Is a securities firm, in the United States

FTC Safeguards Rule, 16 CFR 314.1 to 314.4(i) and 314.6 · Read the law's page

• This instrument reaches your organization only if it is a financial institution over which the Federal Trade Commission has jurisdiction: an entity whose business is an activity that is financial in nature or incidental to such an activity and that is not subject to another regulator's enforcement authority under the Gramm-Leach-Bliley Act, such as a mortgage lender, mortgage broker, finance company, payday lender, account servicer, check casher, collection agency or tax preparation firm. Declare provides_financial_services where that holds; a bank or federally insured credit union answers to its own regulator's standards instead.
• Develop, implement, and maintain a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of the customer information at issue.
• Designate a Qualified Individual responsible for overseeing, implementing and enforcing the program, and base the program on a written risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, reassessed periodically.
• Implement access controls, identify and manage the data, personnel, devices, systems and facilities that matter to your business, encrypt customer information in transit over external networks and at rest unless your Qualified Individual approves effective alternative compensating controls, adopt secure development practices, and implement multi-factor authentication for any individual accessing any information system unless your Qualified Individual approves in writing a reasonably equivalent or more secure control.
• Monitor and log the activity of authorized users, and regularly test the effectiveness of the safeguards' key controls, systems, and procedures: absent effective continuous monitoring, conduct annual penetration testing and vulnerability assessments at least every six months and whenever material changes occur.
• Provide security awareness training, use qualified information security personnel, oversee service providers by selecting capable ones, requiring safeguards by contract and periodically assessing them, and evaluate and adjust the program in light of testing, material changes and risk assessments.
• Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in your control, and have your Qualified Individual report in writing at least annually to your board of directors or equivalent governing body.
• If you maintain customer information concerning fewer than five thousand consumers, the written risk assessment requirement of section 314.4(b)(1), the testing requirement of section 314.4(d)(2), the written incident response plan of section 314.4(h) and the board reporting of section 314.4(i) do not apply to you.

FINRA Rule 4511 · Read the law's page

• It reaches you if you are a FINRA member firm or a person associated with one, because FINRA may sanction either for a violation of a FINRA rule (Rule 8310(a)): make and preserve the books and records the FINRA rules, the Exchange Act and the applicable Exchange Act rules require (Rule 4511(a)).
• Preserve for at least six years any FINRA book or record for which neither the FINRA rules nor the applicable Exchange Act rules specify a period (Rule 4511(b)).
• Preserve every book and record the FINRA rules require you to make in a format and media that complies with SEA Rule 17a-4 (Rule 4511(c)).

FINRA Rule 2210 · Read the law's page

• It reaches you if you are a FINRA member firm or a person associated with one, because FINRA may sanction either for a violation of a FINRA rule (Rule 8310(a)): have an appropriately qualified registered principal approve each retail communication before the earlier of its use or its filing with FINRA's Advertising Regulation Department, unless an exception in Rule 2210(b)(1) applies (Rule 2210(b)(1)(A)).
• Base every communication on principles of fair dealing and good faith, make it fair and balanced, and give it a sound basis for evaluating the facts about any particular security or type of security, industry, or service; do not omit a material fact or qualification if the omission, in light of the context of the material presented, would cause the communication to be misleading (Rule 2210(d)(1)(A)).
• Do not make a false, exaggerated, unwarranted, promissory or misleading statement or claim in any communication, and do not publish, circulate or distribute a communication you know or have reason to know contains an untrue statement of a material fact or is otherwise false or misleading (Rule 2210(d)(1)(B)).
• Do not predict or project performance, imply that past performance will recur, or make an exaggerated or unwarranted claim, opinion or forecast in a communication, other than as Rule 2210(d)(1)(F) permits (Rule 2210(d)(1)(F)).
• Prominently disclose your name in every retail communication and in correspondence (Rule 2210(d)(3)).
• Supervise and review correspondence under Rule 3110(b) and Supplementary Material .06 through .09 to that Rule, and establish written procedures, appropriate to your business, size, structure, and customers, for review by an appropriately qualified registered principal of the institutional communications you and your associated persons use (Rule 2210(b)(2) and (b)(3)).
• Maintain every retail communication and institutional communication for the retention period SEA Rule 17a-4(b) requires and in a format and media that comply with SEA Rule 17a-4, with a copy, the dates of first and last use, the name of any approving registered principal and the date of approval, and the other records Rule 2210(b)(4)(A) lists (Rule 2210(b)(4)(A)).

