SEC Regulation S-ID Compliance and Regulation S-P Compliance
Our Attorneys Help Financial Institutions Comply with the SEC’s Identity Theft Red Flags Rules Under Regulation S-ID and Regulation S-P
Investment firms and other businesses that qualify as a financial institution or creditor under the SEC’s rules must comply with Regulation S-ID. Financial institutions must comply with the SEC’s Regulation S-P as well. If you need to comply, our attorneys can assist with developing and implementing an identity theft prevention program that meets all pertinent federal requirements.
SEC Compliance Team Lead
Former DOJ Trial Attorney
Contact JohnThe US Securities and Exchange Commission (SEC) requires market participants to maintain appropriate and effective oversight of their identity theft prevention efforts. Market participants cannot delegate their regulatory responsibilities, and third-party service provider arrangements do not insulate market participants from liability.
As a result, while market participants can—and generally must—engage cybersecurity vendors to protect their clients’ data, they must also take a broader, hands-on approach to mitigate identity theft. This is essential for complying with the SEC’s “Identity Theft Red Flags Rules” under Regulation S-ID, as well as the SEC’s Regulation S-P.
What Broker-Dealers, Investment Firms, and Other Financial Institutions Need to Know About SEC Regulation S-ID and Regulation S-P Compliance
Broadly, market participants that are subject to Regulations S-ID and S-P must take appropriate steps to manage the reasonably foreseeable risk of identity theft with respect to the opening of a covered account or any existing covered account. This includes (but is not limited to) taking appropriate steps to identify relevant red flags.
Market participants that maintain covered accounts are subject to Regulation S-ID and Regulation S-P compliance. Notably, while these entities may also need to comply with data security provisions of the Fair Credit Reporting Act (FCRA) and other federal statutes, this generally will not be sufficient for meeting their obligations under Regulations S-ID and S-P.
Ultimately, responsibility for Regulation S-ID and Regulation S-P compliance falls on a financial institution’s or creditor’s senior management. At Oberheiden PC, we assist financial institutions and creditors with all aspects of compliance, working closely with their senior management throughout the process. This includes (but is not limited to):
- Developing and implementing an initial written program custom-tailored to the entity’s specific compliance obligations;
- Ensuring that the entity’s initial written program covers any “information or access device” that falls within the scope of Regulation S-ID or Regulation S-P;
- Providing appropriate training to investment advisers and other staff members;
- Ensuring that the entity is appropriately equipped to identify identity theft risks on an ongoing basis; and,
- Ensuring that the entity is prepared to respond appropriately to any cybersecurity threats or intrusions.
Our SEC compliance attorneys help financial institutions and creditors develop and effectively implement custom-tailored Regulation S-ID and Regulation S-P compliance programs that include reasonable policies based on their specific risks and vulnerabilities. As applicable, this includes helping our clients address risks, vulnerabilities, and compliance concerns such as:
- Assigning a senior manager or other designated employee to oversee the entity’s compliance program
- Automated analysis of photograph or physical description data on a customer’s government issued driver’s license or passport
- Storage of unique biometric data
- Use of unique electronic identification numbers
- Providing written or electronic notice of data breaches when necessary
If a covered entity collects other personal identifying information related to a customer’s covered account (i.e., a brokerage account), permits wire transfers, issues paper account statements, uses a “telecommunication identifying information or access device,” or engages in any other business practices that implicate provisions of Regulation S-ID or Regulation S-P, it must be sure to strictly comply with these provisions as well. Covered entities must also implement procedures for promptly reporting incorrect address information (or other incorrect personally identifying information) that raises concerns about possible identity theft.
Crucially, after putting their initial compliance programs in place, financial institutions and creditors must periodically determine whether additional (or revised) compliance efforts are necessary. Recently established credit relationships, information-sharing relationships with foreign financial institutions, establishment of new investment advisory account or mutual fund account relationships, changes in customer identification program rules, and various other developments may all require covered entities to update their Regulation S-ID and Regulation S-P compliance programs.
Identifying Identity Theft Red Flags: The Key to Regulation S-ID and Regulation S-P Compliance
At the heart of Regulation S-ID and Regulation S-P compliance for covered entities is identifying red flags for identity theft. The regulations identify several red flags that covered entities must be prepared to both identify and address on an ongoing basis. Some examples include:
- Questionable electronic fund transfer patterns
- Questionable submission of a fingerprint, voice print, retina or iris image, or other unique physical representation
- Submission of other suspicious personal identifying information
- Submission of inaccurate or incomplete information
- A telephone number submitted is not associated with the customer
Among other requirements, covered entities must have procedures in place to verify a customer’s government issued driver’s license number, government passport number, alien registration number, or taxpayer identification number—as well as any biometric or other personally identifying data. If a broker-dealer, open-end investment company, business development company, or any other covered entity fails to identify any red flags as required, this can potentially create significant exposure in the event of an SEC enforcement proceeding.
While training staff on identity theft mitigation procedures is important, it is generally inadequate on its own. Financial institutions and creditors that are subject to Regulation S-ID and Regulation S-P must have comprehensive and custom-tailored compliance programs, and they must be prepared to demonstrate their ongoing risk mitigation efforts to the SEC if necessary.
FAQs: Effectively Managing SEC Regulation S-ID and Regulation S-P Compliance
What do financial institutions and creditors need to do to comply with the SEC’s identity theft detection regulations?
Financial institutions and creditors that are subject to the SEC’s identity theft detection regulations (i.e., Regulation S-ID and Regulation S-P) must implement reasonable written policies that are designed to protect their clients’ personal and financial information. They must then implement these written policies and proactively manage their identity theft risk on an ongoing basis. Our attorneys assist with all aspects of initial and ongoing Regulation S-ID and Regulation S-P compliance.
How does the SEC define “identity theft”?
As defined by Regulation S-ID, identity theft means, “a fraud committed or attempted using the identifying information of another person without authority.” This definition is extremely broad, and it encompasses everything from attempting to gain direct access to an account maintained by a covered financial institution or creditor to accessing a customer’s account records held by a covered entity.
How does the SEC define a “covered account”?
This term is also defined by Regulation S-ID. As defined in the regulation, a covered account means either: (i) “[a]n account that a financial institution or creditor offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions;” or, (ii) “[a]ny other account that the financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the financial institution or creditor from identity theft.”
What are some of the most common issues that lead to SEC scrutiny under Regulation S-ID and Regulation S-P?
Several common issues can lead to SEC scrutiny under Regulation S-ID and Regulation S-P. For example, financial institutions often fail to periodically assess covered accounts as required by the regulations. Additionally, many firms use boilerplate language without tailoring it to their specific business model and risks. These are both potentially costly errors that covered entities can—and should—avoid.
Covered entities must also ensure that they update their compliance programs to reflect changes in their identity theft risk exposure when necessary. Not only must covered entities’ compliance programs be appropriate to the entity’s size and complexity, but they must also reflect their current compliance obligations.
Do financial institutions need to take specific steps to comply with Regulation S-ID and Regulation S-P?
Yes, complying with Regulations S-ID and S-P requires a custom-tailored approach focused on the specific identity theft prevention requirements established under these regulations. Complying with general cybersecurity regulations will be insufficient in most (if not all) cases. Covered entities need to develop a comprehensive and custom-tailored compliance program with senior management or board approval, and then they must proactively manage compliance on an ongoing basis.
Speak with an SEC Compliance Attorney at Oberheiden PC Today
If you have questions or concerns about Regulation S-ID or Regulation S-P compliance, we invite you to get in touch. Our SEC compliance attorneys work with investment firms, banks, and other financial institutions and creditors nationwide. Call 888-680-1745 or get in touch online to schedule a complimentary initial consultation today.
Related pages:
