[Federal Register Volume 74, Number 153 (Tuesday, August 11, 2009)]
[Rules and Regulations]
[Pages 40398-40440]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: E9-19020]



[[Page 40397]]

-----------------------------------------------------------------------

Part III





Securities and Exchange Commission





-----------------------------------------------------------------------



17 CFR Part 248



Regulation S-AM: Limitations on Affiliate Marketing; Final Rule

Federal Register / Vol. 74 , No. 153 / Tuesday, August 11, 2009 / 
Rules and Regulations

[[Page 40398]]


-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

17 CFR Part 248

[Release Nos. 34-60423, IC-28842, IA-2911; File No. S7-29-04]
RIN 3235-AJ24


Regulation S-AM: Limitations on Affiliate Marketing

AGENCY: Securities and Exchange Commission.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Securities and Exchange Commission (``Commission'') is 
adopting Regulation S-AM to implement Section 624 of the Fair Credit 
Reporting Act as amended by Section 214 of the Fair and Accurate Credit 
Transactions Act of 2003, which required the Commission and other 
Federal agencies to adopt rules implementing limitations on a person's 
use of certain information received from an affiliate to solicit a 
consumer for marketing purposes, unless the consumer has been given 
notice and a reasonable opportunity and a reasonable and simple method 
to opt out of such solicitations. The final rules implement the 
requirements of Section 624 with respect to investment advisers and 
transfer agents registered with the Commission, as well as brokers, 
dealers and investment companies.

DATES: Effective Date: September 10, 2009.
    Compliance Date: Compliance will be mandatory as of January 1, 
2010.

FOR FURTHER INFORMATION CONTACT: For information regarding the 
regulation as it relates to brokers, dealers, or transfer agents, 
contact Brice Prince, Special Counsel, or Ignacio Sandoval, Attorney, 
Office of Chief Counsel, Division of Trading and Markets, (202) 551-
5550, or regarding the regulation as it relates to investment companies 
or investment advisers, contact Penelope Saltzman, Assistant Director, 
Office of Regulatory Policy, Division of Investment Management, (202) 
551-6792, Securities and Exchange Commission, 100 F Street, NE., 
Washington, DC 20549.

SUPPLEMENTARY INFORMATION: The Commission today is adopting Regulation 
S-AM, 17 CFR 248.101 through 248.128, under the Fair and Accurate 
Credit Transactions Act of 2003 (``FACT Act''),\1\ the Securities 
Exchange Act of 1934 (the ``Exchange Act''),\2\ the Investment Company 
Act of 1940 (the ``Investment Company Act''),\3\ and the Investment 
Advisers Act (the ``Advisers Act'').\4\
---------------------------------------------------------------------------

    \1\ Public Law 108-159, Section 214, 117 Stat. 1952, 1980 
(2003).
    \2\ 15 U.S.C. 78q, 78w, and 78mm.
    \3\ 15 U.S.C. 80a-30 and 80a-37.
    \4\ 15 U.S.C. 80b-4 and 80b-11.
---------------------------------------------------------------------------

Table of Contents

I. Background
II. Overview of Comments Received and Explanation of Regulation S-AM
    A. Overview of Comments Received
    B. Explanation of Regulation S-AM
III. Section-by-Section Analysis
    A. Section 248.101 Purpose and Scope
    B. Section 248.102 Examples
    C. Section 248.120 Definitions
    1. Affiliate
    2. Broker
    3. Clear and Conspicuous
    4. Commission
    5. Company
    6. Concise
    7. Consumer
    8. Control
    9. Dealer
    10. Eligibility Information
    11. FCRA
    12. GLBA
    13. Investment Adviser
    14. Investment Company
    15. Marketing Solicitation
    16. Person
    17. Pre-Existing Business Relationship
    18. Transfer Agent
    19. You
    D. Section 248.121 Affiliate Marketing Opt Out and Exceptions
    1. Section 248.121(a)
    2. Section 248.121(b)
    3. Sections 248.121(c) and (d)
    4. Relation to Affiliate-Sharing Notice and Opt Out
    E. Section 248.122 Scope and Duration of Opt Out
    1. Section 248.122(a)
    2. Section 248.122(b) Duration and Timing of Opt Out
    3. Section 248.122(c)
    F. Section 248.123 Contents of Opt Out Notice; Consolidated and 
Equivalent Notices
    1. Section 248.123(a)
    2. Coordinated, Consolidated, and Equivalent Notices
    G. Section 248.124 Reasonable Opportunity To Opt Out
    1. Section 248.124(a)
    2. Section 248.124(b)
    H. Section 248.125 Reasonable and Simple Methods of Opting Out
    I. Section 248.126 Delivery of Opt Out Notices
    J. Section 248.127 Renewal of Opt Out Elections
    K. Section 248.128 Effective Date, Compliance Date, and 
Prospective Application
    1. Section 248.128(a) and (b)
    2. Section 248.128(c)
IV. Appendix to Subpart B-Model Forms
V. Cost-Benefit Analysis
VI. Paperwork Reduction Act
    A. Collection of Information
    B. Use of Information
    C. Respondents
    D. Total Annual Reporting and Recordkeeping Burdens
    E. Retention Period for Recordkeeping Requirements
    F. Collection of Information Is Mandatory
VII. Final Regulatory Flexibility Analysis
    A. Need for the Rule
    B. Description of Small Entities to Which the Final Rules Will 
Apply
    C. Projected Reporting, Recordkeeping, and Other Compliance 
Requirements
    D. Identification of Other Duplicative, Overlapping, or 
Conflicting Federal Rules
    E. Agency Actions To Minimize Effects on Small Entities
VIII. Consideration of Burden on Competition, and Promotion of 
Efficiency, Competition, and Capital Formation
IX. Statutory Authority
X. Text of Final Rules

I. Background

    Section 214 of the FACT Act added Section 624 to the Fair Credit 
Reporting Act (``FCRA'').\5\ This new section of the FCRA gives 
consumers the right to restrict a person from making marketing 
solicitations to them using certain information about them obtained 
from the person's affiliate. Section 214 also required the Office of 
the Comptroller of the Currency (``OCC''), the Board of Governors of 
the Federal Reserve System (``Board''), the Federal Deposit Insurance 
Corporation (``FDIC''), the Office of Thrift Supervision, the National 
Credit Union Administration (``NCUA'') (collectively, the ``Banking 
Agencies'') and the Federal Trade Commission (``FTC'') (collectively 
with the Banking Agencies, the ``Agencies''), and the Commission, in 
consultation and coordination with one another, to issue rules 
implementing Section 624 of the FCRA.
---------------------------------------------------------------------------

    \5\ See Public Law 108-159, Section 214, 117 Stat. 1952, 1980 
(2003); 15 U.S.C. 1681s-3 and note. The FCRA sets standards for the 
collection, communication, and use of information bearing on a 
consumer's credit worthiness, credit standing, credit capacity, 
character, general reputation, personal characteristics, or mode of 
living.
    A portion of Section 214 of the FACT Act amended the FCRA to add 
a new Section 624, while other provisions of Section 214 were not 
incorporated into the FCRA. Throughout this release, references to 
``Section 214'' or ``Section 624 of the FCRA'' are used depending on 
whether the reference is to Section 624 or to a portion of Section 
214 not incorporated into the FCRA.
---------------------------------------------------------------------------

    Commission staff consulted and coordinated with staff of the 
Agencies in drafting rules to implement Section 624. As required by 
Section 214 of the FACT Act, Regulation S-AM is, to the extent 
possible, consistent with and comparable to the implementing 
regulations adopted by the Agencies.\6\

[[Page 40399]]

Regulation S-AM contains rules of general applicability that are 
substantially similar to the rules that have been adopted by the 
Agencies. Regulation S-AM also contains examples that illustrate the 
application of the general rules. These examples differ from those used 
by the Agencies in order to provide more meaningful guidance to 
financial institutions subject to the Commission's jurisdiction.
---------------------------------------------------------------------------

    \6\ See Banking Agencies, Fair Credit Reporting Affiliate 
Marketing Regulations, 72 FR 62910 (Nov. 7, 2007) (``Joint Rules''). 
Citations to particular provisions of the ``Joint Rules'' refer to 
the numbering system used in the Board's final rules. See 12 CFR 
222.1 to 222.28. See also FTC, Affiliate Marketing Rule, 72 FR 61424 
(Oct. 30, 2007) (``FTC Rule'').
---------------------------------------------------------------------------

II. Overview of Comments Received and Explanation of Regulation S-AM

A. Overview of Comments Received

    On July 8, 2004, the Commission proposed Regulation S-AM (the 
``proposal'' or ``proposed rules'').\7\ The Commission received 15 
comments on the proposed rules from financial institutions and their 
representatives.\8\ While a number of commenters generally supported 
the Commission's proposals,\9\ others expressed concerns regarding 
particular provisions of the proposed rules. The most significant areas 
of concern raised by the commenters related to: (1) Proposed 
restrictions on ``constructive sharing''; (2) which affiliate would be 
responsible for providing the notice; (3) the proposed definitions for 
terms such as ``affiliate,'' ``eligibility information,'' ``clear and 
conspicuous,'' ``pre-existing business relationship,'' and ``marketing 
solicitation''; and (4) the scope of certain proposed exceptions to the 
proposed rules' notice and opt out requirements.\10\ A more detailed 
discussion of the comments is contained in the Section-by-Section 
analysis below.
---------------------------------------------------------------------------

    \7\ Limitations on Affiliate Marketing (Regulation S-AM), 
Exchange Act Release No. 49985 (July 8, 2004), 69 FR 42302 (July 14, 
2004) (``Proposing Release'').
    \8\ The Securities Industries Association, n/k/a the Securities 
Industry and Financial Markets Association (``SIFMA'') submitted two 
comment letters. We consider these letters to be one comment. See 
Letters from Alan E. Sorcher, Vice President and Associate General 
Counsel, SIFMA to Jonathan G. Katz, Secretary, Commission (Aug. 13, 
2004) (``SIFMA Letter I'') and from Alan E. Sorcher, Vice President 
and Associate General Counsel, SIFMA to Jonathan G. Katz, Secretary, 
Commission (Aug. 18, 2004) (``SIFMA Letter II'') (together ``SIFMA 
Letters''). Unless otherwise noted, all letters referred to below 
were addressed to the Secretary of the Commission.
    See Letter from Michael E. Bleier, General Counsel, Mellon 
Financial Corporation (July 26, 2004) (``Mellon Letter''); Letter 
from Ira Friedman, Senior Vice President, Chief Privacy Officer and 
Special Counsel, Metropolitan Life Insurance Company (Aug. 3, 2004) 
(``MetLife Letter''); Letter from Larkin Fields, Senior Vice 
President and Chief Privacy Officer, United Services Automobile 
Association (Aug. 11, 2004) (``USAA Letter''); Letter from Jeffrey 
A. Tassey, Executive Director, Coalition to Implement the FACT Act 
(Aug. 12, 2004) (``Coalition Letter''); Letter from Monique S. 
Botkin, Counsel, Investment Counsel Association of America, Inc., n/
k/a Investment Adviser Association (Aug. 12, 2004) (``IAA Letter''); 
Letter from Robert G. Rowe, III, Regulatory Counsel, Independent 
Community Bankers of America (Aug. 12, 2004) (``ICBA Letter''); 
Letter from Peter L. McCorkell, Senior Counsel, Wells Fargo & 
Company (Aug. 12, 2004) (``Wells Fargo Letter''); Letter from 
Roberta B. Meyer, Senior Counsel, Risk Classification, American 
Council of Life Insurers (``ACLI'') (Aug. 13, 2004) (``ACLI 
Letter''); Letter from Tamara K. Salmon, Senior Associate Counsel, 
Investment Company Institute (``ICI'') (Aug. 13, 2006) (``ICI 
Letter''); Letter from Henry H. Hopkins, Chief Legal Counsel, and 
Karen Nash-Goetz, Associate Legal Counsel, T. Rowe Price Associates, 
Inc. (Aug. 13, 2004) (``T. Rowe Price Letter''); Letter from J. 
Stephen Zielezienski, Vice President & Associate General Counsel, 
American Insurance Association (``AIA'') (Aug. 15, 2004) (``AIA 
Letter''); Letter from Beth L. Climo, Executive Director, American 
Bankers Association Securities Association (``ABASA'') (Aug. 16, 
2004) (``ABASA Letter''); Letter from Robert C. Drozdowski, Vice 
President, Payments and Technology Policy, America's Community 
Bankers (``ACB'') (Aug. 16, 2004) (``ACB Letter''); Letter from 
Richard M. Whiting, Executive Director and General Counsel, The 
Financial Services Roundtable (``FSR'') (Aug. 16, 2004) (``FSR 
Letter''). Each of these letters is available at http://www.sec.gov/rules/proposed/s72904.shtml.
    \9\ See, e.g., IAA Letter; ICI Letter; Mellon Letter; MetLife 
Letter.
    \10\ See infra Part III.D.
---------------------------------------------------------------------------

B. Explanation of Regulation S-AM

    Regulation S-AM will allow a consumer, in certain limited 
situations, to block affiliates of a person subject to Regulation S-AM 
that the consumer does business with from soliciting the consumer based 
on certain ``eligibility information'' (i.e., certain financial 
information, such as information regarding the consumer's transactions 
or experiences with the person) received from the person. Unlike 
Regulation S-P, the Commission's privacy rule,\11\ Regulation S-AM does 
not prohibit the sharing of information with another entity. Instead, 
Regulation S-AM prohibits a company from using eligibility information 
received from an affiliate to make marketing solicitations to 
consumers, unless: (1) The potential marketing use of the information 
has been clearly, conspicuously, and concisely disclosed to the 
consumer; (2) the consumer has been provided a reasonable opportunity 
and a simple method to opt out of receiving the marketing solicitation; 
and (3) the consumer has not opted out. Regulation S-AM also provides 
that a notice and opt out required under Regulation S-AM can be 
combined with other disclosures required by law, such as the initial 
and annual privacy notices required by Regulation S-P. Regulation S-AM 
also contains a number of exceptions to its notice and opt out 
requirements, such as when an affiliate making a marketing solicitation 
has a pre-existing business relationship with the consumer, or provides 
marketing material in response to an affirmative request by the 
consumer or in response to a communication initiated by the consumer. 
In addition, the Appendix to Regulation S-AM provides model forms that, 
when used properly, satisfy Regulation S-AM's requirement that an 
affiliate marketing notice be clear, conspicuous, and concise. 
Regulation S-AM also includes examples illustrating the applicability 
of the final rules to certain situations. The facts and circumstances 
of each individual situation, however, will determine whether 
compliance with an example, to the extent applicable, constitutes 
compliance with the final rules.
---------------------------------------------------------------------------

    \11\ Currently, Regulation S-P is codified at 17 CFR Part 248. 
With the adoption of Regulation S-AM, we are redesignating 
Regulation S-P as Subpart A of Part 248, and adopting Regulation S-
AM as Subpart B of Part 248. We are also adopting technical and 
conforming amendments to Regulation S-P to reflect this change as 
detailed infra Part X. In particular, we are changing the current 
subpart designations within Regulation S-P to undesignated center 
headings, revising all references in Regulation S-P to ``this part'' 
to read ``this subpart,'' and for consistency with the term used in 
Regulation S-AM, revising all references to ``G-L-B Act'' to read 
``GLBA.'' We are consolidating Regulation S-P and Regulation S-AM in 
Part 248 because both regulations address information sharing and 
safekeeping.
---------------------------------------------------------------------------

    As adopted, Regulation S-AM differs from the proposed rules in 
several significant ways. First, an affiliate communicating eligibility 
information is not responsible for providing an affiliate marketing 
notice. Instead, the notice may be provided by any affiliate identified 
in the notice that has, or has previously had, a pre-existing business 
relationship with the consumer to whom the notice is provided. Second, 
the final rules do not apply to ``constructive sharing'' scenarios, as 
considered in the Proposing Release. Third, the Commission requested 
and received comment on the use of oral notices, and after careful 
consideration of the comments, the final rules provide that notices 
cannot be delivered orally, but instead, must be delivered 
electronically or in writing. While consumers can elect to opt out 
orally after receipt of the notice, they may not orally revoke their 
opt out. Fourth, unlike the proposal which referred to ``making or 
sending'' marketing solicitations, the final rules eliminate the 
reference to ``send'' because we concluded, based on comments, that 
``sending'' and ``making'' marketing solicitations are different 
activities. Fifth, the final rules clarify that an opt

[[Page 40400]]

out notice may apply to eligibility information obtained in connection 
with one or more continuing relationships the consumer establishes with 
an entity or its affiliates, as long as the notice adequately describes 
the relationships covered by the notice. Sixth, the final rules include 
a new section describing the conditions under which a service provider 
for both an entity that has a pre-existing business relationship with a 
consumer and the entity's affiliate would be acting for the entity 
rather than its affiliate whose products or services are being 
marketed. Finally, the definition of ``affiliate,'' ``control,'' 
``marketing solicitation,'' and ``pre-existing business relationship'' 
have been revised to reflect comments we received.\12\
---------------------------------------------------------------------------

    \12\ These and other changes are discussed in greater detail 
infra Part III.
---------------------------------------------------------------------------

III. Section-by-Section Analysis

    While the Proposing Release placed Regulation S-AM in 17 CFR 247.1-
247.28, the final rules are located in 17 CFR 248.101 through 
248.128.\13\
---------------------------------------------------------------------------

    \13\ See supra note 11. This numbering system differs slightly 
from the one used by the Agencies, but is still consistent with the 
Joint Rules--Regulation S-AM uses section numbers that are higher by 
100 than those used in the Joint Rules. For example, references to 
Sec.  22 of the Joint Rules would correspond to Sec.  122 of 
Regulation S-AM. In addition, the Commission believes that placing 
Regulation S-AM in the same part of the CFR as the Commission's 
privacy rules (i.e., Regulation S-P) will provide persons subject to 
the rules with an easier point of reference, especially since we 
expect that these persons would consolidate the notice and opt out 
requirements of the affiliate marketing rules together with those of 
the privacy rules.
---------------------------------------------------------------------------

A. Section 248.101 Purpose and Scope

    We received no comments on proposed Sec.  247.1, which identifies 
the purposes and scope of the rules, and we are adopting it as 
proposed, redesignated as Sec.  248.101. Paragraph (a) of Sec.  248.101 
of Regulation S-AM provides that the purpose of Regulation S-AM is to 
implement the affiliate marketing provisions of Section 624 of the 
FCRA. Paragraph (b) of Sec.  248.101 lists the entities to which the 
final rules apply. Although the FACT Act does not specifically identify 
the entities that are to be subject to the rules prescribed by the 
Commission,\14\ Congress's inclusion of the Commission as one of the 
agencies required to adopt implementing regulations suggests that 
Congress intended that our rules apply to those entities that the 
Commission regulates, i.e., brokers, dealers, and investment companies, 
as well as to investment advisers and transfer agents that are 
registered with the Commission (respectively, ``registered investment 
advisers'' and ``registered transfer agents,'' and, collectively, with 
brokers, dealers, and investment companies, ``Covered Persons'').\15\ 
These entities are referred to as ``you'' throughout Regulation S-AM. 
We have excluded from the scope of the regulation broker-dealers 
registered by notice with the Commission under Section 15(b)(11) of the 
Exchange Act for the purpose of conducting business in security futures 
products (``notice-registered broker-dealers'').\16\
---------------------------------------------------------------------------

    \14\ Section 214(b) of the FACT Act directed that regulations 
implementing Section 624 of the FCRA be prescribed by the ``Federal 
banking agencies, the National Credit Union Administration, and the 
[Federal Trade] Commission, with respect to the entities that are 
subject to their respective enforcement authority under Section 621 
of the Fair Credit Reporting Act [15 U.S.C. 1681s] and the 
Securities and Exchange Commission * * * .'' See 15 U.S.C. 1681s-3 
note. Section 621(a)(1) of the FCRA grants enforcement authority to 
the FTC for all persons subject to the FCRA ``except to the extent 
that enforcement * * * is specifically committed to some other 
government agency under subsection (b)'' of Section 621. 15 U.S.C. 
1681s(a)(1). The Commission is not one of the agencies included 
under subsection (b). The Commission was added to the list of 
Federal agencies required by Section 214(b) to adopt regulations 
implementing Section 624 of the FCRA in conference committee. There 
is no legislative history on this issue.
    \15\ The term ``Covered Persons'' is used for the purposes of 
this release and is not a defined term in Regulation S-AM. The 
application of Regulation S-AM to investment companies, brokers, 
dealers (other than notice-registered broker-dealers), and 
registered transfer agents and investment advisers is consistent 
with Regulation S-P. Not all transfer agents, investment companies 
or investment advisers are required to register with the Commission. 
Section 17A(c) of the Exchange Act requires that transfer agents 
register with the appropriate regulatory agency, which can be the 
Commission, the Board, the OCC or the FDIC. 15 U.S.C. 78c(a)(34) 
(defining ``appropriate regulatory agency''); 15 U.S.C.78q-1(c) 
(describing the registration requirements for transfer agents). 
Section 6(f) of the Investment Company Act (15 U.S.C. 80a-6(f)) 
provides an exemption from registration for a closed-end investment 
company that elects to be regulated as a business development 
company pursuant to Section 54 of the Act (15 U.S.C. 80a-53). 
Sections 203 and 203A of the Advisers Act govern the registration of 
investment advisers with the Commission. See 15 U.S.C. 80b-3 and 
80b-3a.
    \16\ See discussion of definitions of ``broker'' and ``dealer'' 
infra Parts III.C.2 and III.C.9. Notice-registered broker-dealers 
are subject to primary oversight by the Commodity Futures Trading 
Commission (``CFTC'') and are exempted from all but the core 
provisions of the laws administered by the Commission. We interpret 
Congress's exclusion of the CFTC from the list of financial 
regulators required by Section 214(b) of the FACT Act to prescribe 
regulations implementing Section 624 of the FCRA to mean that 
Congress did not intend for the Commission's rules under the FACT 
Act to apply to entities subject to primary oversight by the CFTC.
---------------------------------------------------------------------------

B. Section 248.102 Examples

    We are adopting as proposed Sec.  247.2, which clarifies the effect 
of the examples used in the rules and model forms, redesignated as 
Sec.  248.102. Given the wide range of possible situations covered by 
Section 624 of the FCRA, Regulation S-AM includes general rules, 
provides more specific examples, and includes model opt out notice 
forms. The examples, which are not exclusive, provide guidance 
concerning the rules' application in ordinary circumstances. The facts 
and circumstances of each individual situation, however, will determine 
whether compliance with an example, to the extent applicable, 
constitutes compliance with this subpart.\17\ Examples in a paragraph 
illustrate only the issue described in the paragraph and do not 
illustrate any other issue that may arise under this subpart. 
Similarly, the examples do not illustrate any issues that may arise 
under other laws or regulations. We received no comment on this 
section.
---------------------------------------------------------------------------

    \17\ The Joint Rules and the FTC Rule provide that, to the 
extent applicable, compliance with an example constitutes compliance 
with the Joint Rules and the FTC Rule, respectively. See, e.g., 12 
CFR 222.2. The examples in our final rules, however, do not provide 
the same safe harbor. The examples in Regulation S-AM are intended 
to describe the broad outlines of situations illustrating compliance 
with the applicable rule. However, the specific facts and 
circumstances relating to a particular situation will determine 
whether compliance with an example constitutes compliance with the 
rules.
---------------------------------------------------------------------------

C. Section 248.120 Definitions

    As noted, for consistency and ease of reference, Regulation S-AM 
generally follows the section numbering used in the Joint Rules and the 
FTC Rule. Therefore, the defined terms proposed under Sec.  247.3 are 
now located in Sec.  248.120. In addition, the examples corresponding 
to the definition of ``pre-existing business relationship,'' in 
proposed Sec.  247.20(d)(1), are now included in the definition of 
``pre-existing business relationship,'' which is redesignated as Sec.  
248.120(q)(2) in the final rules.\18\
---------------------------------------------------------------------------

    \18\ See supra note 13.
---------------------------------------------------------------------------

1. Affiliate
    We are revising the proposed definition of ``affiliate'' in 
response to issues raised by commenters. The proposal defined 
``affiliate'' of a Covered Person as any person that is related by 
common ownership or common corporate control with the Covered Person. 
The proposed rule also provided that a Covered Person is considered an 
affiliate of another person for purposes of Regulation S-AM if: (1) The 
other person is regulated under Section 214 of the FACT Act by one of 
the Agencies; and (2) the rules adopted by that Agency treat the 
Covered Person as an affiliate of the other person.\19\ The proposed

[[Page 40401]]

definition followed the definition of ``affiliates'' in Section 2 of 
the FACT Act, which encompasses ``persons that are related by common 
ownership or affiliated by corporate control.'' \20\
---------------------------------------------------------------------------

    \19\ Proposed Sec.  247.3(a)(1)-(2). This provision was designed 
to prevent the disparate treatment of affiliates within a holding 
company structure that are regulated by different Federal regulators 
and to make this provision of Regulation S-AM consistent with 
comparable provisions of the Agencies.
    \20\ Several FCRA provisions apply to information sharing with 
persons ``related by common ownership or affiliated by corporate 
control,'' ``related by common ownership or affiliated by common 
corporate control,'' or ``affiliated by common ownership or common 
corporate control.'' See, e.g., FCRA Sections 603(d)(2), 615(b)(2), 
and 625(b)(2). Each of these provisions was enacted as part of the 
1996 amendments to the FCRA. Similarly, Section 2(4) of the FACT Act 
defines the term ``affiliate'' to mean ``persons that are related by 
common ownership or affiliated by corporate control.'' In contrast, 
the Gramm-Leach-Bliley Act (``GLBA'') defines ``affiliate'' to mean 
``any company that controls, is controlled by, or is under common 
control with another company.'' See 15 U.S.C. 6809(6).
---------------------------------------------------------------------------

    Commenters noted with approval the proposed definition's general 
consistency with the definition of ``affiliate'' in the GLBA and 
Regulation S-P, but some suggested the definitions should be made more 
consistent.\21\ Two commenters suggested that we eliminate the term 
``corporate'' in the Regulation S-AM definition.\22\ In addition, two 
commenters suggested that the Commission adopt the approach to the 
definition of affiliate taken under California's Financial Information 
Privacy Act (``California Privacy Law'').\23\
---------------------------------------------------------------------------

    \21\ See ACB Letter; FSR Letter; IAA Letter; ICBA Letter; ICI 
Letter; T. Rowe Price Letter; Wells Fargo Letter.
    \22\ See ICI Letter; T. Rowe Price Letter.
    \23\ See FSR Letter; Mellon Letter. These commenters noted that 
the California law places no restriction on information sharing 
among affiliates if they: (1) Are regulated by the same or similar 
functional regulators; (2) are involved in the same broad line of 
business, such as banking, insurance, or securities; and (3) share a 
common brand identity. See Cal. Financial Code Section 4053(c).
---------------------------------------------------------------------------

    After considering the comments, we are revising the definition of 
``affiliate'' to eliminate the term ``corporate'' from the 
definition.\24\ The final definition harmonizes the various FCRA and 
FACT Act formulations, and the GLBA definition, by defining 
``affiliate'' to mean ``any person that is related by common ownership 
or common control with'' another person. While Section 2 of the FACT 
Act contains the term ``corporate,'' we did not include it in the final 
rule in recognition of other types of control relationships that may 
give rise to affiliation under the rule.\25\ In contrast to the other 
regulators, we did not replace the term ``person'' with ``company'' in 
the definition because certain of our Covered Persons are natural 
persons. For example, some brokers-dealers and some investment advisers 
registered with the Commission are sole proprietors. In contrast, 
banking charters are held by entities other than natural persons. This 
change to the definition of ``affiliate'' is intended to promote 
consistency in the Commission's rules and to prevent gaps in the 
coverage of Regulation S-AM. We do not believe that there is a 
substantive difference between the definitions of ``affiliate'' in the 
FACT Act and in Section 509 of the GLBA.\26\ We are not, however, 
incorporating elements of the California Privacy Law into the 
definition. To do so would be beyond our congressional mandate, 
especially given that Congress itself could have incorporated those 
elements when amending the FCRA.
---------------------------------------------------------------------------

    \24\ Section 248.120(a).
    \25\ As discussed below, ``control'' is defined in Regulation S-
AM to include control relationships that go beyond those based on 
corporate control. See infra Part III.C.8.
    \26\ This approach is also consistent with the Agencies' final 
rules. See Joint Rules at 72 FR 62912; FTC Rule at 72 FR 61426.
---------------------------------------------------------------------------

2. Broker
    We received no comments on the proposed definition of ``broker'' 
and are adopting it as proposed.\27\ The definition incorporates the 
definition of ``broker'' in the Exchange Act and excludes notice-
registered brokers.\28\
---------------------------------------------------------------------------

    \27\ See Sec.  248.120(b), which was proposed as Sec.  247.3(b).
    \28\ See supra note 16.
---------------------------------------------------------------------------

3. Clear and Conspicuous
    We are adopting the definition of ``clear and conspicuous'' as 
proposed to mean reasonably understandable and designed to call 
attention to the nature and significance of the information 
presented.\29\ Persons may wish to consider a number of methods to make 
their notices clear and conspicuous, including those described below. 
Institutions are not required to implement any particular method or 
combination of methods to make their disclosures clear and conspicuous. 
Rather, the particular facts and circumstances will determine whether a 
disclosure is clear and conspicuous. Consistent with the Proposing 
Release, a notice or disclosure may be made reasonably understandable 
through various methods that include:
---------------------------------------------------------------------------

    \29\ See Sec.  248.120(c), proposed as Sec.  247.3(c).
---------------------------------------------------------------------------

    <bullet> Using clear and concise sentences, paragraphs, and 
sections;
    <bullet> Using short explanatory sentences;
    <bullet> Using bullet lists;
    <bullet> Using definite, concrete, everyday words;
    <bullet> Using active voice;
    <bullet> Avoiding multiple negatives;
    <bullet> Avoiding legal and highly technical business terminology; 
and
    <bullet> Avoiding explanations that are imprecise and readily 
subject to different interpretations.\30\
---------------------------------------------------------------------------

    \30\ See Proposing Release at 69 FR 42305.
---------------------------------------------------------------------------

    A notice or disclosure could also use various design methods to 
call attention to the nature and significance of the information in it, 
including but not limited to:
    <bullet> Using a plain-language heading;
    <bullet> Using a typeface and type size that are easy to read;
    <bullet> Using wide margins and ample line spacing; and
    <bullet> Using boldface or italics for key words.\31\
---------------------------------------------------------------------------

    \31\ Id.
---------------------------------------------------------------------------

    Persons who choose to provide the notice or disclosure by using an 
Internet Web site may use text or visual cues to encourage the reader 
to scroll down the page, if necessary, to view the entire document. 
Persons may also take steps to ensure that other elements on the Web 
site (such as text, graphics, hyperlinks, or sound) do not distract 
attention from the notice or disclosure.
    If a notice or disclosure required under Regulation S-AM is 
combined with other information, methods for designing the notice or 
disclosure to call attention to the nature and significance of the 
information in it may include distinctive type sizes, styles, fonts, 
paragraphs, headings, graphic devices, and appropriate groupings of 
information. However, there is no need to use distinctive features, 
such as distinctive type sizes, styles, or fonts, to differentiate an 
affiliate marketing opt out notice from other components of a required 
disclosure. For example, the notice could be included in a GLBA privacy 
notice that combines several opt out disclosures in a single notice. 
Moreover, nothing in the clear and conspicuous standard requires 
segregation of the affiliate marketing opt out notice when it is 
combined with a GLBA privacy notice or other required disclosures.
    We recognize that it will not be feasible or appropriate to 
incorporate all of the methods described above with respect to every 
affiliate marketing notice. We recommend, but do not require, that 
institutions consider the methods described above in designing their 
notices. We also encourage the use of consumer or other readability 
testing to devise notices that are understandable to consumers.
    Five commenters addressed the proposed definition of ``clear and

[[Page 40402]]

conspicuous.'' \32\ One commenter expressed approval of the proposed 
definition because of its similarity to the definition of the term 
found in Regulation S-P.\33\ However, other commenters suggested that 
the definition could give rise to an increased risk of litigation and 
civil liability for financial institutions.\34\ While these commenters 
recognized that the proposed definition was derived from the GLBA 
privacy regulations, they noted that compliance with the GLBA privacy 
regulations is enforced exclusively through administrative actions and 
not through private litigation. One commenter suggested the definition 
was unnecessary to ensure that consumers receive a clear and 
conspicuous notice as required by Section 624 of the FCRA, noting that 
other affiliate sharing notice and opt out requirements have operated 
in the FCRA for several years without a regulatory definition.\35\ 
Commenters also pointed to the Board's withdrawal of a similar 
definition in other regulations as support for not including the 
definition.\36\ In the alternative, one commenter suggested that the 
Commission and the Agencies issue questions and answers or non-
exclusive examples indicating that compliance with one of these 
examples would satisfy the rule's requirements.\37\ Another commenter 
suggested outlining reasonable expectations for what would be 
considered ``clear and conspicuous'' and suggested including reasonable 
protections against liability and administrative penalties when 
unintentional errors occur.\38\
---------------------------------------------------------------------------