17 CFR 162.30 · Read the law's page

• This binds a financial institution or creditor subject to administrative enforcement of the Fair Credit Reporting Act by the Commodity Futures Trading Commission, which includes a futures commission merchant, retail foreign exchange dealer, commodity trading advisor, commodity pool operator, introducing broker, swap dealer or major swap participant that directly or indirectly holds a transaction account belonging to a consumer (17 CFR 162.30(a) and (b)(7)).
• Periodically determine whether you offer or maintain covered accounts, conducting a risk assessment that considers the methods you provide to open your accounts, the methods you provide to access them, and your previous experiences with identity theft (17 CFR 162.30(c)).
• If you offer or maintain one or more covered accounts, develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account, appropriate to your size and complexity and the nature and scope of your activities (17 CFR 162.30(d)(1)).
• Include in the program reasonable policies and procedures to identify relevant Red Flags, detect them, respond appropriately to them, and update the program periodically (17 CFR 162.30(d)(2)).
• Obtain approval of the initial written program from your board of directors or an appropriate committee, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements (17 CFR 162.30(e)).
• Consider the guidelines in the appendix to the subpart and include in the program those that are appropriate (17 CFR 162.30(f)).

17 CFR 248.201 · Read the law's page

• This binds a financial institution or creditor that is a broker, dealer or other person registered or required to be registered under the Securities Exchange Act of 1934, an investment company registered or required to be registered under the Investment Company Act of 1940, or an investment adviser registered or required to be registered under the Investment Advisers Act of 1940 (17 CFR 248.201(a)).
• Periodically determine whether you offer or maintain covered accounts, conducting a risk assessment that considers the methods you provide to open your accounts, the methods you provide to access them, and your previous experiences with identity theft (17 CFR 248.201(c)).
• If you offer or maintain one or more covered accounts, develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account, appropriate to your size and complexity and the nature and scope of your activities (17 CFR 248.201(d)(1)).
• Include in the program reasonable policies and procedures to identify relevant Red Flags, detect them, respond appropriately to them, and update the program periodically (17 CFR 248.201(d)(2)).
• Obtain approval of the initial written program from your board of directors or an appropriate committee, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements (17 CFR 248.201(e)).
• Consider the guidelines in the appendix to the subpart and include in the program those that are appropriate (17 CFR 248.201(f)).

FINRA Rule 3110 · Read the law's page

• It reaches you if you are a FINRA member firm or a person associated with one, because FINRA may sanction either for a violation of a FINRA rule (Rule 8310(a)): establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance with applicable securities laws and regulations and with applicable FINRA rules; final responsibility for proper supervision rests with the member (Rule 3110(a)).
• Establish, maintain, and enforce written procedures to supervise the types of business in which you engage and the activities of your associated persons, reasonably designed to achieve compliance with applicable securities laws and regulations and with applicable FINRA rules (Rule 3110(b)(1)).
• Include in those procedures a review of incoming and outgoing written (including electronic) correspondence and internal communications relating to your investment banking or securities business, appropriate for your business, size, structure, and customers; a registered principal must conduct the review and evidence it in writing, and merely opening a communication is not sufficient review (Rule 3110(b)(4) and Supplementary Material .07).
• Have a registered principal review all transactions relating to your investment banking or securities business, evidenced in writing; a reasonably designed risk-based review system may be used in place of a detailed review of each transaction (Rule 3110(b)(2) and Supplementary Material .05).
• Retain the internal communications and correspondence of associated persons relating to your investment banking or securities business for the period and with the accessibility SEA Rule 17a-4(b) specifies, keeping the names of the persons who prepared and who reviewed outgoing correspondence ascertainable from the retained records (Supplementary Material .09).
• Promptly amend your written supervisory procedures to reflect changes in applicable securities laws or regulations, including FINRA rules, and as changes occur in your supervisory system, and promptly communicate the procedures and amendments to the associated persons they concern (Rule 3110(b)(7)).
• Review the businesses in which you engage at least annually (on a calendar-year basis), inspect every office of supervisory jurisdiction annually, and reduce each inspection to a written report kept on file for a minimum of three years (or, for a non-branch location inspected less often than every three years, until the next inspection report is written) (Rule 3110(c)(1) and (c)(2)).

SEC Regulation SCI SCI event notices, 17 CFR 242.1002(b) and (c) · Read the law's page

• This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
• Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
• Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
• Until the SCI event is resolved and your investigation is closed, provide updates to the Commission on a regular basis, or at the frequency the Commission reasonably requests, to correct materially incorrect information or when new material information is discovered.
• If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
• For an SCI event with no or a de minimis impact, keep records and submit a quarterly report within 30 calendar days after the end of each calendar quarter summarizing the systems disruptions and systems intrusions.
• Promptly after responsible SCI personnel conclude that an SCI event that is a systems disruption or systems compliance issue has occurred, disseminate the affected systems and a summary description to the members or participants who may have been affected, and to all members or participants for a major SCI event. For a systems intrusion, disseminate a summary description and the corrective action taken unless you determine and document that dissemination would likely compromise security or an investigation.

SEC Regulation SCI policies and procedures, 17 CFR 242.1000 and 242.1001 · Read the law's page

• This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
• Establish, maintain, and enforce written policies and procedures reasonably designed to ensure that your SCI systems and, for security standards, your indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain your operational capability and promote fair and orderly markets.
• Include in those policies and procedures, at a minimum, regular reviews and testing of the systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters, and monitoring of the systems to identify potential SCI events.
• Include business continuity and disaster recovery plans reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption.
• Periodically review the effectiveness of the policies and procedures and take prompt action to remedy deficiencies. Policies and procedures consistent with current SCI industry standards are deemed reasonably designed, though compliance with those standards is not the exclusive means to comply.

CFTC system safeguards notices, 17 CFR 39.18(g), 38.1051(e) and 37.1401(e) · Read the law's page

• This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
• If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
• If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
• If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
• Give timely advance notice of material planned changes to automated systems that may impact their reliability, security, or capacity, and of material planned changes to your program of risk analysis and oversight.

CFTC system safeguards, 17 CFR 39.18, 38.1051 and 37.1401 · Read the law's page

• This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
• If your organization is a derivatives clearing organization, establish and maintain a program of risk analysis and oversight with respect to your operations and automated systems that identifies and minimizes sources of operational risk, and that addresses information security, business continuity and disaster recovery, capacity and performance planning, systems operations, systems development and quality assurance, and physical security and environmental controls.
• If your organization is a derivatives clearing organization, follow generally accepted standards and industry best practices with respect to the development, operation, reliability, security, and capacity of automated systems, and maintain a business continuity and disaster recovery plan with a recovery time objective of no later than the next business day following a disruption.
• If your organization is a designated contract market or a swap execution facility, maintain a program of risk analysis and oversight with respect to your operations and automated systems that addresses each category of risk analysis and oversight the rule lists, beginning with enterprise risk management and governance and information security.
• If your organization is a designated contract market or a swap execution facility, conduct regular, periodic, objective testing and review of your automated systems to ensure that they are reliable, secure, and have adequate scalable capacity, and regular, periodic testing and review of your business continuity-disaster recovery capabilities.

17 CFR 240.15l-1 · Read the law's page

• It reaches you if you are a broker, a dealer, or a natural person who is an associated person of a broker or dealer and you make a recommendation of any securities transaction or investment strategy involving securities (including account recommendations) to a retail customer, meaning a natural person (or that person's legal representative) who uses the recommendation primarily for personal, family, or household purposes: act in the best interest of the retail customer at the time the recommendation is made, without placing your financial or other interest ahead of the interest of the retail customer (Rule 15l-1(a)(1)).
• Provide the retail customer, prior to or at the time of the recommendation, in writing, full and fair disclosure of all material facts relating to the scope and terms of the relationship (that you act as a broker, dealer, or associated person with respect to the recommendation, the material fees and costs that apply, and the type and scope of services, including any material limitations on what may be recommended) and of all material facts relating to conflicts of interest associated with the recommendation (Rule 15l-1(a)(2)(i)).
• In making the recommendation, exercise reasonable diligence, care, and skill to understand the potential risks, rewards, and costs associated with it and have a reasonable basis to believe that it could be in the best interest of at least some retail customers (Rule 15l-1(a)(2)(ii)(A)).
• Have a reasonable basis to believe that the recommendation is in the best interest of the particular retail customer based on that customer's investment profile and the potential risks, rewards, and costs associated with the recommendation, and that it does not place your financial or other interest ahead of the customer's interest (Rule 15l-1(a)(2)(ii)(B)).
• Have a reasonable basis to believe that a series of recommended transactions, even if in the retail customer's best interest when viewed in isolation, is not excessive and is in the retail customer's best interest when taken together in light of the customer's investment profile (Rule 15l-1(a)(2)(ii)(C)).
• If you are a broker or dealer, establish, maintain, and enforce written policies and procedures reasonably designed to identify and at a minimum disclose, or eliminate, all conflicts of interest associated with recommendations, and to identify and mitigate those that create an incentive for an associated person to place the interest of the broker, dealer, or associated person ahead of the interest of the retail customer (Rule 15l-1(a)(2)(iii)(A) and (B)).
• Identify and disclose any material limitations placed on the securities or investment strategies that may be recommended to a retail customer and any conflicts of interest associated with those limitations, and prevent them from causing recommendations that place the interest of the broker, dealer, or associated person ahead of the retail customer's interest (Rule 15l-1(a)(2)(iii)(C)).
• Identify and eliminate any sales contests, sales quotas, bonuses, and non-cash compensation that are based on the sales of specific securities or specific types of securities within a limited period of time (Rule 15l-1(a)(2)(iii)(D)).
• Establish, maintain, and enforce, in addition to those policies and procedures, written policies and procedures reasonably designed to achieve compliance with Regulation Best Interest (Rule 15l-1(a)(2)(iv)).

17 CFR 240.17a-4 · Read the law's page

• It reaches you if you are a member of a national securities exchange that transacts a business in securities directly with others than members of a national securities exchange, a broker or dealer that transacts a business in securities through the medium of such a member, or a broker or dealer registered under section 15 of the Exchange Act (including a security-based swap dealer or major security-based swap participant that is also a registered broker or dealer): preserve for not less than six years, the first two years in an easily accessible place, the records Rule 17a-3(a)(1) through (3), (5), (21) and (22) require, and analogous records created under Rule 17a-3(e) (Rule 17a-4(a)).
• Preserve for not less than three years, the first two years in an easily accessible place, the originals of all communications received and copies of all communications sent (and any approvals thereof) relating to your business as such, including inter-office memoranda and communications and communications subject to the rules of a self-regulatory organization of which you are a member regarding communications with the public (Rule 17a-4(b)(4)).
• Preserve for not less than three years, the first two years in an easily accessible place, the other records Rule 17a-4(b) lists, among them check books, bank statements, cancelled checks and cash reconciliations, bills receivable or payable, written agreements entered into relating to your business, and records of discretionary authority given in respect of any account (Rule 17a-4(b)(2), (3), (6) and (7)).
• Preserve account cards and records that relate to the terms and conditions of opening and maintaining a customer's account for not less than six years after the account is closed (Rule 17a-4(c)).
• If you keep records on an electronic recordkeeping system, use one that either preserves a record for the duration of its retention period with a complete time-stamped audit trail (all modifications to and deletions of the record, the date and time of actions that create, modify, or delete it, and, if applicable, the identity of the individual who did so) or preserves the records exclusively in a non-rewriteable, non-erasable format (Rule 17a-4(f)(2)(i)).
• Make the system verify automatically the completeness and accuracy of the processes for storing and retaining records electronically, and give it the capacity to readily download and transfer copies of a record and its audit trail (if applicable) in a human readable format and in a reasonably usable electronic format (Rule 17a-4(f)(2)(ii) and (iv)).
• Include a backup electronic recordkeeping system that serves as a redundant set of records, or other redundancy capabilities designed to ensure access to the records (Rule 17a-4(f)(2)(v)).
• At all times have available for examination by the staffs of the Commission, the self-regulatory organizations of which you are a member, and any State securities regulator having jurisdiction facilities for immediately producing the records preserved on the system and for producing copies of them, and be ready to provide immediately any record they request (Rule 17a-4(f)(3)(i) and (ii)).
• At all times have filed with your designated examining authority the undertakings Rule 17a-4(f)(3)(v) sets out, signed by a designated executive officer or a designated third party, to furnish the records promptly on request and to download them in a usable format if you fail to (Rule 17a-4(f)(3)(v)).
• If an outside service bureau, depository, bank, or other recordkeeping service prepares or maintains your records, make sure that entity files with the Commission the written undertaking Rule 17a-4(i) requires; the agreement does not relieve you of the responsibility to prepare and maintain the records (Rule 17a-4(i)).
• Furnish promptly to a representative of the Commission legible, true, complete, and current copies of the records required to be preserved under Rule 17a-4, or any other records subject to examination under section 17(b) of the Exchange Act that are requested, and furnish a record and its audit trail (if applicable) in a reasonably usable electronic format if requested (Rule 17a-4(j)).

