Does Regulation S-p Apply To Registered Advisers

Updated as of: Jan 23, 2003

Staff Responses to Questions about Regulation Due south-P

The staff of the Division of Investment Management has prepared the following responses to questions virtually Regulation S-P, which implements the privacy provisions in Title V of the Gramm-Leach-Bliley Act ("GLBA").ⁱ The adopting release for Regulation S-P² can exist found at: world wide web.sec.gov/rules/final/34-42974.htm. These responses correspond the views of the staff of the Partitioning of Investment Management. They are not a rule, regulation, or statement of the Securities and Exchange Committee, and the Committee has neither canonical nor disapproved this information.

Telescopic of Regulation S-P

Question 1

Q: Does Regulation S-P³ employ to a financial establishment, such as a "hedge fund," that meets the criteria for exclusion from regulation under sections 3(c)(1) or iii(c)(7) of the Investment Visitor Act of 1940 ("ICA")?

A: No. GLBA authorized the Commission to adopt and enforce rules implementing GLBA with respect to "investment companies" nether the ICA.⁴ A fiscal institution⁵ that meets the criteria in sections 3(c)(1) or 3(c)(7) of the ICA is not an "investment company" under that statute, and therefore is non subject to Regulation South-P.⁶ GLBA gives the Federal Merchandise Committee regulatory potency for any financial establishment that is non subject field to the jurisdiction of whatever other regulator under that Act.^vii

Consumer and Client Human relationship

Question 2

Q: Does a wrap account client who has a written contract with the wrap account sponsor, but not with the wrap account's investment adviser, take a customer human relationship with the investment adviser?

A: Yes. Regulation S-P defines a client relationship as a continuing relationship between a consumer and a financial establishment.^viii Examples of a customer relationship include an individual who has an advisory contract with an investment adviser.⁹ Sectionalisation staff has stated that for purposes of the brochure delivery rule under the Investment Advisers Act,¹⁰ a contractual human relationship exists between a wrap account client and the portfolio managing director, even in the absence of a written contract.¹¹ Nosotros believe the aforementioned assay applies nether the privacy rules, and therefore that a wrap account customer has a customer relationship with the portfolio managing director for purposes of Regulation S-P.¹²

Question 3

Q: Does an investment adviser that has only institutional clients, including pension plans, have customers to whom the adviser must provide privacy notices under Regulation Due south-P?

A: No. Regulation South-P requires an investment adviser to provide certain privacy notices to its customers and consumers.¹³ Under the regulation, a "consumer" or a "customer" must be an individual.^fourteen Therefore a customer that is not an individual, such as a pension programme, is neither a consumer nor a customer of the adviser.¹⁵

Question 4

Q: Is an private who purchases investment company ("fund") shares through a broker-dealer a customer of the fund nether Regulation S-P fifty-fifty if the fund has no direct contact with the individual?¹⁶

A: Yes, if the individual owns the fund shares in his or her own name. The examples in Regulation Due south-P provide that an individual who is the record holder of fund shares is the fund'south customer.¹⁷ If the banker-dealer is the record holder of fund shares for the benefit of the individual, the private would not exist a fund customer under Regulation Due south-P.^eighteen

Privacy Notices

Question 5

Q: Can an initial or annual privacy notice be incorporated into another certificate (such as an account statement, annual report, prospectus, merchandise confirmation, Grade ADV, or adviser's brochure)?

A: Regulation S-P does not prohibit financial institutions from combining a privacy notice with another document.¹⁹ Any privacy notice, however, must be clear and conspicuous.²⁰ Therefore a privacy notice that is combined with some other certificate must be distinct from and not hidden in other information in the certificate.²¹ In addition, a fiscal institution must deliver a privacy observe to customers each year even if other information in the combined document demand not be delivered annually (such equally an investment adviser's brochure).²²

Question 6

Q: Must a privacy notice provided jointly past multiple financial institutions in a fund complex separately name each institution to which the privacy policy applies?

A: No, as long as the notice conspicuously identifies the financial institutions covered by the privacy policy every bit members of the fund complex. For example, a privacy policy for the ABC fund complex could land that it applies to all funds that include the ABC name. Conversely, notwithstanding, if the privacy policy applies to additional funds that do non include the ABC name, the policy should specifically place those additional funds.

Question vii

Q: Regulation S-P permits a fiscal institution to evangelize a single annual privacy notice to multiple customers who share an accost ("household") if the notice is in or accompanies a shareholder written report or a prospectus delivered nether the Commission's householding rules.²³ Tin can a fund satisfy the almanac privacy notice requirement by delivering the notice in or with documents that are delivered to multiple shareholders at the same address ("householding"), fifty-fifty if those documents (such as account statements) are not covered past the Commission'southward householding rules?

A: Yep, if the fund obtained consent to household those types of documents in the manner ready forth under the Commission'south householding rules.²⁴

Question 8

Q: Regulation Southward-P requires that funds deliver: (i) an initial privacy discover to new customers non later than when the customer relationship is established, and (ii) an almanac privacy notice to all customers. Regulation S-P also requires, as a one-fourth dimension phase-in of the initial notice requirement, that funds deliver by July 1, 2001 an initial privacy observe to each individual who is a record owner of fund shares as of that appointment.²⁵ As noted in the response to question 7 to a higher place, funds may include an annual privacy notice in or with sure documents that are householded under Commission rules. Can a fund also household the initial privacy observe that must be sent to existing customers by July ane, 2001?

A: Aye, in certain circumstances. Regulation S-P permits householding of annual privacy notices because the Commission believed that customers whose documents are householded besides would consent to having their annual privacy notices householded.²⁶ The Commission was unwilling to brand the same assumptions for customers whose documents are not householded.²⁷ The Commission likewise did non allow banker-dealers, funds, or investment advisers to household initial notices.²⁸ A customer must receive an initial notice no afterwards than when the client relationship is established, and therefore is likely to receive the initial notice before he or she has find of householding. The concern that a fund might provide a unmarried initial notice to new customers who are unaware that documents will be householded does not extend, nonetheless, to the initial find provided to existing customers (by July one, 2001) whose documents are householded. Accordingly, the staff would non recommend enforcement action to the Committee if, prior to July i, 2001, a fund households initial privacy notices (i) in the manner provided for householding annual privacy notices,²⁹ or (ii) for documents that do non autumn under the Commission's householding rules, as provided in the response to question 7 above.

The staff's position would not permit a fund to household an initial observe that is combined with an opt out notice.³⁰ Regulation South-P does not allow financial institutions to household opt out notices. An opt out notice must provide a reasonable means for the consumer (or client) to opt out,³¹ and the Commission did not presume that customers whose disclosure documents are householded would consent to householding the means by which the customer must practise his or her correct to opt out.³² Therefore, if a fund is required to deliver opt out notices (considering, for example, it shares information with nonaffiliated parties outside of an exception), the fund cannot household commitment of the opt out notices.³³

Question 9

Q: Can a fund deliver to a customer with multiple accounts a single initial or annual privacy notice that applies to all the accounts?
A: Yes, as long as (i) the privacy find makes clear each of the accounts to which it applies, (2) the privacy notice is accurate with respect to the privacy policies applicative to each business relationship, and (iii) a customer with multiple accounts who receives a single detect can reasonably exist expected to receive actual notice in writing with respect to each account.³⁴ For case, a customer who receives multiple account statements in a single envelope or who receives a consolidated account statement can reasonably be expected to receive actual notice of a fund's privacy policy that is included in the envelope with the account statement(south).

Question x

Q: Does posting an institution'southward privacy policy on its website satisfy the notice requirements for the institution's website users?

A: An institution must provide privacy notices then that each consumer can reasonably be expected to receive bodily observe in writing or, if the consumer agrees, electronically.³⁵ An institution cannot reasonably wait that all its customers volition receive actual notice in writing of a privacy notice that is posted at a item location, whether that location is an advertising site, the institution's premises, or the institution's web site.³⁶ Equally provided in the examples in Regulation South-P, an institution may reasonably expect that a consumer (or customer) will receive actual notice if, for a consumer (or customer) who conducts transactions electronically, the institution posts the notice on the website and requires the consumer to acknowledge receipt of the detect as a necessary step to obtaining a particular fiscal product or service.³⁷ The examples besides provide that an establishment may reasonably expect that a client volition receive actual notice of the establishment's annual detect, if the customer uses the institution's web site to access fiscal products and services electronically and agrees to receive notices at the spider web site, and the institution posts its electric current privacy notice continuously in a clear and conspicuous manner on the web site.³⁸

Question 11

Q: Can a fund provide the initial privacy discover to a new customer after the customer invests, when information technology delivers the fund's prospectus and confirmation?