    \32\ See ACB Letter; Coalition Letter; IAA Letter; ICBA Letter; 
Wells Fargo Letter.
    \33\ See IAA Letter. See also 17 CFR 248.3(c)(1) (defining 
``clear and conspicuous'' for purposes of Regulation S-P).
    \34\ See ACB Letter; ICBA Letter; Wells Fargo Letter.
    \35\ See Coalition Letter. The FCRA contains ``affiliate 
sharing'' notice and opt out provisions that are distinct from the 
``affiliate marketing'' provisions of Regulation S-AM. Section 
603(d)(2)(A)(iii) of the FCRA provides that a person may communicate 
information that is not transaction or experience information among 
its affiliates without that information becoming a consumer report 
if the sharing is clearly and conspicuously disclosed to the 
consumer and the consumer is given an opportunity to opt out of the 
sharing. In contrast, Regulation S-AM limits the use of information 
by affiliates for marketing purposes, not the sharing of information 
among affiliates.
    \36\ See Coalition Letter; Wells Fargo Letter. These commenters 
cited the Board's decision to withdraw a similar proposal to define 
``clear and conspicuous'' for purposes of Regulations B, E, M, Z, 
and DD, in part because of concerns over civil liability.
    \37\ See ICBA Letter. One commenter urged us to make clear that 
a person does not have to use specific terms for opt out and that 
this should be included as part of the account opening process. See 
SIFMA Letter I.
    \38\ See ACB Letter; see also 12 U.S.C. 4301, et seq.
---------------------------------------------------------------------------

    Because the FACT Act requires that we provide specific guidance on 
how to comply with the clear and conspicuous standard,\39\ we believe 
that it is important to both define ``clear and conspicuous'' in the 
final rules and provide specific guidance for how to satisfy that 
standard.\40\ The Commission notes that an affiliate sharing opt out 
notice required under the FCRA, which may be enforced through private 
rights of action, must be included in a GLBA privacy notice.\41\ 
Therefore, the affiliate sharing opt out notices generally are provided 
in a manner consistent with the clear and conspicuous standard set 
forth in the GLBA privacy regulations.\42\ We believe that Covered 
Persons' experience in providing clear and conspicuous affiliate 
sharing notices should help them provide clear and conspicuous 
affiliate marketing notices under Regulation S-AM.
---------------------------------------------------------------------------

    \39\ See 15 U.S.C. 1681s-3(a)(2)(B) (``Notwithstanding 
subparagraph (A), the notice required under paragraph (1) shall be 
clear, conspicuous, and concise * * *. The regulations prescribed to 
implement this section shall provide specific guidance regarding how 
to comply with such standards.'').
    \40\ The Commission is providing two types of specific guidance 
on satisfying the requirement to provide a clear and conspicuous 
affiliate marketing opt out notice. First, this release and Sec.  
248.121(a) describe certain techniques that may be used to make 
notices clear and conspicuous. Second, the Commission is adopting as 
part of Regulation S-AM the model forms set forth in the Appendix to 
Subpart B--Model Forms (``Appendix'') that may, but are not required 
to, be used to facilitate compliance with the affiliate marketing 
notice requirements.
    \41\ See 15 U.S.C. 6803(b)(4).
    \42\ See, e.g., the definition and examples in Regulation S-P at 
17 CFR 248.3(c).
---------------------------------------------------------------------------

    Accordingly, we are adopting the definition of ``clear and 
conspicuous'' as proposed.\43\ We urge Covered Persons to consider the 
guidance discussed above regarding practices and methods for making 
notices clear and conspicuous. Moreover, like the Agencies, we are 
adopting model forms that may, but are not required to, be used to 
facilitate compliance with the affiliate marketing notice 
requirements.\44\ The requirement that a notice be clear and 
conspicuous would be satisfied by the appropriate use of one of the 
model forms. Accordingly, use of the model forms, although optional, 
should help alleviate risks from litigation related to the requirement 
that notices be clear and conspicuous, about which some commenters 
expressed concern.\45\
---------------------------------------------------------------------------

    \43\ See Sec.  248.120(c), which was proposed as Sec.  247.3(c).
    \44\ See Appendix to Regulation S-AM.
    \45\ See ACB Letter; ICBA Letter; Wells Fargo Letter.
---------------------------------------------------------------------------

4. Commission
    We received no comment on the definition of ``Commission'' to mean 
the Securities and Exchange Commission and are adopting it as 
proposed.\46\
---------------------------------------------------------------------------

    \46\ See Sec.  248.120(d), which was proposed as Sec.  247.3(d).
---------------------------------------------------------------------------

5. Company
    We received no comment on the definition of ``company'' and are 
adopting the term as proposed.\47\
---------------------------------------------------------------------------

    \47\ See Sec.  248.120(e), which was proposed as Sec.  247.3(e).
---------------------------------------------------------------------------

6. Concise
    We received no comment on the definition of ``concise'' and are 
adopting it as proposed.\48\ Section 248.120(f)(1) defines the term 
``concise'' to mean a reasonably brief expression or statement. 
Paragraph (f)(2) provides that a notice required by Regulation S-AM may 
be concise even if it is combined with other disclosures required or 
authorized by Federal or State law.\49\
---------------------------------------------------------------------------

    \48\ See Sec.  248.120(f), which was proposed as Sec.  
247.21(b)(3). The Appendix provides that the requirement for a 
concise notice would be satisfied by the appropriate use of one of 
the model forms contained in the Appendix, although use of the model 
forms is not required. See supra note 40.
    \49\ Such disclosures include, but are not limited to, a GLBA 
privacy notice, an affiliate-sharing notice under Section 
603(d)(2)(A)(iii) of the FCRA, and other consumer disclosures.
---------------------------------------------------------------------------

7. Consumer
    Proposed paragraph (f) of Sec.  247.3 defined ``consumer'' to mean 
an individual, including an individual acting through a legal 
representative.\50\ Some commenters suggested that the definition of 
``consumer'' used in Regulation S-AM should track the definition in 
Regulation S-P.\51\ Some also asked that the Commission include in the 
definition the examples that accompany the definition of ``consumer'' 
in Regulation S-P.\52\
---------------------------------------------------------------------------

    \50\ The proposed definition follows the statutory definition of 
Section 603(c) of the FCRA. See 15 U.S.C. 1681a(c).
    \51\ See ACB Letter; IAA Letter; T. Rowe Price Letter.
    \52\ See IAA Letter; T. Rowe Price Letter.
---------------------------------------------------------------------------

    The Commission is aware of the narrower definition of ``consumer'' 
in the privacy regulations enacted under Title V of the GLBA.\53\ 
However, we believe that the use of distinct definitions of 
``consumer'' reflects differences in the scope and objectives of the 
two statutes. Accordingly, we are adopting the definition of 
``consumer'' as proposed.\54\ For purposes of this definition, an 
individual acting through

[[Page 40403]]

a legal representative would qualify as a consumer.
---------------------------------------------------------------------------

    \53\ See Proposing Release at 69 FR 42305.
    \54\ See Sec.  248.120(g).
---------------------------------------------------------------------------

8. Control
    We are adopting the definition of ``control'' as proposed.\55\ Two 
commenters supported the proposed definition, indicating it was 
consistent with the one found in Regulation S-P and the GLBA.\56\ For 
purposes of Covered Persons, ``control'' means the power to exercise a 
controlling influence over the management or policies of a company, 
whether through ownership of securities, by contract, or otherwise.\57\ 
Ownership of more than 25 percent of a company's voting securities 
would create a presumption of control of the company.\58\ As the 
Proposing Release explained, this definition would be used to determine 
when companies are affiliated \59\ and would result in financial 
institutions being considered affiliates regardless of whether the 
control is exercised by a company or an individual.\60\
---------------------------------------------------------------------------

    \55\ See Sec.  248.120(h), which was proposed as Sec.  247.3(g).
    \56\ See IAA Letter; T. Rowe Price Letter.
    \57\ Section 248.120(h). This definition is consistent with 
definitions of control found elsewhere under the securities laws. 
See, e.g., 17 CFR 240.19g2-1(b)(2); 17 CFR 248.3(i); 15 U.S.C. 80a-
2(a)(9); 15 U.S.C. 80b-2(a)(12).
    \58\ This presumption may be rebutted by evidence, but in the 
case of an investment company, will continue until the Commission 
makes a decision to the contrary according to the procedures 
described in Section 2(a)(9) of the Investment Company Act. 15 
U.S.C. 80a-2(a)(9).
    \59\ See supra Part III.C.1; Proposing Release at 69 FR 42305.
    \60\ In Sec.  222.3(i) of their Joint Proposal, the Banking 
Agencies and the NCUA defined ``control'' as ownership of 25 percent 
of a company's voting securities, control over the election of a 
majority of the directors, trustees or general partners of the 
company, or the power to exercise a controlling influence over 
management or policies of a company, as determined by the particular 
agency. See Banking Agencies and NCUA, Fair Credit Reporting 
Affiliate Marketing Regulation; Proposed Rules, 69 FR 42502 (July 
15, 2004) (``Joint Proposal''). However, as we emphasized in the 
Proposing Release, the definition of ``control'' in the proposed 
rules differed from the Agencies' definition in the Joint Proposal. 
See Proposing Release at 69 FR 42305. The Joint Rules incorporate 
the definition of ``control'' to mean ``common ownership or common 
corporate control'' as in the Agencies' final FCRA medical 
information rules. See Joint Rules at 72 FR 62913 (citing 70 FR 
70664 (Nov. 22, 2005)).
---------------------------------------------------------------------------

9. Dealer
    We received no comments on the definition of ``dealer'' and are 
adopting it as proposed.\61\ Section 248.120(i) defines ``dealer'' to 
have the same meaning as in Section 3(a)(5) of the Exchange Act,\62\ 
regardless of whether the dealer is registered under Section 15(b) of 
the Exchange Act.\63\ The term includes a municipal securities dealer 
as defined in Section 3(a)(30) of the Exchange Act,\64\ other than a 
bank (as defined in Section 3(a)(6) of the Exchange Act),\65\ 
regardless of whether it is registered under Section 15(b) or 15B(a)(2) 
of the Exchange Act.\66\ In addition, the term includes a government 
securities dealer as defined in Section 3(a)(44) of the Exchange 
Act,\67\ regardless of whether it is registered under Section 15(b) or 
15C(a)(2) of the Exchange Act.\68\ The definition specifically excludes 
notice-registered broker-dealers.\69\
---------------------------------------------------------------------------

    \61\ See Sec.  248.120(i), proposed as Sec.  247.3(h).
    \62\ 15 U.S.C. 78c(a)(5).
    \63\ 15 U.S.C. 78o(b).
    \64\ 15 U.S.C. 78c(a)(30).
    \65\ 15 U.S.C. 78c(a)(6).
    \66\ 15 U.S.C. 78o(b), 78o-4(a)(2).
    \67\ 15 U.S.C. 78c(a)(44).
    \68\ 15 U.S.C. 78o(b), 78o-5(a)(2).
    \69\ See discussion of the inapplicability of Regulation S-AM to 
notice-registered broker-dealers supra note 16 and accompanying 
text.
---------------------------------------------------------------------------

10. Eligibility Information
    We are adopting the proposed definition of ``eligibility 
information'' to mean any information, the communication of which would 
be a consumer report, if the statutory exclusions from the definition 
of ``consumer report'' in Section 603(d)(2)(A) of the FCRA, for 
transaction or experience information and for ``other'' information 
that is subject to the affiliate-sharing opt out, did not apply.\70\ As 
under the proposal, eligibility information would include a Covered 
Person's own transaction or experience information, such as information 
about a consumer's account history with that Covered Person, and 
``other'' information under Section 603(d)(2)(A)(iii), such as 
information from consumer reports or applications.\71\
---------------------------------------------------------------------------

    \70\ See Sec.  248.120(j). See also 15 U.S.C. 
1681a(d)(2)(A)(iii). Under the FCRA, the term ``consumer report'' is 
defined to include any communication of information from a consumer 
reporting agency bearing on a consumer's credit worthiness, credit 
standing, credit capacity, character, general reputation, personal 
characteristics, or mode of living that is used or expected to be 
used or collected in whole or in part for the purpose of serving as 
a factor in establishing the consumer's eligibility for credit or 
insurance to be used primarily for personal, family or household 
purposes, employment purposes, or other purposes authorized 
elsewhere in the FCRA. 15 U.S.C. 1681a(d)(1).
    \71\ See Sec.  248.120(j).
---------------------------------------------------------------------------

    We have revised the definition of ``eligibility information'' to 
clarify that the term does not apply to aggregate or blind data that 
does not contain personal identifiers.\72\ Examples of personal 
identifiers listed in the definition include account numbers, names or 
addresses, and also could include Social Security numbers, driver's 
license numbers, telephone numbers, or other types of information that, 
depending on the circumstances or when used in combination, could 
identify the individual or individuals to whom the data relates. Other 
types of personal identifiers could include passwords, screen names, 
user names, e-mail addresses, or Internet Protocol addresses.
---------------------------------------------------------------------------

    \72\ Id.
---------------------------------------------------------------------------

    We recognized in the Proposing Release that it might be burdensome 
for Covered Persons to determine and track whether consumer report 
information is (1) ``eligibility information'' and thus subject to the 
notice and opt out provisions of Section 624 or (2) information that 
might be shared with affiliates under other exceptions to the FCRA (to 
which the notice and opt out provisions of Section 624 do not apply). 
We invited comment on whether the proposed definition of ``eligibility 
information'' appropriately reflected the scope of coverage of the FACT 
Act and provided meaningful guidance to Covered Persons.
    Some commenters indicated that the proposed definition did not 
provide enough meaningful guidance as to what sort of information is 
covered.\73\ Others suggested that the Commission should provide 
examples to illustrate the common types of information that would and 
would not constitute eligibility information.\74\ One commenter 
requested examples specifically relevant to the securities 
industry.\75\ Another commenter offered an alternative definition, 
stating that the proposed definition was unnecessarily complex and 
difficult to apply.\76\ Another commenter noted that, unlike the 
Agencies, the Commission did not provide in the Proposing Release that 
the term was designed to ``facilitate discussion, and not change the 
scope of the information covered by Section 624(a)(1)'' of the 
FCRA.\77\ The commenter expressed concern that the divergence may 
signal some other

[[Page 40404]]

interpretation, but did not provide an example of a secondary 
interpretation.
---------------------------------------------------------------------------

    \73\ See FSR Letter; SIFMA Letter I.
    \74\ See ICI Letter; T. Rowe Price Letter.
    \75\ See ICI Letter.
    \76\ See ICBA Letter. The commenter proposed to define 
eligibility information as ``any information that bears on a 
consumer's credit worthiness, credit standing, credit capacity, 
character, general reputation, personal characteristics or mode of 
living which is used or expected to be used or collected in whole or 
in part for the purpose of serving as a factor in establishing the 
consumer's eligibility for credit or insurance to market products 
and services for personal, family or household purposes to that 
person.''
    \77\ See Coalition Letter.
---------------------------------------------------------------------------

    The Commission believes that further clarification of, or 
exclusions from, the term ``eligibility information'' would implicate 
the definitions of ``consumer report'' and ``consumer reporting 
agency'' in Sections 603(d) and (f), respectively, of the FCRA. The 
Commission does not define the terms ``consumer report'' and ``consumer 
reporting agency'' in this rulemaking or construe terms therein, such 
as ``transaction or experience'' information. We note that financial 
institutions have relied on these statutory definitions for many years. 
Providing examples of information that would or would not be 
eligibility information would not necessarily reduce the complexity of 
the definition, and could create greater uncertainty with regard to 
information that is not covered by an example. The definition of 
``eligibility information'' in Regulation S-AM is the same as the one 
found in the Joint Rules adopted by the Banking Agencies.\78\
---------------------------------------------------------------------------

    \78\ In adopting their final rules, the Banking Agencies stated 
that they anticipate addressing the definitions of ``consumer 
report'' and ``consumer reporting agency'' in a separate rulemaking 
after the required FACT Act rules have been completed. See Joint 
Rules at 72 FR 62915.
---------------------------------------------------------------------------

11. FCRA
    We received no comment on the term ``FCRA'' and are adopting it as 
proposed to mean the Fair Credit Reporting Act.\79\
---------------------------------------------------------------------------

    \79\ See Sec.  248.120(k), which was proposed as Sec.  247.3(j).
---------------------------------------------------------------------------

12. GLBA
    The proposed rule defined ``GLB Act'' to mean the Gramm-Leach-
Bliley Act. We received no comment on this definition but are changing 
the term to ``GLBA'' to be more consistent with the way the Agencies 
refer to the Gramm-Leach-Bliley Act.\80\
---------------------------------------------------------------------------

    \80\ See Sec.  248.120(l), proposed as Sec.  247.3(k).
---------------------------------------------------------------------------

13. Investment Adviser
    We received no comment on the definition of ``investment adviser'' 
and are adopting it as proposed.\81\ This definition incorporates the 
definition of ``investment adviser'' in the Investment Advisers Act.
---------------------------------------------------------------------------

    \81\ See Sec.  248.120(m), proposed as Sec.  247.3(l).
---------------------------------------------------------------------------

14. Investment Company
    We received no comment on the definition of ``investment company'' 
and are adopting it as proposed.\82\ This definition incorporates the 
definition of ``investment company'' in the Investment Company Act.
---------------------------------------------------------------------------

    \82\ See Sec.  248.120(n), proposed as Sec.  247.3(m).
---------------------------------------------------------------------------

15. Marketing Solicitation
    We are adopting the definition of ``marketing solicitation,'' with 
modifications discussed below.\83\ The proposed rule defined 
``marketing solicitation'' to mean marketing initiated by a Covered 
Person to a particular consumer that is based on eligibility 
information communicated to that Covered Person by its affiliate, and 
that is intended to encourage the consumer to purchase or obtain a 
product or service. The definition included any form of communication, 
such as a telemarketing call, direct mail, or electronic mail that is 
directed to a specific consumer based on that consumer's eligibility 
information. It did not include communications that are directed at the 
general public without regard to eligibility information, even if those 
communications are intended to encourage consumers to purchase products 
and services. We noted in the Proposing Release that the definition 
tracked the definition in Section 624 of the FCRA but did not follow 
the statute exactly to prevent confusion with the term ``solicitation'' 
in the context of the Federal securities laws.\84\ Although Section 624 
also authorizes the Commission to exclude other communications from the 
definition of ``marketing solicitation,'' we did not propose to do so, 
but rather, sought comment on whether any other communications should 
be excluded from the statutory definition of ``solicitation.'' \85\ We 
also requested comment on whether, and to what extent, various tools 
used in Internet-based marketing, such as pop-up ads, could constitute 
marketing solicitations as opposed to communications directed at the 
general public.
---------------------------------------------------------------------------

    \83\ See Sec.  248.120(o), proposed as Sec.  247.3(n).
    \84\ See Proposing Release at 69 FR 42306. In particular, 
Regulation S-AM uses the term ``marketing solicitation'' rather than 
``solicitation.'' Although ``solicitation'' is a defined term in 
Section 624 of the FACT Act, the operative phrase in Section 624(a) 
is ``solicitation for marketing purposes.'' See 15 U.S.C. 1681s-
3(a).
    \85\ 15 U.S.C. 1681s-3(d)(2).
---------------------------------------------------------------------------

    Seven commenters addressed the definition of ``marketing 
solicitation.'' \86\ Some expressed concern that the proposed 
definition was not the same as the definition in Section 214 of the 
FCRA \87\ and suggested including the phrase ``of a product or 
service'' in the introductory language to be consistent.\88\ Other 
commenters favored the exclusion from the definition of marketing 
solicitation, solicitations made to the general public.\89\ However, 
one commenter believed that the phrase ``distributed without the use of 
eligibility information communicated by an affiliate'' inadvertently 
misstated the types of general marketing that would not be marketing 
solicitations.\90\ Another commenter asked the Commission to clarify 
that any communications directed at the general public are not 
marketing solicitations regardless of whether they were developed using 
specific eligibility information.\91\
---------------------------------------------------------------------------

    \86\ See Coalition Letter; FSR Letter; ICBA Letter; ICI Letter; 
MetLife Letter; SIFMA Letter I; Wells Fargo Letter.
    \87\ See FSR Letter; SIFMA Letter I.
    \88\ Id. One commenter indicated that the lack of this phrase 
raised the possibility that the definition could be misinterpreted. 
See FSR Letter.
    \89\ See Coalition Letter; ICBA Letter; Wells Fargo Letter.
    \90\ See Coalition Letter.
    \91\ See Wells Fargo Letter.
---------------------------------------------------------------------------

    Several commenters also addressed Internet-based marketing and 
generally opposed including it in this rulemaking.\92\ Some expressed 
the view that discussion of a particular delivery mechanism would be 
counterproductive and contrary to congressional intent, noting that the 
Internet was not specifically addressed in this legislation.\93\ 
Another suggested that Internet issues should be addressed in a 
separate process to ensure that notice and opportunity to be heard are 
given to the parties affected.\94\
---------------------------------------------------------------------------

    \92\ See Coalition Letter; FSR Letter; MetLife Letter.
    \93\ See Coalition Letter; MetLife Letter.
    \94\ See MetLife Letter.
---------------------------------------------------------------------------

    The commenter also opined that pop-up ads that appear automatically 
without the use of eligibility information or information from other 
affiliates are communications directed at the general public, and that 
a consumer visiting an Internet Web site is effectively making an 
inquiry which is tantamount to an affirmative request for information. 
In addition, the commenter asked for clarification that pre-recorded 
messages played while consumers are on hold when calling a call center 
should be construed as general marketing solicitations. Another 
commenter asked for a similar clarification for advertisements that 
appear on password-protected Web sites.\95\
---------------------------------------------------------------------------

    \95\ See ICI Letter.
---------------------------------------------------------------------------

    The revised definition tracks the statutory language more closely 
by encompassing the marketing ``of a product or service.'' \96\ To 
ensure consistency with the definition of ``pre-existing business 
relationship,'' the definition applies to marketing intended to 
encourage the consumer to purchase

[[Page 40405]]

``or obtain'' a product or service. In this way, the definition 
includes marketing for the rental or lease of goods or services, 
financial transactions, and financial contracts. The Commission is not 
adopting the reference to communications ``distributed without the use 
of eligibility information communicated by an affiliate'' in the 
exclusion for marketing directed at the general public because we do 
not believe it is necessary. Marketing that is undertaken without the 
use of eligibility information received from an affiliate is not 
covered by the affiliate marketing rules. Moreover, there is no 
restriction on using eligibility information received from an affiliate 
in marketing directed at the general public, such as radio, television, 
general circulation magazine, billboard advertisements, or publicly 
available Web sites that are not directed to particular consumers.\97\
---------------------------------------------------------------------------

    \96\ For purposes of this release and the final rule, we 
interpret and use the term ``products and services'' to include 
shareholder investments in investment companies.
    \97\ See supra text accompanying note 90. Similarly, visiting a 
publicly available Web site should not, by itself, constitute an 
``inquiry'' for purposes of the pre-existing business relationship 
exception.
---------------------------------------------------------------------------

    The definition of ``marketing solicitation'' does not distinguish 
among different delivery methods or media. A determination of whether a 
marketing communication in any medium constitutes a marketing 
solicitation depends upon the facts and circumstances. The Commission 
declines to exclude categorically from the definition of ``marketing 
solicitation,'' pre-recorded messages played while a consumer is on 
hold with a call center, or advertisements that appear solely on 
password-protected Web sites. Marketing delivered by such media may 
constitute a marketing solicitation if it is targeted to a particular 
consumer based on eligibility information received from an affiliate. 
For example, a pre-recorded message played while a consumer is on hold 
with a call center would be a marketing solicitation if it is targeted 
to a particular consumer based on eligibility information received from 
an affiliate, but would not be a marketing solicitation if it is played 
for all consumers who are on hold with the call center.
    We note that the Agencies declined to exclude educational seminars, 
customer appreciation events, focus group invitations, and similar 
forms of communication from the definition of ``solicitation'' in their 
final rules.\98\ While we received no comments on these types of 
activities, like the Agencies, we believe that such activities must be 
evaluated according to the facts and circumstances, and that some of 
these activities may be coupled with, or a prelude to, a marketing 
solicitation. For example, an invitation to a financial educational 
seminar when the invitees are selected based on eligibility information 
received from an affiliate may be a marketing solicitation if the 
seminar is used to solicit the consumer to purchase or obtain 
investment products or services.
---------------------------------------------------------------------------

    \98\ See Joint Rules at 72 FR 62919; FTC Rule at 72 FR 61432.
---------------------------------------------------------------------------

16. Person
    We received no comment on the definition of ``person,'' and we are 
adopting it as proposed.\99\ The proposed rule defined ``person'' to 
mean any individual, partnership, corporation, trust, estate, 
cooperative, association, government or governmental subdivision or 
agency, or other entity. A person could act through an agent, such as a 
licensed agent (in the case of an insurance company), a trustee (in the 
case of a trust), or any other agent. For purposes of Regulation S-AM, 
actions taken by an agent on behalf of a person that are within the 
scope of the agency relationship will be treated as actions of that 
person.
---------------------------------------------------------------------------

    \99\ See Sec.  248.120(p), proposed as Sec.  247.3(o).
---------------------------------------------------------------------------

17. Pre-Existing Business Relationship
a. Definition
    We are adopting the definition of ``pre-existing business 
relationship'' substantially as proposed,\100\ with the modifications 
discussed below. The proposed rule contained a three-part definition of 
``pre-existing business relationship.'' Under the first part, a ``pre-
existing business relationship'' would exist when there is a financial 
contract in force between a Covered Person and a consumer.\101\ Under 
the second part, a ``pre-existing business relationship'' would exist 
when a consumer purchased, rented, or leased a Covered Person's goods 
or services, or entered into a financial transaction (including holding 
an active account or a policy in force or having another continuing 
relationship) with a Covered Person during the 18-month period 
immediately preceding the date on which a marketing solicitation is 
made.\102\ Under the third part, a ``pre-existing business 
relationship'' would exist when, in certain circumstances, a consumer 
inquired about, or applied for, a product or service offered by a 
Covered Person during the three-month period immediately preceding the 
date on which a marketing solicitation is made to the consumer.\103\ In 
the Proposing Release, we noted that the proposed definition tracked 
the definition in Section 624 of the FCRA but did not follow the 
statute exactly.\104\ We also noted that while Section 624 authorizes 
the Commission to recognize any other circumstances that would 
constitute a pre-existing business relationship, we did not propose to 
exercise this authority.\105\
---------------------------------------------------------------------------

    \100\ See Sec.  248.120(q)(1), proposed as Sec.  247.3(p).
    \101\ See Proposed Sec.  247.3(p)(1).
    \102\ See Proposed Sec.  247.3(p)(2).
    \103\ See Proposed Sec.  247.3(p)(3).
    \104\ See Proposing Release at 42306 (citing 15 U.S.C. 1681s-
3(d)(1)).
    \105\ Id. (citing 15 U.S.C. 1681s-3(d)(1)(D)).
---------------------------------------------------------------------------

    Ten commenters addressed the definition of ``pre-existing business 
relationship.'' \106\ Several commenters noted that the statutory 
reference to ``a person's licensed agent'' was not in the rule.\107\ 
One commenter expressed the view that Congress intended the phrase to 
be included in any implementing rule because it is in the statute.\108\ 
Two commenters noted the importance of licensed agents in the insurance 
industry, and stated that independent, licensed agents frequently act 
as the main point of contact between a consumer and an insurance 
company.\109\ In light of these comments and to more closely track the 
statute, we have added the phrase ``or a person's licensed agent'' in 
the final definition of ``pre-existing business relationship.'' For 
example, a person who is both a licensed agent for an insurance company 
and a registered representative for a broker-dealer may sell to a 
consumer a variable annuity issued by the insurance company. The 
licensed agent may use eligibility information that it obtains in 
connection with selling the variable annuity to the consumer to market 
the insurance company's life insurance policies to the consumer for the 
duration of the pre-existing business relationship without offering an 
opt out opportunity.
---------------------------------------------------------------------------

    \106\ See ABASA Letter; ACB Letter; ACLI Letter; AIA Letter; 
Coalition Letter; FSR Letter; ICBA Letter; MetLife Letter; Wells 
Fargo Letter; SIFMA Letter I.
    \107\ See ACB Letter; ACLI Letter; Coalition Letter; FSR Letter; 
ICBA Letter; MetLife Letter; SIFMA Letter I.
    \108\ See Coalition Letter.
    \109\ See ACLI Letter; MetLife Letter. The ACLI Letter also 
noted that this type of role played by licensed agents would have 
implications for not only life insurers who issue variable life 
insurance and variable annuity contracts but also the broker-dealers 
who sell these products.
---------------------------------------------------------------------------

    Some commenters questioned the requirement in the first part of the 
definition that a financial contract be in force ``on the date on which 
the consumer is sent a marketing

[[Page 40406]]

solicitation.'' \110\ In their view, delays between the time when 
information is processed and prepared for a marketing solicitation and 
the time a marketing solicitation is made or sent would create an undue 
burden of having to synchronize the sending of the marketing 
solicitation with a contract that is in force. They recommended that a 
contract should only have to be in force when the information is 
prepared for a marketing solicitation and not when the marketing 
solicitation is made. We do not agree with these comments and are 
adopting the second part of the definition as proposed. This approach 
is consistent with the approach used in the other two parts of the 
statutory definition.\111\ We also note that the second part of the 
definition alleviates these synchronization problems since a pre-
existing business relationship would continue to exist for another 18 
months after a financial contract ceases to be in force.
---------------------------------------------------------------------------

    \110\ See ACLI Letter; SIFMA Letter I; Wells Fargo Letter.
    \111\ See 15 U.S.C. 1681s(d)(1)(A)-(C). As noted earlier, the 
definition of ``pre-existing business relationship'' in Regulation 
S-AM tracks the statutory definition. Although the statutory 
definition does not contain the term ``sent'' for the provision 
dealing with a contract that is in force (15 U.S.C.1681s(d)(1)(A)), 
the other two parts of the statutory definition do contain the term 
``sent'' (15 U.S.C. 1681s(d)(1)(B)-(C)). Accordingly, we believe 
that the statutory definition is best implemented by including this 
concept in all three parts of the definition in Regulation S-AM.
---------------------------------------------------------------------------

    Some commenters addressed various parts of the second part of the 
definition.\112\ One commenter suggested that ``any account with 
outstanding contractual responsibilities on either side of an account 
relationship should be considered an active account, regardless of 
whether the individual transactions occur or do not occur under the 
account.'' \113\ We decline to interpret an ``active account'' in this 
way. Section 603(r) of the FCRA defines an ``account'' to have the same 
meaning as in Section 903 of the Electronic Fund Transfer Act 
(``EFTA'').\114\ Section 903 of the EFTA defines the term ``account'' 
to mean a demand deposit, savings deposit, or other asset account 
established primarily for personal, family, or household purposes.\115\ 
In addition, our view regarding the term ``account'' is analogous to 
the views expressed by the Agencies.
---------------------------------------------------------------------------

    \112\ See Coalition Letter; Wells Fargo Letter.
    \113\ See Wells Fargo Letter.
    \114\ See 15 U.S.C. 1681a(r)(4).
    \115\ See 15 U.S.C. 1693(a)(2).
---------------------------------------------------------------------------

    One commenter stated that when consumers pay in advance for future 
services, the 18-month exemption under the second part of the 
definition should not begin until after the last payment or shipment of 
the product.\116\ Another commenter suggested that the 18-month period 
should begin at the time that all contractual responsibilities 
expire.\117\ The Commission declines to adopt these suggestions because 
they could lead to consumers receiving marketing solicitations long 
after closing or transferring an account. For purposes of the final 
rule, a pre-existing business relationship terminates when an investor 
redeems or sells investment company shares or closes or transfers an 
account, and not when the investor receives the last statement relating 
to the account or when an obligation assumed by a Covered Person in an 
account opening document expires. The final rule includes examples to 
help clarify the scope of this part of the definition of a pre-existing 
business relationship.\118\
---------------------------------------------------------------------------

    \116\ See Coalition Letter.
    \117\ See Wells Fargo Letter.
    \118\ See Sec. Sec.  248.120(q)(2) and 248.120(q)(3).
---------------------------------------------------------------------------

    Two commenters discussed the third part of the definition of ``pre-
existing business relationship''--an inquiry or application by the 
consumer regarding a product or service offered by the person during 
the preceding three months.\119\ These commenters generally stated that 
the exception should not depend on consumers providing contact 
information or on a consumer's expectations. One commenter indicated 
that an e-mail inquiry, a return address on an envelope, or the 
captured phone number of a consumer requesting information about 
products or services should qualify as a ``pre-existing business 
relationship.'' \120\
---------------------------------------------------------------------------

    \119\ See Coalition Letter; Wells Fargo Letter.
    \120\ See Wells Fargo Letter.
---------------------------------------------------------------------------

    Certain elements of the definition of ``pre-existing business 
relationship'' are substantially similar to the definition of 
``established business relationship'' under the FTC's Telemarketing 
Sales Rule (``TSR'').\121\ The TSR definition was informed by 
Congress's intent that the ``established business relationship'' 
exemption to the ``do not call'' provisions of the Telephone Consumer 
Protection Act \122\ should be grounded on the reasonable expectations 
of the consumer.\123\ Congress's incorporation of similar language in 
the definition of ``pre-existing business relationship'' \124\ suggests 
that it is appropriate to consider the reasonable expectations of the 
consumer in determining the scope of this exception. For purposes of 
Regulation S-AM, an inquiry would include any affirmative request by a 
consumer for information after which the consumer would reasonably 
expect to receive information from the affiliate about its products or 
services.\125\ A consumer would not reasonably expect to receive 
information from an affiliate if the consumer did not request 
information from or provide contact information to the affiliate. For 
this reason, the Commission does not believe that an automatically 
captured telephone number of a consumer is sufficient to create an 
inquiry, particularly when the financial institution could easily ask 
the consumer for contact information during the telephone call that 
captured the consumer's telephone number. Similarly, we do not believe 
that information such as an Internet Protocol address or data contained 
in an Internet ``cookie'' that is automatically collected about a 
consumer visiting a Covered Person's Web site is, by itself, sufficient 
to create an inquiry. We understand that industry practice in the case 
of telephone calls is to ask the consumer to provide or confirm his or 
her contact information.\126\ To provide additional guidance to 
industry, we have provided additional examples in the definition that 
deal with consumer calls and e-mails.\127\ These examples, along with 
other examples, are discussed below. One commenter urged the Commission 
to clarify that all three parts of the definition of ``pre-existing 
business relationship'' include a transaction-based relationship 
between a consumer and a securities affiliate regardless of the issuer 
of the security purchased by the consumer.\128\ This commenter

[[Page 40407]]

asserted that a consumer whose securities and investment transactions 
are managed through a bank-owned securities affiliate would not be 
surprised, and may later expect, to receive marketing solicitations for 
other securities products based on eligibility information the 
securities affiliate has received from the affiliated bank. Another 
commenter urged the Commission to expand the definition to include 
relationships arising out of the ownership of servicing rights, a 
participation interest in lending or other similar relationships.\129\ 
Another commenter suggested that the definition should apply to 
manufacturers that make sales through dealers, such as an automobile 
manufacturer that sells vehicles not directly to consumers, but through 
franchised dealers.\130\ The commenter urged the Commission to consider 
the relationship between a manufacturer and a consumer as a pre-
existing business relationship based on the purchase, rental, or lease 
of the manufacturer's goods.
---------------------------------------------------------------------------

    \121\ See 16 CFR 310.2(n).
    \122\ 47 U.S.C. 227, et seq.
    \123\ H.R. Rep. No. 102-317, at 14-15 (1991). See also FTC, 
Telemarketing Sales Rule, 68 FR 4580, 4591-94 (Jan. 29, 2003) (``TSR 
Adopting Release'').
    \124\ 149 Cong. Rec. S13,980 (daily ed. Nov. 5, 2003) (statement 
of Senator Feinstein) (noting that the ``pre-existing business 
relationship'' definition ``is the same definition developed by the 
Federal Trade Commission in creating a national `Do Not Call' 
registry for telemarketers.'').
    \125\ See TSR Adopting Release at 68 FR 4594.
    \126\ Similarly, the Commission does not believe that a return 
address on an envelope is sufficient to constitute an affirmative 
request by a consumer for information about a person's products or 
services. A consumer would not have a reasonable expectation of 
being contacted about products and services simply by providing a 
return address on an envelope. In our view, a consumer provides a 
return address on an envelope to ensure that if a piece of mail is 
undeliverable, it is returned to the consumer and not because they 
are seeking to establish a business relationship. Accordingly, we 
consider a return address on an envelope analogous to an 
automatically captured telephone number.
    \127\ See Sec. Sec.  248.120(q)(2)(v)-(vii) and (q)(3).
    \128\ See ABASA Letter (stating that the proposed rule supports 
the conclusion that a pre-existing business relationship exists 
between a securities affiliate and a consumer when the consumer 
purchases a proprietary securities product like a bank's own mutual 
fund and expressing concern that the purchase of non-proprietary 
securities products from the securities affiliate could be 
considered to be outside of the first two provisions of the 
definition of a pre-existing business relationship).
    \129\ See Wells Fargo Letter.
    \130\ See FSR Letter. The commenter further indicated that 
vehicle financing may be arranged through a manufacturer's captive 
finance company or independent sources of financing, and noted that 
manufacturers often provide consumers with information about 
warranty coverage, recall notices, and other product information. 
This commenter stated that manufacturers also send solicitations to 
consumers about their products and services, drawing in part on 
transaction or experience information from the captive finance 
company.
---------------------------------------------------------------------------

    Like the Agencies, the Commission believes it is not necessary to 
add any additional bases for a pre-existing business relationship. 
Paragraph (q)(2)(i) of Sec.  248.120 provides an example of a brokerage 
firm with a pre-existing business relationship using eligibility 
information from an affiliate to make marketing solicitations about 
products or services. This example should provide Covered Persons with 
sufficient guidance regarding a securities affiliate's use of 
eligibility information.
b. Examples
    Paragraph (d)(1) of proposed Sec.  247.20 provided four examples to 
illustrate the pre-existing business relationship exception. Proposed 
paragraphs (d)(1)(i) through (iii) contained examples illustrating each 
of the three parts of the definition.\131\ Proposed paragraph 
(d)(1)(iv) provided an example of a consumer calling a centralized call 
center for a group of affiliated companies to inquire about the 
consumer's existing securities account with a broker-dealer, and 
indicated that such a call would not establish a pre-existing business 
relationship between the consumer and the broker-dealer's affiliates. 
We requested comment on these examples.
---------------------------------------------------------------------------

    \131\ See Proposed Sec. Sec.  247.20(d)(1)(i) (illustrating the 
first part), (d)(1)(ii) (illustrating the second part) and 
(d)(1)(iii) (illustrating the third part).
---------------------------------------------------------------------------

    One commenter generally expressed approval of the examples we 
provided, other than the example in proposed Sec.  
247.20(d)(1)(iii).\132\ Another commenter requested that the Commission 
provide further examples dealing with consumer calls to call centers to 
clarify what would and would not be considered subject to Regulation S-
AM's opt out notice requirement.\133\
---------------------------------------------------------------------------

    \132\ The example in proposed Sec.  247.20(d)(1)(iii) 
illustrated that a pre-existing business relationship would exist 
with a Covered Person's affiliate when a consumer made an inquiry 
about, or applied for, a product or service offered by the affiliate 
during the three-month period immediately preceding the date on 
which a marketing solicitation is made to the consumer based on 
eligibility information received from the Covered Person. The 
Coalition Letter stated that a consumer should not be required to 
provide contact information as part of an inquiry in order to 
establish a pre-existing business relationship. As stated above, 
however, we do not believe that a consumer would reasonably expect 
to have established a pre-existing business relationship in the 
absence of providing contact information. See also supra text 
accompanying notes 125 and 126.
    \133\ See MetLife Letter.
---------------------------------------------------------------------------

    We are adopting seven examples of a pre-existing business 
relationship set out in Sec.  248.120(q)(2).\134\ In Sec.  
248.120(q)(3) we have provided three examples of the absence of a pre-
existing relationship.\135\
---------------------------------------------------------------------------

    \134\ Section 248.120(q)(2)(i) provides an example of a pre-
existing business relationship based on a consumer's open account 
with a brokerage firm. Section 248.120(q)(2)(ii) provides a similar 
example of a pre-existing business relationship with a registered 
investment adviser. Section 248.120(q)(2)(iii) provides an example 
in which a pre-existing business relationship is established for 18 
months after the date a consumer who was the record owner of 
investment company securities redeems all of those securities. 
Section 248.120(q)(2)(iv) provides an example in which a consumer 
applies for a product or service, but does not obtain the product or 
service for which she applied, and a pre-existing business 
relationship is established for three months after the date of the 
application. Contact information is not mentioned in this example 
because the consumer presumably would have supplied it on the 
application. Section 248.120(q)(2)(v) provides an example in which a 
consumer makes a telephone inquiry about a product or service 
offered by a brokerage firm and provides contact information to the 
institution, but does not obtain a product or service from or enter 
into a financial transaction with the institution. As noted earlier, 
we do not believe that, by itself, an institution's capture of a 
consumer's telephone number during a telephone conversation with the 
consumer about the institution's products or services is sufficient 
to create an inquiry. In these circumstances, to ensure that an 
inquiry has been made, the institution should ask the consumer to 
provide his or her contact information. Section 248.120(q)(2)(vi) 
provides an example in which pre-existing business relationships are 
established for three months after the date a consumer makes an e-
mail inquiry to a broker-dealer about one of its affiliated 
investment company's products or services without providing any 
contact information other than the consumer's e-mail address. Unlike 
telephone communications, e-mail communications do not provide 
institutions with an opportunity to ask for additional contact 
information at the time of a consumer's initial request for 
information. Section 248.120(q)(2)(vii) provides an example in which 
a pre-existing business relationship between a consumer and a 
broker-dealer is established for three months by a consumer's 
telephone call to a centralized call center for the broker-dealer 
and an affiliated investment company with which the consumer has an 
existing relationship, and the consumer provides contact information 
to the call center and inquires about products and services offered 
by the broker-dealer, but does not obtain any products or services.
    \135\ Section 248.120(q)(3)(i) is similar to Sec.  
248.120(q)(2)(vii) except that the consumer does not inquire about 
an affiliate's products or services but about an existing account 
with the broker-dealer. In this situation, a pre-existing business 
relationship with an affiliate of the broker-dealer is not 
established. Section 248.120(q)(3)(ii) is substantively similar to 
the example in proposed Sec.  247.20(d)(2)(iii), whereby a pre-
existing business relationship is not created by simply requesting 
information about retail hours and locations. Section 
248.120(q)(3)(iii) illustrates that a call in response to an 
advertisement for a free promotional item is not an inquiry about a 
product or service that would establish a pre-existing business 
relationship.
---------------------------------------------------------------------------

18. Transfer Agent
    We received no comment on the definition of ``transfer agent'' and 
are adopting it as proposed.\136\ The rule defines ``transfer agent'' 
to have the same meaning as in Section 3(a)(25) of the Exchange 
Act.\137\
---------------------------------------------------------------------------

    \136\ See Sec.  248.120(r), proposed as Sec.  247.3(q).
    \137\ 15 U.S.C. 78c(a)(25).
---------------------------------------------------------------------------

19. You
    We received no comment on the definition of ``you'' and are 
adopting it substantially as proposed.\138\ The one difference is that 
the final definition does not include notice-registered broker-
dealers.\139\
---------------------------------------------------------------------------

    \138\ See Sec.  248.120(s), proposed as Sec.  247.3(r).
    \139\ See supra note 16.
---------------------------------------------------------------------------

D. Section 248.121 Affiliate Marketing Opt Out and Exceptions

    Proposed Sec.  247.20 set forth the requirement that a consumer be 
provided with notice and a reasonable opportunity to opt out before a 
receiving affiliate uses eligibility information to make marketing 
solicitations to the consumer. Proposed paragraphs (a) and (b) 
bifurcated duties between the ``communicating affiliate'' and 
``receiving affiliate'' to resolve what we perceived as an ambiguity in 
the FCRA with regard to which affiliate was to provide the opt out 
notice to the consumer.\140\ Proposed paragraph (c)

[[Page 40408]]

contained exceptions to the requirements of Regulation S-AM and 
incorporated each of the statutory exceptions to the affiliate 
marketing notice and opt out requirements that are set forth in Section 
624(a)(4) of the FCRA, and paragraph (d) illustrated those exceptions 
with examples. Proposed paragraph (e) provided that Regulation S-AM 
would not be applicable to marketing solicitations that were based on 
information received by an affiliate prior to the proposed mandatory 
compliance date.\141\ Proposed paragraph (f) clarified the relationship 
between sharing information and becoming a credit reporting agency. The 
final rules modify many of these proposed provisions as discussed 
below.
---------------------------------------------------------------------------

    \140\ In the proposed rules, we differentiated between 
affiliates by referring to an affiliate that communicated 
eligibility information to an affiliate as the ``communicating 
affiliate'' and to the affiliate receiving the eligibility 
information as the ``receiving affiliate.''
    \141\ This section, redesignated as Sec.  248.128(c), is 
discussed below. See infra Part III.K.2.
---------------------------------------------------------------------------

1. Section 248.121(a)
    Under proposed Sec.  247.20(a)(1), before a receiving affiliate 
could use eligibility information to make or send marketing 
solicitations to a consumer, the communicating affiliate would have had 
to provide a notice to the consumer stating that the information may be 
communicated to and used by the receiving affiliate for marketing 
purposes. The consumer also would have had to have a reasonable 
opportunity to opt out through some simple method before the receiving 
affiliate could make a marketing solicitation. The notice and opt out 
requirements would have applied only if a receiving affiliate would use 
eligibility information for marketing purposes.\142\ Proposed paragraph 
(a)(2) included two ``rules of construction'' to give further guidance 
regarding how affiliate marketing notices might be provided to 
consumers.\143\
---------------------------------------------------------------------------

    \142\ Proposed paragraph (a)(1) would not have applied if no 
eligibility information was communicated to affiliates, or if no 
receiving affiliate would use eligibility information to make 
marketing solicitations. In the proposal, we provided an example in 
which paragraph (a) was inapplicable. In the example, a financing 
company affiliated with a broker-dealer asked the broker-dealer to 
include financing-company marketing materials in periodic statements 
sent to consumers by the broker-dealer without regard to eligibility 
information.
    \143\ The first rule of construction would have permitted the 
notice to be provided either in the name of a person with which the 
consumer currently did or previously had done business, or by using 
one or more common corporate names shared by members of an 
affiliated group of companies that included the common corporate 
name used by that person. This rule of construction also would have 
provided three alternatives regarding the manner in which the notice 
could have been given. First, a communicating affiliate could have 
provided the notice to the consumer directly. Second, a 
communicating affiliate could have used an agent to provide the 
notice, so long as the agent provided the notice in the name of the 
communicating affiliate or by using a common corporate name. When 
using an agent however, the communicating affiliate would have 
remained responsible for any failure of the agent to fulfill the 
affiliate's notice obligations. Third, a communicating affiliate 
could have provided a joint notice with one or more of its 
affiliates. Of course, if the agent was an affiliate of the person 
that provides the notice, that affiliate could not have included any 
marketing solicitations of its own on or with the notice, unless one 
of the exceptions in paragraph (c) of proposed Sec.  247.20 applied. 
Even if the agent sending the notice were not an affiliate, the 
agent would have been permitted to use the information only for 
limited purposes under Regulation S-P. See 17 CFR 248.11. The second 
rule of construction would have discussed how to avoid issuing 
duplicate notices when Affiliate A communicated information to 
Affiliate B, who in turn communicated information to Affiliate C.
---------------------------------------------------------------------------

    Proposed Sec.  247.20(b) set forth the general duties of a 
receiving affiliate. In particular, a receiving affiliate could not 
have used the eligibility information it received from its affiliate to 
make marketing solicitations to a consumer unless, prior to such use 
the consumer had: (1) Been provided an opt out notice (as described in 
proposed paragraph (a) of Sec.  247.20) that applied to that 
affiliate's use of eligibility information; (2) received a reasonable 
opportunity to opt out of that use through one or more simple methods; 
and (3) not opted out. The Commission solicited comment on these 
provisions. In addition, the Commission also solicited comment on 
whether there were situations where oral notices and opt outs should be 
allowed and, if so, how the statute's clear and conspicuous standard 
could be satisfied.\144\
---------------------------------------------------------------------------

    \144\ The proposal also contemplated that the opt out notice 
would be provided to the consumer in writing or, if the consumer 
agreed, electronically. See Proposing Release at 69 FR 42308.
---------------------------------------------------------------------------

    Five commenters addressed the duties of the communicating affiliate 
and the receiving affiliate.\145\ Some commenters supported having the 
communicating affiliate provide the notice and opt out, indicating that 
consumers may be more likely to expect a notice from the communicating 
affiliate and could unknowingly miss the opportunity to opt out if they 
do not have a pre-existing relationship with the company that is 
sending the notice and opt out.\146\ Other commenters disagreed with 
the provision in the proposal that would have required the 
communicating affiliate provide the notice and opt out.\147\ One 
commenter viewed the statute's lack of direction regarding which entity 
must provide the notice and opt out as evidence of Congressional intent 
to permit companies to structure the notice and opt out in a manner 
that meets their unique needs and situations.\148\ Another commenter 
stated that the FCRA contemplates that the receiving affiliate would 
provide the notice, and that to require the communicating affiliate to 
provide it would create a basis for civil liability if a communicating 
affiliate does not provide notice and an opportunity to opt out before 
a receiving affiliate uses eligibility information to make a marketing 
solicitation.\149\
---------------------------------------------------------------------------

    \145\ See ACLI Letter; ICBA Letter; ICI Letter; T. Rowe Price 
Letter; Wells Fargo Letter.
    \146\ See ICI Letter; T. Rowe Price Letter.
    \147\ See ACLI Letter; ICBA Letter; Wells Fargo Letter.
    \148\ See ACLI Letter. One commenter also suggested allowing 
companies to decide the best method of providing the notice. See 
ICBA Letter.
    \149\ See Wells Fargo Letter.
---------------------------------------------------------------------------

    Six commenters addressed oral notices and supported permitting 
their use.\150\ One commenter indicated that the use of oral notices 
would be an easier method by which consumers could exercise their 
rights under the proposed rules.\151\ This commenter indicated that 
this was especially so for consumers who primarily conduct business 
over the telephone, suggesting that when information is provided over 
the phone, a consumer is less likely to disregard a privacy 
notice.\152\ Another commenter generally noted the changing 
technological landscape and stated that limiting delivery of the notice 
to written form could create a barrier to improved customer 
service.\153\ Another commenter asserted that the FTC, in its TSR, has 
permitted clear and conspicuous oral notices without any enforcement 
difficulties.\154\ One commenter also stated that the clear and 
conspicuous standard could be more easily met with oral notices through 
the use of scripts or lists of frequently asked questions.\155\
---------------------------------------------------------------------------

    \150\ See Coalition Letter; IAA Letter; ICBA Letter; ICI Letter; 
T. Rowe Price Letter; Wells Fargo Letter.
    \151\ See ICI Letter.
    \152\ See ICI Letter. One commenter suggested that the 
regulation permit the notice to be given by an affiliate while the 
consumer is being called with a marketing solicitation. See Wells 
Fargo Letter. Another commenter suggested that delivery of the 
notice would be better effectuated if the affiliate representative 
and consumer engaged in a dialogue. See IAA Letter.
    \153\ See ICBA Letter.
    \154\ See Coalition Letter.
    \155\ See IAA Letter.
---------------------------------------------------------------------------

    After considering these comments regarding proposed paragraphs (a) 
and (b), the Commission is adopting these paragraphs, redesignated as 
Sec.  248.121(a), with modifications. Section 248.121(a)(1) sets forth 
the general rule and contains the three conditions that must be met 
before a Covered Person may use eligibility information about a 
consumer that it

[[Page 40409]]

receives from an affiliate to make a marketing solicitation to the 
consumer. First, it must be clearly and conspicuously disclosed to the 
consumer in writing or, if the consumer agrees, electronically, in a 
concise notice that the Covered Person may use shared eligibility 
information to make marketing solicitations to the consumer. Second, 
the consumer must be provided a reasonable opportunity and a reasonable 
and simple method to opt out of the use of that eligibility information 
to make marketing solicitations to the consumer. Third, the consumer 
must not have opted out. Section 248.121(a)(2) provides an example of 
the general rule.
    The Commission has eliminated as unnecessary the rules of 
construction in proposed paragraph (a)(2) as well as the provisions in 
the proposal relating to notice provided by an agent. General agency 
principles, however, continue to apply. An affiliate that has a pre-
existing business relationship with the consumer may direct its agent 
to provide the opt out notice on its behalf. In light of one 
commenter's concern about civil liability, the final rules do not 
impose duties on any affiliate other than the affiliate that intends to 
use shared eligibility information to make solicitations to the 
consumer. Although an opt out notice must be provided by or on behalf 
of an affiliate that has a pre-existing business relationship with the 
consumer (or as part of a joint notice), that affiliate has no duty to 
provide such a notice. Instead, the final rules provide that absent 
such a notice, an affiliate must not use shared eligibility information 
to make solicitations to the consumer.
    Proposed paragraph (b) of Sec.  247.20 has been deleted and 
replaced with paragraph (a)(3) in Sec.  248.121. Section 248.121(a)(3) 
provides that the initial opt out notice must be provided either by an 
affiliate that has a pre-existing business relationship with the 
consumer, or as part of a joint notice from two or more members of an 
affiliated group of companies, provided that at least one of the 
affiliates on the joint notice has a pre-existing business relationship 
with the consumer. This follows the general approach taken in the 
proposal to ensure that the notice would be provided by an entity known 
to the consumer. While we used the terms ``communicating affiliate'' 
and ``receiving affiliate'' in the proposal and continue to use these 
terms in this release, the final rule text does not include these terms 
in order to avoid potential confusion.\156\ The Commission has 
considered the comments regarding oral notices and opt outs and 
concluded that the opt out notice may not be provided orally. The 
Commission is required, under the FACT Act, to consider the affiliate-
sharing notification practices employed on the date of enactment and to 
ensure that notices and disclosures may be coordinated and consolidated 
in promulgating regulations. Any affiliate-sharing notice required 
under Section 603(d)(2)(A)(iii) of the FCRA generally must be included 
in a GLBA privacy notice, which must be provided in writing, or if the 
consumer agrees, electronically. We find it consistent with existing 
affiliate-sharing notification practices to require the affiliate 
marketing opt out notice to be provided in writing, or if the consumer 
agrees, electronically. The Commission believes that this will promote 
coordination and consolidation of the FCRA affiliate marketing and 
sharing notice with the GLBA privacy notices. We are not persuaded that 
there are any circumstances in which an oral opt out notice would be 
necessary. While oral opt out notices are not permitted, a number of 
key exceptions to the initial notice and opt out requirement may be 
triggered by an oral communication with the customer. These include 
the: (1) Pre-existing business relationship exception; (2) consumer-
initiated communication exception; and (3) consumer authorization or 
request exception. We understand that some Covered Persons currently 
require consumers to provide their Social Security numbers when 
exercising their existing GLBA or FCRA opt out rights. To combat 
identity theft and prevent ``phishing,'' however, consumers have been 
advised not to provide sensitive personal information such as Social 
Security numbers to unknown entities. Furthermore, as one of the 
Federal agencies participating in the President's Identity Theft Task 
Force, the Commission has made a commitment to examine and recommend 
ways to limit the private sector's use of Social Security numbers. The 
approach recommended by some industry commenters would allow an entity 
unknown to the consumer to not only provide the affiliate marketing opt 
out notice, but also to require the consumer to reveal his or her 
Social Security number to that unknown entity in order to exercise the 
opt out. The Commission notes that requiring that a consumer reveal his 
or her Social Security number to an unknown entity in order to exercise 
his or her opt out right would send conflicting messages to consumers 
about providing Social Security numbers to unknown entities. This 
approach would be inconsistent with the Commission's current joint 
efforts with the Agencies to develop a comprehensive record on the uses 
of the Social Security number in the private sector and evaluate their 
necessity, as recommended by the President's Identity Theft Task 
Force.\157\
---------------------------------------------------------------------------

    \156\ The Commission continues to believe that the statute's 
silence with regard to which affiliates may provide the opt out 
notice makes the statute ambiguous on this point. We agree with the 
commenters who indicated that consumers are less likely to disregard 
a notice provided by a person known to the consumer. We are 
concerned that a notice provided by an entity unknown to the 
consumer may not provide meaningful or effective notice because 
consumers are more likely to ignore or discard these notices. 
However, we note that while an agent unknown to the consumer may 
provide a notice, the notice itself would have to clearly indicate 
that it is on behalf of either the company the consumer has or had a 
pre-existing relationship with or be a joint notice from two or more 
members of an affiliated group of companies so long as one of the 
companies on the joint notice has or had a pre-existing relationship 
with the consumer. See Sec.  248.121(a)(3).
    \157\ See Combating Identity Theft: A Strategic Plan at 26-27 
(April 2007) (available at http://www.idtheft.gov). See also 
Regulation S-P: Privacy of Consumer Financial Information and 
Safeguarding Personal Information, Exchange Act Release No. 57427 
(Mar. 4, 2008); 73 FR 13692 (Mar. 13, 2008).
---------------------------------------------------------------------------

2. Section 248.121(b)
a. Making Marketing Solicitations
    The proposed rules referred to ``making or sending'' marketing 
solicitations. One commenter urged us not to address ``sending'' 
marketing solicitations.\158\ The commenter indicated that by making a 
reference to ``sending'' marketing solicitations, it appears that the 
rule encompasses entities that send a marketing solicitation on behalf 
of another entity. The general rule in Section 624(a)(1) of the FCRA, 
along with the duration provisions in Section 624(a)(3) and the pre-
existing business relationship exception in Section 624(a)(4)(A), refer 
to ``making'' or ``to make'' a marketing solicitation. Other provisions 
of the FCRA, such as the consumer choice provision in Section 
624(a)(2)(A), the service provider exception in Section 624(a)(4)(C), 
the non-retroactivity provision in Section 624(a)(5), and the 
definition of ``pre-existing business relationship'' in Section 
624(d)(1), refer to ``sending'' or ``to send'' a marketing 
solicitation. The verb ``to send,'' as used in the statute, refers to a 
ministerial act that a service provider, such as a mail house, performs 
for the person making

[[Page 40410]]

the marketing solicitation,\159\ or indicates the time after which 
marketing solicitations are no longer permitted.\160\
---------------------------------------------------------------------------

    \158\ See Wells Fargo Letter.
    \159\ See 15 U.S.C. 1681s-3(a)(4)(C).
    \160\ See 15 U.S.C. 1681s-3(d)(1)(B) and (C).
---------------------------------------------------------------------------

    The Commission concludes that ``making'' and ``sending'' marketing 
solicitations are different activities and that the focus of the FCRA 
is primarily on the ``making'' of marketing solicitations.\161\ 
Accordingly, the final rules refer to ``making'' a marketing 
solicitation, except where the FCRA specifically refers to ``sending'' 
a marketing solicitation. The FCRA, however, does not describe what a 
person must do in order ``to make'' a marketing solicitation. The 
legislative history is silent on this point. Nevertheless, the 
Commission believes it is important to provide clear guidance regarding 
what activities constitute making a marketing solicitation.
---------------------------------------------------------------------------

    \161\ For example, a service provider may send a marketing 
solicitation to a consumer on behalf of another entity, but it is 
the entity on whose behalf the marketing solicitation is sent that 
is making the marketing solicitation and thus, is subject to the 
general prohibition on making a marketing solicitation without first 
giving the consumer an affiliated marketing notice and an 
opportunity to opt out.
---------------------------------------------------------------------------

    The Commission has added new Sec.  248.121(b) in the final rules to 
clarify what constitutes ``making'' a marketing solicitation for 
purposes of Regulation S-AM. Section 248.121(b)(1) provides that a 
Covered Person makes a marketing solicitation to a consumer if: (1) It 
receives eligibility information from an affiliate; (2) it uses that 
eligibility information to identify the consumer or type of consumer to 
receive a marketing solicitation, establish the criteria used to select 
the consumer to receive a marketing solicitation, or decide which of 
its products or services to market to the consumer or tailor its 
marketing solicitation to that consumer; and (3) as a result of its use 
of the eligibility information, the consumer is provided a marketing 
solicitation.
    The Commission understands that several common business practices 
may complicate application of this provision. Affiliated groups 
sometimes use a common database as the repository for eligibility 
information obtained by various affiliates, and information in that 
database may be accessible to multiple affiliates. In addition, 
affiliated companies sometimes use the same service providers to 
perform marketing activities, and some of those service providers may 
provide services for a number of different affiliates. Moreover, an 
affiliate may use its own eligibility information to market the 
products or services of another affiliate. Paragraphs (b)(2)-(5) of 
Sec.  248.121 address these issues.
    Section 248.121(b)(2) clarifies that a Covered Person may receive 
eligibility information from an affiliate in various ways, including by 
the affiliate placing that information into a common database that a 
Covered Person may access. Of course, receipt of eligibility 
information from an affiliate is only one element of making a marketing 
solicitation. In the case of a common database, use of the eligibility 
information will be important in determining whether a person has made 
a marketing solicitation.
    To clarify the application of the concept of ``making'' a marketing 
solicitation in the context of a Covered Person using a service 
provider, Sec.  248.121(b)(3) generally provides that a person receives 
or uses an affiliate's eligibility information if a service provider 
acting on behalf of the Covered Person receives or uses that 
information on the Covered Person's behalf.\162\ Section 248.121(b)(3) 
also provides that all relevant facts and circumstances will determine 
whether a service provider is acting on behalf of a Covered Person when 
it receives or uses an affiliate's eligibility information in 
connection with marketing the Covered Person's products or services.
---------------------------------------------------------------------------

    \162\ The service provider's activities would be those described 
in Sec. Sec.  248.121(b)(1)(i) and (b)(1)(ii), discussed above. 
Section 248.121(b)(5), as discussed below, provides an exception to 
this general rule.
---------------------------------------------------------------------------

b. Constructive Sharing and Service Providers
    In Sec.  248.121(b)(4), we address the concept of ``constructive 
sharing.'' In the proposing release, we illustrated the constructive 
sharing concept with an example in which a consumer has a pre-existing 
business relationship with a broker-dealer that is affiliated with a 
financing company. In the example, the financing company would provide 
the broker-dealer with specific eligibility criteria, such as consumers 
who have a margin loan balance in excess of $10,000, for the purpose of 
having the broker-dealer make marketing solicitations on behalf of the 
financing company to consumers that meet those criteria. A consumer who 
meets the eligibility criteria would contact the financing company 
after receiving the financing company marketing materials in the manner 
specified in those materials. We contemplated that the consumers' 
responses would provide the financing company with discernable 
eligibility information, such as through a coded response form that 
would identify a consumer as an individual who meets the specific 
eligibility criteria.\163\
---------------------------------------------------------------------------

    \163\ See Proposing Release at 69 FR 42307.
---------------------------------------------------------------------------

    We solicited comment on whether, given the policy objectives of 
Section 214 of the FACT Act, the notice and opt out requirements of 
these rules should apply to circumstances that involve a constructive 
sharing of eligibility information to make marketing solicitations.
    Commenters consistently opposed inclusion of the concept of 
constructive sharing in the final rules.\164\ One commenter argued that 
inclusion of the proposed example of constructive sharing would 
restrict the ability of financial institutions to market products to 
their own customers.\165\ Others stated that including the example was 
inconsistent with many of the exceptions provided in the proposed 
rules.\166\ In general, commenters argued that constructive sharing was 
outside the scope of Regulation S-AM because the rules should address 
the making of marketing solicitations and not the sharing of 
information.\167\
---------------------------------------------------------------------------

    \164\ See ABASA Letter; ACB Letter; Coalition Letter; FSR 
Letter; ICBA Letter; ICI Letter; MetLife Letter; SIFMA Letter I; T. 
Rowe Price Letter; Wells Fargo Letter.
    \165\ See T. Rowe Price Letter.
    \166\ See Coalition Letter; FSR Letter; ICBA Letter; Wells Fargo 
Letter; SIFMA Letter I.
    \167\ See Coalition Letter; ICBA Letter; SIFMA Letter I; Wells 
Fargo Letter. Although the Commission did not receive comment from 
consumer groups, consumer groups argued to the Agencies that 
constructive sharing would contravene the intent of Congress and 
would amount to a loophole that should be fixed.
---------------------------------------------------------------------------

