NIST AI Risk Management Framework

CSA staff say your know your client process must amount to a meaningful discussion with the client or prospective client, even if that discussion is not a face-to-face conversation, and cannot be a tick the box exercise; clients should be able to start a live interaction with an advising representative by telephone, video link, email or internet chat.

CSA staff say you must gather your own know your client information and make your own suitability determinations, and cannot rely on information provided under a referral arrangement or otherwise delegate those obligations to someone else.

It reaches you if you are a registered firm, meaning a registered dealer, a registered adviser or a registered investment fund manager: establish, maintain and apply policies and procedures that establish a system of controls and supervision sufficient to provide reasonable assurance that the firm and each individual acting on its behalf complies with securities legislation and to manage the risks associated with its business in accordance with prudent business practices (section 11.1(1)).

Provide training to your registered individuals on compliance with securities legislation, including the obligations under sections 13.2, 13.2.1, 13.3, 13.4 and 13.4.1 (section 11.1(2)).

It reaches you if you are a registrant dealing with a client, other than an investment fund manager in respect of its activities as one and other than where the client is a registered firm, a Canadian financial institution or a Schedule III bank: take reasonable steps to establish the identity of the client and, if you have cause for concern, make reasonable inquiries as to the reputation of the client (sections 13.1 and 13.2(2)(a) and (5)).

Take reasonable steps to establish whether the client is an insider of a reporting issuer or any other issuer whose securities are publicly traded (section 13.2(2)(b)).

It reaches you if you are a registered firm, meaning a registered dealer, a registered adviser or a registered investment fund manager, other than an investment fund manager in respect of an investment fund that is subject to National Instrument 81-107: take reasonable steps to identify existing material conflicts of interest, and material conflicts of interest that are reasonably foreseeable, between the firm and the client and between each individual acting on the firm's behalf and the client (sections 13.4(1) and 13.4.2).

Address all material conflicts of interest between a client and the firm, including each individual acting on its behalf, in the best interest of the client (section 13.4(2)).

It reaches you if you are a registered firm, meaning a registered dealer, a registered adviser or a registered investment fund manager, other than a firm exempted from subsections 14.2(2) to (6) by Part 9 as a member of a self-regulatory organization: deliver to each client all information that a reasonable investor would consider important about the client's relationship with the registrant (section 14.2(1)).

Include in that information a description of the nature or type of the client's account; a general description of the products and services you will offer, including restrictions on the client's ability to liquidate or resell a security; and a general description of any limits on the products and services you will offer, including whether you will primarily or exclusively offer proprietary products (section 14.2(2)(a), (b) and (b.1)).

It reaches you if you are a registrant, other than where the client is a registered firm, a Canadian financial institution or a Schedule III bank, other than a registered dealer buying or selling securities for the client only as directed by a registered adviser acting for the client, and other than a dealer or dealing representative relieved by Part 3 or Part 9 as a member of a self-regulatory organization: before you open an account for a client, purchase, sell, deposit, exchange or transfer securities for a client's account, take any other investment action for a client, make a recommendation to a client or exercise discretion to take any such action, determine on a reasonable basis that the action is suitable for the client and puts the client's interest first (section 13.3(1), (3) and (4)).

Base the suitability determination on the client's information collected under section 13.2, your assessment or understanding of the security consistent with section 13.2.1, the impact of the action on the client's account including the concentration of securities within the account and the liquidity of those securities, the potential and actual impact of costs on the client's return on investment, and a reasonable range of alternative actions available to you through the registered firm at the time you make the determination (section 13.3(1)(a)).

If you give a client direct electronic access to a trading venue, apply effective systems and controls to assess the client's suitability, review that assessment regularly, ensure the client observes trading thresholds and limits and monitor its trading, and conclude a binding written agreement under which you remain responsible (section 82^16(1) and (4)).

If you are a trader offering a financial services contract by means of distance communication, give the consumer free explanations before the contract is concluded so that the consumer can assess whether the contract and any additional services suit the consumer's needs and financial situation (Võlaõigusseadus, section 55^2(1)).

Be ready to prove that you gave adequate explanations, including the human intervention (section 55^2(3)).

It reaches you if you are an obliged entity within Article 3, which lists credit institutions, financial institutions and the persons named in point (3) acting in the exercise of their professional activities: cooperate fully with the financial intelligence unit by promptly reporting to it, on your own initiative, where you know, suspect or have reasonable grounds to suspect that funds or activities, regardless of the amount involved, are the proceeds of criminal activity or are related to terrorist financing or criminal activity, and by responding to its requests for additional information in such cases (Article 69(1), point (a)). A notary, lawyer, other independent legal professional, auditor, external accountant or tax advisor is exempt from Article 69(1) to the extent that the exemption relates to information received from, or obtained on, a client in the course of ascertaining the legal position of that client or performing the task of defending or representing that client in, or concerning, judicial proceedings, but not where the person takes part in money laundering, its predicate offences or terrorist financing, provides legal advice for those purposes, or knows that the client is seeking legal advice for those purposes (Article 70(2)).

Provide the financial intelligence unit, at its request, with all necessary information, including information on transaction records, within the deadlines imposed, and reply to its requests for information within 5 working days, a deadline the unit may shorten in justified and urgent cases, including to less than 24 hours, or extend where it considers that justified and the extension does not undermine its analysis (Article 69(1), point (b), and third and fourth subparagraphs).

Have robust governance arrangements, which include a clear organizational structure with well-defined, transparent and consistent lines of responsibility (Article 74(1), point (a)).

Have effective processes to identify, manage, monitor and report the risks you are or might be exposed to, including ESG risks in the short, medium and long term (Article 74(1), point (b)).

If you are a creditor, carry out a thorough assessment of the consumer's creditworthiness before concluding a credit agreement (Article 18(1)).

Carry out that assessment in the interest of the consumer, to prevent irresponsible lending practices and over-indebtedness, taking appropriate account of factors relevant to verifying the prospect of the consumer meeting his or her obligations under the credit agreement (Article 18(1)).

If you are a trader concluding a financial services contract with a consumer at a distance, give the consumer free of charge, before the contract is concluded, adequate explanations that make it possible to assess whether the proposed contract and ancillary services are adapted to the consumer's needs and financial situation (Article 16d(1)).

Be ready to prove that you gave the adequate explanations, since the burden of proof is on the trader (Article 16d(4)).

