Is a payment provider, in the United States

FTC Safeguards Rule, 16 CFR 314.1 to 314.4(i) and 314.6 · Read the law's page

• This instrument reaches your organization only if it is a financial institution over which the Federal Trade Commission has jurisdiction: an entity whose business is an activity that is financial in nature or incidental to such an activity and that is not subject to another regulator's enforcement authority under the Gramm-Leach-Bliley Act, such as a mortgage lender, mortgage broker, finance company, payday lender, account servicer, check casher, collection agency or tax preparation firm. Declare provides_financial_services where that holds; a bank or federally insured credit union answers to its own regulator's standards instead.
• Develop, implement, and maintain a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of the customer information at issue.
• Designate a Qualified Individual responsible for overseeing, implementing and enforcing the program, and base the program on a written risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, reassessed periodically.
• Implement access controls, identify and manage the data, personnel, devices, systems and facilities that matter to your business, encrypt customer information in transit over external networks and at rest unless your Qualified Individual approves effective alternative compensating controls, adopt secure development practices, and implement multi-factor authentication for any individual accessing any information system unless your Qualified Individual approves in writing a reasonably equivalent or more secure control.
• Monitor and log the activity of authorized users, and regularly test the effectiveness of the safeguards' key controls, systems, and procedures: absent effective continuous monitoring, conduct annual penetration testing and vulnerability assessments at least every six months and whenever material changes occur.
• Provide security awareness training, use qualified information security personnel, oversee service providers by selecting capable ones, requiring safeguards by contract and periodically assessing them, and evaluate and adjust the program in light of testing, material changes and risk assessments.
• Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in your control, and have your Qualified Individual report in writing at least annually to your board of directors or equivalent governing body.
• If you maintain customer information concerning fewer than five thousand consumers, the written risk assessment requirement of section 314.4(b)(1), the testing requirement of section 314.4(d)(2), the written incident response plan of section 314.4(h) and the board reporting of section 314.4(i) do not apply to you.

12 CFR 1016.4 to 1016.6, 1016.8 and 1016.9 · Read the law's page

• If you are a financial institution that Regulation P covers, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and give a consumer who is not a customer that notice before you disclose any nonpublic personal information about the consumer to a nonaffiliated third party, other than as sections 1016.14 and 1016.15 authorize.
• You may give a customer the initial notice within a reasonable time after you establish the customer relationship if establishing it is not at the customer's election, or if giving it earlier would substantially delay the customer's transaction and the customer agrees to receive it later.
• Give each customer the notice again at least once in any period of 12 consecutive months during the customer relationship, unless you provide nonpublic personal information to nonaffiliated third parties only as sections 1016.13, 1016.14 or 1016.15 allow and have not changed the disclosure policies and practices in your most recent notice.
• If you lose the annual notice exception, give an annual notice: when you were required to give a revised notice, on the annual schedule treating the revised notice as an initial notice; otherwise within 100 days of the change in your policies or practices.
• Except as otherwise authorized in the rule, do not disclose nonpublic personal information about a consumer to a nonaffiliated third party other than as described in your initial notice unless you have given a clear and conspicuous revised notice that accurately describes your policies and practices and a new opt out notice, have given a reasonable opportunity to opt out, and the consumer does not opt out; give a revised notice before you disclose a new category of information, disclose to a new category of nonaffiliated third party, or disclose information about a former customer who has not had the chance to opt out. A revised notice is not required for a new nonaffiliated third party that your prior notice adequately described.
• State in each notice the categories of nonpublic personal information you collect and disclose; the categories of affiliates and nonaffiliated third parties to which you disclose it; the categories of information about former customers you disclose and the parties you disclose it to; a separate statement of the categories of information and of third parties under contract where you disclose to a service provider or joint marketing partner without an opt out; the consumer's right to opt out and how to exercise it; any notice about opting out of affiliate sharing under the Fair Credit Reporting Act; and your policies and practices for protecting the confidentiality and security of the information. Where you disclose to third parties as sections 1016.14 and 1016.15 authorize, you need not list those exceptions; it is enough to say that you disclose to other nonaffiliated companies for your everyday business purposes, or as permitted by law.
• Deliver each notice so that each consumer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, electronically; an oral explanation alone does not meet the rule. For customers, provide the initial, annual and revised notices so that the customer can retain them or obtain them later in writing or, if the customer agrees, electronically.
• The rule reaches a financial institution, meaning an institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as section 4(k) of the Bank Holding Company Act describes; it covers only information about individuals who obtain financial products or services primarily for personal, family, or household purposes.
• The rule does not apply to certain motor vehicle dealers described in section 1029(a) of the Consumer Financial Protection Act, a financial institution or other person subject to the jurisdiction of the Commodity Futures Trading Commission under 7 U.S.C. 7b-2, a registered broker or dealer, a registered investment adviser with respect to its investment advisory activities, a registered investment company, or an insurance company with respect to its insurance activities that a state insurance regulator supervises.