    After carefully considering the comments, we conclude that the FCRA 
only covers situations in which a person uses eligibility information 
that it received from an affiliate to make a marketing solicitation to 
the consumer about its products or services. In a constructive sharing 
scenario like that described in the proposal and above,\168\ a pre-
existing business relationship is established between the consumer and 
the financing company when the consumer contacts the financing company 
to inquire about or apply for products or services as a result of the 
consumer's receipt of the financing company's marketing materials from 
the broker-dealer. Thus, a pre-existing business relationship is 
established before the financing company uses any shared eligibility 
information to make marketing solicitations to the consumer. Because 
the financing company does not use shared eligibility information to 
make marketing solicitations to the consumer before it establishes a 
pre-existing business relationship with the

[[Page 40411]]

consumer, the FCRA's affiliate marketing notice and opt out requirement 
does not apply.
---------------------------------------------------------------------------

    \168\ See supra note 163 and accompanying text.
---------------------------------------------------------------------------

    The Commission acknowledges that the FCRA's affiliate marketing 
provisions only limit the use of eligibility information received from 
an affiliate to make marketing solicitations to a consumer. Separately, 
the affiliate sharing notice and opt out provisions of the FCRA 
(Section 603(d)(2)(A)(iii)) regulate the sharing of eligibility 
information other than transaction or experience information among 
affiliates and prohibit the sharing of such information among 
affiliates, unless the consumer is given notice and an opportunity to 
opt out.\169\ The FCRA does not restrict the sharing of transaction or 
experience information (other than medical information) among 
affiliates.\170\
---------------------------------------------------------------------------

    \169\ Section 603(d)(2)(A)(iii) of the FCRA operates 
independently of FCRA's affiliate marketing provisions. Thus, the 
existence of a pre-existing business relationship between a consumer 
and an affiliate that seeks to use shared eligibility information, 
such as credit scores or income, to market to that consumer (or the 
applicability of another exception to these affiliate marketing 
rules) does not relieve the entity sharing the eligibility 
information from the requirement to comply with the affiliate 
sharing notice and opt out provisions of Section 603(d)(2)(A)(iii) 
of the FCRA before it shares with its affiliate eligibility 
information other than transaction or experience information. See 15 
U.S.C. 1681a(d)(2)(A)(iii).
    \170\ Information sharing occurs if a reference code included in 
marketing materials reveals one affiliate's information about a 
consumer to another affiliate upon receipt of a consumer's response.
---------------------------------------------------------------------------

    Section 248.121(b)(4) describes two situations in which a Covered 
Person has not made a solicitation subject to Regulation S-AM. Both 
situations assume that the Covered Person has not used eligibility 
information received from an affiliate in the manner described in Sec.  
248.121(b)(1)(ii). In the first situation, the affiliate uses its own 
eligibility information that it obtained in connection with a pre-
existing business relationship that it has or had with the consumer to 
market the Covered Person's products or services to the affiliate's 
consumers.\171\ In the second situation, which builds on the first, a 
Covered Person's affiliate directs its service provider to use the 
affiliate's own eligibility information to market the Covered Person's 
products or services to the affiliate's consumer, and the Covered 
Person does not communicate directly with the service provider 
regarding that use of the eligibility information.
---------------------------------------------------------------------------

    \171\ As an example, a broker-dealer that sells investment 
company shares to a consumer has a pre-existing business 
relationship with the consumer (as does the investment company if 
the consumer is the record owner of its shares). The broker-dealer 
may make a marketing solicitation for an investment in an affiliated 
investment company based on eligibility information the broker-
dealer obtained in connection with its pre-existing business 
relationship with the consumer.
---------------------------------------------------------------------------

    The core concept is that the affiliate that obtained the 
eligibility information in connection with a pre-existing business 
relationship with the consumer controls the actions of the service 
provider using that information. Therefore, the service provider's use 
of the eligibility information should not be attributed to the Covered 
Person whose products or services will be marketed to consumers. In 
such circumstances, the service provider is acting on behalf of the 
affiliate that obtained the eligibility information in connection with 
a pre-existing business relationship with the consumer, and not on 
behalf of the Covered Person whose products or services will be 
marketed to that affiliate's consumers.
    In addition, the Commission recognizes that there may be situations 
in which the Covered Person whose products or services are being 
marketed does communicate with the affiliate's service provider.\172\ 
To address these situations, the Commission has added Sec.  
248.121(b)(5) which describes the conditions under which a service 
provider would be deemed to be acting on behalf of the affiliate with 
the pre-existing business relationship, rather than the Covered Person 
whose products or services are being marketed, notwithstanding direct 
communications between the Covered Person and the service 
provider.\173\
---------------------------------------------------------------------------

    \172\ For example, a service provider may perform services for 
various affiliates relying on information maintained in and accessed 
from a common database. In certain circumstances, the person whose 
products or services are being marketed may communicate with the 
service provider of the affiliate with the pre-existing business 
relationship, yet the service provider is still acting on behalf of 
the affiliate when it uses the affiliate's eligibility information 
in connection with marketing the person's products or services.
    \173\ This section builds upon the concept of control of a 
service provider and thus is a natural outgrowth of Sec.  
248.121(b)(4). Under the conditions set forth in Sec.  
248.121(b)(5), the service provider is acting on behalf of an 
affiliate that obtained the eligibility information in connection 
with a pre-existing business relationship with the consumer because, 
among other things, the affiliate controls the actions of the 
service provider in connection with the service provider's receipt 
and use of eligibility information.
---------------------------------------------------------------------------

    Section 248.121(b)(5) provides that a Covered Person does not make 
a marketing solicitation subject to Regulation S-AM if a service 
provider (including an affiliated or third-party service provider that 
maintains or accesses a common database that the Covered Person may 
access) receives and uses eligibility information from the Covered 
Person's affiliate to market the Covered Person's products or services 
to the affiliate's consumer, so long as five conditions are met.
    First, the Covered Person's affiliate must control access to and 
use of its eligibility information by the service provider (including 
the right to establish specific terms and conditions under which the 
service provider may use such information to market the Covered 
Person's products or services). This requirement must be set forth in a 
written agreement between the Covered Person's affiliate and the 
service provider. The Covered Person's affiliate may demonstrate 
control by, for example, establishing and implementing reasonable 
policies and procedures applicable to the service provider's access to 
and use of its eligibility information.\174\
---------------------------------------------------------------------------

    \174\ See Sec.  248.121(b)(5)(i)(A).
---------------------------------------------------------------------------

    Second, the Covered Person's affiliate must establish specific 
terms and conditions under which the service provider may access and 
use that eligibility information to market the Covered Person's 
products or services (or those of affiliates generally) to the 
affiliate's consumers, and periodically evaluates the service 
provider's compliance with those terms and conditions. These terms and 
conditions may include the identity of the affiliated companies whose 
products or services may be marketed to the affiliate's consumers by 
the service provider, the types of products or services of affiliated 
companies that may be marketed, and the number of times the affiliate's 
consumers may receive marketing materials. While the specific terms and 
conditions established by the Covered Person's affiliate must be set 
forth in writing, they are not required to be set forth in a written 
agreement between the affiliate and the service provider. If a periodic 
evaluation by the Covered Person's affiliate reveals that the service 
provider is not complying with those terms and conditions, the 
Commission expects the Covered Person's affiliate to take appropriate 
corrective action.\175\
---------------------------------------------------------------------------

    \175\ See Sec.  248.121(b)(5)(i)(B).
---------------------------------------------------------------------------

    Third, the Covered Person's affiliate must require the service 
provider to implement reasonable policies and procedures designed to 
ensure that the service provider uses the affiliate's eligibility 
information in accordance with the terms and conditions established by 
the affiliate relating to the marketing of the Covered Person's 
products or services. This requirement must be set forth in a written 
agreement between the Covered Person's affiliate and the service 
provider.\176\
---------------------------------------------------------------------------

    \176\ See Sec.  248.121(b)(5)(i)(C).

---------------------------------------------------------------------------

[[Page 40412]]

    Fourth, the Covered Person's affiliate must be identified on or 
with the marketing materials provided to the consumer. This requirement 
will be construed flexibly. For example, the affiliate may be 
identified directly on the marketing materials, on an introductory 
cover letter, on other documents included with the marketing materials 
such as a periodic statement, or on the envelope that contains the 
marketing materials.\177\
---------------------------------------------------------------------------

    \177\ See Sec.  248.121(b)(5)(i)(D).
---------------------------------------------------------------------------

    Fifth, the Covered Person must not directly use the affiliate's 
eligibility information in the manner described in Sec.  
248.121(b)(1)(ii).\178\
---------------------------------------------------------------------------

    \178\ See Sec.  248.121(b)(5)(i)(E).
---------------------------------------------------------------------------

    Under these conditions, the service provider is acting on behalf of 
an affiliate that obtained the eligibility information in connection 
with a pre-existing business relationship with the consumer because, 
among other things, the affiliate controls the actions of the service 
provider in connection with the service provider's receipt and use of 
the eligibility information.\179\ The five conditions together are 
intended to ensure that the service provider is acting on behalf of the 
affiliate that obtained the eligibility information in connection with 
a pre-existing business relationship with the consumer because that 
affiliate controls the service provider's receipt and use of that 
affiliate's eligibility information.
---------------------------------------------------------------------------

    \179\ This provision is designed to minimize uncertainty that 
may arise from the application of the facts and circumstances test 
in Sec.  248.121(b)(3) to situations that involve direct 
communications between a service provider and a Covered Person whose 
products and services will be marketed to consumers.
---------------------------------------------------------------------------

    To provide additional guidance to Covered Persons, Sec.  
248.121(b)(6) provides six illustrative examples of the rules relating 
to making marketing solicitations.
3. Sections 248.121(c) and (d)
    Proposed Sec.  247.20(c) contained exceptions to the requirements 
of Regulation S-AM and incorporated each of the statutory exceptions to 
the affiliate marketing notice and opt out requirements that are set 
forth in Section 624(a)(4) of the FCRA. The Commission has revised the 
preface to the exceptions for clarity to provide that Regulation S-AM 
does not apply to ``you'' if a Covered Person uses eligibility 
information that it receives from an affiliate in certain 
circumstances. In addition, each of the exceptions has been moved to 
Sec.  248.121(c) in the final rules and is discussed below.\180\
---------------------------------------------------------------------------

    \180\ One commenter requested that the Commission delete the 
phrase ``if you use eligibility information you receive from an 
affiliate'' in the introductory words to Proposed Sec.  247.20(c). 
The Commenter stated that this could inadvertently and mistakenly 
expose companies that share information with affiliates to potential 
liability. See SIFMA Letter II. That concern was addressed in the 
constructive sharing discussion above. See supra Part III.D.2.b.
---------------------------------------------------------------------------

a. Pre-Existing Business Relationship Exception
    Proposed paragraph (c)(1) of Sec.  247.20 clarified that the notice 
and opt out requirements of proposed Regulation S-AM would not apply 
when the receiving affiliate has a pre-existing business relationship 
with the consumer. We are adopting Sec.  247.20(c)(1) substantially as 
proposed,\181\ deleting the word ``send'' for the reasons discussed 
above and eliminating, as unnecessary, the cross-reference to the 
location of the definition of ``pre-existing business relationship.'' 
\182\ Commenters' views, and the scope of this exception, have been 
addressed above.\183\ However, to help clarify the scope of the ``pre-
existing business relationship'' exception, Sec.  248.121(d)(1) 
provides an example to illustrate a situation in which the pre-existing 
business relationship exception would apply.\184\
---------------------------------------------------------------------------

    \181\ Proposed Sec.  247.20 (d)(1) provided examples of the pre-
existing business relationship exception. As explained above, we 
have revised the examples from proposed Sec.  247.20(d)(1) in the 
final rule and included them as examples of the definition of ``pre-
existing business relationship'' rather than as examples of 
exceptions from the application of the rule. See Sec.  
248.120(q)(2); See also discussion of ``pre-existing business 
relationship'' and corresponding examples supra Part III.C.17.
    \182\ See Sec.  248.121(c)(1).
    \183\ See supra Part III.C.17.
    \184\ See Sec. Sec.  248.120(q)(2)-(3) for examples illustrating 
situations in which a pre-existing business relationship exists and 
situations in which a pre-existing business relationship does not 
exist.
---------------------------------------------------------------------------

b. Employee Benefit Plan Exception
    Proposed Sec.  247.20(c)(2) provided that Regulation S-AM would not 
apply to an affiliate using the information to facilitate 
communications to an individual for whose benefit the affiliate 
provided employee benefit or other services under a contract with an 
employer related to and arising out of a current employment 
relationship or an individual's status as a participant or beneficiary 
of an employee benefit plan. One commenter stated that the exception 
should be revised to permit communications ``to an affiliate about an 
individual for whose benefit an entity provides employee benefit or 
other services pursuant to a contract with an employer related to and 
arising out of the current employment relationship or status of the 
individual as a participant or beneficiary of an employee benefit 
plan.'' \185\ This commenter also suggested deleting the phrase ``you 
receive from an affiliate'' in the introduction to proposed Sec.  
247.20(c). In this commenter's view, the proposed exception should have 
permitted an employer or plan sponsor to share information with its 
affiliates in order to offer other financial services, such as 
brokerage accounts or IRAs, to its employees. This commenter also 
requested clarification on whether the exception applies only if 
related to products offered as an employee benefit.
---------------------------------------------------------------------------

    \185\ See FSR Letter.
---------------------------------------------------------------------------

    We decline to adopt the changes suggested by this commenter and 
adopt the employee benefit exception, redesignated as Sec.  
248.121(c)(2), as proposed. The focus of the rule is on facilitating 
communications ``to an individual for whose benefit the [Covered 
Person] provides employee benefit or other services,'' which more 
closely tracks the statutory language than the alternative language 
proposed by the commenter.
    Moreover, we note that the only type of Covered Person to whom 
Section 624 of the FCRA might apply is one that receives eligibility 
information from an affiliate.\186\ The FCRA thus makes clear that the 
exceptions in Section 624(a)(4) were meant to apply to persons that 
otherwise would be subject to Section 624. In the case of the employee 
benefit exception, the person using the information is also ``the 
person provid[ing] employee benefit or other services pursuant to a 
contract with an employer.'' \187\ Therefore, this exception, like the 
other provisions of Regulation S-AM, should apply only to a Covered 
Person that uses eligibility information it receives from an affiliate 
to make marketing solicitations to consumers about its products or 
services.\188\
---------------------------------------------------------------------------

    \186\ The statutory preface to the exceptions provides that 
``[t]his section shall not apply to a person'' using information to 
do certain enumerated things. See 15 U.S.C. 1681s-3(a)(4).
    \187\ 15 U.S.C. 1681s-3(a)(4)(B).
    \188\ There is no corresponding example for this provision.
---------------------------------------------------------------------------

c. Service Provider Exception
    Proposed Sec.  247.20(c)(3) provided that the notice and opt out 
requirements of Regulation S-AM would not apply when the eligibility 
information is used to perform services for another affiliate. The 
exception would not have applied if the other affiliate was not 
permitted to make or send marketing solicitations on its own behalf, 
for example as a result of the consumer's prior decision to opt out. 
Thus, under the proposal, when the notice has been provided to a 
consumer and the consumer has opted out, a receiving affiliate subject 
to the

[[Page 40413]]

consumer's opt out election could not circumvent the opt out by 
instructing the communicating affiliate or another affiliate to make or 
send marketing solicitations to the consumer on its behalf.\189\
---------------------------------------------------------------------------

    \189\ Similarly, this exception would not permit a service 
provider to make marketing solicitations on its own behalf if 
eligibility information is communicated and the FCRA's affiliate 
marketing notice and opt out provisions otherwise would apply.
---------------------------------------------------------------------------

    One commenter urged the Commission to adopt this exception.\190\ 
Others suggested conforming it to the statutory provision by deleting 
the references to marketing solicitations on behalf of service 
providers.\191\ One of these commenters maintained that these 
references would impose additional burdens and costs on companies that 
use a single affiliate to provide various administrative services to 
other affiliates and would make it more difficult to provide general 
educational materials to consumers.\192\ One commenter also asked the 
Commission to clarify that the limitation in FCRA Section 624(a)(4)(C) 
only applies to the service provider exception.\193\
---------------------------------------------------------------------------

    \190\ See ICBA Letter.
    \191\ See FSR Letter; MetLife Letter.
    \192\ See FSR Letter.
    \193\ See MetLife Letter.
---------------------------------------------------------------------------

    We are adopting the service provider exception, redesignated as 
Sec.  248.121(c)(3), substantially as proposed. We have eliminated the 
references to marketing solicitations made by a service provider on its 
own behalf. The general rule in Sec.  248.121(a)(1) prohibits a service 
provider from using eligibility information it received from an 
affiliate to make marketing solicitations to a consumer about its own 
products or services unless the consumer is given notice and an 
opportunity to opt out and has not opted out, or unless one of the 
other exceptions applies. The service provider exception simply allows 
a service provider to do what the affiliate on whose behalf it is 
acting may do, such as using shared eligibility information to make 
marketing solicitations to consumers to whom the affiliate is permitted 
to make such marketing solicitations.\194\ Nothing in the service 
provider and pre-existing business relationship exceptions will prevent 
an affiliate that has a pre-existing business relationship with the 
consumer from relying upon the service provider exception, as long as 
the arrangement satisfies the requirements of the rule and applicable 
exceptions. To help clarify the scope of the service provider 
exception, Sec.  248.121(d)(2) provides two examples.\195\
---------------------------------------------------------------------------

    \194\ As discussed above, the final rule does not include the 
word ``make'' because ``making'' and ``sending'' solicitations are 
distinct activities and this provision of the statute uses the verb 
``to send.'' See supra Part II.B.
    \195\ Sections 248.121(b)(4) and 248.121(b)(5) are consistent 
with comparable provisions of the Joint Rules and the FTC Rule, 72 
FR 62922-24 and 72 FR 61435-37, respectively.
---------------------------------------------------------------------------

d. Consumer-Initiated Communication Exception
    Proposed paragraph (c)(4) of Sec.  247.20 provided that the notice 
and opt out requirements would not have applied when eligibility 
information was used in response to a communication initiated by the 
consumer. This exception could have been triggered by an oral, 
electronic, or written communication initiated by the consumer. To be 
covered by the proposed exception, any use of eligibility information 
would need to be responsive to the communication initiated by the 
consumer. Paragraph (d)(2) of the proposed rule provided three examples 
of situations that would and would not meet the exception.\196\
---------------------------------------------------------------------------

    \196\ Proposed Sec.  247.20(d)(2)(i) provided that the exception 
would apply when a consumer holding an account with an institution 
calls the institution's affiliate for information about the 
affiliate's products and services, leaving contact information with 
the affiliate. Proposed Sec.  247.20(d)(2)(ii) provided that the 
exception would not apply when a consumer did not initiate a 
communication but rather called an affiliate back after the 
affiliate made an initial marketing call and left a message for a 
consumer. Proposed Sec.  247.20(d)(2)(iii) provided that the 
exception would not apply when a consumer called an affiliate asking 
for retail locations without asking about the affiliate's products 
and services.
---------------------------------------------------------------------------

    Five commenters addressed this exception.\197\ One commenter 
suggested that the Commission delete the phrase ``orally, 
electronically, or in writing,'' \198\ while another suggested 
modifying it to read ``whether orally, electronically, or in writing.'' 
\199\ Other commenters objected to requiring the use of eligibility 
information to be ``responsive'' to the communication initiated by the 
consumer.\200\ In their view, the concept of ``responsiveness'' would 
create a vague standard and encourage a narrow reading of the 
exception. Another commenter stated that the Commission did not and 
could not provide a clear definition of what would be ``responsive'' 
and opined that this standard would cause a Covered Person to be 
uncertain as to their compliance.\201\ One commenter asserted that 
consumers may not be familiar with the various types of products or 
services available to them and the different affiliates that offer 
those products or services and may rely on the institution to inform 
them about available options.\202\ For this reason, the commenter 
maintained that the exception should not limit an affiliate from 
responding with solicitations about any product or service. This 
commenter also stated that the Senate bill that preceded the FACT Act 
used more restrictive language in this exception than the final 
legislation passed by Congress.
---------------------------------------------------------------------------

    \197\ See Coalition Letter; ICBA Letter; SIFMA Letter I; Wells 
Fargo Letter; USAA Letter.
    \198\ See Coalition Letter.
    \199\ See ICBA Letter.
    \200\ See Wells Fargo Letter; USAA Letter.
    \201\ See Coalition Letter.
    \202\ See Wells Fargo Letter.
---------------------------------------------------------------------------

    Some commenters objected to the example in proposed Sec.  
247.20(d)(2)(ii), stating that a consumer responding to a call-back 
message should qualify as a consumer-initiated communication and noting 
that the consumer has the option of not returning the call.\203\ One 
commenter expressed concern about the example in proposed paragraph 
(d)(2)(iii) regarding the consumer who calls to ask for retail 
locations and hours, and stated that this would create a vague standard 
that would be difficult to apply and subject to differing 
interpretations.\204\
---------------------------------------------------------------------------

    \203\ See SIFMA Letter I; Wells Fargo Letter; Coalition Letter.
    \204\ See ICBA Letter. The commenter, however, did not explain 
why it thought the example was vague.
---------------------------------------------------------------------------

    After considering the comments, we are adopting paragraphs (c)(4) 
and (d)(2) of proposed Sec.  247.20 with some modifications, 
redesignated as Sec. Sec.  248.121(c)(4) and (d)(3), respectively. The 
final rule eliminates the reference to oral, electronic, or written 
communications. Any form of communication may come within the exception 
as long as the consumer initiates the communication, whether in-person 
or by mail, e-mail, telephone, facsimile, or through other means.
    Section 248.121(c)(4) provides that the communications covered by 
the exception must be consumer-initiated and must concern a Covered 
Person's products or services. The FCRA requires a person relying on 
the exception to use eligibility information only ``in response to'' a 
communication initiated by a consumer.\205\ The Commission believes 
that the exceptions should be construed narrowly to avoid undermining 
the general rule requiring notice and opt out. Thus, consistent with 
the purposes of the FCRA, the Commission does not believe that a 
consumer-initiated

[[Page 40414]]

communication unrelated to a Covered Person's products or services 
should trigger the exception. A rule that allowed any consumer-
initiated communication, no matter how unrelated to a Covered Person's 
products or services, to trigger the exception would not give meaning 
to the phrase ``in response to'' and could produce incongruous results. 
For example, if a consumer calls a broker-dealer to ask about retail 
locations and hours, but does not request information about its 
products or services, the broker-dealer may not use eligibility 
information it receives from an affiliate to make marketing 
solicitations to the consumer because the consumer-initiated 
communication does not relate to the broker-dealer's products or 
services. The use of eligibility information received from an affiliate 
would not be responsive to the communication, and the exception would 
not apply.
---------------------------------------------------------------------------

    \205\ See 15 U.S.C. 1681s-3(a)(4)(D). The Commission believes 
this statutory language contemplates that the consumer-initiated 
communications will relate to a Covered Person's products or 
services, and that the marketing solicitations covered by the 
exception will be those made in response to that communication.
---------------------------------------------------------------------------

    However, the Commission recognizes that if a consumer-initiated 
conversation turns to a discussion of products or services the consumer 
may need, marketing solicitations may be responsive if the consumer 
agrees to receive marketing materials and provides or confirms contact 
information by which he or she can receive those materials. For 
example, if a consumer calls a broker-dealer to ask about retail 
locations and hours, the broker-dealer's customer service 
representative asks the consumer if there is a particular product or 
service about which the consumer is seeking information, the consumer 
responds affirmatively and expresses an interest in mutual funds 
offered by the broker-dealer, the customer service representative 
offers to provide that information by telephone and mail additional 
information to the consumer, and the consumer agrees and provides or 
confirms contact information for receipt of the materials to be mailed, 
the broker-dealer may use eligibility information it receives from an 
affiliate to make marketing solicitations to the consumer about mutual 
funds because such marketing solicitations would respond to the 
consumer-initiated communication about mutual funds.
    Likewise, if a consumer who has opted out of an affiliate's use of 
eligibility information to make marketing solicitations calls the 
affiliate for information about a particular product or service, (i.e., 
life insurance), marketing solicitations regarding that specific 
product or service could be made in response to that call, but 
marketing solicitations regarding other products or services could not. 
Because marketing solicitations will likely be made quickly, we do not 
believe it is appropriate to adopt a specific time limit for making 
solicitations following a consumer-initiated communication about 
products or services.
    We are adopting the example in proposed Sec.  247.20(d)(2)(i), 
redesignated as Sec.  248.121(d)(3)(i), and modified to delete the 
references to a telephone call as the specific form of communication 
and the reference to providing contact information. As discussed above 
and illustrated in the examples in Sec. Sec.  248.120(q)(2)(v) and 
(vi), the need to provide contact information may vary depending on the 
form of communication used by the consumer. A new example in Sec.  
248.121(d)(3)(ii) illustrates a situation involving a consumer-
initiated communication in which a consumer does not know exactly what 
products, services, or investments he or she wants, but initiates a 
communication to obtain information about investing for a child's 
college education. We are adopting the call-back example in proposed 
Sec.  247.20(d)(2)(ii), redesignated as Sec.  248.121(d)(3)(iii) and 
modified to illustrate that when a Covered Person makes an initial 
marketing call without using eligibility information received from an 
affiliate and leaves a message that invites the consumer to receive 
information about the Covered Person's products and services by calling 
a toll-free number, the consumer's response qualifies as a consumer-
initiated communication about a product or service. The modified 
example is intended to avoid requiring Covered Persons to track which 
calls are call-backs.\206\
---------------------------------------------------------------------------

    \206\ Although the Commission received no specific comment 
regarding tracking call-backs, we have revised Sec.  
248.121(d)(3)(iii) in order to be consistent with the changes made 
by the Agencies in response to comments they received.
---------------------------------------------------------------------------

    We are adopting the retail hours example in proposed Sec.  
247.20(d)(2)(iii) substantially as proposed and redesignated as Sec.  
248.121(d)(3)(iv). We are also adopting a new example in Sec.  
248.121(d)(3)(v) to address the situation where a consumer calls to ask 
about retail locations and hours and a call center representative, 
after eliciting information about the reason the consumer wants to 
visit a retail location, offers to provide information about products 
of interest to the consumer by telephone and mail, and the consumer 
agrees and provides or confirms contact information. This example 
demonstrates how a conversation may develop to the point where making 
marketing solicitations would be responsive to the consumer's call.
e. Consumer Authorization or Request Exception
    Proposed Sec.  247.20(c)(5) provided that the notice and opt out 
requirements would not apply when the information is used to make 
marketing solicitations that have been affirmatively authorized or 
requested by the consumer.\207\ We contemplated that this provision 
could be triggered by an oral, electronic, or written authorization or 
request by the consumer but indicated that a pre-selected check box 
would not constitute an affirmative authorization or request.\208\ In 
addition, we noted that boilerplate language in a disclosure or 
contract would not have constituted an affirmative authorization.\209\ 
The exception in proposed paragraph (c)(5) could have been triggered, 
for example, if a consumer opens a securities account with a broker-
dealer and authorizes or requests marketing solicitations about 
insurance from an insurance affiliate of the broker-dealer. Under the 
proposed exception, the consumer could have provided the authorization 
or made the request either through the Covered Person with whom he or 
she has a business relationship or directly to the affiliate that would 
make the marketing solicitation.\210\ The duration of the authorization 
or request would have depended on the facts and circumstances. Proposed 
Sec.  247.20(d)(3) provided an example of the affirmative authorization 
or request exception.
---------------------------------------------------------------------------

    \207\ See Proposing Release at 69 FR 42309.
    \208\ Id.
    \209\ Id.
    \210\ Nothing in this exception supersedes the restrictions on 
telemarketing contained in rules of self-regulatory organizations, 
the Federal Communications Commission, or in the TSR, including the 
operation of the ``Do-Not-Call List'' established by the FTC and the 
Federal Communications Commission.
---------------------------------------------------------------------------

    Some commenters noted that the proposed exception would have 
required an ``affirmative'' authorization or request but that the FCRA 
did not.\211\ One commenter indicated that the proposal did not 
indicate how the authorization would be affirmative.\212\ Another 
commenter indicated that inclusion of the term ``affirmative'' in the 
exception would have introduced uncertainty as to what would constitute 
an authorization or request by the consumer, and stated that the term 
should be deleted.\213\ Other commenters asserted that a pre-selected 
check box should be sufficient to evidence a consumer's authorization 
or request for

[[Page 40415]]

marketing solicitations.\214\ In their view, a consumer's decision not 
to deselect a pre-selected check box should constitute a knowing act of 
the consumer to authorize or request marketing solicitations if the 
boxes are properly used.\215\ Other commenters stated that preprinted 
language in a disclosure or contract should be sufficient to evidence a 
consumer's authorization or request for marketing solicitations.\216\ 
Another commenter requested that the Commission clarify that a 
consumer's authorization or request does not have to refer to a 
specific product or service or to a specific provider of products or 
services in order for the exception to apply.\217\
---------------------------------------------------------------------------

    \211\ See ACLI Letter; SIFMA Letter I; Wells Fargo Letter. See 
also 15 U.S.C. 1681s-3(a)(4)(E).
    \212\ See Wells Fargo Letter.
    \213\ See SIFMA Letter I. However, the commenter did not provide 
an example of how this would create uncertainty.
    \214\ See ICBA Letter; USAA Letter; Wells Fargo Letter.
    \215\ See USAA Letter; Wells Fargo Letter.
    \216\ See Coalition Letter. This commenter cited case law and 
FTC informal staff opinion letters relating to a consumer's written 
instructions to obtain a consumer report pursuant to Section 
604(a)(2) of the FCRA as support for allowing boilerplate language 
to constitute authorization or request.
    \217\ See Wells Fargo Letter.
---------------------------------------------------------------------------

    We are adopting Sec.  247.20(c)(5), redesignated as Sec.  
248.121(c)(5), substantially as proposed but without the word 
``affirmative.'' This change does not affect the meaning of the 
exception and the consumer still must take steps to ``authorize'' or 
``request'' marketing solicitations. The GLBA and the implementing 
privacy rules include an exception to permit the disclosure of 
nonpublic personal information ``with the consent or at the direction 
of the consumer.'' \218\ Section 624 of the FCRA creates an exception 
to permit the use of shared eligibility information ``in response to 
solicitations authorized or requested by the consumer.'' The Commission 
interprets the ``authorized or requested'' provision in the FCRA 
exception to require the consumer to take affirmative steps in order to 
trigger the exception despite deletion of the term from the rule. The 
Commission construes this exception, like the other exceptions, 
narrowly and in a manner that does not undermine Regulation S-AM's 
general notice and opt out requirement. In this regard, affiliated 
companies cannot avoid use of the FCRA's notice and opt out requirement 
by including preprinted boilerplate language in the disclosures or 
contracts they provide to consumers, such as a sentence (or a pre-
selected box next to a sentence) stating that by applying to open an 
account, the consumer authorizes or requests to receive marketing 
solicitations from affiliates. Such an interpretation would permit the 
exception to swallow the rule, a result that cannot be squared with the 
intent of Congress to give consumers notice and an opportunity to opt 
out of marketing solicitations. We are adopting the consumer 
authorization or request example in proposed Sec.  247.20(d)(3), 
redesignated as Sec.  248.121(d)(4)(i), with conforming changes in 
light of the changes made to Sec.  248.121(c)(5). In addition, to 
provide more guidance, we are adopting three additional examples. The 
example in Sec.  248.121(d)(4)(ii) illustrates how a consumer can 
authorize or request solicitations by checking a blank check box. The 
examples in Sec. Sec.  248.121(d)(4)(iii) and (iv) illustrate that 
preprinted boilerplate language and a pre-selected check box would not 
meet the authorization or request requirement. The Commission does not 
believe it is appropriate to set a fixed time period for an 
authorization or request. As noted in the proposal, the duration of the 
authorization or request depends on what is reasonable under the facts 
and circumstances.\219\ Of course, an authorization to make marketing 
solicitations to the consumer terminates if the consumer revokes the 
authorization.
---------------------------------------------------------------------------

    \218\ See 15 U.S.C. 6802 (e)(1)(A); 17 CFR 248.14(a)(1).
    \219\ See Proposing Release at 69 FR 42310.
---------------------------------------------------------------------------

    For the reasons discussed in connection with the consumer-initiated 
communication exception, we omitted the reference to oral, electronic, 
or written communications from this exception. We do not believe it is 
necessary to clarify the elements of an authorization or request. 
Section 624(a)(4)(E) of the FACT Act clearly refers to ``solicitations 
authorized or requested by the consumer.'' The facts and circumstances 
will determine what marketing solicitations have been authorized or 
requested by the consumer.
f. Compliance With Applicable Laws Exception
    Proposed Sec.  247.20(c)(6) clarified that the provisions of 
Regulation S-AM would not apply to an affiliate if compliance with the 
requirements of Section 624 by the affiliate would prevent that 
affiliate from complying with any provision of State insurance law 
pertaining to unfair discrimination in a State where the affiliate is 
lawfully doing business.\220\ The Commission received no comments on 
this provision and is adopting it as proposed, redesignated as Sec.  
248.121(c)(6). There is no corresponding example for this exception.
---------------------------------------------------------------------------

    \220\ See FCRA Section 624(a)(4).
---------------------------------------------------------------------------

4. Relation to Affiliate-Sharing Notice and Opt Out
    Proposed paragraph (f) of Sec.  247.20 clarified the relationship 
between the affiliate-sharing notice and opt out opportunity required 
under Section 603(d)(2)(A)(iii) of the FCRA and the affiliate marketing 
notice and opt out opportunity required by new Section 624 of the 
FCRA.\221\ Specifically, proposed paragraph (f) provided that nothing 
in proposed Regulation S-AM would have limited the responsibility of a 
company to comply with the notice and opt out provisions of Section 
603(d)(2)(A)(iii) of the FCRA before it shares information other than 
transaction and experience information with affiliates if it wishes to 
avoid becoming a consumer reporting agency.
---------------------------------------------------------------------------

    \221\ In general, Section 603(d)(2)(A) of the FCRA governs the 
sharing of creditworthiness and similar information among 
affiliates. As discussed in note 5 above, the FCRA sets standards 
for the collection, communication, and use of information bearing on 
a consumer's creditworthiness, credit standing, credit capacity, 
character, general reputation, personal characteristics, or mode of 
living. The FCRA provides that a person who communicates these forms 
of information to others could become a ``consumer reporting 
agency,'' which is subject to substantial statutory obligations. 
However, a person may communicate information about its own 
``transactions or experiences'' with a consumer without becoming a 
consumer reporting agency. This transaction and experience 
information may be communicated among affiliated persons without any 
of them becoming a consumer reporting agency. See FCRA Sections 
603(d)(2)(A)(i) and (ii); 15 U.S.C. 1681a(d)(2)(A)(i) and (ii).
    The FCRA provides that a person may communicate to its 
affiliates information other than transaction and experience 
information without becoming a consumer reporting agency if the 
person first gives the consumer a clear and conspicuous notice that 
such information may be communicated to its affiliates and an 
opportunity to ``opt out,'' or block the person from sharing the 
information. See FCRA Section 603(d)(2)(A)(iii); 15 U.S.C. 
1681a(d)(2)(A)(iii). There is some overlap between this ``affiliate 
sharing'' provision of the FCRA and the ``affiliate marketing'' 
rules that we are adopting. The two provisions are distinct, 
however, and they serve different purposes. Nothing in these rules 
regarding the limitations on affiliate marketing under Section 624 
of the FCRA supersedes or replaces the affiliate sharing notice and 
opt out requirement contained in Section 603(d)(2)(A)(iii) of the 
FCRA.
---------------------------------------------------------------------------

    One commenter urged the Commission to delete this provision as 
unnecessary.\222\ In the alternative, this commenter asked the 
Commission to confirm that Section 603(d)(2)(A)(iii) of the FCRA 
applies to the sharing of information that would otherwise meet the 
definition of a ``consumer report,'' and that the sharing affiliate 
does not automatically become a consumer reporting agency, but risks 
becoming a consumer reporting agency.\223\ In response, the Commission 
is clarifying that the FCRA, not Regulation S-AM,

[[Page 40416]]

establishes the standard for defining a person as a consumer reporting 
agency. Accordingly, we are adopting proposed Sec.  247.20(f), 
redesignated as Sec.  248.121(e) and modified to replace the reference 
to becoming a consumer reporting agency with the phrase ``where 
applicable,'' in order to highlight this clarification.
---------------------------------------------------------------------------

    \222\ See Coalition Letter.
    \223\ Id.
---------------------------------------------------------------------------

E. Section 248.122 Scope and Duration of Opt Out

1. Section 248.122(a)
    The scope of the opt out was addressed in various sections of the 
proposal. Proposed Sec.  247.21(c) provided that the notice could have 
allowed a consumer to choose from a menu of alternatives when opting 
out, such as opting out of receiving marketing solicitations from 
certain types of affiliates, or from receiving marketing solicitations 
that use certain types of information or are delivered using certain 
methods of communication. If a Covered Person provided a menu of 
alternatives, one of the alternatives would have had to allow the 
consumer to opt out with respect to all affiliates, all eligibility 
information, and all methods of delivering marketing solicitations. 
Proposed Sec.  247.25(d) described how the termination of a consumer 
relationship would have affected the consumer's opt out. Under the 
proposal, if a consumer's relationship with a Covered Person terminated 
for any reason when the consumer's opt out election was in force, the 
opt out would have continued to apply indefinitely unless revoked by 
the consumer. The Proposing Release indicated that the opt out would 
have been tied to the consumer, rather than to the information used for 
the marketing solicitations.\224\
---------------------------------------------------------------------------

    \224\ See Proposing Release at 69 FR 42311.
---------------------------------------------------------------------------

    Some commenters were critical of the provision requiring Covered 
Persons that provide a menu of alternatives, to provide the consumer 
with the ability to opt out with respect to all affiliates, all 
eligibility information, and all methods of delivery.\225\ One 
commenter stated that this requirement should be eliminated, arguing 
that this requirement does not appear in the FCRA.\226\ Another 
commenter indicated that the reference to ``all eligibility 
information'' made the provision confusing because it implied that 
there were various forms of eligibility information.\227\ One commenter 
opined that this universal opt out was not Congress's intent and stated 
that a notice should allow opt outs on an account basis rather than an 
individual basis.\228\ Several commenters generally opposed the 
indefinite opt out requirement for consumers that terminate a 
relationship with a person.\229\
---------------------------------------------------------------------------

    \225\ See ACLI Letter; Coalition Letter; FSR Letter.
    \226\ See ACLI Letter. See also 15 U.S.C. 1681s-3(a)(2).
    \227\ See FSR Letter. Another commenter also indicated that the 
``option for all eligibility information'' could be interpreted to 
mean all eligibility information pertaining to the consumer in 
perpetuity. This commenter sought clarification. See Coalition 
Letter.
    \228\ See Coalition Letter.
    \229\ See ACLI Letter; Coalition Letter; FSR Letter; ICBA 
Letter; SIFMA Letter I.
---------------------------------------------------------------------------

    After considering the comments, we are adopting the provision 
relating to the scope of the opt out, with modifications, as Sec.  
248.122(a) of Regulation S-AM. Under this section, which is modeled on 
Section 624(a)(2)(A) of the FCRA, the scope of the opt out depends upon 
the content of the opt out notice. Under Sec.  248.122(a)(1), except as 
otherwise provided in that section, a consumer's election to opt out 
prohibits any affiliate covered by the opt out notice from using the 
eligibility information received from another affiliate as described in 
the notice to make marketing solicitations to the consumer.
    Section 248.122(a)(2)(i) clarifies that, in the context of a 
continuing relationship, an opt out notice may apply to eligibility 
information obtained in connection with a single continuing 
relationship, multiple continuing relationships, continuing 
relationships established subsequent to delivery of the opt out notice, 
or any other transaction with the consumer. Section 248.122(a)(2)(ii) 
provides examples of continuing relationships. These examples are 
substantially similar to the examples used in the GLBA privacy rules, 
with added references to relationships between consumers and 
affiliates.\230\
---------------------------------------------------------------------------

    \230\ See, e.g., 17 CFR 248.4(c)(3).
---------------------------------------------------------------------------

    Section 248.122(a)(3)(i) limits the scope of an opt out notice that 
is not connected with a continuing relationship. This section provides 
that if there is no continuing relationship between a consumer and a 
Covered Person or its affiliate, and if the Covered Person or its 
affiliate provides an opt out notice to a consumer that relates to 
eligibility information obtained in connection with a transaction with 
the consumer, such as an isolated transaction or a credit application 
that is denied, the opt out notice only applies to eligibility 
information obtained in connection with that transaction. The notice 
cannot apply to eligibility information that may be obtained in 
connection with subsequent transactions or a continuing relationship 
that may be subsequently established by the consumer with the Covered 
Person or its affiliate. Section 248.122(a)(3)(ii) provides examples of 
isolated transactions.
    Section 248.122(a)(4) provides that a consumer may be given the 
opportunity to choose from a menu of alternatives when electing to 
prohibit marketing solicitations. An opt out notice may give the 
consumer the opportunity to elect to prohibit marketing solicitations 
from certain types of affiliates covered by the opt out notice but not 
other types of affiliates covered by the notice, marketing 
solicitations based on certain types of eligibility information but not 
other types of eligibility information, or marketing solicitations by 
certain methods of delivery but not other methods of delivery, so long 
as one of the alternatives is the opportunity to prohibit all marketing 
solicitations from all of the affiliates that are covered by the 
notice. We continue to believe that Section 624(a)(2)(A) of the FCRA 
requires the opt out notice to contain a single opt out option for all 
marketing solicitations within the scope of the notice. The Commission 
recognizes that consumers could receive a number of different opt out 
notices, even from the same affiliate. Accordingly, we anticipate 
monitoring industry notice practices and evaluating whether further 
action is needed.
    Section 248.122(a)(5)(i) contains a special rule that explains the 
obligations with respect to notice following the termination of a 
continuing relationship. Under this rule, a consumer must be given a 
new opt out notice if, after all continuing relationships with a person 
or its affiliate have been terminated, the consumer subsequently 
establishes a new continuing relationship with that person or the same 
or a different affiliate and the consumer's eligibility information is 
to be used to make a marketing solicitation.\231\ This will afford the 
consumer and the Covered Person a fresh start following termination of 
all continuing relationships by requiring a new opt out notice if a new 
continuing relationship is subsequently established. The new opt out 
notice must apply, at a minimum, to eligibility information obtained in 
connection with the new continuing relationship. The new opt out notice 
may apply more broadly to information obtained in connection

[[Page 40417]]

with a terminated relationship and give the consumer the opportunity to 
opt out with respect to eligibility information obtained in connection 
with both the terminated and the new continuing relationships. A 
consumer's failure to opt out does not override a prior, but still in-
effect, opt out election made by the consumer and applicable to 
eligibility information obtained in connection with a terminated 
relationship. The prior opt out would still be in effect regardless of 
whether the new opt out notice provided to the consumer applies to 
eligibility information that was obtained in connection with the 
terminated relationship.\232\ Section 248.122(a)(5)(ii) contains an 
example of this special rule. The Commission notes, however, that when 
a consumer was not given an opt out notice in connection with the 
initial continuing relationship because eligibility information 
obtained in connection with that continuing relationship was not shared 
with affiliates for use in making marketing solicitations, an opt out 
notice provided in connection with a new continuing relationship would 
have to apply to any eligibility information obtained in connection 
with the terminated relationship that is to be shared with affiliates 
for use in making future marketing solicitations.
---------------------------------------------------------------------------

    \231\ This provision was designed to address comments regarding 
consumers that terminate a continuing relationship with a Covered 
Person. See supra note 229.
    \232\ The Agencies received comment that it was inappropriate to 
tie the opt out to the consumer, rather than to the information used 
for making marketing solicitations. Upon further examination, we 
conclude that tying the opt out to the consumer could have had 
unintended consequences. For example, if the opt out were tied to 
the consumer, a Covered Person would have to track the consumer 
indefinitely, even if the consumer's relationship with the Covered 
Person terminated and a new relationship with that Covered Person 
was not established until years later. We do not believe that 
Covered Persons should be required to track consumers indefinitely 
following termination of a relationship.
---------------------------------------------------------------------------

2. Section 248.122(b) Duration and Timing of Opt Out
    Proposed Sec.  247.25 addressed the duration and effect of a 
consumer's opt out election. Section 247.25(a) provided that a 
consumer's election to opt out is effective for the opt out period, 
which is a period of at least five years beginning as soon as 
reasonably practicable after the consumer's opt out election is 
received. Nothing in the paragraph limited the ability of Covered 
Persons to set an opt out period of longer than five years, including 
an opt out period that does not expire unless revoked by the consumer. 
We also stated that if for some reason, a consumer elects to opt out 
again while the opt out period remains in effect, a new opt out period 
of at least five years would begin upon receipt of each successive opt 
out election.
    Proposed Sec.  247.25(b) provided that a receiving affiliate could 
not make or send marketing solicitations to a consumer during the opt 
out period based on eligibility information it receives from an 
affiliate, except as provided in the exceptions in proposed Sec.  
247.20(c) or if the consumer had revoked his or her opt out.\233\ The 
proposal would have tied the opt out to the consumer, not to the 
information.\234\ Proposed Sec.  247.25(c) clarified that a consumer 
could opt out at any time. Thus, even if the consumer did not opt out 
in response to the initial opt out notice or if the consumer's election 
to opt out was not prompted by an opt out notice, the consumer could 
still have opted out. Regardless of when the consumer opted out, the 
opt out would be effective for at least five years.
---------------------------------------------------------------------------

    \233\ As discussed above, proposed Sec.  247.20(c) provided 
exceptions from Regulation S-AM's notice and opt out requirements in 
several situations, including when the receiving affiliate has a 
pre-existing business relationship with the consumer or receives an 
affirmative request for marketing solicitations from the consumer or 
when the receiving affiliate provides employee benefits to the 
consumer or performs certain services on behalf of another 
affiliate. See supra Part III.D.3.
    \234\ Thus, under the proposed rules, if a consumer initially 
elected to opt out but did not extend the opt out upon expiration of 
the opt out period, the receiving affiliate could use all of the 
eligibility information it had received about the consumer from its 
affiliate, including eligibility information that it received during 
the opt out period. However, if the consumer subsequently opted out 
again some time after the initial opt out period has lapsed, the 
receiving affiliate could not use any eligibility information about 
the consumer it received from an affiliate on or after the mandatory 
compliance date, including any information it received during the 
period in which no opt out election was in effect. See Proposing 
Release at 69 FR 42311.
     Section 624(a)(5) of the FCRA contains a non-retroactivity 
provision, which provides that nothing shall prohibit the use of 
information that was received prior to the date on which persons are 
required to comply with the regulations implementing Section 624. 15 
U.S.C. 1681s-3(a)(5).
---------------------------------------------------------------------------

    Commenters generally favored the five-year opt out provisions.\235\ 
As discussed above, most commenters were concerned with the indefinite 
opt out provision when a consumer terminates a relationship with a 
person.\236\ One commenter suggested that consumers should be allowed 
to revoke their opt outs orally, stating this would be consistent with 
the FCRA's flexible approach.\237\ Another commenter stated that the 
opt out should not be broadly tied to a consumer but should be done on 
an account basis.\238\ This commenter also asked for clarification on 
the implementation date, suggesting that the ``reasonably practicable'' 
language in the provision should be clarified to mean the opt out would 
begin on the date the opt out is received.
---------------------------------------------------------------------------

    \235\ See ACLI Letter; Coalition Letter; FSR Letter; ICBA 
Letter; SIFMA Letter I.
    \236\ See supra Part III.E.1.
    \237\ See ACLI Letter.
    \238\ See Coalition Letter.
---------------------------------------------------------------------------

    We are adopting the provisions addressing the duration of the opt 
out as redesignated Sec.  248.122(b), with some modifications. The 
final rule clarifies that the opt out period expires if the consumer 
revokes his or her opt out in writing, or, if the consumer agrees, 
electronically. This is consistent with the approach taken in the GLBA 
privacy rules. We do not believe it is necessary or appropriate to 
permit oral revocations. Many of the exceptions to Regulation S-AM's 
notice and opt out provisions may be triggered by oral communications, 
as discussed above, which would permit the use of shared eligibility 
information to make marketing solicitations pending receipt of a 
written or electronic revocation. Also, as noted in the proposal, 
nothing prohibits setting an opt out period longer than five years, 
including an opt out period that does not expire unless revoked by the 
consumer.\239\
---------------------------------------------------------------------------

    \239\ See Proposing Release at 69 FR 42322.
---------------------------------------------------------------------------

    The Commission does not agree that the opt out period should begin 
on the date the consumer's election to opt out is received. We 
interpret the FACT Act requirement to mean that the consumer's opt out 
election must be honored for a period of at least five years from the 
date the election is implemented. We believe that Congress did not 
intend for the opt out period to be shortened to a period of less than 
the five years specified in the statute to reflect the time between the 
date the consumer's opt out election is received and the date the 
consumer's opt out election is implemented.
    The Commission also believes that it is neither necessary nor 
appropriate to set a mandatory deadline for implementing the consumer's 
opt out election. A general standard better reflects that the time it 
will reasonably take to implement a consumer's opt out election may 
vary depending on the facts and circumstances of the situation.
    Consistent with the special rule for a notice following termination 
of a continuing relationship, the duration of the opt out is not 
affected by the termination of a continuing relationship. When a 
consumer opts out in the course of a continuing relationship and that 
relationship is terminated during the opt out period, the opt out 
remains in effect for the remainder of the opt out period. If the 
consumer subsequently establishes a new continuing relationship while 
the

[[Page 40418]]

opt out period remains in effect, the opt out period may not be 
shortened with respect to information obtained in connection with the 
terminated relationship by sending a new opt out notice to the consumer 
when the new continuing relationship is established, even if the 
consumer does not opt out upon receipt of the new opt out notice. A 
person may track the eligibility information obtained in connection 
with the terminated relationship and provide a renewal notice to the 
consumer, or may choose not to use eligibility information obtained in 
connection with the terminated relationship to make marketing 
solicitations to the consumer.
3. Section 248.122(c)
    Proposed Sec.  247.25(c) clarified that a consumer could opt out at 
any time.\240\ As explained in the proposal, even if the consumer did 
not opt out in response to the initial opt out notice or if the 
consumer's election to opt out was not prompted by an opt out notice, a 
consumer could still opt out. Regardless of when the consumer opted 
out, the opt out would have had to be effective for a period of at 
least five years. We received no comment on this provision and are 
adopting it as proposed, redesignated as Sec.  248.122(c).
---------------------------------------------------------------------------

    \240\ See Proposing Release at 69 FR 42311.
---------------------------------------------------------------------------

F. Section 248.123 Contents of Opt Out Notice; Consolidated and 
Equivalent Notices

1. Section 248.123(a)
a. Joint Notice
    Proposed Sec.  247.21 addressed the contents of the affiliate 
marketing opt out notice, and proposed Sec.  247.24(c) permitted joint 
notices with affiliates identified in the notice with respect to which 
the notice was accurate. Proposed Sec.  247.21(a) would have required 
the opt out notice to be clear, conspicuous, and concise, and to 
accurately disclose: (1) That the consumer may elect to limit a 
person's affiliate from using eligibility information about the 
consumer that the affiliate obtains from the person to make marketing 
solicitations to the consumer; and (2) if applicable, that the 
consumer's election will apply for a specified period of time and that 
the consumer will be allowed to extend the election once that period 
expires. The notice also would have had to provide the consumer with a 
reasonable and simple method to opt out.\241\ Under the proposal, use 
of the proposed model forms in the proposed Appendix A, while not 
required, would have complied with proposed Sec.  247.21(a) in 
appropriate circumstances. We received one comment on this section that 
urged the Commission to clarify that a Covered Person would not have to 
send an additional notice if the Covered Person initially provided an 
opt out of limited duration and then determined to increase the length 
of time of the duration or make the opt out permanent.\242\
---------------------------------------------------------------------------

    \241\ Proposed Sec.  247.21(a) reflected the intent of Congress, 
as expressed in Section 624(a)(2)(B) of the FCRA, that a notice 
required by Section 624(a)(2)(B) must be ``clear, conspicuous, and 
concise,'' and the method for opting out be ``simple.''
    \242\ See T. Rowe Price Letter.
---------------------------------------------------------------------------

    We are adopting proposed Sec.  247.21(a), redesignated as Sec.  
248.123(a) with some modifications to enhance the clarity and usability 
of the model notices. We are also incorporating provisions of proposed 
Sec.  247.24(c), pertaining to joint notices.\243\ Paragraph (a)(1)(i) 
provides that all opt out notices must provide the name of the 
affiliate or affiliates providing the notice, and allows for a joint 
notice by a group of affiliates. If affiliates share a common name, 
such as ``ABC,'' then the notice may indicate that it is being provided 
by the family or group of companies with the ``ABC'' name. The notice 
may identify the companies by stating that it is being provided by 
``all of the ABC companies,'' ``the ABC banking, credit card, 
insurance, and securities companies,'' or by listing the name of each 
affiliate providing the notice. A representation that the notice is 
provided by ``the ABC banking, credit card, insurance, and securities 
companies'' applies to all companies in those categories and not just 
to some of those companies. If the affiliates providing the notice do 
not all share a common name, then the notice must either separately 
identify each affiliate by name or identify each of the common names 
used by those affiliates. For example, if the affiliates providing the 
notice do business under both the ABC name and the XYZ name, then the 
notice could list each affiliate by name or indicate that the notice is 
being provided by ``all of the ABC and XYZ companies'' or by ``the ABC 
banking and securities companies and the XYZ insurance companies.'' 
Section 248.123(a)(1)(ii) provides that an opt out notice must contain 
a list of the affiliates or types of affiliates covered by the notice. 
The notice may apply to multiple affiliates and to companies that 
become affiliates after the notice is provided to the consumer. The 
rules for identifying the affiliates covered by the notice are 
substantially similar to the rules for identifying the affiliates 
providing the notice in Sec.  248.123(a)(1)(i) described above.
---------------------------------------------------------------------------

    \243\ Proposed Sec.  247.24(c)(1) permitted a person to provide 
a joint opt out notice with one or more of its affiliates, so long 
as the notice is accurate with respect to each affiliate that issues 
the joint notice. Section 248.123(a)(1)(i) incorporates the 
substance of proposed Sec.  247.24(c)(1) and clarifies ways in which 
affiliates that share a name may be identified. Proposed Sec.  
247.24(c)(2) would have permitted affiliates to provide a joint 
notice if the affiliates shared a common name. One commenter 
suggested that the rule make clear that if in a joint notice some 
affiliates share a common name and other affiliates do not, the 
notice may identify those affiliates with a common name as a group. 
See T. Rowe Price Letter.
---------------------------------------------------------------------------

    Sections 248.123(a)(1)(iii)-(vii) require the opt out notice to 
include: (1) A general description of the types of eligibility 
information that may be used to make marketing solicitations to the 
consumer; (2) a statement that the consumer may elect to limit the use 
of eligibility information to make marketing solicitations to the 
consumer; (3) a statement that the consumer's election will apply for 
the specified period of time stated in the notice and, if applicable, 
that the consumer will be allowed to renew the election once that 
period expires; (4) if the notice is provided to consumers who may have 
previously opted out, such as if a notice is provided to consumers 
annually, a statement that the consumer who has chosen to limit 
marketing offers does not need to act again until the consumer receives 
a renewal notice; and (5) a reasonable and simple method for the 
consumer to opt out. The requirement in Sec.  248.123(a)(1)(vi) to 
include a statement regarding consumers who may have previously opted 
out would be satisfied by appropriate use of the model forms in the 
Appendix.\244\ These forms, unlike the model forms in the proposed 
Appendix, include a statement that can be used in a notice given to a 
consumer who may have previously opted out to advise the consumer that 
he or she does not need to act again until he or she receives a renewal 
notice. The Commission continues to believe that the opt out notice 
must specify the length of the opt out period, if one is provided. 
However, an institution that subsequently chooses to increase the 
duration of the opt out period that it previously disclosed or honor 
the opt out in perpetuity has no obligation to provide a revised notice 
to the consumer. In that situation, the

[[Page 40419]]

result is the same as if the institution established a five-year opt 
out period and then did not send a renewal notice at the end of that 
period. A person receiving eligibility information from an affiliate 
would be prohibited from using that information to make marketing 
solicitations to a consumer unless a renewal notice is first provided 
to the consumer and the consumer does not renew the opt out. So long as 
no marketing solicitations are made using eligibility information 
received from an affiliate, there would be no violation of the FCRA or 
Regulation S-AM for failing to send a renewal notice in this situation.
---------------------------------------------------------------------------

    \244\ The Commission, the Agencies, and the CFTC have proposed a 
model privacy form in a joint rulemaking. See Interagency Proposal 
for Model Privacy Form Under the Gramm-Leach-Bliley Act, Exchange 
Act Release No. 55497 (Mar. 20, 2007); 72 FR 14940 (Mar. 29, 2007). 
This model privacy form is intended to meet the notice content 
requirements of Regulation S-AM.
---------------------------------------------------------------------------

b. Joint Relationships
    Proposed Sec.  247.24(d)(1) set out rules that would have applied 
when two or more consumers (referred to in the proposed regulation as 
``joint consumers'') jointly obtained a product or service, such as a 
joint securities account.\245\ It also provided several examples. Under 
the proposed rules, a Covered Person could have provided a single opt 
out notice to joint accountholders that would have had to indicate 
whether the Covered Person would treat an opt out election by one joint 
accountholder as applying to all of the associated accountholders, or 
whether each accountholder would have to opt out separately. The 
Covered Person could not have required all accountholders to opt out 
before honoring an opt out direction by one of the joint 
accountholders. In addition, we provided an example in proposed 
paragraph (d)(2) to explain how the rules would operate and noted that 
while the example was patterned after similar provisions in the GLBA 
privacy rules as promulgated in Regulation S-P,\246\ they differed from 
the GLBA privacy rules in that Section 624 of the FCRA deals with the 
use of information for marketing by affiliates, rather than the sharing 
of information among affiliates.
---------------------------------------------------------------------------

    \245\ See Proposing Release at 69 FR 42321.
    \246\ See 17 CFR 248.7(d).
---------------------------------------------------------------------------

    In the proposal, we requested specific comment on proposed 
paragraph (d)(1)(vii) and the example in paragraph (d)(2)(iii) that 
addressed the situation in which only one of two joint consumers had 
opted out. Under those paragraphs, in a joint consumer situation, if A 
had opted out only for A, and B did not opt out, we indicated that a 
Covered Person's affiliate could use eligibility information about B to 
send marketing solicitations to B as long as the eligibility 
information was not based on A and B's joint consumer relationship. One 
commenter argued that this approach would be overly restrictive and 
challenging to implement because exclusion of joint account information 
could block information about both a customer who had decided to opt 
out and one that had not.\247\ According to this commenter, Covered 
Persons should be able to use information about joint accounts to make 
marketing solicitations to the consumer who had decided not to opt out.
---------------------------------------------------------------------------

    \247\ See T. Rowe Price Letter.
---------------------------------------------------------------------------

    We are adopting proposed paragraphs (d)(1) and (d)(2) of Sec.  
247.24 with modifications, redesignated as Sec.  248.123(a)(2). 
However, in light of the comment received, we are not adopting the 
example of joint relationships in proposed Sec.  247.24(d)(2) because 
it addressed, in part, the sharing of information rather than the use 
of information to make marketing solicitations, and thus would be 
beyond the scope of this rulemaking. In addition, we have also made 
some technical changes to improve readability and promote consistency 
with the GLBA privacy rules.\248\
---------------------------------------------------------------------------

    \248\ Some implementation issues may arise from providing a 
single opt out notice to joint consumers in the context of this rule 
(which focuses on the use of information) and in the context of 
other privacy rules (which focus on the sharing of information). For 
example, a consumer may opt out with respect to affiliate marketing 
in connection with an individually-held account, but not opt out 
with respect to affiliate marketing in connection with a joint 
consumer account. In that situation, it could be challenging to 
identify which consumer information may and may not be used by 
affiliates to make marketing solicitations to the consumer.
---------------------------------------------------------------------------

c. Alternative Contents
    Proposed Sec.  247.21(d) provided that if a person chose to give 
consumers a broader opt out right than required by law, the person 
could modify the contents of the opt out notice to reflect accurately 
the scope of the opt out right it had provided. Proposed Model Form A-3 
of Appendix A provided guidance for Covered Persons wishing to allow 
consumers to prevent all marketing from that person and its affiliates. 
We received no comments on this provision and are adopting it as 
proposed, redesignated as Sec.  248.122(a)(3). We are adopting proposed 
Model Form A-3, redesignated as Model Form A-5 with slight 
modifications for clarity.
d. Model Notices
    Section 248.123(a)(4) provides that model notices are in the 
Appendix. The Commission has provided model notices to facilitate 
compliance with the rule, although the final rules do not require their 
use.
2. Coordinated, Consolidated, and Equivalent Notices
    Proposed Sec.  247.27 provided that a notice required by proposed 
Regulation S-AM could be coordinated and consolidated with any other 
notice or disclosure required to be issued under any other provision of 
law.\249\ We indicated that these notices could include but were not 
limited to the affiliate sharing and opt out notices described in 
Section 603(d)(2)(A)(iii) of the FCRA \250\ and the privacy notices 
required by Title V of the GLBA. We further noted that a notice or 
other disclosure that was equivalent to the notice required by the 
proposal, and that was provided to a consumer together with disclosures 
required by any other provision of law, would satisfy the requirements 
of the proposed rule.
---------------------------------------------------------------------------

    \249\ This is consistent with Section 624(b) of the FCRA. See 
also 15 U.S.C. 1681s-3 note.
    \250\ See discussion of FCRA Section 603(d)(2)(A)(iii) supra 
note 221.
---------------------------------------------------------------------------

    We requested comment on whether persons subject to the proposed 
rules would plan to consolidate their affiliate marketing notices with 
GLBA privacy notices or affiliate sharing opt out notices, whether we 
provided sufficient guidance on consolidated notices, and whether 
consolidation would be helpful or confusing to consumers. While one 
commenter expressed general support for the provision,\251\ another 
stated that, while financial institutions may consider consolidating 
the affiliate marketing notice with the GLBA privacy notice, the 
decision to consolidate would be affected by the five-year duration of 
the affiliate marketing opt out.\252\ However, the commenter did not 
specify whether this would make a firm more or less likely to 
consolidate notices. However, because Covered Persons are only 
encouraged to consolidate affiliate marketing notices with other 
notices they are required to provide, the Commission is, with the 
exception of technical changes made for clarity, adopting the 
consolidated and equivalent notice provisions as proposed, redesignated 
as Sec. Sec.  248.123(b) and (c).
---------------------------------------------------------------------------

    \251\ See Coalition Letter.
    \252\ See FSR Letter.
---------------------------------------------------------------------------

    We encourage Covered Persons to consolidate their affiliate 
marketing opt out notice with GLBA privacy notices, including any 
affiliate sharing opt out notice under Section 603(d)(2)(A)(iii) of the 
FCRA, so that consumers receive a single notice they can use to review 
and exercise all applicable opt outs. We recognize, however, that 
special issues arise when these notices are

[[Page 40420]]

consolidated. For example, the affiliate marketing opt out may be 
limited to a period of at least five years, subject to renewal, while 
the GLBA privacy and affiliate sharing opt out notices are not time-
limited. This difference, if applicable, must be made clear to the 
consumer. Thus, if a Covered Person uses a consolidated notice and the 
affiliate marketing opt out is limited in duration, the notice must 
inform consumers that if they previously opted out, they do not need to 
opt out again until they receive a renewal notice when the opt out 
expires or is about to expire. In addition, as discussed more fully 
below, the Commission and the Agencies, in a joint rulemaking, have 
proposed a model privacy form that includes an affiliate marketing opt 
out.\253\ The proposed model privacy form is designed to satisfy the 
requirement to provide an affiliate marketing opt out notice.
---------------------------------------------------------------------------

    \253\ See supra note 244.
---------------------------------------------------------------------------

G. Section 248.124 Reasonable Opportunity To Opt Out

1. Section 248.124(a)
    Proposed Sec.  247.22(a) provided that the communicating affiliate 
would have to provide a consumer a ``reasonable opportunity to opt 
out'' after delivery of the opt out notice but before a marketing 
solicitation based on eligibility information is sent. We noted that 
because of the various circumstances in which opt out rights are 
provided, a ``reasonable opportunity to opt out'' should be generally 
construed to avoid setting a mandatory waiting period. A general 
standard would provide flexibility to allow receiving affiliates to use 
eligibility information to make marketing solicitations at an 
appropriate point in time, while assuring that the consumer is given a 
realistic opportunity to prevent such use of the information. We 
received no comments on proposed Sec.  247.22(a) and are adopting it 
substantially as proposed, redesignated as Sec.  248.124(a) with 
technical changes for clarity.
2. Section 248.124(b)
    Proposed Sec. Sec.  247.22(b)(1) through (5) provided examples of 
what might constitute a reasonable opportunity to opt out in different 
situations. Proposed Sec. Sec.  247.22(b)(1) and (2) provided examples 
of reasonable opportunities to opt out by mail or by electronic means 
consistent with the examples used in the GLBA privacy rules.\254\ Both 
examples illustrated that giving consumers 30 days in which to decide 
whether to opt out would be reasonable in most cases. Proposed Sec.  
247.22(b)(3) provided an example of a reasonable opportunity to opt out 
when the consumer was required to decide as a necessary part of 
proceeding with an electronic transaction, whether to opt out before 
completing the transaction.\255\ Proposed paragraph (b)(4) of Sec.  
247.22 provided that including the affiliate marketing opt out notice 
in a notice under the GLBA privacy rules could satisfy the reasonable 
opportunity standard.\256\ Proposed paragraph (b)(5) provided that an 
``opt-in'' would satisfy the reasonable opportunity to opt out 
requirement, as long as a consumer's affirmative consent is 
documented.\257\ We sought comment on whether additional guidance or 
examples were needed regarding the reasonable opportunity to opt out.
---------------------------------------------------------------------------

