a)(2)).
• If you are a third party seeking access to covered data on a consumer's behalf, give the consumer an authorization disclosure that is clear, conspicuous and segregated from other material, certify in it that you agree to the third party obligations, and obtain the consumer's express informed consent, signed electronically or in writing (12 CFR 1033.401, 1033.411).
• Limit your collection, use and retention of covered data to what is reasonably necessary to provide the consumer's requested product or service; targeted advertising, cross-selling of other products or services, and the sale of covered data are not reasonably necessary (12 CFR 1033.421(a)).
• Stop collecting covered data one year after the consumer's most recent authorization unless the consumer gives a new authorization no later than the anniversary of the most recent one (12 CFR 1033.421(b)).
• Apply to your systems for the collection, use and retention of covered data an information security program that satisfies the Gramm-Leach-Bliley Act safeguards rules or, if you are not subject to them, the Federal Trade Commission's Standards for Safeguarding Customer Information, 16 CFR part 314 (12 CFR 1033.421(e)).
• Give the consumer a method to revoke your authorization that is as easy to access and operate as the initial authorization, and notify the data provider, any data aggregator and other third parties holding the consumer's covered data when you receive a revocation request (12 CFR 1033.421(h)).

17 CFR 248.30(a)(3) to (a)(5) · Read the law's page

• This binds a covered institution: a broker or dealer, an investment company, or an investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency (17 CFR 248.30(d)(3)).
• Maintain, within your written safeguarding policies and procedures, a response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, with procedures to assess the nature and scope of an incident, to contain and control it, and to notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization (17 CFR 248.30(a)(3)).
• Give a clear and conspicuous notice, by a means designed to ensure each affected individual can reasonably be expected to receive actual notice in writing, to each individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless you determine after a reasonable investigation that it has not been and is not reasonably likely to be used in a manner that would result in substantial harm or inconvenience (17 CFR 248.30(a)(4)(i)).
• Send the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, delaying it only for the period the United States Attorney General specifies where the Attorney General determines that notice poses a substantial risk to national security or public safety (17 CFR 248.30(a)(4)(iii)).
• Describe in the notice, in general terms, the incident and the type of sensitive customer information involved, and include the other contents paragraph (a)(4)(iv) lists, among them contact information, an explanation of fraud alerts and of how to obtain a free credit report, and the availability of Federal Trade Commission guidance on identity theft (17 CFR 248.30(a)(4)(iv)).
• Maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including that a service provider notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains (17 CFR 248.30(a)(5)(i)).
• Ensure that affected individuals are notified even where a service provider acts for you; the obligation rests with you (17 CFR 248.30(a)(5)(iii)).

Pub. L. 119-36 (Homebuyers Privacy Protection Act), adding 15 U.S.C. 1681b(c)(4) · Read the law's page

• If you are a consumer reporting agency, do not furnish a consumer report to another person on the strength of a request made in connection with a credit transaction involving a residential mortgage loan unless the transaction consists of a firm offer of credit or insurance and that person has certified its authorization from the consumer, or has originated or services a current residential mortgage loan of the consumer, or is an insured depository institution or credit union holding a current account for the consumer (15 U.S.C. 1681b(c)(4)).

12 CFR §§ 1002.4(b), 1002.6(a) and 1002.8(b)(3) and (4), as amended by 91 FR 21620 (Apr. 22, 2026) · Read the law's page

• Do not use information you obtain in evaluating a credit application to discriminate against the applicant on a prohibited basis; otherwise you may consider any information obtained (12 CFR 1002.6(a)).
• Do not design or apply a facially neutral criterion as a proxy for a protected characteristic with the intention of advantaging or disadvantaging individuals based on that characteristic (Supplement I to part 1002, comment 6(a)-2).
• Do not make any oral or written statement, in advertising or otherwise, directed at applicants or prospective applicants that you know or should know would cause a reasonable person to believe that you would deny, or would grant on less favorable terms, a credit application because of a prohibited basis characteristic; spoken or written words and visual images such as symbols, photographs, or videos are statements (12 CFR 1002.4(b)).
• You may direct statements at one group of consumers encouraging that group to apply for credit (Supplement I to part 1002, comment 4(b)-1).
• If you offer a special purpose credit program described in 12 CFR 1002.8(a)(3), do not use the applicant's race, color, national origin, or sex, or any combination of them, as a common characteristic or factor in determining eligibility for the program (12 CFR 1002.8(b)(3)).
• If such a program requires participants to share a characteristic that would otherwise be a prohibited basis, provide evidence for each participant who receives credit through the program that in the absence of the program the participant would not receive such credit as a result of those specific characteristics (12 CFR 1002.8(b)(4)).