16 CFR Section 314.4(j) · Read the law's page

• Notify the FTC within 30 days of discovering a security event that has compromised unencrypted customer information for 500 or more consumers.when it serves a financial business

17 CFR 248.30(a)(3) to (a)(5) · Read the law's page

• This binds a covered institution: a broker or dealer, an investment company, or an investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency (17 CFR 248.30(d)(3)).
• Maintain, within your written safeguarding policies and procedures, a response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, with procedures to assess the nature and scope of an incident, to contain and control it, and to notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization (17 CFR 248.30(a)(3)).
• Give a clear and conspicuous notice, by a means designed to ensure each affected individual can reasonably be expected to receive actual notice in writing, to each individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless you determine after a reasonable investigation that it has not been and is not reasonably likely to be used in a manner that would result in substantial harm or inconvenience (17 CFR 248.30(a)(4)(i)).
• Send the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, delaying it only for the period the United States Attorney General specifies where the Attorney General determines that notice poses a substantial risk to national security or public safety (17 CFR 248.30(a)(4)(iii)).
• Describe in the notice, in general terms, the incident and the type of sensitive customer information involved, and include the other contents paragraph (a)(4)(iv) lists, among them contact information, an explanation of fraud alerts and of how to obtain a free credit report, and the availability of Federal Trade Commission guidance on identity theft (17 CFR 248.30(a)(4)(iv)).
• Maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including that a service provider notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains (17 CFR 248.30(a)(5)(i)).
• Ensure that affected individuals are notified even where a service provider acts for you; the obligation rests with you (17 CFR 248.30(a)(5)(iii)).

Pub. L. 119-36 (Homebuyers Privacy Protection Act), adding 15 U.S.C. 1681b(c)(4) · Read the law's page

• If you are a consumer reporting agency, do not furnish a consumer report to another person on the strength of a request made in connection with a credit transaction involving a residential mortgage loan unless the transaction consists of a firm offer of credit or insurance and that person has certified its authorization from the consumer, or has originated or services a current residential mortgage loan of the consumer, or is an insured depository institution or credit union holding a current account for the consumer (15 U.S.C. 1681b(c)(4)).

