GLBA

The managers who know each person's job should confirm, reduce or remove each account, and the CCO or another designated reviewer should sign and date a summary of the full review. For broker-dealers, the reviewer and the process belong in written supervisory procedures under FINRA Rule 3110 so the sign-off becomes part of the supervisory record.

Yes. Systems outside single sign-on are easy to miss, because disabling someone's main account does not remove access to them. Include custodian platforms, CRM, planning software, client portals and archives that hold customer information, export each user list on the review date, and record who confirmed each account and when fixes were completed.

Review an approved AI vendor before its scheduled date when its terms of service or privacy policy change, when it adds a new model, sub-processor or feature that touches client data, when it reports a security incident, when it is acquired, or when staff start using it for a new purpose. Each of these can change the risk the original approval was based on.

No rule prescribes a format. A practical inventory lists each vendor and the platform it connects to, the customer data in scope, the permission level (read only, trading or money movement), the credential type and last rotation date, the internal owner, the vendor's breach notification commitment, and the date and evidence of the last due diligence review.

Usually, yes. FTC staff guidance says dealers who finance or facilitate financing of automobiles for consumers are financial institutions under the Safeguards Rule, and 16 CFR 314.2(h)(2)(ii) covers dealers that lease vehicles for longer than 90 days. Covered dealers must maintain a written information security program meeting 16 CFR 314.4, including encryption, multifactor authentication, logging, and vendor oversight.

California Insurance Code 791.13 bars agents from disclosing personal or privileged information from an insurance transaction unless an exception applies. One exception covers a person performing a business function for the agent who agrees not to disclose the information further. Whether an AI vendor fits depends on its contract terms, including training and retention. Confirm the analysis with counsel before relying on it.

They can. The GLBA exemption in Civil Code section 1798.145(e) expressly does not apply to section 1798.150, the CCPA's private right of action for breaches of nonencrypted and nonredacted personal information caused by a failure to maintain reasonable security. Statutory damages are $107 to $799 per consumer per incident, as adjusted January 1, 2025, or actual damages if greater.

No. Civil Code section 1798.145(e) exempts personal information collected, processed, sold or disclosed subject to the Gramm-Leach-Bliley Act. It exempts data, not companies. A financial firm that meets the CCPA's business definition still owes CCPA obligations for employee, applicant, website visitor, prospect and business contact data that is not handled under GLBA.

Yes, under the 2025 amendments that took effect July 1, 2026. Connecticut removed the blanket exemption for GLBA-covered financial institutions but kept entity-level exemptions for broker-dealers, investment advisers and their agents regulated by the state banking department or the SEC, as well as insurers and insurance producers. Tax preparers and non-bank lenders lost the blanket exemption.

No GLBA rule names a specific algorithm. The FTC Safeguards Rule requires encryption consistent with current cryptographic standards and safeguards for key material. For data in transit, NIST SP 800-52 Rev. 2 calls for TLS 1.2 with FIPS-based cipher suites and support for TLS 1.3. For data at rest, most firms use AES, the NIST standard in FIPS 197, through tools such as BitLocker and FileVault.

No. The FTC Safeguards Rule treats customer information as unencrypted if the encryption key was accessed by an unauthorized person. In its 2024 Reg S-P adopting release, the SEC said a firm relying on encryption to decide notice is not required should revisit that decision if the decryption key was also obtained. Protecting and escrowing keys is part of the control.

The encryption provision, 16 CFR 314.4(c)(3), requires compensating controls to be reviewed and approved by the Qualified Individual. Unlike the multi-factor authentication exception, it does not say "in writing." A dated, signed approval is still the practical way to show the FTC, an auditor or your board that the review happened and what was approved.

16 CFR 314.4(c)(3) lets a firm that determines encryption is infeasible secure that customer information with effective alternative compensating controls reviewed and approved by its Qualified Individual. Document the system, the reason, the controls, the approval and the date, and revisit the exception when the system changes.

Neither the FTC Safeguards Rule nor Regulation S-P sets a fixed schedule. The FTC rule requires periodic assessment based on the risk a provider presents, and Reg S-P requires oversight through due diligence and monitoring. Many firms tier vendors by risk, review high-risk vendors at least annually and after major changes, and document the cadence in their written policy.

Under the FTC Safeguards Rule, 16 CFR 314.4(i), the Qualified Individual reports to the board or equivalent governing body, or to a senior officer responsible for the information security program if there is no board. The NAIC model law's annual report requirement applies to licensees that have a board. Regulation S-P does not require a board report at all.

If you provide financial products or services to consumers, including investment advice, tax preparation or financial planning, GLBA very likely applies. The question that matters is which implementing rule covers you: Regulation S-P for SEC-registered firms, or the FTC Safeguards Rule for most others.

It depends on the rule that implements GLBA for your firm. The FTC Safeguards Rule requires encryption of customer information at rest and in transit over external networks, with Qualified Individual approved compensating controls where infeasible. Regulation S-P requires technical safeguards without naming encryption, and the banking agencies' guidelines list it as a measure each institution must consider.

