Financial Services

The managers who know each person's job should confirm, reduce or remove each account, and the CCO or another designated reviewer should sign and date a summary of the full review. For broker-dealers, the reviewer and the process belong in written supervisory procedures under FINRA Rule 3110 so the sign-off becomes part of the supervisory record.

Yes. Systems outside single sign-on are easy to miss, because disabling someone's main account does not remove access to them. Include custodian platforms, CRM, planning software, client portals and archives that hold customer information, export each user list on the review date, and record who confirmed each account and when fixes were completed.

No SEC rule names specific tools, but Regulation S-P requires written safeguards for customer information and oversight of service providers. A personal account gives the firm no contract, admin console, audit log or retention control, which makes that oversight hard to show. Most firms approve a firm-managed business plan and block personal AI accounts on firm devices.

The letter sent to the client, yes. Rule 204-2(a)(7) requires SEC-registered advisers to keep written communications sent relating to recommendations or advice, generally for five years. Whether the AI prompts and intermediate drafts must also be kept is a decision firms should make with counsel and write into their policies, then configure retention to match.

No SEC or FINRA rule names AI notetakers. Firms apply the existing content tests in Rules 204-2(a)(7) and 17a-4(b)(4), and FINRA Regulatory Notice 24-09 says its rules apply when firms use generative AI. Each firm should decide in its written procedures how transcripts and summaries are treated, then make sure it can retain and produce them.

Tasks that never need an applicant's identifiers carry the least risk: summarizing a carrier's underwriting guidelines, comparing policy form language, drafting coverage explanations, and writing follow-up emails with placeholders instead of names. Pasting full applications, loss runs, driver's license numbers or health questionnaires into a tool is where agencies need an approved platform, contract terms and data loss prevention rules.

Yes. OpenAI, Anthropic, Google and Microsoft all rely on a header added to encrypted traffic, so the proxy or security service must decrypt and re-encrypt it. That means deploying a trusted certificate to firm devices. A cloud security service with an agent on each laptop applies the control away from the office network too.

Only if it applies firm-wide and covers every path the data can take. Check whether an administrator or each user sets the opt-out, whether rating a response or sending feedback creates an exception, whether free or personal accounts follow different terms, and whether a third-party model provider behind the tool has its own training terms. Get unclear points answered by the vendor in writing.

They should state how long prompts, outputs, uploaded files and transcripts are kept, whether a separate period applies to abuse or safety monitoring, and whether an administrator can shorten it. They should also cover what happens to firm data when a user is removed or the contract ends, how long deletion from backups takes, and whether the vendor will confirm deletion in writing.

No. Under amended Regulation S-P, notice depends on whether sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. It is due within 30 days unless a reasonable investigation finds no reasonable likelihood of use that would cause substantial harm or inconvenience. A deletion confirmation is evidence for that investigation, and waiting for one does not pause the clock.

Review an approved AI vendor before its scheduled date when its terms of service or privacy policy change, when it adds a new model, sub-processor or feature that touches client data, when it reports a security incident, when it is acquired, or when staff start using it for a new purpose. Each of these can change the risk the original approval was based on.

It can be. Regulation S-P defines a service provider as any person or entity that receives, maintains, processes or otherwise is permitted access to customer information through services provided directly to the firm. If advisers put customer information into a firm-contracted AI tool, the vendor likely fits, and the firm's due diligence, monitoring and 72-hour breach notice requirements apply. Confirm the analysis with counsel.

No rule prescribes a format. A practical inventory lists each vendor and the platform it connects to, the customer data in scope, the permission level (read only, trading or money movement), the credential type and last rotation date, the internal owner, the vendor's breach notification commitment, and the date and evidence of the last due diligence review.

From a compliance view, the best AI tool is the one the firm controls. ChatGPT Business or Enterprise and Claude for Work come with business terms that the vendors say exclude training on customer data by default, plus admin settings and single sign-on on qualifying plans. Pick one platform, connect it to your identity provider, block personal accounts, and keep the vendor file current.

An allowlist is the practical approach for firms handling client financial data. Chrome and Edge both support blocking all extensions except those the firm approves, with a request process for new ones. CIS Safeguard 9.4 calls for restricting unauthorized browser extensions. Approved extensions can still be kept off sensitive sites such as the CRM or custodian portals with the runtime_blocked_hosts setting.

Yes. OpenAI supports a ChatGPT-Allowed-Workspace-Id header that a TLS-inspecting proxy or security service adds to chatgpt.com traffic. Only the listed Enterprise workspaces remain usable, and personal workspaces are filtered out. Logged-out use needs a separate URL block, and the desktop and mobile apps need certificate handling or a block.

Yes. An extension with permission to read and change data on websites can see what appears on a page, including AI chat prompts and responses. OX Security reported in December 2025 that two look-alike AI sidebar extensions with about 900,000 combined users sent ChatGPT and DeepSeek conversations to an outside server. Firms can limit this with an extension allowlist and by blocking extensions from sensitive sites.

For confidential conversations, yes. California Penal Code 632 prohibits recording a confidential communication without the consent of all parties, and Section 637.2 allows civil claims of $5,000 per violation. A client portfolio or planning review will usually qualify as confidential. Federal law requires only one party's consent, but the stricter state rule still applies. Confirm multi-state calls with counsel.

California Insurance Code 791.13 bars agents from disclosing personal or privileged information from an insurance transaction unless an exception applies. One exception covers a person performing a business function for the agent who agrees not to disclose the information further. Whether an AI vendor fits depends on its contract terms, including training and retention. Confirm the analysis with counsel before relying on it.

No. If the number arrived with the request, the person who sent the request may control it. The FBI advises ending the call, looking up the contact information yourself and calling it directly, and its business email compromise guidance says to verify payment changes in person or through a known telephone number. Use the number in your records from before the request arrived.

They can. The GLBA exemption in Civil Code section 1798.145(e) expressly does not apply to section 1798.150, the CCPA's private right of action for breaches of nonencrypted and nonredacted personal information caused by a failure to maintain reasonable security. Statutory damages are $107 to $799 per consumer per incident, as adjusted January 1, 2025, or actual damages if greater.

No. The CCPA's partial exemption for job applicant, employee and contractor data in Civil Code section 1798.145(m) became inoperative on January 1, 2023, along with the business-to-business exemption in subdivision (n). California employees and applicants of a covered business now have CCPA rights in their personal information, including notice, access, deletion and correction.

No. Civil Code section 1798.145(e) exempts personal information collected, processed, sold or disclosed subject to the Gramm-Leach-Bliley Act. It exempts data, not companies. A financial firm that meets the CCPA's business definition still owes CCPA obligations for employee, applicant, website visitor, prospect and business contact data that is not handled under GLBA.

Usually not. Civil Code section 1798.145(e) exempts personal information collected, processed, sold or disclosed subject to the Gramm-Leach-Bliley Act. Applicant and employee data is generally not handled under GLBA, so a financial firm that meets the CCPA's business definition should evaluate hiring and HR tools under the ADMT rules with counsel.

It can. Using automated decisionmaking technology to make a significant decision about employment is one of the processing activities listed in section 7150 of the CCPA regulations, as is inferring characteristics of job applicants or employees through systematic observation. For a business subject to the CCPA, the regulations require the assessment before new processing of this kind begins.

Not by default, according to the vendors. OpenAI says it does not train on organization data by default for ChatGPT Enterprise, Business, Edu and the API. Anthropic says it does not use inputs or outputs from its commercial products for training by default unless a user submits feedback, which Team and Enterprise owners can turn off. Recheck the terms at each annual review.

Under 31 CFR 1023.220, a broker-dealer keeps the identifying information it collected for five years after the account is closed. Records of verification, including documents relied on, non-documentary methods and results, and how discrepancies were resolved, are kept for five years after each record is made. Vendor tools with shorter retention need an export process.

The CIP rule allows reliance only on another financial institution regulated by a federal functional regulator, when reliance is reasonable and that institution certifies its AML program annually. A software vendor is a tool the firm uses. FINRA Regulatory Notice 21-29 reminds firms that outsourcing does not remove supervisory responsibility, so the firm owns the tool's settings and results.

Usually not. The Marketing Rule defines an advertisement as a communication to more than one person, or to one or more persons if it includes hypothetical performance. A review written for a single client generally falls outside the first part. A template sent to many clients, or AI-generated projections in the letter, can change that, so firms should settle the question with counsel.

Microsoft's deployment guidance says Conditional Access needs a tenant with Microsoft Entra ID P1, P2 or a trial license, and that risk-based policies using Entra ID Protection need P2. Session controls through Conditional Access app control also depend on Microsoft Defender for Cloud Apps licensing. Confirm current licensing with Microsoft or your provider before you plan AI access policies.

Yes, under the 2025 amendments that took effect July 1, 2026. Connecticut removed the blanket exemption for GLBA-covered financial institutions but kept entity-level exemptions for broker-dealers, investment advisers and their agents regulated by the state banking department or the SEC, as well as insurers and insurance producers. Tax preparers and non-bank lenders lost the blanket exemption.

Often, yes. Amended Regulation S-P defines a service provider as any person or entity that receives, maintains, processes or is otherwise permitted access to customer information through services provided directly to the firm. A CRM, rebalancer, billing or aggregation platform pulling custodian data on your behalf generally fits. Whether a specific arrangement qualifies is a question for compliance counsel.

They should. A due diligence questionnaire, an RFP response, a website security page and the brochure all describe the same program to people deciding whether to trust the firm. When they disagree, at least one is wrong. Examiners compare documents, and the SEC has brought cases over adviser statements that overstated capabilities the firm did not have.

Yes, with the right license. Defender Vulnerability Management's browser extensions inventory lists extensions in Edge, Chrome and Firefox on Windows devices, with users, devices, permissions and a risk rating. It requires Defender Vulnerability Management Standalone or the add-on for Defender for Endpoint Plan 2. Chrome Enterprise Core, available at no additional cost, reports extensions on enrolled Chrome browsers, including Macs.

Not immediately. OpenAI says a deleted chat disappears from the account at once and is scheduled for permanent deletion from its systems within 30 days, unless it was already de-identified or OpenAI must keep it longer for security or legal reasons. Capture a record of what was pasted before deleting, and note the retention window in your incident file.

Often not. Microsoft Purview's built-in U.S. bank account number type matches 6 to 17 digits only when a keyword such as checking, savings or bank account appears within 300 characters. Prompts that refer to a custodial or brokerage account may not include those words. Firms usually need a custom sensitive information type built around their custodians' account formats and the terms staff actually use.

Regulation S-P does not name multifactor authentication. It requires written policies and procedures covering administrative, technical and physical safeguards for customer information, and the SEC's fiscal 2026 exam priorities name access controls and account management. State-registered advisers under the FTC Safeguards Rule must use MFA for anyone accessing any information system unless the Qualified Individual approves an equivalent control in writing.

Yes. In its 2024 Reg S-P adopting release, the SEC said a covered institution can adopt a single set of policies and procedures covering Regulation S-P and other rules, provided they meet the requirements of each rule. A dual-registered firm still has to tailor the program to both its brokerage and advisory business, and keep records under both the broker-dealer and adviser recordkeeping rules.

Often it is only the starting point. NIST SP 800-88 Rev. 2 notes that phones can hold on-board and removable memory, so each component may need its own approach. Wipe the device through your management platform, remove and handle any memory card, release it from firm accounts, and record what was done.

Yes, with limits. A business or enterprise AI account that does not train on your data and has a defined retention period is a reasonable starting point. The bigger control is what goes into the prompt: research a company, sector or thesis without pasting position sizes, entry prices, entity names or pending trades. Pair the policy with data loss prevention rules that catch holdings files.

A family office that meets the SEC's family office rule is excluded from the definition of investment adviser, so Regulation S-P does not reach it as an adviser. Reg S-P covers registered advisers, broker-dealers, investment companies and registered transfer agents. If the family also works with a registered adviser or broker-dealer, those firms carry their own Reg S-P duties. Counsel should confirm the office's status.

Yes, under the current rule. FINRA Rule 2210(b)(1)(A) requires a registered principal to approve each retail communication before the earlier of its use or filing, subject to listed exceptions, regardless of whether a person or an AI tool drafted it. Regulatory Notice 26-14 proposes a risk-based approach, but it is a proposal and has not been adopted.

Rule 3110 requires each member firm to establish and maintain a supervisory system reasonably designed to achieve compliance with securities laws and FINRA rules, and to establish, maintain and enforce written supervisory procedures. A failure to supervise finding generally means the system or procedures fell short of that standard or were not followed. For generative AI, expect examiners to ask for written procedures that cover the tools in use and evidence that reviews happened.

Rule 3120 requires firms to test and verify that their supervisory procedures are reasonably designed and to report results to senior management at least annually. When a firm uses AI monitoring as part of its supervision, that monitoring is a supervisory procedure. Including it in the annual testing gives the report, and the CEO's Rule 3130 certification, concrete evidence to stand on.

Not by itself. An alert starts a supervisory review. If that review leads the firm to conclude, or it reasonably should have concluded, that an associated person or the firm violated securities rules in a way that meets the thresholds in Supplementary Material .01, FINRA Rule 4530(b) requires a report within 30 calendar days. Customer data in an unapproved tool may also trigger the firm's Regulation S-P incident response program.

No. FINRA has not published an AI vendor form. Regulatory Notice 21-29 groups its vendor questions around the decision to outsource, due diligence, vendor onboarding and supervision, and asks whether firms document their due diligence findings. Notice 24-09 confirms FINRA rules apply to generative AI from third parties, so the same supervision duties cover AI vendors.

FINRA Rule 4370(d) requires a firm to designate a member of senior management to approve the plan. That person must be a registered principal and is responsible for conducting the required annual review of the plan. Separately, Rule 4370(b) requires the plan to be updated whenever there is a material change to the firm's operations, structure, business, or location.

FINRA Rule 4370 sets no testing frequency. It requires an annual review, and FINRA's Regulatory Notice 21-44 notes that annual testing is an effective practice it has observed at member firms. Running the test as part of the annual review gives the designated principal current results to approve.

Rule 4370 does not specifically mandate testing, as FINRA stated in Regulatory Notice 21-44. It does require an annual review, and FINRA says that review may include testing BCP functionality. FINRA lists annual testing as an observed effective practice, and its recent guidance recommends regularly testing backup restoration and recovery capabilities.

Yes, with limits. FINRA Rule 3110 Supplementary Material .08 lets a supervisor or principal delegate certain review functions to persons who need not be registered. The principal remains ultimately responsible for the reviews and must take reasonable steps to make sure delegated work is done properly, and should keep enough evidence to show overall supervisory control.

Under FINRA Rule 4517, firms must update required contact information no later than 30 days after any change and review it within 17 business days after the end of each calendar year. Rule 4370(f) requires two emergency contact persons, at least one a member of senior management and a registered principal.

No rule names AI prompt logs as a required record. FINRA's 2026 Annual Regulatory Oversight Report lists storing prompt and output logs, tracking model versions and human review of outputs as effective practices. Separately, any AI-drafted communication that relates to the business, once sent, is subject to the existing retention and correspondence review rules.