Institutions, payment institutions and electronic money institutions should establish whether an arrangement with a third party falls under the definition of outsourcing, an arrangement of any form by which a service provider performs a process, a service or an activity that would otherwise be undertaken by the institution itself (paragraphs 12 and 26).

Institutions and payment institutions should always consider a function as critical or important where a defect or failure in its performance would materially impair their continuing compliance with the conditions of their authorization, their financial performance, or the soundness or continuity of their banking and payment services and activities; or when operational tasks of internal control functions are outsourced, unless the assessment establishes that a failure to provide the outsourced function or its inappropriate provision would not have an adverse impact on the effectiveness of the internal control function; or when they intend to outsource functions of banking activities or payment services to an extent that would require authorization by a competent authority (paragraph 29).

If you are a provider of an AI system considered high-risk under Article 6 of Regulation (EU) 2024/1689, outside the scope of Regulation (EU) 2017/745 or (EU) 2017/746, and you claim interoperability of the system with the harmonised software components of EHR systems, prove compliance with the essential requirements on the European interoperability software component and the European logging software component in Section 2 of Annex II (Article 27(2)).

It reaches you if you are an obliged entity within Article 2(1), which lists credit institutions, financial institutions and the natural or legal persons acting in the exercise of their professional activities that the paragraph names: cooperate fully with the financial intelligence unit by promptly informing it, including by filing a report, on your own initiative, where you know, suspect or have reasonable grounds to suspect that funds, regardless of the amount involved, are the proceeds of criminal activity or are related to terrorist financing, and by promptly responding to its requests for additional information in such cases (Article 33(1), point (a)). A notary, other independent legal professional, auditor, external accountant or tax advisor is outside the obligations of Article 33(1) only to the strict extent that the information is received from, or obtained on, a client in the course of ascertaining the legal position of the client, or performing the task of defending or representing that client in, or concerning, judicial proceedings (Article 34(2)).

Provide the financial intelligence unit directly, at its request, with all necessary information (Article 33(1), point (b), as replaced by Directive (EU) 2018/843, Article 1, point (21)).

Implement an IT strategy and arrangements for physical and electronic security that minimize the risks of attacks against your information systems, promptly inform the competent authority of any material breaches of your physical and electronic security measures with an incident report on the nature of the incident, the measures taken and the initiatives to avoid similar incidents, and annually undertake penetration tests and vulnerability scans (Article 18(1) to (4)).

If your algorithmic trading pursues a market making strategy, carry out that market making continuously during a specified proportion of the trading venue's trading hours, except under exceptional circumstances, enter into a binding written agreement with the trading venue that specifies your obligations, and have in place effective systems and controls to ensure that you fulfil your obligations under the agreement at all times (Directive 2014/65/EU, Article 17(3)). You are considered to pursue a market making strategy when, as a member or participant of one or more trading venues, your strategy, when dealing on own account, involves posting firm, simultaneous two-way quotes of comparable size and at competitive prices relating to one or more financial instruments on a single trading venue or across different trading venues, with the result of providing liquidity on a regular and frequent basis to the overall market (Article 17(4)).

It reaches you if you are an investment firm, meaning a legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis (Directive 2014/65/EU, Article 4(1), point (1)): arrange for records to be kept of all services, activities and transactions undertaken by you, sufficient to enable the competent authority to fulfil its supervisory tasks and to perform the enforcement actions under the Directive, Regulation (EU) No 600/2014, Directive 2014/57/EU and Regulation (EU) No 596/2014, and in particular to ascertain that you have complied with all obligations, including those with respect to clients or potential clients and to the integrity of the market (Article 16(6)).

Keep at the disposal of the competent authority, for five years, the relevant data relating to all orders and all transactions in financial instruments which you have carried out, whether on own account or on behalf of a client (Regulation (EU) No 600/2014, Article 25(1)).

It reaches you if you are an investment firm, meaning a legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis (Directive 2014/65/EU, Article 4(1), point (1)), that manufactures financial instruments for sale to clients, or that offers or recommends financial instruments: maintain, operate and review a process for the approval of each financial instrument and significant adaptations of existing financial instruments before it is marketed or distributed to clients, specify in that process an identified target market of end clients within the relevant category of clients for each financial instrument, assess all relevant risks to that target market, and make sure the intended distribution strategy is consistent with it (Directive 2014/65/EU, Article 16(3)).

Regularly review the financial instruments you offer or market, taking into account any event that could materially affect the potential risk to the identified target market, to assess at least whether each remains consistent with the needs of the identified target market and whether the intended distribution strategy remains appropriate (Article 16(3)).

It reaches you if you are an investment firm, meaning a legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis (Directive 2014/65/EU, Article 4(1), point (1)), that provides investment advice or portfolio management: obtain the necessary information regarding the client's or potential client's knowledge and experience in the investment field relevant to the specific type of product or service, financial situation including the ability to bear losses, and investment objectives including risk tolerance, so as to recommend the investment services and financial instruments that are suitable for the client and in particular are in accordance with the client's risk tolerance and ability to bear losses (Article 25(2)).

Do not create any ambiguity or confusion about your responsibilities in the process when assessing suitability, and inform clients or potential clients, clearly and simply, that the reason for assessing suitability is to enable you to act in the client's best interest (Article 54(1)).

Obtain the works council's consent to guidelines on personnel selection for hirings, transfers, regroupings and dismissals, also where artificial intelligence is used in drawing them up (section 95(1) and (2a)).

Accept that the works council may call in an expert where it must assess the introduction or application of artificial intelligence, which the Act treats as necessary (section 80(3)).

Do not treat workers or applicants less favourably than others in a comparable situation because of religion, personal convictions, disability, age, nationality, or sexual orientation, and do not apply a seemingly neutral provision, criterion, practice, act, agreement, or conduct that puts persons with one of those characteristics at a particular disadvantage (art. 2, comma 1).

Do not harass anyone on those grounds through unwanted conduct that violates a person's dignity and creates an intimidating, hostile, degrading, humiliating, or offensive climate, and do not order anyone to discriminate (art. 2, commi 3 and 4).

At all times keep your principal bank account in Mauritius, an office and relevant infrastructure in Mauritius, adequate internal controls, risk management (including cyber risk management) and governance policies and procedures, a business continuity and disaster recovery plan, a board of at least three directors with one independent director resident in Mauritius, an adequate number of competent officers, and a code of conduct and ethics that binds your officers (clause 5(1)).

Preserve the integrity and privacy of clients' information in conformity with the applicable Data Protection Laws of Mauritius, and where clients' information is stored and processed through cloud computing facilities for analytics, keep it under adequate security and access controls, accessible to you at all times and to the Commission on request (clause 5(1)(e) and (2)).

It reaches you if you operate as a place of public accommodation or public service, meaning a business, facility or institution whose goods, services, facilities, privileges, advantages, or accommodations are made available to the public (section 301): do not deny an individual the full and equal enjoyment of them because of religion, race, color, national origin, age, sex, sexual orientation, gender identity or expression, or marital status (section 302(a)).

Do not print, circulate, post, mail, or otherwise publish a statement, advertisement, notice, or sign indicating that the full and equal enjoyment of the goods, services, facilities, privileges, advantages, or accommodations of a place of public accommodation or public service will be refused, withheld, or denied on those grounds (section 302(b)).

Apply the rules of Article 24 also to decisions you take on the basis of algorithms or other artificial intelligence systems (Article 24(3)).

It reaches you if you are a Member Organisation, meaning a financial institution or financial services provider regulated by SAMA, that SAMA has notified is required to implement and comply with the Counter-Fraud Framework (the Framework applies to Member Organisations operating in Saudi Arabia at SAMA's discretion, Sections 1.4 and 1.5 and Appendix A): implement and maintain fraud detection systems that monitor customer products and services, and internal systems, for transactions or behaviors that may be indicative of fraud, and have them operate 24/7 with appropriate resources in place to manage their outputs on a timely basis (Sections 5.2(a) and 5.2(b)). The Framework words its Control Requirements as "should", and each line below keeps that strength.

Build the fraud detection system capability to include, at a minimum, analysis of structured data, monitoring of customer and internal accounts, baselining of user behavior patterns into profiles so that deviations from normal activity can be identified, a library of rules based on known fraud typologies, segmentation of customer groups to tailor rules, a weighting of rules based on the assessed level of fraud risk together with risk scoring, aggregation of risk scores across multiple channels, and linking of outputs to a Case Management System (Section 5.2(e)).

Provide personalised attention through a natural-person operator who answers in real time and identifies themselves at the start of the conversation, as soon as possible, so that on average 95 percent of requests are attended within three minutes (article 8(2)).

Give the information on paper or in electronic form that is accessible to the worker and can be stored and printed, and keep proof that it was transmitted or received (Article 6(2)).

Include in each notice of an adverse determination a description of and the source of the screening criteria and review procedures used as guidelines in making the adverse determination.

It reaches you if you are a Licensed Financial Institution, meaning a bank or other financial institution licensed by the Central Bank of the UAE under Decretal Federal Law 14 of 2018 to carry on a licensed financial activity, and you provide Financial Products and/or Services to Consumers who are Natural Persons or Sole Proprietorships (Regulation, Scope of Application and Article 1; Standards, Introduction): when you reject a Consumer's application for a Financial Product and/or Service, disclose the reason for the rejection to the applicant, except where the reason is related to Financial Crime Compliance risks or as may be prohibited by law (Standard 2.1.1.26).

When you decrease the credit limit on a card or close the card for business reasons, provide the Consumer with a notice and the reason for the limit decrease or closure (Standard 7.1.3.6).

If you are a common platform firm, taking into account the nature, scale and complexity of your business and the nature and range of financial services and activities undertaken in the course of your designated investment business, establish, implement and maintain adequate policies and procedures designed to detect any risk of failure by the firm to comply with its obligations under the UK law on markets in financial instruments, as well as associated risks, and put in place adequate measures and procedures designed to minimize such risks and to enable the FCA to exercise its powers effectively under that law (SYSC 6.1.2-AR).

If you are a common platform firm, establish and maintain a permanent and effective compliance function which operates independently and which monitors on a permanent basis and assesses, on a regular basis, the adequacy and effectiveness of the measures, policies and procedures put in place under SYSC 6.1.2-AR and the actions taken to address any deficiencies in your compliance with your obligations; advises and assists the relevant persons responsible for carrying out your designated investment business to comply with your obligations under the UK law on markets in financial instruments; reports to the management body, at least on an annual basis, on the implementation and effectiveness of the overall control environment for your designated investment business, the risks that have been identified and the complaints-handling reporting as well as remedies undertaken or to be undertaken; and monitors the operations of the complaints-handling process and considers complaints as a source of relevant information (SYSC 6.1.3-AR).

It reaches you if you are a firm to which the common platform requirements apply, which is every firm apart from an insurer, a UK ISPV, a managing agent and the Society unless a specific rule provides otherwise (SYSC 1 Annex 1 2.1R): establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the firm, including its managers, employees and appointed representatives, with its obligations under the regulatory system and for countering the risk that the firm might be used to further financial crime (SYSC 6.1.1R).

If you are a firm which is not a common platform firm or management company and you carry on designated investment business with or for retail clients or professional clients, allocate to a director or senior manager the function of having responsibility for oversight of your compliance and of reporting to the governing body in respect of that responsibility (SYSC 6.1.4AR).

It reaches you if you operate as a creditor under a prospective regulated agreement, meaning the person providing credit under a consumer credit agreement, including the prospective creditor, where the agreement is a regulated agreement and is not an excluded agreement (a consumer hire agreement or an agreement secured on land): when you decide not to proceed with it on the basis of information you obtained from a credit reference agency, inform the debtor, when telling the debtor of the decision, that the decision was reached on the basis of information from a credit reference agency, and provide the debtor with the particulars of the agency, including its name, address and telephone number (Consumer Credit Act 1974, section 157(A1), (4); section 189).

It reaches you if you operate as a service-provider, meaning a person concerned with the provision of a service to the public or a section of the public (for payment or not), and a service includes goods or facilities: do not discriminate against a person requiring the service, including a person seeking to obtain or use it, by not providing the person with the service, which includes not providing it of the quality, in the manner or on the terms on which you usually provide it to the public or the section of it that includes the person (Equality Act 2010, section 29(1), section 31(2), (6) and (7)).

In providing the service, do not discriminate against a person as to the terms on which you provide the service, by terminating the provision of the service, or by subjecting the person to any other detriment (section 29(2)).

