10.1 Personal Information, Fiduciary Data and Relationships

In modern securities operations, customer onboarding, margin lending, clearing, settlement, and asset custody generate immense volumes of sensitive financial and personal data. Back-office operations specialists operate at the critical intersection of trade processing, third-party vendor integration, and client records. Protecting this confidential information is not merely an operational best practice; it is a strict statutory mandate under federal securities laws and self-regulatory organization (SRO) rules. Operations professionals must master the regulatory architecture governing customer privacy notices, opt-out protocols, information security safeguards, modern breach notifications, and identity theft prevention frameworks.

SEC Regulation S-P: Statutory Scope & Core Definitions

Enacted by the Securities and Exchange Commission (SEC) pursuant to Title V of the Gramm-Leach-Bliley Act (GLBA) of 1999 and codified under 17 CFR Part 248, Regulation S-P is the foundational federal privacy regulation governing the financial securities industry. The regulation applies directly to all registered broker-dealers, registered investment companies (mutual funds, closed-end funds, unit investment trusts), and SEC-registered investment advisers (RIAs).

The overarching objective of Regulation S-P is twofold: first, to ensure that financial institutions establish comprehensive procedural safeguards to protect customer records; and second, to provide consumers and customers with transparent disclosures and meaningful control over how their nonpublic financial information is shared with non-affiliated third parties.

Nonpublic Personal Information (NPI) Defined

At the center of Regulation S-P is the concept of Nonpublic Personal Information (NPI). Understanding what constitutes NPI is essential for operations personnel who handle customer paperwork, electronic databases, and clearing files.

• Personally Identifiable Financial Information (PIFI): NPI includes any personally identifiable financial information that: (1) a consumer provides to a broker-dealer to obtain a financial product or service; (2) results from any transaction involving the consumer and the broker-dealer; or (3) is otherwise obtained by the broker-dealer in connection with providing a financial product or service.
• Representative Examples of NPI:
  • Government Identification Numbers: Social Security numbers (SSNs), Individual Taxpayer Identification Numbers (ITINs), passport numbers, and driver's license numbers.
  • Account Details & Balances: Brokerage account numbers, bank routing and account numbers, trade confirmation details, margin loan debit balances, and securities portfolio holdings.
  • Financial Background Data: Net worth, annual income, credit scores, consumer credit reports, and tax return filings collected during account onboarding.
  • Derived Groupings & Lists: Any list, description, or grouping of consumers (and publicly available information pertaining to them) that is derived using personally identifiable financial information that is not publicly available. For example, a list of individuals who maintain active margin accounts with equity exceeding $1,000,000 constitutes NPI because the list was constructed using confidential internal firm records.

NPI vs. Publicly Available Information

Publicly available information consists of data that the broker-dealer has a reasonable basis to believe is lawfully made available to the general public from: (1) government records (such as county real estate property records or corporate filings on SEC EDGAR); (2) widely distributed media (such as published telephone directories, newspapers, or publicly accessible internet websites); or (3) disclosures required by federal, state, or local law.

The Legal Demarcation: Consumers vs. Customers

Regulation S-P draws a critical legal and operational distinction between a consumer and a customer. This distinction governs exactly when a broker-dealer is legally required to deliver privacy notices and provide opt-out rights.

1. Consumer

• Statutory Definition: An individual who obtains or has obtained a financial product or service from a broker-dealer that is to be used primarily for personal, family, or household purposes, whether or not a continuing relationship is established; a customer is also a consumer.
• Operational Scenarios: An individual who visits a broker-dealer to execute an isolated wire transfer, cash a check, purchase an isolated cashier's check, or submit an account application that is subsequently rejected or abandoned.
• Privacy Notice Mandate: A broker-dealer is not legally required to deliver an Initial Privacy Notice to a consumer unless the firm intends to disclose the consumer's NPI to non-affiliated third parties outside of statutory exceptions. If the firm keeps the consumer's NPI internal, no notice is required.

2. Customer

• Statutory Definition: A consumer who has established a continuing, ongoing relationship with the broker-dealer under which the firm provides one or more financial products or services.
• Operational Scenarios: An individual who opens a cash or margin brokerage account, holds securities in custody or street name, signs an investment advisory contract, or maintains an active securities loan.
• Privacy Notice Mandate: A broker-dealer must deliver an Initial Privacy Notice to every customer at or before the time the customer relationship is established, regardless of whether the firm discloses or plans to disclose NPI to third parties. Furthermore, the firm must deliver an Annual Privacy Notice throughout the life of the relationship (unless qualifying for the FAST Act statutory exemption).

Information Sharing and Fiduciary Data

Share information internally only for authorized purposes and with appropriate access. An operations employee may need settlement account details but not an unrelated investment-banking project file. A shared employer does not justify unrestricted internal access.

Rule 2060 prohibits using information about securities ownership obtained in a fiduciary capacity to solicit purchases or sales except in the circumstances permitted by the rule. For example, a shareholder list obtained while handling a corporate action is not a free prospecting list for the sales desk. Customer privacy, fiduciary purpose and confidentiality must be assessed separately from whether a name appears publicly elsewhere.

Before an external disclosure, identify the recipient, purpose, legal basis, minimum information needed and secure channel. An appropriate clearing transmission differs from a marketing sale of customer data. Log access and disclosures as required and follow retention rules even when a customer requests deletion; privacy rights do not authorize destruction of records that securities law requires preserving.

If staff discover a statement sent to the wrong customer, contain further distribution, report it through the incident process and preserve the affected data and delivery records. Do not quietly delete the email and declare that no information left the firm.

Sources checked 2026-10-20: SEC Regulation S-P, FINRA shareholder materials.