10.2 Privacy Notices, Opt-outs and Exceptions

Required Privacy Notices & The FAST Act Exception

Broker-dealer operations must maintain strict workflows to ensure privacy notices are timely, clear, and legally compliant.

1. Initial Privacy Notice

• Delivery Timing: Must be delivered at or prior to the time the customer relationship is established (e.g., during the customer onboarding workflow before account approval or trade execution).
• Content Requirements: Must be clear and conspicuous (prominently displayed and easy to understand). The notice must explicitly state:
  • The categories of NPI collected by the broker-dealer;
  • The categories of NPI disclosed to third parties;
  • The categories of affiliates and non-affiliated third parties to whom NPI is disclosed;
  • The customer's legal right to opt out of disclosures to non-affiliated third parties; and
  • The firm's operational policies and procedures for protecting the confidentiality, security, and integrity of customer records.

2. Annual Privacy Notice

• Standard Requirement: A broker-dealer must deliver an updated privacy notice to all active customers at least once in any consecutive 12-month period during which the relationship continues.
• The FAST Act Statutory Exception: Enacted under the Fixing America's Surface Transportation (FAST) Act of 2015, Congress established a statutory safe harbor exempting broker-dealers from delivering an annual privacy notice if the firm satisfies two cumulative conditions:
  1. The firm does not share NPI with non-affiliated third parties other than pursuant to statutory exceptions that do not trigger opt-out rights (e.g., operational trade clearing, account administration, regulatory reporting); and
  2. The firm has not modified its privacy policies and disclosure practices from those detailed in the most recent privacy notice previously delivered to customers.
• If a broker-dealer alters its data-sharing practices, it forfeits the FAST Act exemption and must immediately deliver a revised privacy notice.

3. Revised Privacy Notice

If a broker-dealer intends to disclose a new category of NPI to a non-affiliated third party, or disclose NPI to a new category of non-affiliated third party not previously disclosed in its current notice, the firm must deliver a revised notice and provide a reasonable new opt-out opportunity where required before sharing the information.

Customer Opt-Out Rights & Operational Mechanics

Under Regulation S-P, customers possess the fundamental legal right to prevent a broker-dealer from sharing their NPI with non-affiliated third parties.

A Reasonable Opt-out Opportunity

Before disclosing NPI to a non-affiliated third party, the broker-dealer must provide the customer with a clear explanation of their right to opt out and a reasonable opportunity to exercise that right. The rule gives 30 days after a mailed or electronically delivered notice as an example of a reasonable opportunity. It is not a universal mandatory 30-day waiting period for all relationships and delivery methods.

Reasonable vs. Unreasonable Opt-Out Methods

The method provided to the customer to exercise their opt-out must be operationally accessible and convenient:

• Reasonable Opt-Out Methods: Providing a toll-free telephone number staffed during normal business hours; including a pre-addressed, postage-paid opt-out reply card; or providing a prominent, electronic one-click opt-out link within the customer's online account portal.
• Unreasonable Opt-Out Methods: Requiring a customer to draft a custom legal letter from scratch; requiring a customer to visit a physical branch office; or requiring a customer to navigate a deliberately confusing, multi-layered electronic interface designed to deter opt-outs.

Persistence and Joint Accounts

• Indefinite Duration: Once a customer registers an opt-out election, that opt-out remains effective indefinitely until the customer revokes it as permitted under the applicable notice and rule. Even if the customer terminates their account and the relationship becomes dormant, the prior opt-out election continues to protect their archived NPI.
• Joint Account Governance: For joint accounts (such as JTWROS or TIC), a broker-dealer may establish in its privacy notice that an opt-out by one joint account holder applies to all account holders, or allow each joint holder to opt out independently.

Statutory Exceptions to the Opt-Out Requirement

Federal privacy law recognizes that financial markets cannot function if customers can block every operational transfer of data. Under Sections 13, 14, and 15 of Regulation S-P, broker-dealers may share NPI with third parties without providing an opt-out notice or waiting 30 days under three primary operational safe harbors:

1. Operational Trade Processing & Account Servicing (Section 14)

Broker-dealers may disclose permitted information within the exception’s scope to non-affiliated third parties when necessary to effect, administer, process, clear, settle, or enforce a transaction requested or authorized by the customer. This covers operational data transmissions to:

• Clearing broker-dealers (e.g., Pershing, National Financial Services) and clearing agencies (NSCC, DTC);
• Custodian banks and corporate transfer agents;
• Outside technology service providers that generate customer trade confirmations, monthly account statements, and tax forms (e.g., Form 1099);
• Back-office portfolio accounting software and trade blotter reconciliation systems.

2. Joint Marketing Agreements (Section 13)

A broker-dealer may share NPI with non-affiliated financial institutions pursuant to a formal, written joint agreement to market financial products or services, provided:

• The broker-dealer fully disclosed this arrangement in its initial privacy notice; and
• The written contract strictly prohibits the third party from disclosing or using the customer NPI for any purpose other than executing the specific joint marketing program.

3. Legal, Regulatory & Fraud Prevention Mandates (Section 15)

A broker-dealer may disclose NPI without opt-out rights under statutory mandates:

• To comply with federal, state, or local laws, rules, or judicial processes (including grand jury subpoenas and court orders);
• To respond to regulatory inquiries and examinations conducted by the SEC, FINRA, state securities administrators, or banking regulators;
• To file mandatory Anti-Money Laundering (AML) reports with FinCEN, including Currency Transaction Reports (CTR Form 112) and Suspicious Activity Reports (SAR Form 111);
• To protect against or prevent actual or potential fraud, unauthorized transactions, cyber intrusions, or legal liability.

Sources checked 2026-10-20: SEC Regulation S-P, FINRA shareholder materials.