It reaches you if you operate as a service-provider, meaning a person concerned with the provision of a service to the public or a section of the public (for payment or not), or exercise a public function that is not the provision of such a service: where a provision, criterion or practice of yours puts disabled persons generally at a substantial disadvantage in relation to the provision of the service in comparison with persons who are not disabled, take such steps as it is reasonable to have to take to avoid the disadvantage (Equality Act 2010, section 29(7), section 20(3), Schedule 2 paragraph 2(1), (2) and (4)).

Where a physical feature puts disabled persons generally at a substantial disadvantage in relation to the provision of the service, take such steps as it is reasonable to have to take to avoid the disadvantage or to adopt a reasonable alternative method of providing the service (section 20(4), Schedule 2 paragraph 2(3)).

It reaches you if you operate as a firm with respect to consumer credit lending, other than under an agreement in which you take an article in pawn on the terms described in CONC 5.2A.2R(1), a current account agreement that may allow the account-holder to overdraw without a pre-arranged overdraft or to exceed a pre-arranged overdraft limit where doing so would be a regulated credit agreement (overrunning), a non-commercial agreement, or a small borrower-lender-supplier agreement which is a restricted-use credit agreement: undertake a reasonable assessment of the creditworthiness of a customer before entering into a regulated credit agreement, significantly increasing the amount of credit provided under one, or significantly increasing a credit limit for running-account credit under one, and do not take that step unless you can demonstrate that you have done so in accordance with CONC 5.2A and had proper regard to the outcome in respect of affordability risk (CONC 5.2A.1R, 5.2A.2R, 5.2A.4R, 5.2A.5R).

Base the assessment on sufficient information that you are aware of at the time, obtained where appropriate from the customer and where necessary from a credit reference agency, enough to carry out a reasonable assessment (CONC 5.2A.7R).

A firm must have effective risk strategies and risk management systems (Fundamental Rule 5).

It reaches you if you are a firm to which the common platform requirements apply, which is every firm apart from an insurer, a UK ISPV, a managing agent and the Society unless a specific rule provides otherwise (SYSC 1 Annex 1 2.1R): have robust governance arrangements, which include a clear organizational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks you are or might be exposed to, and internal control mechanisms, including sound administrative and accounting procedures and effective control and safeguard arrangements for information processing systems (SYSC 4.1.1R(1)).

If you are a common platform firm, make the arrangements, processes and mechanisms in SYSC 4.1.1R comprehensive and proportionate to the nature, scale and complexity of the risks inherent in your business model and activities (SYSC 4.1.2R).

It reaches you if you are a common platform firm, meaning a MIFIDPRU investment firm, a bank, a building society, a designated investment firm or a dormant asset fund operator (SYSC 1 Annex 1 3.2G and Table A): when relying on a third party for the performance of operational functions which are critical for the performance of regulated activities, listed activities or ancillary services on a continuous and satisfactory basis, take reasonable steps to avoid undue additional operational risk, and do not undertake the outsourcing of important operational functions in such a way as to impair materially the quality of your internal control or the ability of the FCA to monitor your compliance with all obligations under the regulatory system (SYSC 8.1.1R).

If you are a common platform firm and you outsource critical or important operational functions, remain fully responsible for discharging all of your obligations under the UK law on markets in financial instruments, and comply with the conditions that the outsourcing must not result in the delegation by senior management of their responsibility, must not alter your relationship and obligations towards clients, must not undermine the conditions with which you must comply in order to be authorized and to remain so, and must not remove or modify any other condition subject to which your authorization was granted (SYSC 8.1.6-AR).

If you are a firm other than a common platform firm and you outsource critical or important operational functions or any relevant services and activities, remain fully responsible for discharging all of your obligations under the regulatory system, and comply with the conditions that the outsourcing must not result in the delegation by senior personnel of their responsibility, must not alter your relationship and obligations towards clients, must not undermine the conditions with which you must comply in order to be authorized and to remain so, and must not remove or modify any other condition subject to which your authorization was granted (SYSC 8.1.6R).

It reaches you if you are a firm that makes a personal recommendation to a retail client in relation to a designated investment, manages investments of a retail client of the firm, or manages the assets of an occupational pension scheme, stakeholder pension scheme or personal pension scheme, other than in relation to your MiFID, equivalent third country or optional exemption business or an insurance-based investment product, for which COBS 9A sets the suitability rules (COBS 9.1.1R and COBS 9.1.1AG), and not in relation to a targeted support service within the scope of COBS 9B (COBS 9.1.1BG): take reasonable steps to ensure that a personal recommendation, or a decision to trade, is suitable for your client, and ensure that any life policy proposed is consistent with the client's insurance demands and needs (COBS 9.2.1R(1)).

When making the personal recommendation or managing the client's investments, obtain the necessary information regarding the client's knowledge and experience in the investment field relevant to the specific type of designated investment or service, financial situation and investment objectives, so as to enable you to make the recommendation, or take the decision, which is suitable for the client (COBS 9.2.1R(2)).

It reaches you if you are a firm that provides investment advice or portfolio management in the course of MiFID, equivalent third country or optional exemption business, or investment advice in relation to an insurance-based investment product (COBS 9A.1.1R; for an insurance-based investment product only the rules that implemented the IDD or derive from the IDD Regulation apply, COBS 9A.1.5R; the chapter does not apply in relation to a targeted support service within the scope of COBS 9B, COBS 9A.1.1AG): when providing investment advice or portfolio management, obtain the necessary information regarding the client's knowledge and experience in the investment field relevant to the specific type of financial instrument or service, financial situation including ability to bear losses, and investment objectives including risk tolerance, and only recommend investment services and financial instruments, or take decisions to trade, which are suitable for the client and in particular in accordance with the client's risk tolerance and ability to bear losses (COBS 9A.2.1R).

Determine the extent of the information to be obtained from a client in light of all the features of the service to be provided, and obtain from the client such information as is necessary to understand the essential facts about the client and to have a reasonable basis for determining that the specific transaction meets the client's investment objectives including risk tolerance, that the client is able financially to bear any related investment risks consistent with those objectives, and that the client has the necessary experience and knowledge to understand the risks involved in the transaction or in the management of the portfolio (COBS 9A.2.4R).

It reaches you if you are a firm carrying on retail market business, meaning the regulated activities and ancillary activities, payment services and issuing of electronic money of a firm in a distribution chain that involves a retail customer, or if you communicate or approve a financial promotion addressed to or likely to be received by a retail customer, to the extent you are responsible for determining or materially influencing retail customer outcomes: act to deliver good outcomes for retail customers (Principle 12, PRIN 2.1.1R, and PRIN 3.2.6R to 3.2.7R).