15 U.S.C. 1681 et seq. · Read the law's page

• If you assemble or evaluate consumer information to furnish consumer reports to third parties, furnish a consumer report only under the circumstances section 1681b(a) lists, and follow reasonable procedures to assure maximum possible accuracy of the information in it.
• If you are a consumer reporting agency, disclose to a consumer on request the information in the consumer's file, and when the consumer disputes an item, conduct a reasonable reinvestigation free of charge before the end of the 30-day period that begins when you receive the notice, which extends by not more than 15 additional days if you receive relevant information from the consumer during that period.
• If you use or obtain a consumer report, do so only for a purpose section 1681b authorizes and certify that purpose; before procuring a report for employment purposes, make a clear and conspicuous written disclosure in a document that consists solely of the disclosure and get the consumer's written authorization, unless the transportation-applicant procedure in section 1681b(b)(2)(B) applies.
• If you use a consumer report for employment purposes and intend to take adverse action based on it, first give the consumer a copy of the report and a written description of the consumer's rights under the Act, unless the transportation-applicant procedure in section 1681b(b)(3)(B) applies.
• If you take adverse action based in whole or in part on a consumer report, give the consumer notice of the action, disclosure of any numerical credit score you used in taking it, the name, address and telephone number of the agency that furnished the report, a statement that the agency did not make the decision, and notice of the consumer's right to a free copy of the report and to dispute its accuracy.
• If you furnish information to a consumer reporting agency, do not furnish information you know or have reasonable cause to believe is inaccurate, and when the agency notifies you of a dispute, investigate, report the results, and modify, delete or permanently block an item found inaccurate, incomplete or unverifiable.
• Applies to a consumer reporting agency, to a person that uses a consumer report, and to a person that furnishes information to a consumer reporting agency; a consumer report is a communication of information bearing on a consumer's credit worthiness, character or mode of living that is used as a factor in eligibility for credit, insurance, employment or another purpose section 1681b authorizes.

15 U.S.C. § 80b-6 · Read the law's page

• It reaches you if you are an investment adviser, meaning any person who, for compensation, engages in the business of advising others, either directly or through publications or writings, as to the value of securities or as to the advisability of investing in, purchasing, or selling securities (subject to the exclusions in section 202(a)(11) of the Advisers Act): do not use the mails or any means or instrumentality of interstate commerce, directly or indirectly, to employ any device, scheme, or artifice to defraud any client or prospective client (section 206(1)).
• Do not engage in any transaction, practice, or course of business which operates as a fraud or deceit upon any client or prospective client (section 206(2)).
• Before completing a transaction in which you act as principal for your own account and knowingly sell a security to or purchase a security from a client, or act as broker for a person other than the client and knowingly effect a sale or purchase for the client's account, disclose to the client in writing the capacity in which you are acting and obtain the client's consent; this does not apply to a transaction with a customer of a broker or dealer that is not acting as an investment adviser in relation to the transaction (section 206(3)).
• Do not engage in any act, practice, or course of business which is fraudulent, deceptive, or manipulative, as the Commission defines such acts, practices, and courses of business by rule (section 206(4)).

SEC Regulation S-P safeguards policies and incident response programs, 17 CFR 248.30(a)(1) to (a)(3) · Read the law's page

• This instrument reaches your organization only if it is a covered institution: a broker or dealer, an investment company, or an investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. Declare is_securities_firm where that holds. Larger entities had to comply 18 months after the amendments were published in the Federal Register on June 3, 2024, and smaller entities 24 months after.
• Develop, implement, and maintain written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information, reasonably designed to ensure its security and confidentiality, protect against anticipated threats or hazards to its security or integrity, and protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.
• Include in those policies and procedures a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures.
• Make the response program include procedures to assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the systems and types of customer information affected, and to take appropriate steps to contain and control the incident to prevent further unauthorized access or use.
• Make the response program include procedures to notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless you determine after a reasonable investigation that the information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

SEC Regulation S-P service provider oversight and notice, 17 CFR 248.30(a)(5) · Read the law's page

• This instrument reaches your organization only if it is a covered institution: a broker or dealer, an investment company, or an investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. Declare is_securities_firm where that holds. Larger entities had to comply 18 months after the amendments were published in the Federal Register on June 3, 2024, and smaller entities 24 months after.
• Make your incident response program include written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of your service providers, including to ensure that affected individuals are notified.
• Make those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
• Initiate your incident response program upon receipt of a service provider's notification.
• You may enter into a written agreement with a service provider to notify affected individuals on your behalf, but the obligation to ensure that affected individuals are notified rests with you.