Quick Answer
Identify the prospect, get a confidentiality agreement signed, then screen. The identification program collects four items before the account opens and verifies identity within a reasonable time. Full discretion needs three writings, while time-and-price discretion needs none. The privacy rule defaults to opt out, not opt in.
The paperwork chain from first contact to a funded subscription, plus the privacy rules alongside.
Which One-Liners Win Points?
- Identify a contact as a legitimate potential investor before sharing any non-public detail, and sign the confidentiality agreement before the offering memorandum goes out.
- That agreement puts the recipient outside Regulation Fair Disclosure (Regulation FD), which reaches only a reporting issuer: live for a private investment in public equity, dead for a non-reporting start-up.
- Customer identification program (CIP): collect name, date of birth, address, and identification number before the account opens, then verify identity within a reasonable time before or after, by documents, non-documentary methods, or both.
- The know-your-customer (KYC) duty is broader and ongoing: reasonable diligence to know the essential facts about the customer and about each person's authority to act.
- Power of attorney for an individual, trust instrument for a trust, corporate resolution for a corporation. The rule demands the authorized names, not a titled document.
- Full discretion needs three writings: the customer's prior authorization to a named individual, the firm's acceptance, and prompt approval of each order, plus frequent review for excessive trading, by the firm or its designated principal.
- Limited time-and-price discretion needs none of the three, shows on the order ticket, and expires at the end of that business day absent a signed, dated written extension.
- Electronic delivery takes direct notice, access comparable to paper, and evidence of delivery, proved primarily by informed consent.
- A qualified institutional buyer (QIB) certification letter is signed by the chief financial officer or another executive officer and states the amount owned and invested on a discretionary basis, dated on or since the last fiscal year end.
- The privacy rule (Regulation S-P): the initial privacy notice is due no later than when the relationship begins. Sharing nonpublic personal information (NPI) with a nonaffiliated third party also needs an opt-out notice, a reasonable opportunity, and no opt-out.
Which Numbers Matter Most?
| Item | Value |
|---|---|
| Items collected before opening | 4, inside a 5-part program |
| Program records | 5 years after closing, or after the record is made |
| Opt-out opportunity | 30 days from mailing or online acknowledgment |
| Service-provider breach notice to the firm | 72 hours |
| Firm breach notice to customers | within 30 days of awareness |
Which Gotchas Trip Students Up?
- Collected and verified are different checkpoints, and a customer awaiting an applied-for taxpayer identification number can still open.
- The identification program and the know-your-customer duty are not one obligation: identity at opening against ongoing essential facts.
- Consent to electronic delivery must be affirmative and stays revocable. Silence is not consent, and a website posting is not direct notice.
- A global consent demanded as the price of opening an account is not informed, unless the firm runs everything online.
- Signing and funding a subscription agreement does not complete the sale. The issuer's acceptance does, and it may reject in part.
- The privacy default is opt out, a letter-only opt-out is not reasonable, "other exceptions" is a closed list of seven, and the breach clock starts at awareness.
One-Breath Recap
Identify a legitimate prospect and sign the confidentiality agreement before any non-public detail goes out. The identification program collects four items before opening and verifies identity within a reasonable time, while the know-your-customer duty runs on afterward. Full discretion needs written customer authorization, written firm acceptance, and written approval of each order, while time-and-price discretion needs none and dies at the end of the business day. Electronic delivery needs notice, access, and proof of delivery, and the privacy rule defaults to opt out.
Need more than the recap? Read the full Customer Documentation and Screening unit.