No. FINRA Regulatory Notice 24-09 says FINRA's rules are technology neutral and apply when member firms use AI, including generative AI. Supervision under Rule 3110, communications under Rule 2210 and recordkeeping obligations apply to AI-assisted work the same way they apply to work done by people, including AI features embedded in vendor products.

Regulatory Notice 24-09 reminded member firms that FINRA intends its rules to be technologically neutral, and that those rules apply when firms use generative AI, whether they develop the tools themselves or use a third party's technology, including features embedded in existing products. It did not create new AI-specific rules.

Rule 3110.18 permits remote inspections only during the pilot, which ends June 30, 2027. FINRA states that firms outside the pilot must inspect offices and locations on-site under Regulatory Notice 11-54. If no permanent rule is in effect by then, inspections planned remotely for later in 2027 would need to be conducted on-site.

No. FINRA Rule 3110 Supplementary Material .06 lets a firm use risk-based principles to decide how much correspondence and internal communication to review. If not everything is reviewed before use, procedures must include training, documentation of that training, and surveillance and follow-up. A documented monthly sample of AI prompts and outputs is one way to provide that surveillance.

Not directly. A vendor's privacy request process is tied to the account holder, so the employee has to delete the conversations and submit the request, for example through privacy.openai.com for OpenAI. The firm can require this under its policies, supervise the steps, and keep screenshots, the request and the vendor's reply in the incident file.

Rule 204-1 requires an adviser to file its annual updating amendment within 90 days of the end of its fiscal year, which is March 31 for most calendar-year firms. If the brochure changed materially, Rule 204-3 requires delivering the updated brochure or a summary of material changes to clients within 120 days of fiscal year end.

There is no Form ADV item dedicated to cybersecurity. The SEC's 2022 proposal that would have added cybersecurity risk and incident disclosure to the brochure was withdrawn in June 2025. Many advisers still describe their security practices in the brochure or in risk disclosures, and anything they choose to say must be accurate under Section 207 of the Advisers Act.

Form ADV Part 2A is the firm brochure, the plain-English disclosure document an adviser gives to clients and prospective clients. It describes the firm's services, fees, conflicts of interest, disciplinary history and other business practices. The SEC posts it on the Investment Adviser Public Disclosure site, so anything the firm says there about its cybersecurity is public.

Under 16 CFR 314.6, firms that maintain customer information on fewer than 5,000 consumers are exempt from the written risk assessment, penetration and vulnerability testing, the written incident response plan, and the annual board report. They still must designate a Qualified Individual and maintain the rule's other safeguards, such as access controls, encryption and multi-factor authentication.

The FTC Safeguards Rule requires the Qualified Individual to report in writing, regularly and at least annually, to the board of directors or equivalent governing body. If the firm has no board, the report goes to a senior officer responsible for the information security program. Firms with customer information on fewer than 5,000 consumers are exempt from this report.

Yes. The Qualified Individual can work for an affiliate or service provider. If so, the firm must retain responsibility for compliance, designate a senior member of its own staff to direct and oversee the Qualified Individual, and require the provider to maintain an information security program that protects the firm consistent with the FTC Safeguards Rule.

Yes, for most covered firms. Under 16 CFR 314.4(d)(2), a firm without effective continuous monitoring must conduct penetration testing annually, scoped by its risk assessment, and vulnerability assessments at least every six months and after material changes. Firms that maintain customer information on fewer than 5,000 consumers are exempt from this testing schedule under 16 CFR 314.6.

At least every six months, unless the firm uses effective continuous monitoring. 16 CFR 314.4(d)(2) also requires a vulnerability assessment whenever there are material changes to operations or business arrangements, and whenever circumstances arise that may have a material impact on the information security program. The assessments must be designed to identify publicly known security vulnerabilities.

Under the FTC Safeguards Rule, 16 CFR 314.4(i), the Qualified Individual reports to the board or equivalent governing body, or to a senior officer responsible for the information security program if there is no board. The NAIC model law's annual report requirement applies to licensees that have a board. Regulation S-P does not require a board report at all.

Under 15 U.S.C. 6823, a person who knowingly and intentionally violates the pretexting provision faces fines and up to five years in prison. If the violation occurs while breaking another federal law, or as part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum rises to 10 years and the fines double.

GLBA has three main parts for financial firms: the Financial Privacy Rule, which governs privacy notices and the sharing of nonpublic personal information; the Safeguards Rule, which requires a program to protect customer information; and the pretexting provisions, which prohibit obtaining customer information under false pretenses. For SEC-registered firms, Regulation S-P implements the privacy and safeguards parts.

Pretexting is obtaining a financial institution's customer information through false statements to its officers, employees, agents or customers, or by using forged or stolen documents. 15 U.S.C. 6821 makes it a violation, along with asking someone else to do it. Brokers, dealers and investment advisers are financial institutions under the statute.

Three or four. Microsoft says effectiveness is noticeably reduced when users have more than five main labels. A common set for advisers and broker-dealers is Public, Internal, Client Confidential and Client Restricted, with encryption reserved for the restricted label that covers ID copies, account applications and other sensitive customer information.

Regulation S-P does not set a frequency. It requires written procedures for overseeing service providers, including due diligence and monitoring, and Rule 206(4)-7 requires an SEC-registered adviser to review its policies at least annually. A practical cadence is to review integrations during that annual review, at each contract renewal, and whenever a vendor changes its product or the internal owner leaves the firm.

Regulation S-P does not set a frequency. Running one at least once a year lets the results feed the annual compliance review. A second exercise after a significant change, such as a new custodian, CRM or IT provider, tests the notice procedure where it changed.

In states that adopted the NAIC Insurance Data Security Model Law, a licensee with a board must have executive management report in writing at least annually on the security program's status and material matters. The model exempts licensees with fewer than ten employees. As of August 2025, the NAIC counted 28 adopting jurisdictions, and California was not among them.

Yes. 16 CFR 314.2(h)(2)(xi) names a mortgage broker as a financial institution because brokering loans is a financial activity under the Bank Holding Company Act. That brings the full rule: a written information security program, a Qualified Individual, encryption, multi-factor authentication, service provider oversight, secure disposal, and notice to the FTC within 30 days of a breach involving 500 or more consumers.

The NAIC Model Bulletin on AI is addressed to insurers, and 29 jurisdictions had adopted it as of October 8, 2026. California has not adopted it. California's own Bulletin 2022-5 is directed to insurers and other licensees, which includes agents and brokers, and covers bias in rating, underwriting and claims practices that rely on algorithms and models.

GOVERN, MAP, MEASURE and MANAGE. GOVERN sets the policies, roles and culture for AI risk and applies across the other three. MAP establishes context and identifies the risks of each AI system, MEASURE analyzes and tracks those risks, and MANAGE prioritizes and acts on them, including monitoring after deployment and handling incidents.

No. Microsoft's end of support notice for Office 2021 says there will be no extension and no extended security updates after October 13, 2026. The apps keep working, but newly found vulnerabilities are not fixed. Microsoft recommends moving to a newer version of Office or to the Microsoft 365 apps, which most business plans already include.

Microsoft points Office 2021 users to a newer version of Office or to the Microsoft 365 apps. The Microsoft 365 apps included in most business plans are updated continuously. Office 2024, the current perpetual version, is listed on Microsoft's lifecycle page with support ending in October 2029, so it buys time but brings the same decision back in three years.

It can be. If a representative uses a personal AI account to draft or discuss business communications, the firm has no copy of that interaction. In 2022 the SEC charged 16 firms more than $1.1 billion in combined penalties for failing to preserve off-channel messages. The practical response is to approve AI tools the firm can capture and block personal accounts on firm devices.

A common example at a financial firm is a portfolio accounting server that cannot run current endpoint protection. The firm records the waived control, isolates the server on its own network segment, adds monitoring, has the CCO or Qualified Individual approve the arrangement, and sets an expiry date tied to the vendor's upgrade.

Leave out Social Security numbers, full account numbers, dates of birth and anything used to verify identity, which Reg S-P treats as sensitive customer information. Use names, holdings and balances only in a firm-approved tool. A simple habit is to draft with placeholders and fill in figures from the reporting system after the AI writes the narrative.

It can. 17 CFR 248.201 covers SEC-registered investment advisers that offer or maintain covered accounts. In a December 2022 risk alert, the SEC Division of Examinations said this includes advisers who can direct transfers or payments from individual accounts to third parties, where the accounts are primarily for personal, family or household purposes. Covered firms need a written identity theft prevention program.

Rule 204-2(a)(25) lists six: written safeguards policies and procedures, documentation of detected unauthorized access and the response, documentation of notice investigations and determinations, service provider oversight policies, service provider contracts, and disposal policies for consumer report information. They are kept at least five years.

The rule does not mention exceptions. 17 CFR 248.30(a)(1) requires written policies covering administrative, technical and physical safeguards, so any control the firm does not apply is a departure from its own policy. Firms document those departures with a reason, compensating controls, an approver and an expiry date, and keep them with their Reg S-P records.

No. 17 CFR 248.30 requires written policies and procedures to safeguard customer information, including an incident response program, but its text does not require a report to a board or name an approver. Advisers still review their compliance policies at least annually under Advisers Act Rule 206(4)-7, and the report behind a broker-dealer CEO's FINRA Rule 3130 certification goes to the board.

No rule text names a certificate. 17 CFR 248.30(b) requires reasonable disposal measures and written disposal policies, and the 2024 amendments require records documenting compliance. A per-device certificate that lists the serial number, sanitization method, tool, verification method and the person who did the work is the simplest evidence that a specific device was handled under the procedure.

As soon as practicable, but not later than 30 days after the firm becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. Notice is not required if a reasonable investigation shows the sensitive customer information is not reasonably likely to be used in a way that causes substantial harm or inconvenience.

Not by that name. Under 17 CFR 248.30(a)(3)(i), a firm's incident response program must include procedures to identify the customer information systems and types of customer information that may have been accessed in an incident. A current inventory of systems and the data they hold is the practical way to meet that requirement within the 30-day customer notice window.

Yes. Under 17 CFR 248.30(d), customer information means any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic or other form. Shredding paper client files and sanitizing devices should both be covered by the same written disposal procedure.

Yes. A firm may skip customer notice only after a reasonable investigation finds no reasonable likelihood of substantial harm or inconvenience. SEC-registered advisers must keep written documentation of that investigation and the basis for the determination under Rule 204-2(a)(25), and broker-dealers keep the same documentation under Rule 17a-4(e)(14).

It can. Many copiers store images of scanned and copied pages on an internal drive, and if those pages include customer information, returning the copier is a disposal event under 17 CFR 248.30(b). The FTC's copier guidance suggests lease terms that let the firm keep the drive or require the provider to overwrite it, handled by skilled technicians.

Usually, yes. Rule 248.30(d)(10) defines a service provider as any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through services provided directly to a covered institution. A managed IT provider with administrative access to email, endpoints, file storage or backups is permitted access, so the firm's written oversight policies under Rule 248.30(a)(5) should cover it.

Generally the firm where the incident occurred. The SEC's 2024 adopting release explains that the institution with the incident has the facts needed to inform affected individuals. A firm without contact details can coordinate with the institution that holds the customer relationship, and the two firms can agree which of them sends the notice. The 30-day deadline still applies.

Yes. Since the 2024 amendments, 17 CFR 248.30(d)(5) defines customer information to include nonpublic personal information about customers of other financial institutions that has been provided to your firm. Your safeguards policy, incident response program, service provider oversight and disposal procedures all need to cover those records, not only data about your own clients.

It can. Reg S-P's incident response program covers any unauthorized access to or use of customer information, including information given out over the phone. If sensitive customer information was, or is reasonably likely to have been, accessed without authorization, notice is due within 30 days of becoming aware, unless a reasonable investigation shows it is not reasonably likely to be used to cause substantial harm or inconvenience.

Investment advisers keep Regulation S-P records under Rule 204-2(a)(25) for five years, the first two in an appropriate office. Broker-dealers follow Rule 17a-4(e)(14): policies until three years after they stop being used, incident and notification documentation for three years from creation, and service provider contracts until three years after the contract ends.

No. Regulation S-P does not name a technology. Amended Rule 248.30(a) requires written policies and procedures reasonably designed to protect against unauthorized access to customer information, and an incident response program that can identify which systems and types of customer information were accessed. Zero trust network access is one way to meet those objectives and to produce the access logs an investigation needs.

Amended Rule 248.30(a)(5) requires a covered institution's policies to be reasonably designed so that service providers notify it as soon as possible, but no later than 72 hours after becoming aware of a breach in security resulting in unauthorized access to a customer information system the provider maintains. The firm itself remains responsible for making sure affected individuals are notified.

Yes, if the firm enters into a written agreement for it. Rule 248.30(a)(5)(ii) allows a covered institution to have a service provider notify affected individuals on its behalf. Under Rule 248.30(a)(5)(iii), the obligation to ensure affected individuals are notified stays with the firm, so it should still confirm that notices went out on time and with the required contents.

Rule 248.30 defines covered institutions to include brokers or dealers, investment companies, and investment advisers and transfer agents registered with the Commission. An adviser registered only with a state is not registered with the SEC, so it falls outside that definition. State-registered advisers should confirm with counsel which state privacy and security rules apply to them.

No. Amended Regulation S-P requires a written incident response program reasonably designed to detect, respond to and recover from unauthorized access to customer information, including customer notification procedures. It does not prescribe how the program is tested. Many firms use a tabletop exercise to check whether the notice procedure can meet the 30-day deadline and keep the exercise report as evidence.

It means the firm's incident response program includes written policies and procedures reasonably designed to require oversight of service providers, including through due diligence and monitoring. Under Rule 248.30(a)(5)(i), those policies must be designed so each provider protects against unauthorized access to customer information and notifies the firm no later than 72 hours after becoming aware of a breach of a customer information system it maintains.

Not by name. Rule 248.30 requires written safeguards reasonably designed to protect against anticipated threats or hazards to customer information. Software that no longer receives security updates is a widely known risk, so examiners reviewing a firm's safeguards may ask how unsupported systems fit within its written policies. Your compliance counsel can advise on your firm's specific facts.

No. Amended Rule 248.30(a)(5) requires written policies and procedures for overseeing service providers, including due diligence and monitoring. The 2023 proposal would have required a written contract, and the final rule did not adopt that mandate. Many firms still use contract terms to evidence the 72-hour notice commitment, and Rule 204-2(a)(25) requires advisers to keep any such agreements.

For an SEC-registered adviser, Rule 204-2 requires most books and records to be kept at least five years, indexed for easy retrieval, with a separately stored duplicate copy. Before retiring a server, map where each record set will live, confirm the duplicate, and test retrieval. Then sanitize the old drives using a method such as those in NIST SP 800-88 and keep the certificate.

Rule 204-2(a)(7) requires advisers to keep written communications relating to advice and recommendations, whoever or whatever drafted them. Rule 204-2(a)(17) requires records of the compliance policies and of the annual review. Many firms also keep the approved tool list, monthly monitoring results and follow-up actions, which are the evidence that the procedures are actually applied.

Rule 206(4)-7(c) requires an adviser to designate one supervised person, the chief compliance officer, to administer its policies and procedures. The CCO typically owns the AI section and its review. Technical work, such as blocking unapproved tools and producing activity reports, can sit with an internal IT lead or an outside provider, as long as the procedures say who does what.

No SEC rule names AI, but Rule 206(4)-7 requires an SEC-registered adviser to adopt and implement written policies and procedures reasonably designed to prevent Advisers Act violations by the firm and its supervised persons. When staff use AI for client communications, marketing, research or meeting notes, that work falls under rules the manual already covers, so the manual should address it.

Start with the Regulation S-P records Rule 204-2(a)(25) already requires: written safeguards, incident response, service provider oversight and disposal policies, records of any detected unauthorized access and notification decisions, and service provider contracts. Buyers also commonly ask for a vendor inventory, MFA and user access reports, a device inventory, backup test results and a description of what the communications archive captures.

They must still be preserved for the full retention period. Under SEC Rule 204-2(f), an adviser that ceases business must arrange for and be responsible for preserving its books and records for the rest of the required period, generally at least five years, and notify the SEC in writing of the exact address where they will be kept. Migration plans should record where each archive lands.

Rule 204-2(a)(7) requires SEC-registered advisers to keep written communications relating to recommendations, advice, the movement of funds or securities, and orders. Under Rule 204-2(e)(1), those records are kept at least five years from the end of the fiscal year of the last entry, with the first two years in an appropriate office of the adviser.

Not exclusively. Since the SEC's 2022 amendments, Rule 17a-4(f) lets a broker-dealer use either a non-rewriteable, non-erasable format or a system that keeps a complete time-stamped audit trail of every modification and deletion. Either way, the system must verify storage automatically, date retention periods and export records in human readable and usable electronic formats.

Regulation S-P does not set a frequency. It requires written policies and procedures that protect against unauthorized access to customer information, so the firm sets the review cycle in those policies and has to follow it. Many firms use quarterly reviews, matching CIS Safeguard 5.1, which calls for validating active accounts at least quarterly.

The September 14, 2026 risk alert described advisers that missed annual reviews, did not follow their own review procedures, failed to keep testing records in their books and records, did not explain how they oversaw delegated functions, and did not implement recommended changes. Staff encouraged documented review procedures and tracking corrective actions to completion.

No. The Division of Examinations states that its priorities are not an exhaustive list of the areas it will examine. Examiners scope each exam based on the firm's own risk profile, prior findings and current events, and priorities can shift during the year. The published list is a strong signal of emphasis, and a firm should expect questions outside it.

The SEC's Division of Examinations publishes its priorities once per fiscal year, and the fiscal year begins October 1. The fiscal 2026 priorities were released on November 17, 2025. As of mid-October 2026, the fiscal 2027 priorities had not yet been published. The document is a staff statement, not a rule, and exams already under way are not limited to it.

They are an annual document from the SEC's Division of Examinations listing the risks and practices examiners plan to emphasize for advisers, broker-dealers, funds and other registrants in the coming fiscal year. It is a staff statement, not a rule. The fiscal 2026 edition, released November 17, 2025, emphasized fiduciary duty, compliance programs, never-examined advisers, information security and Regulation S-P.

No. The SEC withdrew its 2023 predictive data analytics proposal effective June 17, 2025. Examiners apply existing rules instead: the compliance rule, Rule 206(4)-7, for policies and supervision; the Marketing Rule for claims about AI; Rule 204-2 for records; and Regulation S-P when client data reaches an AI vendor. The FY2026 exam priorities say staff will test AI representations and supervision.

The SEC's Fiscal Year 2027 Examination Priorities use "super intelligence (SI)" as the term for advanced AI. The Division says registrants are increasingly incorporating SI into their businesses and that threat actors use it to automate and accelerate cyberattacks, including SI-generated phishing and deepfake voice and video. Examiners will review how firms prepare for these threats and how they monitor SI use.

A usable record names the policy section being waived, the specific system or person covered, the business reason, the risk and how it is accepted, the compensating controls, the approver's name, title and date, and a fixed expiry date. NIST CSF 2.0 subcategory ID.RA-07 describes the same goal: exceptions that are managed, assessed for risk impact, recorded and tracked.

A seeded test prompt is a scripted prompt, built with dummy data, that a designated tester enters into an approved AI tool to confirm the prompt is captured, retained and flagged as expected. It tests the monitoring system from end to end. Real client information should never be used in a seeded test, and test items should be tagged so they stay out of production statistics.

Not on its own. FINRA's 2026 oversight report describes fraudsters using GenAI to create fake ID documents and deepfakes built from customers' social media images. FINRA lists likeness checks as one effective practice alongside follow-up questions based on credit bureau data and limits on automated approval of multiple accounts, which points to layering checks instead of relying on one.