12 CFR 1016.7 and 1016.10 to 1016.15 · Read the law's page

• If you are a financial institution that Regulation P covers, then, except as otherwise authorized in this part, do not, directly or through an affiliate, disclose nonpublic personal information about a consumer to a nonaffiliated third party unless you have given the consumer the initial notice and an opt out notice, have given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out; this applies whether or not the consumer is your customer.
• Give each consumer a clear and conspicuous opt out notice stating that you disclose or reserve the right to disclose nonpublic personal information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means to do so, such as check-off boxes, a reply form, an electronic means or a toll-free telephone number; requiring the consumer to write his or her own letter is not a reasonable means.
• Allow a reasonable opportunity to opt out, such as 30 days from the date you mailed the notices or, for an online account, 30 days after the customer acknowledges receipt of the notices.
• Honor an opt out for all nonpublic personal information you have collected about the consumer, whether you collected it before or after the direction to opt out.
• Comply with a consumer's opt out direction as soon as reasonably practicable after you receive it; let a consumer opt out at any time; treat the direction as effective until the consumer revokes it in writing or, if the consumer agrees, electronically; after a customer relationship ends, the direction continues to apply to the information you collected during or related to that relationship, but it does not apply to a new customer relationship.
• Do not disclose an account number or similar access number or access code for a consumer's credit card, deposit, share or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency. This does not bar disclosure to your agent or service provider solely to perform marketing for your own products or services if it is not authorized to initiate charges to the account, or to a participant in a private label credit card program or an affinity or similar program where the participants are identified to the customer when the customer enters the program. A number or code in encrypted form is not an account number if you give the recipient no means to decode it.
• To provide nonpublic personal information to a nonaffiliated third party that performs services or functions on your behalf without an opt out, give the initial notice and enter into a contract that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed it.
• The notice to a consumer who is not a customer under section 1016.4(a)(2), the opt out requirements of sections 1016.7 and 1016.10, and the service provider and joint marketing requirements of section 1016.13 do not apply when you disclose nonpublic personal information as necessary to effect, administer or enforce a transaction a consumer requests or authorizes, or in connection with servicing or processing a requested financial product or service, maintaining or servicing the consumer's account, or a proposed or actual securitization or secondary market sale (section 1016.14(a)); the notice you owe a customer under section 1016.4(a)(1) still applies.
• The same three requirements (the initial notice requirement in section 1016.4(a)(2), the opt out requirements of sections 1016.7 and 1016.10, and the service provider and joint marketing requirements of section 1016.13) also do not apply to a disclosure made with the consumer's consent or at the consumer's direction (until revoked); to protect the confidentiality or security of your records or against fraud; for required institutional risk control or to resolve consumer disputes or inquiries; to persons holding a legal or beneficial interest relating to the consumer or acting in a fiduciary or representative capacity for the consumer; to insurance rate advisory organizations, guaranty funds or agencies, agencies rating you, persons assessing your compliance with industry standards, and your attorneys, accountants and auditors; to law enforcement agencies, self-regulatory organizations and for an investigation on a matter related to public safety, to the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978; to a consumer reporting agency under the Fair Credit Reporting Act; in connection with a sale, merger, transfer or exchange of a business or operating unit that concerns solely its consumers; or to comply with law, a properly authorized investigation, subpoena or summons, or judicial process (section 1016.15(a)).
• If you receive nonpublic personal information from a nonaffiliated financial institution under an exception, disclose and use it only as section 1016.11 permits: to that institution's affiliates, to your affiliates (which may use it only as you may), and under an exception to carry out the activity covered by the exception under which you received it.
• If you receive nonpublic personal information from a nonaffiliated financial institution outside an exception, disclose it only to that institution's affiliates, to your affiliates (which may disclose it only as you may), and to any other person if the disclosure would be lawful if made directly to that person by the institution that gave it to you.
• The rule reaches a financial institution, meaning an institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as section 4(k) of the Bank Holding Company Act describes; it covers only information about individuals who obtain financial products or services primarily for personal, family, or household purposes. The rule also reaches third parties that are not financial institutions but that receive nonpublic personal information from financial institutions with whom they are not affiliated.
• The rule does not apply to certain motor vehicle dealers described in section 1029(a) of the Consumer Financial Protection Act, a financial institution or other person subject to the jurisdiction of the Commodity Futures Trading Commission under 7 U.S.C. 7b-2, a registered broker or dealer, a registered investment adviser with respect to its investment advisory activities, a registered investment company, or an insurance company with respect to its insurance activities that a state insurance regulator supervises.

17 CFR 162.30 · Read the law's page

• This binds a financial institution or creditor subject to administrative enforcement of the Fair Credit Reporting Act by the Commodity Futures Trading Commission, which includes a futures commission merchant, retail foreign exchange dealer, commodity trading advisor, commodity pool operator, introducing broker, swap dealer or major swap participant that directly or indirectly holds a transaction account belonging to a consumer (17 CFR 162.30(a) and (b)(7)).
• Periodically determine whether you offer or maintain covered accounts, conducting a risk assessment that considers the methods you provide to open your accounts, the methods you provide to access them, and your previous experiences with identity theft (17 CFR 162.30(c)).
• If you offer or maintain one or more covered accounts, develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account, appropriate to your size and complexity and the nature and scope of your activities (17 CFR 162.30(d)(1)).
• Include in the program reasonable policies and procedures to identify relevant Red Flags, detect them, respond appropriately to them, and update the program periodically (17 CFR 162.30(d)(2)).
• Obtain approval of the initial written program from your board of directors or an appropriate committee, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements (17 CFR 162.30(e)).
• Consider the guidelines in the appendix to the subpart and include in the program those that are appropriate (17 CFR 162.30(f)).

SEC Regulation SCI SCI event notices, 17 CFR 242.1002(b) and (c) · Read the law's page

• This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
• Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
• Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
• Until the SCI event is resolved and your investigation is closed, provide updates to the Commission on a regular basis, or at the frequency the Commission reasonably requests, to correct materially incorrect information or when new material information is discovered.
• If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
• For an SCI event with no or a de minimis impact, keep records and submit a quarterly report within 30 calendar days after the end of each calendar quarter summarizing the systems disruptions and systems intrusions.
• Promptly after responsible SCI personnel conclude that an SCI event that is a systems disruption or systems compliance issue has occurred, disseminate the affected systems and a summary description to the members or participants who may have been affected, and to all members or participants for a major SCI event. For a systems intrusion, disseminate a summary description and the corrective action taken unless you determine and document that dissemination would likely compromise security or an investigation.

SEC Regulation SCI policies and procedures, 17 CFR 242.1000 and 242.1001 · Read the law's page

• This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
• Establish, maintain, and enforce written policies and procedures reasonably designed to ensure that your SCI systems and, for security standards, your indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain your operational capability and promote fair and orderly markets.
• Include in those policies and procedures, at a minimum, regular reviews and testing of the systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters, and monitoring of the systems to identify potential SCI events.
• Include business continuity and disaster recovery plans reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption.
• Periodically review the effectiveness of the policies and procedures and take prompt action to remedy deficiencies. Policies and procedures consistent with current SCI industry standards are deemed reasonably designed, though compliance with those standards is not the exclusive means to comply.

CFTC system safeguards notices, 17 CFR 39.18(g), 38.1051(e) and 37.1401(e) · Read the law's page

• This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
• If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
• If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
• If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
• Give timely advance notice of material planned changes to automated systems that may impact their reliability, security, or capacity, and of material planned changes to your program of risk analysis and oversight.

CFTC system safeguards, 17 CFR 39.18, 38.1051 and 37.1401 · Read the law's page

• This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
• If your organization is a derivatives clearing organization, establish and maintain a program of risk analysis and oversight with respect to your operations and automated systems that identifies and minimizes sources of operational risk, and that addresses information security, business continuity and disaster recovery, capacity and performance planning, systems operations, systems development and quality assurance, and physical security and environmental controls.
• If your organization is a derivatives clearing organization, follow generally accepted standards and industry best practices with respect to the development, operation, reliability, security, and capacity of automated systems, and maintain a business continuity and disaster recovery plan with a recovery time objective of no later than the next business day following a disruption.
• If your organization is a designated contract market or a swap execution facility, maintain a program of risk analysis and oversight with respect to your operations and automated systems that addresses each category of risk analysis and oversight the rule lists, beginning with enterprise risk management and governance and information security.
• If your organization is a designated contract market or a swap execution facility, conduct regular, periodic, objective testing and review of your automated systems to ensure that they are reliable, secure, and have adequate scalable capacity, and regular, periodic testing and review of your business continuity-disaster recovery capabilities.

16 CFR Section 314.4(j) · Read the law's page

• Notify the FTC within 30 days of discovering a security event that has compromised unencrypted customer information for 500 or more consumers.when it serves a financial business

12 CFR Part 1033 · Read the law's page

• If you are a data provider (a financial institution, a card issuer, or any other person that controls or possesses information about a Regulation E account, a Regulation Z credit card, or the facilitation of payments from either), make covered data available on request to the consumer and to an authorized third party in an electronic form they can use, including the most recently updated data you hold and information about authorized transactions not yet settled (12 CFR 1033.111, 1033.201(a), (b)).
• Maintain a consumer interface and a developer interface, make covered data available in a machine-readable file on request, and impose no fee or charge on a consumer or an authorized third party for the interfaces or for requests (12 CFR 1033.301(a) to (c)).
• Take no action with the intent of evading the rule, and no action you know or should know is likely to render covered data unusable or to prevent, interfere with, or materially discourage a consumer or authorized third party from accessing it (12 CFR 1033.201(a)(2)).
• If you are a third party seeking access to covered data on a consumer's behalf, give the consumer an authorization disclosure that is clear, conspicuous and segregated from other material, certify in it that you agree to the third party obligations, and obtain the consumer's express informed consent, signed electronically or in writing (12 CFR 1033.401, 1033.411).
• Limit your collection, use and retention of covered data to what is reasonably necessary to provide the consumer's requested product or service; targeted advertising, cross-selling of other products or services, and the sale of covered data are not reasonably necessary (12 CFR 1033.421(a)).
• Stop collecting covered data one year after the consumer's most recent authorization unless the consumer gives a new authorization no later than the anniversary of the most recent one (12 CFR 1033.421(b)).
• Apply to your systems for the collection, use and retention of covered data an information security program that satisfies the Gramm-Leach-Bliley Act safeguards rules or, if you are not subject to them, the Federal Trade Commission's Standards for Safeguarding Customer Information, 16 CFR part 314 (12 CFR 1033.421(e)).
• Give the consumer a method to revoke your authorization that is as easy to access and operate as the initial authorization, and notify the data provider, any data aggregator and other third parties holding the consumer's covered data when you receive a revocation request (12 CFR 1033.421(h)).

Pub. L. 119-36 (Homebuyers Privacy Protection Act), adding 15 U.S.C. 1681b(c)(4) · Read the law's page

• If you are a consumer reporting agency, do not furnish a consumer report to another person on the strength of a request made in connection with a credit transaction involving a residential mortgage loan unless the transaction consists of a firm offer of credit or insurance and that person has certified its authorization from the consumer, or has originated or services a current residential mortgage loan of the consumer, or is an insured depository institution or credit union holding a current account for the consumer (15 U.S.C. 1681b(c)(4)).

15 U.S.C. 1681 et seq. · Read the law's page

• If you assemble or evaluate consumer information to furnish consumer reports to third parties, furnish a consumer report only under the circumstances section 1681b(a) lists, and follow reasonable procedures to assure maximum possible accuracy of the information in it.
• If you are a consumer reporting agency, disclose to a consumer on request the information in the consumer's file, and when the consumer disputes an item, conduct a reasonable reinvestigation free of charge before the end of the 30-day period that begins when you receive the notice, which extends by not more than 15 additional days if you receive relevant information from the consumer during that period.
• If you use or obtain a consumer report, do so only for a purpose section 1681b authorizes and certify that purpose; before procuring a report for employment purposes, make a clear and conspicuous written disclosure in a document that consists solely of the disclosure and get the consumer's written authorization, unless the transportation-applicant procedure in section 1681b(b)(2)(B) applies.
• If you use a consumer report for employment purposes and intend to take adverse action based on it, first give the consumer a copy of the report and a written description of the consumer's rights under the Act, unless the transportation-applicant procedure in section 1681b(b)(3)(B) applies.
• If you take adverse action based in whole or in part on a consumer report, give the consumer notice of the action, disclosure of any numerical credit score you used in taking it, the name, address and telephone number of the agency that furnished the report, a statement that the agency did not make the decision, and notice of the consumer's right to a free copy of the report and to dispute its accuracy.
• If you furnish information to a consumer reporting agency, do not furnish information you know or have reasonable cause to believe is inaccurate, and when the agency notifies you of a dispute, investigate, report the results, and modify, delete or permanently block an item found inaccurate, incomplete or unverifiable.
• Applies to a consumer reporting agency, to a person that uses a consumer report, and to a person that furnishes information to a consumer reporting agency; a consumer report is a communication of information bearing on a consumer's credit worthiness, character or mode of living that is used as a factor in eligibility for credit, insurance, employment or another purpose section 1681b authorizes.