A: No. GLBA requires a fund to provide an initial notice to customers no later on than the time the customer relationship is established. Regulation Due south-P provides that an private establishes a client relationship with a fund when the individual purchases fund shares in his or her own name (i.e., the trade date).³⁹ Thus, an initial privacy notice provided with a prospectus and confirmation would need to be provided to the investor no after than the merchandise date.

Regulation Southward-P provides exceptions to this delivery rule in certain circumstances. A fund may provide the initial privacy discover within a reasonable time after information technology establishes a customer relationship if: (i) establishing the customer relationship is not at the customer'due south election; (2) providing detect no later than when the fund establishes a customer human relationship would substantially delay the customer's transaction and the customer agrees to receive the notice at a later on time; or (iii) a nonaffiliated banker or dealer establishes a customer relationship between the fund and a consumer without the fund's prior noesis.⁴⁰

Question 11.01

Q: When must an insurance visitor dissever account provide an initial privacy policy to a new customer who purchases a variable annuity or variable life contract?⁴¹

A: GLBA requires a fund to provide an initial privacy discover to customers not afterward than the time the customer human relationship is established. An private establishes a customer relationship with an insurance visitor separate account when the individual purchases a variable annuity or variable life contract (i.e., the date the separate account problems the contract).⁴² Thus, the split business relationship must provide an initial privacy notice to its client non subsequently that the fourth dimension it issues the contract.

Question 11.02

Q: If a variable annuity or variable life contract provides for a total refund of the buy payments upon rescission by a new customer during the "free-expect" period,⁴³ can an insurance company separate business relationship provide the initial privacy notice to the client when it delivers the variable contract before the cease of the free-look period?

A: Aye. The release adopting Regulation Southward-P states that in most circumstances, a fund (including an insurance company dissever account) "should give the initial notice at a bespeak when the consumer however has a meaningful option about whether to enter into the customer relationship."⁴⁴ If an investor may fully recover investment costs upon rescission of the contract, then, every bit of the date the variable contract is delivered, the investor still has a meaningful choice every bit to whether there volition be a continuing relationship.⁴⁵ In those circumstances, the staff would non recommend enforcement action to the Commission if an insurance company split account provides the initial privacy find to the investor when it delivers the variable annuity or variable life contract earlier the end of the complimentary-wait flow.⁴⁶

Question 12

Q: When must a closed-end fund provide an initial privacy detect to new investors who purchase fund shares on the secondary market?

A: Closed-end funds are discipline to the same initial privacy notice delivery requirements as open up-end funds (see response to question eleven for these requirements). Therefore, if an investor buys shares of a closed-end fund that he or she does not already ain through a banker or dealer affiliated with the fund, the fund must provide an initial privacy observe to the investor no afterwards than when the fund establishes the client relationship (i.e., when the investor purchases fund shares in his or her own name).⁴⁷ If an investor purchases the shares of a closed-end fund that he or she does not already own through a banker or dealer unaffiliated with the fund, the fund would accept a reasonable fourth dimension to provide an initial find to the investor after the customer human relationship is established.⁴⁸ Under these circumstances, a "reasonable time after . . . establish[ing] a client relationship" includes a reasonable time after the fund learns of the customer'southward buy of the fund shares.

Exceptions to Opt Out

Question 13

Q: Must an investment adviser permit its customers to opt out before the adviser shares nonpublic personal information about the customers with (i) a nonaffiliated broker-dealer in guild to execute trades on behalf of the customers or (ii) a nonaffiliated custodian that holds securities on behalf of the customers?

A: No. Regulation S-P permits financial institutions in certain circumstances to share nonpublic personal information virtually consumers (and customers) with nonaffiliated third parties without providing them with notice of and opportunity to opt out.⁴⁹ These circumstances include sharing information with a nonaffiliate (i) as necessary to outcome, administer, or enforce a transaction that a consumer requests or authorizes, (ii) in connexion with processing or servicing a financial product or service a consumer authorizes, and (3) in connection with maintaining or servicing the consumer's business relationship with the institution.⁵⁰ Under these exceptions, an investment adviser need non provide a customer the opportunity to opt out before sharing nonpublic personal data most the customer with (i) a nonaffiliated banker-dealer in order to execute trades the customer has authorized and (ii) a nonaffiliated custodian that holds securities on behalf of the customer.

Monitoring Third Parties

Question xiv

Q: Is an investment adviser responsible for the privacy policies of broker-dealers that execute transactions the adviser's clients have authorized, or of funds that the adviser recommends to its clients?

A: No. A financial institution is non responsible under Regulation S-P for the privacy practices of a nonaffiliated 3rd party with whom the institution shares information nether an exception listed in sections 248.14 or 248.15 (such as a broker that executes transactions the client has authorized). Regulation S-P limits the ability of these nonaffiliates to utilise and share information they have received in those circumstances.⁵¹ If the nonaffiliate receiving the data under an exception is a broker-dealer, fund, or investment adviser registered with the Commission, the Committee could enforce the provisions of Regulation Southward-P with respect to the nonaffiliate.⁵²

Endnotes

¹ Pub. L. No. 106-102, 113 Stat. 1338, §§ 501-527 (1999) (codification at 15 United statesC. §§ 6801-6827). The staff responses were first issued on April 9, 2001, and take been updated, every bit noted higher up.

² Privacy of Consumer Financial Information (Regulation S-P), Investment Visitor Human activity Release No. 24543 (June 22, 2000) [65 Fed. Reg. 40334 (June 29, 2000)] ("Adopting Release").

ⁱⁱⁱ See 17 CFR Part 248; Adopting Release, supra note 2.

⁴ See GLBA, supra notation ane, §§ 504(a)(1), 505(a)(iv). GLBA also gave the Commission regulatory authority nether the Securities Exchange Act of 1934 with respect to broker-dealers, and nether the Investment Advisers Act of 1940 with respect to investment directorate registered with the Committee. Id. §§ 504(a)(one), 505(a)(3), (5).

⁵ GLBA defines "financial institution" to mean "any establishment the business of which is engaging in financial activities as described in section iv(k) of the Bank Holding Company Human action of 1956." Id. § 509(three)(A).

⁶ See 15 U.s.C. 80a-3(c)(ane) (issuer whose outstanding securities are endemic by no more than 100 persons and that is not making and does not propose to brand a public offering of its securities is non an investment company); 15 UsC. 80a-3(c)(7) (issuer whose securities are owned merely by "qualified purchasers" and that is not making and does not suggest to brand a public offer of its securities is not an investment visitor).

⁷ Come across GLBA, supra note ane, at §§ 504(a)(1), 505(a)(7). Under GLBA, the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve Organization, the Federal Deposit Insurance Corporation, and the Part of Thrift Supervision are the regulators for national and land banks; the National Credit Spousal relationship Administration is the regulator for federally insured credit unions; and state insurance authorities are the regulators for insurance providers. Id. § 505(a)(1), (two), (6). In add-on, the Commodity Futures Modernization Deed of 2000 ("CFMA") provides that the Commodity Futures Trading Commission ("CFTC") is the regulator, for purposes of GLBA, for futures committee merchants, commodity trading advisors, commodity pool operators, and introducing brokers bailiwick to the CFTC's jurisdiction nether the CFMA. CFMA, Pub. Fifty. No. 106-554, § 124, 114 Stat. 2763, 2763A-411 (2000).

^eight 17 CFR 248.three(one thousand)(1).

⁹ Run into 17 CFR. 248.iii(one thousand)(2)(B).

¹⁰ Encounter 17 CFR 275.204-3.

¹¹ Come across National Regulatory Services, Inc., SEC No-Activity Letter (Dec. two, 1992) ("NRS") at n.4.

¹² It may be unclear when the customer relationship with the portfolio manager is established in a wrap account and, therefore, when the portfolio managing director must provide the initial notice to the customer. Regulation S-P provides that a customer relationship is established when the consumer enters into a contract with the adviser. Run across 17 CFR 248.iv(c)(3)(iii). The staff has previously stated that information technology believes the contractual relationship arises no subsequently than the time the portfolio manager begins to provide services to the client. See NRS, supra note 11,. at text post-obit n. 4. Therefore, a portfolio director must provide an initial privacy notice to a wrap account client no later on than when information technology begins to provide services to the client.

¹³ The adviser must provide to customers: (i) an initial privacy notice generally not later than when the customer relationship is established, and (ii) an annual privacy notice afterwards that. 17 CFR 248.iv(a)(one), 248.5(a)(i). Run into as well 17 CFR 248.8 (requiring a financial institution to provide a revised privacy notice before sharing nonpublic personal information almost a consumer with a nonaffiliate other than equally described in the initial privacy notice provided to the consumer). If an adviser intends to share nonpublic personal information well-nigh a consumer with a nonaffiliated third party (other than under an exception), the adviser must provide the consumer with an initial find and opportunity to opt out of the sharing. 17 CFR 248.10(a)(one).