15 U.S.C. 1681 et seq. · Read the law's page

• If you assemble or evaluate consumer information to furnish consumer reports to third parties, furnish a consumer report only under the circumstances section 1681b(a) lists, and follow reasonable procedures to assure maximum possible accuracy of the information in it.
• If you are a consumer reporting agency, disclose to a consumer on request the information in the consumer's file, and when the consumer disputes an item, conduct a reasonable reinvestigation free of charge before the end of the 30-day period that begins when you receive the notice, which extends by not more than 15 additional days if you receive relevant information from the consumer during that period.
• If you use or obtain a consumer report, do so only for a purpose section 1681b authorizes and certify that purpose; before procuring a report for employment purposes, make a clear and conspicuous written disclosure in a document that consists solely of the disclosure and get the consumer's written authorization, unless the transportation-applicant procedure in section 1681b(b)(2)(B) applies.
• If you use a consumer report for employment purposes and intend to take adverse action based on it, first give the consumer a copy of the report and a written description of the consumer's rights under the Act, unless the transportation-applicant procedure in section 1681b(b)(3)(B) applies.
• If you take adverse action based in whole or in part on a consumer report, give the consumer notice of the action, disclosure of any numerical credit score you used in taking it, the name, address and telephone number of the agency that furnished the report, a statement that the agency did not make the decision, and notice of the consumer's right to a free copy of the report and to dispute its accuracy.
• If you furnish information to a consumer reporting agency, do not furnish information you know or have reasonable cause to believe is inaccurate, and when the agency notifies you of a dispute, investigate, report the results, and modify, delete or permanently block an item found inaccurate, incomplete or unverifiable.
• Applies to a consumer reporting agency, to a person that uses a consumer report, and to a person that furnishes information to a consumer reporting agency; a consumer report is a communication of information bearing on a consumer's credit worthiness, character or mode of living that is used as a factor in eligibility for credit, insurance, employment or another purpose section 1681b authorizes.

15 U.S.C. § 80b-6 · Read the law's page

• It reaches you if you are an investment adviser, meaning any person who, for compensation, engages in the business of advising others, either directly or through publications or writings, as to the value of securities or as to the advisability of investing in, purchasing, or selling securities (subject to the exclusions in section 202(a)(11) of the Advisers Act): do not use the mails or any means or instrumentality of interstate commerce, directly or indirectly, to employ any device, scheme, or artifice to defraud any client or prospective client (section 206(1)).
• Do not engage in any transaction, practice, or course of business which operates as a fraud or deceit upon any client or prospective client (section 206(2)).
• Before completing a transaction in which you act as principal for your own account and knowingly sell a security to or purchase a security from a client, or act as broker for a person other than the client and knowingly effect a sale or purchase for the client's account, disclose to the client in writing the capacity in which you are acting and obtain the client's consent; this does not apply to a transaction with a customer of a broker or dealer that is not acting as an investment adviser in relation to the transaction (section 206(3)).
• Do not engage in any act, practice, or course of business which is fraudulent, deceptive, or manipulative, as the Commission defines such acts, practices, and courses of business by rule (section 206(4)).

SEC Regulation S-P safeguards policies and incident response programs, 17 CFR 248.30(a)(1) to (a)(3) · Read the law's page

• This instrument reaches your organization only if it is a covered institution: a broker or dealer, an investment company, or an investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. Declare is_securities_firm where that holds. Larger entities had to comply 18 months after the amendments were published in the Federal Register on June 3, 2024, and smaller entities 24 months after.
• Develop, implement, and maintain written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information, reasonably designed to ensure its security and confidentiality, protect against anticipated threats or hazards to its security or integrity, and protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.
• Include in those policies and procedures a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures.
• Make the response program include procedures to assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the systems and types of customer information affected, and to take appropriate steps to contain and control the incident to prevent further unauthorized access or use.
• Make the response program include procedures to notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless you determine after a reasonable investigation that the information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

SEC Regulation S-P service provider oversight and notice, 17 CFR 248.30(a)(5) · Read the law's page

• This instrument reaches your organization only if it is a covered institution: a broker or dealer, an investment company, or an investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. Declare is_securities_firm where that holds. Larger entities had to comply 18 months after the amendments were published in the Federal Register on June 3, 2024, and smaller entities 24 months after.
• Make your incident response program include written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of your service providers, including to ensure that affected individuals are notified.
• Make those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
• Initiate your incident response program upon receipt of a service provider's notification.
• You may enter into a written agreement with a service provider to notify affected individuals on your behalf, but the obligation to ensure that affected individuals are notified rests with you.