Regulations

Regulation S-P

Regulation S-P focuses on protecting the personal and private information of customers of financial firms. Because firms collect and store information electronically, they must use appropriate safeguards to protect customer privacy.

Regulation S-P also clarifies what counts as private (non-public) information. Some examples are straightforward, such as Social Security numbers, suitability information, and account balances. Other sources can be less obvious, such as data collected through internet cookies. Regardless of the source, firms must safeguard this information properly.

In addition to identifying and protecting private information, Regulation S-P requires firms to disclose to customers when non-public information is provided to third parties. For example, a firm must tell a customer if it sends the customer’s non-public information to a third-party company that prints checks. To print checks, the third party needs access to account numbers and other private account information.

Firms must provide these disclosures at account opening and then annually. There is one exception: a firm is not required to deliver the annual notice if it shares non-public information with non-affiliated third parties only under exceptions that carry no opt-out right and has not changed the policies described in its most recent notice. The account-opening notice is always required. The firm must also give the customer an “opt-out” feature, which prevents the firm from disclosing private information to third parties. Opt-out methods must be easy to use. Common examples include check-off boxes on letters or emails. More burdensome requirements - such as forcing a customer to write a lengthy letter to request an opt-out - are prohibited.

Regulation S-P’s safeguarding rules also cover data breaches. Firms must maintain a written incident response program, reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. The program must extend to service providers: the firm must oversee them and require a provider to notify the firm no later than 72 hours after it learns of a breach.

If sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, the firm must notify each affected individual as soon as practicable and no later than 30 days after becoming aware of the incident - unless a reasonable investigation shows the information is not reasonably likely to be used in a way that causes substantial harm or inconvenience.

Regulation M

Regulation M is designed to prevent market manipulation during offerings of new securities. It focuses on underwriters and issuers and prohibits activities that could artificially inflate the price of a security before and during an offering. Regulation M aims to support a fair market by applying several tiers of restrictions based on the size and liquidity of the security. This helps ensure the security’s price reflects its true market value.

Regulation S

Regulation S provides an exemption from SEC registration for securities that are offered and sold outside the United States. Because the offering takes place offshore, the issuer does not have to register the securities under the Securities Act of 1933. The regulation is designed to keep foreign offerings separate from U.S. markets.

Regulation S also places restrictions on how quickly those securities can be resold into the United States. For debt securities, such as bonds, issued by most reporting issuers, the typical distribution compliance period is 40 days. During this period, the securities cannot be offered or sold to U.S. persons. After the compliance period has passed, resales into the U.S. may occur, subject to any applicable rules.

In general, Regulation S securities cannot be immediately sold back into U.S. markets. Depending on the issuer and the type of security, exam questions may reference resale restrictions lasting 6 to 12 months. The key idea is that Regulation S applies to offshore offerings, provides an exemption from SEC registration, and imposes resale restrictions to prevent securities from flowing directly back into US markets.