Act in good faith towards retail customers (PRIN 2A.2.1R); the standard of conduct is set out in PRIN 2A.2.2R and includes fair and open dealing and acting consistently with the reasonable expectations of retail customers.

It reaches you if you operate as a bank as 31 CFR 1010.100 defines the term: each agent, agency, branch or office within the United States of a person doing business as a commercial bank or trust company, a private bank, a savings and loan association or building and loan association, an insured institution, a savings bank, industrial bank or other thrift institution, a credit union, or another listed capacity. File a SAR with FinCEN for a transaction conducted or attempted by, at, or through the bank that involves or aggregates at least $5,000 in funds or other assets and that the bank knows, suspects, or has reason to suspect falls within 31 CFR 1020.320(a)(2)(i), (ii) or (iii). A bank is not required to file a SAR for a robbery or burglary committed or attempted that is reported to appropriate law enforcement authorities, or for lost, missing, counterfeit, or stolen securities with respect to which the bank files a report under 17 CFR 240.17f-1 (31 CFR 1020.320(c)).

File the SAR no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing; where no suspect was identified on that date you may delay filing an additional 30 calendar days to identify a suspect, but never more than 60 calendar days after initial detection (31 CFR 1020.320(b)(3)).

It reaches you if you are an investment adviser under the Advisers Act, including an automated adviser: the Commission interprets the federal fiduciary duty you owe your client, which comprises a duty of care and a duty of loyalty, to require you to act in the best interest of your client and not to place your own interest ahead of the client's.

The Commission says the duty of care includes a duty to provide advice that is in the best interest of the client based on a reasonable understanding of the client's objectives; for a retail client you should, at a minimum, make a reasonable inquiry into the client's financial situation, level of financial sophistication, investment experience, and financial goals.

It reaches you if you operate as a creditor: a person who regularly extends, renews, or continues credit, who regularly arranges for credit to be extended, renewed, or continued, or who, in the ordinary course of business, regularly participates in a credit decision, including setting the terms of the credit, but not a person whose only participation in a credit transaction involves honoring a credit card. The duty is triggered by adverse action, which does not include a refusal to extend additional credit under an existing credit arrangement where the applicant is delinquent or otherwise in default, or where the additional credit would exceed a previously established credit limit (15 U.S.C. 1691(d)(6)). A creditor must notify an applicant of the action taken within 30 days after receiving a completed application (15 U.S.C. 1691(d)(1); 12 CFR 1002.9(a)(1)(i)).

Notify the applicant within 30 days after taking adverse action on an incomplete application (unless you send a notice of incompleteness), within 30 days after taking adverse action on an existing account, and within 90 days after notifying the applicant of a counteroffer that the applicant does not expressly accept or use (12 CFR 1002.9(a)(1)(ii) to (iv)).

It reaches you if you are a member of a national securities exchange that transacts a business in securities directly with others than members of a national securities exchange, a broker or dealer that transacts a business in securities through the medium of such a member, or a broker or dealer registered under section 15 of the Exchange Act (including a security-based swap dealer or major security-based swap participant that is also a registered broker or dealer): preserve for not less than six years, the first two years in an easily accessible place, the records Rule 17a-3(a)(1) through (3), (5), (21) and (22) require, and analogous records created under Rule 17a-3(e) (Rule 17a-4(a)).

Preserve for not less than three years, the first two years in an easily accessible place, the originals of all communications received and copies of all communications sent (and any approvals thereof) relating to your business as such, including inter-office memoranda and communications and communications subject to the rules of a self-regulatory organization of which you are a member regarding communications with the public (Rule 17a-4(b)(4)).

FinCEN says the Bank Secrecy Act prohibits you from disclosing a SAR, or information that would reveal the existence or non-existence of a SAR, other than in limited circumstances (31 CFR 1020.320(e); 31 U.S.C. 5318(g)(2)(A)).

When you share underlying facts, transactions or documents with another financial institution, including a foreign one, FinCEN says you must take appropriate measures, such as redaction, to ensure that information that would reveal the existence of a SAR is not shared.

It reaches you if you are a FINRA member firm or a person associated with one, because FINRA may sanction either for a violation of a FINRA rule (Rule 8310(a)): have an appropriately qualified registered principal approve each retail communication before the earlier of its use or its filing with FINRA's Advertising Regulation Department, unless an exception in Rule 2210(b)(1) applies (Rule 2210(b)(1)(A)).

Base every communication on principles of fair dealing and good faith, make it fair and balanced, and give it a sound basis for evaluating the facts about any particular security or type of security, industry, or service; do not omit a material fact or qualification if the omission, in light of the context of the material presented, would cause the communication to be misleading (Rule 2210(d)(1)(A)).

It reaches you if you are a FINRA member firm or a person associated with one, because FINRA may sanction either for a violation of a FINRA rule (Rule 8310(a)): establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance with applicable securities laws and regulations and with applicable FINRA rules; final responsibility for proper supervision rests with the member (Rule 3110(a)).

Establish, maintain, and enforce written procedures to supervise the types of business in which you engage and the activities of your associated persons, reasonably designed to achieve compliance with applicable securities laws and regulations and with applicable FINRA rules (Rule 3110(b)(1)).

It reaches you if you are a FINRA member firm or a person associated with one, because FINRA may sanction either for a violation of a FINRA rule (Rule 8310(a)): make and preserve the books and records the FINRA rules, the Exchange Act and the applicable Exchange Act rules require (Rule 4511(a)).

Preserve for at least six years any FINRA book or record for which neither the FINRA rules nor the applicable Exchange Act rules specify a period (Rule 4511(b)).

Before using alternative data, carry out through a well-designed compliance management program a thorough analysis of the relevant consumer protection laws and regulations, which the statement names as fair lending laws, the prohibitions against unfair, deceptive or abusive acts or practices, and the Fair Credit Reporting Act, so that you understand the opportunities, risks and compliance requirements.

Apply more robust compliance management, including appropriate testing, monitoring and controls, to alternative data that present greater consumer protection risks.