    \254\ See 17 CFR 248.7(a)(3)(i)-(ii).
    \255\ Under this proposed example, the Covered Person provided a 
simple process of opting out at the Internet Web site where the 
transaction was occurring. The opt out notice was automatically 
provided to the consumer, such as through the use of a mandatory 
link to an intermediate Web page, or ``speed bump.'' The consumer 
was given a choice of either opting out or not opting out at that 
time through a simple process conducted at the Internet Web site. In 
this situation we indicated that a consumer could be required to 
check a box on the Internet Web site in order to opt out or decline 
to opt out before continuing with the transaction. However, this 
example would not have included a situation in which the consumer 
was required to send a separate e-mail or visit a different Internet 
Web site in order to opt out.
    \256\ In this situation, the consumer would be allowed to 
exercise the opt out in the same manner and with the same amount of 
time to exercise the opt out as with respect to the GLBA privacy 
notice. This example takes into account the statutory requirement 
that we consider methods for coordinating and combining notices. See 
FACT Act Section 214(b)(3).
    \257\ In the proposal, we noted that some persons subject to 
Regulation S-AM might have a policy of not allowing affiliates to 
use eligibility information for marketing purposes unless a consumer 
affirmatively consented, or ``opted in,'' to receiving such 
marketing solicitations. However, we also noted that a pre-selected 
check box on a Web form or boilerplate language in a standard 
contract or disclosure document would not be evidence of the 
consumer's affirmative consent.
---------------------------------------------------------------------------

    A number of commenters addressed the 30-day safe harbor.\258\ Some 
commenters stated that it would provide consumers with a reasonable 
opportunity to opt out.\259\ Others were concerned that the time period 
would be viewed as a de facto minimum even though we had stated it 
would not.\260\ Most commenters however, objected to informing the 
consumer that he or she has a specific period of time by which to 
respond,\261\ citing a lack of Congressional intent,\262\ customer 
confusion,\263\ and unnecessary compliance burdens if Covered Persons 
decided to consolidate the GLBA notices with the Regulation S-AM 
notice.\264\ While we received no specific comment on the opportunity 
to opt out by mail provision, one commenter stated that requiring 
consumers to acknowledge receipt of notices sent electronically, as in 
proposed Sec.  247.22(b)(2), would violate the Electronic Signatures in 
Global and National Commerce Act (``E-Sign Act'').\265\ In addition, 
one commenter suggested broadening the scope of proposed Sec.  
247.22(b)(3) to include all transactions.\266\ This commenter also 
opined that proposed paragraphs (b)(4) and (b)(5) were inconsistent, 
appearing to equate an opt in with obtaining an opt out for the 
purposes of the proposal, and urged the Commission to omit the opt-in 
example. Another commenter did not agree that pre-selected boxes would 
be an unacceptable method for obtaining customer authorization, if used 
properly.\267\
---------------------------------------------------------------------------

    \258\ See Coalition Letter; FSR Letter; ICBA Letter.
    \259\ See FSR Letter; Wells Fargo Letter.
    \260\ See Coalition Letter; ICBA Letter.
    \261\ See ACLI Letter; Coalition Letter; FSR Letter; ICBA 
Letter.
    \262\ See Coalition Letter.
    \263\ See ACLI Letter; ICBA Letter.
    \264\ See Coalition Letter.
    \265\ See ACB Letter. The E-Sign Act is codified at 15 U.S.C. 
Chapter 96.
    \266\ See Coalition Letter.
    \267\ See USAA Letter.
---------------------------------------------------------------------------

    We are adopting Sec. Sec.  247.22(b)(1) and (b)(3) substantially as 
proposed, redesignated as Sec. Sec.  248.124(b)(1) and (3). We are 
retaining the 30-day safe harbor because it helps afford certainty to 
entities that choose to follow the 30-day waiting period. We 
understand, however, that shorter waiting periods may be adequate under 
certain facts and circumstances in accordance with the general test for 
a reasonable opportunity to opt out.
    The final rule divides proposed Sec.  247.22(b)(2) into two 
subparts, redesignated as Sec. Sec.  248.124(b)(2)(i) and (ii), to 
illustrate the different means of delivering an electronic notice. The 
example illustrates that for notices provided electronically, such as 
at an Internet Web site at which the consumer has obtained a product or 
service, a reasonable opportunity to opt out would include giving the 
consumer 30 days after the consumer acknowledges receipt of the 
electronic notice to opt out by any reasonable means. The 
acknowledgement of receipt aspect of this example is consistent with an 
example in the GLBA privacy regulations.\268\ The example also 
illustrates that for notices provided by e-mail to a consumer who had 
agreed to receive disclosures by e-mail from the

[[Page 40421]]

person sending the notice, a reasonable opportunity to opt out would 
include giving the consumer 30 days after the e-mail is sent to elect 
to opt out by any reasonable means. Consumer acknowledgement is not 
necessary when the consumer has agreed to receive disclosures by e-
mail. Moreover, the electronic delivery of affiliate marketing opt out 
notices does not require consumer consent in accordance with the E-Sign 
Act because neither Section 624 of the FCRA nor these final rules 
require that the notice be provided in writing. Persons that provide 
electronic affiliate marketing opt out notices under Regulation S-AM 
may do so pursuant to the agreement of the consumer, as specified in 
these rules, or in accordance with the requirements of the E-Sign Act.
---------------------------------------------------------------------------

    \268\ See 17 CFR 248.9(b)(1)(iii).
---------------------------------------------------------------------------

    We agree with commenters that the example regarding electronic 
transactions in redesignated Sec.  248.124(b)(3) is limited in scope, 
and have added a new example for in-person transactions in Sec.  
248.124(b)(4). Together, these examples illustrate that an abbreviated 
opt out period is appropriate when the consumer is given a ``yes'' or 
``no'' choice and is not permitted to proceed with the transaction 
unless he or she makes a choice.\269\
---------------------------------------------------------------------------

    \269\ For in-person transactions, consumers could be provided 
with a form that requires them to write ``yes'' or ``no'' to 
indicate their opt out preference, or a form that contains two blank 
check boxes: one to opt out and one not to opt out. Of course, if an 
opportunity to opt out is to be reasonable, a consumer must be 
permitted to choose freely whether to opt out or not, and must not 
be induced to forego his or her right to opt out.
---------------------------------------------------------------------------

    We received no comments on proposed Sec.  247.22(b)(4), which 
provides that an affiliate marketing opt out notice can be included in 
a GLBA privacy notice, and are adopting it substantially as proposed, 
redesignated as Sec.  248.124(b)(5). We are not adopting the example in 
proposed Sec.  247.22(b)(5) that would have illustrated the option of 
providing a consumer with an opportunity to ``opt in'' to affiliate 
marketing because the example was unnecessary and confusing.

H. Section 248.125 Reasonable and Simple Methods of Opting Out

    Proposed Sec.  247.23(a) provided guidance on how a person could 
provide consumers with reasonable and simple methods of opting out. 
These examples generally track the examples of reasonable opt out means 
from Section 7(a)(2)(ii) of the GLBA privacy rules,\270\ with certain 
modifications to give effect to Congress's mandate in the FACT Act that 
the method of opting out of affiliate marketing must also be 
``simple.'' Accordingly, the example in proposed Sec.  247.23(a)(2) 
contemplated the use of a self-addressed envelope with which the 
consumer could mail his or her reply form and opt out notice. If 
consumers were given the choice of calling a toll-free telephone number 
to opt out, the example contemplated that the system would be 
adequately designed and staffed to enable consumers to opt out with a 
single phone call.\271\
---------------------------------------------------------------------------

    \270\ See, e.g., 17 CFR 248.7(a)(2)(ii).
    \271\ See Proposed Sec.  247.23(a)(4).
---------------------------------------------------------------------------

    Proposed Sec.  247.23(b) provided examples of opt out methods that 
would not be considered reasonable and simple. These methods include 
requiring the consumer to write a letter or to call or write to obtain 
an opt out form that was not included with the notice. A consumer who 
agrees to receive the opt out notice in electronic form only, such as 
by electronic mail or at an Internet Web site, would have to be allowed 
to opt out by the same or a substantially similar electronic form and 
should not be required to opt out solely by telephone or paper mail.
    Eight commenters addressed these examples,\272\ and generally 
agreed that the examples of the use of oral opt outs were reasonable 
and simple methods.\273\ One commenter stated that consumers should 
also be able to orally revoke their opt outs.\274\ Some commenters 
requested that the Commission clarify that this section is intended 
only to provide examples and is not mandatory.\275\ Another commenter 
suggested that we delete the examples of methods that did not provide a 
reasonable and simple method of opting out, stating that these examples 
could expose Covered Persons to civil liability.\276\ Other commenters 
objected to the reference to self-addressed envelopes.\277\ One stated 
that a self-addressed envelope was unnecessary and inconsistent with 
Congress's intent because it was not required by the statute or 
necessary for GLBA notices.\278\ Another commenter asserted that 
Covered Persons would view the use of a self-addressed envelope as a 
requirement.\279\ This commenter opined that consumers would use the 
envelopes for other purposes, like sending remittances or address 
change forms, which would have ``disastrous'' consequences including 
unavoidable delays and lapsed notices.
---------------------------------------------------------------------------

    \272\ See ACLI Letter; Coalition Letter; FSR Letter; IAA Letter; 
ICBA Letter; ICI Letter; T. Rowe Price Letter; Wells Fargo Letter.
    \273\ See FSR Letter; IAA Letter; ICI Letter; T. Rowe Price 
Letter.
    \274\ See FSR Letter.
    \275\ See ICBA Letter; Coalition Letter.
    \276\ See Wells Fargo Letter.
    \277\ See ACLI Letter; FSR Letter.
    \278\ See FSR Letter.
    \279\ See ACLI Letter.
---------------------------------------------------------------------------

    Other commenters addressed electronic opt outs.\280\ One commenter 
viewed the proposed requirement for the opt out to be electronic when 
the notice is electronic as arbitrary, stating that a similar 
requirement is not imposed on opt out notices sent by mail.\281\ 
Another commenter opined that this requirement was not intended by 
Congress and requested that we adopt the GLBA rule examples.\282\ 
Finally, some commenters believed that a company that provides a 
reasonable and simple method of opting out should not be required to 
honor an opt out through a different mechanism.\283\
---------------------------------------------------------------------------

    \280\ See Coalition Letter; Wells Fargo Letter.
    \281\ See Wells Fargo Letter.
    \282\ See Coalition Letter.
    \283\ See Coalition Letter; ICBA Letter.
---------------------------------------------------------------------------

    We are adopting Sec.  247.23, redesignated as Sec.  248.125, 
revised as discussed below. Paragraph (a) provides the general rule 
that Covered Persons must not use eligibility information from an 
affiliate in order to make marketing solicitations to a consumer unless 
the consumer has been provided with a reasonable and simple method to 
opt out. Paragraph (b) provides examples illustrating opt out methods 
that are reasonable and simple, as well as examples that are not.\284\
---------------------------------------------------------------------------

    \284\ The examples of specific methods identified in the final 
rules are not an exhaustive list of permissible methods.
---------------------------------------------------------------------------

    We decline to follow commenters' suggestion that we adopt the GLBA 
examples without change. Section 624 of the FCRA requires the 
Commission to ensure that the consumer is given reasonable and simple 
methods of opting out. The GLBA did not require simple methods of 
opting out, although the Commission sought to provide examples of 
simple methods in the GLBA privacy rules. Most of the examples we are 
adopting are substantially similar to those in proposed Sec.  247.23, 
but have been revised for clarity. We are retaining the examples in 
proposed Sec. Sec.  247.23(a)(1) and (3), redesignated as Sec.  
248.125(b)(1)(i) and (iii), respectively. The example in Sec.  
248.125(b)(1)(ii) has been revised to reflect our understanding that 
the reply form and self-addressed envelope would be included together 
with the opt out notice and to clarify that the example is not 
mandatory. We do not find commenters' other views on this example to be 
persuasive. As in the proposal, the example in Sec.  248.125(b)(1)(iv) 
contemplates that a

[[Page 40422]]

toll-free telephone number that consumers may call to opt out would be 
adequately designed and staffed to enable consumers to opt out in a 
single phone call. In setting up a toll-free telephone number that 
consumers may use to exercise their opt out rights, institutions should 
minimize extraneous marketing or other messages directed to consumers 
who are in the process of opting out.
    One new example in Sec.  248.125(b)(1)(v) illustrates that 
reasonable and simple methods include allowing consumers to exercise 
all of their opt out rights described in a consolidated opt out notice 
that includes GLBA privacy, FCRA affiliate sharing, and FCRA affiliate 
marketing opt outs, by a single method, such as calling a single toll-
free telephone number. This example furthers the Commission's statutory 
directive to ensure that notices and disclosures may be coordinated and 
consolidated.\285\
---------------------------------------------------------------------------

    \285\ See 15 U.S.C. 1681s(b).
---------------------------------------------------------------------------

    We have retained the examples of opt out methods that are not 
reasonable and simple in proposed Sec. Sec.  247.23(b)(1) through 
(b)(3), redesignated as Sec. Sec.  248.125(b)(2)(i) through (b)(2)(iii) 
respectively. The example redesignated as Sec.  248.125(b)(2)(iii) has 
been slightly modified to illustrate that it is not reasonable or 
simple to require a consumer who receives the opt out notice in 
electronic form, such as through posting at an Internet Web site, to 
opt out solely by paper mail or solely by visiting a different Web site 
without providing a link to that site. We did not find the commenters' 
views on these examples to be persuasive.
    In order to be consistent with the Joint Rules and the FTC 
rule,\286\ the Commission has added new Sec.  248.125(c), which 
clarifies that a consumer may be required to opt out through a specific 
means, as long as that means is reasonable and simple for the consumer. 
This section corresponds to a provision in Regulation S-P.\287\
---------------------------------------------------------------------------

    \286\ See Joint Rules at 72 FR 62935; FTC Rule at 72 FR 61448.
    \287\ See 17 CFR 248.7(a)(2)(iv).
---------------------------------------------------------------------------

I. Section 248.126 Delivery of Opt Out Notices

    Paragraph (a) of proposed Sec.  247.24 provided that a person 
covered by the proposed rule would have needed to deliver its opt out 
notice so that each consumer reasonably could be expected to receive 
actual notice. An electronically delivered opt out notice could have 
been delivered either in accordance with the electronic disclosure 
provisions in proposed Regulation S-AM or in accordance with the E-Sign 
Act.\288\ The proposed rule included an example where a Covered Person 
could e-mail its affiliate marketing notice to consumers who had 
previously agreed to the electronic delivery of information and could 
provide the notice on its Internet Web site for consumers who obtain 
products or services electronically through that Web site. One 
commenter expressed concern over the proposed requirement that the 
consumer acknowledge receipt of the notice as a necessary step to 
obtaining a particular product or service.\289\ The commenter viewed 
this as inconsistent with the E-Sign Act.
---------------------------------------------------------------------------

    \288\ See 15 U.S.C. 7001, et seq.
    \289\ See ACB Letter.
---------------------------------------------------------------------------

    Proposed Sec.  247.24(b) provided examples of fulfilling the 
expectation of actual notice. We indicated that the ``reasonable 
expectation of delivery'' standard is a lesser standard than actual 
notice. For instance, if a communicating affiliate mailed a printed 
copy of its notice to the last known mailing address of a consumer, it 
would have met its obligation even if the consumer has changed 
addresses and never received the notice. One commenter expressed 
support for this standard.\290\
---------------------------------------------------------------------------

    \290\ See Coalition Letter.
---------------------------------------------------------------------------

    We are adopting Sec.  247.24, redesignated as Sec.  248.126, with 
modifications. We retained the reasonable expectation of actual notice 
standard, and the examples of a reasonable expectation of actual notice 
for an electronic notice have been revised and divided into two sets of 
examples of what does and does not meet the requirement.\291\ The 
examples in paragraphs (b)(3)-(4) of Sec.  248.126 illustrate that a 
consumer may reasonably be expected to receive actual notice if the 
affiliate providing the notice provides a notice by e-mail to a 
consumer who has agreed to receive electronic disclosures by e-mail 
from the affiliate providing the notice, or posts the notice on the 
Internet Web site at which the consumer obtained a product or service 
electronically and requires the consumer to acknowledge receipt of the 
notice. Conversely, the examples in paragraphs (c)(2)-(c)(3) of Sec.  
248.126 illustrate that a consumer may not reasonably be expected to 
receive actual notice if the affiliate providing the notice sends the 
notice by e-mail to a consumer who has not agreed to receive electronic 
disclosures by e-mail from the affiliate providing the notice, or posts 
the notice on an Internet Web site without requiring the consumer to 
acknowledge receipt of the notice.
---------------------------------------------------------------------------

    \291\ This is consistent with the approach taken in paragraph 
(b) of Sec.  248.124.
---------------------------------------------------------------------------

    As discussed above, the Commission has determined that the 
electronic delivery of opt out notices does not require consumer 
consent in accordance with the E-Sign Act because nothing in Section 
624 of the FCRA requires the notice to be provided in writing. Thus, we 
believe that requiring an acknowledgement of receipt is not 
inconsistent with the E-Sign Act. Moreover, this example is consistent 
with an example in the GLBA privacy rules and is appropriate, 
particularly where the notice is posted on an Internet Web site.
    Unlike the Agencies, the Commission did not receive requests to 
require the mandatory delivery of electronic notices by e-mail. Like 
the Agencies, however, we decline to do so. The Commission agrees with 
the Agencies that concerns about unsolicited e-mail and the security of 
e-mail make it inappropriate to require e-mail as the only permissible 
form of electronic delivery for opt out notices.

J. Section 248.127 Renewal of Opt Out Elections

    Proposed Sec.  247.26 described procedures for extending an opt 
out. Proposed paragraph (a) of Sec.  247.26 required consumers to be 
provided with a new notice and a reasonable opportunity to extend their 
opt out before a receiving affiliate could make marketing solicitations 
based on the consumer's eligibility information upon expiration of the 
opt out period. The affiliate that initially provided the notice, or 
its successor, would provide the extension notice. If an extension 
notice were not provided to the consumer, the opt out period would 
continue indefinitely. The requirement to provide an extension notice 
upon expiration of the opt out period would apply to any opt out--even 
if, for example, the consumer failed to opt out initially and informed 
the communicating affiliate of his or her opt out at some later time. 
The consumer could extend the opt out at the expiration of each 
successive opt out period. Proposed paragraph (b) of Sec.  247.26 
provided that each opt out extension would be effective for a period of 
at least five years, in compliance with proposed Sec.  247.25.
    Proposed Sec.  247.26(c) addressed the contents of an extension 
notice.\292\ Like the initial notice, an extension notice

[[Page 40423]]

would have to be clear, conspicuous, and concise. Proposed paragraph 
(c) provided some flexibility in the design and contents of the notice. 
Under one approach, the notice could have accurately disclosed the same 
items required to be disclosed in the initial opt out notice under 
proposed Sec.  247.21(a), along with a statement explaining that the 
consumer's prior opt out had expired or was about to expire, as 
applicable, and that the consumer would have to opt out again if he or 
she wished to keep the opt out election in force. Under another 
approach, the extension notice could have provided: (1) That the 
consumer previously elected to limit affiliates from using eligibility 
information about the consumer to make marketing solicitations to the 
consumer; (2) that the consumer's election had expired or was about to 
expire, as applicable; (3) that the consumer could have elected to 
extend his or her previous election; and (4) a reasonable and simple 
method for the consumer to extend the opt out. We requested comment 
regarding whether persons subject to proposed Regulation S-AM would 
plan to limit the duration of the opt out, and on the relative burdens 
and benefits of providing limited or unlimited opt out periods.
---------------------------------------------------------------------------

    \292\ Covered Persons are not required to provide extension 
notices if they treat the consumer's opt out election as valid in 
perpetuity unless revoked by the consumer.
---------------------------------------------------------------------------

    Proposed Sec.  247.26(d) addressed the timing of the extension 
notice and provided that an extension notice could be delivered to the 
consumer either a reasonable period of time before an opt out period 
expired, or any time after the opt out period expired, but before 
covered marketing solicitations were made to the consumer. Requiring 
the extension notice a reasonable period of time before the opt out 
period expired was intended to facilitate the smooth transition of 
consumers who choose to change their elections. An extension notice 
given too far in advance of the expiration of the opt out period might 
confuse consumers. We did not propose to set a fixed time for what 
would constitute a ``reasonable period of time,'' noting that a 
reasonable period of time could depend upon the amount of time given to 
the consumer for a reasonable opportunity to opt out, the amount of 
time necessary to process opt outs, and other factors. Nevertheless, we 
stated that providing an extension notice in combination with the last 
annual privacy notice required by the GLBA that was provided to the 
consumer before expiration of the affiliate marketing opt out period 
would have been reasonable in all cases. Proposed Sec.  247.26(e) made 
clear that sending an extension notice to a consumer before the 
expiration of the opt out period would not shorten the five-year opt 
out period.
    We also noted that opt out elections under the GLBA do not expire, 
and that GLBA notices typically state that a consumer need not opt out 
again if the consumer previously opted out. We recognized that 
including an affiliate marketing opt out notice or an extension notice 
in combination with an initial or annual notice under the GLBA required 
complying with both FCRA and GLBA requirements as applicable. Under the 
proposal, if a person chose to make the affiliate marketing opt out 
effective in perpetuity, the statement in the GLBA notice would have 
remained correct. However, the GLBA notice would not have been accurate 
with respect to the extension notice if the affiliate marketing opt out 
were limited to a defined period of five or more years. In that case, 
the extension notice regarding affiliate marketing would have had to 
make clear to the consumer the necessity of opting out again in order 
to extend the opt out. We requested comment on this interaction between 
the FACT Act and GLBA notices, including whether the Commission should 
provide further guidance regarding how a communicating affiliate might 
ensure that the difference in opt out rights is clear to consumers.
    Commenters expressed concern that the extension notice would differ 
from the initial notice because the extension notice would be required 
to inform the consumer that the consumer's prior opt out had expired or 
was about to expire, as applicable, and that the consumer would have to 
opt out again to keep the opt out election in force.\293\ In their 
view, this additional disclosure would have been costly and have 
provided little benefit to consumers. One commenter maintained that the 
additional disclosure would make it difficult, if not impossible, to 
combine the extension notice with the GLBA privacy notice.\294\
---------------------------------------------------------------------------

    \293\ See Coalition Letter; ICBA Letter.
    \294\ See ICBA Letter.
---------------------------------------------------------------------------

    The Commission is adopting proposed Sec.  247.26, redesignated as 
Sec.  248.127, with modifications as discussed below. The final rules 
also replace the references to ``extension'' with references to a 
``renewal'' notice.
    Section 248.127(a) provides that after an opt out period expires, a 
person may not make marketing solicitations to a consumer who 
previously opted out unless the consumer has been given a compliant 
renewal notice and a reasonable opportunity to opt out, and the 
consumer does not renew the opt out. This section also clarifies that a 
person can make marketing solicitations to a consumer after expiration 
of the opt out period if one of the exceptions in Sec.  248.121(c) 
applies.
    Section 248.127(a)(2) addresses the opt out renewal period. We 
continue to believe it is not necessary to set a fixed minimum period 
of time for a reasonable opportunity to renew the opt out, and that 
doing so would be inconsistent with the approach taken in other 
sections of Regulation S-AM and in the GLBA privacy rules. We received 
no comment regarding the minimum five-year period duration of the 
renewed opt out and are adopting this provision as proposed. Section 
248.127(a)(3) states that a renewal notice must be provided either by 
the affiliate (or its successor) who provided the previous opt out 
notice, or as part of a joint renewal notice from two or more members 
of an affiliated group of companies, or their successors, that jointly 
provided the previous opt out notice. This provision balances the goal 
of ensuring that the notice is provided by an entity known to the 
consumer with the need to provide a degree of flexibility to recognize 
changes in corporate structure that may occur over time.
    In the proposal, we recognized that the content of the extension or 
renewal notice would differ from the content of the initial notice. We 
note that while the statute does not require that affiliate marketing 
initial and opt out renewal notices be identical, it does require that 
the Commission provide guidance to ensure that opt out notices are 
clear, conspicuous, and concise. We find it unreasonable to expect a 
consumer, after receiving a renewal notice, to remember that he or she 
previously opted out five years ago (or longer). We also find it 
unreasonable to expect a consumer who remembers opting out to know that 
he or she must opt out again in order to renew that decision. To ensure 
that a consumer receives a meaningful renewal notice, the consumer must 
be: (1) Reminded that he or she previously opted out; (2) informed that 
the previous opt out has expired or is about to expire; and (3) advised 
that to continue to limit solicitations from affiliates, he or she must 
renew the previous opt out. The renewal notice can state that ``the 
consumer's election has expired or is about to expire.'' The final rule 
omits the words ``as applicable'' to clarify that the notice does not 
have to be tailored to differentiate consumers for whom the election 
``has expired'' from those for whom the election ``is about to 
expire.''
    The Commission does not agree with the commenters who indicated 
that the renewal notice's additional content

[[Page 40424]]

frustrates the combination of FCRA affiliate marketing opt out notices 
with GLBA privacy notices. Even if the language of the renewal notice 
were identical to the initial notice, it still could be difficult to 
avoid honoring a consumer's opt out in perpetuity if the opt out notice 
is incorporated into the GLBA privacy notice. GLBA privacy notices 
often state that if a consumer has previously opted out, it is not 
necessary for the consumer to opt out again. This statement is accurate 
for affiliate marketing if the consumer's opt out will be honored in 
perpetuity, but is inaccurate if an affiliate marketing opt out, 
included as part of the notice, will be effective only for a limited 
period of time, subject to renewal by the consumer in five-year 
intervals. Thus, if an affiliate marketing opt out notice were 
consolidated with a GLBA privacy notice and affiliate marketing opt 
outs were effective only for a limited period of time, the notice would 
have to be modified to make clear that statements about the consumer 
not needing to opt out again do not apply to the affiliate marketing 
renewal notice. Therefore, the Commission does not believe that 
requiring a renewal notice to contain information not included in an 
initial notice will significantly affect the ability to incorporate 
affiliate marketing opt out notices into GLBA privacy notices because 
consolidation of the notices is most likely to occur when the affiliate 
marketing opt out will be honored in perpetuity. Entities that prefer 
not to provide renewal notices may do so by honoring the consumer's opt 
out in perpetuity. We therefore are adopting Sec.  247.26(b) 
substantially as proposed, but redesignated as Sec.  248.127(b) with 
revisions that reflect the changes to Sec.  248.123, as discussed 
above.\295\
---------------------------------------------------------------------------

    \295\ These changes relate to identification of the affiliates 
or group of affiliates providing the opt out, descriptions of the 
types of eligibility information that may be used and the ability of 
the consumer to limit the use of that information, as well as other 
requirements that make the opt out notice reasonable and simple.
---------------------------------------------------------------------------

    Proposed Sec.  247.26(d) addressed the timing of the extension or 
renewal notice. We received no comment on this section and are adopting 
it substantially as proposed, redesignated as Sec.  248.127(d).\296\ 
Proposed Sec.  247.26(e) addressed the effect of an extension or 
renewal notice on the existing opt out period. We received no comment 
on this section and are adopting it substantially as proposed, 
redesignated as Sec.  248.127(d), with some modifications.\297\
---------------------------------------------------------------------------

    \296\ We have changed the reference from ``extension'' to 
``renewal'' of a notice and deleted ``before any affiliate makes or 
sends'' as unnecessary. Proposed Sec.  247.26(d)(2) is now referred 
to as ``Combination with annual privacy notice'' in Sec.  
248.127(c)(2) and clarified for ease of reference.
    \297\ The phrase ``to a period of less than 5 years'' has been 
omitted as unnecessary.
---------------------------------------------------------------------------

K. Section 248.128 Effective Date, Compliance Date, and Prospective 
Application

1. Section 248.128(a) and (b)
    In the Proposing Release, we recognized that some institutions may 
want to combine their affiliate marketing opt out notice with their 
next annual GLBA privacy notice. Twelve commenters addressed the 
effective and mandatory compliance dates.\298\ These commenters 
believed that the mandatory compliance date should be delayed until 
some time after the effective date of the final rules. The commenters 
suggested various periods for delaying the mandatory compliance date 
from six, 12,\299\ 15,\300\ and 18 months.\301\ In addition, they 
argued that a delayed mandatory compliance date was necessary in order 
to make significant changes to business practices and procedures, to 
implement necessary operational and systems changes, and to design and 
provide affiliate marketing opt out notices. Commenters also noted that 
many institutions would like to send the affiliate marketing notices 
with their initial or annual GLBA privacy notices, both to minimize 
costs and to avoid consumer confusion. These commenters noted that many 
large institutions provide GLBA privacy notices on a rolling basis, and 
indicated that a delayed mandatory compliance date was necessary to 
enable institutions to introduce affiliate marketing opt out notices 
into this cycle. A few industry commenters believed that Congress knew 
that an effective date is not necessarily the same as a mandatory 
compliance date because banking regulations commonly have effective 
dates and mandatory compliance dates that differ.
---------------------------------------------------------------------------

    \298\ See ACB Letter; ACLI Letter; AIA Letter; Coalition Letter; 
FSR Letter; IAA Letter; ICBA Letter; ICI Letter; Metlife Letter; 
SIFMA Letter I; T. Rowe Price Letter; USAA Letter.
    \299\ See ACB Letter; AIA Letter; Coalition Letter; ICBA Letter; 
Metlife Letter.
    \300\ See IAA Letter; T. Rowe Price Letter.
    \301\ See ACLI Letter.
---------------------------------------------------------------------------

    Regulation S-AM becomes effective approximately 30 days after 
publication in the Federal Register.\302\ Compliance with Regulation S-
AM is required not later than January 1, 2010.\303\ The mandatory 
compliance date is delayed to give Covered Persons a reasonable amount 
of time to include the affiliate marketing opt out notice with their 
initial and annual privacy notices.\304\ This is consistent with the 
FCRA's directive that notices may be consolidated and coordinated. The 
Commission believes that delaying the mandatory compliance date until 
January 1, 2010 will give Covered Persons adequate time to develop and 
distribute opt out notices, as well as provide Covered Persons 
sufficient time to develop and distribute consolidated notices.
---------------------------------------------------------------------------

    \302\ See Sec.  248.128(a).
    \303\ See Sec.  248.128(b).
    \304\ In the proposal, we indicated that the final rules would 
become effective six months after the date on which they were issued 
in final form. This was consistent with the requirements of Section 
624 of the FCRA. See Proposing Release at 69 FR 42302.
---------------------------------------------------------------------------

2. Section 248.128(c)
    Proposed Sec.  247.20(e) provided that Regulation S-AM would not 
apply to eligibility information received by a receiving affiliate 
prior to the required compliance date. Some commenters argued that the 
proposed rule did not track the statutory language or reflect the 
intent of Congress.\305\ These commenters asserted the final rules 
should grandfather all information received by any financial 
institution or affiliate in a holding company before the mandatory 
compliance date, rather than grandfather only that information received 
before the mandatory compliance date by a person that intends to use 
the information to make solicitations to the consumer. In the 
alternative, one commenter requested that, if we adopted the rule as 
proposed, we clarify that any information placed into a common database 
by an affiliate be considered to have been provided to an affiliated 
person.\306\ The commenter argued that without such a clarification, 
affiliated companies would have to undertake costly deconstruction of 
existing databases to ensure compliance.
---------------------------------------------------------------------------

    \305\ See ACLI Letter; Coalition Letter; Wells Fargo Letter.
    \306\ See Coalition Letter.
---------------------------------------------------------------------------

    We are adopting Sec.  247.20(e) substantially as proposed, 
redesignated as Sec.  248.128(c), with modifications discussed below. 
To address concerns expressed by commenters, the final rules clarify 
that a Covered Person receives eligibility information from an 
affiliate when the affiliate places that information in a common 
database that is accessible by a Covered Person, even if the Covered 
Person has not accessed or used that information as of the compliance 
date. The final rules do not apply to eligibility information placed in 
a common database before the mandatory compliance date by an affiliate 
who has a pre-existing business relationship with a consumer. The rules

[[Page 40425]]

do apply if eligibility information is obtained by an affiliate before 
the mandatory compliance date and is not, before the mandatory 
compliance date: (1) placed into a common database that is accessible 
to other affiliates; or (2) provided to another affiliate. The final 
rules also apply to new or updated eligibility information placed in a 
common database after the mandatory compliance date.

IV. Appendix to Subpart B--Model Forms

    Proposed Appendix A provided model forms as examples to illustrate 
how Covered Persons could comply with the notice and opt out 
requirements of Section 624 of the FCRA and proposed Regulation S-
AM.\307\ Proposed Appendix A included three proposed model forms. Model 
Form A-1 was an initial opt out notice. Model Form A-2 was an extension 
notice that could be used when a consumer's prior opt out has expired 
or was about to expire. Model Form A-3 was for persons subject to 
proposed Regulation S-AM to use if they offered consumers a broader 
right to opt out of marketing than required by law.
---------------------------------------------------------------------------

    \307\ See Proposing Release at 69 FR 42322.
---------------------------------------------------------------------------

    We stated that use of the proposed model forms would not be 
mandatory.\308\ We also noted that persons subject to proposed 
Regulation S-AM could use the model forms, modify them to suit 
particular circumstances, or use some other form, so long as the 
requirements of the proposed rules were met. We noted that although 
Model Forms A-1 and A-2 used five years as the duration of the opt out 
period, communicating affiliates could have chosen an opt out period 
longer than five years and substituted the longer time period in the 
opt out notices. The proposal also provided an illustration in which 
the communicating affiliates chose to treat the consumer's opt out as 
effective in perpetuity and thereby omitted from the initial notice any 
reference to the limited duration of the opt out period or the right to 
extend the opt out.
---------------------------------------------------------------------------

    \308\ See Proposing Release at 69 FR 42312.
---------------------------------------------------------------------------

    Each of the proposed model forms was designed as a stand-alone 
form. We anticipated that some Covered Persons might want to combine 
the affiliate marketing opt out notice with a GLBA privacy notice. We 
noted that if the notices were combined, we expected that Covered 
Persons would integrate the affiliate marketing opt out notice with 
other required disclosures and avoid repetition of information such as 
the methods for opting out. Finally, we noted that the development of a 
model form that would combine the various opt out notices was beyond 
the scope of the proposed rulemaking. We received one comment on the 
model forms that generally supported the development of templates.\309\ 
This commenter also suggested there should be a safe harbor for 
companies that use the model forms.
---------------------------------------------------------------------------

    \309\ See ICBA Letter.
---------------------------------------------------------------------------

    We are adopting the model forms in Appendix A of the proposal 
substantially as proposed, redesignated as Appendix to Subpart B--Model 
Forms, with additions and revisions to reflect changes incorporated in 
the final rules, discussed above. The model forms are designed to be 
helpful for entities that give notices and beneficial for consumers. As 
under the proposal, the model forms are provided as stand-alone 
documents. Persons may also choose to combine their affiliate marketing 
notices with other consumer disclosures, such as GLBA privacy 
notices.\310\ Creating a consolidated model form is beyond the scope of 
this rulemaking. However, as discussed above, institutions can combine 
affiliate marketing opt out notices with other disclosures, including 
GLBA privacy and opt out notices. If a combined model notice is 
adopted, we would expect the use of that model to satisfy the 
requirement to provide an initial affiliate marketing opt out 
notice.\311\ As adopted, the Appendix includes five model forms. Model 
Form A-1 is for an initial notice provided by a single affiliate. Model 
Form A-2 is for an initial notice provided as a joint notice from two 
or more affiliates. Model Form A-3 is for a renewal notice provided by 
a single affiliate. Model Form A-4 is for a renewal notice provided as 
a joint notice from two or more affiliates. Model Form A-5 is for a 
voluntary ``no marketing'' opt out.
---------------------------------------------------------------------------

    \310\ On March 31, 2006, the Commission and the Agencies 
released a report entitled Evolution of a Prototype Financial 
Privacy Notice prepared by Kleimann Communication Group, Inc., 
summarizing research that led to the development of a prototype 
short-form GLBA privacy notice. This report is available at http://www.ftc.gov/privacy/privacyinitiatives/FTCFinalReportExecutiveSummary.pdf. That prototype included an 
affiliate marketing opt out notice. The prototype assumed that the 
notice would be provided by the affiliate that is sharing 
eligibility information. The Commission believes that providing 
model forms in this rule for stand-alone opt out notices that may be 
used in a more diverse set of circumstances than a model privacy 
form is appropriate and consistent with efforts to develop a model 
privacy form. On March 29, 2007, the Commission, the Agencies, and 
the CFTC published for public comment in the Federal Register a 
model privacy form based on the prototype that includes the 
affiliate marketing opt out notice. See supra note 244.
    \311\ See supra Part III.F.
---------------------------------------------------------------------------

    While use of the model forms is not mandatory, appropriate use of 
the model forms satisfies the requirement in Section 624 of the FCRA 
that Covered Persons provide notices that are ``clear, conspicuous, and 
concise.'' \312\ As adopted, the model forms state that a consumer's 
opt out election applies either for a fixed number of years or for ``at 
least 5 years.'' This revision permits Covered Persons that use a 
longer opt out period or that subsequently extend their opt out period 
to rely on the model language. The model forms also contain a reference 
to the consumer's right to revoke an opt out, and the model forms 
clarify that, with an opt out of limited duration, the consumer does 
not have to opt out again until a renewal notice is sent.
---------------------------------------------------------------------------

    \312\ Persons may use or not use the model forms, or modify the 
forms, so long as the requirements of the regulation are met. For 
example, although some of the model forms use five years as the 
duration of the opt out period, an opt out period of longer than 
five years may be used and the longer time substituted in the opt 
out notices. However, Covered Persons that modify the forms or use 
different forms for their notice requirements should take care to 
ensure that their notices are clear, conspicuous, and concise.
---------------------------------------------------------------------------

V. Cost-Benefit Analysis

    The Commission is sensitive to the costs and benefits of its rules 
and understands that the rules may impose costs on Covered Persons. 
Regulation S-AM's requirement to provide consumers with notice and an 
opportunity to opt out of receiving affiliate marketing solicitations 
is designed to benefit consumers by enabling them to limit certain 
marketing solicitations from affiliated companies. In addition, the 
notice requirement should enhance the transparency of each Covered 
Person's affiliate marketing and information sharing practices.
    In the proposal, we noted that the proposed rules would impose 
costs upon Covered Persons \313\ that wish to engage in affiliate 
marketing based on the communication of eligibility information. Absent 
an exception, a Covered Person is prohibited from using eligibility 
information received from an affiliate to make marketing solicitations 
to consumers, unless: (1) The potential marketing use of the 
information has been clearly, conspicuously and concisely disclosed to 
the consumer; (2) the consumer has been provided a reasonable 
opportunity and a simple method to opt out of receiving the

[[Page 40426]]

marketing solicitation; and (3) the consumer has not opted out.
---------------------------------------------------------------------------

    \313\ ``Covered Persons'' include brokers, dealers (except 
notice-registered broker-dealers), and investment companies, as well 
as investment advisers and transfer agents that are registered with 
the Commission.
---------------------------------------------------------------------------

    In proposing the rules, we estimated that approximately 6,768 
broker-dealers, 5,182 investment companies, 7,977 registered investment 
advisers, and 443 registered transfer agents would be required to 
comply with Regulation S-AM.\314\ We also indicated that a Covered 
Person's obligation to provide notice and opportunity to opt out would 
depend on the information sharing policies of that person and the 
marketing policies of its affiliates.\315\ After considering a number 
of factors,\316\ we estimated in the Proposing Release that 
approximately 10% of Covered Persons, or 2,037 respondents, would be 
required to provide consumers with notice and an opt out opportunity 
under Regulation S-AM.\317\ We further estimated that 14,259 Covered 
Persons each would require 1 hour on average to review its information 
sharing and affiliate marketing policies and practices to determine 
whether notice and an opt out opportunity would be necessary. After 
assuming a cost of $125 per hour for managerial staff time, we 
estimated that the total one-time cost of review would be approximately 
$1,782,375 (14,259 x $125). We estimated that, upon completion of the 
review, 2,037 Covered Persons actually would be required to provide a 
notice and an opt out opportunity, and that those persons would need an 
average of 6 hours to develop an initial notice and opt out form and 2 
hours to design notices for new customers to receive on an ongoing 
basis (a total of 8 hours per affected Covered Person, or 16,296 
hours). We assumed this time would be divided between senior staff, 
computer professionals, and secretarial staff, with review by legal 
professionals. Assuming an average per-hour staff cost of $95, we 
estimated the total cost to be $1,548,120 (16,296 x $95) in the first 
year. We also estimated that each of the 2,037 affected Covered Persons 
would spend approximately 2 hours per year (or 4,074 hours) delivering 
notices to new consumers and recording any opt outs that are received 
on an ongoing basis. Finally, we noted that these tasks would not 
require managerial or professional involvement; thus, we estimated an 
average staff cost of $40 per hour, for a total annual cost of $162,960 
(4,074 x $40).\318\
---------------------------------------------------------------------------

    \314\ See Proposing Release at 69 FR 42313.
    \315\ For purposes of the Paperwork Reduction Act analysis in 
the Proposing Release, we estimated that approximately 70% of 
Covered Persons have affiliates. Updated statistics reported in 
registration forms filed by investment advisers show that 
approximately 56% of registered investment advisers have a corporate 
affiliate, and we estimated that other Covered Persons would report 
a rate of affiliation similar to that reported by registered 
investment advisers. Id.
    \316\ In the Proposing Release we indicated that: (1) A Covered 
Person that does not have affiliates or that does not communicate 
eligibility information to its affiliates would not be required to 
comply with the proposed notice and opt out requirements; (2) even 
if a communicating affiliate shared eligibility information, notice 
and opt out would not be required if the receiving affiliate did not 
use the information as a basis for marketing solicitations; (3) 
because the proposed rules allowed for a single, joint notice on 
behalf of a common corporate family, Covered Persons would not be 
required to independently provide affiliate marketing notices and 
opt out opportunities if they were included in an affiliate's 
notice; and (4) the proposed rules incorporated a number of 
statutory exceptions that would further reduce the number of persons 
required to provide affiliate marketing notices. In addition, in the 
Proposing Release we noted that if an institution were required to 
provide consumers notice and an opportunity to opt out, the notice 
could be combined with GLBA privacy notices or with any other 
document, including other disclosure documents or account 
statements. We expressed our expectation that most institutions that 
would be required to provide an affiliate marketing notice would 
combine that notice with some other form of communication. Id.
    \317\ Id. at 42313-14.
    \318\ Id. at 42314.
---------------------------------------------------------------------------

    We received one comment on the cost-benefit analysis, which stated 
that the estimates understated the compliance burden associated with 
Regulation S-AM.\319\ The commenter indicated that the Banking Agencies 
estimated that it would take approximately 18 hours to prepare and 
distribute the initial notice to customers. It also indicated that 
reprogramming costs could run into the millions of dollars for the 
securities industry. The commenter stated that, based on the experience 
of the securities industry in complying with the GLBA, each firm would 
have to spend several hundred hours to review its information sharing 
and affiliate marketing policies, to provide initial notice and opt 
out, to design notices to be sent to new customers on an ongoing basis, 
to deliver the notices to customers and to record any opt outs that are 
received. The commenter did not provide us with specific data regarding 
its estimates.
---------------------------------------------------------------------------

    \319\ See SIFMA Letter I.
---------------------------------------------------------------------------

    The Commission recognizes that costs for developing and maintaining 
records of delivery of affiliate marketing notices and recording opt 
out elections, and costs for personal training, will vary greatly, 
depending on the size of a financial institution, its customer base, 
number of affiliates, and the extent to which the institution intends 
to share information. Accordingly, we have revised our estimates to 
make them consistent with the compliance estimates provided by the 
Banking Agencies in their Joint Rules,\320\ to update the number of 
entities subject to Regulation S-AM and make the dollar costs 
economically current. For the purposes of the final rules, we estimate 
that approximately 5,561 broker-dealers, 4,586 investment companies, 
11,300 registered investment advisers, and 413 registered transfer 
agents will be required to comply with Regulation S-AM.\321\ After 
considering a number of factors, we estimate that approximately 10% of 
Covered Persons, or 2,186 respondents, will be required to provide 
consumers with notice and an opt out opportunity under Regulation S-AM. 
Moreover, we estimate that 12,242 \322\ Covered Persons each will 
require 1 hour on average to review its information sharing and 
affiliate marketing policies and practices to determine whether notice 
and an opt out opportunity is necessary. Assuming a cost of $180 per 
hour for managerial staff time,\323\ the staff estimates that the total 
one-time cost of review will be approximately $2,203,560 (12,242 x 
$180). Once the review is complete, we estimate that 2,186 Covered 
Persons will be required to provide an affiliate marketing notice and 
an opt out opportunity, and that those persons will need an average of 
18 hours to prepare an initial notice and distribute it to consumers (a 
total of 39,348 hours). We assume that this time will be divided 
between senior staff, computer professionals, and secretarial staff, 
with review by legal professionals. We estimate an average per-hour 
staff cost

[[Page 40427]]

of $256,\324\ with an estimated total cost of $10,073,088 (39,348 x 
$256) in the first year. We also estimate that each of the 2,186 
Covered Persons will spend approximately 4 hours per year (or 8,744 
hours) for creating and delivering notices to new consumers and 
recording any opt outs that are received on an ongoing basis. Finally, 
as in the Proposing Release, we note that these tasks should not 
require managerial or professional involvement. Thus, we estimate an 
average staff cost of $56 per hour,\325\ for a total annual cost of 
$489,664 (8,744 hours x $56).\326\
---------------------------------------------------------------------------

    \320\ The Banking Agencies estimated that 18 hours was 
reasonable but expected that figure to vary among Covered Persons. 
See 69 FR 42513. In the Proposing Release, the Commission estimated 
that the ``hour burden for developing, sending and tracking the opt 
out notices would range from 2-20 hours, with an average of 6 
hours.'' See Proposing Release at 69 FR 42315.
    \321\ A Covered Person's obligation to provide notices and opt 
out opportunities will depend on the information sharing policies of 
that person and the marketing policies of its affiliates. For 
purposes of the Paperwork Reduction Act, we now estimate that 
approximately 56% of Covered Persons have affiliates. Statistics 
reported in registration forms filed by investment advisers show 
that approximately 56% of registered investment advisers have a 
corporate affiliate, and we estimate that other Covered Persons 
would report a rate of affiliation similar to that reported by 
registered investment advisers.
    \322\ This estimate is based on the following calculation: 
(5,561 + 4,586 + 11,300 + 413 = 21,860 x .56 = 12,242).
    \323\ This is the per hour cost of Senior Compliance Officer, 
who we feel will be the appropriate person to review notices. This 
figure is derived from See Securities Industry and Financial Markets 
Association, Report on Management and Professional Earnings in the 
Securities Industry--2007 (2007) (``SIFMA Report''), modified by the 
Commission's Office of Economic Analysis to account for an 1800-hour 
work year, bonuses, firm size, employee benefits, and overhead.
    \324\ This estimate is derived from averaging the per hour costs 
of a Programmer Analyst ($194), a Senior Database Administrator 
($266), a Compliance Manager ($245), a Director of Compliance 
($394), a Paralegal ($168) and a Compliance Attorney ($270). See 
SIFMA Report.
    \325\ This estimate is derived from averaging the per hour costs 
of a Senior General Clerk ($52), a General Clerk ($40), an 
Administrative Assistant ($65), a Compliance Clerk ($62) and a Data 
Entry Clerk ($61). See SIFMA Report.
    \326\ We note that Regulation S-AM includes several 
considerations that should minimize compliance costs for affected 
persons. First, as required by the FACT Act, Regulation S-AM allows 
Covered Persons to combine their affiliate marketing opt out notices 
with any other notice required by law, including the privacy notices 
required under the GLBA. Covered Persons are already required to 
provide privacy notices and to accept consumer opt out elections 
related to information sharing. Second, Regulation S-AM allows 
Covered Persons some flexibility to develop and distribute the 
affiliate marketing opt out notices, and to record opt out elections 
in the manner best suited to their business and needs. Third, 
Regulation S-AM is consistent and comparable with the rules proposed 
by the Agencies, which should provide greater certainty to Covered 
Persons that are part of a family of affiliated companies because 
such affiliated companies are subject to consistent requirements. 
Finally, Regulation S-AM includes examples that provide specific 
guidance regarding what types of policies and procedures Covered 
Persons could develop.
---------------------------------------------------------------------------

VI. Paperwork Reduction Act

    Certain provisions of Regulation S-AM may constitute a ``collection 
of information'' within the meaning of the Paperwork Reduction Act of 
1995.\327\ The Commission submitted Regulation S-AM to the Office of 
Management and Budget (``OMB'') for review in accordance with 44 U.S.C. 
3507(d) and 5 CFR 1320.11, and the OMB approved the collection of 
information. The title for the collection of information is 
``Regulation S-AM: Limitations on Affiliate Marketing,'' its expiration 
date is November 30, 2010, and its OMB control number is 3235-0609. An 
agency may not conduct or sponsor, and a person is not required to 
respond to, a collection of information unless it displays a currently 
valid OMB control number.\328\ Responses to these collections of 
information will not be kept confidential. The Commission received no 
comments on the PRA analysis included in its proposal to adopt 
Regulation S-AM.\329\ We do not believe that any differences between 
Regulation S-AM as proposed and Regulation S-AM as adopted, including 
the increase in average estimated burden hours, would significantly 
affect the collection of information or the estimated hour burden 
associated with the collection of information.
---------------------------------------------------------------------------

    \327\ As amended, codified at 44 U.S.C. Chapter 35.
    \328\ 44 U.S.C. 3512.
    \329\ See Proposing Release at 69 FR 42314-16.
---------------------------------------------------------------------------

A. Collection of Information

    Before an affiliate may use eligibility information received from 
another affiliate to make marketing solicitations to a consumer, the 
consumer must be provided with a notice informing the individual of his 
or her right to opt out of such marketing. In addition, as a practical 
matter, Covered Persons must keep records of any opt out elections in 
order for the opt outs to be effective. The opt out period must last at 
least five years. At the end of the opt out period, the consumer must 
be provided with a renewal notice and a new chance to opt out before 
the resumption of marketing solicitations to the consumer based on the 
consumer's eligibility information.
    Notice and opt out are only required if a Covered Person uses 
eligibility information from an affiliate for use in marketing 
solicitations. Covered Persons that do not have affiliates, or whose 
affiliates do not make marketing solicitations based on eligibility 
information received from a Covered Person, are not required to provide 
notice and opt out. Regulation S-AM contains a number of other 
exceptions as directed by Section 214 of the FACT Act, such as for 
situations in which the affiliate has a pre-existing business 
relationship with the consumer or in which the consumer requests 
marketing information. In the final rules, we have attempted to retain 
procedural flexibility and to minimize compliance burdens except as 
required by the terms of the FACT Act.

B. Use of Information

    Section 624 of the FCRA is intended to enhance the protection of 
consumer financial information in the affiliate marketing context and 
to enable consumers to limit Covered Persons from using eligibility 
information they receive from an affiliate to make marketing 
solicitations. Regulation S-AM is necessary to fulfill the statutory 
mandate, in Section 214 of the FACT Act, that the Commission prescribe 
regulations to implement Section 624.

C. Respondents

    We estimate that approximately 5,561 broker-dealers, 4,586 
investment companies, 11,300 registered investment advisers, and 413 
registered transfer agents will be required to comply with Regulation 
S-AM. However, we expect that only a fraction of all Covered Persons 
will be required to provide notices and opt out opportunities to 
consumers. First, the rules only apply to Covered Persons that have 
affiliates, and then only if affiliates receiving eligibility 
information make marketing solicitations based on the eligibility 
information received from a Covered Person. Based on a review of forms 
filed with the Commission, we estimate that approximately 56% of 
Covered Persons have an affiliate.\330\ However, we assume that many of 
those Covered Persons do not communicate eligibility information to 
their affiliates for marketing purposes and thus will not be subject to 
the notice and opt out requirements of Regulation S-AM.\331\ The rules 
also incorporate a number of statutory exceptions that further reduce 
the number of Covered Persons required to provide affiliate marketing 
notices. In addition, any notices required by Regulation S-AM can be 
combined with notices already required by Regulation S-P. Further, if 
notice is required, Regulation S-AM allows all affiliates under common 
ownership or control to provide a single, joint notice. Accordingly, 
Covered Persons that are required to provide affiliate marketing 
notices could be covered by a notice sent by one or more affiliates, 
and may not be required to provide a notice independently. In light of 
these factors, we estimate that approximately 10% of Covered Persons, 
or approximately 2,186 respondents, will be required to provide 
consumers with notices and an opportunity to opt out under Regulation 
S-AM.
---------------------------------------------------------------------------

    \330\ This estimate is based upon statistics reported on Form 
ADV, the Universal Application for Investment Adviser Registration, 
which contains specific questions regarding affiliations between 
investment advisers and other persons in the financial industry. We 
estimate that other Covered Persons would report a rate of 
affiliation similar to that reported by registered investment 
advisers.
    \331\ For example, professional standards require investment 
advisers to preserve the confidentiality of information communicated 
by clients or prospects. See Association for Investment Management 
and Research, Standards of Practice Handbook 123, 125 (1996).
---------------------------------------------------------------------------

D. Total Annual Reporting and Recordkeeping Burdens

    Every Covered Person that has one or more affiliates likely would 
incur a one-time burden in reviewing its policies and business 
practices to determine the

[[Page 40428]]

extent to which it communicates eligibility information to affiliates 
for marketing purposes and whether those affiliates make marketing 
solicitations based on that eligibility information. This determination 
should be straightforward for most entities, in part because GLBA 
privacy regulations already require Covered Persons other than transfer 
agents to review their information sharing practices and disclose 
whether they share information with affiliates.\332\ We estimate that 
approximately 56% of all Covered Persons, or approximately 12,242, have 
an affiliate. The amount of time required to review their policies will 
vary widely, from a few minutes for those that do not share eligibility 
information with affiliates to 4 hours or more for Covered Persons with 
more complex information sharing arrangements. We estimate that each 
Covered Person will require 1 hour on average to review its policies 
and practices, for a total one-time burden of 12,242 hours. We estimate 
that 2,186 Covered Persons will be required to provide notice and opt 
out opportunities under the rules. This process consists of several 
steps. First, an affiliate marketing notice would have to be created. 
The amount of time required to develop a notice should be reduced 
significantly by the inclusion of model forms in Regulation S-AM. 
Second, the notices will need to be delivered. The final rules allow 
that affiliate marketing notices may be combined with any other notice 
or disclosure required by law. We expect that most Covered Persons will 
combine their affiliate marketing notices with some other form of 
communication, such as an account statement or an annual privacy notice 
under the GLBA. Because those communications are already delivered to 
consumers, adding a brief affiliate marketing notice should not result 
in added costs for processing or for postage and materials.\333\ 
Notices may be delivered electronically to consumers who have agreed to 
electronic communications, which should further reduce the costs of 
delivery. Third, as a practical matter, Covered Persons will need to 
keep accurate records in order to honor any opt out elections and to 
track the expiration of the opt out period. The number of actual notice 
mailings in any given year will depend on the number of consumers who 
do business with each affected person. For purposes of the PRA, we 
estimate that the hour burden for developing, sending, and tracking the 
opt out notices will range from 2-50 hours, with an average of 18 hours 
for each Covered Person (39,348 hours total).\334\ We estimate that 
postage and materials costs for the notices would be negligible because 
the notices likely will be combined with other required mailings.\335\
---------------------------------------------------------------------------

    \332\ See 17 CFR 248.6(a)(3) (initial, annual, and revised GLBA 
privacy notices must include ``the categories of affiliates * * * to 
whom you disclose nonpublic personal information''). Transfer agents 
are subject to consistent and comparable requirements promulgated by 
the Agencies.
    \333\ Because we assume that most affiliate marketing notices 
will be combined with other required mailings, we base our estimates 
on the resources required to integrate an affiliate marketing notice 
into another mailing, rather than on the resources required to 
create and send a separate mailing.
    \334\ See discussion of new cost estimates and burden hours 
supra Part V.
    \335\ See discussion of consolidated notices supra Part III.F.2.
---------------------------------------------------------------------------

    Because the notice and opt out requirements are a prerequisite to 
conducting covered forms of affiliate marketing, most Covered Persons 
would provide notice within the first year after which compliance with 
Regulation S-AM is required. However, additional notices will be 
required as new customer relationships are formed. We anticipate that 
many Covered Persons will ensure delivery to new consumers with a 
minimum of additional effort by providing or combining the notices with 
other documents such as account opening documents or initial GLBA 
privacy notices. Accordingly, we estimate an ongoing annual burden of 4 
hours per year (or 8,744 hours total) for creating and delivering 
notices to new consumers and recording any opt outs that are received 
on an ongoing basis.\336\
---------------------------------------------------------------------------

    \336\ See discussion of new cost estimates and burden hours 
supra Part V.
---------------------------------------------------------------------------

    A consumer opt out may expire at the end of five years, as long as 
the person that provided the initial notice provides the consumer with 
renewed notice and an opportunity to extend his or her opt out election 
before any affiliate marketing may begin.\337\ Designing, sending, and 
recording opt out renewal notices will require additional hours and 
costs. However, because the initial opt out period must last for at 
least five years, any burden related to renewal notices would not arise 
within the first four years of the collection of information.
---------------------------------------------------------------------------

    \337\ In order to ease the burden of tracking each opt out 
period, many affiliated persons may decide to implement an opt out 
period of longer than five years, including a period that never 
expires.
---------------------------------------------------------------------------

    In sum, we estimate that each of approximately 12,242 Covered 
Persons will require an average one-time burden of 1 hour to review 
affiliate marketing practices (12,242 hours total). We estimate that 
the approximately 2,186 Covered Persons required to provide notices and 
opt out opportunities will incur an average first-year burden of 18 
hours to provide notices and allow for consumer opt outs, for a total 
estimated first-year burden of 39,348 hours. With regard to continuing 
notice burdens, we estimate that each of the approximately 2,186 
Covered Persons required to provide notices and opt out opportunities 
will incur an annual burden of 2 hours to develop notices for new 
consumers (4,372 hours total) and an annual burden of 2 hours to 
deliver the notices and record any opt outs for new consumers (4,372 
hours total). These estimates represent a total one-time burden of 
51,590 hours (12,242 hours plus 39,348 hours) and an ongoing annual 
burden of 8,744 hours (4,372 hours plus 4,372 hours). We do not expect 
that Covered Persons will incur start-up or materials costs in addition 
to the staff time discussed above.

E. Retention Period for Recordkeeping Requirements

    Regulation S-AM does not contain express provisions governing the 
retention of records related to opt outs. However, as noted above, a 
person subject to Regulation S-AM would need to keep some record of 
consumer opt outs in order to know which consumers should not receive 
marketing solicitations based on eligibility information. These records 
would need to be retained for at least as long as the opt out period of 
five or more years, so that the person responsible for providing the 
renewal notice would know when that notice is required.

F. Collection of Information Is Mandatory

    As noted, Covered Persons that use eligibility information from 
their affiliates for marketing purposes will be required to comply with 
the notice and opt out provisions of Regulation S-AM. Assuming that no 
other exception applies, the disclosure and recordkeeping requirements 
will be mandatory with respect to those Covered Persons.

VII. Final Regulatory Flexibility Analysis

    The Commission has prepared this Final Regulatory Flexibility 
Analysis for Regulation S-AM in accordance with 5 U.S.C. 604.

A. Need for the Rule

    Regulation S-AM implements Section 214 of the FACT Act (which added 
new Section 624 to the FCRA) that, in general, prohibits a person from 
using certain information received from an

[[Page 40429]]

affiliate to make marketing solicitations to a consumer, unless the 
consumer is given notice, as well as an opportunity and a simple method 
to opt out, of the possibility of receiving such solicitations. Section 
214 also required the Agencies and the Commission, in consultation and 
coordination with one another, to issue implementing regulations that 
are consistent and comparable to the extent possible. The objectives of 
Regulation S-AM are discussed in detail in the Background, Overview of 
Comments Received and Explanation of Regulation S-AM, and Section-by-
Section Analysis at Sections I through III above. The legal basis for 
Regulation S-AM is Section 214 of the FACT Act,\338\ as well as 
Sections 17, 17A, 23, and 36 of the Exchange Act,\339\ Sections 31 and 
38 of the Investment Company Act,\340\ and Sections 204 and 211 of the 
Investment Advisers Act.\341\ The Commission received no comments 
regarding the Initial Regulatory Flexibility Analysis.
---------------------------------------------------------------------------

    \338\ Public Law 108-159, 117 Stat. 1952 (2003).
    \339\ 15 U.S.C. 78q, 78q-1, 78w, and 78mm.
    \340\ 15 U.S.C. 80a-30 and 80a-37.
    \341\ 15 U.S.C. 80b-4 and 80b-11.
---------------------------------------------------------------------------

B. Description of Small Entities to Which the Final Rules Will Apply

    Regulation S-AM applies to any Covered Person that uses eligibility 
information for the purpose of making marketing solicitations. Of the 
entities registered with the Commission, 896 broker-dealers, 197 
investment companies, 671 registered investment advisers, and 76 
registered transfer agents are considered small entities.\342\ Only 
affiliated entities are subject to Regulation S-AM. We estimate that 
56% of all Covered Persons have affiliates, although it is not clear 
whether small entities differ significantly from larger entities in 
their rates of corporate affiliation. While we invited comment from 
small entities that would be subject to the proposed rules as well as 
general comment regarding information that would help us to quantify 
the number of small entities that may be affected by Regulation S-AM, 
we received none.
---------------------------------------------------------------------------

    \342\ For purposes of the Regulatory Flexibility Act, under the 
Exchange Act a small entity is a broker or dealer that had total 
capital of less than $500,000 on the date of its prior fiscal year 
and is not affiliated with any person that is not a small entity. 17 
CFR 240.0-10. Under the Investment Company Act a ``small entity'' is 
an investment company that, together with other investment companies 
in the same group of related investment companies, has net assets of 
$50 million or less as of the end of its most recent fiscal year. 17 
CFR 270.0-10. Under the Investment Advisers Act, a small entity is 
an investment adviser that: (i) Manages less than $25 million in 
assets, (ii) has total assets of less than $5 million on the last 
day of its most recent fiscal year, and (iii) does not control, is 
not controlled by, and is not under common control with another 
investment adviser that manages $25 million or more in assets, or 
any person that had total assets of $5 million or more on the last 
day of the most recent fiscal year. 17 CFR 275.0-7. A small entity 
in the transfer agent context is defined to be any transfer agent 
that (i) received less than 500 items for transfer and less than 500 
items for processing during the preceding six months: (ii) 
transferred only items of issuers that would be deemed ``small 
businesses'' or ``small organizations'' under Rule 0-10 under the 
Exchange Act; (iii) maintained master shareholder files that in the 
aggregate contained less than 1,000 shareholder accounts at all 
times during the preceding fiscal year; and (iv) is not affiliated 
with any person (other than a natural person) that is not a small 
business or small organization under Rule 0-10. 17 CFR 240.0-10.
---------------------------------------------------------------------------

C. Projected Reporting, Recordkeeping, and Other Compliance 
Requirements

    Regulation S-AM requires Covered Persons to provide consumers with 
notice and an opportunity to opt out of affiliated persons' use of 
eligibility information for marketing purposes. The final rule 
prohibits a Covered Person from using eligibility information received 
from an affiliate to make marketing solicitations to consumers, unless: 
(1) The potential marketing use of the information has been clearly, 
conspicuously and concisely disclosed to the consumer; (2) the consumer 
has been provided a reasonable opportunity and a simple method to opt 
out of receiving the marketing solicitation; and (3) the consumer has 
not opted out.
    For those entities that provide the Section 624 notice in 
consolidation with other documents such as notices provided under the 
GLBA or other Federally mandated disclosures, the final rules impose 
very limited additional reporting or recordkeeping requirements. 
However, for Covered Persons that choose to send the notices 
separately, the reporting and recordkeeping requirements and other 
compliance requirements may be more substantial. Although the final 
rules do not include specific recordkeeping requirements, in practice 
some system of recordkeeping must exist to ensure that any consumer opt 
outs are honored.
    There are a number of features of the FACT Act's affiliate 
marketing provisions as implemented by Regulation S-AM that limit its 
scope. First, the law only applies to the use of eligibility 
information by affiliates for the purpose of making marketing 
solicitations. Thus, affiliates that make marketing solicitations based 
solely upon their own information or without regard to eligibility 
information are not affected by this law. Second, the law provides 
exceptions to its notice and opt out requirements that permit Covered 
Persons to market to consumers with whom they have a ``pre-existing 
business relationship'' or from whom they have received a request for 
information. Third, Sec.  248.123(a)(1)(i) allows a single, joint 
notice to be sent to a consumer on behalf of multiple affiliates.
    A number of alternatives exist that could reduce the costs 
associated with compliance with Regulation S-AM. First, significant 
cost savings may be obtained by consolidating affiliate marketing 
notices with GLBA privacy notices or with other documents provided to 
consumers such as account statements. In addition, the model forms 
could be used for opt out notices that comply with the requirements of 
the rules. Regulation S-AM also permits Covered Persons to reduce the 
need for ongoing tracking by offering a permanent opt out from both the 
sharing of information between affiliates and from receiving marketing 
based on such sharing, which would be consistent with both the GLBA and 
FCRA notice and opt out requirements as well as with the FACT Act's 
notice and opt out requirements. Small entities may wish to consider 
whether consolidation of their privacy and affiliate marketing notices 
and opt out forms can reduce their compliance costs. Similar 
considerations can reduce the burden of providing affiliate marketing 
notices to new consumers. For example, as long as the notices remain 
clear, conspicuous, and concise,\343\ small entity Covered Persons can 
combine affiliate marketing notices with account opening documents or 
initial privacy notices provided under the GLBA in order to ensure that 
affiliate marketing notices are delivered to new consumers without 
substantial additional efforts on the part of the Covered Person.
---------------------------------------------------------------------------

    \343\ See Sec.  248.123(a).
---------------------------------------------------------------------------

    The Commission was concerned about the potential impact of the 
proposed rules on small entities and requested comment on: (1) The 
potential impact of any or all of the provisions in the proposed rules, 
including any benefits and costs, that the Commission should consider; 
(2) the costs and benefits of any alternatives, paying special 
attention to the effect of the proposed rules on small entities in 
light of the above analysis; (3) costs to implement and to comply with 
the proposed rules, including any expenditure of time or money for, for 
example, employee training, legal counsel, or other professional time, 
for preparing and processing the notices; and (4) costs to record and 
track consumers' elections to opt out. We received no comments on these 
issues.

