Customer Privacy

The whole unit on one sheet: confidentiality controls, Regulation S-P disclosures, beneficial-owner elections, and Regulation S-ID identity-theft protection.

Which One-Liners Win Points?

• Customer information needs a permitted purpose. A firm controls access whenever information moves between departments or leaves the firm.
• Fiduciary ownership information performs its function, not a sales pitch. A member cannot use information gained as a paying agent, transfer agent, or trustee to solicit purchases, sales, or exchanges, unless the issuer requests it and the member acts on the issuer's behalf.
• Regulation S-P is privacy; Regulation S-ID is red flags. S-P protects and shares customer information; S-ID watches for signs of identity theft in covered accounts.
• Nonpublic personal information can hide inside a public grouping. A consumer list built from nonpublic financial data stays nonpublic personal information even when it also contains public information.
• Opt out is the usual choice, not opt in. Most disclosures of nonpublic personal information to nonaffiliated third parties give the customer a chance to opt out.
• OBO objects; NOBO does not. The election concerns identity disclosure to the issuer, not the fact of beneficial ownership.

How Does Regulation S-P Control Customer Information?

• Requires a privacy notice describing the firm's privacy policies, practices, and information-sharing.
• Sets conditions before a firm discloses nonpublic personal information (NPI) to a nonaffiliated third party.
• Gives the customer an opt-out opportunity for most such disclosures, subject to exceptions.
• Requires the firm to protect customer records from unauthorized access or use.
• Requires reasonable measures and written procedures for secure disposal of customer information.
• Applies even when information moves outside the firm; privacy controls and disclosure conditions still apply.

Who Decides OBO or NOBO?

• Applies to a beneficial owner of securities registered in the name of a broker-dealer, a registered clearing agency, or its nominee.
• The election is a privacy choice about disclosure, not a test of whether someone holds securities beneficially.

Memory Aid: OBO = Objects, NOBO = No Objection.

Which Gotchas Trip Students Up?

• Fiduciary ownership information is not a general solicitation list. The exception requires an issuer request and solicitation on the issuer's behalf, never the member's own benefit.
• The usual choice is opt out, not opt in. Watch for a question that flips the default for nonaffiliated-third-party disclosure of nonpublic personal information.
• Regulation S-P requires more than a disclosure form. It also requires safeguards against unauthorized access or use, and secure disposal procedures.
• OBO and NOBO classify a disclosure choice, not an ownership type. For nominee-held securities, the designation never answers whether someone holds securities beneficially.
• Regulation S-ID covers possible identity theft involving covered accounts, not general privacy. Regulation S-P protects and shares customer information; Regulation S-ID detects, prevents, and mitigates identity theft.

One-Breath Recap

Customer privacy runs on controlled access: a firm protects customer information from improper use and disclosure inside and outside the firm, and fiduciary ownership information from a paying agent, transfer agent, or trustee cannot support a solicitation unless the issuer requests it and the member acts on the issuer's behalf. Regulation S-P requires a privacy notice, an opt-out choice before most nonpublic personal information sharing with nonaffiliated third parties, plus safeguards and secure disposal, and such information can hide inside a public grouping. A beneficial owner of nominee-held securities elects whether the issuer learns their identity: an objecting owner says no, a non-objecting owner says yes, and neither changes the ownership. Regulation S-ID closes the loop with a written program that identifies, detects, responds to, and updates identity-theft red flags for covered accounts.

Need more than the recap? Read the full Customer Privacy unit.