SIE Ready🛡️ Compliance Considerations · Lesson 4 of 6 · 5 min
Reg S-P and Red Flags
🔐 A customer's Social Security number, balances and trades are exactly what identity thieves want. Two SEC regulations decide what a firm can share and how it must guard the rest.
💡 Key idea
S-P: privacy notices, opt-out before sharing with nonaffiliated third parties, safeguards, and breach notice within 30 days. S-ID: a written program to detect identity theft red flags.
🧠 Why it matters
REGULATION S-P protects nonpublic personal information. A firm gives a PRIVACY NOTICE when the customer relationship begins and generally every year after. Before sharing it with NONAFFILIATED third parties, such as outside marketers, it must let the customer OPT OUT; sharing with a service provider that processes accounts is an exception. Firms need written safeguards and disposal policies. 2024 amendments add an INCIDENT RESPONSE PROGRAM: when sensitive customer information is (or is reasonably likely to be) accessed without authorization, affected customers get notice within 30 days of the firm becoming aware. All firms had to comply by June 3, 2026. REGULATION S-ID requires a written IDENTITY THEFT PROGRAM that spots RED FLAGS, such as an address change followed by a wire request.
📈 In the real world
📬 Two days after an online change of address on Ed's account, someone calls asking to wire $40,000 to a new bank. The firm's Reg S-ID program flags the combination. A rep phones Ed at the number on file, and Ed says he never moved. The wire is stopped.
📌 Takeaways
- Privacy notice at the start of the relationship and generally every year
- Opt-out right before nonpublic data goes to nonaffiliated third parties
- Breach notice to affected customers within 30 days; Reg S-ID red-flag program
📖 Terms in this lesson
Regulation S-P: The SEC privacy rule requiring firms to give privacy notices, let customers opt out of certain sharing with nonaffiliates, and safeguard customer information.
Regulation S-ID: The SEC rule requiring firms to run a program that detects and responds to red flags of identity theft.
✅ Test yourself
Under Regulation S-P, a customer's right to opt out applies to sharing nonpublic personal information with whom?
- The firm's clearing firm for processing
- The firm's own affiliates
- FINRA examiners
- Nonaffiliated third parties
Answer: D · Nonaffiliated third parties
Reg S-P's privacy opt-out applies to sharing with nonaffiliated third parties such as outside marketers. Regulators and service providers that process transactions fall under exceptions, and affiliate marketing is handled by a separate rule (Regulation S-AM), not this opt-out.
Under the amended Regulation S-P, how quickly must affected customers be notified after a firm becomes aware of unauthorized access to their sensitive information?
- Within 10 business days
- No later than 30 days
- Within 90 days
- Within 72 hours
Answer: B · No later than 30 days
Notice is due as soon as practicable but no later than 30 days. The 72-hour figure is how fast a service provider must alert the firm, not the deadline for telling customers.
Which situation is the best example of an identity theft red flag under Regulation S-ID?
- A customer adds to an IRA before the tax deadline
- An address change, then a big wire request
- A customer asks for a copy of the privacy notice
- A customer buys a stock she has owned before
Answer: B · An address change, then a big wire request
A sudden address change followed by a request to move money is a classic account-takeover pattern. The other choices are ordinary customer behavior with no sign of a stolen identity.
SIE-style questions, XP and streaks in the app. No sign-up needed.