10.3 Safeguards, Breach Response and Identity Theft

The Safeguards Rule & The Disposal Rule

While notice and opt-out provisions govern information sharing, operational security is anchored by two critical provisions within Regulation S-P.

1. The Safeguards Rule (17 CFR § 248.30(a))

The Safeguards Rule mandates that every registered broker-dealer adopt written policies and procedures establishing administrative, technical, and physical safeguards reasonably designed to:

1. Ensure the security and confidentiality of customer records and information;
2. Protect against any anticipated threats or hazards to the security or integrity of customer records and information; and
3. Protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.

Risk-based Safeguard Examples

The following illustrate possible controls; the rule requires a reasonably designed program, not every listed technology or one prescribed architecture.

• Administrative Safeguards: Establishing a formal Written Information Security Policy (WISP); conducting annual employee privacy and cybersecurity training; executing background checks on new operations staff; enforcing the principle of least privilege (limiting system access strictly to data required for an employee's job function); and maintaining written confidentiality agreements.
• Physical Safeguards: Implementing electronic badge access to operations facilities; restricting access to cashiering cages, stock record departments, and server rooms; maintaining physical visitor logs and visitor escorts; enforcing "clean desk" and "clear screen" policies; and storing paper files containing NPI in fireproof, locked file cabinets.
• Technical Safeguards: Requiring multi-factor authentication (MFA) across all employee workstations and customer web portals; enforcing robust data encryption standards (appropriate encryption for the data and systems, rather than one universally mandated algorithm/version); installing dual-perimeter firewalls and intrusion detection/prevention systems (IDS/IPS); managing software vulnerability patching; and performing periodic penetration testing.

2. Secure Disposal

Enacted pursuant to the Fair and Accurate Credit Transactions Act (FACT Act) of 2003, the Disposal Rule requires broker-dealers handling covered consumer and customer information under the current rule to take reasonable measures to protect against unauthorized access during disposal:

• Paper Document Destruction: Cross-cut shredding, burning, or pulverizing physical paper files so that customer information cannot practicably be read or reconstructed.
• Electronic Media Destruction: Degaussing (demagnetizing) magnetic data tapes; overwriting digital hard drives with cryptographic wiping software; or physically crushing, shredding, or incinerating electronic storage drives before equipment disposal or decommissioning.

Current Regulation S-P Incident Response

The 2024 amendments require incident-response policies to detect, respond to and recover from unauthorized access/use of customer information. Assess scope, identify affected information and systems, contain the incident, preserve evidence and determine required notifications.

Affected-individual notice is required as soon as practicable, generally within 30 days after awareness of unauthorized access/use that occurred or is reasonably likely to have occurred, when sensitive customer information is implicated under the rule. A reasonable investigation can support the rule’s no-substantial-harm/inconvenience exception. Authorized national-security/public-safety delays have specific conditions; management cannot simply postpone notice to avoid embarrassment.

Service-provider oversight policies must be reasonably designed to ensure safeguards and notice as soon as possible, no later than 72 hours after the provider becomes aware of a covered breach. The final rule uses an oversight-policy requirement, rather than a universal mandate that every provider sign one specified contract. Outsourcing notification does not remove the covered institution’s responsibility.

Larger entities’ compliance date was December 3, 2025; smaller entities’ was June 3, 2026. Both have passed as of October 2026. For broker-dealers, “small entity” is determined using the applicable total-capital and affiliation tests, generally less than $500,000 total capital, not $50 million in assets or capital.

A stolen statement containing only a publicly known name differs from compromised login credentials or a name combined with a sensitive identifier. Assess the actual information and access; do not assume that encryption automatically removes every notification duty or that every event requires identical notices.

Source checked 2026-10-20: SEC Regulation S-P final rule and compliance materials.

Regulation S-ID: The Red Flags Rule

For entities within the SEC’s jurisdiction, 17 CFR § 248.201, Regulation S-ID requires covered SEC-regulated financial institutions/creditors maintaining covered accounts to develop, implement, and maintain a written Identity Theft Prevention Program.

Covered Accounts Defined

A covered account is: (1) any account offered or maintained primarily for personal, family, or household purposes that involves or permits multiple payments or transactions (e.g., retail brokerage accounts, margin accounts, checking-linked accounts, retirement accounts); or (2) any other account for which there is a reasonably foreseeable risk of identity theft.

The Four Core Program Mandates

1. Identify: Incorporate relevant identity theft "red flags" into written procedures tailored to the firm's specific business lines and account types.
2. Detect: Establish operational detection controls during account opening and ongoing account administration.
3. Respond: Execute appropriate operational responses when red flags are detected (e.g., freezing disbursements, contacting the customer via out-of-band verified channels, notifying AML and compliance officers).
4. Update: Periodically review and update the program to address evolving cyber threats and identity theft schemes.

Common Operational Identity Theft Red Flags

• Address Discrepancies: A customer request to disburse funds or liquidate securities immediately following an online address or email change within the preceding 30 days.
• Suspicious Identification Documents: Presentation of altered driver's licenses, passports with font irregularities, expired identification credentials, or photographs that do not match the customer's appearance.
• Inconsistent Personal Identifiers: An SSN matching the Social Security Administration's Death Master File; an invalid area code/zip code combination; or mail repeatedly returned as undeliverable while account trading continues.
• Anomalous Account Behavior: Sudden, massive liquidation of long-held conservative blue-chip equities followed by an urgent request to wire funds to an unverified offshore third-party entity.

Sources checked 2026-10-20: SEC Regulation S-P, FINRA shareholder materials.