It reaches you if you are an investment adviser, meaning any person who, for compensation, engages in the business of advising others, either directly or through publications or writings, as to the value of securities or as to the advisability of investing in, purchasing, or selling securities (subject to the exclusions in section 202(a)(11) of the Advisers Act): do not use the mails or any means or instrumentality of interstate commerce, directly or indirectly, to employ any device, scheme, or artifice to defraud any client or prospective client (section 206(1)).

Do not engage in any transaction, practice, or course of business which operates as a fraud or deceit upon any client or prospective client (section 206(2)).

The agencies say the Bank Secrecy Act prohibits you from disclosing a SAR, or any information that would reveal the existence of a SAR, including to a customer or other person who is the subject of the SAR, and from notifying any person involved in the transaction that the transaction has been reported (31 CFR 1020.320(e); 31 U.S.C. 5318(g)(2)).

The agencies say you should consider customer communication on a case-by-case basis and take precautions when discussing information that could reveal the existence of a SAR.

It reaches you if you are a broker, a dealer, or a natural person who is an associated person of a broker or dealer and you make a recommendation of any securities transaction or investment strategy involving securities (including account recommendations) to a retail customer, meaning a natural person (or that person's legal representative) who uses the recommendation primarily for personal, family, or household purposes: act in the best interest of the retail customer at the time the recommendation is made, without placing your financial or other interest ahead of the interest of the retail customer (Rule 15l-1(a)(1)).

Provide the retail customer, prior to or at the time of the recommendation, in writing, full and fair disclosure of all material facts relating to the scope and terms of the relationship (that you act as a broker, dealer, or associated person with respect to the recommendation, the material fees and costs that apply, and the type and scope of services, including any material limitations on what may be recommended) and of all material facts relating to conflicts of interest associated with the recommendation (Rule 15l-1(a)(2)(i)).

An institution should have internal controls and information systems appropriate to the size of the institution and the nature, scope and risk of its activities, providing for clear lines of authority and responsibility for monitoring adherence to established policies, effective risk assessment, timely and accurate financial, operational and regulatory reports, adequate procedures to safeguard and manage assets, and compliance with applicable laws and regulations (Guidelines section II.A).

An institution should have an internal audit system appropriate to its size and the nature and scope of its activities, providing for adequate monitoring of the system of internal controls through an internal audit function (or, where its size, complexity or scope of operations does not warrant a full scale internal audit function, a system of independent reviews of key internal controls), independence and objectivity, qualified persons, adequate testing and review of information systems, adequate documentation of tests and findings and any corrective actions, verification and review of management actions to address material weaknesses, and review by its audit committee or board of directors of the effectiveness of the internal audit systems (Guidelines section II.B).

If you procure employees for an employer, or procure for employees opportunities to work for an employer, do not fail or refuse to refer, or classify or refer, an individual because of race, color, religion, sex, or national origin (Title VII section 703(b)), or because of age (Age Discrimination in Employment Act section 4(b)).

Be ready to demonstrate that a particular employment practice that causes a disparate impact on race, color, religion, sex, or national origin is job related for the position in question and consistent with business necessity; a disparate impact is also established where the complaining party demonstrates an alternative employment practice and the respondent refuses to adopt it (Title VII section 703(k)(1)).

Set an authorization validity period of at least 12 months for a drug, device, or covered service treating a chronic or long-term care condition, and at least six months for an outpatient covered service

If you are sued for damage caused in the use of an AI system, and the claimant presents facts and elements that make the claim plausible, produce on the court's order the evidence specifically relevant to how the system works, including the logs under Article 12, the risk-management documentation under Article 9, the relevant technical documentation under Article 11 and the human-oversight information under Article 14 of Regulation (EU) 2024/1689; the order is limited to what is necessary and proportionate, and the court protects trade secrets and confidential information (art. 17, commi 1 to 4).

If you hold such evidence as a third party to the action, produce it on the same terms (art. 17, comma 1).

If you redact a document you publish under this article to protect trade secrets, cybersecurity, public safety or national security, or to comply with law, describe the character and justification of each redaction in the published version, to the extent those concerns permit, and keep the unredacted information for five years.

A third-party validator would have to certify to the model's developer and to the Office of Cyber Command whether the model has been validated and is appropriately positioned for deployment, and disclose any financial or other interest the validator has in the model or its developer.

Do not develop, use, distribute, or sell a program or device known to be intended for defeating a protection system or for unauthorized access to, or destruction, blocking, or modification of, computer information.

Do not, knowing you are not authorized, introduce, modify or erase data in a computer system, or change the normal use of data in it by any technological means.

Do not cause an interruption of a computer system's normal operation, or damage, delete, deteriorate, alter, or suppress computer data, without right.

Do not produce, sell, obtain for use, import, export, distribute, or otherwise make available a device, including computer data or computer programs, principally designed or adapted to permit the commission of an offense in Title I of this Book.

Do not modify computer material, or cause a computer to cease to function, without authorisation.

Do not cause a stoppage or denial of service, delete or alter data, diminish a system's value or utility, or introduce a computer contaminant, with intent to cause or knowing it is likely to cause wrongful loss, gain, or damage; this is punishable as tampering with computer material under the Penal Code of Bhutan.

Do not manipulate a computer data-processing or data-transfer operation to produce an incorrect result, or to avoid a process that would otherwise have produced a correct one, in order to obtain an undue benefit at a third party's expense.

Do not damage, delete, alter, or interfere with computer data, or hinder or interfere with the functioning of a computer or computer system, without lawful excuse.

Do not manufacture, sell, distribute, or possess a device, password, or access code designed or adapted to commit an offence under the Act.

Do not hinder or falsify the operation of a computer system, or introduce, damage, delete, alter, or suppress computer data without right.

Do not produce, sell, obtain, import, or distribute a device, program, password, or access code intended to commit any of the above offenses, unless it is for authorized testing or protecting a computer system.

Do not use, possess, traffic in, or permit another person to have access to a computer password to commit either of the above.

Do not damage or destroy a computer information system's function, data, or programs (Art. 286).

Do not make, acquire, sell, possess, distribute or make available a device, computer program or computer data created or adapted to commit any of these offences; doing so is itself a criminal offence carrying up to three years' imprisonment, or up to two years for passwords, access codes or similar data.

Do not intentionally and without right seriously hinder or interrupt an information system's operation, including by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing its data or by blocking access to it.

Do not, intentionally and without right, produce, sell, procure for use, import, distribute or otherwise make available a computer program designed or adapted primarily to commit an offence under articles 3 to 6, or a password, access code or similar data giving access to an information system, intending it to be used to commit such an offence.

