Regulation S-P (Privacy)
The SEC's privacy rule: firms must deliver a privacy notice at account opening and annually, give customers the right to OPT OUT of sharing nonpublic personal information with nonaffiliated third parties, and safeguard customer records.
The exam tests Reg S-P as a timing-and-trigger question: it hands you a scenario and asks when a notice is required or whether the customer gets an opt-out. The “tell” is the recipient — sharing with a nonaffiliated third party is the only path that triggers the opt-out, while affiliates and account-servicing vendors are exempt. A newer wrinkle: the SEC’s 2024 amendments add a breach-notification rule requiring firms to notify affected individuals as soon as practicable, and no later than 30 days after becoming aware of a breach (phased compliance — larger firms by Dec 3, 2025, smaller firms by June 3, 2026; older question banks omit this entirely).
Don’t confuse Reg S-P with its neighbors. CIP/account-opening collects identity data going in; Reg S-P controls that data going out. AML screens for criminal money flows; Reg S-P protects honest customers’ privacy. SIPC restores missing assets when a firm fails, not when data leaks. Memory hook: S-P = “Stay Private.” When the question says “outside the firm’s corporate family,” reach for the opt-out.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →