40398 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

1Public Law 108–159, Section 214, 117 Stat. 

1952, 1980 (2003). 

2 15 U.S.C. 78q, 78w, and 78mm. 

3 15 U.S.C. 80a–30 and 80a–37. 

4 15 U.S.C. 80b–4 and 80b–11. 

5See Public Law 108–159, Section 214, 117 Stat. 

1952, 1980 (2003); 15 U.S.C. 1681s–3 and note. The 

FCRA sets standards for the collection, 

communication, and use of information bearing on 

a consumer’s credit worthiness, credit standing, 

credit capacity, character, general reputation, 

personal characteristics, or mode of living. 

A portion of Section 214 of the FACT Act 

amended the FCRA to add a new Section 624, while 

other provisions of Section 214 were not 

incorporated into the FCRA. Throughout this 

release, references to ‘‘Section 214’’ or ‘‘Section 624 

of the FCRA’’ are used depending on whether the 

reference is to Section 624 or to a portion of Section 

214 not incorporated into the FCRA. 

6See Banking Agencies, Fair Credit Reporting 

Affiliate Marketing Regulations, 72 FR 62910 (Nov. 

7, 2007) (‘‘Joint Rules’’). Citations to particular 

SECURITIES AND EXCHANGE 

COMMISSION 

17 CFR Part 248 

[Release Nos. 34–60423, IC–28842, IA–2911; 

File No. S7–29–04] 

RIN 3235–AJ24 

Regulation S–AM: Limitations on 

Affiliate Marketing 

AGENCY: Securities and Exchange 

Commission. 

ACTION: Final rule. 

SUMMARY: The Securities and Exchange 

Commission (‘‘Commission’’) is 

adopting Regulation S–AM to 

implement Section 624 of the Fair 

Credit Reporting Act as amended by 

Section 214 of the Fair and Accurate 

Credit Transactions Act of 2003, which 

required the Commission and other 

Federal agencies to adopt rules 

implementing limitations on a person’s 

use of certain information received from 

an affiliate to solicit a consumer for 

marketing purposes, unless the 

consumer has been given notice and a 

reasonable opportunity and a reasonable 

and simple method to opt out of such 

solicitations. The final rules implement 

the requirements of Section 624 with 

respect to investment advisers and 

transfer agents registered with the 

Commission, as well as brokers, dealers 

and investment companies. 

DATES: Effective Date: September 10, 

2009. 

Compliance Date: Compliance will be 

mandatory as of January 1, 2010. 

FOR FURTHER INFORMATION CONTACT: For 

information regarding the regulation as 

it relates to brokers, dealers, or transfer 

agents, contact Brice Prince, Special 

Counsel, or Ignacio Sandoval, Attorney, 

Office of Chief Counsel, Division of 

Trading and Markets, (202) 551–5550, or 

regarding the regulation as it relates to 

investment companies or investment 

advisers, contact Penelope Saltzman, 

Assistant Director, Office of Regulatory 

Policy, Division of Investment 

Management, (202) 551–6792, Securities 

and Exchange Commission, 100 F 

Street, NE., Washington, DC 20549. 

SUPPLEMENTARY INFORMATION: The 

Commission today is adopting 

Regulation S–AM, 17 CFR 248.101 

through 248.128, under the Fair and 

Accurate Credit Transactions Act of 

2003 (‘‘FACT Act’’),1 the Securities 

Exchange Act of 1934 (the ‘‘Exchange 

Act’’),2 the Investment Company Act of 

1940 (the ‘‘Investment Company Act’’),3

and the Investment Advisers Act (the 

‘‘Advisers Act’’).4

Table of Contents 

I. Background 

II. Overview of Comments Received and 

Explanation of Regulation S–AM 

A. Overview of Comments Received 

B. Explanation of Regulation S–AM 

III. Section-by-Section Analysis 

A. Section 248.101 Purpose and Scope 

B. Section 248.102 Examples 

C. Section 248.120 Definitions 

1. Affiliate 

2. Broker 

3. Clear and Conspicuous 

4. Commission 

5. Company 

6. Concise 

7. Consumer 

8. Control 

9. Dealer 

10. Eligibility Information 

11. FCRA 

12. GLBA 

13. Investment Adviser 

14. Investment Company 

15. Marketing Solicitation 

16. Person 

17. Pre-Existing Business Relationship 

18. Transfer Agent 

19. You 

D. Section 248.121 Affiliate Marketing 

Opt Out and Exceptions 

1. Section 248.121(a) 

2. Section 248.121(b) 

3. Sections 248.121(c) and (d) 

4. Relation to Affiliate-Sharing Notice and 

Opt Out 

E. Section 248.122 Scope and Duration of 

Opt Out 

1. Section 248.122(a) 

2. Section 248.122(b) Duration and 

Timing of Opt Out 

3. Section 248.122(c) 

F. Section 248.123 Contents of Opt Out 

Notice; Consolidated and Equivalent 

Notices 

1. Section 248.123(a) 

2. Coordinated, Consolidated, and 

Equivalent Notices 

G. Section 248.124 Reasonable 

Opportunity To Opt Out 

1. Section 248.124(a) 

2. Section 248.124(b) 

H. Section 248.125 Reasonable and 

Simple Methods of Opting Out 

I. Section 248.126 Delivery of Opt Out 

Notices 

J. Section 248.127 Renewal of Opt Out 

Elections 

K. Section 248.128 Effective Date, 

Compliance Date, and Prospective 

Application 

1. Section 248.128(a) and (b) 

2. Section 248.128(c) 

IV. Appendix to Subpart B-Model Forms 

V. Cost-Benefit Analysis 

VI. Paperwork Reduction Act 

A. Collection of Information 

B. Use of Information 

C. Respondents 

D. Total Annual Reporting and 

Recordkeeping Burdens 

E. Retention Period for Recordkeeping 

Requirements 

F. Collection of Information Is Mandatory 

VII. Final Regulatory Flexibility Analysis 

A. Need for the Rule 

B. Description of Small Entities to Which 

the Final Rules Will Apply 

C. Projected Reporting, Recordkeeping, and 

Other Compliance Requirements 

D. Identification of Other Duplicative, 

Overlapping, or Conflicting Federal 

Rules 

E. Agency Actions To Minimize Effects on 

Small Entities 

VIII. Consideration of Burden on 

Competition, and Promotion of 

Efficiency, Competition, and Capital 

Formation 

IX. Statutory Authority 

X. Text of Final Rules 

I. Background 

Section 214 of the FACT Act added 

Section 624 to the Fair Credit Reporting 

Act (‘‘FCRA’’).5 This new section of the 

FCRA gives consumers the right to 

restrict a person from making marketing 

solicitations to them using certain 

information about them obtained from 

the person’s affiliate. Section 214 also 

required the Office of the Comptroller of 

the Currency (‘‘OCC’’), the Board of 

Governors of the Federal Reserve 

System (‘‘Board’’), the Federal Deposit 

Insurance Corporation (‘‘FDIC’’), the 

Office of Thrift Supervision, the 

National Credit Union Administration 

(‘‘NCUA’’) (collectively, the ‘‘Banking 

Agencies’’) and the Federal Trade 

Commission (‘‘FTC’’) (collectively with 

the Banking Agencies, the ‘‘Agencies’’), 

and the Commission, in consultation 

and coordination with one another, to 

issue rules implementing Section 624 of 

the FCRA. 

Commission staff consulted and 

coordinated with staff of the Agencies in 

drafting rules to implement Section 624. 

As required by Section 214 of the FACT 

Act, Regulation S–AM is, to the extent 

possible, consistent with and 

comparable to the implementing 

regulations adopted by the Agencies.6


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40399 

provisions of the ‘‘Joint Rules’’ refer to the 

numbering system used in the Board’s final rules. 

See 12 CFR 222.1 to 222.28. See also FTC, Affiliate 

Marketing Rule, 72 FR 61424 (Oct. 30, 2007) (‘‘FTC 

Rule’’). 

7 Limitations on Affiliate Marketing (Regulation 

S–AM), Exchange Act Release No. 49985 (July 8, 

2004), 69 FR 42302 (July 14, 2004) (‘‘Proposing 

Release’’). 

8The Securities Industries Association, n/k/a the 

Securities Industry and Financial Markets 

Association (‘‘SIFMA’’) submitted two comment 

letters. We consider these letters to be one 

comment. See Letters from Alan E. Sorcher, Vice 

President and Associate General Counsel, SIFMA to 

Jonathan G. Katz, Secretary, Commission (Aug. 13, 

2004) (‘‘SIFMA Letter I’’) and from Alan E. Sorcher, 

Vice President and Associate General Counsel, 

SIFMA to Jonathan G. Katz, Secretary, Commission 

(Aug. 18, 2004) (‘‘SIFMA Letter II’’) (together 

‘‘SIFMA Letters’’). Unless otherwise noted, all 

letters referred to below were addressed to the 

Secretary of the Commission. 

See Letter from Michael E. Bleier, General 

Counsel, Mellon Financial Corporation (July 26, 

2004) (‘‘Mellon Letter’’); Letter from Ira Friedman, 

Senior Vice President, Chief Privacy Officer and 

Special Counsel, Metropolitan Life Insurance 

Company (Aug. 3, 2004) (‘‘MetLife Letter’’); Letter 

from Larkin Fields, Senior Vice President and Chief 

Privacy Officer, United Services Automobile 

Association (Aug. 11, 2004) (‘‘USAA Letter’’); Letter 

from Jeffrey A. Tassey, Executive Director, Coalition 

to Implement the FACT Act (Aug. 12, 2004) 

(‘‘Coalition Letter’’); Letter from Monique S. Botkin, 

Counsel, Investment Counsel Association of 

America, Inc., n/k/a Investment Adviser 

Association (Aug. 12, 2004) (‘‘IAA Letter’’); Letter 

from Robert G. Rowe, III, Regulatory Counsel, 

Independent Community Bankers of America (Aug. 

12, 2004) (‘‘ICBA Letter’’); Letter from Peter L. 

McCorkell, Senior Counsel, Wells Fargo & Company 

(Aug. 12, 2004) (‘‘Wells Fargo Letter’’); Letter from 

Roberta B. Meyer, Senior Counsel, Risk 

Classification, American Council of Life Insurers 

(‘‘ACLI’’) (Aug. 13, 2004) (‘‘ACLI Letter’’); Letter 

from Tamara K. Salmon, Senior Associate Counsel, 

Investment Company Institute (‘‘ICI’’) (Aug. 13, 

2006) (‘‘ICI Letter’’); Letter from Henry H. Hopkins, 

Chief Legal Counsel, and Karen Nash-Goetz, 

Associate Legal Counsel, T. Rowe Price Associates, 

Inc. (Aug. 13, 2004) (‘‘T. Rowe Price Letter’’); Letter 

from J. Stephen Zielezienski, Vice President & 

Associate General Counsel, American Insurance 

Association (‘‘AIA’’) (Aug. 15, 2004) (‘‘AIA Letter’’); 

Letter from Beth L. Climo, Executive Director, 

American Bankers Association Securities 

Association (‘‘ABASA’’) (Aug. 16, 2004) (‘‘ABASA 

Letter’’); Letter from Robert C. Drozdowski, Vice 

President, Payments and Technology Policy, 

America’s Community Bankers (‘‘ACB’’) (Aug. 16, 

2004) (‘‘ACB Letter’’); Letter from Richard M. 

Whiting, Executive Director and General Counsel, 

The Financial Services Roundtable (‘‘FSR’’) (Aug. 

16, 2004) (‘‘FSR Letter’’). Each of these letters is 

available at http://www.sec.gov/rules/proposed/ 

s72904.shtml. 9See, e.g., IAA Letter; ICI Letter; Mellon Letter; 

MetLife Letter. 10See infra Part III.D. 11Currently, Regulation S–P is codified at 17 CFR 

Part 248. With the adoption of Regulation S–AM, 

we are redesignating Regulation S–P as Subpart A 

of Part 248, and adopting Regulation S–AM as 

Subpart B of Part 248. We are also adopting 

technical and conforming amendments to 

Regulation S–P to reflect this change as detailed 

infra Part X. In particular, we are changing the 

current subpart designations within Regulation S– 

P to undesignated center headings, revising all 

references in Regulation S–P to ‘‘this part’’ to read 

‘‘this subpart,’’ and for consistency with the term 

used in Regulation S–AM, revising all references to 

‘‘G–L–B Act’’ to read ‘‘GLBA.’’ We are consolidating 

Regulation S–P and Regulation S–AM in Part 248 

because both regulations address information 

sharing and safekeeping. 

Regulation S–AM contains rules of 

general applicability that are 

substantially similar to the rules that 

have been adopted by the Agencies. 

Regulation S–AM also contains 

examples that illustrate the application 

of the general rules. These examples 

differ from those used by the Agencies 

in order to provide more meaningful 

guidance to financial institutions 

subject to the Commission’s 

jurisdiction. 

II. Overview of Comments Received 

and Explanation of Regulation S–AM 

A. Overview of Comments Received 

On July 8, 2004, the Commission 

proposed Regulation S–AM (the 

‘‘proposal’’ or ‘‘proposed rules’’).7 The 

Commission received 15 comments on 

the proposed rules from financial 

institutions and their representatives.8

While a number of commenters 

generally supported the Commission’s 

proposals,9 others expressed concerns 

regarding particular provisions of the 

proposed rules. The most significant 

areas of concern raised by the 

commenters related to: (1) Proposed 

restrictions on ‘‘constructive sharing’’; 

(2) which affiliate would be responsible 

for providing the notice; (3) the 

proposed definitions for terms such as 

‘‘affiliate,’’ ‘‘eligibility information,’’ 

‘‘clear and conspicuous,’’ ‘‘pre-existing 

business relationship,’’ and ‘‘marketing 

solicitation’’; and (4) the scope of 

certain proposed exceptions to the 

proposed rules’ notice and opt out 

requirements.10 A more detailed 

discussion of the comments is contained 

in the Section-by-Section analysis 

below. 

B. Explanation of Regulation S–AM 

Regulation S–AM will allow a 

consumer, in certain limited situations, 

to block affiliates of a person subject to 

Regulation S–AM that the consumer 

does business with from soliciting the 

consumer based on certain ‘‘eligibility 

information’’ (i.e., certain financial 

information, such as information 

regarding the consumer’s transactions or 

experiences with the person) received 

from the person. Unlike Regulation S– 

P, the Commission’s privacy rule,11

Regulation S–AM does not prohibit the 

sharing of information with another 

entity. Instead, Regulation S–AM 

prohibits a company from using 

eligibility information received from an 

affiliate to make marketing solicitations 

to consumers, unless: (1) The potential 

marketing use of the information has 

been clearly, conspicuously, and 

concisely disclosed to the consumer; (2) 

the consumer has been provided a 

reasonable opportunity and a simple 

method to opt out of receiving the 

marketing solicitation; and (3) the 

consumer has not opted out. Regulation 

S–AM also provides that a notice and 

opt out required under Regulation S– 

AM can be combined with other 

disclosures required by law, such as the 

initial and annual privacy notices 

required by Regulation S–P. Regulation 

S–AM also contains a number of 

exceptions to its notice and opt out 

requirements, such as when an affiliate 

making a marketing solicitation has a 

pre-existing business relationship with 

the consumer, or provides marketing 

material in response to an affirmative 

request by the consumer or in response 

to a communication initiated by the 

consumer. In addition, the Appendix to 

Regulation S–AM provides model forms 

that, when used properly, satisfy 

Regulation S–AM’s requirement that an 

affiliate marketing notice be clear, 

conspicuous, and concise. Regulation 

S–AM also includes examples 

illustrating the applicability of the final 

rules to certain situations. The facts and 

circumstances of each individual 

situation, however, will determine 

whether compliance with an example, 

to the extent applicable, constitutes 

compliance with the final rules. 

As adopted, Regulation S–AM differs 

from the proposed rules in several 

significant ways. First, an affiliate 

communicating eligibility information is 

not responsible for providing an affiliate 

marketing notice. Instead, the notice 

may be provided by any affiliate 

identified in the notice that has, or has 

previously had, a pre-existing business 

relationship with the consumer to 

whom the notice is provided. Second, 

the final rules do not apply to 

‘‘constructive sharing’’ scenarios, as 

considered in the Proposing Release. 

Third, the Commission requested and 

received comment on the use of oral 

notices, and after careful consideration 

of the comments, the final rules provide 

that notices cannot be delivered orally, 

but instead, must be delivered 

electronically or in writing. While 

consumers can elect to opt out orally 

after receipt of the notice, they may not 

orally revoke their opt out. Fourth, 

unlike the proposal which referred to 

‘‘making or sending’’ marketing 

solicitations, the final rules eliminate 

the reference to ‘‘send’’ because we 

concluded, based on comments, that 

‘‘sending’’ and ‘‘making’’ marketing 

solicitations are different activities. 

Fifth, the final rules clarify that an opt 


srobinson on DSKHWCL6B1PROD with RULES3
40400 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

12These and other changes are discussed in 

greater detail infra Part III. 

13See supra note 11. This numbering system 

differs slightly from the one used by the Agencies, 

but is still consistent with the Joint Rules— 

Regulation S–AM uses section numbers that are 

higher by 100 than those used in the Joint Rules. 

For example, references to § 22 of the Joint Rules 

would correspond to § 122 of Regulation S–AM. In 

addition, the Commission believes that placing 

Regulation S–AM in the same part of the CFR as 

the Commission’s privacy rules (i.e., Regulation S– 

P) will provide persons subject to the rules with an 

easier point of reference, especially since we expect 

that these persons would consolidate the notice and 

opt out requirements of the affiliate marketing rules 

together with those of the privacy rules. 

14Section 214(b) of the FACT Act directed that 

regulations implementing Section 624 of the FCRA 

be prescribed by the ‘‘Federal banking agencies, the 

National Credit Union Administration, and the 

[Federal Trade] Commission, with respect to the 

entities that are subject to their respective 

enforcement authority under Section 621 of the Fair 

Credit Reporting Act [15 U.S.C. 1681s] and the 

Securities and Exchange Commission * * * .’’ See 

15 U.S.C. 1681s–3 note. Section 621(a)(1) of the 

FCRA grants enforcement authority to the FTC for 

all persons subject to the FCRA ‘‘except to the 

extent that enforcement * * * is specifically 

committed to some other government agency under 

subsection (b)’’ of Section 621. 15 U.S.C. 

1681s(a)(1). The Commission is not one of the 

agencies included under subsection (b). The 

Commission was added to the list of Federal 

agencies required by Section 214(b) to adopt 

regulations implementing Section 624 of the FCRA 

in conference committee. There is no legislative 

history on this issue. 

15The term ‘‘Covered Persons’’ is used for the 

purposes of this release and is not a defined term 

in Regulation S–AM. The application of Regulation 

S–AM to investment companies, brokers, dealers 

(other than notice-registered broker-dealers), and 

registered transfer agents and investment advisers is 

consistent with Regulation S–P. Not all transfer 

agents, investment companies or investment 

advisers are required to register with the 

Commission. Section 17A(c) of the Exchange Act 

requires that transfer agents register with the 

appropriate regulatory agency, which can be the 

Commission, the Board, the OCC or the FDIC. 15 

U.S.C. 78c(a)(34) (defining ‘‘appropriate regulatory 

agency’’); 15 U.S.C.78q–1(c) (describing the 

registration requirements for transfer agents). 

Section 6(f) of the Investment Company Act (15 

U.S.C. 80a–6(f)) provides an exemption from 

registration for a closed-end investment company 

that elects to be regulated as a business 

development company pursuant to Section 54 of 

the Act (15 U.S.C. 80a–53). Sections 203 and 203A 

of the Advisers Act govern the registration of 

investment advisers with the Commission. See 15 

U.S.C. 80b–3 and 80b–3a. 

16See discussion of definitions of ‘‘broker’’ and 

‘‘dealer’’ infra Parts III.C.2 and III.C.9. Noticeregistered broker-dealers are subject to primary 

oversight by the Commodity Futures Trading 

Commission (‘‘CFTC’’) and are exempted from all 

but the core provisions of the laws administered by 

the Commission. We interpret Congress’s exclusion 

of the CFTC from the list of financial regulators 

required by Section 214(b) of the FACT Act to 

prescribe regulations implementing Section 624 of 

the FCRA to mean that Congress did not intend for 

the Commission’s rules under the FACT Act to 

apply to entities subject to primary oversight by the 

CFTC. 

17The Joint Rules and the FTC Rule provide that, 

to the extent applicable, compliance with an 

example constitutes compliance with the Joint 

Rules and the FTC Rule, respectively. See, e.g., 12 

CFR 222.2. The examples in our final rules, 

however, do not provide the same safe harbor. The 

examples in Regulation S–AM are intended to 

describe the broad outlines of situations illustrating 

compliance with the applicable rule. However, the 

specific facts and circumstances relating to a 

particular situation will determine whether 

compliance with an example constitutes 

compliance with the rules. 

18See supra note 13. 

19Proposed § 247.3(a)(1)–(2). This provision was 

designed to prevent the disparate treatment of 

out notice may apply to eligibility 

information obtained in connection 

with one or more continuing 

relationships the consumer establishes 

with an entity or its affiliates, as long as 

the notice adequately describes the 

relationships covered by the notice. 

Sixth, the final rules include a new 

section describing the conditions under 

which a service provider for both an 

entity that has a pre-existing business 

relationship with a consumer and the 

entity’s affiliate would be acting for the 

entity rather than its affiliate whose 

products or services are being marketed. 

Finally, the definition of ‘‘affiliate,’’ 

‘‘control,’’ ‘‘marketing solicitation,’’ and 

‘‘pre-existing business relationship’’ 

have been revised to reflect comments 

we received.12

III. Section-by-Section Analysis 

While the Proposing Release placed 

Regulation S–AM in 17 CFR 247.1– 

247.28, the final rules are located in 17 

CFR 248.101 through 248.128.13

A. Section 248.101 Purpose and Scope 

We received no comments on 

proposed § 247.1, which identifies the 

purposes and scope of the rules, and we 

are adopting it as proposed, 

redesignated as § 248.101. Paragraph (a) 

of § 248.101 of Regulation S–AM 

provides that the purpose of Regulation 

S–AM is to implement the affiliate 

marketing provisions of Section 624 of 

the FCRA. Paragraph (b) of § 248.101 

lists the entities to which the final rules 

apply. Although the FACT Act does not 

specifically identify the entities that are 

to be subject to the rules prescribed by 

the Commission,14 Congress’s inclusion 

of the Commission as one of the 

agencies required to adopt 

implementing regulations suggests that 

Congress intended that our rules apply 

to those entities that the Commission 

regulates, i.e., brokers, dealers, and 

investment companies, as well as to 

investment advisers and transfer agents 

that are registered with the Commission 

(respectively, ‘‘registered investment 

advisers’’ and ‘‘registered transfer 

agents,’’ and, collectively, with brokers, 

dealers, and investment companies, 

‘‘Covered Persons’’).15 These entities are 

referred to as ‘‘you’’ throughout 

Regulation S–AM. We have excluded 

from the scope of the regulation brokerdealers registered by notice with the 

Commission under Section 15(b)(11) of 

the Exchange Act for the purpose of 

conducting business in security futures 

products (‘‘notice-registered brokerdealers’’).16

B. Section 248.102 Examples 

We are adopting as proposed § 247.2, 

which clarifies the effect of the 

examples used in the rules and model 

forms, redesignated as § 248.102. Given 

the wide range of possible situations 

covered by Section 624 of the FCRA, 

Regulation S–AM includes general 

rules, provides more specific examples, 

and includes model opt out notice 

forms. The examples, which are not 

exclusive, provide guidance concerning 

the rules’ application in ordinary 

circumstances. The facts and 

circumstances of each individual 

situation, however, will determine 

whether compliance with an example, 

to the extent applicable, constitutes 

compliance with this subpart.17

Examples in a paragraph illustrate only 

the issue described in the paragraph and 

do not illustrate any other issue that 

may arise under this subpart. Similarly, 

the examples do not illustrate any issues 

that may arise under other laws or 

regulations. We received no comment 

on this section. 

C. Section 248.120 Definitions 

As noted, for consistency and ease of 

reference, Regulation S–AM generally 

follows the section numbering used in 

the Joint Rules and the FTC Rule. 

Therefore, the defined terms proposed 

under § 247.3 are now located in 

§ 248.120. In addition, the examples 

corresponding to the definition of ‘‘preexisting business relationship,’’ in 

proposed § 247.20(d)(1), are now 

included in the definition of ‘‘preexisting business relationship,’’ which 

is redesignated as § 248.120(q)(2) in the 

final rules.18

1. Affiliate 

We are revising the proposed 

definition of ‘‘affiliate’’ in response to 

issues raised by commenters. The 

proposal defined ‘‘affiliate’’ of a Covered 

Person as any person that is related by 

common ownership or common 

corporate control with the Covered 

Person. The proposed rule also provided 

that a Covered Person is considered an 

affiliate of another person for purposes 

of Regulation S–AM if: (1) The other 

person is regulated under Section 214 of 

the FACT Act by one of the Agencies; 

and (2) the rules adopted by that Agency 

treat the Covered Person as an affiliate 

of the other person.19 The proposed 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40401 

affiliates within a holding company structure that 

are regulated by different Federal regulators and to 

make this provision of Regulation S–AM consistent 

with comparable provisions of the Agencies. 20Several FCRA provisions apply to information 

sharing with persons ‘‘related by common 

ownership or affiliated by corporate control,’’ 

‘‘related by common ownership or affiliated by 

common corporate control,’’ or ‘‘affiliated by 

common ownership or common corporate control.’’ 

See, e.g., FCRA Sections 603(d)(2), 615(b)(2), and 

625(b)(2). Each of these provisions was enacted as 

part of the 1996 amendments to the FCRA. 

Similarly, Section 2(4) of the FACT Act defines the 

term ‘‘affiliate’’ to mean ‘‘persons that are related 

by common ownership or affiliated by corporate 

control.’’ In contrast, the Gramm-Leach-Bliley Act 

(‘‘GLBA’’) defines ‘‘affiliate’’ to mean ‘‘any company 

that controls, is controlled by, or is under common 

control with another company.’’ See 15 U.S.C. 

6809(6). 

21See ACB Letter; FSR Letter; IAA Letter; ICBA 

Letter; ICI Letter; T. Rowe Price Letter; Wells Fargo 

Letter. 

22See ICI Letter; T. Rowe Price Letter. 

23See FSR Letter; Mellon Letter. These 

commenters noted that the California law places no 

restriction on information sharing among affiliates 

if they: (1) Are regulated by the same or similar 

functional regulators; (2) are involved in the same 

broad line of business, such as banking, insurance, 

or securities; and (3) share a common brand 

identity. See Cal. Financial Code Section 4053(c). 

24Section 248.120(a). 

25As discussed below, ‘‘control’’ is defined in 

Regulation S–AM to include control relationships 

that go beyond those based on corporate control. 

See infra Part III.C.8. 

26This approach is also consistent with the 

Agencies’ final rules. See Joint Rules at 72 FR 

62912; FTC Rule at 72 FR 61426. 

27See § 248.120(b), which was proposed as 

§ 247.3(b). 

28See supra note 16. 

29See § 248.120(c), proposed as § 247.3(c). 

30See Proposing Release at 69 FR 42305. 

31 Id. 

definition followed the definition of 

‘‘affiliates’’ in Section 2 of the FACT 

Act, which encompasses ‘‘persons that 

are related by common ownership or 

affiliated by corporate control.’’ 20

Commenters noted with approval the 

proposed definition’s general 

consistency with the definition of 

‘‘affiliate’’ in the GLBA and Regulation 

S–P, but some suggested the definitions 

should be made more consistent.21 Two 

commenters suggested that we eliminate 

the term ‘‘corporate’’ in the Regulation 

S–AM definition.22 In addition, two 

commenters suggested that the 

Commission adopt the approach to the 

definition of affiliate taken under 

California’s Financial Information 

Privacy Act (‘‘California Privacy 

Law’’).23

After considering the comments, we 

are revising the definition of ‘‘affiliate’’ 

to eliminate the term ‘‘corporate’’ from 

the definition.24 The final definition 

harmonizes the various FCRA and 

FACT Act formulations, and the GLBA 

definition, by defining ‘‘affiliate’’ to 

mean ‘‘any person that is related by 

common ownership or common control 

with’’ another person. While Section 2 

of the FACT Act contains the term 

‘‘corporate,’’ we did not include it in the 

final rule in recognition of other types 

of control relationships that may give 

rise to affiliation under the rule.25 In 

contrast to the other regulators, we did 

not replace the term ‘‘person’’ with 

‘‘company’’ in the definition because 

certain of our Covered Persons are 

natural persons. For example, some 

brokers-dealers and some investment 

advisers registered with the Commission 

are sole proprietors. In contrast, banking 

charters are held by entities other than 

natural persons. This change to the 

definition of ‘‘affiliate’’ is intended to 

promote consistency in the 

Commission’s rules and to prevent gaps 

in the coverage of Regulation S–AM. We 

do not believe that there is a substantive 

difference between the definitions of 

‘‘affiliate’’ in the FACT Act and in 

Section 509 of the GLBA.26 We are not, 

however, incorporating elements of the 

California Privacy Law into the 

definition. To do so would be beyond 

our congressional mandate, especially 

given that Congress itself could have 

incorporated those elements when 

amending the FCRA. 

2. Broker 

We received no comments on the 

proposed definition of ‘‘broker’’ and are 

adopting it as proposed.27 The 

definition incorporates the definition of 

‘‘broker’’ in the Exchange Act and 

excludes notice-registered brokers.28

3. Clear and Conspicuous 

We are adopting the definition of 

‘‘clear and conspicuous’’ as proposed to 

mean reasonably understandable and 

designed to call attention to the nature 

and significance of the information 

presented.29 Persons may wish to 

consider a number of methods to make 

their notices clear and conspicuous, 

including those described below. 

Institutions are not required to 

implement any particular method or 

combination of methods to make their 

disclosures clear and conspicuous. 

Rather, the particular facts and 

circumstances will determine whether a 

disclosure is clear and conspicuous. 

Consistent with the Proposing Release, 

a notice or disclosure may be made 

reasonably understandable through 

various methods that include: 

• Using clear and concise sentences, 

paragraphs, and sections; 

• Using short explanatory sentences; 

• Using bullet lists; 

• Using definite, concrete, everyday 

words; 

• Using active voice; 

• Avoiding multiple negatives; 

• Avoiding legal and highly technical 

business terminology; and 

• Avoiding explanations that are 

imprecise and readily subject to 

different interpretations.30

A notice or disclosure could also use 

various design methods to call attention 

to the nature and significance of the 

information in it, including but not 

limited to: 

• Using a plain-language heading; 

• Using a typeface and type size that 

are easy to read; 

• Using wide margins and ample line 

spacing; and 

• Using boldface or italics for key 

words.31

Persons who choose to provide the 

notice or disclosure by using an Internet 

Web site may use text or visual cues to 

encourage the reader to scroll down the 

page, if necessary, to view the entire 

document. Persons may also take steps 

to ensure that other elements on the 

Web site (such as text, graphics, 

hyperlinks, or sound) do not distract 

attention from the notice or disclosure. 

If a notice or disclosure required 

under Regulation S–AM is combined 

with other information, methods for 

designing the notice or disclosure to call 

attention to the nature and significance 

of the information in it may include 

distinctive type sizes, styles, fonts, 

paragraphs, headings, graphic devices, 

and appropriate groupings of 

information. However, there is no need 

to use distinctive features, such as 

distinctive type sizes, styles, or fonts, to 

differentiate an affiliate marketing opt 

out notice from other components of a 

required disclosure. For example, the 

notice could be included in a GLBA 

privacy notice that combines several opt 

out disclosures in a single notice. 

Moreover, nothing in the clear and 

conspicuous standard requires 

segregation of the affiliate marketing opt 

out notice when it is combined with a 

GLBA privacy notice or other required 

disclosures. 

We recognize that it will not be 

feasible or appropriate to incorporate all 

of the methods described above with 

respect to every affiliate marketing 

notice. We recommend, but do not 

require, that institutions consider the 

methods described above in designing 

their notices. We also encourage the use 

of consumer or other readability testing 

to devise notices that are 

understandable to consumers. 

Five commenters addressed the 

proposed definition of ‘‘clear and 


srobinson on DSKHWCL6B1PROD with RULES3
40402 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

32See ACB Letter; Coalition Letter; IAA Letter; 

ICBA Letter; Wells Fargo Letter. 

33See IAA Letter. See also 17 CFR 248.3(c)(1) 

(defining ‘‘clear and conspicuous’’ for purposes of 

Regulation S–P). 

34See ACB Letter; ICBA Letter; Wells Fargo 

Letter. 

35See Coalition Letter. The FCRA contains 

‘‘affiliate sharing’’ notice and opt out provisions 

that are distinct from the ‘‘affiliate marketing’’ 

provisions of Regulation S–AM. Section 

603(d)(2)(A)(iii) of the FCRA provides that a person 

may communicate information that is not 

transaction or experience information among its 

affiliates without that information becoming a 

consumer report if the sharing is clearly and 

conspicuously disclosed to the consumer and the 

consumer is given an opportunity to opt out of the 

sharing. In contrast, Regulation S–AM limits the use 

of information by affiliates for marketing purposes, 

not the sharing of information among affiliates. 

36See Coalition Letter; Wells Fargo Letter. These 

commenters cited the Board’s decision to withdraw 

a similar proposal to define ‘‘clear and 

conspicuous’’ for purposes of Regulations B, E, M, 

Z, and DD, in part because of concerns over civil 

liability. 

37See ICBA Letter. One commenter urged us to 

make clear that a person does not have to use 

specific terms for opt out and that this should be 

included as part of the account opening process. 

See SIFMA Letter I. 

38See ACB Letter; see also 12 U.S.C. 4301, et seq. 39See 15 U.S.C. 1681s–3(a)(2)(B) 

(‘‘Notwithstanding subparagraph (A), the notice 

required under paragraph (1) shall be clear, 

conspicuous, and concise * * *. The regulations 

prescribed to implement this section shall provide 

specific guidance regarding how to comply with 

such standards.’’). 40The Commission is providing two types of 

specific guidance on satisfying the requirement to 

provide a clear and conspicuous affiliate marketing 

opt out notice. First, this release and § 248.121(a) 

describe certain techniques that may be used to 

make notices clear and conspicuous. Second, the 

Commission is adopting as part of Regulation S–AM 

the model forms set forth in the Appendix to 

Subpart B—Model Forms (‘‘Appendix’’) that may, 

but are not required to, be used to facilitate 

compliance with the affiliate marketing notice 

requirements. 41See 15 U.S.C. 6803(b)(4). 

42See, e.g., the definition and examples in 

Regulation S–P at 17 CFR 248.3(c). 

43See § 248.120(c), which was proposed as 

§ 247.3(c). 

44See Appendix to Regulation S–AM. 

45See ACB Letter; ICBA Letter; Wells Fargo 

Letter. 

46See § 248.120(d), which was proposed as 

§ 247.3(d). 

47See § 248.120(e), which was proposed as 

§ 247.3(e). 

48See § 248.120(f), which was proposed as 

§ 247.21(b)(3). The Appendix provides that the 

requirement for a concise notice would be satisfied 

by the appropriate use of one of the model forms 

contained in the Appendix, although use of the 

model forms is not required. See supra note 40. 

49Such disclosures include, but are not limited 

to, a GLBA privacy notice, an affiliate-sharing 

notice under Section 603(d)(2)(A)(iii) of the FCRA, 

and other consumer disclosures. 

50The proposed definition follows the statutory 

definition of Section 603(c) of the FCRA. See 15 

U.S.C. 1681a(c). 

51See ACB Letter; IAA Letter; T. Rowe Price 

Letter. 

52See IAA Letter; T. Rowe Price Letter. 

53See Proposing Release at 69 FR 42305. 

54See § 248.120(g). 

conspicuous.’’ 32 One commenter 

expressed approval of the proposed 

definition because of its similarity to the 

definition of the term found in 

Regulation S–P.33 However, other 

commenters suggested that the 

definition could give rise to an 

increased risk of litigation and civil 

liability for financial institutions.34

While these commenters recognized that 

the proposed definition was derived 

from the GLBA privacy regulations, they 

noted that compliance with the GLBA 

privacy regulations is enforced 

exclusively through administrative 

actions and not through private 

litigation. One commenter suggested the 

definition was unnecessary to ensure 

that consumers receive a clear and 

conspicuous notice as required by 

Section 624 of the FCRA, noting that 

other affiliate sharing notice and opt out 

requirements have operated in the 

FCRA for several years without a 

regulatory definition.35 Commenters 

also pointed to the Board’s withdrawal 

of a similar definition in other 

regulations as support for not including 

the definition.36 In the alternative, one 

commenter suggested that the 

Commission and the Agencies issue 

questions and answers or non-exclusive 

examples indicating that compliance 

with one of these examples would 

satisfy the rule’s requirements.37

Another commenter suggested outlining 

reasonable expectations for what would 

be considered ‘‘clear and conspicuous’’ 

and suggested including reasonable 

protections against liability and 

administrative penalties when 

unintentional errors occur.38

Because the FACT Act requires that 

we provide specific guidance on how to 

comply with the clear and conspicuous 

standard,39 we believe that it is 

important to both define ‘‘clear and 

conspicuous’’ in the final rules and 

provide specific guidance for how to 

satisfy that standard.40 The Commission 

notes that an affiliate sharing opt out 

notice required under the FCRA, which 

may be enforced through private rights 

of action, must be included in a GLBA 

privacy notice.41 Therefore, the affiliate 

sharing opt out notices generally are 

provided in a manner consistent with 

the clear and conspicuous standard set 

forth in the GLBA privacy regulations.42

We believe that Covered Persons’ 

experience in providing clear and 

conspicuous affiliate sharing notices 

should help them provide clear and 

conspicuous affiliate marketing notices 

under Regulation S–AM. 

Accordingly, we are adopting the 

definition of ‘‘clear and conspicuous’’ as 

proposed.43 We urge Covered Persons to 

consider the guidance discussed above 

regarding practices and methods for 

making notices clear and conspicuous. 

Moreover, like the Agencies, we are 

adopting model forms that may, but are 

not required to, be used to facilitate 

compliance with the affiliate marketing 

notice requirements.44 The requirement 

that a notice be clear and conspicuous 

would be satisfied by the appropriate 

use of one of the model forms. 

Accordingly, use of the model forms, 

although optional, should help alleviate 

risks from litigation related to the 

requirement that notices be clear and 

conspicuous, about which some 

commenters expressed concern.45

4. Commission 

We received no comment on the 

definition of ‘‘Commission’’ to mean the 

Securities and Exchange Commission 

and are adopting it as proposed.46

5. Company 

We received no comment on the 

definition of ‘‘company’’ and are 

adopting the term as proposed.47

6. Concise 

We received no comment on the 

definition of ‘‘concise’’ and are adopting 

it as proposed.48 Section 248.120(f)(1) 

defines the term ‘‘concise’’ to mean a 

reasonably brief expression or 

statement. Paragraph (f)(2) provides that 

a notice required by Regulation S–AM 

may be concise even if it is combined 

with other disclosures required or 

authorized by Federal or State law.49

7. Consumer 

Proposed paragraph (f) of § 247.3 

defined ‘‘consumer’’ to mean an 

individual, including an individual 

acting through a legal representative.50

Some commenters suggested that the 

definition of ‘‘consumer’’ used in 

Regulation S–AM should track the 

definition in Regulation S–P.51 Some 

also asked that the Commission include 

in the definition the examples that 

accompany the definition of 

‘‘consumer’’ in Regulation S–P.52

The Commission is aware of the 

narrower definition of ‘‘consumer’’ in 

the privacy regulations enacted under 

Title V of the GLBA.53 However, we 

believe that the use of distinct 

definitions of ‘‘consumer’’ reflects 

differences in the scope and objectives 

of the two statutes. Accordingly, we are 

adopting the definition of ‘‘consumer’’ 

as proposed.54 For purposes of this 

definition, an individual acting through 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40403 

55See § 248.120(h), which was proposed as 

§ 247.3(g). 

56See IAA Letter; T. Rowe Price Letter. 

57Section 248.120(h). This definition is 

consistent with definitions of control found 

elsewhere under the securities laws. See, e.g., 17 

CFR 240.19g2–1(b)(2); 17 CFR 248.3(i); 15 U.S.C. 

80a–2(a)(9); 15 U.S.C. 80b–2(a)(12). 

58This presumption may be rebutted by evidence, 

but in the case of an investment company, will 

continue until the Commission makes a decision to 

the contrary according to the procedures described 

in Section 2(a)(9) of the Investment Company Act. 

15 U.S.C. 80a–2(a)(9). 

59See supra Part III.C.1; Proposing Release at 69 

FR 42305. 

60 In § 222.3(i) of their Joint Proposal, the Banking 

Agencies and the NCUA defined ‘‘control’’ as 

ownership of 25 percent of a company’s voting 

securities, control over the election of a majority of 

the directors, trustees or general partners of the 

company, or the power to exercise a controlling 

influence over management or policies of a 

company, as determined by the particular agency. 

See Banking Agencies and NCUA, Fair Credit 

Reporting Affiliate Marketing Regulation; Proposed 

Rules, 69 FR 42502 (July 15, 2004) (‘‘Joint 

Proposal’’). However, as we emphasized in the 

Proposing Release, the definition of ‘‘control’’ in the 

proposed rules differed from the Agencies’ 

definition in the Joint Proposal. See Proposing 

Release at 69 FR 42305. The Joint Rules incorporate 

the definition of ‘‘control’’ to mean ‘‘common 

ownership or common corporate control’’ as in the 

Agencies’ final FCRA medical information rules. 

See Joint Rules at 72 FR 62913 (citing 70 FR 70664 

(Nov. 22, 2005)). 

61See § 248.120(i), proposed as § 247.3(h). 

62 15 U.S.C. 78c(a)(5). 

63 15 U.S.C. 78o(b). 

64 15 U.S.C. 78c(a)(30). 

65 15 U.S.C. 78c(a)(6). 

66 15 U.S.C. 78o(b), 78o–4(a)(2). 

67 15 U.S.C. 78c(a)(44). 

68 15 U.S.C. 78o(b), 78o-5(a)(2). 

69See discussion of the inapplicability of 

Regulation S–AM to notice-registered brokerdealers supra note 16 and accompanying text. 

70See § 248.120(j). See also 15 U.S.C. 

1681a(d)(2)(A)(iii). Under the FCRA, the term 

‘‘consumer report’’ is defined to include any 

communication of information from a consumer 

reporting agency bearing on a consumer’s credit 

worthiness, credit standing, credit capacity, 

character, general reputation, personal 

characteristics, or mode of living that is used or 

expected to be used or collected in whole or in part 

for the purpose of serving as a factor in establishing 

the consumer’s eligibility for credit or insurance to 

be used primarily for personal, family or household 

purposes, employment purposes, or other purposes 

authorized elsewhere in the FCRA. 15 U.S.C. 

1681a(d)(1). 

71See § 248.120(j). 

72 Id. 

73See FSR Letter; SIFMA Letter I. 

74See ICI Letter; T. Rowe Price Letter. 

75See ICI Letter. 

76See ICBA Letter. The commenter proposed to 

define eligibility information as ‘‘any information 

that bears on a consumer’s credit worthiness, credit 

standing, credit capacity, character, general 

reputation, personal characteristics or mode of 

living which is used or expected to be used or 

collected in whole or in part for the purpose of 

serving as a factor in establishing the consumer’s 

eligibility for credit or insurance to market products 

and services for personal, family or household 

purposes to that person.’’ 

77See Coalition Letter. 

a legal representative would qualify as 

a consumer. 

8. Control 

We are adopting the definition of 

‘‘control’’ as proposed.55 Two 

commenters supported the proposed 

definition, indicating it was consistent 

with the one found in Regulation S–P 

and the GLBA.56 For purposes of 

Covered Persons, ‘‘control’’ means the 

power to exercise a controlling 

influence over the management or 

policies of a company, whether through 

ownership of securities, by contract, or 

otherwise.57 Ownership of more than 25 

percent of a company’s voting securities 

would create a presumption of control 

of the company.58 As the Proposing 

Release explained, this definition would 

be used to determine when companies 

are affiliated 59 and would result in 

financial institutions being considered 

affiliates regardless of whether the 

control is exercised by a company or an 

individual.60

9. Dealer 

We received no comments on the 

definition of ‘‘dealer’’ and are adopting 

it as proposed.61 Section 248.120(i) 

defines ‘‘dealer’’ to have the same 

meaning as in Section 3(a)(5) of the 

Exchange Act,62 regardless of whether 

the dealer is registered under Section 

15(b) of the Exchange Act.63 The term 

includes a municipal securities dealer 

as defined in Section 3(a)(30) of the 

Exchange Act,64 other than a bank (as 

defined in Section 3(a)(6) of the 

Exchange Act),65 regardless of whether 

it is registered under Section 15(b) or 

15B(a)(2) of the Exchange Act.66 In 

addition, the term includes a 

government securities dealer as defined 

in Section 3(a)(44) of the Exchange 

Act,67 regardless of whether it is 

registered under Section 15(b) or 

15C(a)(2) of the Exchange Act.68 The 

definition specifically excludes noticeregistered broker-dealers.69

10. Eligibility Information 

We are adopting the proposed 

definition of ‘‘eligibility information’’ to 

mean any information, the 

communication of which would be a 

consumer report, if the statutory 

exclusions from the definition of 

‘‘consumer report’’ in Section 

603(d)(2)(A) of the FCRA, for 

transaction or experience information 

and for ‘‘other’’ information that is 

subject to the affiliate-sharing opt out, 

did not apply.70 As under the proposal, 

eligibility information would include a 

Covered Person’s own transaction or 

experience information, such as 

information about a consumer’s account 

history with that Covered Person, and 

‘‘other’’ information under Section 

603(d)(2)(A)(iii), such as information 

from consumer reports or 

applications.71

We have revised the definition of 

‘‘eligibility information’’ to clarify that 

the term does not apply to aggregate or 

blind data that does not contain 

personal identifiers.72 Examples of 

personal identifiers listed in the 

definition include account numbers, 

names or addresses, and also could 

include Social Security numbers, 

driver’s license numbers, telephone 

numbers, or other types of information 

that, depending on the circumstances or 

when used in combination, could 

identify the individual or individuals to 

whom the data relates. Other types of 

personal identifiers could include 

passwords, screen names, user names, email addresses, or Internet Protocol 

addresses. 

We recognized in the Proposing 

Release that it might be burdensome for 

Covered Persons to determine and track 

whether consumer report information is 

(1) ‘‘eligibility information’’ and thus 

subject to the notice and opt out 

provisions of Section 624 or (2) 

information that might be shared with 

affiliates under other exceptions to the 

FCRA (to which the notice and opt out 

provisions of Section 624 do not apply). 

We invited comment on whether the 

proposed definition of ‘‘eligibility 

information’’ appropriately reflected the 

scope of coverage of the FACT Act and 

provided meaningful guidance to 

Covered Persons. 

Some commenters indicated that the 

proposed definition did not provide 

enough meaningful guidance as to what 

sort of information is covered.73 Others 

suggested that the Commission should 

provide examples to illustrate the 

common types of information that 

would and would not constitute 

eligibility information.74 One 

commenter requested examples 

specifically relevant to the securities 

industry.75 Another commenter offered 

an alternative definition, stating that the 

proposed definition was unnecessarily 

complex and difficult to apply.76

Another commenter noted that, unlike 

the Agencies, the Commission did not 

provide in the Proposing Release that 

the term was designed to ‘‘facilitate 

discussion, and not change the scope of 

the information covered by Section 

624(a)(1)’’ of the FCRA.77 The 

commenter expressed concern that the 

divergence may signal some other 


srobinson on DSKHWCL6B1PROD with RULES3
40404 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

78 In adopting their final rules, the Banking 

Agencies stated that they anticipate addressing the 

definitions of ‘‘consumer report’’ and ‘‘consumer 

reporting agency’’ in a separate rulemaking after the 

required FACT Act rules have been completed. See 

Joint Rules at 72 FR 62915. 

79See § 248.120(k), which was proposed as 

§ 247.3(j). 

80See § 248.120(l), proposed as § 247.3(k). 

81See § 248.120(m), proposed as § 247.3(l). 

82See § 248.120(n), proposed as § 247.3(m). 

83See § 248.120(o), proposed as § 247.3(n). 

84See Proposing Release at 69 FR 42306. In 

particular, Regulation S–AM uses the term 

‘‘marketing solicitation’’ rather than ‘‘solicitation.’’ 

Although ‘‘solicitation’’ is a defined term in Section 

624 of the FACT Act, the operative phrase in 

Section 624(a) is ‘‘solicitation for marketing 

purposes.’’ See 15 U.S.C. 1681s–3(a). 

85 15 U.S.C. 1681s–3(d)(2). 

86See Coalition Letter; FSR Letter; ICBA Letter; 

ICI Letter; MetLife Letter; SIFMA Letter I; Wells 

Fargo Letter. 

87See FSR Letter; SIFMA Letter I. 

88 Id. One commenter indicated that the lack of 

this phrase raised the possibility that the definition 

could be misinterpreted. See FSR Letter. 

89See Coalition Letter; ICBA Letter; Wells Fargo 

Letter. 

90See Coalition Letter. 

91See Wells Fargo Letter. 

92See Coalition Letter; FSR Letter; MetLife Letter. 

93See Coalition Letter; MetLife Letter. 

94See MetLife Letter. 

95See ICI Letter. 

96For purposes of this release and the final rule, 

we interpret and use the term ‘‘products and 

services’’ to include shareholder investments in 

investment companies. 

interpretation, but did not provide an 

example of a secondary interpretation. 

The Commission believes that further 

clarification of, or exclusions from, the 

term ‘‘eligibility information’’ would 

implicate the definitions of ‘‘consumer 

report’’ and ‘‘consumer reporting 

agency’’ in Sections 603(d) and (f), 

respectively, of the FCRA. The 

Commission does not define the terms 

‘‘consumer report’’ and ‘‘consumer 

reporting agency’’ in this rulemaking or 

construe terms therein, such as 

‘‘transaction or experience’’ 

information. We note that financial 

institutions have relied on these 

statutory definitions for many years. 

Providing examples of information that 

would or would not be eligibility 

information would not necessarily 

reduce the complexity of the definition, 

and could create greater uncertainty 

with regard to information that is not 

covered by an example. The definition 

of ‘‘eligibility information’’ in 

Regulation S–AM is the same as the one 

found in the Joint Rules adopted by the 

Banking Agencies.78

11. FCRA 

We received no comment on the term 

‘‘FCRA’’ and are adopting it as proposed 

to mean the Fair Credit Reporting Act.79

12. GLBA 

The proposed rule defined ‘‘GLB Act’’ 

to mean the Gramm-Leach-Bliley Act. 

We received no comment on this 

definition but are changing the term to 

‘‘GLBA’’ to be more consistent with the 

way the Agencies refer to the GrammLeach-Bliley Act.80

13. Investment Adviser 

We received no comment on the 

definition of ‘‘investment adviser’’ and 

are adopting it as proposed.81 This 

definition incorporates the definition of 

‘‘investment adviser’’ in the Investment 

Advisers Act. 

14. Investment Company 

We received no comment on the 

definition of ‘‘investment company’’ 

and are adopting it as proposed.82 This 

definition incorporates the definition of 

‘‘investment company’’ in the 

Investment Company Act. 

15. Marketing Solicitation 

We are adopting the definition of 

‘‘marketing solicitation,’’ with 

modifications discussed below.83 The 

proposed rule defined ‘‘marketing 

solicitation’’ to mean marketing 

initiated by a Covered Person to a 

particular consumer that is based on 

eligibility information communicated to 

that Covered Person by its affiliate, and 

that is intended to encourage the 

consumer to purchase or obtain a 

product or service. The definition 

included any form of communication, 

such as a telemarketing call, direct mail, 

or electronic mail that is directed to a 

specific consumer based on that 

consumer’s eligibility information. It 

did not include communications that 

are directed at the general public 

without regard to eligibility information, 

even if those communications are 

intended to encourage consumers to 

purchase products and services. We 

noted in the Proposing Release that the 

definition tracked the definition in 

Section 624 of the FCRA but did not 

follow the statute exactly to prevent 

confusion with the term ‘‘solicitation’’ 

in the context of the Federal securities 

laws.84 Although Section 624 also 

authorizes the Commission to exclude 

other communications from the 

definition of ‘‘marketing solicitation,’’ 

we did not propose to do so, but rather, 

sought comment on whether any other 

communications should be excluded 

from the statutory definition of 

‘‘solicitation.’’ 85 We also requested 

comment on whether, and to what 

extent, various tools used in Internetbased marketing, such as pop-up ads, 

could constitute marketing solicitations 

as opposed to communications directed 

at the general public. 

Seven commenters addressed the 

definition of ‘‘marketing solicitation.’’ 86

Some expressed concern that the 

proposed definition was not the same as 

the definition in Section 214 of the 

FCRA 87 and suggested including the 

phrase ‘‘of a product or service’’ in the 

introductory language to be 

consistent.88 Other commenters favored 

the exclusion from the definition of 

marketing solicitation, solicitations 

made to the general public.89 However, 

one commenter believed that the phrase 

‘‘distributed without the use of 

eligibility information communicated by 

an affiliate’’ inadvertently misstated the 

types of general marketing that would 

not be marketing solicitations.90

Another commenter asked the 

Commission to clarify that any 

communications directed at the general 

public are not marketing solicitations 

regardless of whether they were 

developed using specific eligibility 

information.91

Several commenters also addressed 

Internet-based marketing and generally 

opposed including it in this 

rulemaking.92 Some expressed the view 

that discussion of a particular delivery 

mechanism would be counterproductive 

and contrary to congressional intent, 

noting that the Internet was not 

specifically addressed in this 

legislation.93 Another suggested that 

Internet issues should be addressed in a 

separate process to ensure that notice 

and opportunity to be heard are given to 

the parties affected.94

The commenter also opined that popup ads that appear automatically 

without the use of eligibility 

information or information from other 

affiliates are communications directed 

at the general public, and that a 

consumer visiting an Internet Web site 

is effectively making an inquiry which 

is tantamount to an affirmative request 

for information. In addition, the 

commenter asked for clarification that 

pre-recorded messages played while 

consumers are on hold when calling a 

call center should be construed as 

general marketing solicitations. Another 

commenter asked for a similar 

clarification for advertisements that 

appear on password-protected Web 

sites.95

The revised definition tracks the 

statutory language more closely by 

encompassing the marketing ‘‘of a 

product or service.’’ 96 To ensure 

consistency with the definition of ‘‘preexisting business relationship,’’ the 

definition applies to marketing intended 

to encourage the consumer to purchase 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40405 

97See supra text accompanying note 90. 

Similarly, visiting a publicly available Web site 

should not, by itself, constitute an ‘‘inquiry’’ for 

purposes of the pre-existing business relationship 

exception. 

98See Joint Rules at 72 FR 62919; FTC Rule at 72 

FR 61432. 

99See § 248.120(p), proposed as § 247.3(o). 

100See § 248.120(q)(1), proposed as § 247.3(p). 

101See Proposed § 247.3(p)(1). 

102See Proposed § 247.3(p)(2). 

103See Proposed § 247.3(p)(3). 

104See Proposing Release at 42306 (citing 15 

U.S.C. 1681s–3(d)(1)). 

105 Id. (citing 15 U.S.C. 1681s–3(d)(1)(D)). 

106See ABASA Letter; ACB Letter; ACLI Letter; 

AIA Letter; Coalition Letter; FSR Letter; ICBA 

Letter; MetLife Letter; Wells Fargo Letter; SIFMA 

Letter I. 

107See ACB Letter; ACLI Letter; Coalition Letter; 

FSR Letter; ICBA Letter; MetLife Letter; SIFMA 

Letter I. 

108See Coalition Letter. 

109See ACLI Letter; MetLife Letter. The ACLI 

Letter also noted that this type of role played by 

licensed agents would have implications for not 

only life insurers who issue variable life insurance 

and variable annuity contracts but also the brokerdealers who sell these products. 

‘‘or obtain’’ a product or service. In this 

way, the definition includes marketing 

for the rental or lease of goods or 

services, financial transactions, and 

financial contracts. The Commission is 

not adopting the reference to 

communications ‘‘distributed without 

the use of eligibility information 

communicated by an affiliate’’ in the 

exclusion for marketing directed at the 

general public because we do not 

believe it is necessary. Marketing that is 

undertaken without the use of eligibility 

information received from an affiliate is 

not covered by the affiliate marketing 

rules. Moreover, there is no restriction 

on using eligibility information received 

from an affiliate in marketing directed at 

the general public, such as radio, 

television, general circulation magazine, 

billboard advertisements, or publicly 

available Web sites that are not directed 

to particular consumers.97

The definition of ‘‘marketing 

solicitation’’ does not distinguish among 

different delivery methods or media. A 

determination of whether a marketing 

communication in any medium 

constitutes a marketing solicitation 

depends upon the facts and 

circumstances. The Commission 

declines to exclude categorically from 

the definition of ‘‘marketing 

solicitation,’’ pre-recorded messages 

played while a consumer is on hold 

with a call center, or advertisements 

that appear solely on passwordprotected Web sites. Marketing 

delivered by such media may constitute 

a marketing solicitation if it is targeted 

to a particular consumer based on 

eligibility information received from an 

affiliate. For example, a pre-recorded 

message played while a consumer is on 

hold with a call center would be a 

marketing solicitation if it is targeted to 

a particular consumer based on 

eligibility information received from an 

affiliate, but would not be a marketing 

solicitation if it is played for all 

consumers who are on hold with the 

call center. 

We note that the Agencies declined to 

exclude educational seminars, customer 

appreciation events, focus group 

invitations, and similar forms of 

communication from the definition of 

‘‘solicitation’’ in their final rules.98

While we received no comments on 

these types of activities, like the 

Agencies, we believe that such activities 

must be evaluated according to the facts 

and circumstances, and that some of 

these activities may be coupled with, or 

a prelude to, a marketing solicitation. 

For example, an invitation to a financial 

educational seminar when the invitees 

are selected based on eligibility 

information received from an affiliate 

may be a marketing solicitation if the 

seminar is used to solicit the consumer 

to purchase or obtain investment 

products or services. 

16. Person 

We received no comment on the 

definition of ‘‘person,’’ and we are 

adopting it as proposed.99 The proposed 

rule defined ‘‘person’’ to mean any 

individual, partnership, corporation, 

trust, estate, cooperative, association, 

government or governmental 

subdivision or agency, or other entity. A 

person could act through an agent, such 

as a licensed agent (in the case of an 

insurance company), a trustee (in the 

case of a trust), or any other agent. For 

purposes of Regulation S–AM, actions 

taken by an agent on behalf of a person 

that are within the scope of the agency 

relationship will be treated as actions of 

that person. 

17. Pre-Existing Business Relationship 

a. Definition 

We are adopting the definition of 

‘‘pre-existing business relationship’’ 

substantially as proposed,100 with the 

modifications discussed below. The 

proposed rule contained a three-part 

definition of ‘‘pre-existing business 

relationship.’’ Under the first part, a 

‘‘pre-existing business relationship’’ 

would exist when there is a financial 

contract in force between a Covered 

Person and a consumer.101 Under the 

second part, a ‘‘pre-existing business 

relationship’’ would exist when a 

consumer purchased, rented, or leased a 

Covered Person’s goods or services, or 

entered into a financial transaction 

(including holding an active account or 

a policy in force or having another 

continuing relationship) with a Covered 

Person during the 18-month period 

immediately preceding the date on 

which a marketing solicitation is 

made.102 Under the third part, a ‘‘preexisting business relationship’’ would 

exist when, in certain circumstances, a 

consumer inquired about, or applied for, 

a product or service offered by a 

Covered Person during the three-month 

period immediately preceding the date 

on which a marketing solicitation is 

made to the consumer.103 In the 

Proposing Release, we noted that the 

proposed definition tracked the 

definition in Section 624 of the FCRA 

but did not follow the statute exactly.104

We also noted that while Section 624 

authorizes the Commission to recognize 

any other circumstances that would 

constitute a pre-existing business 

relationship, we did not propose to 

exercise this authority.105

Ten commenters addressed the 

definition of ‘‘pre-existing business 

relationship.’’ 106 Several commenters 

noted that the statutory reference to ‘‘a 

person’s licensed agent’’ was not in the 

rule.107 One commenter expressed the 

view that Congress intended the phrase 

to be included in any implementing rule 

because it is in the statute.108 Two 

commenters noted the importance of 

licensed agents in the insurance 

industry, and stated that independent, 

licensed agents frequently act as the 

main point of contact between a 

consumer and an insurance 

company.109 In light of these comments 

and to more closely track the statute, we 

have added the phrase ‘‘or a person’s 

licensed agent’’ in the final definition of 

‘‘pre-existing business relationship.’’ 

For example, a person who is both a 

licensed agent for an insurance 

company and a registered representative 

for a broker-dealer may sell to a 

consumer a variable annuity issued by 

the insurance company. The licensed 

agent may use eligibility information 

that it obtains in connection with selling 

the variable annuity to the consumer to 

market the insurance company’s life 

insurance policies to the consumer for 

the duration of the pre-existing business 

relationship without offering an opt out 

opportunity. 

Some commenters questioned the 

requirement in the first part of the 

definition that a financial contract be in 

force ‘‘on the date on which the 

consumer is sent a marketing 


srobinson on DSKHWCL6B1PROD with RULES3
40406 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

110See ACLI Letter; SIFMA Letter I; Wells Fargo 

Letter. 111See 15 U.S.C. 1681s(d)(1)(A)–(C). As noted 

earlier, the definition of ‘‘pre-existing business 

relationship’’ in Regulation S–AM tracks the 

statutory definition. Although the statutory 

definition does not contain the term ‘‘sent’’ for the 

provision dealing with a contract that is in force (15 

U.S.C.1681s(d)(1)(A)), the other two parts of the 

statutory definition do contain the term ‘‘sent’’ (15 

U.S.C. 1681s(d)(1)(B)–(C)). Accordingly, we believe 

that the statutory definition is best implemented by 

including this concept in all three parts of the 

definition in Regulation S–AM. 

112See Coalition Letter; Wells Fargo Letter. 

113See Wells Fargo Letter. 

114See 15 U.S.C. 1681a(r)(4). 

115See 15 U.S.C. 1693(a)(2). 

116See Coalition Letter. 

117See Wells Fargo Letter. 

118See §§ 248.120(q)(2) and 248.120(q)(3). 

119See Coalition Letter; Wells Fargo Letter. 

120See Wells Fargo Letter. 

121See 16 CFR 310.2(n). 

122 47 U.S.C. 227, et seq. 

123H.R. Rep. No. 102–317, at 14–15 (1991). See 

also FTC, Telemarketing Sales Rule, 68 FR 4580, 

4591–94 (Jan. 29, 2003) (‘‘TSR Adopting Release’’). 

124 149 Cong. Rec. S13,980 (daily ed. Nov. 5, 

2003) (statement of Senator Feinstein) (noting that 

the ‘‘pre-existing business relationship’’ definition 

‘‘is the same definition developed by the Federal 

Trade Commission in creating a national ‘Do Not 

Call’ registry for telemarketers.’’). 

125See TSR Adopting Release at 68 FR 4594. 

126Similarly, the Commission does not believe 

that a return address on an envelope is sufficient 

to constitute an affirmative request by a consumer 

for information about a person’s products or 

services. A consumer would not have a reasonable 

expectation of being contacted about products and 

services simply by providing a return address on an 

envelope. In our view, a consumer provides a return 

address on an envelope to ensure that if a piece of 

mail is undeliverable, it is returned to the consumer 

and not because they are seeking to establish a 

business relationship. Accordingly, we consider a 

return address on an envelope analogous to an 

automatically captured telephone number. 

127See §§ 248.120(q)(2)(v)–(vii) and (q)(3). 

128See ABASA Letter (stating that the proposed 

rule supports the conclusion that a pre-existing 

business relationship exists between a securities 

affiliate and a consumer when the consumer 

purchases a proprietary securities product like a 

bank’s own mutual fund and expressing concern 

that the purchase of non-proprietary securities 

products from the securities affiliate could be 

solicitation.’’ 110 In their view, delays 

between the time when information is 

processed and prepared for a marketing 

solicitation and the time a marketing 

solicitation is made or sent would create 

an undue burden of having to 

synchronize the sending of the 

marketing solicitation with a contract 

that is in force. They recommended that 

a contract should only have to be in 

force when the information is prepared 

for a marketing solicitation and not 

when the marketing solicitation is 

made. We do not agree with these 

comments and are adopting the second 

part of the definition as proposed. This 

approach is consistent with the 

approach used in the other two parts of 

the statutory definition.111 We also note 

that the second part of the definition 

alleviates these synchronization 

problems since a pre-existing business 

relationship would continue to exist for 

another 18 months after a financial 

contract ceases to be in force. 

Some commenters addressed various 

parts of the second part of the 

definition.112 One commenter suggested 

that ‘‘any account with outstanding 

contractual responsibilities on either 

side of an account relationship should 

be considered an active account, 

regardless of whether the individual 

transactions occur or do not occur under 

the account.’’ 113 We decline to interpret 

an ‘‘active account’’ in this way. Section 

603(r) of the FCRA defines an ‘‘account’’ 

to have the same meaning as in Section 

903 of the Electronic Fund Transfer Act 

(‘‘EFTA’’).114 Section 903 of the EFTA 

defines the term ‘‘account’’ to mean a 

demand deposit, savings deposit, or 

other asset account established 

primarily for personal, family, or 

household purposes.115 In addition, our 

view regarding the term ‘‘account’’ is 

analogous to the views expressed by the 

Agencies. 

One commenter stated that when 

consumers pay in advance for future 

services, the 18-month exemption under 

the second part of the definition should 

not begin until after the last payment or 

shipment of the product.116 Another 

commenter suggested that the 18-month 

period should begin at the time that all 

contractual responsibilities expire.117

The Commission declines to adopt these 

suggestions because they could lead to 

consumers receiving marketing 

solicitations long after closing or 

transferring an account. For purposes of 

the final rule, a pre-existing business 

relationship terminates when an 

investor redeems or sells investment 

company shares or closes or transfers an 

account, and not when the investor 

receives the last statement relating to 

the account or when an obligation 

assumed by a Covered Person in an 

account opening document expires. The 

final rule includes examples to help 

clarify the scope of this part of the 

definition of a pre-existing business 

relationship.118

Two commenters discussed the third 

part of the definition of ‘‘pre-existing 

business relationship’’—an inquiry or 

application by the consumer regarding a 

product or service offered by the person 

during the preceding three months.119

These commenters generally stated that 

the exception should not depend on 

consumers providing contact 

information or on a consumer’s 

expectations. One commenter indicated 

that an e-mail inquiry, a return address 

on an envelope, or the captured phone 

number of a consumer requesting 

information about products or services 

should qualify as a ‘‘pre-existing 

business relationship.’’ 120

Certain elements of the definition of 

‘‘pre-existing business relationship’’ are 

substantially similar to the definition of 

‘‘established business relationship’’ 

under the FTC’s Telemarketing Sales 

Rule (‘‘TSR’’).121 The TSR definition 

was informed by Congress’s intent that 

the ‘‘established business relationship’’ 

exemption to the ‘‘do not call’’ 

provisions of the Telephone Consumer 

Protection Act 122 should be grounded 

on the reasonable expectations of the 

consumer.123 Congress’s incorporation 

of similar language in the definition of 

‘‘pre-existing business relationship’’ 124

suggests that it is appropriate to 

consider the reasonable expectations of 

the consumer in determining the scope 

of this exception. For purposes of 

Regulation S–AM, an inquiry would 

include any affirmative request by a 

consumer for information after which 

the consumer would reasonably expect 

to receive information from the affiliate 

about its products or services.125 A 

consumer would not reasonably expect 

to receive information from an affiliate 

if the consumer did not request 

information from or provide contact 

information to the affiliate. For this 

reason, the Commission does not 

believe that an automatically captured 

telephone number of a consumer is 

sufficient to create an inquiry, 

particularly when the financial 

institution could easily ask the 

consumer for contact information 

during the telephone call that captured 

the consumer’s telephone number. 

Similarly, we do not believe that 

information such as an Internet Protocol 

address or data contained in an Internet 

‘‘cookie’’ that is automatically collected 

about a consumer visiting a Covered 

Person’s Web site is, by itself, sufficient 

to create an inquiry. We understand that 

industry practice in the case of 

telephone calls is to ask the consumer 

to provide or confirm his or her contact 

information.126 To provide additional 

guidance to industry, we have provided 

additional examples in the definition 

that deal with consumer calls and emails.127 These examples, along with 

other examples, are discussed below. 

One commenter urged the Commission 

to clarify that all three parts of the 

definition of ‘‘pre-existing business 

relationship’’ include a transactionbased relationship between a consumer 

and a securities affiliate regardless of 

the issuer of the security purchased by 

the consumer.128 This commenter 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40407 

considered to be outside of the first two provisions 

of the definition of a pre-existing business 

relationship). 

129See Wells Fargo Letter. 

130See FSR Letter. The commenter further 

indicated that vehicle financing may be arranged 

through a manufacturer’s captive finance company 

or independent sources of financing, and noted that 

manufacturers often provide consumers with 

information about warranty coverage, recall notices, 

and other product information. This commenter 

stated that manufacturers also send solicitations to 

consumers about their products and services, 

drawing in part on transaction or experience 

information from the captive finance company. 

131See Proposed §§ 247.20(d)(1)(i) (illustrating 

the first part), (d)(1)(ii) (illustrating the second part) 

and (d)(1)(iii) (illustrating the third part). 

132The example in proposed § 247.20(d)(1)(iii) 

illustrated that a pre-existing business relationship 

would exist with a Covered Person’s affiliate when 

a consumer made an inquiry about, or applied for, 

a product or service offered by the affiliate during 

the three-month period immediately preceding the 

date on which a marketing solicitation is made to 

the consumer based on eligibility information 

received from the Covered Person. The Coalition 

Letter stated that a consumer should not be required 

to provide contact information as part of an inquiry 

in order to establish a pre-existing business 

relationship. As stated above, however, we do not 

believe that a consumer would reasonably expect to 

have established a pre-existing business 

relationship in the absence of providing contact 

information. See also supra text accompanying 

notes 125 and 126. 

133See MetLife Letter. 

134Section 248.120(q)(2)(i) provides an example 

of a pre-existing business relationship based on a 

consumer’s open account with a brokerage firm. 

Section 248.120(q)(2)(ii) provides a similar example 

of a pre-existing business relationship with a 

registered investment adviser. Section 

248.120(q)(2)(iii) provides an example in which a 

pre-existing business relationship is established for 

18 months after the date a consumer who was the 

record owner of investment company securities 

redeems all of those securities. Section 

248.120(q)(2)(iv) provides an example in which a 

consumer applies for a product or service, but does 

not obtain the product or service for which she 

applied, and a pre-existing business relationship is 

established for three months after the date of the 

application. Contact information is not mentioned 

in this example because the consumer presumably 

would have supplied it on the application. Section 

248.120(q)(2)(v) provides an example in which a 

consumer makes a telephone inquiry about a 

product or service offered by a brokerage firm and 

provides contact information to the institution, but 

does not obtain a product or service from or enter 

into a financial transaction with the institution. As 

noted earlier, we do not believe that, by itself, an 

institution’s capture of a consumer’s telephone 

number during a telephone conversation with the 

consumer about the institution’s products or 

services is sufficient to create an inquiry. In these 

circumstances, to ensure that an inquiry has been 

made, the institution should ask the consumer to 

provide his or her contact information. Section 

248.120(q)(2)(vi) provides an example in which preexisting business relationships are established for 

three months after the date a consumer makes an 

e-mail inquiry to a broker-dealer about one of its 

affiliated investment company’s products or 

services without providing any contact information 

other than the consumer’s e-mail address. Unlike 

telephone communications, e-mail communications 

do not provide institutions with an opportunity to 

ask for additional contact information at the time 

of a consumer’s initial request for information. 

Section 248.120(q)(2)(vii) provides an example in 

which a pre-existing business relationship between 

a consumer and a broker-dealer is established for 

three months by a consumer’s telephone call to a 

centralized call center for the broker-dealer and an 

affiliated investment company with which the 

consumer has an existing relationship, and the 

consumer provides contact information to the call 

center and inquires about products and services 

offered by the broker-dealer, but does not obtain 

any products or services. 

135Section 248.120(q)(3)(i) is similar to 

§ 248.120(q)(2)(vii) except that the consumer does 

not inquire about an affiliate’s products or services 

but about an existing account with the brokerdealer. In this situation, a pre-existing business 

relationship with an affiliate of the broker-dealer is 

not established. Section 248.120(q)(3)(ii) is 

substantively similar to the example in proposed 

§ 247.20(d)(2)(iii), whereby a pre-existing business 

relationship is not created by simply requesting 

information about retail hours and locations. 

Section 248.120(q)(3)(iii) illustrates that a call in 

response to an advertisement for a free promotional 

item is not an inquiry about a product or service 

that would establish a pre-existing business 

relationship. 

136See § 248.120(r), proposed as § 247.3(q). 

137 15 U.S.C. 78c(a)(25). 

138See § 248.120(s), proposed as § 247.3(r). 

139See supra note 16. 

140 In the proposed rules, we differentiated 

between affiliates by referring to an affiliate that 

communicated eligibility information to an affiliate 

Continued 

asserted that a consumer whose 

securities and investment transactions 

are managed through a bank-owned 

securities affiliate would not be 

surprised, and may later expect, to 

receive marketing solicitations for other 

securities products based on eligibility 

information the securities affiliate has 

received from the affiliated bank. 

Another commenter urged the 

Commission to expand the definition to 

include relationships arising out of the 

ownership of servicing rights, a 

participation interest in lending or other 

similar relationships.129 Another 

commenter suggested that the definition 

should apply to manufacturers that 

make sales through dealers, such as an 

automobile manufacturer that sells 

vehicles not directly to consumers, but 

through franchised dealers.130 The 

commenter urged the Commission to 

consider the relationship between a 

manufacturer and a consumer as a preexisting business relationship based on 

the purchase, rental, or lease of the 

manufacturer’s goods. 

Like the Agencies, the Commission 

believes it is not necessary to add any 

additional bases for a pre-existing 

business relationship. Paragraph (q)(2)(i) 

of § 248.120 provides an example of a 

brokerage firm with a pre-existing 

business relationship using eligibility 

information from an affiliate to make 

marketing solicitations about products 

or services. This example should 

provide Covered Persons with sufficient 

guidance regarding a securities 

affiliate’s use of eligibility information. 

b. Examples 

Paragraph (d)(1) of proposed § 247.20 

provided four examples to illustrate the 

pre-existing business relationship 

exception. Proposed paragraphs (d)(1)(i) 

through (iii) contained examples 

illustrating each of the three parts of the 

definition.131 Proposed paragraph 

(d)(1)(iv) provided an example of a 

consumer calling a centralized call 

center for a group of affiliated 

companies to inquire about the 

consumer’s existing securities account 

with a broker-dealer, and indicated that 

such a call would not establish a preexisting business relationship between 

the consumer and the broker-dealer’s 

affiliates. We requested comment on 

these examples. 

One commenter generally expressed 

approval of the examples we provided, 

other than the example in proposed 

§ 247.20(d)(1)(iii).132 Another 

commenter requested that the 

Commission provide further examples 

dealing with consumer calls to call 

centers to clarify what would and would 

not be considered subject to Regulation 

S–AM’s opt out notice requirement.133

We are adopting seven examples of a 

pre-existing business relationship set 

out in § 248.120(q)(2).134 In 

§ 248.120(q)(3) we have provided three 

examples of the absence of a preexisting relationship.135

18. Transfer Agent 

We received no comment on the 

definition of ‘‘transfer agent’’ and are 

adopting it as proposed.136 The rule 

defines ‘‘transfer agent’’ to have the 

same meaning as in Section 3(a)(25) of 

the Exchange Act.137

19. You 

We received no comment on the 

definition of ‘‘you’’ and are adopting it 

substantially as proposed.138 The one 

difference is that the final definition 

does not include notice-registered 

broker-dealers.139

D. Section 248.121 Affiliate Marketing 

Opt Out and Exceptions 

Proposed § 247.20 set forth the 

requirement that a consumer be 

provided with notice and a reasonable 

opportunity to opt out before a receiving 

affiliate uses eligibility information to 

make marketing solicitations to the 

consumer. Proposed paragraphs (a) and 

(b) bifurcated duties between the 

‘‘communicating affiliate’’ and 

‘‘receiving affiliate’’ to resolve what we 

perceived as an ambiguity in the FCRA 

with regard to which affiliate was to 

provide the opt out notice to the 

consumer.140 Proposed paragraph (c) 


srobinson on DSKHWCL6B1PROD with RULES3
40408 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

as the ‘‘communicating affiliate’’ and to the affiliate 

receiving the eligibility information as the 

‘‘receiving affiliate.’’ 

141This section, redesignated as § 248.128(c), is 

discussed below. See infra Part III.K.2. 

142Proposed paragraph (a)(1) would not have 

applied if no eligibility information was 

communicated to affiliates, or if no receiving 

affiliate would use eligibility information to make 

marketing solicitations. In the proposal, we 

provided an example in which paragraph (a) was 

inapplicable. In the example, a financing company 

affiliated with a broker-dealer asked the brokerdealer to include financing-company marketing 

materials in periodic statements sent to consumers 

by the broker-dealer without regard to eligibility 

information. 

143The first rule of construction would have 

permitted the notice to be provided either in the 

name of a person with which the consumer 

currently did or previously had done business, or 

by using one or more common corporate names 

shared by members of an affiliated group of 

companies that included the common corporate 

name used by that person. This rule of construction 

also would have provided three alternatives 

regarding the manner in which the notice could 

have been given. First, a communicating affiliate 

could have provided the notice to the consumer 

directly. Second, a communicating affiliate could 

have used an agent to provide the notice, so long 

as the agent provided the notice in the name of the 

communicating affiliate or by using a common 

corporate name. When using an agent however, the 

communicating affiliate would have remained 

responsible for any failure of the agent to fulfill the 

affiliate’s notice obligations. Third, a 

communicating affiliate could have provided a joint 

notice with one or more of its affiliates. Of course, 

if the agent was an affiliate of the person that 

provides the notice, that affiliate could not have 

included any marketing solicitations of its own on 

or with the notice, unless one of the exceptions in 

paragraph (c) of proposed § 247.20 applied. Even if 

the agent sending the notice were not an affiliate, 

the agent would have been permitted to use the 

information only for limited purposes under 

Regulation S–P. See 17 CFR 248.11. The second 

rule of construction would have discussed how to 

avoid issuing duplicate notices when Affiliate A 

communicated information to Affiliate B, who in 

turn communicated information to Affiliate C. 

144The proposal also contemplated that the opt 

out notice would be provided to the consumer in 

writing or, if the consumer agreed, electronically. 

See Proposing Release at 69 FR 42308. 

145See ACLI Letter; ICBA Letter; ICI Letter; T. 

Rowe Price Letter; Wells Fargo Letter. 

146See ICI Letter; T. Rowe Price Letter. 

147See ACLI Letter; ICBA Letter; Wells Fargo 

Letter. 

148See ACLI Letter. One commenter also 

suggested allowing companies to decide the best 

method of providing the notice. See ICBA Letter. 

149See Wells Fargo Letter. 

150See Coalition Letter; IAA Letter; ICBA Letter; 

ICI Letter; T. Rowe Price Letter; Wells Fargo Letter. 

151See ICI Letter. 

152See ICI Letter. One commenter suggested that 

the regulation permit the notice to be given by an 

affiliate while the consumer is being called with a 

marketing solicitation. See Wells Fargo Letter. 

Another commenter suggested that delivery of the 

notice would be better effectuated if the affiliate 

representative and consumer engaged in a dialogue. 

See IAA Letter. 

153See ICBA Letter. 

154See Coalition Letter. 

155See IAA Letter. 

contained exceptions to the 

requirements of Regulation S–AM and 

incorporated each of the statutory 

exceptions to the affiliate marketing 

notice and opt out requirements that are 

set forth in Section 624(a)(4) of the 

FCRA, and paragraph (d) illustrated 

those exceptions with examples. 

Proposed paragraph (e) provided that 

Regulation S–AM would not be 

applicable to marketing solicitations 

that were based on information received 

by an affiliate prior to the proposed 

mandatory compliance date.141

Proposed paragraph (f) clarified the 

relationship between sharing 

information and becoming a credit 

reporting agency. The final rules modify 

many of these proposed provisions as 

discussed below. 

1. Section 248.121(a) 

Under proposed § 247.20(a)(1), before 

a receiving affiliate could use eligibility 

information to make or send marketing 

solicitations to a consumer, the 

communicating affiliate would have had 

to provide a notice to the consumer 

stating that the information may be 

communicated to and used by the 

receiving affiliate for marketing 

purposes. The consumer also would 

have had to have a reasonable 

opportunity to opt out through some 

simple method before the receiving 

affiliate could make a marketing 

solicitation. The notice and opt out 

requirements would have applied only 

if a receiving affiliate would use 

eligibility information for marketing 

purposes.142 Proposed paragraph (a)(2) 

included two ‘‘rules of construction’’ to 

give further guidance regarding how 

affiliate marketing notices might be 

provided to consumers.143

Proposed § 247.20(b) set forth the 

general duties of a receiving affiliate. In 

particular, a receiving affiliate could not 

have used the eligibility information it 

received from its affiliate to make 

marketing solicitations to a consumer 

unless, prior to such use the consumer 

had: (1) Been provided an opt out notice 

(as described in proposed paragraph (a) 

of § 247.20) that applied to that 

affiliate’s use of eligibility information; 

(2) received a reasonable opportunity to 

opt out of that use through one or more 

simple methods; and (3) not opted out. 

The Commission solicited comment on 

these provisions. In addition, the 

Commission also solicited comment on 

whether there were situations where 

oral notices and opt outs should be 

allowed and, if so, how the statute’s 

clear and conspicuous standard could 

be satisfied.144

Five commenters addressed the duties 

of the communicating affiliate and the 

receiving affiliate.145 Some commenters 

supported having the communicating 

affiliate provide the notice and opt out, 

indicating that consumers may be more 

likely to expect a notice from the 

communicating affiliate and could 

unknowingly miss the opportunity to 

opt out if they do not have a pre-existing 

relationship with the company that is 

sending the notice and opt out.146 Other 

commenters disagreed with the 

provision in the proposal that would 

have required the communicating 

affiliate provide the notice and opt 

out.147 One commenter viewed the 

statute’s lack of direction regarding 

which entity must provide the notice 

and opt out as evidence of 

Congressional intent to permit 

companies to structure the notice and 

opt out in a manner that meets their 

unique needs and situations.148 Another 

commenter stated that the FCRA 

contemplates that the receiving affiliate 

would provide the notice, and that to 

require the communicating affiliate to 

provide it would create a basis for civil 

liability if a communicating affiliate 

does not provide notice and an 

opportunity to opt out before a receiving 

affiliate uses eligibility information to 

make a marketing solicitation.149

Six commenters addressed oral 

notices and supported permitting their 

use.150 One commenter indicated that 

the use of oral notices would be an 

easier method by which consumers 

could exercise their rights under the 

proposed rules.151 This commenter 

indicated that this was especially so for 

consumers who primarily conduct 

business over the telephone, suggesting 

that when information is provided over 

the phone, a consumer is less likely to 

disregard a privacy notice.152 Another 

commenter generally noted the 

changing technological landscape and 

stated that limiting delivery of the 

notice to written form could create a 

barrier to improved customer service.153

Another commenter asserted that the 

FTC, in its TSR, has permitted clear and 

conspicuous oral notices without any 

enforcement difficulties.154 One 

commenter also stated that the clear and 

conspicuous standard could be more 

easily met with oral notices through the 

use of scripts or lists of frequently asked 

questions.155

After considering these comments 

regarding proposed paragraphs (a) and 

(b), the Commission is adopting these 

paragraphs, redesignated as 

§ 248.121(a), with modifications. 

Section 248.121(a)(1) sets forth the 

general rule and contains the three 

conditions that must be met before a 

Covered Person may use eligibility 

information about a consumer that it 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40409 

156The Commission continues to believe that the 

statute’s silence with regard to which affiliates may 

provide the opt out notice makes the statute 

ambiguous on this point. We agree with the 

commenters who indicated that consumers are less 

likely to disregard a notice provided by a person 

known to the consumer. We are concerned that a 

notice provided by an entity unknown to the 

consumer may not provide meaningful or effective 

notice because consumers are more likely to ignore 

or discard these notices. However, we note that 

while an agent unknown to the consumer may 

provide a notice, the notice itself would have to 

clearly indicate that it is on behalf of either the 

company the consumer has or had a pre-existing 

relationship with or be a joint notice from two or 

more members of an affiliated group of companies 

so long as one of the companies on the joint notice 

has or had a pre-existing relationship with the 

consumer. See § 248.121(a)(3). 

157See Combating Identity Theft: A Strategic Plan 

at 26–27 (April 2007) (available at http:// 

www.idtheft.gov). See also Regulation S–P: Privacy 

of Consumer Financial Information and 

Safeguarding Personal Information, Exchange Act 

Release No. 57427 (Mar. 4, 2008); 73 FR 13692 

(Mar. 13, 2008). 

158See Wells Fargo Letter. 

receives from an affiliate to make a 

marketing solicitation to the consumer. 

First, it must be clearly and 

conspicuously disclosed to the 

consumer in writing or, if the consumer 

agrees, electronically, in a concise 

notice that the Covered Person may use 

shared eligibility information to make 

marketing solicitations to the consumer. 

Second, the consumer must be provided 

a reasonable opportunity and a 

reasonable and simple method to opt 

out of the use of that eligibility 

information to make marketing 

solicitations to the consumer. Third, the 

consumer must not have opted out. 

Section 248.121(a)(2) provides an 

example of the general rule. 

The Commission has eliminated as 

unnecessary the rules of construction in 

proposed paragraph (a)(2) as well as the 

provisions in the proposal relating to 

notice provided by an agent. General 

agency principles, however, continue to 

apply. An affiliate that has a preexisting business relationship with the 

consumer may direct its agent to 

provide the opt out notice on its behalf. 

In light of one commenter’s concern 

about civil liability, the final rules do 

not impose duties on any affiliate other 

than the affiliate that intends to use 

shared eligibility information to make 

solicitations to the consumer. Although 

an opt out notice must be provided by 

or on behalf of an affiliate that has a preexisting business relationship with the 

consumer (or as part of a joint notice), 

that affiliate has no duty to provide such 

a notice. Instead, the final rules provide 

that absent such a notice, an affiliate 

must not use shared eligibility 

information to make solicitations to the 

consumer. 

Proposed paragraph (b) of § 247.20 

has been deleted and replaced with 

paragraph (a)(3) in § 248.121. Section 

248.121(a)(3) provides that the initial 

opt out notice must be provided either 

by an affiliate that has a pre-existing 

business relationship with the 

consumer, or as part of a joint notice 

from two or more members of an 

affiliated group of companies, provided 

that at least one of the affiliates on the 

joint notice has a pre-existing business 

relationship with the consumer. This 

follows the general approach taken in 

the proposal to ensure that the notice 

would be provided by an entity known 

to the consumer. While we used the 

terms ‘‘communicating affiliate’’ and 

‘‘receiving affiliate’’ in the proposal and 

continue to use these terms in this 

release, the final rule text does not 

include these terms in order to avoid 

potential confusion.156 The Commission 

has considered the comments regarding 

oral notices and opt outs and concluded 

that the opt out notice may not be 

provided orally. The Commission is 

required, under the FACT Act, to 

consider the affiliate-sharing 

notification practices employed on the 

date of enactment and to ensure that 

notices and disclosures may be 

coordinated and consolidated in 

promulgating regulations. Any affiliatesharing notice required under Section 

603(d)(2)(A)(iii) of the FCRA generally 

must be included in a GLBA privacy 

notice, which must be provided in 

writing, or if the consumer agrees, 

electronically. We find it consistent 

with existing affiliate-sharing 

notification practices to require the 

affiliate marketing opt out notice to be 

provided in writing, or if the consumer 

agrees, electronically. The Commission 

believes that this will promote 

coordination and consolidation of the 

FCRA affiliate marketing and sharing 

notice with the GLBA privacy notices. 

We are not persuaded that there are any 

circumstances in which an oral opt out 

notice would be necessary. While oral 

opt out notices are not permitted, a 

number of key exceptions to the initial 

notice and opt out requirement may be 

triggered by an oral communication 

with the customer. These include the: 

(1) Pre-existing business relationship 

exception; (2) consumer-initiated 

communication exception; and (3) 

consumer authorization or request 

exception. We understand that some 

Covered Persons currently require 

consumers to provide their Social 

Security numbers when exercising their 

existing GLBA or FCRA opt out rights. 

To combat identity theft and prevent 

‘‘phishing,’’ however, consumers have 

been advised not to provide sensitive 

personal information such as Social 

Security numbers to unknown entities. 

Furthermore, as one of the Federal 

agencies participating in the President’s 

Identity Theft Task Force, the 

Commission has made a commitment to 

examine and recommend ways to limit 

the private sector’s use of Social 

Security numbers. The approach 

recommended by some industry 

commenters would allow an entity 

unknown to the consumer to not only 

provide the affiliate marketing opt out 

notice, but also to require the consumer 

to reveal his or her Social Security 

number to that unknown entity in order 

to exercise the opt out. The Commission 

notes that requiring that a consumer 

reveal his or her Social Security number 

to an unknown entity in order to 

exercise his or her opt out right would 

send conflicting messages to consumers 

about providing Social Security 

numbers to unknown entities. This 

approach would be inconsistent with 

the Commission’s current joint efforts 

with the Agencies to develop a 

comprehensive record on the uses of the 

Social Security number in the private 

sector and evaluate their necessity, as 

recommended by the President’s 

Identity Theft Task Force.157

2. Section 248.121(b) 

a. Making Marketing Solicitations 

The proposed rules referred to 

‘‘making or sending’’ marketing 

solicitations. One commenter urged us 

not to address ‘‘sending’’ marketing 

solicitations.158 The commenter 

indicated that by making a reference to 

‘‘sending’’ marketing solicitations, it 

appears that the rule encompasses 

entities that send a marketing 

solicitation on behalf of another entity. 

The general rule in Section 624(a)(1) of 

the FCRA, along with the duration 

provisions in Section 624(a)(3) and the 

pre-existing business relationship 

exception in Section 624(a)(4)(A), refer 

to ‘‘making’’ or ‘‘to make’’ a marketing 

solicitation. Other provisions of the 

FCRA, such as the consumer choice 

provision in Section 624(a)(2)(A), the 

service provider exception in Section 

624(a)(4)(C), the non-retroactivity 

provision in Section 624(a)(5), and the 

definition of ‘‘pre-existing business 

relationship’’ in Section 624(d)(1), refer 

to ‘‘sending’’ or ‘‘to send’’ a marketing 

solicitation. The verb ‘‘to send,’’ as used 

in the statute, refers to a ministerial act 

that a service provider, such as a mail 

house, performs for the person making 


srobinson on DSKHWCL6B1PROD with RULES3
40410 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

159See 15 U.S.C. 1681s–3(a)(4)(C). 

160See 15 U.S.C. 1681s–3(d)(1)(B) and (C). 

161For example, a service provider may send a 

marketing solicitation to a consumer on behalf of 

another entity, but it is the entity on whose behalf 

the marketing solicitation is sent that is making the 

marketing solicitation and thus, is subject to the 

general prohibition on making a marketing 

solicitation without first giving the consumer an 

affiliated marketing notice and an opportunity to 

opt out. 

162The service provider’s activities would be 

those described in §§ 248.121(b)(1)(i) and (b)(1)(ii), 

discussed above. Section 248.121(b)(5), as 

discussed below, provides an exception to this 

general rule. 

163See Proposing Release at 69 FR 42307. 

164See ABASA Letter; ACB Letter; Coalition 

Letter; FSR Letter; ICBA Letter; ICI Letter; MetLife 

Letter; SIFMA Letter I; T. Rowe Price Letter; Wells 

Fargo Letter. 

165See T. Rowe Price Letter. 

166See Coalition Letter; FSR Letter; ICBA Letter; 

Wells Fargo Letter; SIFMA Letter I. 

167See Coalition Letter; ICBA Letter; SIFMA 

Letter I; Wells Fargo Letter. Although the 

Commission did not receive comment from 

consumer groups, consumer groups argued to the 

Agencies that constructive sharing would 

contravene the intent of Congress and would 

amount to a loophole that should be fixed. 

168See supra note 163 and accompanying text. 

the marketing solicitation,159 or 

indicates the time after which marketing 

solicitations are no longer permitted.160

The Commission concludes that 

‘‘making’’ and ‘‘sending’’ marketing 

solicitations are different activities and 

that the focus of the FCRA is primarily 

on the ‘‘making’’ of marketing 

solicitations.161 Accordingly, the final 

rules refer to ‘‘making’’ a marketing 

solicitation, except where the FCRA 

specifically refers to ‘‘sending’’ a 

marketing solicitation. The FCRA, 

however, does not describe what a 

person must do in order ‘‘to make’’ a 

marketing solicitation. The legislative 

history is silent on this point. 

Nevertheless, the Commission believes 

it is important to provide clear guidance 

regarding what activities constitute 

making a marketing solicitation. 

The Commission has added new 

§ 248.121(b) in the final rules to clarify 

what constitutes ‘‘making’’ a marketing 

solicitation for purposes of Regulation 

S–AM. Section 248.121(b)(1) provides 

that a Covered Person makes a 

marketing solicitation to a consumer if: 

(1) It receives eligibility information 

from an affiliate; (2) it uses that 

eligibility information to identify the 

consumer or type of consumer to receive 

a marketing solicitation, establish the 

criteria used to select the consumer to 

receive a marketing solicitation, or 

decide which of its products or services 

to market to the consumer or tailor its 

marketing solicitation to that consumer; 

and (3) as a result of its use of the 

eligibility information, the consumer is 

provided a marketing solicitation. 

The Commission understands that 

several common business practices may 

complicate application of this provision. 

Affiliated groups sometimes use a 

common database as the repository for 

eligibility information obtained by 

various affiliates, and information in 

that database may be accessible to 

multiple affiliates. In addition, affiliated 

companies sometimes use the same 

service providers to perform marketing 

activities, and some of those service 

providers may provide services for a 

number of different affiliates. Moreover, 

an affiliate may use its own eligibility 

information to market the products or 

services of another affiliate. Paragraphs 

(b)(2)–(5) of § 248.121 address these 

issues. 

Section 248.121(b)(2) clarifies that a 

Covered Person may receive eligibility 

information from an affiliate in various 

ways, including by the affiliate placing 

that information into a common 

database that a Covered Person may 

access. Of course, receipt of eligibility 

information from an affiliate is only one 

element of making a marketing 

solicitation. In the case of a common 

database, use of the eligibility 

information will be important in 

determining whether a person has made 

a marketing solicitation. 

To clarify the application of the 

concept of ‘‘making’’ a marketing 

solicitation in the context of a Covered 

Person using a service provider, 

§ 248.121(b)(3) generally provides that a 

person receives or uses an affiliate’s 

eligibility information if a service 

provider acting on behalf of the Covered 

Person receives or uses that information 

on the Covered Person’s behalf.162

Section 248.121(b)(3) also provides that 

all relevant facts and circumstances will 

determine whether a service provider is 

acting on behalf of a Covered Person 

when it receives or uses an affiliate’s 

eligibility information in connection 

with marketing the Covered Person’s 

products or services. 

b. Constructive Sharing and Service 

Providers 

In § 248.121(b)(4), we address the 

concept of ‘‘constructive sharing.’’ In 

the proposing release, we illustrated the 

constructive sharing concept with an 

example in which a consumer has a preexisting business relationship with a 

broker-dealer that is affiliated with a 

financing company. In the example, the 

financing company would provide the 

broker-dealer with specific eligibility 

criteria, such as consumers who have a 

margin loan balance in excess of 

$10,000, for the purpose of having the 

broker-dealer make marketing 

solicitations on behalf of the financing 

company to consumers that meet those 

criteria. A consumer who meets the 

eligibility criteria would contact the 

financing company after receiving the 

financing company marketing materials 

in the manner specified in those 

materials. We contemplated that the 

consumers’ responses would provide 

the financing company with discernable 

eligibility information, such as through 

a coded response form that would 

identify a consumer as an individual 

who meets the specific eligibility 

criteria.163

We solicited comment on whether, 

given the policy objectives of Section 

214 of the FACT Act, the notice and opt 

out requirements of these rules should 

apply to circumstances that involve a 

constructive sharing of eligibility 

information to make marketing 

solicitations. 

Commenters consistently opposed 

inclusion of the concept of constructive 

sharing in the final rules.164 One 

commenter argued that inclusion of the 

proposed example of constructive 

sharing would restrict the ability of 

financial institutions to market products 

to their own customers.165 Others stated 

that including the example was 

inconsistent with many of the 

exceptions provided in the proposed 

rules.166 In general, commenters argued 

that constructive sharing was outside 

the scope of Regulation S–AM because 

the rules should address the making of 

marketing solicitations and not the 

sharing of information.167

After carefully considering the 

comments, we conclude that the FCRA 

only covers situations in which a person 

uses eligibility information that it 

received from an affiliate to make a 

marketing solicitation to the consumer 

about its products or services. In a 

constructive sharing scenario like that 

described in the proposal and above,168

a pre-existing business relationship is 

established between the consumer and 

the financing company when the 

consumer contacts the financing 

company to inquire about or apply for 

products or services as a result of the 

consumer’s receipt of the financing 

company’s marketing materials from the 

broker-dealer. Thus, a pre-existing 

business relationship is established 

before the financing company uses any 

shared eligibility information to make 

marketing solicitations to the consumer. 

Because the financing company does 

not use shared eligibility information to 

make marketing solicitations to the 

consumer before it establishes a preexisting business relationship with the 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40411 

169Section 603(d)(2)(A)(iii) of the FCRA operates 

independently of FCRA’s affiliate marketing 

provisions. Thus, the existence of a pre-existing 

business relationship between a consumer and an 

affiliate that seeks to use shared eligibility 

information, such as credit scores or income, to 

market to that consumer (or the applicability of 

another exception to these affiliate marketing rules) 

does not relieve the entity sharing the eligibility 

information from the requirement to comply with 

the affiliate sharing notice and opt out provisions 

of Section 603(d)(2)(A)(iii) of the FCRA before it 

shares with its affiliate eligibility information other 

than transaction or experience information. See 15 

U.S.C. 1681a(d)(2)(A)(iii). 

170 Information sharing occurs if a reference code 

included in marketing materials reveals one 

affiliate’s information about a consumer to another 

affiliate upon receipt of a consumer’s response. 

171As an example, a broker-dealer that sells 

investment company shares to a consumer has a 

pre-existing business relationship with the 

consumer (as does the investment company if the 

consumer is the record owner of its shares). The 

broker-dealer may make a marketing solicitation for 

an investment in an affiliated investment company 

based on eligibility information the broker-dealer 

obtained in connection with its pre-existing 

business relationship with the consumer. 

172For example, a service provider may perform 

services for various affiliates relying on information 

maintained in and accessed from a common 

database. In certain circumstances, the person 

whose products or services are being marketed may 

communicate with the service provider of the 

affiliate with the pre-existing business relationship, 

yet the service provider is still acting on behalf of 

the affiliate when it uses the affiliate’s eligibility 

information in connection with marketing the 

person’s products or services. 

173This section builds upon the concept of 

control of a service provider and thus is a natural 

outgrowth of § 248.121(b)(4). Under the conditions 

set forth in § 248.121(b)(5), the service provider is 

acting on behalf of an affiliate that obtained the 

eligibility information in connection with a preexisting business relationship with the consumer 

because, among other things, the affiliate controls 

the actions of the service provider in connection 

with the service provider’s receipt and use of 

eligibility information. 

174See § 248.121(b)(5)(i)(A). 

175See § 248.121(b)(5)(i)(B). 

176See § 248.121(b)(5)(i)(C). 

consumer, the FCRA’s affiliate 

marketing notice and opt out 

requirement does not apply. 

The Commission acknowledges that 

the FCRA’s affiliate marketing 

provisions only limit the use of 

eligibility information received from an 

affiliate to make marketing solicitations 

to a consumer. Separately, the affiliate 

sharing notice and opt out provisions of 

the FCRA (Section 603(d)(2)(A)(iii)) 

regulate the sharing of eligibility 

information other than transaction or 

experience information among affiliates 

and prohibit the sharing of such 

information among affiliates, unless the 

consumer is given notice and an 

opportunity to opt out.169 The FCRA 

does not restrict the sharing of 

transaction or experience information 

(other than medical information) among 

affiliates.170

Section 248.121(b)(4) describes two 

situations in which a Covered Person 

has not made a solicitation subject to 

Regulation S–AM. Both situations 

assume that the Covered Person has not 

used eligibility information received 

from an affiliate in the manner 

described in § 248.121(b)(1)(ii). In the 

first situation, the affiliate uses its own 

eligibility information that it obtained in 

connection with a pre-existing business 

relationship that it has or had with the 

consumer to market the Covered 

Person’s products or services to the 

affiliate’s consumers.171 In the second 

situation, which builds on the first, a 

Covered Person’s affiliate directs its 

service provider to use the affiliate’s 

own eligibility information to market 

the Covered Person’s products or 

services to the affiliate’s consumer, and 

the Covered Person does not 

communicate directly with the service 

provider regarding that use of the 

eligibility information. 

The core concept is that the affiliate 

that obtained the eligibility information 

in connection with a pre-existing 

business relationship with the consumer 

controls the actions of the service 

provider using that information. 

Therefore, the service provider’s use of 

the eligibility information should not be 

attributed to the Covered Person whose 

products or services will be marketed to 

consumers. In such circumstances, the 

service provider is acting on behalf of 

the affiliate that obtained the eligibility 

information in connection with a preexisting business relationship with the 

consumer, and not on behalf of the 

Covered Person whose products or 

services will be marketed to that 

affiliate’s consumers. 

In addition, the Commission 

recognizes that there may be situations 

in which the Covered Person whose 

products or services are being marketed 

does communicate with the affiliate’s 

service provider.172 To address these 

situations, the Commission has added 

§ 248.121(b)(5) which describes the 

conditions under which a service 

provider would be deemed to be acting 

on behalf of the affiliate with the preexisting business relationship, rather 

than the Covered Person whose 

products or services are being marketed, 

notwithstanding direct communications 

between the Covered Person and the 

service provider.173

Section 248.121(b)(5) provides that a 

Covered Person does not make a 

marketing solicitation subject to 

Regulation S–AM if a service provider 

(including an affiliated or third-party 

service provider that maintains or 

accesses a common database that the 

Covered Person may access) receives 

and uses eligibility information from the 

Covered Person’s affiliate to market the 

Covered Person’s products or services to 

the affiliate’s consumer, so long as five 

conditions are met. 

First, the Covered Person’s affiliate 

must control access to and use of its 

eligibility information by the service 

provider (including the right to establish 

specific terms and conditions under 

which the service provider may use 

such information to market the Covered 

Person’s products or services). This 

requirement must be set forth in a 

written agreement between the Covered 

Person’s affiliate and the service 

provider. The Covered Person’s affiliate 

may demonstrate control by, for 

example, establishing and implementing 

reasonable policies and procedures 

applicable to the service provider’s 

access to and use of its eligibility 

information.174

Second, the Covered Person’s affiliate 

must establish specific terms and 

conditions under which the service 

provider may access and use that 

eligibility information to market the 

Covered Person’s products or services 

(or those of affiliates generally) to the 

affiliate’s consumers, and periodically 

evaluates the service provider’s 

compliance with those terms and 

conditions. These terms and conditions 

may include the identity of the affiliated 

companies whose products or services 

may be marketed to the affiliate’s 

consumers by the service provider, the 

types of products or services of affiliated 

companies that may be marketed, and 

the number of times the affiliate’s 

consumers may receive marketing 

materials. While the specific terms and 

conditions established by the Covered 

Person’s affiliate must be set forth in 

writing, they are not required to be set 

forth in a written agreement between the 

affiliate and the service provider. If a 

periodic evaluation by the Covered 

Person’s affiliate reveals that the service 

provider is not complying with those 

terms and conditions, the Commission 

expects the Covered Person’s affiliate to 

take appropriate corrective action.175

Third, the Covered Person’s affiliate 

must require the service provider to 

implement reasonable policies and 

procedures designed to ensure that the 

service provider uses the affiliate’s 

eligibility information in accordance 

with the terms and conditions 

established by the affiliate relating to 

the marketing of the Covered Person’s 

products or services. This requirement 

must be set forth in a written agreement 

between the Covered Person’s affiliate 

and the service provider.176


srobinson on DSKHWCL6B1PROD with RULES3
40412 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

177See § 248.121(b)(5)(i)(D). 

178See § 248.121(b)(5)(i)(E). 

179This provision is designed to minimize 

uncertainty that may arise from the application of 

the facts and circumstances test in § 248.121(b)(3) 

to situations that involve direct communications 

between a service provider and a Covered Person 

whose products and services will be marketed to 

consumers. 

180One commenter requested that the 

Commission delete the phrase ‘‘if you use eligibility 

information you receive from an affiliate’’ in the 

introductory words to Proposed § 247.20(c). The 

Commenter stated that this could inadvertently and 

mistakenly expose companies that share 

information with affiliates to potential liability. See 

SIFMA Letter II. That concern was addressed in the 

constructive sharing discussion above. See supra 

Part III.D.2.b. 

181Proposed § 247.20 (d)(1) provided examples of 

the pre-existing business relationship exception. As 

explained above, we have revised the examples 

from proposed § 247.20(d)(1) in the final rule and 

included them as examples of the definition of 

‘‘pre-existing business relationship’’ rather than as 

examples of exceptions from the application of the 

rule. See § 248.120(q)(2); See also discussion of 

‘‘pre-existing business relationship’’ and 

corresponding examples supra Part III.C.17. 

182See § 248.121(c)(1). 

183See supra Part III.C.17. 

184See §§ 248.120(q)(2)–(3) for examples 

illustrating situations in which a pre-existing 

business relationship exists and situations in which 

a pre-existing business relationship does not exist. 

185See FSR Letter. 

186The statutory preface to the exceptions 

provides that ‘‘[t]his section shall not apply to a 

person’’ using information to do certain enumerated 

things. See 15 U.S.C. 1681s–3(a)(4). 

187 15 U.S.C. 1681s–3(a)(4)(B). 

188There is no corresponding example for this 

provision. 

Fourth, the Covered Person’s affiliate 

must be identified on or with the 

marketing materials provided to the 

consumer. This requirement will be 

construed flexibly. For example, the 

affiliate may be identified directly on 

the marketing materials, on an 

introductory cover letter, on other 

documents included with the marketing 

materials such as a periodic statement, 

or on the envelope that contains the 

marketing materials.177

Fifth, the Covered Person must not 

directly use the affiliate’s eligibility 

information in the manner described in 

§ 248.121(b)(1)(ii).178

Under these conditions, the service 

provider is acting on behalf of an 

affiliate that obtained the eligibility 

information in connection with a preexisting business relationship with the 

consumer because, among other things, 

the affiliate controls the actions of the 

service provider in connection with the 

service provider’s receipt and use of the 

eligibility information.179 The five 

conditions together are intended to 

ensure that the service provider is acting 

on behalf of the affiliate that obtained 

the eligibility information in connection 

with a pre-existing business relationship 

with the consumer because that affiliate 

controls the service provider’s receipt 

and use of that affiliate’s eligibility 

information. 

To provide additional guidance to 

Covered Persons, § 248.121(b)(6) 

provides six illustrative examples of the 

rules relating to making marketing 

solicitations. 

3. Sections 248.121(c) and (d) 

Proposed § 247.20(c) contained 

exceptions to the requirements of 

Regulation S–AM and incorporated each 

of the statutory exceptions to the 

affiliate marketing notice and opt out 

requirements that are set forth in 

Section 624(a)(4) of the FCRA. The 

Commission has revised the preface to 

the exceptions for clarity to provide that 

Regulation S–AM does not apply to 

‘‘you’’ if a Covered Person uses 

eligibility information that it receives 

from an affiliate in certain 

circumstances. In addition, each of the 

exceptions has been moved to 

§ 248.121(c) in the final rules and is 

discussed below.180

a. Pre-Existing Business Relationship 

Exception 

Proposed paragraph (c)(1) of § 247.20 

clarified that the notice and opt out 

requirements of proposed Regulation S– 

AM would not apply when the receiving 

affiliate has a pre-existing business 

relationship with the consumer. We are 

adopting § 247.20(c)(1) substantially as 

proposed,181 deleting the word ‘‘send’’ 

for the reasons discussed above and 

eliminating, as unnecessary, the crossreference to the location of the 

definition of ‘‘pre-existing business 

relationship.’’ 182 Commenters’ views, 

and the scope of this exception, have 

been addressed above.183 However, to 

help clarify the scope of the ‘‘preexisting business relationship’’ 

exception, § 248.121(d)(1) provides an 

example to illustrate a situation in 

which the pre-existing business 

relationship exception would apply.184

b. Employee Benefit Plan Exception 

Proposed § 247.20(c)(2) provided that 

Regulation S–AM would not apply to an 

affiliate using the information to 

facilitate communications to an 

individual for whose benefit the affiliate 

provided employee benefit or other 

services under a contract with an 

employer related to and arising out of a 

current employment relationship or an 

individual’s status as a participant or 

beneficiary of an employee benefit plan. 

One commenter stated that the 

exception should be revised to permit 

communications ‘‘to an affiliate about 

an individual for whose benefit an 

entity provides employee benefit or 

other services pursuant to a contract 

with an employer related to and arising 

out of the current employment 

relationship or status of the individual 

as a participant or beneficiary of an 

employee benefit plan.’’ 185 This 

commenter also suggested deleting the 

phrase ‘‘you receive from an affiliate’’ in 

the introduction to proposed 

§ 247.20(c). In this commenter’s view, 

the proposed exception should have 

permitted an employer or plan sponsor 

to share information with its affiliates in 

order to offer other financial services, 

such as brokerage accounts or IRAs, to 

its employees. This commenter also 

requested clarification on whether the 

exception applies only if related to 

products offered as an employee benefit. 

We decline to adopt the changes 

suggested by this commenter and adopt 

the employee benefit exception, 

redesignated as § 248.121(c)(2), as 

proposed. The focus of the rule is on 

facilitating communications ‘‘to an 

individual for whose benefit the 

[Covered Person] provides employee 

benefit or other services,’’ which more 

closely tracks the statutory language 

than the alternative language proposed 

by the commenter. 

Moreover, we note that the only type 

of Covered Person to whom Section 624 

of the FCRA might apply is one that 

receives eligibility information from an 

affiliate.186 The FCRA thus makes clear 

that the exceptions in Section 624(a)(4) 

were meant to apply to persons that 

otherwise would be subject to Section 

624. In the case of the employee benefit 

exception, the person using the 

information is also ‘‘the person 

provid[ing] employee benefit or other 

services pursuant to a contract with an 

employer.’’ 187 Therefore, this 

exception, like the other provisions of 

Regulation S–AM, should apply only to 

a Covered Person that uses eligibility 

information it receives from an affiliate 

to make marketing solicitations to 

consumers about its products or 

services.188

c. Service Provider Exception 

Proposed § 247.20(c)(3) provided that 

the notice and opt out requirements of 

Regulation S–AM would not apply 

when the eligibility information is used 

to perform services for another affiliate. 

The exception would not have applied 

if the other affiliate was not permitted 

to make or send marketing solicitations 

on its own behalf, for example as a 

result of the consumer’s prior decision 

to opt out. Thus, under the proposal, 

when the notice has been provided to a 

consumer and the consumer has opted 

out, a receiving affiliate subject to the 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40413 

189Similarly, this exception would not permit a 

service provider to make marketing solicitations on 

its own behalf if eligibility information is 

communicated and the FCRA’s affiliate marketing 

notice and opt out provisions otherwise would 

apply. 

190See ICBA Letter. 

191See FSR Letter; MetLife Letter. 

192See FSR Letter. 

193See MetLife Letter. 

194As discussed above, the final rule does not 

include the word ‘‘make’’ because ‘‘making’’ and 

‘‘sending’’ solicitations are distinct activities and 

this provision of the statute uses the verb ‘‘to send.’’ 

See supra Part II.B. 

195Sections 248.121(b)(4) and 248.121(b)(5) are 

consistent with comparable provisions of the Joint 

Rules and the FTC Rule, 72 FR 62922–24 and 72 

FR 61435–37, respectively. 

196Proposed § 247.20(d)(2)(i) provided that the 

exception would apply when a consumer holding 

an account with an institution calls the institution’s 

affiliate for information about the affiliate’s 

products and services, leaving contact information 

with the affiliate. Proposed § 247.20(d)(2)(ii) 

provided that the exception would not apply when 

a consumer did not initiate a communication but 

rather called an affiliate back after the affiliate made 

an initial marketing call and left a message for a 

consumer. Proposed § 247.20(d)(2)(iii) provided 

that the exception would not apply when a 

consumer called an affiliate asking for retail 

locations without asking about the affiliate’s 

products and services. 

197See Coalition Letter; ICBA Letter; SIFMA 

Letter I; Wells Fargo Letter; USAA Letter. 

198See Coalition Letter. 

199See ICBA Letter. 

200See Wells Fargo Letter; USAA Letter. 

201See Coalition Letter. 

202See Wells Fargo Letter. 

203See SIFMA Letter I; Wells Fargo Letter; 

Coalition Letter. 

204See ICBA Letter. The commenter, however, 

did not explain why it thought the example was 

vague. 

205See 15 U.S.C. 1681s–3(a)(4)(D). The 

Commission believes this statutory language 

contemplates that the consumer-initiated 

communications will relate to a Covered Person’s 

products or services, and that the marketing 

solicitations covered by the exception will be those 

made in response to that communication. 

consumer’s opt out election could not 

circumvent the opt out by instructing 

the communicating affiliate or another 

affiliate to make or send marketing 

solicitations to the consumer on its 

behalf.189

One commenter urged the 

Commission to adopt this exception.190

Others suggested conforming it to the 

statutory provision by deleting the 

references to marketing solicitations on 

behalf of service providers.191 One of 

these commenters maintained that these 

references would impose additional 

burdens and costs on companies that 

use a single affiliate to provide various 

administrative services to other affiliates 

and would make it more difficult to 

provide general educational materials to 

consumers.192 One commenter also 

asked the Commission to clarify that the 

limitation in FCRA Section 624(a)(4)(C) 

only applies to the service provider 

exception.193

We are adopting the service provider 

exception, redesignated as 

§ 248.121(c)(3), substantially as 

proposed. We have eliminated the 

references to marketing solicitations 

made by a service provider on its own 

behalf. The general rule in 

§ 248.121(a)(1) prohibits a service 

provider from using eligibility 

information it received from an affiliate 

to make marketing solicitations to a 

consumer about its own products or 

services unless the consumer is given 

notice and an opportunity to opt out 

and has not opted out, or unless one of 

the other exceptions applies. The 

service provider exception simply 

allows a service provider to do what the 

affiliate on whose behalf it is acting may 

do, such as using shared eligibility 

information to make marketing 

solicitations to consumers to whom the 

affiliate is permitted to make such 

marketing solicitations.194 Nothing in 

the service provider and pre-existing 

business relationship exceptions will 

prevent an affiliate that has a preexisting business relationship with the 

consumer from relying upon the service 

provider exception, as long as the 

arrangement satisfies the requirements 

of the rule and applicable exceptions. 

To help clarify the scope of the service 

provider exception, § 248.121(d)(2) 

provides two examples.195

d. Consumer-Initiated Communication 

Exception 

Proposed paragraph (c)(4) of § 247.20 

provided that the notice and opt out 

requirements would not have applied 

when eligibility information was used 

in response to a communication 

initiated by the consumer. This 

exception could have been triggered by 

an oral, electronic, or written 

communication initiated by the 

consumer. To be covered by the 

proposed exception, any use of 

eligibility information would need to be 

responsive to the communication 

initiated by the consumer. Paragraph 

(d)(2) of the proposed rule provided 

three examples of situations that would 

and would not meet the exception.196

Five commenters addressed this 

exception.197 One commenter suggested 

that the Commission delete the phrase 

‘‘orally, electronically, or in writing,’’ 198

while another suggested modifying it to 

read ‘‘whether orally, electronically, or 

in writing.’’ 199 Other commenters 

objected to requiring the use of 

eligibility information to be 

‘‘responsive’’ to the communication 

initiated by the consumer.200 In their 

view, the concept of ‘‘responsiveness’’ 

would create a vague standard and 

encourage a narrow reading of the 

exception. Another commenter stated 

that the Commission did not and could 

not provide a clear definition of what 

would be ‘‘responsive’’ and opined that 

this standard would cause a Covered 

Person to be uncertain as to their 

compliance.201 One commenter asserted 

that consumers may not be familiar with 

the various types of products or services 

available to them and the different 

affiliates that offer those products or 

services and may rely on the institution 

to inform them about available 

options.202 For this reason, the 

commenter maintained that the 

exception should not limit an affiliate 

from responding with solicitations 

about any product or service. This 

commenter also stated that the Senate 

bill that preceded the FACT Act used 

more restrictive language in this 

exception than the final legislation 

passed by Congress. 

Some commenters objected to the 

example in proposed § 247.20(d)(2)(ii), 

stating that a consumer responding to a 

call-back message should qualify as a 

consumer-initiated communication and 

noting that the consumer has the option 

of not returning the call.203 One 

commenter expressed concern about the 

example in proposed paragraph 

(d)(2)(iii) regarding the consumer who 

calls to ask for retail locations and 

hours, and stated that this would create 

a vague standard that would be difficult 

to apply and subject to differing 

interpretations.204

After considering the comments, we 

are adopting paragraphs (c)(4) and (d)(2) 

of proposed § 247.20 with some 

modifications, redesignated as 

§§ 248.121(c)(4) and (d)(3), respectively. 

The final rule eliminates the reference 

to oral, electronic, or written 

communications. Any form of 

communication may come within the 

exception as long as the consumer 

initiates the communication, whether 

in-person or by mail, e-mail, telephone, 

facsimile, or through other means. 

Section 248.121(c)(4) provides that 

the communications covered by the 

exception must be consumer-initiated 

and must concern a Covered Person’s 

products or services. The FCRA requires 

a person relying on the exception to use 

eligibility information only ‘‘in response 

to’’ a communication initiated by a 

consumer.205 The Commission believes 

that the exceptions should be construed 

narrowly to avoid undermining the 

general rule requiring notice and opt 

out. Thus, consistent with the purposes 

of the FCRA, the Commission does not 

believe that a consumer-initiated 


srobinson on DSKHWCL6B1PROD with RULES3
40414 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

206Although the Commission received no specific 

comment regarding tracking call-backs, we have 

revised § 248.121(d)(3)(iii) in order to be consistent 

with the changes made by the Agencies in response 

to comments they received. 

207See Proposing Release at 69 FR 42309. 

208 Id. 

209 Id. 

210Nothing in this exception supersedes the 

restrictions on telemarketing contained in rules of 

self-regulatory organizations, the Federal 

Communications Commission, or in the TSR, 

including the operation of the ‘‘Do-Not-Call List’’ 

established by the FTC and the Federal 

Communications Commission. 

211See ACLI Letter; SIFMA Letter I; Wells Fargo 

Letter. See also 15 U.S.C. 1681s–3(a)(4)(E). 

212See Wells Fargo Letter. 

213See SIFMA Letter I. However, the commenter 

did not provide an example of how this would 

create uncertainty. 

communication unrelated to a Covered 

Person’s products or services should 

trigger the exception. A rule that 

allowed any consumer-initiated 

communication, no matter how 

unrelated to a Covered Person’s 

products or services, to trigger the 

exception would not give meaning to 

the phrase ‘‘in response to’’ and could 

produce incongruous results. For 

example, if a consumer calls a brokerdealer to ask about retail locations and 

hours, but does not request information 

about its products or services, the 

broker-dealer may not use eligibility 

information it receives from an affiliate 

to make marketing solicitations to the 

consumer because the consumerinitiated communication does not relate 

to the broker-dealer’s products or 

services. The use of eligibility 

information received from an affiliate 

would not be responsive to the 

communication, and the exception 

would not apply. 

However, the Commission recognizes 

that if a consumer-initiated conversation 

turns to a discussion of products or 

services the consumer may need, 

marketing solicitations may be 

responsive if the consumer agrees to 

receive marketing materials and 

provides or confirms contact 

information by which he or she can 

receive those materials. For example, if 

a consumer calls a broker-dealer to ask 

about retail locations and hours, the 

broker-dealer’s customer service 

representative asks the consumer if 

there is a particular product or service 

about which the consumer is seeking 

information, the consumer responds 

affirmatively and expresses an interest 

in mutual funds offered by the brokerdealer, the customer service 

representative offers to provide that 

information by telephone and mail 

additional information to the consumer, 

and the consumer agrees and provides 

or confirms contact information for 

receipt of the materials to be mailed, the 

broker-dealer may use eligibility 

information it receives from an affiliate 

to make marketing solicitations to the 

consumer about mutual funds because 

such marketing solicitations would 

respond to the consumer-initiated 

communication about mutual funds. 

Likewise, if a consumer who has 

opted out of an affiliate’s use of 

eligibility information to make 

marketing solicitations calls the affiliate 

for information about a particular 

product or service, (i.e., life insurance), 

marketing solicitations regarding that 

specific product or service could be 

made in response to that call, but 

marketing solicitations regarding other 

products or services could not. Because 

marketing solicitations will likely be 

made quickly, we do not believe it is 

appropriate to adopt a specific time 

limit for making solicitations following 

a consumer-initiated communication 

about products or services. 

We are adopting the example in 

proposed § 247.20(d)(2)(i), redesignated 

as § 248.121(d)(3)(i), and modified to 

delete the references to a telephone call 

as the specific form of communication 

and the reference to providing contact 

information. As discussed above and 

illustrated in the examples in 

§§ 248.120(q)(2)(v) and (vi), the need to 

provide contact information may vary 

depending on the form of 

communication used by the consumer. 

A new example in § 248.121(d)(3)(ii) 

illustrates a situation involving a 

consumer-initiated communication in 

which a consumer does not know 

exactly what products, services, or 

investments he or she wants, but 

initiates a communication to obtain 

information about investing for a child’s 

college education. We are adopting the 

call-back example in proposed 

§ 247.20(d)(2)(ii), redesignated as 

§ 248.121(d)(3)(iii) and modified to 

illustrate that when a Covered Person 

makes an initial marketing call without 

using eligibility information received 

from an affiliate and leaves a message 

that invites the consumer to receive 

information about the Covered Person’s 

products and services by calling a tollfree number, the consumer’s response 

qualifies as a consumer-initiated 

communication about a product or 

service. The modified example is 

intended to avoid requiring Covered 

Persons to track which calls are callbacks.206

We are adopting the retail hours 

example in proposed § 247.20(d)(2)(iii) 

substantially as proposed and 

redesignated as § 248.121(d)(3)(iv). We 

are also adopting a new example in 

§ 248.121(d)(3)(v) to address the 

situation where a consumer calls to ask 

about retail locations and hours and a 

call center representative, after eliciting 

information about the reason the 

consumer wants to visit a retail location, 

offers to provide information about 

products of interest to the consumer by 

telephone and mail, and the consumer 

agrees and provides or confirms contact 

information. This example demonstrates 

how a conversation may develop to the 

point where making marketing 

solicitations would be responsive to the 

consumer’s call. 

e. Consumer Authorization or Request 

Exception 

Proposed § 247.20(c)(5) provided that 

the notice and opt out requirements 

would not apply when the information 

is used to make marketing solicitations 

that have been affirmatively authorized 

or requested by the consumer.207 We 

contemplated that this provision could 

be triggered by an oral, electronic, or 

written authorization or request by the 

consumer but indicated that a preselected check box would not constitute 

an affirmative authorization or 

request.208 In addition, we noted that 

boilerplate language in a disclosure or 

contract would not have constituted an 

affirmative authorization.209 The 

exception in proposed paragraph (c)(5) 

could have been triggered, for example, 

if a consumer opens a securities account 

with a broker-dealer and authorizes or 

requests marketing solicitations about 

insurance from an insurance affiliate of 

the broker-dealer. Under the proposed 

exception, the consumer could have 

provided the authorization or made the 

request either through the Covered 

Person with whom he or she has a 

business relationship or directly to the 

affiliate that would make the marketing 

solicitation.210 The duration of the 

authorization or request would have 

depended on the facts and 

circumstances. Proposed § 247.20(d)(3) 

provided an example of the affirmative 

authorization or request exception. 

Some commenters noted that the 

proposed exception would have 

required an ‘‘affirmative’’ authorization 

or request but that the FCRA did not.211

One commenter indicated that the 

proposal did not indicate how the 

authorization would be affirmative.212

Another commenter indicated that 

inclusion of the term ‘‘affirmative’’ in 

the exception would have introduced 

uncertainty as to what would constitute 

an authorization or request by the 

consumer, and stated that the term 

should be deleted.213 Other commenters 

asserted that a pre-selected check box 

should be sufficient to evidence a 

consumer’s authorization or request for 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40415 

214See ICBA Letter; USAA Letter; Wells Fargo 

Letter. 

215See USAA Letter; Wells Fargo Letter. 

216See Coalition Letter. This commenter cited 

case law and FTC informal staff opinion letters 

relating to a consumer’s written instructions to 

obtain a consumer report pursuant to Section 

604(a)(2) of the FCRA as support for allowing 

boilerplate language to constitute authorization or 

request. 

217See Wells Fargo Letter. 

218See 15 U.S.C. 6802 (e)(1)(A); 17 CFR 

248.14(a)(1). 

219See Proposing Release at 69 FR 42310. 

220See FCRA Section 624(a)(4). 

221 In general, Section 603(d)(2)(A) of the FCRA 

governs the sharing of creditworthiness and similar 

information among affiliates. As discussed in note 

5 above, the FCRA sets standards for the collection, 

communication, and use of information bearing on 

a consumer’s creditworthiness, credit standing, 

credit capacity, character, general reputation, 

personal characteristics, or mode of living. The 

FCRA provides that a person who communicates 

these forms of information to others could become 

a ‘‘consumer reporting agency,’’ which is subject to 

substantial statutory obligations. However, a person 

may communicate information about its own 

‘‘transactions or experiences’’ with a consumer 

without becoming a consumer reporting agency. 

This transaction and experience information may be 

communicated among affiliated persons without 

any of them becoming a consumer reporting agency. 

See FCRA Sections 603(d)(2)(A)(i) and (ii); 15 

U.S.C. 1681a(d)(2)(A)(i) and (ii). 

The FCRA provides that a person may 

communicate to its affiliates information other than 

transaction and experience information without 

becoming a consumer reporting agency if the person 

first gives the consumer a clear and conspicuous 

notice that such information may be communicated 

to its affiliates and an opportunity to ‘‘opt out,’’ or 

block the person from sharing the information. See 

FCRA Section 603(d)(2)(A)(iii); 15 U.S.C. 

1681a(d)(2)(A)(iii). There is some overlap between 

this ‘‘affiliate sharing’’ provision of the FCRA and 

the ‘‘affiliate marketing’’ rules that we are adopting. 

The two provisions are distinct, however, and they 

serve different purposes. Nothing in these rules 

regarding the limitations on affiliate marketing 

under Section 624 of the FCRA supersedes or 

replaces the affiliate sharing notice and opt out 

requirement contained in Section 603(d)(2)(A)(iii) 

of the FCRA. 

222See Coalition Letter. 

223 Id. 

marketing solicitations.214 In their view, 

a consumer’s decision not to deselect a 

pre-selected check box should 

constitute a knowing act of the 

consumer to authorize or request 

marketing solicitations if the boxes are 

properly used.215 Other commenters 

stated that preprinted language in a 

disclosure or contract should be 

sufficient to evidence a consumer’s 

authorization or request for marketing 

solicitations.216 Another commenter 

requested that the Commission clarify 

that a consumer’s authorization or 

request does not have to refer to a 

specific product or service or to a 

specific provider of products or services 

in order for the exception to apply.217

We are adopting § 247.20(c)(5), 

redesignated as § 248.121(c)(5), 

substantially as proposed but without 

the word ‘‘affirmative.’’ This change 

does not affect the meaning of the 

exception and the consumer still must 

take steps to ‘‘authorize’’ or ‘‘request’’ 

marketing solicitations. The GLBA and 

the implementing privacy rules include 

an exception to permit the disclosure of 

nonpublic personal information ‘‘with 

the consent or at the direction of the 

consumer.’’ 218 Section 624 of the FCRA 

creates an exception to permit the use 

of shared eligibility information ‘‘in 

response to solicitations authorized or 

requested by the consumer.’’ The 

Commission interprets the ‘‘authorized 

or requested’’ provision in the FCRA 

exception to require the consumer to 

take affirmative steps in order to trigger 

the exception despite deletion of the 

term from the rule. The Commission 

construes this exception, like the other 

exceptions, narrowly and in a manner 

that does not undermine Regulation S– 

AM’s general notice and opt out 

requirement. In this regard, affiliated 

companies cannot avoid use of the 

FCRA’s notice and opt out requirement 

by including preprinted boilerplate 

language in the disclosures or contracts 

they provide to consumers, such as a 

sentence (or a pre-selected box next to 

a sentence) stating that by applying to 

open an account, the consumer 

authorizes or requests to receive 

marketing solicitations from affiliates. 

Such an interpretation would permit the 

exception to swallow the rule, a result 

that cannot be squared with the intent 

of Congress to give consumers notice 

and an opportunity to opt out of 

marketing solicitations. We are adopting 

the consumer authorization or request 

example in proposed § 247.20(d)(3), 

redesignated as § 248.121(d)(4)(i), with 

conforming changes in light of the 

changes made to § 248.121(c)(5). In 

addition, to provide more guidance, we 

are adopting three additional examples. 

The example in § 248.121(d)(4)(ii) 

illustrates how a consumer can 

authorize or request solicitations by 

checking a blank check box. The 

examples in §§ 248.121(d)(4)(iii) and 

(iv) illustrate that preprinted boilerplate 

language and a pre-selected check box 

would not meet the authorization or 

request requirement. The Commission 

does not believe it is appropriate to set 

a fixed time period for an authorization 

or request. As noted in the proposal, the 

duration of the authorization or request 

depends on what is reasonable under 

the facts and circumstances.219 Of 

course, an authorization to make 

marketing solicitations to the consumer 

terminates if the consumer revokes the 

authorization. 

For the reasons discussed in 

connection with the consumer-initiated 

communication exception, we omitted 

the reference to oral, electronic, or 

written communications from this 

exception. We do not believe it is 

necessary to clarify the elements of an 

authorization or request. Section 

624(a)(4)(E) of the FACT Act clearly 

refers to ‘‘solicitations authorized or 

requested by the consumer.’’ The facts 

and circumstances will determine what 

marketing solicitations have been 

authorized or requested by the 

consumer. 

f. Compliance With Applicable Laws 

Exception 

Proposed § 247.20(c)(6) clarified that 

the provisions of Regulation S–AM 

would not apply to an affiliate if 

compliance with the requirements of 

Section 624 by the affiliate would 

prevent that affiliate from complying 

with any provision of State insurance 

law pertaining to unfair discrimination 

in a State where the affiliate is lawfully 

doing business.220 The Commission 

received no comments on this provision 

and is adopting it as proposed, 

redesignated as § 248.121(c)(6). There is 

no corresponding example for this 

exception. 

4. Relation to Affiliate-Sharing Notice 

and Opt Out 

Proposed paragraph (f) of § 247.20 

clarified the relationship between the 

affiliate-sharing notice and opt out 

opportunity required under Section 

603(d)(2)(A)(iii) of the FCRA and the 

affiliate marketing notice and opt out 

opportunity required by new Section 

624 of the FCRA.221 Specifically, 

proposed paragraph (f) provided that 

nothing in proposed Regulation S–AM 

would have limited the responsibility of 

a company to comply with the notice 

and opt out provisions of Section 

603(d)(2)(A)(iii) of the FCRA before it 

shares information other than 

transaction and experience information 

with affiliates if it wishes to avoid 

becoming a consumer reporting agency. 

One commenter urged the 

Commission to delete this provision as 

unnecessary.222 In the alternative, this 

commenter asked the Commission to 

confirm that Section 603(d)(2)(A)(iii) of 

the FCRA applies to the sharing of 

information that would otherwise meet 

the definition of a ‘‘consumer report,’’ 

and that the sharing affiliate does not 

automatically become a consumer 

reporting agency, but risks becoming a 

consumer reporting agency.223 In 

response, the Commission is clarifying 

that the FCRA, not Regulation S–AM, 


srobinson on DSKHWCL6B1PROD with RULES3
40416 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

224See Proposing Release at 69 FR 42311. 

225See ACLI Letter; Coalition Letter; FSR Letter. 

226See ACLI Letter. See also 15 U.S.C. 1681s– 

3(a)(2). 

227See FSR Letter. Another commenter also 

indicated that the ‘‘option for all eligibility 

information’’ could be interpreted to mean all 

eligibility information pertaining to the consumer 

in perpetuity. This commenter sought clarification. 

See Coalition Letter. 

228See Coalition Letter. 

229See ACLI Letter; Coalition Letter; FSR Letter; 

ICBA Letter; SIFMA Letter I. 

230See, e.g., 17 CFR 248.4(c)(3). 

231This provision was designed to address 

comments regarding consumers that terminate a 

continuing relationship with a Covered Person. See 

supra note 229. 

establishes the standard for defining a 

person as a consumer reporting agency. 

Accordingly, we are adopting proposed 

§ 247.20(f), redesignated as § 248.121(e) 

and modified to replace the reference to 

becoming a consumer reporting agency 

with the phrase ‘‘where applicable,’’ in 

order to highlight this clarification. 

E. Section 248.122 Scope and Duration 

of Opt Out 

1. Section 248.122(a) 

The scope of the opt out was 

addressed in various sections of the 

proposal. Proposed § 247.21(c) provided 

that the notice could have allowed a 

consumer to choose from a menu of 

alternatives when opting out, such as 

opting out of receiving marketing 

solicitations from certain types of 

affiliates, or from receiving marketing 

solicitations that use certain types of 

information or are delivered using 

certain methods of communication. If a 

Covered Person provided a menu of 

alternatives, one of the alternatives 

would have had to allow the consumer 

to opt out with respect to all affiliates, 

all eligibility information, and all 

methods of delivering marketing 

solicitations. Proposed § 247.25(d) 

described how the termination of a 

consumer relationship would have 

affected the consumer’s opt out. Under 

the proposal, if a consumer’s 

relationship with a Covered Person 

terminated for any reason when the 

consumer’s opt out election was in 

force, the opt out would have continued 

to apply indefinitely unless revoked by 

the consumer. The Proposing Release 

indicated that the opt out would have 

been tied to the consumer, rather than 

to the information used for the 

marketing solicitations.224

Some commenters were critical of the 

provision requiring Covered Persons 

that provide a menu of alternatives, to 

provide the consumer with the ability to 

opt out with respect to all affiliates, all 

eligibility information, and all methods 

of delivery.225 One commenter stated 

that this requirement should be 

eliminated, arguing that this 

requirement does not appear in the 

FCRA.226 Another commenter indicated 

that the reference to ‘‘all eligibility 

information’’ made the provision 

confusing because it implied that there 

were various forms of eligibility 

information.227 One commenter opined 

that this universal opt out was not 

Congress’s intent and stated that a 

notice should allow opt outs on an 

account basis rather than an individual 

basis.228 Several commenters generally 

opposed the indefinite opt out 

requirement for consumers that 

terminate a relationship with a 

person.229

After considering the comments, we 

are adopting the provision relating to 

the scope of the opt out, with 

modifications, as § 248.122(a) of 

Regulation S–AM. Under this section, 

which is modeled on Section 

624(a)(2)(A) of the FCRA, the scope of 

the opt out depends upon the content of 

the opt out notice. Under 

§ 248.122(a)(1), except as otherwise 

provided in that section, a consumer’s 

election to opt out prohibits any affiliate 

covered by the opt out notice from using 

the eligibility information received from 

another affiliate as described in the 

notice to make marketing solicitations to 

the consumer. 

Section 248.122(a)(2)(i) clarifies that, 

in the context of a continuing 

relationship, an opt out notice may 

apply to eligibility information obtained 

in connection with a single continuing 

relationship, multiple continuing 

relationships, continuing relationships 

established subsequent to delivery of 

the opt out notice, or any other 

transaction with the consumer. Section 

248.122(a)(2)(ii) provides examples of 

continuing relationships. These 

examples are substantially similar to the 

examples used in the GLBA privacy 

rules, with added references to 

relationships between consumers and 

affiliates.230

Section 248.122(a)(3)(i) limits the 

scope of an opt out notice that is not 

connected with a continuing 

relationship. This section provides that 

if there is no continuing relationship 

between a consumer and a Covered 

Person or its affiliate, and if the Covered 

Person or its affiliate provides an opt 

out notice to a consumer that relates to 

eligibility information obtained in 

connection with a transaction with the 

consumer, such as an isolated 

transaction or a credit application that 

is denied, the opt out notice only 

applies to eligibility information 

obtained in connection with that 

transaction. The notice cannot apply to 

eligibility information that may be 

obtained in connection with subsequent 

transactions or a continuing relationship 

that may be subsequently established by 

the consumer with the Covered Person 

or its affiliate. Section 248.122(a)(3)(ii) 

provides examples of isolated 

transactions. 

Section 248.122(a)(4) provides that a 

consumer may be given the opportunity 

to choose from a menu of alternatives 

when electing to prohibit marketing 

solicitations. An opt out notice may give 

the consumer the opportunity to elect to 

prohibit marketing solicitations from 

certain types of affiliates covered by the 

opt out notice but not other types of 

affiliates covered by the notice, 

marketing solicitations based on certain 

types of eligibility information but not 

other types of eligibility information, or 

marketing solicitations by certain 

methods of delivery but not other 

methods of delivery, so long as one of 

the alternatives is the opportunity to 

prohibit all marketing solicitations from 

all of the affiliates that are covered by 

the notice. We continue to believe that 

Section 624(a)(2)(A) of the FCRA 

requires the opt out notice to contain a 

single opt out option for all marketing 

solicitations within the scope of the 

notice. The Commission recognizes that 

consumers could receive a number of 

different opt out notices, even from the 

same affiliate. Accordingly, we 

anticipate monitoring industry notice 

practices and evaluating whether further 

action is needed. 

Section 248.122(a)(5)(i) contains a 

special rule that explains the obligations 

with respect to notice following the 

termination of a continuing 

relationship. Under this rule, a 

consumer must be given a new opt out 

notice if, after all continuing 

relationships with a person or its 

affiliate have been terminated, the 

consumer subsequently establishes a 

new continuing relationship with that 

person or the same or a different affiliate 

and the consumer’s eligibility 

information is to be used to make a 

marketing solicitation.231 This will 

afford the consumer and the Covered 

Person a fresh start following 

termination of all continuing 

relationships by requiring a new opt out 

notice if a new continuing relationship 

is subsequently established. The new 

opt out notice must apply, at a 

minimum, to eligibility information 

obtained in connection with the new 

continuing relationship. The new opt 

out notice may apply more broadly to 

information obtained in connection 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40417 

232The Agencies received comment that it was 

inappropriate to tie the opt out to the consumer, 

rather than to the information used for making 

marketing solicitations. Upon further examination, 

we conclude that tying the opt out to the consumer 

could have had unintended consequences. For 

example, if the opt out were tied to the consumer, 

a Covered Person would have to track the consumer 

indefinitely, even if the consumer’s relationship 

with the Covered Person terminated and a new 

relationship with that Covered Person was not 

established until years later. We do not believe that 

Covered Persons should be required to track 

consumers indefinitely following termination of a 

relationship. 

233As discussed above, proposed § 247.20(c) 

provided exceptions from Regulation S–AM’s 

notice and opt out requirements in several 

situations, including when the receiving affiliate 

has a pre-existing business relationship with the 

consumer or receives an affirmative request for 

marketing solicitations from the consumer or when 

the receiving affiliate provides employee benefits to 

the consumer or performs certain services on behalf 

of another affiliate. See supra Part III.D.3. 

234Thus, under the proposed rules, if a consumer 

initially elected to opt out but did not extend the 

opt out upon expiration of the opt out period, the 

receiving affiliate could use all of the eligibility 

information it had received about the consumer 

from its affiliate, including eligibility information 

that it received during the opt out period. However, 

if the consumer subsequently opted out again some 

time after the initial opt out period has lapsed, the 

receiving affiliate could not use any eligibility 

information about the consumer it received from an 

affiliate on or after the mandatory compliance date, 

including any information it received during the 

period in which no opt out election was in effect. 

See Proposing Release at 69 FR 42311. 

Section 624(a)(5) of the FCRA contains a nonretroactivity provision, which provides that nothing 

shall prohibit the use of information that was 

received prior to the date on which persons are 

required to comply with the regulations 

implementing Section 624. 15 U.S.C. 1681s–3(a)(5). 

235See ACLI Letter; Coalition Letter; FSR Letter; 

ICBA Letter; SIFMA Letter I. 

236See supra Part III.E.1. 

237See ACLI Letter. 

238See Coalition Letter. 239See Proposing Release at 69 FR 42322. 

with a terminated relationship and give 

the consumer the opportunity to opt out 

with respect to eligibility information 

obtained in connection with both the 

terminated and the new continuing 

relationships. A consumer’s failure to 

opt out does not override a prior, but 

still in-effect, opt out election made by 

the consumer and applicable to 

eligibility information obtained in 

connection with a terminated 

relationship. The prior opt out would 

still be in effect regardless of whether 

the new opt out notice provided to the 

consumer applies to eligibility 

information that was obtained in 

connection with the terminated 

relationship.232 Section 248.122(a)(5)(ii) 

contains an example of this special rule. 

The Commission notes, however, that 

when a consumer was not given an opt 

out notice in connection with the initial 

continuing relationship because 

eligibility information obtained in 

connection with that continuing 

relationship was not shared with 

affiliates for use in making marketing 

solicitations, an opt out notice provided 

in connection with a new continuing 

relationship would have to apply to any 

eligibility information obtained in 

connection with the terminated 

relationship that is to be shared with 

affiliates for use in making future 

marketing solicitations. 

2. Section 248.122(b) Duration and 

Timing of Opt Out 

Proposed § 247.25 addressed the 

duration and effect of a consumer’s opt 

out election. Section 247.25(a) provided 

that a consumer’s election to opt out is 

effective for the opt out period, which 

is a period of at least five years 

beginning as soon as reasonably 

practicable after the consumer’s opt out 

election is received. Nothing in the 

paragraph limited the ability of Covered 

Persons to set an opt out period of 

longer than five years, including an opt 

out period that does not expire unless 

revoked by the consumer. We also 

stated that if for some reason, a 

consumer elects to opt out again while 

the opt out period remains in effect, a 

new opt out period of at least five years 

would begin upon receipt of each 

successive opt out election. 

Proposed § 247.25(b) provided that a 

receiving affiliate could not make or 

send marketing solicitations to a 

consumer during the opt out period 

based on eligibility information it 

receives from an affiliate, except as 

provided in the exceptions in proposed 

§ 247.20(c) or if the consumer had 

revoked his or her opt out.233 The 

proposal would have tied the opt out to 

the consumer, not to the information.234

Proposed § 247.25(c) clarified that a 

consumer could opt out at any time. 

Thus, even if the consumer did not opt 

out in response to the initial opt out 

notice or if the consumer’s election to 

opt out was not prompted by an opt out 

notice, the consumer could still have 

opted out. Regardless of when the 

consumer opted out, the opt out would 

be effective for at least five years. 

Commenters generally favored the 

five-year opt out provisions.235 As 

discussed above, most commenters were 

concerned with the indefinite opt out 

provision when a consumer terminates 

a relationship with a person.236 One 

commenter suggested that consumers 

should be allowed to revoke their opt 

outs orally, stating this would be 

consistent with the FCRA’s flexible 

approach.237 Another commenter stated 

that the opt out should not be broadly 

tied to a consumer but should be done 

on an account basis.238 This commenter 

also asked for clarification on the 

implementation date, suggesting that the 

‘‘reasonably practicable’’ language in the 

provision should be clarified to mean 

the opt out would begin on the date the 

opt out is received. 

We are adopting the provisions 

addressing the duration of the opt out as 

redesignated § 248.122(b), with some 

modifications. The final rule clarifies 

that the opt out period expires if the 

consumer revokes his or her opt out in 

writing, or, if the consumer agrees, 

electronically. This is consistent with 

the approach taken in the GLBA privacy 

rules. We do not believe it is necessary 

or appropriate to permit oral 

revocations. Many of the exceptions to 

Regulation S–AM’s notice and opt out 

provisions may be triggered by oral 

communications, as discussed above, 

which would permit the use of shared 

eligibility information to make 

marketing solicitations pending receipt 

of a written or electronic revocation. 

Also, as noted in the proposal, nothing 

prohibits setting an opt out period 

longer than five years, including an opt 

out period that does not expire unless 

revoked by the consumer.239

The Commission does not agree that 

the opt out period should begin on the 

date the consumer’s election to opt out 

is received. We interpret the FACT Act 

requirement to mean that the 

consumer’s opt out election must be 

honored for a period of at least five 

years from the date the election is 

implemented. We believe that Congress 

did not intend for the opt out period to 

be shortened to a period of less than the 

five years specified in the statute to 

reflect the time between the date the 

consumer’s opt out election is received 

and the date the consumer’s opt out 

election is implemented. 

The Commission also believes that it 

is neither necessary nor appropriate to 

set a mandatory deadline for 

implementing the consumer’s opt out 

election. A general standard better 

reflects that the time it will reasonably 

take to implement a consumer’s opt out 

election may vary depending on the 

facts and circumstances of the situation. 

Consistent with the special rule for a 

notice following termination of a 

continuing relationship, the duration of 

the opt out is not affected by the 

termination of a continuing 

relationship. When a consumer opts out 

in the course of a continuing 

relationship and that relationship is 

terminated during the opt out period, 

the opt out remains in effect for the 

remainder of the opt out period. If the 

consumer subsequently establishes a 

new continuing relationship while the 


srobinson on DSKHWCL6B1PROD with RULES3
40418 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

240See Proposing Release at 69 FR 42311. 

241Proposed § 247.21(a) reflected the intent of 

Congress, as expressed in Section 624(a)(2)(B) of the 

FCRA, that a notice required by Section 624(a)(2)(B) 

must be ‘‘clear, conspicuous, and concise,’’ and the 

method for opting out be ‘‘simple.’’ 

242See T. Rowe Price Letter. 

243Proposed § 247.24(c)(1) permitted a person to 

provide a joint opt out notice with one or more of 

its affiliates, so long as the notice is accurate with 

respect to each affiliate that issues the joint notice. 

Section 248.123(a)(1)(i) incorporates the substance 

of proposed § 247.24(c)(1) and clarifies ways in 

which affiliates that share a name may be 

identified. Proposed § 247.24(c)(2) would have 

permitted affiliates to provide a joint notice if the 

affiliates shared a common name. One commenter 

suggested that the rule make clear that if in a joint 

notice some affiliates share a common name and 

other affiliates do not, the notice may identify those 

affiliates with a common name as a group. See T. 

Rowe Price Letter. 

244The Commission, the Agencies, and the CFTC 

have proposed a model privacy form in a joint 

rulemaking. See Interagency Proposal for Model 

Privacy Form Under the Gramm-Leach-Bliley Act, 

Exchange Act Release No. 55497 (Mar. 20, 2007); 72 

FR 14940 (Mar. 29, 2007). This model privacy form 

is intended to meet the notice content requirements 

of Regulation S–AM. 

opt out period remains in effect, the opt 

out period may not be shortened with 

respect to information obtained in 

connection with the terminated 

relationship by sending a new opt out 

notice to the consumer when the new 

continuing relationship is established, 

even if the consumer does not opt out 

upon receipt of the new opt out notice. 

A person may track the eligibility 

information obtained in connection 

with the terminated relationship and 

provide a renewal notice to the 

consumer, or may choose not to use 

eligibility information obtained in 

connection with the terminated 

relationship to make marketing 

solicitations to the consumer. 

3. Section 248.122(c) 

Proposed § 247.25(c) clarified that a 

consumer could opt out at any time.240

As explained in the proposal, even if the 

consumer did not opt out in response to 

the initial opt out notice or if the 

consumer’s election to opt out was not 

prompted by an opt out notice, a 

consumer could still opt out. Regardless 

of when the consumer opted out, the opt 

out would have had to be effective for 

a period of at least five years. We 

received no comment on this provision 

and are adopting it as proposed, 

redesignated as § 248.122(c). 

F. Section 248.123 Contents of Opt Out 

Notice; Consolidated and Equivalent 

Notices 

1. Section 248.123(a) 

a. Joint Notice 

Proposed § 247.21 addressed the 

contents of the affiliate marketing opt 

out notice, and proposed § 247.24(c) 

permitted joint notices with affiliates 

identified in the notice with respect to 

which the notice was accurate. 

Proposed § 247.21(a) would have 

required the opt out notice to be clear, 

conspicuous, and concise, and to 

accurately disclose: (1) That the 

consumer may elect to limit a person’s 

affiliate from using eligibility 

information about the consumer that the 

affiliate obtains from the person to make 

marketing solicitations to the consumer; 

and (2) if applicable, that the 

consumer’s election will apply for a 

specified period of time and that the 

consumer will be allowed to extend the 

election once that period expires. The 

notice also would have had to provide 

the consumer with a reasonable and 

simple method to opt out.241 Under the 

proposal, use of the proposed model 

forms in the proposed Appendix A, 

while not required, would have 

complied with proposed § 247.21(a) in 

appropriate circumstances. We received 

one comment on this section that urged 

the Commission to clarify that a 

Covered Person would not have to send 

an additional notice if the Covered 

Person initially provided an opt out of 

limited duration and then determined to 

increase the length of time of the 

duration or make the opt out 

permanent.242

We are adopting proposed § 247.21(a), 

redesignated as § 248.123(a) with some 

modifications to enhance the clarity and 

usability of the model notices. We are 

also incorporating provisions of 

proposed § 247.24(c), pertaining to joint 

notices.243 Paragraph (a)(1)(i) provides 

that all opt out notices must provide the 

name of the affiliate or affiliates 

providing the notice, and allows for a 

joint notice by a group of affiliates. If 

affiliates share a common name, such as 

‘‘ABC,’’ then the notice may indicate 

that it is being provided by the family 

or group of companies with the ‘‘ABC’’ 

name. The notice may identify the 

companies by stating that it is being 

provided by ‘‘all of the ABC 

companies,’’ ‘‘the ABC banking, credit 

card, insurance, and securities 

companies,’’ or by listing the name of 

each affiliate providing the notice. A 

representation that the notice is 

provided by ‘‘the ABC banking, credit 

card, insurance, and securities 

companies’’ applies to all companies in 

those categories and not just to some of 

those companies. If the affiliates 

providing the notice do not all share a 

common name, then the notice must 

either separately identify each affiliate 

by name or identify each of the common 

names used by those affiliates. For 

example, if the affiliates providing the 

notice do business under both the ABC 

name and the XYZ name, then the 

notice could list each affiliate by name 

or indicate that the notice is being 

provided by ‘‘all of the ABC and XYZ 

companies’’ or by ‘‘the ABC banking 

and securities companies and the XYZ 

insurance companies.’’ Section 

248.123(a)(1)(ii) provides that an opt out 

notice must contain a list of the 

affiliates or types of affiliates covered by 

the notice. The notice may apply to 

multiple affiliates and to companies that 

become affiliates after the notice is 

provided to the consumer. The rules for 

identifying the affiliates covered by the 

notice are substantially similar to the 

rules for identifying the affiliates 

providing the notice in § 248.123(a)(1)(i) 

described above. 

Sections 248.123(a)(1)(iii)–(vii) 

require the opt out notice to include: (1) 

A general description of the types of 

eligibility information that may be used 

to make marketing solicitations to the 

consumer; (2) a statement that the 

consumer may elect to limit the use of 

eligibility information to make 

marketing solicitations to the consumer; 

(3) a statement that the consumer’s 

election will apply for the specified 

period of time stated in the notice and, 

if applicable, that the consumer will be 

allowed to renew the election once that 

period expires; (4) if the notice is 

provided to consumers who may have 

previously opted out, such as if a notice 

is provided to consumers annually, a 

statement that the consumer who has 

chosen to limit marketing offers does 

not need to act again until the consumer 

receives a renewal notice; and (5) a 

reasonable and simple method for the 

consumer to opt out. The requirement in 

§ 248.123(a)(1)(vi) to include a 

statement regarding consumers who 

may have previously opted out would 

be satisfied by appropriate use of the 

model forms in the Appendix.244 These 

forms, unlike the model forms in the 

proposed Appendix, include a 

statement that can be used in a notice 

given to a consumer who may have 

previously opted out to advise the 

consumer that he or she does not need 

to act again until he or she receives a 

renewal notice. The Commission 

continues to believe that the opt out 

notice must specify the length of the opt 

out period, if one is provided. However, 

an institution that subsequently chooses 

to increase the duration of the opt out 

period that it previously disclosed or 

honor the opt out in perpetuity has no 

obligation to provide a revised notice to 

the consumer. In that situation, the 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40419 

245See Proposing Release at 69 FR 42321. 

246See 17 CFR 248.7(d). 

247See T. Rowe Price Letter. 

248Some implementation issues may arise from 

providing a single opt out notice to joint consumers 

in the context of this rule (which focuses on the use 

of information) and in the context of other privacy 

rules (which focus on the sharing of information). 

For example, a consumer may opt out with respect 

to affiliate marketing in connection with an 

individually-held account, but not opt out with 

respect to affiliate marketing in connection with a 

joint consumer account. In that situation, it could 

be challenging to identify which consumer 

information may and may not be used by affiliates 

to make marketing solicitations to the consumer. 

249This is consistent with Section 624(b) of the 

FCRA. See also 15 U.S.C. 1681s–3 note. 

250See discussion of FCRA Section 

603(d)(2)(A)(iii) supra note 221. 

251See Coalition Letter. 

252See FSR Letter. 

result is the same as if the institution 

established a five-year opt out period 

and then did not send a renewal notice 

at the end of that period. A person 

receiving eligibility information from an 

affiliate would be prohibited from using 

that information to make marketing 

solicitations to a consumer unless a 

renewal notice is first provided to the 

consumer and the consumer does not 

renew the opt out. So long as no 

marketing solicitations are made using 

eligibility information received from an 

affiliate, there would be no violation of 

the FCRA or Regulation S–AM for 

failing to send a renewal notice in this 

situation. 

b. Joint Relationships 

Proposed § 247.24(d)(1) set out rules 

that would have applied when two or 

more consumers (referred to in the 

proposed regulation as ‘‘joint 

consumers’’) jointly obtained a product 

or service, such as a joint securities 

account.245 It also provided several 

examples. Under the proposed rules, a 

Covered Person could have provided a 

single opt out notice to joint 

accountholders that would have had to 

indicate whether the Covered Person 

would treat an opt out election by one 

joint accountholder as applying to all of 

the associated accountholders, or 

whether each accountholder would 

have to opt out separately. The Covered 

Person could not have required all 

accountholders to opt out before 

honoring an opt out direction by one of 

the joint accountholders. In addition, 

we provided an example in proposed 

paragraph (d)(2) to explain how the 

rules would operate and noted that 

while the example was patterned after 

similar provisions in the GLBA privacy 

rules as promulgated in Regulation S– 

P,246 they differed from the GLBA 

privacy rules in that Section 624 of the 

FCRA deals with the use of information 

for marketing by affiliates, rather than 

the sharing of information among 

affiliates. 

In the proposal, we requested specific 

comment on proposed paragraph 

(d)(1)(vii) and the example in paragraph 

(d)(2)(iii) that addressed the situation in 

which only one of two joint consumers 

had opted out. Under those paragraphs, 

in a joint consumer situation, if A had 

opted out only for A, and B did not opt 

out, we indicated that a Covered 

Person’s affiliate could use eligibility 

information about B to send marketing 

solicitations to B as long as the 

eligibility information was not based on 

A and B’s joint consumer relationship. 

One commenter argued that this 

approach would be overly restrictive 

and challenging to implement because 

exclusion of joint account information 

could block information about both a 

customer who had decided to opt out 

and one that had not.247 According to 

this commenter, Covered Persons 

should be able to use information about 

joint accounts to make marketing 

solicitations to the consumer who had 

decided not to opt out. 

We are adopting proposed paragraphs 

(d)(1) and (d)(2) of § 247.24 with 

modifications, redesignated as 

§ 248.123(a)(2). However, in light of the 

comment received, we are not adopting 

the example of joint relationships in 

proposed § 247.24(d)(2) because it 

addressed, in part, the sharing of 

information rather than the use of 

information to make marketing 

solicitations, and thus would be beyond 

the scope of this rulemaking. In 

addition, we have also made some 

technical changes to improve readability 

and promote consistency with the GLBA 

privacy rules.248

c. Alternative Contents 

Proposed § 247.21(d) provided that if 

a person chose to give consumers a 

broader opt out right than required by 

law, the person could modify the 

contents of the opt out notice to reflect 

accurately the scope of the opt out right 

it had provided. Proposed Model Form 

A–3 of Appendix A provided guidance 

for Covered Persons wishing to allow 

consumers to prevent all marketing from 

that person and its affiliates. We 

received no comments on this provision 

and are adopting it as proposed, 

redesignated as § 248.122(a)(3). We are 

adopting proposed Model Form A–3, 

redesignated as Model Form A–5 with 

slight modifications for clarity. 

d. Model Notices 

Section 248.123(a)(4) provides that 

model notices are in the Appendix. The 

Commission has provided model 

notices to facilitate compliance with the 

rule, although the final rules do not 

require their use. 

2. Coordinated, Consolidated, and 

Equivalent Notices 

Proposed § 247.27 provided that a 

notice required by proposed Regulation 

S–AM could be coordinated and 

consolidated with any other notice or 

disclosure required to be issued under 

any other provision of law.249 We 

indicated that these notices could 

include but were not limited to the 

affiliate sharing and opt out notices 

described in Section 603(d)(2)(A)(iii) of 

the FCRA 250 and the privacy notices 

required by Title V of the GLBA. We 

further noted that a notice or other 

disclosure that was equivalent to the 

notice required by the proposal, and 

that was provided to a consumer 

together with disclosures required by 

any other provision of law, would 

satisfy the requirements of the proposed 

rule. 

We requested comment on whether 

persons subject to the proposed rules 

would plan to consolidate their affiliate 

marketing notices with GLBA privacy 

notices or affiliate sharing opt out 

notices, whether we provided sufficient 

guidance on consolidated notices, and 

whether consolidation would be helpful 

or confusing to consumers. While one 

commenter expressed general support 

for the provision,251 another stated that, 

while financial institutions may 

consider consolidating the affiliate 

marketing notice with the GLBA privacy 

notice, the decision to consolidate 

would be affected by the five-year 

duration of the affiliate marketing opt 

out.252 However, the commenter did not 

specify whether this would make a firm 

more or less likely to consolidate 

notices. However, because Covered 

Persons are only encouraged to 

consolidate affiliate marketing notices 

with other notices they are required to 

provide, the Commission is, with the 

exception of technical changes made for 

clarity, adopting the consolidated and 

equivalent notice provisions as 

proposed, redesignated as §§ 248.123(b) 

and (c). 

We encourage Covered Persons to 

consolidate their affiliate marketing opt 

out notice with GLBA privacy notices, 

including any affiliate sharing opt out 

notice under Section 603(d)(2)(A)(iii) of 

the FCRA, so that consumers receive a 

single notice they can use to review and 

exercise all applicable opt outs. We 

recognize, however, that special issues 

arise when these notices are 


srobinson on DSKHWCL6B1PROD with RULES3
40420 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

253See supra note 244. 

254See 17 CFR 248.7(a)(3)(i)–(ii). 

255Under this proposed example, the Covered 

Person provided a simple process of opting out at 

the Internet Web site where the transaction was 

occurring. The opt out notice was automatically 

provided to the consumer, such as through the use 

of a mandatory link to an intermediate Web page, 

or ‘‘speed bump.’’ The consumer was given a choice 

of either opting out or not opting out at that time 

through a simple process conducted at the Internet 

Web site. In this situation we indicated that a 

consumer could be required to check a box on the 

Internet Web site in order to opt out or decline to 

opt out before continuing with the transaction. 

However, this example would not have included a 

situation in which the consumer was required to 

send a separate e-mail or visit a different Internet 

Web site in order to opt out. 

256 In this situation, the consumer would be 

allowed to exercise the opt out in the same manner 

and with the same amount of time to exercise the 

opt out as with respect to the GLBA privacy notice. 

This example takes into account the statutory 

requirement that we consider methods for 

coordinating and combining notices. See FACT Act 

Section 214(b)(3). 

257 In the proposal, we noted that some persons 

subject to Regulation S–AM might have a policy of 

not allowing affiliates to use eligibility information 

for marketing purposes unless a consumer 

affirmatively consented, or ‘‘opted in,’’ to receiving 

such marketing solicitations. However, we also 

noted that a pre-selected check box on a Web form 

or boilerplate language in a standard contract or 

disclosure document would not be evidence of the 

consumer’s affirmative consent. 

258See Coalition Letter; FSR Letter; ICBA Letter. 

259See FSR Letter; Wells Fargo Letter. 

260See Coalition Letter; ICBA Letter. 

261See ACLI Letter; Coalition Letter; FSR Letter; 

ICBA Letter. 

262See Coalition Letter. 263See ACLI Letter; ICBA Letter. 264See Coalition Letter. 265See ACB Letter. The E–Sign Act is codified at 

15 U.S.C. Chapter 96. 266See Coalition Letter. 267See USAA Letter. 268See 17 CFR 248.9(b)(1)(iii). 

consolidated. For example, the affiliate 

marketing opt out may be limited to a 

period of at least five years, subject to 

renewal, while the GLBA privacy and 

affiliate sharing opt out notices are not 

time-limited. This difference, if 

applicable, must be made clear to the 

consumer. Thus, if a Covered Person 

uses a consolidated notice and the 

affiliate marketing opt out is limited in 

duration, the notice must inform 

consumers that if they previously opted 

out, they do not need to opt out again 

until they receive a renewal notice 

when the opt out expires or is about to 

expire. In addition, as discussed more 

fully below, the Commission and the 

Agencies, in a joint rulemaking, have 

proposed a model privacy form that 

includes an affiliate marketing opt 

out.253 The proposed model privacy 

form is designed to satisfy the 

requirement to provide an affiliate 

marketing opt out notice. 

G. Section 248.124 Reasonable 

Opportunity To Opt Out 

1. Section 248.124(a) 

Proposed § 247.22(a) provided that 

the communicating affiliate would have 

to provide a consumer a ‘‘reasonable 

opportunity to opt out’’ after delivery of 

the opt out notice but before a marketing 

solicitation based on eligibility 

information is sent. We noted that 

because of the various circumstances in 

which opt out rights are provided, a 

‘‘reasonable opportunity to opt out’’ 

should be generally construed to avoid 

setting a mandatory waiting period. A 

general standard would provide 

flexibility to allow receiving affiliates to 

use eligibility information to make 

marketing solicitations at an appropriate 

point in time, while assuring that the 

consumer is given a realistic 

opportunity to prevent such use of the 

information. We received no comments 

on proposed § 247.22(a) and are 

adopting it substantially as proposed, 

redesignated as § 248.124(a) with 

technical changes for clarity. 

2. Section 248.124(b) 

Proposed §§ 247.22(b)(1) through (5) 

provided examples of what might 

constitute a reasonable opportunity to 

opt out in different situations. Proposed 

§§ 247.22(b)(1) and (2) provided 

examples of reasonable opportunities to 

opt out by mail or by electronic means 

consistent with the examples used in 

the GLBA privacy rules.254 Both 

examples illustrated that giving 

consumers 30 days in which to decide 

whether to opt out would be reasonable 

in most cases. Proposed § 247.22(b)(3) 

provided an example of a reasonable 

opportunity to opt out when the 

consumer was required to decide as a 

necessary part of proceeding with an 

electronic transaction, whether to opt 

out before completing the 

transaction.255 Proposed paragraph 

(b)(4) of § 247.22 provided that 

including the affiliate marketing opt out 

notice in a notice under the GLBA 

privacy rules could satisfy the 

reasonable opportunity standard.256

Proposed paragraph (b)(5) provided that 

an ‘‘opt-in’’ would satisfy the reasonable 

opportunity to opt out requirement, as 

long as a consumer’s affirmative consent 

is documented.257 We sought comment 

on whether additional guidance or 

examples were needed regarding the 

reasonable opportunity to opt out. 

A number of commenters addressed 

the 30-day safe harbor.258 Some 

commenters stated that it would provide 

consumers with a reasonable 

opportunity to opt out.259 Others were 

concerned that the time period would 

be viewed as a de facto minimum even 

though we had stated it would not.260

Most commenters however, objected to 

informing the consumer that he or she 

has a specific period of time by which 

to respond,261 citing a lack of 

Congressional intent,262 customer 

confusion,263 and unnecessary 

compliance burdens if Covered Persons 

decided to consolidate the GLBA 

notices with the Regulation S–AM 

notice.264 While we received no specific 

comment on the opportunity to opt out 

by mail provision, one commenter 

stated that requiring consumers to 

acknowledge receipt of notices sent 

electronically, as in proposed 

§ 247.22(b)(2), would violate the 

Electronic Signatures in Global and 

National Commerce Act (‘‘E–Sign 

Act’’).265 In addition, one commenter 

suggested broadening the scope of 

proposed § 247.22(b)(3) to include all 

transactions.266 This commenter also 

opined that proposed paragraphs (b)(4) 

and (b)(5) were inconsistent, appearing 

to equate an opt in with obtaining an 

opt out for the purposes of the proposal, 

and urged the Commission to omit the 

opt-in example. Another commenter did 

not agree that pre-selected boxes would 

be an unacceptable method for 

obtaining customer authorization, if 

used properly.267

We are adopting §§ 247.22(b)(1) and 

(b)(3) substantially as proposed, 

redesignated as §§ 248.124(b)(1) and (3). 

We are retaining the 30-day safe harbor 

because it helps afford certainty to 

entities that choose to follow the 30-day 

waiting period. We understand, 

however, that shorter waiting periods 

may be adequate under certain facts and 

circumstances in accordance with the 

general test for a reasonable opportunity 

to opt out. 

The final rule divides proposed 

§ 247.22(b)(2) into two subparts, 

redesignated as §§ 248.124(b)(2)(i) and 

(ii), to illustrate the different means of 

delivering an electronic notice. The 

example illustrates that for notices 

provided electronically, such as at an 

Internet Web site at which the consumer 

has obtained a product or service, a 

reasonable opportunity to opt out would 

include giving the consumer 30 days 

after the consumer acknowledges 

receipt of the electronic notice to opt 

out by any reasonable means. The 

acknowledgement of receipt aspect of 

this example is consistent with an 

example in the GLBA privacy 

regulations.268 The example also 

illustrates that for notices provided by email to a consumer who had agreed to 

receive disclosures by e-mail from the 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40421 

269For in-person transactions, consumers could 

be provided with a form that requires them to write 

‘‘yes’’ or ‘‘no’’ to indicate their opt out preference, 

or a form that contains two blank check boxes: one 

to opt out and one not to opt out. Of course, if an 

opportunity to opt out is to be reasonable, a 

consumer must be permitted to choose freely 

whether to opt out or not, and must not be induced 

to forego his or her right to opt out. 

270See, e.g., 17 CFR 248.7(a)(2)(ii). 

271See Proposed § 247.23(a)(4). 

272See ACLI Letter; Coalition Letter; FSR Letter; 

IAA Letter; ICBA Letter; ICI Letter; T. Rowe Price 

Letter; Wells Fargo Letter. 

273See FSR Letter; IAA Letter; ICI Letter; T. Rowe 

Price Letter. 

274See FSR Letter. 

275See ICBA Letter; Coalition Letter. 

276See Wells Fargo Letter. 

277See ACLI Letter; FSR Letter. 

278See FSR Letter. 

279See ACLI Letter. 

280See Coalition Letter; Wells Fargo Letter. 281See Wells Fargo Letter. 282See Coalition Letter. 283See Coalition Letter; ICBA Letter. 284The examples of specific methods identified 

in the final rules are not an exhaustive list of 

permissible methods. 

person sending the notice, a reasonable 

opportunity to opt out would include 

giving the consumer 30 days after the email is sent to elect to opt out by any 

reasonable means. Consumer 

acknowledgement is not necessary 

when the consumer has agreed to 

receive disclosures by e-mail. Moreover, 

the electronic delivery of affiliate 

marketing opt out notices does not 

require consumer consent in accordance 

with the E–Sign Act because neither 

Section 624 of the FCRA nor these final 

rules require that the notice be provided 

in writing. Persons that provide 

electronic affiliate marketing opt out 

notices under Regulation S–AM may do 

so pursuant to the agreement of the 

consumer, as specified in these rules, or 

in accordance with the requirements of 

the E–Sign Act. 

We agree with commenters that the 

example regarding electronic 

transactions in redesignated 

§ 248.124(b)(3) is limited in scope, and 

have added a new example for in-person 

transactions in § 248.124(b)(4). 

Together, these examples illustrate that 

an abbreviated opt out period is 

appropriate when the consumer is given 

a ‘‘yes’’ or ‘‘no’’ choice and is not 

permitted to proceed with the 

transaction unless he or she makes a 

choice.269

We received no comments on 

proposed § 247.22(b)(4), which provides 

that an affiliate marketing opt out notice 

can be included in a GLBA privacy 

notice, and are adopting it substantially 

as proposed, redesignated as 

§ 248.124(b)(5). We are not adopting the 

example in proposed § 247.22(b)(5) that 

would have illustrated the option of 

providing a consumer with an 

opportunity to ‘‘opt in’’ to affiliate 

marketing because the example was 

unnecessary and confusing. 

H. Section 248.125 Reasonable and 

Simple Methods of Opting Out 

Proposed § 247.23(a) provided 

guidance on how a person could 

provide consumers with reasonable and 

simple methods of opting out. These 

examples generally track the examples 

of reasonable opt out means from 

Section 7(a)(2)(ii) of the GLBA privacy 

rules,270 with certain modifications to 

give effect to Congress’s mandate in the 

FACT Act that the method of opting out 

of affiliate marketing must also be 

‘‘simple.’’ Accordingly, the example in 

proposed § 247.23(a)(2) contemplated 

the use of a self-addressed envelope 

with which the consumer could mail his 

or her reply form and opt out notice. If 

consumers were given the choice of 

calling a toll-free telephone number to 

opt out, the example contemplated that 

the system would be adequately 

designed and staffed to enable 

consumers to opt out with a single 

phone call.271

Proposed § 247.23(b) provided 

examples of opt out methods that would 

not be considered reasonable and 

simple. These methods include 

requiring the consumer to write a letter 

or to call or write to obtain an opt out 

form that was not included with the 

notice. A consumer who agrees to 

receive the opt out notice in electronic 

form only, such as by electronic mail or 

at an Internet Web site, would have to 

be allowed to opt out by the same or a 

substantially similar electronic form and 

should not be required to opt out solely 

by telephone or paper mail. 

Eight commenters addressed these 

examples,272 and generally agreed that 

the examples of the use of oral opt outs 

were reasonable and simple methods.273

One commenter stated that consumers 

should also be able to orally revoke their 

opt outs.274 Some commenters 

requested that the Commission clarify 

that this section is intended only to 

provide examples and is not 

mandatory.275 Another commenter 

suggested that we delete the examples of 

methods that did not provide a 

reasonable and simple method of opting 

out, stating that these examples could 

expose Covered Persons to civil 

liability.276 Other commenters objected 

to the reference to self-addressed 

envelopes.277 One stated that a selfaddressed envelope was unnecessary 

and inconsistent with Congress’s intent 

because it was not required by the 

statute or necessary for GLBA 

notices.278 Another commenter asserted 

that Covered Persons would view the 

use of a self-addressed envelope as a 

requirement.279 This commenter opined 

that consumers would use the envelopes 

for other purposes, like sending 

remittances or address change forms, 

which would have ‘‘disastrous’’ 

consequences including unavoidable 

delays and lapsed notices. 

Other commenters addressed 

electronic opt outs.280 One commenter 

viewed the proposed requirement for 

the opt out to be electronic when the 

notice is electronic as arbitrary, stating 

that a similar requirement is not 

imposed on opt out notices sent by 

mail.281 Another commenter opined that 

this requirement was not intended by 

Congress and requested that we adopt 

the GLBA rule examples.282 Finally, 

some commenters believed that a 

company that provides a reasonable and 

simple method of opting out should not 

be required to honor an opt out through 

a different mechanism.283

We are adopting § 247.23, 

redesignated as § 248.125, revised as 

discussed below. Paragraph (a) provides 

the general rule that Covered Persons 

must not use eligibility information 

from an affiliate in order to make 

marketing solicitations to a consumer 

unless the consumer has been provided 

with a reasonable and simple method to 

opt out. Paragraph (b) provides 

examples illustrating opt out methods 

that are reasonable and simple, as well 

as examples that are not.284

We decline to follow commenters’ 

suggestion that we adopt the GLBA 

examples without change. Section 624 

of the FCRA requires the Commission to 

ensure that the consumer is given 

reasonable and simple methods of 

opting out. The GLBA did not require 

simple methods of opting out, although 

the Commission sought to provide 

examples of simple methods in the 

GLBA privacy rules. Most of the 

examples we are adopting are 

substantially similar to those in 

proposed § 247.23, but have been 

revised for clarity. We are retaining the 

examples in proposed §§ 247.23(a)(1) 

and (3), redesignated as 

§ 248.125(b)(1)(i) and (iii), respectively. 

The example in § 248.125(b)(1)(ii) has 

been revised to reflect our 

understanding that the reply form and 

self-addressed envelope would be 

included together with the opt out 

notice and to clarify that the example is 

not mandatory. We do not find 

commenters’ other views on this 

example to be persuasive. As in the 

proposal, the example in 

§ 248.125(b)(1)(iv) contemplates that a 


srobinson on DSKHWCL6B1PROD with RULES3
40422 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

285See 15 U.S.C. 1681s(b). 

286See Joint Rules at 72 FR 62935; FTC Rule at 

72 FR 61448. 

287See 17 CFR 248.7(a)(2)(iv). 

288See 15 U.S.C. 7001, et seq. 

289See ACB Letter. 

290See Coalition Letter. 

291This is consistent with the approach taken in 

paragraph (b) of § 248.124. 

292Covered Persons are not required to provide 

extension notices if they treat the consumer’s opt 

out election as valid in perpetuity unless revoked 

by the consumer. 

toll-free telephone number that 

consumers may call to opt out would be 

adequately designed and staffed to 

enable consumers to opt out in a single 

phone call. In setting up a toll-free 

telephone number that consumers may 

use to exercise their opt out rights, 

institutions should minimize extraneous 

marketing or other messages directed to 

consumers who are in the process of 

opting out. 

One new example in 

§ 248.125(b)(1)(v) illustrates that 

reasonable and simple methods include 

allowing consumers to exercise all of 

their opt out rights described in a 

consolidated opt out notice that 

includes GLBA privacy, FCRA affiliate 

sharing, and FCRA affiliate marketing 

opt outs, by a single method, such as 

calling a single toll-free telephone 

number. This example furthers the 

Commission’s statutory directive to 

ensure that notices and disclosures may 

be coordinated and consolidated.285

We have retained the examples of opt 

out methods that are not reasonable and 

simple in proposed §§ 247.23(b)(1) 

through (b)(3), redesignated as 

§§ 248.125(b)(2)(i) through (b)(2)(iii) 

respectively. The example redesignated 

as § 248.125(b)(2)(iii) has been slightly 

modified to illustrate that it is not 

reasonable or simple to require a 

consumer who receives the opt out 

notice in electronic form, such as 

through posting at an Internet Web site, 

to opt out solely by paper mail or solely 

by visiting a different Web site without 

providing a link to that site. We did not 

find the commenters’ views on these 

examples to be persuasive. 

In order to be consistent with the Joint 

Rules and the FTC rule,286 the 

Commission has added new 

§ 248.125(c), which clarifies that a 

consumer may be required to opt out 

through a specific means, as long as that 

means is reasonable and simple for the 

consumer. This section corresponds to a 

provision in Regulation S–P.287

I. Section 248.126 Delivery of Opt Out 

Notices 

Paragraph (a) of proposed § 247.24 

provided that a person covered by the 

proposed rule would have needed to 

deliver its opt out notice so that each 

consumer reasonably could be expected 

to receive actual notice. An 

electronically delivered opt out notice 

could have been delivered either in 

accordance with the electronic 

disclosure provisions in proposed 

Regulation S–AM or in accordance with 

the E–Sign Act.288 The proposed rule 

included an example where a Covered 

Person could e-mail its affiliate 

marketing notice to consumers who had 

previously agreed to the electronic 

delivery of information and could 

provide the notice on its Internet Web 

site for consumers who obtain products 

or services electronically through that 

Web site. One commenter expressed 

concern over the proposed requirement 

that the consumer acknowledge receipt 

of the notice as a necessary step to 

obtaining a particular product or 

service.289 The commenter viewed this 

as inconsistent with the E–Sign Act. 

Proposed § 247.24(b) provided 

examples of fulfilling the expectation of 

actual notice. We indicated that the 

‘‘reasonable expectation of delivery’’ 

standard is a lesser standard than actual 

notice. For instance, if a communicating 

affiliate mailed a printed copy of its 

notice to the last known mailing address 

of a consumer, it would have met its 

obligation even if the consumer has 

changed addresses and never received 

the notice. One commenter expressed 

support for this standard.290

We are adopting § 247.24, 

redesignated as § 248.126, with 

modifications. We retained the 

reasonable expectation of actual notice 

standard, and the examples of a 

reasonable expectation of actual notice 

for an electronic notice have been 

revised and divided into two sets of 

examples of what does and does not 

meet the requirement.291 The examples 

in paragraphs (b)(3)–(4) of § 248.126 

illustrate that a consumer may 

reasonably be expected to receive actual 

notice if the affiliate providing the 

notice provides a notice by e-mail to a 

consumer who has agreed to receive 

electronic disclosures by e-mail from 

the affiliate providing the notice, or 

posts the notice on the Internet Web site 

at which the consumer obtained a 

product or service electronically and 

requires the consumer to acknowledge 

receipt of the notice. Conversely, the 

examples in paragraphs (c)(2)–(c)(3) of 

§ 248.126 illustrate that a consumer may 

not reasonably be expected to receive 

actual notice if the affiliate providing 

the notice sends the notice by e-mail to 

a consumer who has not agreed to 

receive electronic disclosures by e-mail 

from the affiliate providing the notice, 

or posts the notice on an Internet Web 

site without requiring the consumer to 

acknowledge receipt of the notice. 

As discussed above, the Commission 

has determined that the electronic 

delivery of opt out notices does not 

require consumer consent in accordance 

with the E–Sign Act because nothing in 

Section 624 of the FCRA requires the 

notice to be provided in writing. Thus, 

we believe that requiring an 

acknowledgement of receipt is not 

inconsistent with the E–Sign Act. 

Moreover, this example is consistent 

with an example in the GLBA privacy 

rules and is appropriate, particularly 

where the notice is posted on an 

Internet Web site. 

Unlike the Agencies, the Commission 

did not receive requests to require the 

mandatory delivery of electronic notices 

by e-mail. Like the Agencies, however, 

we decline to do so. The Commission 

agrees with the Agencies that concerns 

about unsolicited e-mail and the 

security of e-mail make it inappropriate 

to require e-mail as the only permissible 

form of electronic delivery for opt out 

notices. 

J. Section 248.127 Renewal of Opt Out 

Elections 

Proposed § 247.26 described 

procedures for extending an opt out. 

Proposed paragraph (a) of § 247.26 

required consumers to be provided with 

a new notice and a reasonable 

opportunity to extend their opt out 

before a receiving affiliate could make 

marketing solicitations based on the 

consumer’s eligibility information upon 

expiration of the opt out period. The 

affiliate that initially provided the 

notice, or its successor, would provide 

the extension notice. If an extension 

notice were not provided to the 

consumer, the opt out period would 

continue indefinitely. The requirement 

to provide an extension notice upon 

expiration of the opt out period would 

apply to any opt out—even if, for 

example, the consumer failed to opt out 

initially and informed the 

communicating affiliate of his or her opt 

out at some later time. The consumer 

could extend the opt out at the 

expiration of each successive opt out 

period. Proposed paragraph (b) of 

§ 247.26 provided that each opt out 

extension would be effective for a 

period of at least five years, in 

compliance with proposed § 247.25. 

Proposed § 247.26(c) addressed the 

contents of an extension notice.292 Like 

the initial notice, an extension notice 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40423 

293See Coalition Letter; ICBA Letter. 

294See ICBA Letter. 

would have to be clear, conspicuous, 

and concise. Proposed paragraph (c) 

provided some flexibility in the design 

and contents of the notice. Under one 

approach, the notice could have 

accurately disclosed the same items 

required to be disclosed in the initial 

opt out notice under proposed 

§ 247.21(a), along with a statement 

explaining that the consumer’s prior opt 

out had expired or was about to expire, 

as applicable, and that the consumer 

would have to opt out again if he or she 

wished to keep the opt out election in 

force. Under another approach, the 

extension notice could have provided: 

(1) That the consumer previously 

elected to limit affiliates from using 

eligibility information about the 

consumer to make marketing 

solicitations to the consumer; (2) that 

the consumer’s election had expired or 

was about to expire, as applicable; (3) 

that the consumer could have elected to 

extend his or her previous election; and 

(4) a reasonable and simple method for 

the consumer to extend the opt out. We 

requested comment regarding whether 

persons subject to proposed Regulation 

S–AM would plan to limit the duration 

of the opt out, and on the relative 

burdens and benefits of providing 

limited or unlimited opt out periods. 

Proposed § 247.26(d) addressed the 

timing of the extension notice and 

provided that an extension notice could 

be delivered to the consumer either a 

reasonable period of time before an opt 

out period expired, or any time after the 

opt out period expired, but before 

covered marketing solicitations were 

made to the consumer. Requiring the 

extension notice a reasonable period of 

time before the opt out period expired 

was intended to facilitate the smooth 

transition of consumers who choose to 

change their elections. An extension 

notice given too far in advance of the 

expiration of the opt out period might 

confuse consumers. We did not propose 

to set a fixed time for what would 

constitute a ‘‘reasonable period of time,’’ 

noting that a reasonable period of time 

could depend upon the amount of time 

given to the consumer for a reasonable 

opportunity to opt out, the amount of 

time necessary to process opt outs, and 

other factors. Nevertheless, we stated 

that providing an extension notice in 

combination with the last annual 

privacy notice required by the GLBA 

that was provided to the consumer 

before expiration of the affiliate 

marketing opt out period would have 

been reasonable in all cases. Proposed 

§ 247.26(e) made clear that sending an 

extension notice to a consumer before 

the expiration of the opt out period 

would not shorten the five-year opt out 

period. 

We also noted that opt out elections 

under the GLBA do not expire, and that 

GLBA notices typically state that a 

consumer need not opt out again if the 

consumer previously opted out. We 

recognized that including an affiliate 

marketing opt out notice or an extension 

notice in combination with an initial or 

annual notice under the GLBA required 

complying with both FCRA and GLBA 

requirements as applicable. Under the 

proposal, if a person chose to make the 

affiliate marketing opt out effective in 

perpetuity, the statement in the GLBA 

notice would have remained correct. 

However, the GLBA notice would not 

have been accurate with respect to the 

extension notice if the affiliate 

marketing opt out were limited to a 

defined period of five or more years. In 

that case, the extension notice regarding 

affiliate marketing would have had to 

make clear to the consumer the 

necessity of opting out again in order to 

extend the opt out. We requested 

comment on this interaction between 

the FACT Act and GLBA notices, 

including whether the Commission 

should provide further guidance 

regarding how a communicating affiliate 

might ensure that the difference in opt 

out rights is clear to consumers. 

Commenters expressed concern that 

the extension notice would differ from 

the initial notice because the extension 

notice would be required to inform the 

consumer that the consumer’s prior opt 

out had expired or was about to expire, 

as applicable, and that the consumer 

would have to opt out again to keep the 

opt out election in force.293 In their 

view, this additional disclosure would 

have been costly and have provided 

little benefit to consumers. One 

commenter maintained that the 

additional disclosure would make it 

difficult, if not impossible, to combine 

the extension notice with the GLBA 

privacy notice.294

The Commission is adopting 

proposed § 247.26, redesignated as 

§ 248.127, with modifications as 

discussed below. The final rules also 

replace the references to ‘‘extension’’ 

with references to a ‘‘renewal’’ notice. 

Section 248.127(a) provides that after 

an opt out period expires, a person may 

not make marketing solicitations to a 

consumer who previously opted out 

unless the consumer has been given a 

compliant renewal notice and a 

reasonable opportunity to opt out, and 

the consumer does not renew the opt 

out. This section also clarifies that a 

person can make marketing solicitations 

to a consumer after expiration of the opt 

out period if one of the exceptions in 

§ 248.121(c) applies. 

Section 248.127(a)(2) addresses the 

opt out renewal period. We continue to 

believe it is not necessary to set a fixed 

minimum period of time for a 

reasonable opportunity to renew the opt 

out, and that doing so would be 

inconsistent with the approach taken in 

other sections of Regulation S–AM and 

in the GLBA privacy rules. We received 

no comment regarding the minimum 

five-year period duration of the renewed 

opt out and are adopting this provision 

as proposed. Section 248.127(a)(3) states 

that a renewal notice must be provided 

either by the affiliate (or its successor) 

who provided the previous opt out 

notice, or as part of a joint renewal 

notice from two or more members of an 

affiliated group of companies, or their 

successors, that jointly provided the 

previous opt out notice. This provision 

balances the goal of ensuring that the 

notice is provided by an entity known 

to the consumer with the need to 

provide a degree of flexibility to 

recognize changes in corporate structure 

that may occur over time. 

In the proposal, we recognized that 

the content of the extension or renewal 

notice would differ from the content of 

the initial notice. We note that while the 

statute does not require that affiliate 

marketing initial and opt out renewal 

notices be identical, it does require that 

the Commission provide guidance to 

ensure that opt out notices are clear, 

conspicuous, and concise. We find it 

unreasonable to expect a consumer, 

after receiving a renewal notice, to 

remember that he or she previously 

opted out five years ago (or longer). We 

also find it unreasonable to expect a 

consumer who remembers opting out to 

know that he or she must opt out again 

in order to renew that decision. To 

ensure that a consumer receives a 

meaningful renewal notice, the 

consumer must be: (1) Reminded that he 

or she previously opted out; (2) 

informed that the previous opt out has 

expired or is about to expire; and (3) 

advised that to continue to limit 

solicitations from affiliates, he or she 

must renew the previous opt out. The 

renewal notice can state that ‘‘the 

consumer’s election has expired or is 

about to expire.’’ The final rule omits 

the words ‘‘as applicable’’ to clarify that 

the notice does not have to be tailored 

to differentiate consumers for whom the 

election ‘‘has expired’’ from those for 

whom the election ‘‘is about to expire.’’ 

The Commission does not agree with 

the commenters who indicated that the 

renewal notice’s additional content 


srobinson on DSKHWCL6B1PROD with RULES3
40424 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

295These changes relate to identification of the 

affiliates or group of affiliates providing the opt out, 

descriptions of the types of eligibility information 

that may be used and the ability of the consumer 

to limit the use of that information, as well as other 

requirements that make the opt out notice 

reasonable and simple. 

296We have changed the reference from 

‘‘extension’’ to ‘‘renewal’’ of a notice and deleted 

‘‘before any affiliate makes or sends’’ as 

unnecessary. Proposed § 247.26(d)(2) is now 

referred to as ‘‘Combination with annual privacy 

notice’’ in § 248.127(c)(2) and clarified for ease of 

reference. 

297The phrase ‘‘to a period of less than 5 years’’ 

has been omitted as unnecessary. 

298See ACB Letter; ACLI Letter; AIA Letter; 

Coalition Letter; FSR Letter; IAA Letter; ICBA 

Letter; ICI Letter; Metlife Letter; SIFMA Letter I; T. 

Rowe Price Letter; USAA Letter. 

299See ACB Letter; AIA Letter; Coalition Letter; 

ICBA Letter; Metlife Letter. 

300See IAA Letter; T. Rowe Price Letter. 

301See ACLI Letter. 

302See § 248.128(a). 

303See § 248.128(b). 

304 In the proposal, we indicated that the final 

rules would become effective six months after the 

date on which they were issued in final form. This 

was consistent with the requirements of Section 624 

of the FCRA. See Proposing Release at 69 FR 42302. 

305See ACLI Letter; Coalition Letter; Wells Fargo 

Letter. 

306See Coalition Letter. 

frustrates the combination of FCRA 

affiliate marketing opt out notices with 

GLBA privacy notices. Even if the 

language of the renewal notice were 

identical to the initial notice, it still 

could be difficult to avoid honoring a 

consumer’s opt out in perpetuity if the 

opt out notice is incorporated into the 

GLBA privacy notice. GLBA privacy 

notices often state that if a consumer has 

previously opted out, it is not necessary 

for the consumer to opt out again. This 

statement is accurate for affiliate 

marketing if the consumer’s opt out will 

be honored in perpetuity, but is 

inaccurate if an affiliate marketing opt 

out, included as part of the notice, will 

be effective only for a limited period of 

time, subject to renewal by the 

consumer in five-year intervals. Thus, if 

an affiliate marketing opt out notice 

were consolidated with a GLBA privacy 

notice and affiliate marketing opt outs 

were effective only for a limited period 

of time, the notice would have to be 

modified to make clear that statements 

about the consumer not needing to opt 

out again do not apply to the affiliate 

marketing renewal notice. Therefore, the 

Commission does not believe that 

requiring a renewal notice to contain 

information not included in an initial 

notice will significantly affect the ability 

to incorporate affiliate marketing opt out 

notices into GLBA privacy notices 

because consolidation of the notices is 

most likely to occur when the affiliate 

marketing opt out will be honored in 

perpetuity. Entities that prefer not to 

provide renewal notices may do so by 

honoring the consumer’s opt out in 

perpetuity. We therefore are adopting 

§ 247.26(b) substantially as proposed, 

but redesignated as § 248.127(b) with 

revisions that reflect the changes to 

§ 248.123, as discussed above.295

Proposed § 247.26(d) addressed the 

timing of the extension or renewal 

notice. We received no comment on this 

section and are adopting it substantially 

as proposed, redesignated as 

§ 248.127(d).296 Proposed § 247.26(e) 

addressed the effect of an extension or 

renewal notice on the existing opt out 

period. We received no comment on this 

section and are adopting it substantially 

as proposed, redesignated as 

§ 248.127(d), with some 

modifications.297

K. Section 248.128 Effective Date, 

Compliance Date, and Prospective 

Application 

1. Section 248.128(a) and (b) 

In the Proposing Release, we 

recognized that some institutions may 

want to combine their affiliate 

marketing opt out notice with their next 

annual GLBA privacy notice. Twelve 

commenters addressed the effective and 

mandatory compliance dates.298 These 

commenters believed that the 

mandatory compliance date should be 

delayed until some time after the 

effective date of the final rules. The 

commenters suggested various periods 

for delaying the mandatory compliance 

date from six, 12,299 15,300 and 18 

months.301 In addition, they argued that 

a delayed mandatory compliance date 

was necessary in order to make 

significant changes to business practices 

and procedures, to implement necessary 

operational and systems changes, and to 

design and provide affiliate marketing 

opt out notices. Commenters also noted 

that many institutions would like to 

send the affiliate marketing notices with 

their initial or annual GLBA privacy 

notices, both to minimize costs and to 

avoid consumer confusion. These 

commenters noted that many large 

institutions provide GLBA privacy 

notices on a rolling basis, and indicated 

that a delayed mandatory compliance 

date was necessary to enable 

institutions to introduce affiliate 

marketing opt out notices into this 

cycle. A few industry commenters 

believed that Congress knew that an 

effective date is not necessarily the same 

as a mandatory compliance date because 

banking regulations commonly have 

effective dates and mandatory 

compliance dates that differ. 

Regulation S–AM becomes effective 

approximately 30 days after publication 

in the Federal Register.302 Compliance 

with Regulation S–AM is required not 

later than January 1, 2010.303 The 

mandatory compliance date is delayed 

to give Covered Persons a reasonable 

amount of time to include the affiliate 

marketing opt out notice with their 

initial and annual privacy notices.304

This is consistent with the FCRA’s 

directive that notices may be 

consolidated and coordinated. The 

Commission believes that delaying the 

mandatory compliance date until 

January 1, 2010 will give Covered 

Persons adequate time to develop and 

distribute opt out notices, as well as 

provide Covered Persons sufficient time 

to develop and distribute consolidated 

notices. 

2. Section 248.128(c) 

Proposed § 247.20(e) provided that 

Regulation S–AM would not apply to 

eligibility information received by a 

receiving affiliate prior to the required 

compliance date. Some commenters 

argued that the proposed rule did not 

track the statutory language or reflect 

the intent of Congress.305 These 

commenters asserted the final rules 

should grandfather all information 

received by any financial institution or 

affiliate in a holding company before the 

mandatory compliance date, rather than 

grandfather only that information 

received before the mandatory 

compliance date by a person that 

intends to use the information to make 

solicitations to the consumer. In the 

alternative, one commenter requested 

that, if we adopted the rule as proposed, 

we clarify that any information placed 

into a common database by an affiliate 

be considered to have been provided to 

an affiliated person.306 The commenter 

argued that without such a clarification, 

affiliated companies would have to 

undertake costly deconstruction of 

existing databases to ensure compliance. 

We are adopting § 247.20(e) 

substantially as proposed, redesignated 

as § 248.128(c), with modifications 

discussed below. To address concerns 

expressed by commenters, the final 

rules clarify that a Covered Person 

receives eligibility information from an 

affiliate when the affiliate places that 

information in a common database that 

is accessible by a Covered Person, even 

if the Covered Person has not accessed 

or used that information as of the 

compliance date. The final rules do not 

apply to eligibility information placed 

in a common database before the 

mandatory compliance date by an 

affiliate who has a pre-existing business 

relationship with a consumer. The rules 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40425 

307See Proposing Release at 69 FR 42322. 

308See Proposing Release at 69 FR 42312. 

309See ICBA Letter. 

310On March 31, 2006, the Commission and the 

Agencies released a report entitled Evolution of a 

Prototype Financial Privacy Notice prepared by 

Kleimann Communication Group, Inc., 

summarizing research that led to the development 

of a prototype short-form GLBA privacy notice. This 

report is available at http://www.ftc.gov/privacy/ 

privacyinitiatives/ 

FTCFinalReportExecutiveSummary.pdf. That 

prototype included an affiliate marketing opt out 

notice. The prototype assumed that the notice 

would be provided by the affiliate that is sharing 

eligibility information. The Commission believes 

that providing model forms in this rule for standalone opt out notices that may be used in a more 

diverse set of circumstances than a model privacy 

form is appropriate and consistent with efforts to 

develop a model privacy form. On March 29, 2007, 

the Commission, the Agencies, and the CFTC 

published for public comment in the Federal 

Register a model privacy form based on the 

prototype that includes the affiliate marketing opt 

out notice. See supra note 244. 

311See supra Part III.F. 

312Persons may use or not use the model forms, 

or modify the forms, so long as the requirements of 

the regulation are met. For example, although some 

of the model forms use five years as the duration 

of the opt out period, an opt out period of longer 

than five years may be used and the longer time 

substituted in the opt out notices. However, 

Covered Persons that modify the forms or use 

different forms for their notice requirements should 

take care to ensure that their notices are clear, 

conspicuous, and concise. 

313 ‘‘Covered Persons’’ include brokers, dealers 

(except notice-registered broker-dealers), and 

investment companies, as well as investment 

advisers and transfer agents that are registered with 

the Commission. 

do apply if eligibility information is 

obtained by an affiliate before the 

mandatory compliance date and is not, 

before the mandatory compliance date: 

(1) placed into a common database that 

is accessible to other affiliates; or (2) 

provided to another affiliate. The final 

rules also apply to new or updated 

eligibility information placed in a 

common database after the mandatory 

compliance date. 

IV. Appendix to Subpart B—Model 

Forms 

Proposed Appendix A provided 

model forms as examples to illustrate 

how Covered Persons could comply 

with the notice and opt out 

requirements of Section 624 of the 

FCRA and proposed Regulation S– 

AM.307 Proposed Appendix A included 

three proposed model forms. Model 

Form A–1 was an initial opt out notice. 

Model Form A–2 was an extension 

notice that could be used when a 

consumer’s prior opt out has expired or 

was about to expire. Model Form A–3 

was for persons subject to proposed 

Regulation S–AM to use if they offered 

consumers a broader right to opt out of 

marketing than required by law. 

We stated that use of the proposed 

model forms would not be 

mandatory.308 We also noted that 

persons subject to proposed Regulation 

S–AM could use the model forms, 

modify them to suit particular 

circumstances, or use some other form, 

so long as the requirements of the 

proposed rules were met. We noted that 

although Model Forms A–1 and A–2 

used five years as the duration of the opt 

out period, communicating affiliates 

could have chosen an opt out period 

longer than five years and substituted 

the longer time period in the opt out 

notices. The proposal also provided an 

illustration in which the communicating 

affiliates chose to treat the consumer’s 

opt out as effective in perpetuity and 

thereby omitted from the initial notice 

any reference to the limited duration of 

the opt out period or the right to extend 

the opt out. 

Each of the proposed model forms 

was designed as a stand-alone form. We 

anticipated that some Covered Persons 

might want to combine the affiliate 

marketing opt out notice with a GLBA 

privacy notice. We noted that if the 

notices were combined, we expected 

that Covered Persons would integrate 

the affiliate marketing opt out notice 

with other required disclosures and 

avoid repetition of information such as 

the methods for opting out. Finally, we 

noted that the development of a model 

form that would combine the various 

opt out notices was beyond the scope of 

the proposed rulemaking. We received 

one comment on the model forms that 

generally supported the development of 

templates.309 This commenter also 

suggested there should be a safe harbor 

for companies that use the model forms. 

We are adopting the model forms in 

Appendix A of the proposal 

substantially as proposed, redesignated 

as Appendix to Subpart B—Model 

Forms, with additions and revisions to 

reflect changes incorporated in the final 

rules, discussed above. The model forms 

are designed to be helpful for entities 

that give notices and beneficial for 

consumers. As under the proposal, the 

model forms are provided as standalone documents. Persons may also 

choose to combine their affiliate 

marketing notices with other consumer 

disclosures, such as GLBA privacy 

notices.310 Creating a consolidated 

model form is beyond the scope of this 

rulemaking. However, as discussed 

above, institutions can combine affiliate 

marketing opt out notices with other 

disclosures, including GLBA privacy 

and opt out notices. If a combined 

model notice is adopted, we would 

expect the use of that model to satisfy 

the requirement to provide an initial 

affiliate marketing opt out notice.311 As 

adopted, the Appendix includes five 

model forms. Model Form A–1 is for an 

initial notice provided by a single 

affiliate. Model Form A–2 is for an 

initial notice provided as a joint notice 

from two or more affiliates. Model Form 

A–3 is for a renewal notice provided by 

a single affiliate. Model Form A–4 is for 

a renewal notice provided as a joint 

notice from two or more affiliates. 

Model Form A–5 is for a voluntary ‘‘no 

marketing’’ opt out. 

While use of the model forms is not 

mandatory, appropriate use of the 

model forms satisfies the requirement in 

Section 624 of the FCRA that Covered 

Persons provide notices that are ‘‘clear, 

conspicuous, and concise.’’ 312 As 

adopted, the model forms state that a 

consumer’s opt out election applies 

either for a fixed number of years or for 

‘‘at least 5 years.’’ This revision permits 

Covered Persons that use a longer opt 

out period or that subsequently extend 

their opt out period to rely on the model 

language. The model forms also contain 

a reference to the consumer’s right to 

revoke an opt out, and the model forms 

clarify that, with an opt out of limited 

duration, the consumer does not have to 

opt out again until a renewal notice is 

sent. 

V. Cost-Benefit Analysis 

The Commission is sensitive to the 

costs and benefits of its rules and 

understands that the rules may impose 

costs on Covered Persons. Regulation S– 

AM’s requirement to provide consumers 

with notice and an opportunity to opt 

out of receiving affiliate marketing 

solicitations is designed to benefit 

consumers by enabling them to limit 

certain marketing solicitations from 

affiliated companies. In addition, the 

notice requirement should enhance the 

transparency of each Covered Person’s 

affiliate marketing and information 

sharing practices. 

In the proposal, we noted that the 

proposed rules would impose costs 

upon Covered Persons 313 that wish to 

engage in affiliate marketing based on 

the communication of eligibility 

information. Absent an exception, a 

Covered Person is prohibited from using 

eligibility information received from an 

affiliate to make marketing solicitations 

to consumers, unless: (1) The potential 

marketing use of the information has 

been clearly, conspicuously and 

concisely disclosed to the consumer; (2) 

the consumer has been provided a 

reasonable opportunity and a simple 

method to opt out of receiving the 


srobinson on DSKHWCL6B1PROD with RULES3
40426 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

314See Proposing Release at 69 FR 42313. 

315For purposes of the Paperwork Reduction Act 

analysis in the Proposing Release, we estimated that 

approximately 70% of Covered Persons have 

affiliates. Updated statistics reported in registration 

forms filed by investment advisers show that 

approximately 56% of registered investment 

advisers have a corporate affiliate, and we estimated 

that other Covered Persons would report a rate of 

affiliation similar to that reported by registered 

investment advisers. Id. 

316 In the Proposing Release we indicated that: (1) 

A Covered Person that does not have affiliates or 

that does not communicate eligibility information 

to its affiliates would not be required to comply 

with the proposed notice and opt out requirements; 

(2) even if a communicating affiliate shared 

eligibility information, notice and opt out would 

not be required if the receiving affiliate did not use 

the information as a basis for marketing 

solicitations; (3) because the proposed rules 

allowed for a single, joint notice on behalf of a 

common corporate family, Covered Persons would 

not be required to independently provide affiliate 

marketing notices and opt out opportunities if they 

were included in an affiliate’s notice; and (4) the 

proposed rules incorporated a number of statutory 

exceptions that would further reduce the number of 

persons required to provide affiliate marketing 

notices. In addition, in the Proposing Release we 

noted that if an institution were required to provide 

consumers notice and an opportunity to opt out, the 

notice could be combined with GLBA privacy 

notices or with any other document, including 

other disclosure documents or account statements. 

We expressed our expectation that most institutions 

that would be required to provide an affiliate 

marketing notice would combine that notice with 

some other form of communication. Id. 

317 Id. at 42313–14. 

318 Id. at 42314. 

319See SIFMA Letter I. 

320The Banking Agencies estimated that 18 hours 

was reasonable but expected that figure to vary 

among Covered Persons. See 69 FR 42513. In the 

Proposing Release, the Commission estimated that 

the ‘‘hour burden for developing, sending and 

tracking the opt out notices would range from 2– 

20 hours, with an average of 6 hours.’’ See 

Proposing Release at 69 FR 42315. 

321A Covered Person’s obligation to provide 

notices and opt out opportunities will depend on 

the information sharing policies of that person and 

the marketing policies of its affiliates. For purposes 

of the Paperwork Reduction Act, we now estimate 

that approximately 56% of Covered Persons have 

affiliates. Statistics reported in registration forms 

filed by investment advisers show that 

approximately 56% of registered investment 

advisers have a corporate affiliate, and we estimate 

that other Covered Persons would report a rate of 

affiliation similar to that reported by registered 

investment advisers. 

322This estimate is based on the following 

calculation: (5,561 + 4,586 + 11,300 + 413 = 21,860 

× .56 = 12,242). 

323This is the per hour cost of Senior Compliance 

Officer, who we feel will be the appropriate person 

to review notices. This figure is derived from See 

Securities Industry and Financial Markets 

Association, Report on Management and 

Professional Earnings in the Securities Industry— 

2007 (2007) (‘‘SIFMA Report’’), modified by the 

Commission’s Office of Economic Analysis to 

account for an 1800-hour work year, bonuses, firm 

size, employee benefits, and overhead. 

marketing solicitation; and (3) the 

consumer has not opted out. 

In proposing the rules, we estimated 

that approximately 6,768 broker-dealers, 

5,182 investment companies, 7,977 

registered investment advisers, and 443 

registered transfer agents would be 

required to comply with Regulation S– 

AM.314 We also indicated that a Covered 

Person’s obligation to provide notice 

and opportunity to opt out would 

depend on the information sharing 

policies of that person and the 

marketing policies of its affiliates.315

After considering a number of factors,316

we estimated in the Proposing Release 

that approximately 10% of Covered 

Persons, or 2,037 respondents, would be 

required to provide consumers with 

notice and an opt out opportunity under 

Regulation S–AM.317 We further 

estimated that 14,259 Covered Persons 

each would require 1 hour on average to 

review its information sharing and 

affiliate marketing policies and practices 

to determine whether notice and an opt 

out opportunity would be necessary. 

After assuming a cost of $125 per hour 

for managerial staff time, we estimated 

that the total one-time cost of review 

would be approximately $1,782,375 

(14,259 × $125). We estimated that, 

upon completion of the review, 2,037 

Covered Persons actually would be 

required to provide a notice and an opt 

out opportunity, and that those persons 

would need an average of 6 hours to 

develop an initial notice and opt out 

form and 2 hours to design notices for 

new customers to receive on an ongoing 

basis (a total of 8 hours per affected 

Covered Person, or 16,296 hours). We 

assumed this time would be divided 

between senior staff, computer 

professionals, and secretarial staff, with 

review by legal professionals. Assuming 

an average per-hour staff cost of $95, we 

estimated the total cost to be $1,548,120 

(16,296 × $95) in the first year. We also 

estimated that each of the 2,037 affected 

Covered Persons would spend 

approximately 2 hours per year (or 

4,074 hours) delivering notices to new 

consumers and recording any opt outs 

that are received on an ongoing basis. 

Finally, we noted that these tasks would 

not require managerial or professional 

involvement; thus, we estimated an 

average staff cost of $40 per hour, for a 

total annual cost of $162,960 (4,074 × 

$40).318

We received one comment on the 

cost-benefit analysis, which stated that 

the estimates understated the 

compliance burden associated with 

Regulation S–AM.319 The commenter 

indicated that the Banking Agencies 

estimated that it would take 

approximately 18 hours to prepare and 

distribute the initial notice to 

customers. It also indicated that 

reprogramming costs could run into the 

millions of dollars for the securities 

industry. The commenter stated that, 

based on the experience of the securities 

industry in complying with the GLBA, 

each firm would have to spend several 

hundred hours to review its information 

sharing and affiliate marketing policies, 

to provide initial notice and opt out, to 

design notices to be sent to new 

customers on an ongoing basis, to 

deliver the notices to customers and to 

record any opt outs that are received. 

The commenter did not provide us with 

specific data regarding its estimates. 

The Commission recognizes that costs 

for developing and maintaining records 

of delivery of affiliate marketing notices 

and recording opt out elections, and 

costs for personal training, will vary 

greatly, depending on the size of a 

financial institution, its customer base, 

number of affiliates, and the extent to 

which the institution intends to share 

information. Accordingly, we have 

revised our estimates to make them 

consistent with the compliance 

estimates provided by the Banking 

Agencies in their Joint Rules,320 to 

update the number of entities subject to 

Regulation S–AM and make the dollar 

costs economically current. For the 

purposes of the final rules, we estimate 

that approximately 5,561 broker-dealers, 

4,586 investment companies, 11,300 

registered investment advisers, and 413 

registered transfer agents will be 

required to comply with Regulation S– 

AM.321 After considering a number of 

factors, we estimate that approximately 

10% of Covered Persons, or 2,186 

respondents, will be required to provide 

consumers with notice and an opt out 

opportunity under Regulation S–AM. 

Moreover, we estimate that 12,242 322

Covered Persons each will require 1 

hour on average to review its 

information sharing and affiliate 

marketing policies and practices to 

determine whether notice and an opt 

out opportunity is necessary. Assuming 

a cost of $180 per hour for managerial 

staff time,323 the staff estimates that the 

total one-time cost of review will be 

approximately $2,203,560 (12,242 × 

$180). Once the review is complete, we 

estimate that 2,186 Covered Persons will 

be required to provide an affiliate 

marketing notice and an opt out 

opportunity, and that those persons will 

need an average of 18 hours to prepare 

an initial notice and distribute it to 

consumers (a total of 39,348 hours). We 

assume that this time will be divided 

between senior staff, computer 

professionals, and secretarial staff, with 

review by legal professionals. We 

estimate an average per-hour staff cost 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40427 

324This estimate is derived from averaging the 

per hour costs of a Programmer Analyst ($194), a 

Senior Database Administrator ($266), a 

Compliance Manager ($245), a Director of 

Compliance ($394), a Paralegal ($168) and a 

Compliance Attorney ($270). See SIFMA Report. 

325This estimate is derived from averaging the 

per hour costs of a Senior General Clerk ($52), a 

General Clerk ($40), an Administrative Assistant 

($65), a Compliance Clerk ($62) and a Data Entry 

Clerk ($61). See SIFMA Report. 

326We note that Regulation S–AM includes 

several considerations that should minimize 

compliance costs for affected persons. First, as 

required by the FACT Act, Regulation S–AM allows 

Covered Persons to combine their affiliate 

marketing opt out notices with any other notice 

required by law, including the privacy notices 

required under the GLBA. Covered Persons are 

already required to provide privacy notices and to 

accept consumer opt out elections related to 

information sharing. Second, Regulation S–AM 

allows Covered Persons some flexibility to develop 

and distribute the affiliate marketing opt out 

notices, and to record opt out elections in the 

manner best suited to their business and needs. 

Third, Regulation S–AM is consistent and 

comparable with the rules proposed by the 

Agencies, which should provide greater certainty to 

Covered Persons that are part of a family of 

affiliated companies because such affiliated 

companies are subject to consistent requirements. 

Finally, Regulation S–AM includes examples that 

provide specific guidance regarding what types of 

policies and procedures Covered Persons could 

develop. 

327As amended, codified at 44 U.S.C. Chapter 35. 

328 44 U.S.C. 3512. 329See Proposing Release at 69 FR 42314–16. 

330This estimate is based upon statistics reported 

on Form ADV, the Universal Application for 

Investment Adviser Registration, which contains 

specific questions regarding affiliations between 

investment advisers and other persons in the 

financial industry. We estimate that other Covered 

Persons would report a rate of affiliation similar to 

that reported by registered investment advisers. 

331For example, professional standards require 

investment advisers to preserve the confidentiality 

of information communicated by clients or 

prospects. See Association for Investment 

Management and Research, Standards of Practice 

Handbook 123, 125 (1996). 

of $256,324 with an estimated total cost 

of $10,073,088 (39,348 × $256) in the 

first year. We also estimate that each of 

the 2,186 Covered Persons will spend 

approximately 4 hours per year (or 

8,744 hours) for creating and delivering 

notices to new consumers and recording 

any opt outs that are received on an 

ongoing basis. Finally, as in the 

Proposing Release, we note that these 

tasks should not require managerial or 

professional involvement. Thus, we 

estimate an average staff cost of $56 per 

hour,325 for a total annual cost of 

$489,664 (8,744 hours × $56).326

VI. Paperwork Reduction Act 

Certain provisions of Regulation S– 

AM may constitute a ‘‘collection of 

information’’ within the meaning of the 

Paperwork Reduction Act of 1995.327

The Commission submitted Regulation 

S–AM to the Office of Management and 

Budget (‘‘OMB’’) for review in 

accordance with 44 U.S.C. 3507(d) and 

5 CFR 1320.11, and the OMB approved 

the collection of information. The title 

for the collection of information is 

‘‘Regulation S–AM: Limitations on 

Affiliate Marketing,’’ its expiration date 

is November 30, 2010, and its OMB 

control number is 3235–0609. An 

agency may not conduct or sponsor, and 

a person is not required to respond to, 

a collection of information unless it 

displays a currently valid OMB control 

number.328 Responses to these 

collections of information will not be 

kept confidential. The Commission 

received no comments on the PRA 

analysis included in its proposal to 

adopt Regulation S–AM.329 We do not 

believe that any differences between 

Regulation S–AM as proposed and 

Regulation S–AM as adopted, including 

the increase in average estimated 

burden hours, would significantly affect 

the collection of information or the 

estimated hour burden associated with 

the collection of information. 

A. Collection of Information 

Before an affiliate may use eligibility 

information received from another 

affiliate to make marketing solicitations 

to a consumer, the consumer must be 

provided with a notice informing the 

individual of his or her right to opt out 

of such marketing. In addition, as a 

practical matter, Covered Persons must 

keep records of any opt out elections in 

order for the opt outs to be effective. 

The opt out period must last at least five 

years. At the end of the opt out period, 

the consumer must be provided with a 

renewal notice and a new chance to opt 

out before the resumption of marketing 

solicitations to the consumer based on 

the consumer’s eligibility information. 

Notice and opt out are only required 

if a Covered Person uses eligibility 

information from an affiliate for use in 

marketing solicitations. Covered Persons 

that do not have affiliates, or whose 

affiliates do not make marketing 

solicitations based on eligibility 

information received from a Covered 

Person, are not required to provide 

notice and opt out. Regulation S–AM 

contains a number of other exceptions 

as directed by Section 214 of the FACT 

Act, such as for situations in which the 

affiliate has a pre-existing business 

relationship with the consumer or in 

which the consumer requests marketing 

information. In the final rules, we have 

attempted to retain procedural 

flexibility and to minimize compliance 

burdens except as required by the terms 

of the FACT Act. 

B. Use of Information 

Section 624 of the FCRA is intended 

to enhance the protection of consumer 

financial information in the affiliate 

marketing context and to enable 

consumers to limit Covered Persons 

from using eligibility information they 

receive from an affiliate to make 

marketing solicitations. Regulation S– 

AM is necessary to fulfill the statutory 

mandate, in Section 214 of the FACT 

Act, that the Commission prescribe 

regulations to implement Section 624. 

C. Respondents 

We estimate that approximately 5,561 

broker-dealers, 4,586 investment 

companies, 11,300 registered 

investment advisers, and 413 registered 

transfer agents will be required to 

comply with Regulation S–AM. 

However, we expect that only a fraction 

of all Covered Persons will be required 

to provide notices and opt out 

opportunities to consumers. First, the 

rules only apply to Covered Persons that 

have affiliates, and then only if affiliates 

receiving eligibility information make 

marketing solicitations based on the 

eligibility information received from a 

Covered Person. Based on a review of 

forms filed with the Commission, we 

estimate that approximately 56% of 

Covered Persons have an affiliate.330

However, we assume that many of those 

Covered Persons do not communicate 

eligibility information to their affiliates 

for marketing purposes and thus will 

not be subject to the notice and opt out 

requirements of Regulation S–AM.331

The rules also incorporate a number of 

statutory exceptions that further reduce 

the number of Covered Persons required 

to provide affiliate marketing notices. In 

addition, any notices required by 

Regulation S–AM can be combined with 

notices already required by Regulation 

S–P. Further, if notice is required, 

Regulation S–AM allows all affiliates 

under common ownership or control to 

provide a single, joint notice. 

Accordingly, Covered Persons that are 

required to provide affiliate marketing 

notices could be covered by a notice 

sent by one or more affiliates, and may 

not be required to provide a notice 

independently. In light of these factors, 

we estimate that approximately 10% of 

Covered Persons, or approximately 

2,186 respondents, will be required to 

provide consumers with notices and an 

opportunity to opt out under Regulation 

S–AM. 

D. Total Annual Reporting and 

Recordkeeping Burdens 

Every Covered Person that has one or 

more affiliates likely would incur a onetime burden in reviewing its policies 

and business practices to determine the 


srobinson on DSKHWCL6B1PROD with RULES3
40428 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

332See 17 CFR 248.6(a)(3) (initial, annual, and 

revised GLBA privacy notices must include ‘‘the 

categories of affiliates * * * to whom you disclose 

nonpublic personal information’’). Transfer agents 

are subject to consistent and comparable 

requirements promulgated by the Agencies. 

333Because we assume that most affiliate 

marketing notices will be combined with other 

required mailings, we base our estimates on the 

resources required to integrate an affiliate marketing 

notice into another mailing, rather than on the 

resources required to create and send a separate 

mailing. 

334See discussion of new cost estimates and 

burden hours supra Part V. 

335See discussion of consolidated notices supra 

Part III.F.2. 

336See discussion of new cost estimates and 

burden hours supra Part V. 

337 In order to ease the burden of tracking each 

opt out period, many affiliated persons may decide 

to implement an opt out period of longer than five 

years, including a period that never expires. 

extent to which it communicates 

eligibility information to affiliates for 

marketing purposes and whether those 

affiliates make marketing solicitations 

based on that eligibility information. 

This determination should be 

straightforward for most entities, in part 

because GLBA privacy regulations 

already require Covered Persons other 

than transfer agents to review their 

information sharing practices and 

disclose whether they share information 

with affiliates.332 We estimate that 

approximately 56% of all Covered 

Persons, or approximately 12,242, have 

an affiliate. The amount of time required 

to review their policies will vary 

widely, from a few minutes for those 

that do not share eligibility information 

with affiliates to 4 hours or more for 

Covered Persons with more complex 

information sharing arrangements. We 

estimate that each Covered Person will 

require 1 hour on average to review its 

policies and practices, for a total onetime burden of 12,242 hours. We 

estimate that 2,186 Covered Persons will 

be required to provide notice and opt 

out opportunities under the rules. This 

process consists of several steps. First, 

an affiliate marketing notice would have 

to be created. The amount of time 

required to develop a notice should be 

reduced significantly by the inclusion of 

model forms in Regulation S–AM. 

Second, the notices will need to be 

delivered. The final rules allow that 

affiliate marketing notices may be 

combined with any other notice or 

disclosure required by law. We expect 

that most Covered Persons will combine 

their affiliate marketing notices with 

some other form of communication, 

such as an account statement or an 

annual privacy notice under the GLBA. 

Because those communications are 

already delivered to consumers, adding 

a brief affiliate marketing notice should 

not result in added costs for processing 

or for postage and materials.333 Notices 

may be delivered electronically to 

consumers who have agreed to 

electronic communications, which 

should further reduce the costs of 

delivery. Third, as a practical matter, 

Covered Persons will need to keep 

accurate records in order to honor any 

opt out elections and to track the 

expiration of the opt out period. The 

number of actual notice mailings in any 

given year will depend on the number 

of consumers who do business with 

each affected person. For purposes of 

the PRA, we estimate that the hour 

burden for developing, sending, and 

tracking the opt out notices will range 

from 2–50 hours, with an average of 18 

hours for each Covered Person (39,348 

hours total).334 We estimate that postage 

and materials costs for the notices 

would be negligible because the notices 

likely will be combined with other 

required mailings.335

Because the notice and opt out 

requirements are a prerequisite to 

conducting covered forms of affiliate 

marketing, most Covered Persons would 

provide notice within the first year after 

which compliance with Regulation S– 

AM is required. However, additional 

notices will be required as new 

customer relationships are formed. We 

anticipate that many Covered Persons 

will ensure delivery to new consumers 

with a minimum of additional effort by 

providing or combining the notices with 

other documents such as account 

opening documents or initial GLBA 

privacy notices. Accordingly, we 

estimate an ongoing annual burden of 4 

hours per year (or 8,744 hours total) for 

creating and delivering notices to new 

consumers and recording any opt outs 

that are received on an ongoing basis.336

A consumer opt out may expire at the 

end of five years, as long as the person 

that provided the initial notice provides 

the consumer with renewed notice and 

an opportunity to extend his or her opt 

out election before any affiliate 

marketing may begin.337 Designing, 

sending, and recording opt out renewal 

notices will require additional hours 

and costs. However, because the initial 

opt out period must last for at least five 

years, any burden related to renewal 

notices would not arise within the first 

four years of the collection of 

information. 

In sum, we estimate that each of 

approximately 12,242 Covered Persons 

will require an average one-time burden 

of 1 hour to review affiliate marketing 

practices (12,242 hours total). We 

estimate that the approximately 2,186 

Covered Persons required to provide 

notices and opt out opportunities will 

incur an average first-year burden of 18 

hours to provide notices and allow for 

consumer opt outs, for a total estimated 

first-year burden of 39,348 hours. With 

regard to continuing notice burdens, we 

estimate that each of the approximately 

2,186 Covered Persons required to 

provide notices and opt out 

opportunities will incur an annual 

burden of 2 hours to develop notices for 

new consumers (4,372 hours total) and 

an annual burden of 2 hours to deliver 

the notices and record any opt outs for 

new consumers (4,372 hours total). 

These estimates represent a total onetime burden of 51,590 hours (12,242 

hours plus 39,348 hours) and an 

ongoing annual burden of 8,744 hours 

(4,372 hours plus 4,372 hours). We do 

not expect that Covered Persons will 

incur start-up or materials costs in 

addition to the staff time discussed 

above. 

E. Retention Period for Recordkeeping 

Requirements 

Regulation S–AM does not contain 

express provisions governing the 

retention of records related to opt outs. 

However, as noted above, a person 

subject to Regulation S–AM would need 

to keep some record of consumer opt 

outs in order to know which consumers 

should not receive marketing 

solicitations based on eligibility 

information. These records would need 

to be retained for at least as long as the 

opt out period of five or more years, so 

that the person responsible for 

providing the renewal notice would 

know when that notice is required. 

F. Collection of Information Is 

Mandatory 

As noted, Covered Persons that use 

eligibility information from their 

affiliates for marketing purposes will be 

required to comply with the notice and 

opt out provisions of Regulation S–AM. 

Assuming that no other exception 

applies, the disclosure and 

recordkeeping requirements will be 

mandatory with respect to those 

Covered Persons. 

VII. Final Regulatory Flexibility 

Analysis 

The Commission has prepared this 

Final Regulatory Flexibility Analysis for 

Regulation S–AM in accordance with 5 

U.S.C. 604. 

A. Need for the Rule 

Regulation S–AM implements Section 

214 of the FACT Act (which added new 

Section 624 to the FCRA) that, in 

general, prohibits a person from using 

certain information received from an 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40429 

338Public Law 108–159, 117 Stat. 1952 (2003). 

339 15 U.S.C. 78q, 78q–1, 78w, and 78mm. 

340 15 U.S.C. 80a–30 and 80a–37. 

341 15 U.S.C. 80b–4 and 80b–11. 

342For purposes of the Regulatory Flexibility Act, 

under the Exchange Act a small entity is a broker 

or dealer that had total capital of less than $500,000 

on the date of its prior fiscal year and is not 

affiliated with any person that is not a small entity. 

17 CFR 240.0–10. Under the Investment Company 

Act a ‘‘small entity’’ is an investment company that, 

together with other investment companies in the 

same group of related investment companies, has 

net assets of $50 million or less as of the end of 

its most recent fiscal year. 17 CFR 270.0–10. Under 

the Investment Advisers Act, a small entity is an 

investment adviser that: (i) Manages less than $25 

million in assets, (ii) has total assets of less than $5 

million on the last day of its most recent fiscal year, 

and (iii) does not control, is not controlled by, and 

is not under common control with another 

investment adviser that manages $25 million or 

more in assets, or any person that had total assets 

of $5 million or more on the last day of the most 

recent fiscal year. 17 CFR 275.0–7. A small entity 

in the transfer agent context is defined to be any 

transfer agent that (i) received less than 500 items 

for transfer and less than 500 items for processing 

during the preceding six months: (ii) transferred 

only items of issuers that would be deemed ‘‘small 

businesses’’ or ‘‘small organizations’’ under Rule 0– 

10 under the Exchange Act; (iii) maintained master 

shareholder files that in the aggregate contained less 

than 1,000 shareholder accounts at all times during 

the preceding fiscal year; and (iv) is not affiliated 

with any person (other than a natural person) that 

is not a small business or small organization under 

Rule 0–10. 17 CFR 240.0–10. 343See § 248.123(a). 

affiliate to make marketing solicitations 

to a consumer, unless the consumer is 

given notice, as well as an opportunity 

and a simple method to opt out, of the 

possibility of receiving such 

solicitations. Section 214 also required 

the Agencies and the Commission, in 

consultation and coordination with one 

another, to issue implementing 

regulations that are consistent and 

comparable to the extent possible. The 

objectives of Regulation S–AM are 

discussed in detail in the Background, 

Overview of Comments Received and 

Explanation of Regulation S–AM, and 

Section-by-Section Analysis at Sections 

I through III above. The legal basis for 

Regulation S–AM is Section 214 of the 

FACT Act,338 as well as Sections 17, 

17A, 23, and 36 of the Exchange Act,339

Sections 31 and 38 of the Investment 

Company Act,340 and Sections 204 and 

211 of the Investment Advisers Act.341

The Commission received no comments 

regarding the Initial Regulatory 

Flexibility Analysis. 

B. Description of Small Entities to 

Which the Final Rules Will Apply 

Regulation S–AM applies to any 

Covered Person that uses eligibility 

information for the purpose of making 

marketing solicitations. Of the entities 

registered with the Commission, 896 

broker-dealers, 197 investment 

companies, 671 registered investment 

advisers, and 76 registered transfer 

agents are considered small entities.342

Only affiliated entities are subject to 

Regulation S–AM. We estimate that 

56% of all Covered Persons have 

affiliates, although it is not clear 

whether small entities differ 

significantly from larger entities in their 

rates of corporate affiliation. While we 

invited comment from small entities 

that would be subject to the proposed 

rules as well as general comment 

regarding information that would help 

us to quantify the number of small 

entities that may be affected by 

Regulation S–AM, we received none. 

C. Projected Reporting, Recordkeeping, 

and Other Compliance Requirements 

Regulation S–AM requires Covered 

Persons to provide consumers with 

notice and an opportunity to opt out of 

affiliated persons’ use of eligibility 

information for marketing purposes. The 

final rule prohibits a Covered Person 

from using eligibility information 

received from an affiliate to make 

marketing solicitations to consumers, 

unless: (1) The potential marketing use 

of the information has been clearly, 

conspicuously and concisely disclosed 

to the consumer; (2) the consumer has 

been provided a reasonable opportunity 

and a simple method to opt out of 

receiving the marketing solicitation; and 

(3) the consumer has not opted out. 

For those entities that provide the 

Section 624 notice in consolidation with 

other documents such as notices 

provided under the GLBA or other 

Federally mandated disclosures, the 

final rules impose very limited 

additional reporting or recordkeeping 

requirements. However, for Covered 

Persons that choose to send the notices 

separately, the reporting and 

recordkeeping requirements and other 

compliance requirements may be more 

substantial. Although the final rules do 

not include specific recordkeeping 

requirements, in practice some system 

of recordkeeping must exist to ensure 

that any consumer opt outs are honored. 

There are a number of features of the 

FACT Act’s affiliate marketing 

provisions as implemented by 

Regulation S–AM that limit its scope. 

First, the law only applies to the use of 

eligibility information by affiliates for 

the purpose of making marketing 

solicitations. Thus, affiliates that make 

marketing solicitations based solely 

upon their own information or without 

regard to eligibility information are not 

affected by this law. Second, the law 

provides exceptions to its notice and opt 

out requirements that permit Covered 

Persons to market to consumers with 

whom they have a ‘‘pre-existing 

business relationship’’ or from whom 

they have received a request for 

information. Third, § 248.123(a)(1)(i) 

allows a single, joint notice to be sent 

to a consumer on behalf of multiple 

affiliates. 

A number of alternatives exist that 

could reduce the costs associated with 

compliance with Regulation S–AM. 

First, significant cost savings may be 

obtained by consolidating affiliate 

marketing notices with GLBA privacy 

notices or with other documents 

provided to consumers such as account 

statements. In addition, the model forms 

could be used for opt out notices that 

comply with the requirements of the 

rules. Regulation S–AM also permits 

Covered Persons to reduce the need for 

ongoing tracking by offering a 

permanent opt out from both the sharing 

of information between affiliates and 

from receiving marketing based on such 

sharing, which would be consistent 

with both the GLBA and FCRA notice 

and opt out requirements as well as 

with the FACT Act’s notice and opt out 

requirements. Small entities may wish 

to consider whether consolidation of 

their privacy and affiliate marketing 

notices and opt out forms can reduce 

their compliance costs. Similar 

considerations can reduce the burden of 

providing affiliate marketing notices to 

new consumers. For example, as long as 

the notices remain clear, conspicuous, 

and concise,343 small entity Covered 

Persons can combine affiliate marketing 

notices with account opening 

documents or initial privacy notices 

provided under the GLBA in order to 

ensure that affiliate marketing notices 

are delivered to new consumers without 

substantial additional efforts on the part 

of the Covered Person. 

The Commission was concerned 

about the potential impact of the 

proposed rules on small entities and 

requested comment on: (1) The potential 

impact of any or all of the provisions in 

the proposed rules, including any 

benefits and costs, that the Commission 

should consider; (2) the costs and 

benefits of any alternatives, paying 

special attention to the effect of the 

proposed rules on small entities in light 

of the above analysis; (3) costs to 

implement and to comply with the 

proposed rules, including any 

expenditure of time or money for, for 

example, employee training, legal 

counsel, or other professional time, for 

preparing and processing the notices; 

and (4) costs to record and track 

consumers’ elections to opt out. We 

received no comments on these issues. 


srobinson on DSKHWCL6B1PROD with RULES3
40430 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

344See discussion of overlap of Regulation S–AM 

with the affiliate sharing provisions of the FCRA 

supra Parts II.B and III. 

345 15 U.S.C. 78w(a)(2). 

346See Joint Rules and FTC rule. 

347 15 U.S.C. 78c(f). 

348 15 U.S.C. 80a–2(c). 

349See Proposing Release at 69 FR 42318. 

350Public Law 108–159, Section 214, 117 Stat. 

1952 (2003). 

351 15 U.S.C. 78q, 78q–1, 78w, and 78mm. 

352 15 U.S.C. 80a–30 and 80a–37. 

353 15 U.S.C. 80b–4 and 80b–11. 

D. Identification of Other Duplicative, 

Overlapping, or Conflicting Federal 

Rules 

With the exception of the opt out for 

affiliate sharing under Section 

603(d)(2)(A)(iii) of the FCRA, we have 

not identified any Federal statutes or 

regulations that duplicate, overlap, or 

conflict with Regulation S–AM. As 

discussed previously, while there is 

some overlap between Regulation S–AM 

and the affiliate sharing provisions of 

the FCRA and the notice provisions of 

Regulation S–P, we expect that Covered 

Persons will consolidate the notice 

provisions of Regulation S–AM, the 

affiliate sharing provisions of the FCRA 

and the privacy notice provisions of 

Regulation S–P.344 We sought and 

received no comment regarding any 

other statute or regulation, including 

State or local statutes or regulations, 

that would duplicate, overlap, or 

conflict with the proposed rules. 

E. Agency Actions To Minimize Effects 

on Small Entities 

The Regulatory Flexibility Act directs 

the Commission to consider significant 

alternatives that would accomplish the 

stated objectives of a rule while 

minimizing any significant adverse 

impact on small businesses. In 

connection with Regulation S–AM, the 

Commission considered the following 

alternatives: (1) The establishment of 

differing compliance or reporting 

requirements or timetables that take into 

account the resources available to small 

entities; (2) the clarification, 

consolidation, or simplification of 

compliance and reporting requirements 

under the proposed rules for small 

entities; (3) the use of performance 

rather than design standards; and (4) an 

exemption from coverage of the 

proposed rules, or any part thereof, for 

small entities. 

The Commission does not believe that 

an exemption from coverage or special 

compliance or reporting requirements 

for small entities would be consistent 

with the mandates of the FACT Act. 

Section 214 of the FACT Act addresses 

the protection of consumer privacy, and 

consumer privacy concerns do not 

depend on the size of the entity 

involved. However, we have endeavored 

throughout the final rules to minimize 

the regulatory burden on all Covered 

Persons, including small entities, while 

meeting the statutory requirements. 

Small entities should benefit from the 

existing emphasis on performance 

rather than design standards throughout 

the final rules and the use of examples, 

including model forms for affiliate 

marketing notices. The Commission 

solicited and received no comment on 

any alternative system that would be 

consistent with the FACT Act but would 

minimize the impact on small entities. 

VIII. Consideration of Burden on 

Competition, and Promotion of 

Efficiency, Competition, and Capital 

Formation 

Section 23(a)(2) of the Exchange 

Act 345 requires the Commission, in 

adopting rules under the Exchange Act, 

to consider the impact that the rules 

may have upon competition. Regulation 

S–AM, which implements Section 214 

of the FACT Act, applies to all brokers, 

dealers, investment companies, 

registered investment advisers, and 

registered transfer agents. Each of these 

entities must provide notice and an 

opportunity to opt out to customers 

before an affiliate uses eligibility 

information to make marketing 

solicitations to consumers. Because 

other entities will be subject to 

substantially similar affiliate marketing 

and opt out notice rules adopted by the 

Agencies,346 all financial institutions 

will have to bear costs of implementing 

the rules or substantially similar rules. 

We do not believe the rules will result 

in anti-competitive effects. Other 

affiliated persons that make marketing 

solicitations using eligibility 

information received from a Covered 

Person subject to Regulation S–AM or 

the substantially similar rules of the 

Agencies will be subject to substantially 

similar requirements. Therefore, all 

persons that engage in affiliate 

marketing based on eligibility 

information will be required to bear the 

costs of implementing the rules or 

substantially similar rules. Although 

these costs may vary among persons 

subject to the various affiliate marketing 

rules, we do not believe that the costs 

would be significantly greater for any 

particular entity or entities based on 

which affiliate marketing rule applies to 

that entity. 

Section 3(f) of the Exchange Act,347

Section 202(c) of the Investment 

Advisers Act, and Section 2(c) of the 

Investment Company Act 348 require the 

Commission, when engaging in 

rulemaking to consider or determine 

whether an action is necessary or 

appropriate in the public interest, to 

consider whether the action will 

promote efficiency, competition, and 

capital formation. We solicited 

comment on these issues but received 

none.349 The rules will result in 

additional costs for Covered Persons 

and their affiliates, which may affect 

their efficiency. As discussed above, 

however, the rules and the model forms 

should promote efficiency by 

minimizing compliance costs. The 

ability of Covered Persons and their 

affiliates to use joint notices should 

further promote efficiency by facilitating 

the use of notices already prepared by 

affiliates and the allocation of 

compliance and notice delivery costs 

among affiliates. The rules and model 

forms also should promote competition 

among Covered Persons and between 

Covered Persons and other types of 

entities subject to the affiliate marketing 

rules of the Agencies by providing a 

common set of requirements relating to 

the use of eligibility information for 

affiliate marketing purposes. We are not 

aware of any effect the final rules will 

have on capital formation. 

IX. Statutory Authority 

The Commission is adopting 

Regulation S–AM and making 

conforming, technical amendments to 

Regulation S–P under the authority set 

forth in Section 214 of the FACT Act,350

Sections 17, 17A, 23, and 36 of the 

Exchange Act,351 Sections 31 and 38 of 

the Investment Company Act,352 and 

Sections 204 and 211 of the Investment 

Advisers Act.353

X. Text of Final Rules 

List of Subjects in 17 CFR Part 248 

Affiliate marketing, Brokers, 

Consumer protection, Dealers, 

Investment advisers, Investment 

companies, Privacy, Reporting and 

recordkeeping requirements, Securities, 

Transfer agents. 

■ For the reasons stated in the preamble, 

the Securities and Exchange 

Commission amends 17 CFR part 248 as 

follows: 

PART 248—REGULATIONS S–P AND 

S–AM 

■ 1. The authority citation for part 248 

is revised to read as follows: 

Authority: 15 U.S.C. 78q, 78q–1, 78w, 

78mm, 80a–30, 80a–37, 80b–4, 80b–11, 

1681s–3 and note, 1681w(a)(1), 6801–6809, 

and 6825. 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40431 

■ 2. The heading for part 248 is revised 

to read as set forth above. 

■ 3. In part 248, wherever it may occur, 

remove each reference to ‘‘this part’’ and 

add the reference ‘‘this subpart’’ in its 

place. 

§ 248.3 [Amended] 

■ 4. In § 248.3, amend paragraphs (a)(1), 

(a)(2) and (p) by removing the reference 

‘‘G–L–B Act’’ and adding the reference 

‘‘GLBA’’ in its place. 

Subpart A—[Amended] 

■ 5. Remove the heading of subpart A of 

part 248 and add in its place the 

following undesignated center heading: 

‘‘Privacy and Opt Out Notices’’. 

Subpart B—[Amended] 

■ 6. Remove the heading of subpart B of 

part 248 and add in its place the 

following undesignated center heading: 

‘‘Limits on Disclosures’’. 

Subpart C—[Amended] 

■ 7. Remove the heading of subpart C of 

part 248 and add in its place the 

following undesignated center heading: 

‘‘Exceptions’’. 

Subpart D—[Amended] 

■ 8. Remove the heading of subpart D of 

part 248 and add in its place the 

following undesignated center heading: 

‘‘Relation to Other Laws; Effective 

Date’’. 

Subpart A—Regulation S–P: Privacy of 

Consumer Financial Information and 

Safeguarding Personal Information 

■ 9. Designate §§ 248.1 through 248.30 

as subpart A and add a heading to read 

as set forth above. 

■ 10. Reserve §§ 248.31 through 248.100 

in subpart A. 

Appendix A to Subpart A 

[Redesignated as Appendix B to 

Subpart A] 

■ 11. Appendix A to part 248 is 

redesignated as Appendix B to subpart 

A. 

■ 12a. A new Appendix A to Subpart A 

is added and reserved to read as follows: 

Appendix A to Subpart A—Forms 

[Reserved] 

■ 12b. The heading for newly 

redesignated Appendix B to Subpart A 

is revised to read as follows: 

Appendix B to Subpart A—Sample 

Clauses 

■ 13. Subpart B (§§ 248.101 through 

248.128 and Appendix to Subpart B) is 

added to part 248 to read as follows: 

Subpart B—Regulation S–AM: Limitations 

on Affiliate Marketing 

Sec. 

248.101 Purpose and scope. 

248.102 Examples. 

248.103–248.119 [Reserved] 

248.120 Definitions. 

248.121 Affiliate marketing opt out and 

exceptions. 

248.122 Scope and duration of opt out. 

248.123 Contents of opt out notice; 

consolidated and equivalent notices. 

248.124 Reasonable opportunity to opt out. 

248.125 Reasonable and simple methods of 

opting out. 

248.126 Delivery of opt out notices. 

248.127 Renewal of opt out elections. 

248.128 Effective date, compliance date, 

and prospective application. 

Appendix to Subpart B—Model Forms 

Subpart B—Regulation S–AM: 

Limitations on Affiliate Marketing 

§ 248.101 Purpose and scope. 

(a) Purpose. The purpose of this 

subpart is to implement section 624 of 

the Fair Credit Reporting Act, 15 U.S.C. 

1681, et seq. (‘‘FCRA’’). Section 624, 

which was added to the FCRA by 

section 214 of the Fair and Accurate 

Credit Transactions Act of 2003, Public 

Law 108–159, 117 Stat. 1952 (2003) 

(‘‘FACT Act’’ or ‘‘Act’’), regulates the 

use of consumer information received 

from an affiliate to make marketing 

solicitations. 

(b) Scope. This subpart applies to any 

broker or dealer other than a noticeregistered broker or dealer, to any 

investment company, and to any 

investment adviser or transfer agent 

registered with the Commission. These 

entities are referred to in this subpart as 

‘‘you.’’ 

§ 248.102 Examples. 

The examples in this subpart are not 

exclusive. The examples in this subpart 

provide guidance concerning the rules’ 

application in ordinary circumstances. 

The facts and circumstances of each 

individual situation, however, will 

determine whether compliance with an 

example, to the extent applicable, 

constitutes compliance with this 

subpart. Examples in a paragraph 

illustrate only the issue described in the 

paragraph and do not illustrate any 

other issue that may arise under this 

subpart. Similarly, the examples do not 

illustrate any issues that may arise 

under other laws or regulations. 

§§ 248.103–248.119 [Reserved] 

§ 248.120 Definitions. 

As used in this subpart, unless the 

context requires otherwise: 

(a) Affiliate of a broker, dealer, or 

investment company, or an investment 

adviser or transfer agent registered with 

the Commission means any person that 

is related by common ownership or 

common control with the broker, dealer, 

or investment company, or the 

investment adviser or transfer agent 

registered with the Commission. In 

addition, a broker, dealer, or investment 

company, or an investment adviser or 

transfer agent registered with the 

Commission will be deemed an affiliate 

of a company for purposes of this 

subpart if: 

(1) That company is regulated under 

section 214 of the FACT Act, Public 

Law 108–159, 117 Stat. 1952 (2003), by 

a government regulator other than the 

Commission; and 

(2) Rules adopted by the other 

government regulator under section 214 

of the FACT Act treat the broker, dealer, 

or investment company, or investment 

adviser or transfer agent registered with 

the Commission as an affiliate of that 

company. 

(b) Broker has the same meaning as in 

section 3(a)(4) of the Securities 

Exchange Act of 1934 (15 U.S.C. 

78c(a)(4)). A ‘‘broker’’ does not include 

a broker registered by notice with the 

Commission under section 15(b)(11) of 

the Securities Exchange Act of 1934 (15 

U.S.C. 78o(b)(11)). 

(c) Clear and conspicuous means 

reasonably understandable and 

designed to call attention to the nature 

and significance of the information 

presented. 

(d) Commission means the Securities 

and Exchange Commission. 

(e) Company means any corporation, 

limited liability company, business 

trust, general or limited partnership, 

association, or similar organization. 

(f) Concise. (1) In general. The term 

‘‘concise’’ means a reasonably brief 

expression or statement. 

(2) Combination with other required 

disclosures. A notice required by this 

subpart may be concise even if it is 

combined with other disclosures 

required or authorized by Federal or 

State law. 

(g) Consumer means an individual. 

(h) Control of a company means the 

power to exercise a controlling 

influence over the management or 

policies of a company whether through 

ownership of securities, by contract, or 

otherwise. Any person who owns 

beneficially, either directly or through 

one or more controlled companies, more 


srobinson on DSKHWCL6B1PROD with RULES3
40432 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

than 25 percent of the voting securities 

of any company is presumed to control 

the company. Any person who does not 

own more than 25 percent of the voting 

securities of any company will be 

presumed not to control the company. 

Any presumption regarding control may 

be rebutted by evidence, but, in the case 

of an investment company, will 

continue until the Commission makes a 

decision to the contrary according to the 

procedures described in section 2(a)(9) 

of the Investment Company Act of 1940 

(15 U.S.C. 80a–2(a)(9)). 

(i) Dealer has the same meaning as in 

section 3(a)(5) of the Securities 

Exchange Act of 1934 (15 U.S.C. 

78c(a)(5)). A ‘‘dealer’’ does not include 

a dealer registered by notice with the 

Commission under section 15(b)(11) of 

the Securities Exchange Act of 1934 (15 

U.S.C. 78o(b)(11)). 

(j) Eligibility information means any 

information the communication of 

which would be a consumer report if 

the exclusions from the definition of 

‘‘consumer report’’ in section 

603(d)(2)(A) of the FCRA did not apply. 

Eligibility information does not include 

aggregate or blind data that does not 

contain personal identifiers such as 

account numbers, names, or addresses. 

(k) FCRA means the Fair Credit 

Reporting Act (15 U.S.C. 1681, et seq.). 

(l) GLBA means the Gramm-LeachBliley Act (15 U.S.C. 6801, et seq.). 

(m) Investment adviser has the same 

meaning as in section 202(a)(11) of the 

Investment Advisers Act of 1940 (15 

U.S.C. 80b–2(a)(11)). 

(n) Investment company has the same 

meaning as in section 3 of the 

Investment Company Act of 1940 (15 

U.S.C. 80a–3) and includes a separate 

series of the investment company. 

(o) Marketing solicitation. (1) In 

general. The term ‘‘marketing 

solicitation’’ means the marketing of a 

product or service initiated by a person 

to a particular consumer that is: 

(i) Based on eligibility information 

communicated to that person by its 

affiliate as described in this subpart; and 

(ii) Intended to encourage the 

consumer to purchase or obtain such 

product or service. 

(2) Exclusion of marketing directed at 

the general public. A marketing 

solicitation does not include marketing 

communications that are directed at the 

general public. For example, television, 

general circulation magazine, billboard 

advertisements and publicly available 

Web sites that are not directed to 

particular consumers would not 

constitute marketing solicitations, even 

if those communications are intended to 

encourage consumers to purchase 

products and services from the person 

initiating the communications. 

(3) Examples of marketing 

solicitations. A marketing solicitation 

would include, for example, a 

telemarketing call, direct mail, e-mail, 

or other form of marketing 

communication directed to a particular 

consumer that is based on eligibility 

information received from an affiliate. 

(p) Person means any individual, 

partnership, corporation, trust, estate, 

cooperative, association, government or 

governmental subdivision or agency, or 

other entity. 

(q) Pre-existing business relationship. 

(1) In general. The term ‘‘pre-existing 

business relationship’’ means a 

relationship between a person, or a 

person’s licensed agent, and a consumer 

based on: 

(i) A financial contract between the 

person and the consumer which is in 

force on the date on which the 

consumer is sent a solicitation covered 

by this subpart; 

(ii) The purchase, rental, or lease by 

the consumer of the person’s goods or 

services, or a financial transaction 

(including holding an active account or 

a policy in force or having another 

continuing relationship) between the 

consumer and the person, during the 18- 

month period immediately preceding 

the date on which the consumer is sent 

a solicitation covered by this subpart; or 

(iii) An inquiry or application by the 

consumer regarding a product or service 

offered by that person during the threemonth period immediately preceding 

the date on which the consumer is sent 

a solicitation covered by this subpart. 

(2) Examples of pre-existing business 

relationships. (i) If a consumer has a 

brokerage account with a broker-dealer 

that is currently in force, the brokerdealer has a pre-existing business 

relationship with the consumer and can 

use eligibility information it receives 

from its affiliates to make solicitations 

to the consumer about its products or 

services. 

(ii) If a consumer has an investment 

advisory contract with a registered 

investment adviser, the investment 

adviser has a pre-existing business 

relationship with the consumer and can 

use eligibility information it receives 

from its affiliates to make solicitations 

to the consumer about its products or 

services. 

(iii) If a consumer was the record 

owner of securities issued by an 

investment company, but the consumer 

redeems these securities, the investment 

company has a pre-existing business 

relationship with the consumer and can 

use eligibility information it receives 

from its affiliates to make solicitations 

to the consumer about its products or 

services for 18 months after the date the 

consumer redeemed the investment 

company’s securities. 

(iv) If a consumer applies for a margin 

account offered by a broker-dealer, but 

does not obtain a product or service 

from or enter into a financial contract or 

transaction with the broker-dealer, the 

broker-dealer has a pre-existing business 

relationship with the consumer and can 

therefore use eligibility information it 

receives from its affiliates to make 

solicitations to the consumer about its 

products or services for three months 

after the date of the application. 

(v) If a consumer makes a telephone 

inquiry to a broker-dealer about its 

products or services and provides 

contact information to the broker-dealer, 

but does not obtain a product or service 

from or enter into a financial contract or 

transaction with the institution, the 

broker-dealer has a pre-existing business 

relationship with the consumer and can 

therefore use eligibility information it 

receives from its affiliates to make 

solicitations to the consumer about its 

products or services for three months 

after the date of the inquiry. 

(vi) If a consumer makes an inquiry by 

e-mail to a broker-dealer about one of its 

affiliated investment company’s 

products or services but does not obtain 

a product or service from, or enter into 

a financial contract or transaction with 

the broker-dealer or the investment 

company, the broker-dealer and the 

investment company both have a preexisting business relationship with the 

consumer and can therefore use 

eligibility information they receive from 

their affiliates to make solicitations to 

the consumer about their products or 

services for three months after the date 

of the inquiry. 

(vii) If a consumer who has a preexisting business relationship with an 

investment company that is part of a 

group of affiliated companies makes a 

telephone call to the centralized call 

center for the affiliated companies to 

inquire about products or services 

offered by a broker-dealer affiliated with 

the investment company, and provides 

contact information to the call center, 

the call constitutes an inquiry to the 

broker-dealer. In these circumstances, 

the broker-dealer has a pre-existing 

business relationship with the consumer 

and can therefore use eligibility 

information it receives from the 

investment company to make 

solicitations to the consumer about its 

products or services for three months 

after the date of the inquiry. 

(3) Examples where no pre-existing 

business relationship is created. (i) If a 

consumer makes a telephone call to a 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40433 

centralized call center for a group of 

affiliated companies to inquire about the 

consumer’s existing account at a brokerdealer, the call does not constitute an 

inquiry to any affiliate other than the 

broker-dealer that holds the consumer’s 

account and does not establish a preexisting business relationship between 

the consumer and any affiliate of the 

account-holding broker-dealer. 

(ii) If a consumer who has an advisory 

contract with a registered investment 

adviser makes a telephone call to an 

affiliate of the investment adviser to ask 

about the affiliate’s retail locations and 

hours, but does not make an inquiry 

about the affiliate’s products or services, 

the call does not constitute an inquiry 

and does not establish a pre-existing 

business relationship between the 

consumer and the affiliate. Also, the 

affiliate’s capture of the consumer’s 

telephone number does not constitute 

an inquiry and does not establish a preexisting business relationship between 

the consumer and the affiliate. 

(iii) If a consumer makes a telephone 

call to a broker-dealer in response to an 

advertisement offering a free 

promotional item to consumers who call 

a toll-free number, but the 

advertisement does not indicate that the 

broker-dealer’s products or services will 

be marketed to consumers who call in 

response, the call does not create a preexisting business relationship between 

the consumer and the broker-dealer 

because the consumer has not made an 

inquiry about a product or service 

offered by the institution, but has 

merely responded to an offer for a free 

promotional item. 

(r) Transfer agent has the same 

meaning as in section 3(a)(25) of the 

Securities Exchange Act of 1934 (15 

U.S.C. 78c(a)(25)). 

(s) You means: 

(1) Any broker or dealer other than a 

broker or dealer registered by notice 

with the Commission under section 

15(b)(11) of the Securities Exchange Act 

of 1934 (15 U.S.C. 78o(b)(11)); 

(2) Any investment company; 

(3) Any investment adviser registered 

with the Commission under the 

Investment Advisers Act of 1940 (15 

U.S.C. 80b–1, et seq.); and 

(4) Any transfer agent registered with 

the Commission under section 17A of 

the Securities Exchange Act of 1934 (15 

U.S.C. 78q–1). 

§ 248.121 Affiliate marketing opt out and 

exceptions. 

(a) Initial notice and opt out 

requirement. (1) In general. You may not 

use eligibility information about a 

consumer that you receive from an 

affiliate to make a marketing solicitation 

to the consumer, unless: 

(i) It is clearly and conspicuously 

disclosed to the consumer in writing or, 

if the consumer agrees, electronically, in 

a concise notice that you may use 

eligibility information about that 

consumer received from an affiliate to 

make marketing solicitations to the 

consumer; 

(ii) The consumer is provided a 

reasonable opportunity and a reasonable 

and simple method to ‘‘opt out,’’ or the 

consumer prohibits you from using 

eligibility information to make 

marketing solicitations to the consumer; 

and 

(iii) The consumer has not opted out. 

(2) Example. A consumer has a 

brokerage account with a broker-dealer. 

The broker-dealer furnishes eligibility 

information about the consumer to its 

affiliated investment adviser. Based on 

that eligibility information, the 

investment adviser wants to make a 

marketing solicitation to the consumer 

about its discretionary advisory 

accounts. The investment adviser does 

not have a pre-existing business 

relationship with the consumer and 

none of the other exceptions apply. The 

investment adviser is prohibited from 

using eligibility information received 

from its broker-dealer affiliate to make 

marketing solicitations to the consumer 

about its discretionary advisory 

accounts unless the consumer is given 

a notice and opportunity to opt out and 

the consumer does not opt out. 

(3) Affiliates who may provide the 

notice. The notice required by this 

paragraph must be provided: 

(i) By an affiliate that has or has 

previously had a pre-existing business 

relationship with the consumer; or 

(ii) As part of a joint notice from two 

or more members of an affiliated group 

of companies, provided that at least one 

of the affiliates on the joint notice has 

or has previously had a pre-existing 

business relationship with the 

consumer. 

(b) Making marketing solicitations. (1) 

In general. For purposes of this subpart, 

you make a marketing solicitation if: 

(i) You receive eligibility information 

from an affiliate; 

(ii) You use that eligibility 

information to do one or more of the 

following: 

(A) Identify the consumer or type of 

consumer to receive a marketing 

solicitation; 

(B) Establish criteria used to select the 

consumer to receive a marketing 

solicitation; or 

(C) Decide which of your products or 

services to market to the consumer or 

tailor your marketing solicitation to that 

consumer; and 

(iii) As a result of your use of the 

eligibility information, the consumer is 

provided a marketing solicitation. 

(2) Receiving eligibility information 

from an affiliate, including through a 

common database. You may receive 

eligibility information from an affiliate 

in various ways, including when the 

affiliate places that information into a 

common database that you may access. 

(3) Receipt or use of eligibility 

information by your service provider. 

Except as provided in paragraph (b)(5) 

of this section, you receive or use an 

affiliate’s eligibility information if a 

service provider acting on your behalf 

(whether an affiliate or a nonaffiliated 

third party) receives or uses that 

information in the manner described in 

paragraph (b)(1)(i) or (b)(1)(ii) of this 

section. All relevant facts and 

circumstances will determine whether a 

person is acting as your service provider 

when it receives or uses an affiliate’s 

eligibility information in connection 

with marketing your products and 

services. 

(4) Use by an affiliate of its own 

eligibility information. Unless you have 

used eligibility information that you 

receive from an affiliate in the manner 

described in paragraph (b)(1)(ii) of this 

section, you do not make a marketing 

solicitation subject to this subpart if 

your affiliate: 

(i) Uses its own eligibility information 

that it obtained in connection with a 

pre-existing business relationship it has 

or had with the consumer to market 

your products or services to the 

affiliate’s consumer; or 

(ii) Directs its service provider to use 

the affiliate’s own eligibility information 

that it obtained in connection with a 

pre-existing business relationship it has 

or had with the consumer to market 

your products or services to the 

consumer, and you do not communicate 

directly with the service provider 

regarding that use. 

(5) Use of eligibility information by a 

service provider. (i) In general. You do 

not make a marketing solicitation 

subject to this subpart if a service 

provider (including an affiliated or 

third-party service provider that 

maintains or accesses a common 

database that you may access) receives 

eligibility information from your 

affiliate that your affiliate obtained in 

connection with a pre-existing business 

relationship it has or had with the 

consumer and uses that eligibility 

information to market your products or 

services to that affiliate’s consumer, so 

long as: 


srobinson on DSKHWCL6B1PROD with RULES3
40434 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

(A) Your affiliate controls access to 

and use of its eligibility information by 

the service provider (including the right 

to establish the specific terms and 

conditions under which the service 

provider may use such information to 

market your products or services); 

(B) Your affiliate establishes specific 

terms and conditions under which the 

service provider may access and use 

your affiliate’s eligibility information to 

market your products and services (or 

those of affiliates generally) to your 

affiliate’s consumers, such as the 

identity of the affiliated companies 

whose products or services may be 

marketed to the affiliate’s consumers by 

the service provider, the types of 

products or services of affiliated 

companies that may be marketed, and 

the number of times your affiliate’s 

consumers may receive marketing 

materials, and periodically evaluates the 

service provider’s compliance with 

those terms and conditions; 

(C) Your affiliate requires the service 

provider to implement reasonable 

policies and procedures designed to 

ensure that the service provider uses 

your affiliate’s eligibility information in 

accordance with the terms and 

conditions established by your affiliate 

relating to the marketing of your 

products or services; 

(D) Your affiliate is identified on or 

with the marketing materials provided 

to the consumer; and 

(E) You do not directly use your 

affiliate’s eligibility information in the 

manner described in paragraph (b)(1)(ii) 

of this section. 

(ii) Writing requirements. (A) The 

requirements of paragraphs (b)(5)(i)(A) 

and (C) of this section must be set forth 

in a written agreement between your 

affiliate and the service provider; and 

(B) The specific terms and conditions 

established by your affiliate as provided 

in paragraph (b)(5)(i)(B) of this section 

must be set forth in writing. 

(6) Examples of making marketing 

solicitations. (i) A consumer has an 

investment advisory contract with a 

registered investment adviser that is 

affiliated with a broker-dealer. The 

broker-dealer receives eligibility 

information about the consumer from 

the investment adviser. The brokerdealer uses that eligibility information 

to identify the consumer to receive a 

marketing solicitation about brokerage 

products and services, and, as a result, 

the broker-dealer provides a marketing 

solicitation to the consumer about its 

brokerage services. Pursuant to 

paragraph (b)(1) of this section, the 

broker-dealer has made a marketing 

solicitation to the consumer. 

(ii) The same facts as in the example 

in paragraph (b)(6)(i) of this section, 

except that after using the eligibility 

information to identify the consumer to 

receive a marketing solicitation about 

brokerage products and services, the 

broker-dealer asks the registered 

investment adviser to send the 

marketing solicitation to the consumer 

and the investment adviser does so. 

Pursuant to paragraph (b)(1) of this 

section, the broker-dealer has made a 

marketing solicitation to the consumer 

because it used eligibility information 

about the consumer that it received from 

an affiliate to identify the consumer to 

receive a marketing solicitation about its 

products or services, and, as a result, a 

marketing solicitation was provided to 

the consumer about the broker-dealer’s 

products and services. 

(iii) The same facts as in the example 

in paragraph (b)(6)(i) of this section, 

except that eligibility information about 

consumers who have an investment 

advisory contract with a registered 

investment adviser is placed into a 

common database that all members of 

the affiliated group of companies may 

independently access and use. Without 

using the investment adviser’s eligibility 

information, the broker-dealer develops 

selection criteria and provides those 

criteria, marketing materials, and related 

instructions to the investment adviser. 

The investment adviser reviews 

eligibility information about its own 

consumers using the selection criteria 

provided by the broker-dealer to 

determine which consumers should 

receive the broker-dealer’s marketing 

materials and sends the broker-dealer’s 

marketing materials to those consumers. 

Even though the broker-dealer has 

received eligibility information through 

the common database as provided in 

paragraph (b)(2) of this section, it did 

not use that information to identify 

consumers or establish selection 

criteria; instead, the investment adviser 

used its own eligibility information. 

Therefore, pursuant to paragraph 

(b)(4)(i) of this section, the broker-dealer 

has not made a marketing solicitation to 

the consumer. 

(iv) The same facts as in the example 

in paragraph (b)(6)(iii) of this section, 

except that the registered investment 

adviser provides the broker-dealer’s 

criteria to the investment adviser’s 

service provider and directs the service 

provider to use the investment adviser’s 

eligibility information to identify 

investment adviser consumers who 

meet the criteria and to send the brokerdealer’s marketing materials to those 

consumers. The broker-dealer does not 

communicate directly with the service 

provider regarding the use of the 

investment adviser’s information to 

market its products or services to the 

investment adviser’s consumers. 

Pursuant to paragraph (b)(4)(ii) of this 

section, the broker-dealer has not made 

a marketing solicitation to the 

consumer. 

(v) An affiliated group of companies 

includes an investment company, a 

principal underwriter for the investment 

company, a retail broker-dealer, and a 

transfer agent that also acts as a service 

provider. Each affiliate in the group 

places information about its consumers 

into a common database. The service 

provider has access to all information in 

the common database. The investment 

company controls access to and use of 

its eligibility information by the service 

provider. This control is set forth in a 

written agreement between the 

investment company and the service 

provider. The written agreement also 

requires the service provider to establish 

reasonable policies and procedures 

designed to ensure that the service 

provider uses the investment company’s 

eligibility information in accordance 

with specific terms and conditions 

established by the investment company 

relating to the marketing of the products 

and services of all affiliates, including 

the principal underwriter and the retail 

broker-dealer. In a separate written 

communication, the investment 

company specifies the terms and 

conditions under which the service 

provider may use the investment 

company’s eligibility information to 

market the retail broker-dealer’s 

products and services to the investment 

company’s consumers. The specific 

terms and conditions are: a list of 

affiliated companies (including the 

retail broker-dealer) whose products or 

services may be marketed to the 

investment company’s consumers by the 

service provider; the specific products 

or services or types of products or 

services that may be marketed to the 

investment company’s consumers by the 

service provider; the categories of 

eligibility information that may be used 

by the service provider in marketing 

products or services to the investment 

company’s consumers; the types or 

categories of the investment company’s 

consumers to whom the service 

provider may market products or 

services of investment company 

affiliates; the number and types of 

marketing communications that the 

service provider may send to the 

investment company’s consumers; and 

the length of time during which the 

service provider may market the 

products or services of the investment 

company’s affiliates to its consumers. 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40435 

The investment company periodically 

evaluates the service provider’s 

compliance with these terms and 

conditions. The retail broker-dealer asks 

the service provider to market brokerage 

services to certain of the investment 

company’s consumers. Without using 

the investment company’s eligibility 

information, the retail broker-dealer 

develops selection criteria and provides 

those criteria, its marketing materials, 

and related instructions to the service 

provider. The service provider uses the 

investment company’s eligibility 

information from the common database 

to identify the investment company’s 

consumers to whom brokerage services 

will be marketed. When the retail 

broker-dealer’s marketing materials are 

provided to the identified consumers, 

the name of the investment company is 

displayed on the retail broker-dealer’s 

marketing materials, an introductory 

letter that accompanies the marketing 

materials, an account statement that 

accompanies the marketing materials, or 

the envelope containing the marketing 

materials. The requirements of 

paragraph (b)(5) of this section have 

been satisfied, and the retail brokerdealer has not made a marketing 

solicitation to the consumer. 

