Rule Atlas
Regulation S: Regulation S-P: Customer Privacy and Safeguarding Information
Under Regulation S (FINRA / SEC Customer Protection Rule 15c3-3), regulation S-P: Customer Privacy and Safeguarding Information establishes the authoritative rules tested on the FINRA Series 99. Explores the requirements for protecting customer nonpublic personal information under Regulation S-P, including privacy notices and opt-out rights. VoraPrep verifies every threshold, worked table, and practice question below against the current FINRA Series 99 blueprint.
Core Statutory Concepts
| Feature | Initial Privacy Notice | Annual Privacy Notice | Revised Privacy Notice |
|---|---|---|---|
| Timing | At account opening / relationship establishment | At least once per year while relationship persists | Before making material changes to privacy practices |
| Content | Types of NPI, sharing practices, opt-out rights | Reiteration of privacy policy and opt-out rights | Explains specific material changes in practices |
| Opt-Out Opportunity | Must be offered with the initial notice | Must be offered with the annual notice | May trigger a new opt-out if changes affect sharing |
| Recipient | 'Customers' (ongoing relationship) and 'consumers' (one-time transaction) | 'Customers' only | 'Customers' and 'consumers' affected by changes |
An individual opens a new brokerage account with an ABC Brokerage on June 15, 2026. The firm intends to share nonpublic personal information about its customers with non-affiliated third parties for marketing purposes. Under Regulation S-P, when must ABC Brokerage provide an initial privacy notice to this customer?
Practitioner Application: Regulation S-P: Customer Privacy and Safeguarding Information
A new client calls your firm, concerned they haven't received a privacy notice. They recall providing sensitive financial details when opening their account and are unsure how their 'nonpublic personal information' (NPI) is being used or if they can opt out of certain disclosures. Meanwhile, an internal audit reveals that some customer data is being stored on unencrypted local drives, contrary to firm policy. As an operations professional, you must ensure strict adherence to federal privacy regulations.
- Financial institutions, including broker-dealers, are subject to Regulation S-P (17 CFR §248.1 et seq.), which mandates the protection of 'nonpublic personal information' (NPI) of their customers. This rule stems from the Gramm-Leach-Bliley Act (GLBA) and requires firms to develop and maintain safeguards for customer NPI, provide privacy notices, and allow customers to opt out of certain information sharing.
- What is 'Nonpublic Personal Information' (NPI)? NPI includes any personally identifiable financial information that a financial institution collects about an individual, which is not publicly available. Examples include account numbers, social security numbers, income and asset information, transaction history, and information derived from such data. Importantly, NPI also includes 'personally identifiable information' (PII) if that PII is also financial in nature.
Common FINRA Series 99 Distractors on Regulation S
- 1⚠️ Exam trap: Underestimating the scope of 'safeguards'. It's not just about technical cybersecurity; it includes physical security of records, employee training, and proper disposal of sensitive documents.
- 2Regulation S-P protects 'nonpublic personal information' (NPI).
- 3Firms must provide 'initial' and 'annual privacy notices' to customers.
- 4Customers have the right to 'opt out' of the disclosure of their NPI to nonaffiliated third parties for certain purposes.
- 5Firms must implement 'administrative, technical, and physical safeguards' to protect NPI, including proper disposal.
Frequently Asked Questions: Regulation S
What is the core rule under Regulation S (Regulation S-P: Customer Privacy and Safeguarding Information)?
Under Regulation S (FINRA / SEC Customer Protection Rule 15c3-3), regulation S-P: Customer Privacy and Safeguarding Information establishes the authoritative rules tested on the FINRA Series 99. Explores the requirements for protecting customer nonpublic personal information under Regulation S-P, including privacy notices and opt-out rights. VoraPrep verifies every threshold, worked table, and practice question below against the current FINRA Series 99 blueprint.
How is Regulation S tested on the FINRA Series 99?
⚠️ Exam trap: Underestimating the scope of 'safeguards'. It's not just about technical cybersecurity; it includes physical security of records, employee training, and proper disposal of sensitive documents. Regulation S-P protects 'nonpublic personal information' (NPI).
Where can I practice FINRA Series 99 questions on Regulation S-P: Customer Privacy and Safeguarding Information?
Test yourself instantly with the free playable FINRA Series 99 question on this page, or launch VoraPrep's full FINRA Series 99 adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/series99.