Under 15 U.S.C. 6823, a person who knowingly and intentionally violates the pretexting provision faces fines and up to five years in prison. If the violation occurs while breaking another federal law, or as part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum rises to 10 years and the fines double.

No rule names AI tools specifically. The FTC Safeguards Rule requires the assessment to identify reasonably foreseeable internal and external risks to customer information, and requires firms to identify and manage the systems that hold it. An AI tool that receives, stores or generates customer information is one of those systems, so it falls within the assessment's scope.

The FTC Safeguards Rule requires a written risk assessment and requires firms to periodically perform additional assessments, without setting a fixed interval. It also requires adjusting the program after material changes to operations or business arrangements. Many firms update the assessment at least annually so it can feed the Qualified Individual's annual board report, and again when they adopt significant new systems.

GLBA has three main parts for financial firms: the Financial Privacy Rule, which governs privacy notices and the sharing of nonpublic personal information; the Safeguards Rule, which requires a program to protect customer information; and the pretexting provisions, which prohibit obtaining customer information under false pretenses. For SEC-registered firms, Regulation S-P implements the privacy and safeguards parts.

GLBA is the federal law. Regulation S-P is the SEC rule that implements GLBA's privacy and safeguards requirements for SEC-registered firms. For an SEC-registered RIA or broker-dealer, complying with Reg S-P is how you comply with GLBA.

Pretexting is obtaining a financial institution's customer information through false statements to its officers, employees, agents or customers, or by using forged or stolen documents. 15 U.S.C. 6821 makes it a violation, along with asking someone else to do it. Brokers, dealers and investment advisers are financial institutions under the statute.

Start with tasks that need no applicant identifiers, such as summarizing underwriting guidelines or drafting coverage explanations. For anything involving applications, use a business AI plan tied to agency sign-in, with contract terms that limit training and retention. Add data loss prevention rules for driver's license and Social Security numbers, block personal AI accounts on agency devices, and review activity logs on a set schedule.

In states that adopted the NAIC Insurance Data Security Model Law, a licensee with a board must have executive management report in writing at least annually on the security program's status and material matters. The model exempts licensees with fewer than ten employees. As of August 2025, the NAIC counted 28 adopting jurisdictions, and California was not among them.

It can. 17 CFR 248.201 covers SEC-registered investment advisers that offer or maintain covered accounts. In a December 2022 risk alert, the SEC Division of Examinations said this includes advisers who can direct transfers or payments from individual accounts to third parties, where the accounts are primarily for personal, family or household purposes. Covered firms need a written identity theft prevention program.

No. 17 CFR 248.30 requires written policies and procedures to safeguard customer information, including an incident response program, but its text does not require a report to a board or name an approver. Advisers still review their compliance policies at least annually under Advisers Act Rule 206(4)-7, and the report behind a broker-dealer CEO's FINRA Rule 3130 certification goes to the board.

It can. Reg S-P's incident response program covers any unauthorized access to or use of customer information, including information given out over the phone. If sensitive customer information was, or is reasonably likely to have been, accessed without authorization, notice is due within 30 days of becoming aware, unless a reasonable investigation shows it is not reasonably likely to be used to cause substantial harm or inconvenience.

Regulation S-P does not set a frequency. It requires written policies and procedures that protect against unauthorized access to customer information, so the firm sets the review cycle in those policies and has to follow it. Many firms use quarterly reviews, matching CIS Safeguard 5.1, which calls for validating active accounts at least quarterly.

Usually not. Where a rule requires a written report to the board, such as the FTC Safeguards Rule, it calls for the overall status of the program and material matters. A practical report summarizes counts, trends and dispositions, then gives detail only on findings where customer information was exposed or could have been, and on risks that need a board decision.

Oklahoma's Senate Bill 546 and the Louisiana Data Privacy Act both take effect January 1, 2027. Each applies only above set thresholds, such as personal data of 100,000 Oklahoma consumers or 75,000 Louisiana consumers, and both exempt financial institutions at the entity level. Firms should still confirm the final enacted text with counsel.

A practical checklist covers a current vendor inventory with risk tiers, onboarding due diligence, a written reassessment schedule, fresh evidence such as SOC 2 reports and access reviews, contract checks for security and breach notice terms, and dated records of follow-up. Neither the FTC Safeguards Rule nor Regulation S-P prescribes a checklist, so each firm sets and documents its own.

A user access review is a periodic check that every account on a firm's systems still belongs to a current person who needs that level of access. Reviewers confirm, reduce or remove each account, and the firm keeps dated lists and sign-offs. For RIAs and broker-dealers, it is one way to show that Regulation S-P access safeguards work.

Vendor oversight is the ongoing process of selecting, contracting with, monitoring and reassessing the outside companies that handle your firm's customer data or systems. For GLBA-covered firms, the FTC Safeguards Rule requires capable providers, contractual safeguards and periodic risk-based assessment, and amended Regulation S-P requires oversight through due diligence and monitoring.