(vi) The same facts as in the example 

in paragraph (b)(6)(v) of this section, 

except that the terms and conditions 

permit the service provider to use the 

investment company’s eligibility 

information to market the products and 

services of other affiliates to the 

investment company’s consumers 

whenever the service provider deems it 

appropriate to do so. The service 

provider uses the investment company’s 

eligibility information in accordance 

with the discretion afforded to it by the 

terms and conditions. Because the terms 

and conditions are not specific, the 

requirements of paragraph (b)(5) of this 

section have not been satisfied. 

(c) Exceptions. The provisions of this 

subpart do not apply to you if you use 

eligibility information that you receive 

from an affiliate: 

(1) To make a marketing solicitation 

to a consumer with whom you have a 

pre-existing business relationship; 

(2) To facilitate communications to an 

individual for whose benefit you 

provide employee benefit or other 

services pursuant to a contract with an 

employer related to and arising out of 

the current employment relationship or 

status of the individual as a participant 

or beneficiary of an employee benefit 

plan; 

(3) To perform services on behalf of 

an affiliate, except that this paragraph 

shall not be construed as permitting you 

to send marketing solicitations on behalf 

of an affiliate if the affiliate would not 

be permitted to send the marketing 

solicitation as a result of the election of 

the consumer to opt out under this 

subpart; 

(4) In response to a communication 

about your products or services initiated 

by the consumer; 

(5) In response to an authorization or 

request by the consumer to receive 

solicitations; or 

(6) If your compliance with this 

subpart would prevent you from 

complying with any provision of State 

insurance laws pertaining to unfair 

discrimination in any State in which 

you are lawfully doing business. 

(d) Examples of exceptions. (1) 

Example of the pre-existing business 

relationship exception. A consumer has 

a brokerage account with a brokerdealer. The consumer also has a deposit 

account with the broker-dealer’s 

affiliated depository institution. The 

broker-dealer receives eligibility 

information about the consumer from its 

depository institution affiliate and uses 

that information to make a marketing 

solicitation to the consumer about the 

broker-dealer’s college savings accounts. 

The broker-dealer may make this 

marketing solicitation even if the 

consumer has not been given a notice 

and opportunity to opt out because the 

broker-dealer has a pre-existing business 

relationship with the consumer. 

(2) Examples of service provider 

exception. (i) A consumer has a 

brokerage account with a broker-dealer. 

The broker-dealer furnishes eligibility 

information about the consumer to its 

affiliate, a registered investment adviser. 

Based on that eligibility information, the 

investment adviser wants to make a 

marketing solicitation to the consumer 

about its advisory services. The 

investment adviser does not have a preexisting business relationship with the 

consumer and none of the other 

exceptions in paragraph (c) of this 

section apply. The consumer has been 

given an opt out notice and has elected 

to opt out of receiving such marketing 

solicitations. The investment adviser 

asks a service provider to send the 

marketing solicitation to the consumer 

on its behalf. The service provider may 

not send the marketing solicitation on 

behalf of the investment adviser 

because, as a result of the consumer’s 

opt out election, the investment adviser 

is not permitted to make the marketing 

solicitation. 

(ii) The same facts as in paragraph 

(d)(2)(i) of this section, except the 

consumer has been given an opt out 

notice, but has not elected to opt out. 

The investment adviser asks a service 

provider to send the solicitation to the 

consumer on its behalf. The service 

provider may send the marketing 

solicitation on behalf of the investment 

adviser because, as a result of the 

consumer’s not opting out, the 

investment adviser is permitted to make 

the marketing solicitation. 

(3) Examples of consumer-initiated 

communications. (i) A consumer who is 

the record owner of shares in an 

investment company initiates a 

communication with an affiliated 

registered investment adviser about 

advisory services. The affiliated 

investment adviser may use eligibility 

information about the consumer it 

obtains from the investment company or 

any other affiliate to make marketing 

solicitations regarding the affiliated 

investment adviser’s services in 

response to the consumer-initiated 

communication. 

(ii) A consumer who has a brokerage 

account with a broker-dealer contacts 

the broker-dealer to request information 

about how to save and invest for a 

child’s college education without 

specifying the type of savings or 

investment vehicle in which the 

consumer may be interested. 

Information about a range of different 

products or services offered by the 

broker-dealer and one or more of its 

affiliates may be responsive to that 

communication. Such products, 

services, and investments may include 

the following: investments in affiliated 

investment companies; investments in 

section 529 plans offered by the brokerdealer; or trust services offered by a 

different financial institution in the 

affiliated group. Any affiliate offering 

products or services that would be 

responsive to the consumer’s request for 

information about saving and investing 

for a child’s college education may use 

eligibility information to make 

marketing solicitations to the consumer 

in response to this communication. 

(iii) A registered investment adviser 

makes a marketing call to the consumer 

without using eligibility information 

received from an affiliate. The 

investment adviser leaves a voice-mail 

message that invites the consumer to 

call a toll-free number to receive 

information about services offered by 

the investment adviser. If the consumer 

calls the toll-free number to inquire 

about the investment advisory services, 

the call is a consumer-initiated 

communication about a product or 

service, and the investment adviser may 

now use eligibility information it 

receives from its affiliates to make 

marketing solicitations to the consumer. 

(iv) A consumer calls a broker-dealer 

to ask about retail locations and hours, 

but does not request information about 


srobinson on DSKHWCL6B1PROD with RULES3
40436 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

its products or services. The brokerdealer may not use eligibility 

information it receives from an affiliate 

to make marketing solicitations to the 

consumer because the consumerinitiated communication does not relate 

to the broker-dealer’s products or 

services. Thus, the use of eligibility 

information received from an affiliate 

would not be responsive to the 

communication and the exception does 

not apply. 

(v) A consumer calls a broker-dealer 

to ask about retail locations and hours. 

The customer service representative 

asks the consumer if there is a particular 

product or service about which the 

consumer is seeking information. The 

consumer responds that the consumer 

wants to stop in and find out about 

mutual funds (i.e., registered open-end 

investment companies). The customer 

service representative offers to provide 

that information by telephone and mail 

additional information to the consumer. 

The consumer agrees and provides or 

confirms contact information for receipt 

of the materials to be mailed. The 

broker-dealer may use eligibility 

information it receives from an affiliate 

to make marketing solicitations to the 

consumer about mutual funds because 

such marketing solicitations would 

respond to the consumer-initiated 

communication about mutual funds. 

(4) Examples of consumer 

authorization or request for marketing 

solicitations. (i) A consumer who has a 

brokerage account with a broker-dealer 

authorizes or requests information about 

life insurance offered by the brokerdealer’s insurance affiliate. The 

authorization or request, whether given 

to the broker-dealer or the insurance 

affiliate, would permit the insurance 

affiliate to use eligibility information 

about the consumer it obtains from the 

broker-dealer or any other affiliate to 

make marketing solicitations to the 

consumer about life insurance. 

(ii) A consumer completes an online 

application to open an online brokerage 

account with a broker-dealer. The 

broker-dealer’s online application 

contains a blank check box that the 

consumer may check to authorize or 

request information from the brokerdealer’s affiliates. The consumer checks 

the box. The consumer has authorized 

or requested marketing solicitations 

from the broker-dealer’s affiliates. 

(iii) A consumer completes an online 

application to open an online brokerage 

account with a broker-dealer. The 

broker-dealer’s online application 

contains a check box indicating that the 

consumer authorizes or requests 

information from the broker-dealer’s 

affiliates. The consumer does not 

deselect the check box. The consumer 

has not authorized or requested 

marketing solicitations from the brokerdealer’s affiliates. 

(iv) The terms and conditions of a 

brokerage account agreement contain 

preprinted boilerplate language stating 

that by applying to open an account the 

consumer authorizes or requests to 

receive solicitations from the brokerdealer’s affiliates. The consumer has not 

authorized or requested marketing 

solicitations from the broker-dealer’s 

affiliates. 

(e) Relation to affiliate-sharing notice 

and opt out. Nothing in this subpart 

limits the responsibility of a person to 

comply with the notice and opt out 

provisions of Section 603(d)(2)(A)(iii) of 

the FCRA (15 U.S.C. 1681a(d)(2)(A)(iii)) 

where applicable. 

§ 248.122 Scope and duration of opt out. 

(a) Scope of opt out. (1) In general. 

Except as otherwise provided in this 

section, the consumer’s election to opt 

out prohibits any affiliate covered by the 

opt out notice from using eligibility 

information received from another 

affiliate as described in the notice to 

make marketing solicitations to the 

consumer. 

(2) Continuing relationship. (i) In 

general. If the consumer establishes a 

continuing relationship with you or 

your affiliate, an opt out notice may 

apply to eligibility information obtained 

in connection with: 

(A) A single continuing relationship 

or multiple continuing relationships 

that the consumer establishes with you 

or your affiliates, including continuing 

relationships established subsequent to 

delivery of the opt out notice, so long 

as the notice adequately describes the 

continuing relationships covered by the 

opt out; or 

(B) Any other transaction between the 

consumer and you or your affiliates as 

described in the notice. 

(ii) Examples of continuing 

relationships. A consumer has a 

continuing relationship with you or 

your affiliate if the consumer: 

(A) Opens a brokerage account or 

enters into an advisory contract with 

you or your affiliate; 

(B) Obtains a loan for which you or 

your affiliate owns the servicing rights; 

(C) Purchases investment company 

shares in his or her own name; 

(D) Holds an investment through you 

or your affiliate; such as when you act 

or your affiliate acts as a custodian for 

securities or for assets in an individual 

retirement arrangement; 

(E) Enters into an agreement or 

understanding with you or your affiliate 

whereby you or your affiliate undertakes 

to arrange or broker a home mortgage 

loan for the consumer; 

(F) Enters into a lease of personal 

property with you or your affiliate; or 

(G) Obtains financial, investment, or 

economic advisory services from you or 

your affiliate for a fee. 

(3) No continuing relationship. (i) In 

general. If there is no continuing 

relationship between a consumer and 

you or your affiliate, and you or your 

affiliate obtain eligibility information 

about a consumer in connection with a 

transaction with the consumer, such as 

an isolated transaction or an application 

that is denied, an opt out notice 

provided to the consumer only applies 

to eligibility information obtained in 

connection with that transaction. 

(ii) Examples of isolated transactions. 

An isolated transaction occurs if: 

(A) The consumer uses your or your 

affiliate’s ATM to withdraw cash from 

an account at another financial 

institution; or 

(B) A broker-dealer opens a brokerage 

account for the consumer solely for the 

purpose of liquidating or purchasing 

securities as an accommodation, i.e., on 

a one-time basis, without the 

expectation of engaging in other 

transactions. 

(4) Menu of alternatives. A consumer 

may be given the opportunity to choose 

from a menu of alternatives when 

electing to prohibit solicitations, such as 

by electing to prohibit solicitations from 

certain types of affiliates covered by the 

opt out notice but not other types of 

affiliates covered by the notice, electing 

to prohibit marketing solicitations based 

on certain types of eligibility 

information but not other types of 

eligibility information, or electing to 

prohibit marketing solicitations by 

certain methods of delivery but not 

other methods of delivery. However, 

one of the alternatives must allow the 

consumer to prohibit all marketing 

solicitations from all of the affiliates that 

are covered by the notice. 

(5) Special rule for a notice following 

termination of all continuing 

relationships. (i) In general. A consumer 

must be given a new opt out notice if, 

after all continuing relationships with 

you or your affiliate(s) are terminated, 

the consumer subsequently establishes 

another continuing relationship with 

you or your affiliate(s) and the 

consumer’s eligibility information is to 

be used to make a marketing 

solicitation. The new opt out notice 

must apply, at a minimum, to eligibility 

information obtained in connection 

with the new continuing relationship. 

Consistent with paragraph (b) of this 

section, the consumer’s decision not to 

opt out after receiving the new opt out 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40437 

notice would not override a prior opt 

out election by the consumer that 

applies to eligibility information 

obtained in connection with a 

terminated relationship, regardless of 

whether the new opt out notice applies 

to eligibility information obtained in 

connection with the terminated 

relationship. 

(ii) Example. A consumer has an 

advisory contract with a company that 

is registered with the Commission as 

both a broker-dealer and an investment 

adviser, and that is part of an affiliated 

group. The consumer terminates the 

advisory contract. One year after 

terminating the advisory contract, the 

consumer opens a brokerage account 

with the same company. The consumer 

must be given a new notice and 

opportunity to opt out before the 

company’s affiliates may make 

marketing solicitations to the consumer 

using eligibility information obtained by 

the company in connection with the 

new brokerage account relationship, 

regardless of whether the consumer 

opted out in connection with the 

advisory contract. 

(b) Duration of opt out. The election 

of a consumer to opt out must be 

effective for a period of at least five 

years (the ‘‘opt out period’’) beginning 

when the consumer’s opt out election is 

received and implemented, unless the 

consumer subsequently revokes the opt 

out in writing or, if the consumer agrees, 

electronically. An opt out period of 

more than five years may be established, 

including an opt out period that does 

not expire unless revoked by the 

consumer. 

(c) Time of opt out. A consumer may 

opt out at any time. 

§ 248.123 Contents of opt out notice; 

consolidated and equivalent notices. 

(a) Contents of opt out notice. (1) In 

general. A notice must be clear, 

conspicuous, and concise, and must 

accurately disclose: 

(i) The name of the affiliate(s) 

providing the notice. If the notice is 

provided jointly by multiple affiliates 

and each affiliate shares a common 

name, such as ‘‘ABC,’’ then the notice 

may indicate that it is being provided by 

multiple companies with the ABC name 

or multiple companies in the ABC group 

or family of companies, for example, by 

stating that the notice is provided by 

‘‘all of the ABC companies,’’ ‘‘the ABC 

banking, credit card, insurance, and 

securities companies,’’ or by listing the 

name of each affiliate providing the 

notice. But if the affiliates providing the 

joint notice do not all share a common 

name, then the notice must either 

separately identify each affiliate by 

name or identify each of the common 

names used by those affiliates, for 

example, by stating that the notice is 

provided by ‘‘all of the ABC and XYZ 

companies’’ or by ‘‘the ABC bank and 

securities companies and the XYZ 

insurance companies’’; 

(ii) A list of the affiliates or types of 

affiliates whose use of eligibility 

information is covered by the notice, 

which may include companies that 

become affiliates after the notice is 

provided to the consumer. If each 

affiliate covered by the notice shares a 

common name, such as ‘‘ABC,’’ then the 

notice may indicate that it applies to 

multiple companies with the ABC name 

or multiple companies in the ABC group 

or family of companies, for example, by 

stating that the notice is provided by 

‘‘all of the ABC companies,’’ ‘‘the ABC 

banking, credit card, insurance, and 

securities companies,’’ or by listing the 

name of each affiliate providing the 

notice. But if the affiliates covered by 

the notice do not all share a common 

name, then the notice must either 

separately identify each covered affiliate 

by name or identify each of the common 

names used by those affiliates, for 

example, by stating that the notice 

applies to ‘‘all of the ABC and XYZ 

companies’’ or to ‘‘the ABC banking and 

securities companies and the XYZ 

insurance companies’’; 

(iii) A general description of the types 

of eligibility information that may be 

used to make marketing solicitations to 

the consumer; 

(iv) That the consumer may elect to 

limit the use of eligibility information to 

make marketing solicitations to the 

consumer; 

(v) That the consumer’s election will 

apply for the specified period of time 

stated in the notice and, if applicable, 

that the consumer will be allowed to 

renew the election once that period 

expires; 

(vi) If the notice is provided to 

consumers who may have previously 

opted out, such as if a notice is provided 

to consumers annually, that the 

consumer who has chosen to limit 

marketing solicitations does not need to 

act again until the consumer receives a 

renewal notice; and 

(vii) A reasonable and simple method 

for the consumer to opt out. 

(2) Joint relationships. (i) If two or 

more consumers jointly obtain a product 

or service, a single opt out notice may 

be provided to the joint consumers. Any 

of the joint consumers may exercise the 

right to opt out. 

(ii) The opt out notice must explain 

how an opt out direction by a joint 

consumer will be treated. An opt out 

direction by a joint consumer may be 

treated as applying to all of the 

associated joint consumers, or each joint 

consumer may be permitted to opt out 

separately. If each joint consumer is 

permitted to opt out separately, one of 

the joint consumers must be permitted 

to opt out on behalf of all of the joint 

consumers and the joint consumers 

must be permitted to exercise their 

separate rights to opt out in a single 

response. 

(iii) It is impermissible to require all 

joint consumers to opt out before 

implementing any opt out direction. 

(3) Alternative contents. If the 

consumer is afforded a broader right to 

opt out of receiving marketing than is 

required by this subpart, the 

requirements of this section may be 

satisfied by providing the consumer 

with a clear, conspicuous, and concise 

notice that accurately discloses the 

consumer’s opt out rights. 

(4) Model notices. Model notices are 

provided in the Appendix to this 

subpart. 

(b) Coordinated and consolidated 

notices. A notice required by this 

subpart may be coordinated and 

consolidated with any other notice or 

disclosure required to be issued under 

any other provision of law by the entity 

providing the notice, including but not 

limited to the notice described in 

section 603(d)(2)(A)(iii) of the FCRA (15 

U.S.C. 1681a(d)(2)(A)(iii)) and the GLBA 

privacy notice. 

(c) Equivalent notices. A notice or 

other disclosure that is equivalent to the 

notice required by this subpart, and that 

is provided to a consumer together with 

disclosures required by any other 

provision of law, satisfies the 

requirements of this section. 

§ 248.124 Reasonable opportunity to opt 

out. 

(a) In general. You must not use 

eligibility information that you receive 

from an affiliate to make marketing 

solicitations to a consumer about your 

products or services unless the 

consumer is provided a reasonable 

opportunity to opt out, as required by 

§ 248.121(a)(1)(ii). 

(b) Examples of a reasonable 

opportunity to opt out. The consumer is 

given a reasonable opportunity to opt 

out if: 

(1) By mail. The opt out notice is 

mailed to the consumer. The consumer 

is given 30 days from the date the notice 

is mailed to elect to opt out by any 

reasonable means. 

(2) By electronic means. (i) The opt 

out notice is provided electronically to 

the consumer, such as by posting the 

notice at an Internet Web site at which 

the consumer has obtained a product or 


srobinson on DSKHWCL6B1PROD with RULES3
40438 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

service. The consumer acknowledges 

receipt of the electronic notice. The 

consumer is given 30 days after the date 

the consumer acknowledges receipt to 

elect to opt out by any reasonable 

means. 

(ii) The opt out notice is provided to 

the consumer by e-mail where the 

consumer has agreed to receive 

disclosures by e-mail from the person 

sending the notice. The consumer is 

given 30 days after the e-mail is sent to 

elect to opt out by any reasonable 

means. 

(3) At the time of an electronic 

transaction. The opt out notice is 

provided to the consumer at the time of 

an electronic transaction, such as a 

transaction conducted on an Internet 

Web site. The consumer is required to 

decide, as a necessary part of 

proceeding with the transaction, 

whether to opt out before completing 

the transaction. There is a simple 

process that the consumer may use to 

opt out at that time using the same 

mechanism through which the 

transaction is conducted. 

(4) At the time of an in-person 

transaction. The opt out notice is 

provided to the consumer in writing at 

the time of an in-person transaction. 

The consumer is required to decide, as 

a necessary part of proceeding with the 

transaction, whether to opt out before 

completing the transaction, and is not 

permitted to complete the transaction 

without making a choice. There is a 

simple process that the consumer may 

use during the course of the in-person 

transaction to opt out, such as 

completing a form that requires 

consumers to write a ‘‘yes’’ or ‘‘no’’ to 

indicate their opt out preference or that 

requires the consumer to check one of 

two blank check boxes—one that allows 

consumers to indicate that they want to 

opt out and one that allows consumers 

to indicate that they do not want to opt 

out. 

(5) By including in a privacy notice. 

The opt out notice is included in a 

GLBA privacy notice. The consumer is 

allowed to exercise the opt out within 

a reasonable period of time and in the 

same manner as the opt out under that 

privacy notice. 

§ 248.125 Reasonable and simple methods 

of opting out. 

(a) In general. You must not use 

eligibility information about a consumer 

that you receive from an affiliate to 

make a marketing solicitation to the 

consumer about your products or 

services, unless the consumer is 

provided a reasonable and simple 

method to opt out, as required by 

§ 248.121(a)(1)(ii). 

(b) Examples. (1) Reasonable and 

simple opt out methods. Reasonable and 

simple methods for exercising the opt 

out right include: 

(i) Designating a check-off box in a 

prominent position on the opt out form; 

(ii) Including a reply form and a selfaddressed envelope together with the 

opt out notice; 

(iii) Providing an electronic means to 

opt out, such as a form that can be 

electronically mailed or processed at an 

Internet Web site, if the consumer agrees 

to the electronic delivery of information; 

(iv) Providing a toll-free telephone 

number that consumers may call to opt 

out; or 

(v) Allowing consumers to exercise all 

of their opt out rights described in a 

consolidated opt out notice that 

includes the GLBA privacy, FCRA 

affiliate sharing, and FCRA affiliate 

marketing opt outs, by a single method, 

such as by calling a single toll-free 

telephone number. 

(2) Opt out methods that are not 

reasonable and simple. Reasonable and 

simple methods for exercising an opt 

out right do not include: 

(i) Requiring the consumer to write 

his or her own letter; 

(ii) Requiring the consumer to call or 

write to obtain a form for opting out, 

rather than including the form with the 

opt out notice; or 

(iii) Requiring the consumer who 

receives the opt out notice in electronic 

form only, such as through posting at an 

Internet Web site, to opt out solely by 

paper mail or by visiting a different Web 

site without providing a link to that site. 

(c) Specific opt out means. Each 

consumer may be required to opt out 

through a specific means, as long as that 

means is reasonable and simple for that 

consumer. 

§ 248.126 Delivery of opt out notices. 

(a) In general. The opt out notice must 

be provided so that each consumer can 

reasonably be expected to receive actual 

notice. For opt out notices provided 

electronically, the notice may be 

provided in compliance with either the 

electronic disclosure provisions in this 

subpart or the provisions in section 101 

of the Electronic Signatures in Global 

and National Commerce Act, 15 U.S.C. 

7001, et seq. 

(b) Examples of reasonable 

expectation of actual notice. A 

consumer may reasonably be expected 

to receive actual notice if the affiliate 

providing the notice: 

(1) Hand-delivers a printed copy of 

the notice to the consumer; 

(2) Mails a printed copy of the notice 

to the last known mailing address of the 

consumer; 

(3) Provides a notice by e-mail to a 

consumer who has agreed to receive 

electronic disclosures by e-mail from 

the affiliate providing the notice; or 

(4) Posts the notice on the Internet 

Web site at which the consumer 

obtained a product or service 

electronically and requires the 

consumer to acknowledge receipt of the 

notice. 

(c) Examples of no reasonable 

expectation of actual notice. A 

consumer may not reasonably be 

expected to receive actual notice if the 

affiliate providing the notice: 

(1) Only posts the notice on a sign in 

a branch or office or generally publishes 

the notice in a newspaper; 

(2) Sends the notice by e-mail to a 

consumer who has not agreed to receive 

electronic disclosures by e-mail from 

the affiliate providing the notice; or 

(3) Posts the notice on an Internet 

Web site without requiring the 

consumer to acknowledge receipt of the 

notice. 

§ 248.127 Renewal of opt out elections. 

(a) Renewal notice and opt out 

requirement. (1) In general. After the opt 

out period expires, you may not make 

marketing solicitations to a consumer 

who previously opted out, unless: 

(i) The consumer has been given a 

renewal notice that complies with the 

requirements of this section and 

§§ 248.124 through 248.126, and a 

reasonable opportunity and a reasonable 

and simple method to renew the opt 

out, and the consumer does not renew 

the opt out; or 

(ii) An exception in § 248.121(c) 

applies. 

(2) Renewal period. Each opt out 

renewal must be effective for a period of 

at least five years as provided in 

§ 248.122(b). 

(3) Affiliates who may provide the 

notice. The notice required by this 

paragraph must be provided: 

(i) By the affiliate that provided the 

previous opt out notice, or its successor; 

or 

(ii) As part of a joint renewal notice 

from two or more members of an 

affiliated group of companies, or their 

successors, that jointly provided the 

previous opt out notice. 

(b) Contents of renewal notice. The 

renewal notice must be clear, 

conspicuous, and concise, and must 

accurately disclose: 

(1) The name of the affiliate(s) 

providing the notice. If the notice is 

provided jointly by multiple affiliates 

and each affiliate shares a common 

name, such as ‘‘ABC,’’ then the notice 

may indicate it is being provided by 

multiple companies with the ABC name 


srobinson on DSKHWCL6B1PROD with RULES3
Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 40439 

or multiple companies in the ABC group 

or family of companies, for example, by 

stating that the notice is provided by 

‘‘all of the ABC companies,’’ ‘‘the ABC 

banking, credit card, insurance, and 

securities companies,’’ or by listing the 

name of each affiliate providing the 

notice. But if the affiliates providing the 

joint notice do not all share a common 

name, then the notice must either 

separately identify each affiliate by 

name or identify each of the common 

names used by those affiliates, for 

example, by stating that the notice is 

provided by ‘‘all of the ABC and XYZ 

companies’’ or by ‘‘the ABC banking 

and securities companies and the XYZ 

insurance companies’’; 

(2) A list of the affiliates or types of 

affiliates whose use of eligibility 

information is covered by the notice, 

which may include companies that 

become affiliates after the notice is 

provided to the consumer. If each 

affiliate covered by the notice shares a 

common name, such as ‘‘ABC,’’ then the 

notice may indicate that it applies to 

multiple companies with the ABC name 

or multiple companies in the ABC group 

or family of companies, for example, by 

stating that the notice is provided by 

‘‘all of the ABC companies,’’ ‘‘the ABC 

banking, credit card, insurance, and 

securities companies,’’ or by listing the 

name of each affiliate providing the 

notice. But if the affiliates covered by 

the notice do not all share a common 

name, then the notice must either 

separately identify each covered affiliate 

by name or identify each of the common 

names used by those affiliates, for 

example, by stating that the notice 

applies to ‘‘all of the ABC and XYZ 

companies’’ or to ‘‘the ABC banking and 

securities companies and the XYZ 

insurance companies’’; 

(3) A general description of the types 

of eligibility information that may be 

used to make marketing solicitations to 

the consumer; 

(4) That the consumer previously 

elected to limit the use of certain 

information to make marketing 

solicitations to the consumer; 

(5) That the consumer’s election has 

expired or is about to expire; 

(6) That the consumer may elect to 

renew the consumer’s previous election; 

(7) If applicable, that the consumer’s 

election to renew will apply for the 

specified period of time stated in the 

notice and that the consumer will be 

allowed to renew the election once that 

period expires; and 

(8) A reasonable and simple method 

for the consumer to opt out. 

(c) Timing of the renewal notice. (1) 

In general. A renewal notice may be 

provided to the consumer either: 

(i) A reasonable period of time before 

the expiration of the opt out period; or 

(ii) Any time after the expiration of 

the opt out period but before marketing 

solicitations that would have been 

prohibited by the expired opt out are 

made to the consumer. 

(2) Combination with annual privacy 

notice. If you provide an annual privacy 

notice under the GLBA, providing a 

renewal notice with the last annual 

privacy notice provided to the consumer 

before expiration of the opt out period 

is a reasonable period of time before 

expiration of the opt out in all cases. 

(d) No effect on opt out period. An opt 

out period may not be shortened by 

sending a renewal notice to the 

consumer before expiration of the opt 

out period, even if the consumer does 

not renew the opt out. 

§ 248.128 Effective date, compliance date, 

and prospective application. 

(a) Effective date. This subpart is 

effective September 10, 2009. 

(b) Mandatory compliance date. 

Compliance with this subpart is 

required not later than January 1, 2010. 

(c) Prospective application. The 

provisions of this subpart do not 

prohibit you from using eligibility 

information that you receive from an 

affiliate to make a marketing solicitation 

to a consumer if you receive such 

information prior to January 1, 2010. For 

purposes of this section, you are 

deemed to receive eligibility 

information when such information is 

placed into a common database and is 

accessible by you. 

Appendix to Subpart B—Model Forms 

a. Although you and your affiliates are not 

required to use the model forms in this 

Appendix, use of a model form (if applicable 

to each person that uses it) complies with the 

requirement in section 624 of the FCRA for 

clear, conspicuous, and concise notices. 

b. Although you may need to change the 

language or format of a model form to reflect 

your actual policies and procedures, any 

such changes may not be so extensive as to 

affect the substance, clarity, or meaningful 

sequence of the language in the model forms. 

Acceptable changes include, for example: 

1. Rearranging the order of the references 

to ‘‘your income,’’ ‘‘your account history,’’ 

and ‘‘your credit score.’’ 

2. Substituting other types of information 

for ‘‘income,’’ ‘‘account history,’’ or ‘‘credit 

score’’ for accuracy, such as ‘‘payment 

history,’’ ‘‘credit history,’’ ‘‘payoff status,’’ or 

‘‘claims history.’’ 

3. Substituting a clearer and more accurate 

description of the affiliates providing or 

covered by the notice for phrases such as 

‘‘the [ABC] group of companies.’’ 

4. Substituting other types of affiliates 

covered by the notice for ‘‘credit card,’’ 

‘‘insurance,’’ or ‘‘securities’’ affiliates. 

5. Omitting items that are not accurate or 

applicable. For example, if a person does not 

limit the duration of the opt out period, the 

notice may omit information about the 

renewal notice. 

6. Adding a statement informing the 

consumer how much time they have to opt 

out before shared eligibility information may 

be used to make solicitations to them. 

7. Adding a statement that the consumer 

may exercise the right to opt out at any time. 

8. Adding the following statement, if 

accurate: ‘‘If you previously opted out, you 

do not need to do so again.’’ 

9. Providing a place on the form for the 

consumer to fill in identifying information, 

such as his or her name and address. 

10. Adding disclosures regarding the 

treatment of opt-outs by joint consumers to 

comply with § 248.123(a)(2), if applicable. 

A–1—Model Form for Initial Opt Out Notice 

(Single-Affiliate Notice) 

A–2—Model Form for Initial Opt Out Notice 

(Joint Notice) 

A–3—Model Form for Renewal Notice 

(Single-Affiliate Notice) 

A–4—Model Form for Renewal Notice (Joint 

Notice) 

A–5—Model Form for Voluntary ‘‘No 

Marketing’’ Notice 

A–1—Model Form for Initial Opt Out Notice 

(Single-Affiliate Notice)—[Your Choice to 

Limit Marketing]/[Marketing Opt Out] 

• [Name of Affiliate] is providing this 

notice. 

• [Optional: Federal law gives you the 

right to limit some but not all marketing from 

our affiliates. Federal law also requires us to 

give you this notice to tell you about your 

choice to limit marketing from our affiliates.] 

• You may limit our affiliates in the [ABC] 

group of companies, such as our [investment 

adviser, broker, transfer agent, and 

investment company] affiliates, from 

marketing their products or services to you 

based on your personal information that we 

collect and share with them. This 

information includes your [income], your 

[account history with us], and your [credit 

score]. 

• Your choice to limit marketing offers 

from our affiliates will apply [until you tell 

us to change your choice]/[for x years from 

when you tell us your choice]/[for at least 5 

years from when you tell us your choice]. 

[Include if the opt out period expires.] Once 

that period expires, you will receive a 

renewal notice that will allow you to 

continue to limit marketing offers from our 

affiliates for [another x years]/[at least 

another 5 years]. 

• [Include, if applicable, in a subsequent 

notice, including an annual notice, for 

consumers who may have previously opted 

out.] If you have already made a choice to 

limit marketing offers from our affiliates, you 

do not need to act again until you receive the 

renewal notice. 

To limit marketing offers, contact us 

[include all that apply]: 

• By telephone: 1–877–###–#### 

• On the Web: www.—.com 

• By mail: check the box and complete the 

form below, and send the form to: 

[Company name] 


srobinson on DSKHWCL6B1PROD with RULES3
40440 Federal Register / Vol. 74, No. 153 / Tuesday, August 11, 2009 / Rules and Regulations 

[Company address] 

b Do not allow your affiliates to use my 

personal information to market to me. 

A–2—Model Form for Initial Opt Out Notice 

(Joint Notice)—[Your Choice to Limit 

Marketing]/[Marketing Opt Out] 

• The [ABC group of companies] is 

providing this notice. 

• [Optional: Federal law gives you the 

right to limit some but not all marketing from 

the [ABC] companies. Federal law also 

requires us to give you this notice to tell you 

about your choice to limit marketing from the 

[ABC] companies.] 

• You may limit the [ABC] companies, 

such as the [ABC investment companies, 

investment advisers, transfer agents, and 

broker-dealers] affiliates, from marketing 

their products or services to you based on 

your personal information that they receive 

from other [ABC] companies. This 

information includes your [income], your 

[account history], and your [credit score]. 

• Your choice to limit marketing offers 

from the [ABC] companies will apply [until 

you tell us to change your choice]/[for x years 

from when you tell us your choice]/[for at 

least 5 years from when you tell us your 

choice]. [Include if the opt out period 

expires.] Once that period expires, you will 

receive a renewal notice that will allow you 

to continue to limit marketing offers from the 

[ABC] companies for [another x years]/[at 

least another 5 years]. 

• [Include, if applicable, in a subsequent 

notice, including an annual notice, for 

consumers who may have previously opted 

out.] If you have already made a choice to 

limit marketing offers from the [ABC] 

companies, you do not need to act again until 

you receive the renewal notice. 

To limit marketing offers, contact us 

[include all that apply]: 

• By telephone: 1–877–###–#### 

• On the Web: www.—.com 

• By mail: check the box and complete the 

form below, and send the form to: 

[Company name] 

[Company address] 

b Do not allow any company [in the ABC 

group of companies] to use my personal 

information to market to me. 

A–3—Model Form for Renewal Notice 

(Single-Affiliate Notice)—[Renewing Your 

Choice to Limit Marketing]/[Renewing Your 

Marketing Opt Out] 

• [Name of Affiliate] is providing this 

notice. 

• [Optional: Federal law gives you the 

right to limit some but not all marketing from 

our affiliates. Federal law also requires us to 

give you this notice to tell you about your 

choice to limit marketing from our affiliates.] 

• You previously chose to limit our 

affiliates in the [ABC] group of companies, 

such as our [investment adviser, investment 

company, transfer agent, and broker-dealer] 

affiliates, from marketing their products or 

services to you based on your personal 

information that we share with them. This 

information includes your [income], your 

[account history with us], and your [credit 

score]. 

• Your choice has expired or is about to 

expire. 

To renew your choice to limit marketing 

for [x] more years, contact us [include all that 

apply]: 

• By telephone: 1–877–###–#### 

• On the Web: www.—.com 

• By mail: check the box and complete the 

form below, and send the form to: 

[Company name] 

[Company address] 

b Renew my choice to limit marketing for 

[x] more years. 

A–4—Model Form for Renewal Notice (Joint 

Notice)—[Renewing Your Choice to Limit 

Marketing]/[Renewing Your Marketing Opt 

Out] 

• The [ABC group of companies] is 

providing this notice. 

• [Optional: Federal law gives you the 

right to limit some but not all marketing from 

the [ABC] companies. Federal law also 

requires us to give you this notice to tell you 

about your choice to limit marketing from the 

[ABC] companies.] 

• You previously chose to limit the [ABC] 

companies, such as the [ABC investment 

adviser, investment company, transfer agent, 

and broker-dealer] affiliates, from marketing 

their products or services to you based on 

your personal information that they receive 

from other ABC companies. This information 

includes your [income], your [account 

history], and your [credit score]. 

• Your choice has expired or is about to 

expire. 

To renew your choice to limit marketing 

for [x] more years, contact us [include all that 

apply]: 

• By telephone: 1–877–###–#### 

• On the Web: www.—.com 

• By mail: check the box and complete the 

form below, and send the form to: 

[Company name] 

[Company address] 

b Renew my choice to limit marketing for 

[x] more years. 

A–5—Model Form for Voluntary ‘‘No 

Marketing’’ Notice—Your Choice to Stop 

Marketing 

• [Name of Affiliate] is providing this 

notice. 

• You may choose to stop all marketing 

from us and our affiliates. 

• [Your choice to stop marketing from us 

and our affiliates will apply until you tell us 

to change your choice.] 

To stop all marketing, contact us [include 

all that apply]: 

• By telephone: 1–877–###–#### 

• On the Web: www.—.com 

• By mail: check the box and complete the 

form below, and send the form to: 

[Company name] 

[Company address] 

b Do not market to me. 

Dated: August 4, 2009. 

By the Commission. 

Elizabeth M. Murphy, 

Secretary. 

[FR Doc. E9–19020 Filed 8–10–09; 8:45 am] 

BILLING CODE 8010–01–P 


srobinson on DSKHWCL6B1PROD with RULES3