Usually not. Where a rule requires a written report to the board, such as the FTC Safeguards Rule, it calls for the overall status of the program and material matters. A practical report summarizes counts, trends and dispositions, then gives detail only on findings where customer information was exposed or could have been, and on risks that need a board decision.

FinCEN's November 2024 deepfake alert lists red flags during live verification, including a customer who uses a third-party webcam plugin, or who tries to change communication methods mid-check because of excessive or suspicious technical glitches. On a phone request, watch for a caller who cannot take a call back, insists on staying on the line, or uses urgency to skip normal steps.

Oklahoma's Senate Bill 546 and the Louisiana Data Privacy Act both take effect January 1, 2027. Each applies only above set thresholds, such as personal data of 100,000 Oklahoma consumers or 75,000 Louisiana consumers, and both exempt financial institutions at the entity level. Firms should still confirm the final enacted text with counsel.

FINRA guidance points to a Social Security number that is not valid or is associated with a different person's name, the same identifying information on seemingly unrelated accounts, temporary or fictitious email addresses, IP or geolocation data that does not fit the stated address, extremely rapid completion of the application, and a funding bank account in a different name.

For broker-dealers, Rule 17a-4(b)(4) covers communications relating to the business, and FINRA describes that as including text and chat messages. For advisers, Rule 204-2(a)(7) applies to written communications about advice, recommendations, funds or orders, whatever the device. Firms that cannot capture texts generally prohibit business texting and monitor for it.

Criminals use AI to generate speech that sounds like a specific person. The FBI warns that they use AI-generated audio to impersonate public figures or personal relations to elicit payments, and FinCEN's November 2024 alert describes criminals impersonating an executive or other trusted employee to instruct staff to transfer large sums. At an advisory or brokerage firm, that can look like a call from a familiar client or partner asking for an urgent wire to a new account.

Off-channel communications are business messages sent through channels the firm has not approved or cannot capture, such as personal text messages, personal email or unarchived messaging apps. Under SEC Rule 204-2 and Exchange Act Rule 17a-4, the content of a message decides whether it must be kept, so a qualifying message on an uncaptured channel is a recordkeeping gap.

AI washing is the SEC's term for misleading claims that a firm uses artificial intelligence. In March 2024 the SEC settled charges against two investment advisers, Delphia (USA) Inc. and Global Predictions Inc., with civil penalties of $225,000 and $175,000, citing the Marketing Rule. Any AI claim in Form ADV, a website or marketing should be accurate and supported by records.

Identity secure score is a percentage in Microsoft Entra that shows how closely a tenant follows Microsoft's identity security recommendations, such as requiring MFA for administrators and blocking legacy authentication. Microsoft recalculates it every 24 hours. Recommendations marked as ignored drop out of the calculation, and risk-accepted actions leave the improvement list, so read the score alongside the list of accepted risks.

FINRA describes a synthetic identity as a legitimate Social Security number combined with a false name, address and date of birth. Fraudsters use these identities to open brokerage accounts that belong to no real customer. Because no victim notices and complains, synthetic accounts can stay open longer than accounts opened with a fully stolen identity, so firm controls at onboarding matter more.

A user access review is a periodic check that every account on a firm's systems still belongs to a current person who needs that level of access. Reviewers confirm, reduce or remove each account, and the firm keeps dated lists and sign-offs. For RIAs and broker-dealers, it is one way to show that Regulation S-P access safeguards work.

Under the FTC Safeguards Rule, the Qualified Individual approves MFA and encryption exceptions, and the MFA approval must be in writing (16 CFR 314.4(c)(3) and (c)(5)). Reg S-P names no approver for SEC-registered firms, so most advisers route exceptions through the CCO who administers the Rule 206(4)-7 program, often with the system owner co-signing.

Microsoft prices commercial Windows 10 Extended Security Updates at $61 per device for year one and says the price doubles each consecutive year, which makes year two $122 per device. Coverage is sold in full years only and is cumulative, so a firm joining in year two also pays for year one. Coverage ends after three years.

The server will keep working, but it stops receiving security fixes unless the firm buys Extended Security Updates. Regulation S-P requires safeguards reasonably designed to protect against anticipated threats to customer information, so an examiner may ask how an unpatched server holding client data fits within the firm's written policies. Compliance counsel can advise on a specific firm's facts.

Only through paid Extended Security Updates. Microsoft's extended support for Windows Server 2016 ends on January 12, 2027, and regular security updates stop that day. Classic ESU licenses are bought in yearly increments, and eligible customers can pay as they go through Azure Arc. Microsoft recommends upgrading to Windows Server 2025 or moving workloads to Azure.

Yes, until January 12, 2027. Windows Server 2016 is in extended support, which ends on that date. After it, Microsoft stops regular security updates, and the only way to keep receiving them is a paid Extended Security Updates subscription. Microsoft recommends upgrading to Windows Server 2025 or moving workloads to Azure.

It can be. Regulation S-P defines a service provider as any person or entity that receives, maintains, processes or otherwise is permitted access to customer information through services provided directly to the firm. A ZTNA broker sits in the path of traffic to systems holding customer information, so many firms include it in service provider oversight, including the 72-hour breach notice. Confirm the analysis with counsel.