Do not introduce, or attempt to introduce, data into an information system without authorization.

Do not divulge, generate, copy, capture, use, alter, traffic in, or decode an access code or similar mechanism used to achieve illicit access to such a system, and do not falsify an access device.

Do not destroy, damage, delete, deteriorate, alter, suspend, obstruct, or suppress computer data or an information system's logical components, and do not design, acquire, or distribute malicious software meant to do so.

Do not disrupt, slow, damage, or alter the design of a website, email account, or information system without authorization.

Do not alter, delete, damage or block data in a computer system, and do not interfere with or hinder the functioning of a computer system, including by an automated crawler's request volume or behavior.

Do not intentionally and without right seriously hinder or interrupt the functioning of an information system by inputting computer data, or by transmitting, damaging, deleting, deteriorating, altering or suppressing such data, or by rendering such data inaccessible; Member States must make this a criminal offense, at least for cases which are not minor (Article 4).

Do not intentionally and without right delete, damage, deteriorate, alter or suppress computer data on an information system, or render such data inaccessible; Member States must make this a criminal offense, at least for cases which are not minor (Article 5).

Do not impair, falsify, corrupt, or delete data on a French computer system in the course of an automated crawl, which Articles 323-2 and 323-3 punish separately from unauthorized access itself, with a higher penalty where the system is a State personal-data system.

Do not modify data held in a computer system, or degrade, interrupt, or deny access to a computer system, without lawful authority or excuse.

Do not manufacture, sell, import, distribute, or possess a device or data designed or adapted primarily to commit an offence under this Part.

Do not produce, obtain, sell, or distribute passwords, security codes, or software designed to commit these offences.

Do not unlawfully delete, suppress, render unusable, or alter data.

Do not disclose a password or access code, or modify a programme or electronic record, without authority.

Do not, without right, seriously hinder or interrupt the operation of an information system by entering, transmitting, deleting, destroying or altering digital data or by blocking access to it.

Do not produce, sell, obtain for use, import, possess or distribute, without right and in order to commit that offense, devices, computer programs, passwords or access codes designed or adapted for it.

Do not destroy, erase, or render useless another's computer records or the programs a computer uses, and do not distribute destructive programs capable of damaging computerized records, programs, or equipment.

Knowingly accessing a computer with intent to commit theft is computer fraud, graded by the degree of theft intended, up to a class A felony.

Knowingly or intentionally causing unauthorized damage to a computer, computer system, or computer network is computer damage, graded up to a class A felony where the computer manages or controls critical infrastructure.

Do not introduce, delete, alter or suppress computer data, or disable a computer system's operation, without authorization.

Do not hinder an information system's operation, or modify, delete, or render inaccessible data stored in it, without authorization; Btk. Section 423(2) makes this a felony independent of Section 423(1)'s access offense.

Do not intentionally hinder or interrupt an information system, or delete, damage, alter, suppress or intercept data on it, without lawful authority (ss. 3-5).

Do not produce, distribute or make available a computer programme, password, code or similar data designed for committing any of the section 2 to 5 offences (s. 6).

Do not obtain, hold, produce, reproduce, distribute, or supply codes, passwords, devices, or other means suited to accessing a computer or telematic system protected by security measures, or instructions enabling that access, without authorization.

Do not, without a legitimate reason, create or provide to another person an electronic record that gives an improper command making a computer, when a person uses it, fail to act as that person intends or act contrary to that intent, or a record describing such a command, where the purpose is to have it run on another person's computer.

Do not, without a legitimate reason, put a record that itself gives such an improper command into a state in which it is executed on another person's computer; an attempt is also an offence.

Do not knowingly and without authorization disclose a password, code, or other means of access to a computer, computer network, social networking website, or another person's personal electronic content.

Do not carry out intentional acts or omissions directed at disrupting the operation of an informatization object, such as a server or online service.

Do not modify, damage, destroy, impair, or conceal information in an automated data processing system without authorization, or knowingly enter false information into it, per Section 243.

Do not manufacture, adapt, distribute, acquire, transport, or store a tool, device, software, password, or access code intended to influence such a system's resources, or to gain unauthorized access to it for committing a crime, per Section 244.

Do not fraudulently damage or hinder the operation of an information system, or fraudulently enter, delete, or modify digital data hosted by one.

Do not intentionally hinder, disturb, or disrupt access to a service, hardware, software, or data source through the information network.

Do not interfere with a computer or electronic storage device owned by another, or the data or programmes on it, without the owner's consent, if you intend to secure an advantage for yourself or cause damage.

Do not change, delete, or otherwise make unusable or suppress data processed, transmitted, or supplied by automation that is not at your sole disposal, in a way that causes damage to another person.

Do not seriously interfere with the functioning of a computer system that you may not use, or may not use alone, by entering or transmitting data.

Do not, for criminal purposes or otherwise unlawfully, produce, transport, import, sell, give access to, distribute, acquire or hold devices or software directly intended or adapted to commit criminal offenses, or passwords, codes or similar data intended for connecting to an information system or a part of it.

Do not intentionally or knowingly damage a computer resource, or introduce or allow the introduction of a computer virus into one, without a reasonable ground to believe you have the right to do so.

Do not modify, damage, destroy, or impair the operation of computer equipment, a computer, a computer system, or a computer network without authorisation while crawling or otherwise interacting with it in Malta, under Article 337D of the Criminal Code.

Do not obtain, or attempt to obtain, a subscription-based or otherwise paid commercial computer service by false representation, false statement, unauthorized account charging, equipment tampering, or any other fraudulent means.

Do not deny computer system services to an authorized user.

Do not produce, hold, or supply a tool, device, password or access code principally designed to commit these offences, other than for authorized testing, research, or protecting an information system.

Do not damage, delete, deteriorate, alter, or suppress data belonging to a computer system without authorisation.

Do not intentionally affect the functioning of a computer system or network by introducing, transmitting, damaging, deleting, deteriorating, altering, or suppressing data.

Do not alter, damage, disrupt or destroy computer property or a computer service, or introduce data known to be false with intent to harm another's property or financial interests.

Do not make, import, sell, distribute, or advertise a device, or provide a service or publish information, intended to circumvent a technological protection measure if you know or have reason to believe it will be used to infringe copyright in the protected work.