¹⁴ Run into 17 CFR 248.3(g)(one) (a "consumer" is an individual who obtains or has obtained a financial product or service from a financial institution primarily for personal, family, or household purposes, or that individual's legal representative); 17 CFR 248.iii(j), 248.iii(k)(1) (a "customer" is a consumer who has an ongoing relationship with the institution).

¹⁵ Come across Adopting Release, supra note two, at n.43. Beneficiaries of a pension program that is the adviser's customer also would non be the adviser's customers. Any individual adaptation clients to whom the adviser provides personal fiscal services would, yet, be the adviser's customers for purposes of Regulation S-P.

¹⁶ Funds may have indirect contact with individual shareholders, who receive fund prospectuses and shareholder reports through a banker-dealer.

¹⁷ Run across 17 CFR 248.3(grand)(2)(i)(C). See also Adopting Release, supra annotation 2, at text preceding n.59.

^xviii A fund may receive nonpublic personal information nigh a beneficial shareholder from a broker-dealer under an exception in sections 248.14 or 248.15 (to provide tax information direct to the shareholder for example). Run into 17 CFR 248.14, 248.fifteen. A fund that receives nonpublic personal information about shareholders under an exception in sections 248.14 or 248.15 is limited in the ways in which information technology tin can share or use that information. Run across 17 CFR 248.eleven(a).

¹⁹ Encounter Adopting Release, supra note 2, at text following n.28 (discussion of combined notices). Run into besides 17 CFR 248.three(c)(2)(ii)(Eastward) (examples of methods for making a privacy notice "clear and conspicuous" when it is combined with another document).

²⁰ See 17 CFR 248.four(a)(1), 248.v(a)(1), 248.seven(a)(i).

²¹ See 17 CFR 248.3(c) (a clear and conspicuous notice is designed to call attending to the nature and significance of the information in the discover); 17 CFR 248.3(c)(2)(E) (examples of blueprint techniques that call attention to the nature and significance of a privacy detect combined with other information include using distinctive type size, style, and graphic devices).

²² See 17 CFR 275.204-3(c)(1) (an investment adviser must deliver or offer in writing to evangelize to each of its clients a written disclosure statement).

²³ Encounter 17 CFR 248.9(c)(2); 17 CFR 230.154 (permitting public companies to household prospectuses); 17 CFR 270.30d-1(f) (permitting management companies to household semi-almanac stockholder reports); 17 CFR 270.30d-2(b) (permitting unit investment trusts to household semi-annual shareholder reports).

²⁴ Come across 17 CFR 230.154(a)(3) (requiring written consent to household prospectuses); 17 CFR 230.154(b) (atmospheric condition for implied consent to household prospectuses); 17 CFR 230.154(c) (almanac notice to shareholders of right to revoke consent); 17 CFR 270.30d-i(f)(1)(iii) (requiring written consent to household shareholder reports); 17 CFR 270.30d-ane(f)(2) (atmospheric condition for implied consent to household shareholder reports); 17 CFR 270.30d-ane(f)(3) (annual notice to shareholders of right to revoke consent); 17 CFR 270.30d-2(b) (incorporating requirements of rule 30d-1(f) for householding reports to shareholders of unit investment trusts).

²⁵ 17 CFR 248.eighteen(b)(1).

²⁶ See Adopting Release, supra note 2, at text post-obit north.139.

²⁷ See id.

²⁸ The Commission noted that (i) it believed any reduction in the number of initial notices consumers might receive would exist minimal, and (two) individuals who share the same address may not get consumers of the fiscal institution at the same time. Id. at text following due north.139.

²⁹ See 17 CFR 248.nine(c)(2). The staff also would non recommend enforcement activity to the Commission if a fund delivers an annual detect in or with an annual report or proxy statement under the weather in 17 CFR 240.14a-3(e).

³⁰ A financial establishment may combine an opt out notice with an initial notice. See 17 CFR 248.7(b).

³¹ Encounter 17 CFR 248.7(a)(3). By dissimilarity, an initial or annual notice must include an explanation of the consumer'southward right to opt out, including the method by which the consumer may exercise the right to opt out. See 17 CFR 248.six(a)(6).

³² Sure methods of opt out, such equally a check-off box, would require a dissever form for each customer to exercise the opt out right. Other means, such as a price-gratis number, would allow multiple customers to opt out even if they received one form. The Commission did non, nevertheless, provide an exception for householding opt out notices based on the means of opt out.

³³ When a fund delivers an opt out notice, it also must include a re-create of the privacy notice. See 17 CFR 248.vii(c) (fund that provides an opt out notice after the initial notice must include a copy of the initial notice with the opt out detect).

³⁴ Run across 17 CFR 248.iv(a) (initial notice must be articulate and conspicuous and accurately reverberate the fiscal institution's privacy policies), 248.5(a)(1) (aforementioned for annual notice), 248.9(a) (privacy notices must be delivered so that each consumer tin can reasonably exist expected to receive actual find). The regulation does non prohibit an institution from providing a single privacy find to a customer regarding all the client's accounts. See 17 CFR 248.4(d)(two) (if the initial, revised, or annual notice that a fund most recently provided to a customer was accurate with respect to a new fiscal production or service, the fund need non provide the client a new privacy notice).

³⁵ 17 CFR 248.9(a).

³⁶ See 17 CFR 248.9(b)(ii) (an institution may non reasonably await that a consumer will receive actual notice of the institution's privacy policies if the institution just posts the policies in a co-operative office, generally publishes advertisements of the policies, or sends a notice by e-mail to a consumer who does not obtain financial products or services from the institution electronically).

³⁷ 17 CFR 248.nine(b)(i)(iii).

³⁸ 17 CFR 248.9(c)(one)(i).

³⁹ Come across 17 CFR 248.4(c)(3)(iv).

⁴⁰ 17 CFR 248.4(eastward)(1).

⁴¹ Variable contracts are securities under the Securities Act of 1933. See, eastward.g., SEC v. Variable Annuity Life Ins. Co., 359 U.S. 65, 71-73 (1959). Variable annuity and variable life insurance payments are allocated to a segregated asset account, or "split up account," which typically is registered equally an investment visitor under the ICA. See Prudential Ins. Co. v. SEC, 326 F.second 383 (3d Cir.), cert. denied, 377 U.S. 953 (1964). See too 15 UsC. 80a-2(a)(37) (definition of "separate account" under the ICA).

⁴² See 17 CFR 248.four(c)(3)(four) (a customer human relationship with a fund is established when the consumer (who is the record possessor) purchases shares the fund has issued).

⁴³ Variable annuity and variable life contracts typically contain a "gratuitous-look" provision that gives the contract owner the correct to render the contract within a specified period for a refund. See Frederick R. Belamy & Steven B. Boehm, The Investment Company Regulation Deskbook §17.iv[1] (Amy L. Goodman, ed., 1997).

⁴⁴ Adopting Release, supra annotation 2, at text accompanying northward.98.

⁴⁵ Run across 17 CFR 248.3(chiliad)(1) (defining "client relationship" to mean a continuing relationship betwixt a consumer and a financial institution).

⁴⁶ This position is in comity with the requirements of the National Association of Insurance Commissioners' Privacy of Consumer Financial and Health Information Model Regulation. Run into National Clan of Insurance Commissioners, Privacy of Consumer Fiscal and Health Information Model Regulation, Art. 2, § v.A(one) (initial privacy notice must exist provided not afterwards than when the customer relationship is established); Art. Two, § 5.C(2)(a) (customer human relationship is established upon delivery of the insurance contract).

⁴⁷ See 17 CFR 248.five(a)(1); 248.iv(c)(iii)(four). If the investor already owns shares of the fund, he or she already will accept received an initial privacy discover, and need not receive some other initial discover.

⁴⁸ Come across 17 CFR 248.iv(eastward)(i)(3).

⁴⁹ Come across 17 CFR 248.thirteen, 248.14, 248.15.

⁵⁰ 17 CFR 248.14(a)(1)-(2). Run into as well 17 CFR 248.14(b)(ane) ("necessary to effect, administer, or enforce a transaction" includes information sharing that is required or is a usual, appropriate, or acceptable method to carry out the transaction or the product or service business concern of which the transaction is a part, and tape, service or maintain the client's business relationship in the ordinary course of providing the financial service).

⁵¹ See 17 CFR 248.11(a).

⁵² See GLBA, supra note ane, at § 505(a)(3)-(5). Another regulator specified in GLBA would enforce the privacy regulations with respect to a nonaffiliated fiscal institution discipline to that regulator's jurisdiction. See supra note 7. Encounter as well Adopting Release, supra annotation 2, at text preceding n.157.

http://www.sec.gov/divisions/investment/guidance/regs2qa.htm