Is a crypto-asset provider, in the United States

FTC Safeguards Rule, 16 CFR 314.1 to 314.4(i) and 314.6 · Read the law's page

• This instrument reaches your organization only if it is a financial institution over which the Federal Trade Commission has jurisdiction: an entity whose business is an activity that is financial in nature or incidental to such an activity and that is not subject to another regulator's enforcement authority under the Gramm-Leach-Bliley Act, such as a mortgage lender, mortgage broker, finance company, payday lender, account servicer, check casher, collection agency or tax preparation firm. Declare provides_financial_services where that holds; a bank or federally insured credit union answers to its own regulator's standards instead.
• Develop, implement, and maintain a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of the customer information at issue.
• Designate a Qualified Individual responsible for overseeing, implementing and enforcing the program, and base the program on a written risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, reassessed periodically.
• Implement access controls, identify and manage the data, personnel, devices, systems and facilities that matter to your business, encrypt customer information in transit over external networks and at rest unless your Qualified Individual approves effective alternative compensating controls, adopt secure development practices, and implement multi-factor authentication for any individual accessing any information system unless your Qualified Individual approves in writing a reasonably equivalent or more secure control.
• Monitor and log the activity of authorized users, and regularly test the effectiveness of the safeguards' key controls, systems, and procedures: absent effective continuous monitoring, conduct annual penetration testing and vulnerability assessments at least every six months and whenever material changes occur.
• Provide security awareness training, use qualified information security personnel, oversee service providers by selecting capable ones, requiring safeguards by contract and periodically assessing them, and evaluate and adjust the program in light of testing, material changes and risk assessments.
• Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in your control, and have your Qualified Individual report in writing at least annually to your board of directors or equivalent governing body.
• If you maintain customer information concerning fewer than five thousand consumers, the written risk assessment requirement of section 314.4(b)(1), the testing requirement of section 314.4(d)(2), the written incident response plan of section 314.4(h) and the board reporting of section 314.4(i) do not apply to you.

17 CFR 162.30 · Read the law's page

• This binds a financial institution or creditor subject to administrative enforcement of the Fair Credit Reporting Act by the Commodity Futures Trading Commission, which includes a futures commission merchant, retail foreign exchange dealer, commodity trading advisor, commodity pool operator, introducing broker, swap dealer or major swap participant that directly or indirectly holds a transaction account belonging to a consumer (17 CFR 162.30(a) and (b)(7)).
• Periodically determine whether you offer or maintain covered accounts, conducting a risk assessment that considers the methods you provide to open your accounts, the methods you provide to access them, and your previous experiences with identity theft (17 CFR 162.30(c)).
• If you offer or maintain one or more covered accounts, develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account, appropriate to your size and complexity and the nature and scope of your activities (17 CFR 162.30(d)(1)).
• Include in the program reasonable policies and procedures to identify relevant Red Flags, detect them, respond appropriately to them, and update the program periodically (17 CFR 162.30(d)(2)).
• Obtain approval of the initial written program from your board of directors or an appropriate committee, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements (17 CFR 162.30(e)).
• Consider the guidelines in the appendix to the subpart and include in the program those that are appropriate (17 CFR 162.30(f)).

SEC Regulation SCI SCI event notices, 17 CFR 242.1002(b) and (c) · Read the law's page

• This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
• Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
• Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
• Until the SCI event is resolved and your investigation is closed, provide updates to the Commission on a regular basis, or at the frequency the Commission reasonably requests, to correct materially incorrect information or when new material information is discovered.
• If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
• For an SCI event with no or a de minimis impact, keep records and submit a quarterly report within 30 calendar days after the end of each calendar quarter summarizing the systems disruptions and systems intrusions.
• Promptly after responsible SCI personnel conclude that an SCI event that is a systems disruption or systems compliance issue has occurred, disseminate the affected systems and a summary description to the members or participants who may have been affected, and to all members or participants for a major SCI event. For a systems intrusion, disseminate a summary description and the corrective action taken unless you determine and document that dissemination would likely compromise security or an investigation.

SEC Regulation SCI policies and procedures, 17 CFR 242.1000 and 242.1001 · Read the law's page

• This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
• Establish, maintain, and enforce written policies and procedures reasonably designed to ensure that your SCI systems and, for security standards, your indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain your operational capability and promote fair and orderly markets.
• Include in those policies and procedures, at a minimum, regular reviews and testing of the systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters, and monitoring of the systems to identify potential SCI events.
• Include business continuity and disaster recovery plans reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption.
• Periodically review the effectiveness of the policies and procedures and take prompt action to remedy deficiencies. Policies and procedures consistent with current SCI industry standards are deemed reasonably designed, though compliance with those standards is not the exclusive means to comply.

CFTC system safeguards notices, 17 CFR 39.18(g), 38.1051(e) and 37.1401(e) · Read the law's page

• This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
• If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
• If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
• If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
• Give timely advance notice of material planned changes to automated systems that may impact their reliability, security, or capacity, and of material planned changes to your program of risk analysis and oversight.

CFTC system safeguards, 17 CFR 39.18, 38.1051 and 37.1401 · Read the law's page

• This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
• If your organization is a derivatives clearing organization, establish and maintain a program of risk analysis and oversight with respect to your operations and automated systems that identifies and minimizes sources of operational risk, and that addresses information security, business continuity and disaster recovery, capacity and performance planning, systems operations, systems development and quality assurance, and physical security and environmental controls.
• If your organization is a derivatives clearing organization, follow generally accepted standards and industry best practices with respect to the development, operation, reliability, security, and capacity of automated systems, and maintain a business continuity and disaster recovery plan with a recovery time objective of no later than the next business day following a disruption.
• If your organization is a designated contract market or a swap execution facility, maintain a program of risk analysis and oversight with respect to your operations and automated systems that addresses each category of risk analysis and oversight the rule lists, beginning with enterprise risk management and governance and information security.
• If your organization is a designated contract market or a swap execution facility, conduct regular, periodic, objective testing and review of your automated systems to ensure that they are reliable, secure, and have adequate scalable capacity, and regular, periodic testing and review of your business continuity-disaster recovery capabilities.

16 CFR Section 314.4(j) · Read the law's page

• Notify the FTC within 30 days of discovering a security event that has compromised unencrypted customer information for 500 or more consumers.when it serves a financial business

Pub. L. 119-36 (Homebuyers Privacy Protection Act), adding 15 U.S.C. 1681b(c)(4) · Read the law's page

• If you are a consumer reporting agency, do not furnish a consumer report to another person on the strength of a request made in connection with a credit transaction involving a residential mortgage loan unless the transaction consists of a firm offer of credit or insurance and that person has certified its authorization from the consumer, or has originated or services a current residential mortgage loan of the consumer, or is an insured depository institution or credit union holding a current account for the consumer (15 U.S.C. 1681b(c)(4)).

15 U.S.C. 1681 et seq. · Read the law's page

• If you assemble or evaluate consumer information to furnish consumer reports to third parties, furnish a consumer report only under the circumstances section 1681b(a) lists, and follow reasonable procedures to assure maximum possible accuracy of the information in it.
• If you are a consumer reporting agency, disclose to a consumer on request the information in the consumer's file, and when the consumer disputes an item, conduct a reasonable reinvestigation free of charge before the end of the 30-day period that begins when you receive the notice, which extends by not more than 15 additional days if you receive relevant information from the consumer during that period.
• If you use or obtain a consumer report, do so only for a purpose section 1681b authorizes and certify that purpose; before procuring a report for employment purposes, make a clear and conspicuous written disclosure in a document that consists solely of the disclosure and get the consumer's written authorization, unless the transportation-applicant procedure in section 1681b(b)(2)(B) applies.
• If you use a consumer report for employment purposes and intend to take adverse action based on it, first give the consumer a copy of the report and a written description of the consumer's rights under the Act, unless the transportation-applicant procedure in section 1681b(b)(3)(B) applies.
• If you take adverse action based in whole or in part on a consumer report, give the consumer notice of the action, disclosure of any numerical credit score you used in taking it, the name, address and telephone number of the agency that furnished the report, a statement that the agency did not make the decision, and notice of the consumer's right to a free copy of the report and to dispute its accuracy.
• If you furnish information to a consumer reporting agency, do not furnish information you know or have reasonable cause to believe is inaccurate, and when the agency notifies you of a dispute, investigate, report the results, and modify, delete or permanently block an item found inaccurate, incomplete or unverifiable.
• Applies to a consumer reporting agency, to a person that uses a consumer report, and to a person that furnishes information to a consumer reporting agency; a consumer report is a communication of information bearing on a consumer's credit worthiness, character or mode of living that is used as a factor in eligibility for credit, insurance, employment or another purpose section 1681b authorizes.