Do not interfere with, alter, damage, or disable a computer system or the data it holds.

Do not cause the suppression, modification or alteration of data, or a malfunction of the system, when accessing or remaining present in it without right.

Do not violate electronic business order.

Do not delete, alter, damage or conceal computer data, a program, or a computer system without authorization, or otherwise disable or hinder the use of a computer system, data, program or computer communication.

Do not knowingly alter, damage or destroy a computer, computer system, computer network, or its software, programs, documentation or data without authorization, and do not access or use one for the purpose of defrauding, obtaining money, property or services by false pretenses, or committing theft.

Do not interfere with, damage, or disrupt an information system or data in Pakistan without authorization, which section 5 of the Act separately punishes.

Do not obstruct a data-processing operation by destroying, disabling, removing or altering the infrastructure that carries it out.

Do not damage, introduce, delete, deteriorate, alter, suppress, or make inaccessible another party's computer data.

Do not disable a computer system, impede access to it, or hinder or prevent its operation or the provision of its services.

Do not produce, obtain, sell, or supply a device, computer program, password, or access code adapted to commit an Art. 267, 268a, 269, or 269a offense; doing so is a separate offense under Art. 269b carrying imprisonment up to 5 years, unless you act solely to secure a system or to develop a securing method.

Do not hinder or attempt to hinder the functioning of an information system.

Do not use a computer or network without authority and with intent to disable, alter, or erase data or programs, or to cause a malfunction, even where no fraudulent purpose is involved.

Do not produce, distribute, or possess a device, program, password, or access code intended to commit one of these offences, per Cod penal art. 365.

Do not create, use, or distribute computer programs, or other computer information, known to be intended for unauthorized destruction, blocking, modification, or copying of computer information, or for defeating computer-information security tools, under Criminal Code Article 273; this reaches tools built to circumvent a site's technical access controls.

Do not interfere with data on, or the operation of, a computer system without lawful excuse or justification.

Do not modify data held in a computer system without authorization, including to impair the system's operation or the reliability of the data it holds.

Do not produce, sell, procure, import, distribute, or make available a device, access code, or password designed or intended for use in accessing an electronic system without authorisation.

Do not hold or access tools suited to enter a security-measure-protected system, or equipment or programmes designed to alter such a system or its data, without justified reason.

Do not delete, alter, damage, or conceal computer data or a program without authorisation.

Do not interfere with a computer system's operation or with computer data within it without authorization, including by unauthorized insertion, transmission, damage, deletion, degradation, alteration, suppression, or blocking of computer data.

Do not produce, import, procure, sell, exchange, distribute, or otherwise make available a device, computer program, password, access code, or similar data created to enable unauthorized access to a computer system.

Do not disrupt, deny, or inhibit access to software, data, or a computer system, or modify, change, alter, destroy, or disable software, data, or a computer system, without the owner's consent; these acts carry felony exposure up to a Class 2 felony (up to twenty-five years and a $50,000 fine) where the access is also part of a deceptive scheme to obtain money, property, or services.

Do not build, install, or distribute a tool whose purpose is to bypass a network's normal access-control or authentication procedures.

Do not deliberately introduce a computer virus into a computer or computer network without authority from its owner.

Do not intentionally cause unauthorised modification or damage to a computer, computer system, or computer programme in the course of an automated collection process.

Do not obstruct or disrupt access to a service, device, programme, or data source on the network (art. 5).

Do not introduce anything that suspends or disrupts a system's operation, or damages, deletes, or modifies a programme, on the network (art. 6).

Do not hinder another person's access to or use of a computer system by flooding it with data.

Do not build or use a program whose purpose is committing one of the offenses in this chapter (Article 362).

Do not obstruct or disrupt a computer system's operation, or corrupt, destroy, alter, or render inaccessible the data it holds, or insert or transmit its data without authorisation, regardless of whether the data taken is personal.

Do not create, distribute or sell software or technical means designed for unauthorized interference in the operation of an information, electronic communications or information-and-communications system or network.

Do not interfere, without authorization, in the operation of an information, electronic communications or information-and-communications system or network.

Do not access or cause to be accessed a computer, computer system, or computer network to devise or execute a scheme to defraud, or to obtain money, property, or services by false or fraudulent pretenses, representations, or promises.

Do not access, without authorization and for a fraudulent or other illegal purpose, a computer, computer system, computer network, computer software, computer program, or the data it contains, to alter, damage, or destroy it.

Do not destroy, alter, or render unusable data or computer systems belonging to another without authorization.

Do not do any act that causes unauthorised interference to a computer system, program or data; the fine and prison term rise sharply where the interference causes a financial loss over VT1,000,000, threatens national security or public health or safety, or causes physical injury or death.

Do not produce, sell, import, export, distribute or make available software, a device, a password or an access code for the purpose of unauthorised interception or interference with a computer system, except for authorised training, testing or protection of a computer system.

Do not cause the destruction or damage of a system, or of the data, information, or programs it holds, or interrupt its operation, when you access it; the penalty is higher where the system belongs to the Holy See, Vatican City State, or another public authority.

Do not obtain, reproduce, disseminate, or supply passwords or other means of accessing a protected system, or instructions for doing so, for profit or to cause harm.

Do not import, distribute, sell, or use equipment or programs meant to defeat a system's security measures.

Intentionally deceptive circumvention of a technical barrier to disable or alter data or programs squarely fits this statute's elements.

Do not knowingly and willfully access a computer, computer service, or computer network to execute a scheme to defraud or to obtain money, property, or services by fraudulent pretenses; this is a felony punishable by up to $10,000 and ten years, or both.

Do not introduce ransomware into a computer, computer system, or computer network with intent to extort money or other consideration; this is a separate felony punishable by up to $100,000 and ten years, or both.

Intentionally flooding a computer, program, system, or network with messages that exceed its processing capacity, causing an interruption in service, is a separate offense under this statute regardless of whether any data is altered.

Do not damage, delete, alter, or block access to computer data, or interfere with the functioning of a computer or information system, without lawful authority.

Do not communicate, disclose, or use an access code, password, or programme designed to gain unauthorised access to data or a computer system.

A research organization or cultural-heritage institution carrying out scientific research may reproduce and extract text and data from a lawfully accessible work without the rights holder's authorization, and must store the copies with appropriate security measures, per art. 36^1.

Keep a reproduction made under the general text-and-data-mining exception only for as long as the mining requires.