[[Page 40430]]

D. Identification of Other Duplicative, Overlapping, or Conflicting 
Federal Rules

    With the exception of the opt out for affiliate sharing under 
Section 603(d)(2)(A)(iii) of the FCRA, we have not identified any 
Federal statutes or regulations that duplicate, overlap, or conflict 
with Regulation S-AM. As discussed previously, while there is some 
overlap between Regulation S-AM and the affiliate sharing provisions of 
the FCRA and the notice provisions of Regulation S-P, we expect that 
Covered Persons will consolidate the notice provisions of Regulation S-
AM, the affiliate sharing provisions of the FCRA and the privacy notice 
provisions of Regulation S-P.\344\ We sought and received no comment 
regarding any other statute or regulation, including State or local 
statutes or regulations, that would duplicate, overlap, or conflict 
with the proposed rules.
---------------------------------------------------------------------------

    \344\ See discussion of overlap of Regulation S-AM with the 
affiliate sharing provisions of the FCRA supra Parts II.B and III.
---------------------------------------------------------------------------

E. Agency Actions To Minimize Effects on Small Entities

    The Regulatory Flexibility Act directs the Commission to consider 
significant alternatives that would accomplish the stated objectives of 
a rule while minimizing any significant adverse impact on small 
businesses. In connection with Regulation S-AM, the Commission 
considered the following alternatives: (1) The establishment of 
differing compliance or reporting requirements or timetables that take 
into account the resources available to small entities; (2) the 
clarification, consolidation, or simplification of compliance and 
reporting requirements under the proposed rules for small entities; (3) 
the use of performance rather than design standards; and (4) an 
exemption from coverage of the proposed rules, or any part thereof, for 
small entities.
    The Commission does not believe that an exemption from coverage or 
special compliance or reporting requirements for small entities would 
be consistent with the mandates of the FACT Act. Section 214 of the 
FACT Act addresses the protection of consumer privacy, and consumer 
privacy concerns do not depend on the size of the entity involved. 
However, we have endeavored throughout the final rules to minimize the 
regulatory burden on all Covered Persons, including small entities, 
while meeting the statutory requirements. Small entities should benefit 
from the existing emphasis on performance rather than design standards 
throughout the final rules and the use of examples, including model 
forms for affiliate marketing notices. The Commission solicited and 
received no comment on any alternative system that would be consistent 
with the FACT Act but would minimize the impact on small entities.

VIII. Consideration of Burden on Competition, and Promotion of 
Efficiency, Competition, and Capital Formation

    Section 23(a)(2) of the Exchange Act \345\ requires the Commission, 
in adopting rules under the Exchange Act, to consider the impact that 
the rules may have upon competition. Regulation S-AM, which implements 
Section 214 of the FACT Act, applies to all brokers, dealers, 
investment companies, registered investment advisers, and registered 
transfer agents. Each of these entities must provide notice and an 
opportunity to opt out to customers before an affiliate uses 
eligibility information to make marketing solicitations to consumers. 
Because other entities will be subject to substantially similar 
affiliate marketing and opt out notice rules adopted by the 
Agencies,\346\ all financial institutions will have to bear costs of 
implementing the rules or substantially similar rules. We do not 
believe the rules will result in anti-competitive effects. Other 
affiliated persons that make marketing solicitations using eligibility 
information received from a Covered Person subject to Regulation S-AM 
or the substantially similar rules of the Agencies will be subject to 
substantially similar requirements. Therefore, all persons that engage 
in affiliate marketing based on eligibility information will be 
required to bear the costs of implementing the rules or substantially 
similar rules. Although these costs may vary among persons subject to 
the various affiliate marketing rules, we do not believe that the costs 
would be significantly greater for any particular entity or entities 
based on which affiliate marketing rule applies to that entity.
---------------------------------------------------------------------------

    \345\ 15 U.S.C. 78w(a)(2).
    \346\ See Joint Rules and FTC rule.
---------------------------------------------------------------------------

    Section 3(f) of the Exchange Act,\347\ Section 202(c) of the 
Investment Advisers Act, and Section 2(c) of the Investment Company Act 
\348\ require the Commission, when engaging in rulemaking to consider 
or determine whether an action is necessary or appropriate in the 
public interest, to consider whether the action will promote 
efficiency, competition, and capital formation. We solicited comment on 
these issues but received none.\349\ The rules will result in 
additional costs for Covered Persons and their affiliates, which may 
affect their efficiency. As discussed above, however, the rules and the 
model forms should promote efficiency by minimizing compliance costs. 
The ability of Covered Persons and their affiliates to use joint 
notices should further promote efficiency by facilitating the use of 
notices already prepared by affiliates and the allocation of compliance 
and notice delivery costs among affiliates. The rules and model forms 
also should promote competition among Covered Persons and between 
Covered Persons and other types of entities subject to the affiliate 
marketing rules of the Agencies by providing a common set of 
requirements relating to the use of eligibility information for 
affiliate marketing purposes. We are not aware of any effect the final 
rules will have on capital formation.
---------------------------------------------------------------------------

    \347\ 15 U.S.C. 78c(f).
    \348\ 15 U.S.C. 80a-2(c).
    \349\ See Proposing Release at 69 FR 42318.
---------------------------------------------------------------------------

IX. Statutory Authority

    The Commission is adopting Regulation S-AM and making conforming, 
technical amendments to Regulation S-P under the authority set forth in 
Section 214 of the FACT Act,\350\ Sections 17, 17A, 23, and 36 of the 
Exchange Act,\351\ Sections 31 and 38 of the Investment Company 
Act,\352\ and Sections 204 and 211 of the Investment Advisers Act.\353\
---------------------------------------------------------------------------

    \350\ Public Law 108-159, Section 214, 117 Stat. 1952 (2003).
    \351\ 15 U.S.C. 78q, 78q-1, 78w, and 78mm.
    \352\ 15 U.S.C. 80a-30 and 80a-37.
    \353\ 15 U.S.C. 80b-4 and 80b-11.
---------------------------------------------------------------------------

X. Text of Final Rules

List of Subjects in 17 CFR Part 248

    Affiliate marketing, Brokers, Consumer protection, Dealers, 
Investment advisers, Investment companies, Privacy, Reporting and 
recordkeeping requirements, Securities, Transfer agents.

0
For the reasons stated in the preamble, the Securities and Exchange 
Commission amends 17 CFR part 248 as follows:

PART 248--REGULATIONS S-P AND S-AM

0
1. The authority citation for part 248 is revised to read as follows:


    Authority: 15 U.S.C. 78q, 78q-1, 78w, 78mm, 80a-30, 80a-37, 80b-
4, 80b-11, 1681s-3 and note, 1681w(a)(1), 6801-6809, and 6825.

[[Page 40431]]


0
2. The heading for part 248 is revised to read as set forth above.

0
3. In part 248, wherever it may occur, remove each reference to ``this 
part'' and add the reference ``this subpart'' in its place.


Sec.  248.3  [Amended]

0
4. In Sec.  248.3, amend paragraphs (a)(1), (a)(2) and (p) by removing 
the reference ``G-L-B Act'' and adding the reference ``GLBA'' in its 
place.

Subpart A--[Amended]

0
5. Remove the heading of subpart A of part 248 and add in its place the 
following undesignated center heading: ``Privacy and Opt Out Notices''.

Subpart B--[Amended]

0
6. Remove the heading of subpart B of part 248 and add in its place the 
following undesignated center heading: ``Limits on Disclosures''.

Subpart C--[Amended]

0
7. Remove the heading of subpart C of part 248 and add in its place the 
following undesignated center heading: ``Exceptions''.

Subpart D--[Amended]

0
8. Remove the heading of subpart D of part 248 and add in its place the 
following undesignated center heading: ``Relation to Other Laws; 
Effective Date''.

Subpart A--Regulation S-P: Privacy of Consumer Financial 
Information and Safeguarding Personal Information

0
9. Designate Sec. Sec.  248.1 through 248.30 as subpart A and add a 
heading to read as set forth above.

0
10. Reserve Sec. Sec.  248.31 through 248.100 in subpart A.

Appendix A to Subpart A [Redesignated as Appendix B to Subpart A]

0
11. Appendix A to part 248 is redesignated as Appendix B to subpart A.

0
12a. A new Appendix A to Subpart A is added and reserved to read as 
follows:

Appendix A to Subpart A--Forms [Reserved]

0
12b. The heading for newly redesignated Appendix B to Subpart A is 
revised to read as follows:

 Appendix B to Subpart A--Sample Clauses

0
13. Subpart B (Sec. Sec.  248.101 through 248.128 and Appendix to 
Subpart B) is added to part 248 to read as follows:
Subpart B--Regulation S-AM: Limitations on Affiliate Marketing
Sec.
248.101 Purpose and scope.
248.102 Examples.
248.103-248.119 [Reserved]
248.120 Definitions.
248.121 Affiliate marketing opt out and exceptions.
248.122 Scope and duration of opt out.
248.123 Contents of opt out notice; consolidated and equivalent 
notices.
248.124 Reasonable opportunity to opt out.
248.125 Reasonable and simple methods of opting out.
248.126 Delivery of opt out notices.
248.127 Renewal of opt out elections.
248.128 Effective date, compliance date, and prospective 
application.

Appendix to Subpart B--Model Forms

Subpart B--Regulation S-AM: Limitations on Affiliate Marketing


Sec.  248.101  Purpose and scope.

    (a) Purpose. The purpose of this subpart is to implement section 
624 of the Fair Credit Reporting Act, 15 U.S.C. 1681, et seq. 
(``FCRA''). Section 624, which was added to the FCRA by section 214 of 
the Fair and Accurate Credit Transactions Act of 2003, Public Law 108-
159, 117 Stat. 1952 (2003) (``FACT Act'' or ``Act''), regulates the use 
of consumer information received from an affiliate to make marketing 
solicitations.
    (b) Scope. This subpart applies to any broker or dealer other than 
a notice-registered broker or dealer, to any investment company, and to 
any investment adviser or transfer agent registered with the 
Commission. These entities are referred to in this subpart as ``you.''


Sec.  248.102  Examples.

    The examples in this subpart are not exclusive. The examples in 
this subpart provide guidance concerning the rules' application in 
ordinary circumstances. The facts and circumstances of each individual 
situation, however, will determine whether compliance with an example, 
to the extent applicable, constitutes compliance with this subpart. 
Examples in a paragraph illustrate only the issue described in the 
paragraph and do not illustrate any other issue that may arise under 
this subpart. Similarly, the examples do not illustrate any issues that 
may arise under other laws or regulations.


Sec. Sec.  248.103-248.119  [Reserved]


Sec.  248.120  Definitions.

    As used in this subpart, unless the context requires otherwise:
    (a) Affiliate of a broker, dealer, or investment company, or an 
investment adviser or transfer agent registered with the Commission 
means any person that is related by common ownership or common control 
with the broker, dealer, or investment company, or the investment 
adviser or transfer agent registered with the Commission. In addition, 
a broker, dealer, or investment company, or an investment adviser or 
transfer agent registered with the Commission will be deemed an 
affiliate of a company for purposes of this subpart if:
    (1) That company is regulated under section 214 of the FACT Act, 
Public Law 108-159, 117 Stat. 1952 (2003), by a government regulator 
other than the Commission; and
    (2) Rules adopted by the other government regulator under section 
214 of the FACT Act treat the broker, dealer, or investment company, or 
investment adviser or transfer agent registered with the Commission as 
an affiliate of that company.
    (b) Broker has the same meaning as in section 3(a)(4) of the 
Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(4)). A ``broker'' 
does not include a broker registered by notice with the Commission 
under section 15(b)(11) of the Securities Exchange Act of 1934 (15 
U.S.C. 78o(b)(11)).
    (c) Clear and conspicuous means reasonably understandable and 
designed to call attention to the nature and significance of the 
information presented.
    (d) Commission means the Securities and Exchange Commission.
    (e) Company means any corporation, limited liability company, 
business trust, general or limited partnership, association, or similar 
organization.
    (f) Concise. (1) In general. The term ``concise'' means a 
reasonably brief expression or statement.
    (2) Combination with other required disclosures. A notice required 
by this subpart may be concise even if it is combined with other 
disclosures required or authorized by Federal or State law.
    (g) Consumer means an individual.
    (h) Control of a company means the power to exercise a controlling 
influence over the management or policies of a company whether through 
ownership of securities, by contract, or otherwise. Any person who owns 
beneficially, either directly or through one or more controlled 
companies, more

[[Page 40432]]

than 25 percent of the voting securities of any company is presumed to 
control the company. Any person who does not own more than 25 percent 
of the voting securities of any company will be presumed not to control 
the company. Any presumption regarding control may be rebutted by 
evidence, but, in the case of an investment company, will continue 
until the Commission makes a decision to the contrary according to the 
procedures described in section 2(a)(9) of the Investment Company Act 
of 1940 (15 U.S.C. 80a-2(a)(9)).
    (i) Dealer has the same meaning as in section 3(a)(5) of the 
Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(5)). A ``dealer'' 
does not include a dealer registered by notice with the Commission 
under section 15(b)(11) of the Securities Exchange Act of 1934 (15 
U.S.C. 78o(b)(11)).
    (j) Eligibility information means any information the communication 
of which would be a consumer report if the exclusions from the 
definition of ``consumer report'' in section 603(d)(2)(A) of the FCRA 
did not apply. Eligibility information does not include aggregate or 
blind data that does not contain personal identifiers such as account 
numbers, names, or addresses.
    (k) FCRA means the Fair Credit Reporting Act (15 U.S.C. 1681, et 
seq.).
    (l) GLBA means the Gramm-Leach-Bliley Act (15 U.S.C. 6801, et 
seq.).
    (m) Investment adviser has the same meaning as in section 
202(a)(11) of the Investment Advisers Act of 1940 (15 U.S.C. 80b-
2(a)(11)).
    (n) Investment company has the same meaning as in section 3 of the 
Investment Company Act of 1940 (15 U.S.C. 80a-3) and includes a 
separate series of the investment company.
    (o) Marketing solicitation. (1) In general. The term ``marketing 
solicitation'' means the marketing of a product or service initiated by 
a person to a particular consumer that is:
    (i) Based on eligibility information communicated to that person by 
its affiliate as described in this subpart; and
    (ii) Intended to encourage the consumer to purchase or obtain such 
product or service.
    (2) Exclusion of marketing directed at the general public. A 
marketing solicitation does not include marketing communications that 
are directed at the general public. For example, television, general 
circulation magazine, billboard advertisements and publicly available 
Web sites that are not directed to particular consumers would not 
constitute marketing solicitations, even if those communications are 
intended to encourage consumers to purchase products and services from 
the person initiating the communications.
    (3) Examples of marketing solicitations. A marketing solicitation 
would include, for example, a telemarketing call, direct mail, e-mail, 
or other form of marketing communication directed to a particular 
consumer that is based on eligibility information received from an 
affiliate.
    (p) Person means any individual, partnership, corporation, trust, 
estate, cooperative, association, government or governmental 
subdivision or agency, or other entity.
    (q) Pre-existing business relationship. (1) In general. The term 
``pre-existing business relationship'' means a relationship between a 
person, or a person's licensed agent, and a consumer based on:
    (i) A financial contract between the person and the consumer which 
is in force on the date on which the consumer is sent a solicitation 
covered by this subpart;
    (ii) The purchase, rental, or lease by the consumer of the person's 
goods or services, or a financial transaction (including holding an 
active account or a policy in force or having another continuing 
relationship) between the consumer and the person, during the 18-month 
period immediately preceding the date on which the consumer is sent a 
solicitation covered by this subpart; or
    (iii) An inquiry or application by the consumer regarding a product 
or service offered by that person during the three-month period 
immediately preceding the date on which the consumer is sent a 
solicitation covered by this subpart.
    (2) Examples of pre-existing business relationships. (i) If a 
consumer has a brokerage account with a broker-dealer that is currently 
in force, the broker-dealer has a pre-existing business relationship 
with the consumer and can use eligibility information it receives from 
its affiliates to make solicitations to the consumer about its products 
or services.
    (ii) If a consumer has an investment advisory contract with a 
registered investment adviser, the investment adviser has a pre-
existing business relationship with the consumer and can use 
eligibility information it receives from its affiliates to make 
solicitations to the consumer about its products or services.
    (iii) If a consumer was the record owner of securities issued by an 
investment company, but the consumer redeems these securities, the 
investment company has a pre-existing business relationship with the 
consumer and can use eligibility information it receives from its 
affiliates to make solicitations to the consumer about its products or 
services for 18 months after the date the consumer redeemed the 
investment company's securities.
    (iv) If a consumer applies for a margin account offered by a 
broker-dealer, but does not obtain a product or service from or enter 
into a financial contract or transaction with the broker-dealer, the 
broker-dealer has a pre-existing business relationship with the 
consumer and can therefore use eligibility information it receives from 
its affiliates to make solicitations to the consumer about its products 
or services for three months after the date of the application.
    (v) If a consumer makes a telephone inquiry to a broker-dealer 
about its products or services and provides contact information to the 
broker-dealer, but does not obtain a product or service from or enter 
into a financial contract or transaction with the institution, the 
broker-dealer has a pre-existing business relationship with the 
consumer and can therefore use eligibility information it receives from 
its affiliates to make solicitations to the consumer about its products 
or services for three months after the date of the inquiry.
    (vi) If a consumer makes an inquiry by e-mail to a broker-dealer 
about one of its affiliated investment company's products or services 
but does not obtain a product or service from, or enter into a 
financial contract or transaction with the broker-dealer or the 
investment company, the broker-dealer and the investment company both 
have a pre-existing business relationship with the consumer and can 
therefore use eligibility information they receive from their 
affiliates to make solicitations to the consumer about their products 
or services for three months after the date of the inquiry.
    (vii) If a consumer who has a pre-existing business relationship 
with an investment company that is part of a group of affiliated 
companies makes a telephone call to the centralized call center for the 
affiliated companies to inquire about products or services offered by a 
broker-dealer affiliated with the investment company, and provides 
contact information to the call center, the call constitutes an inquiry 
to the broker-dealer. In these circumstances, the broker-dealer has a 
pre-existing business relationship with the consumer and can therefore 
use eligibility information it receives from the investment company to 
make solicitations to the consumer about its products or services for 
three months after the date of the inquiry.
    (3) Examples where no pre-existing business relationship is 
created. (i) If a consumer makes a telephone call to a

[[Page 40433]]

centralized call center for a group of affiliated companies to inquire 
about the consumer's existing account at a broker-dealer, the call does 
not constitute an inquiry to any affiliate other than the broker-dealer 
that holds the consumer's account and does not establish a pre-existing 
business relationship between the consumer and any affiliate of the 
account-holding broker-dealer.
    (ii) If a consumer who has an advisory contract with a registered 
investment adviser makes a telephone call to an affiliate of the 
investment adviser to ask about the affiliate's retail locations and 
hours, but does not make an inquiry about the affiliate's products or 
services, the call does not constitute an inquiry and does not 
establish a pre-existing business relationship between the consumer and 
the affiliate. Also, the affiliate's capture of the consumer's 
telephone number does not constitute an inquiry and does not establish 
a pre-existing business relationship between the consumer and the 
affiliate.
    (iii) If a consumer makes a telephone call to a broker-dealer in 
response to an advertisement offering a free promotional item to 
consumers who call a toll-free number, but the advertisement does not 
indicate that the broker-dealer's products or services will be marketed 
to consumers who call in response, the call does not create a pre-
existing business relationship between the consumer and the broker-
dealer because the consumer has not made an inquiry about a product or 
service offered by the institution, but has merely responded to an 
offer for a free promotional item.
    (r) Transfer agent has the same meaning as in section 3(a)(25) of 
the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(25)).
    (s) You means:
    (1) Any broker or dealer other than a broker or dealer registered 
by notice with the Commission under section 15(b)(11) of the Securities 
Exchange Act of 1934 (15 U.S.C. 78o(b)(11));
    (2) Any investment company;
    (3) Any investment adviser registered with the Commission under the 
Investment Advisers Act of 1940 (15 U.S.C. 80b-1, et seq.); and
    (4) Any transfer agent registered with the Commission under section 
17A of the Securities Exchange Act of 1934 (15 U.S.C. 78q-1).


Sec.  248.121  Affiliate marketing opt out and exceptions.

    (a) Initial notice and opt out requirement. (1) In general. You may 
not use eligibility information about a consumer that you receive from 
an affiliate to make a marketing solicitation to the consumer, unless:
    (i) It is clearly and conspicuously disclosed to the consumer in 
writing or, if the consumer agrees, electronically, in a concise notice 
that you may use eligibility information about that consumer received 
from an affiliate to make marketing solicitations to the consumer;
    (ii) The consumer is provided a reasonable opportunity and a 
reasonable and simple method to ``opt out,'' or the consumer prohibits 
you from using eligibility information to make marketing solicitations 
to the consumer; and
    (iii) The consumer has not opted out.
    (2) Example. A consumer has a brokerage account with a broker-
dealer. The broker-dealer furnishes eligibility information about the 
consumer to its affiliated investment adviser. Based on that 
eligibility information, the investment adviser wants to make a 
marketing solicitation to the consumer about its discretionary advisory 
accounts. The investment adviser does not have a pre-existing business 
relationship with the consumer and none of the other exceptions apply. 
The investment adviser is prohibited from using eligibility information 
received from its broker-dealer affiliate to make marketing 
solicitations to the consumer about its discretionary advisory accounts 
unless the consumer is given a notice and opportunity to opt out and 
the consumer does not opt out.
    (3) Affiliates who may provide the notice. The notice required by 
this paragraph must be provided:
    (i) By an affiliate that has or has previously had a pre-existing 
business relationship with the consumer; or
    (ii) As part of a joint notice from two or more members of an 
affiliated group of companies, provided that at least one of the 
affiliates on the joint notice has or has previously had a pre-existing 
business relationship with the consumer.
    (b) Making marketing solicitations. (1) In general. For purposes of 
this subpart, you make a marketing solicitation if:
    (i) You receive eligibility information from an affiliate;
    (ii) You use that eligibility information to do one or more of the 
following:
    (A) Identify the consumer or type of consumer to receive a 
marketing solicitation;
    (B) Establish criteria used to select the consumer to receive a 
marketing solicitation; or
    (C) Decide which of your products or services to market to the 
consumer or tailor your marketing solicitation to that consumer; and
    (iii) As a result of your use of the eligibility information, the 
consumer is provided a marketing solicitation.
    (2) Receiving eligibility information from an affiliate, including 
through a common database. You may receive eligibility information from 
an affiliate in various ways, including when the affiliate places that 
information into a common database that you may access.
    (3) Receipt or use of eligibility information by your service 
provider. Except as provided in paragraph (b)(5) of this section, you 
receive or use an affiliate's eligibility information if a service 
provider acting on your behalf (whether an affiliate or a nonaffiliated 
third party) receives or uses that information in the manner described 
in paragraph (b)(1)(i) or (b)(1)(ii) of this section. All relevant 
facts and circumstances will determine whether a person is acting as 
your service provider when it receives or uses an affiliate's 
eligibility information in connection with marketing your products and 
services.
    (4) Use by an affiliate of its own eligibility information. Unless 
you have used eligibility information that you receive from an 
affiliate in the manner described in paragraph (b)(1)(ii) of this 
section, you do not make a marketing solicitation subject to this 
subpart if your affiliate:
    (i) Uses its own eligibility information that it obtained in 
connection with a pre-existing business relationship it has or had with 
the consumer to market your products or services to the affiliate's 
consumer; or
    (ii) Directs its service provider to use the affiliate's own 
eligibility information that it obtained in connection with a pre-
existing business relationship it has or had with the consumer to 
market your products or services to the consumer, and you do not 
communicate directly with the service provider regarding that use.
    (5) Use of eligibility information by a service provider. (i) In 
general. You do not make a marketing solicitation subject to this 
subpart if a service provider (including an affiliated or third-party 
service provider that maintains or accesses a common database that you 
may access) receives eligibility information from your affiliate that 
your affiliate obtained in connection with a pre-existing business 
relationship it has or had with the consumer and uses that eligibility 
information to market your products or services to that affiliate's 
consumer, so long as:

[[Page 40434]]

    (A) Your affiliate controls access to and use of its eligibility 
information by the service provider (including the right to establish 
the specific terms and conditions under which the service provider may 
use such information to market your products or services);
    (B) Your affiliate establishes specific terms and conditions under 
which the service provider may access and use your affiliate's 
eligibility information to market your products and services (or those 
of affiliates generally) to your affiliate's consumers, such as the 
identity of the affiliated companies whose products or services may be 
marketed to the affiliate's consumers by the service provider, the 
types of products or services of affiliated companies that may be 
marketed, and the number of times your affiliate's consumers may 
receive marketing materials, and periodically evaluates the service 
provider's compliance with those terms and conditions;
    (C) Your affiliate requires the service provider to implement 
reasonable policies and procedures designed to ensure that the service 
provider uses your affiliate's eligibility information in accordance 
with the terms and conditions established by your affiliate relating to 
the marketing of your products or services;
    (D) Your affiliate is identified on or with the marketing materials 
provided to the consumer; and
    (E) You do not directly use your affiliate's eligibility 
information in the manner described in paragraph (b)(1)(ii) of this 
section.
    (ii) Writing requirements. (A) The requirements of paragraphs 
(b)(5)(i)(A) and (C) of this section must be set forth in a written 
agreement between your affiliate and the service provider; and
    (B) The specific terms and conditions established by your affiliate 
as provided in paragraph (b)(5)(i)(B) of this section must be set forth 
in writing.
    (6) Examples of making marketing solicitations. (i) A consumer has 
an investment advisory contract with a registered investment adviser 
that is affiliated with a broker-dealer. The broker-dealer receives 
eligibility information about the consumer from the investment adviser. 
The broker-dealer uses that eligibility information to identify the 
consumer to receive a marketing solicitation about brokerage products 
and services, and, as a result, the broker-dealer provides a marketing 
solicitation to the consumer about its brokerage services. Pursuant to 
paragraph (b)(1) of this section, the broker-dealer has made a 
marketing solicitation to the consumer.
    (ii) The same facts as in the example in paragraph (b)(6)(i) of 
this section, except that after using the eligibility information to 
identify the consumer to receive a marketing solicitation about 
brokerage products and services, the broker-dealer asks the registered 
investment adviser to send the marketing solicitation to the consumer 
and the investment adviser does so. Pursuant to paragraph (b)(1) of 
this section, the broker-dealer has made a marketing solicitation to 
the consumer because it used eligibility information about the consumer 
that it received from an affiliate to identify the consumer to receive 
a marketing solicitation about its products or services, and, as a 
result, a marketing solicitation was provided to the consumer about the 
broker-dealer's products and services.
    (iii) The same facts as in the example in paragraph (b)(6)(i) of 
this section, except that eligibility information about consumers who 
have an investment advisory contract with a registered investment 
adviser is placed into a common database that all members of the 
affiliated group of companies may independently access and use. Without 
using the investment adviser's eligibility information, the broker-
dealer develops selection criteria and provides those criteria, 
marketing materials, and related instructions to the investment 
adviser. The investment adviser reviews eligibility information about 
its own consumers using the selection criteria provided by the broker-
dealer to determine which consumers should receive the broker-dealer's 
marketing materials and sends the broker-dealer's marketing materials 
to those consumers. Even though the broker-dealer has received 
eligibility information through the common database as provided in 
paragraph (b)(2) of this section, it did not use that information to 
identify consumers or establish selection criteria; instead, the 
investment adviser used its own eligibility information. Therefore, 
pursuant to paragraph (b)(4)(i) of this section, the broker-dealer has 
not made a marketing solicitation to the consumer.
    (iv) The same facts as in the example in paragraph (b)(6)(iii) of 
this section, except that the registered investment adviser provides 
the broker-dealer's criteria to the investment adviser's service 
provider and directs the service provider to use the investment 
adviser's eligibility information to identify investment adviser 
consumers who meet the criteria and to send the broker-dealer's 
marketing materials to those consumers. The broker-dealer does not 
communicate directly with the service provider regarding the use of the 
investment adviser's information to market its products or services to 
the investment adviser's consumers. Pursuant to paragraph (b)(4)(ii) of 
this section, the broker-dealer has not made a marketing solicitation 
to the consumer.
    (v) An affiliated group of companies includes an investment 
company, a principal underwriter for the investment company, a retail 
broker-dealer, and a transfer agent that also acts as a service 
provider. Each affiliate in the group places information about its 
consumers into a common database. The service provider has access to 
all information in the common database. The investment company controls 
access to and use of its eligibility information by the service 
provider. This control is set forth in a written agreement between the 
investment company and the service provider. The written agreement also 
requires the service provider to establish reasonable policies and 
procedures designed to ensure that the service provider uses the 
investment company's eligibility information in accordance with 
specific terms and conditions established by the investment company 
relating to the marketing of the products and services of all 
affiliates, including the principal underwriter and the retail broker-
dealer. In a separate written communication, the investment company 
specifies the terms and conditions under which the service provider may 
use the investment company's eligibility information to market the 
retail broker-dealer's products and services to the investment 
company's consumers. The specific terms and conditions are: a list of 
affiliated companies (including the retail broker-dealer) whose 
products or services may be marketed to the investment company's 
consumers by the service provider; the specific products or services or 
types of products or services that may be marketed to the investment 
company's consumers by the service provider; the categories of 
eligibility information that may be used by the service provider in 
marketing products or services to the investment company's consumers; 
the types or categories of the investment company's consumers to whom 
the service provider may market products or services of investment 
company affiliates; the number and types of marketing communications 
that the service provider may send to the investment company's 
consumers; and the length of time during which the service provider may 
market the products or services of the investment company's affiliates 
to its consumers.

[[Page 40435]]

The investment company periodically evaluates the service provider's 
compliance with these terms and conditions. The retail broker-dealer 
asks the service provider to market brokerage services to certain of 
the investment company's consumers. Without using the investment 
company's eligibility information, the retail broker-dealer develops 
selection criteria and provides those criteria, its marketing 
materials, and related instructions to the service provider. The 
service provider uses the investment company's eligibility information 
from the common database to identify the investment company's consumers 
to whom brokerage services will be marketed. When the retail broker-
dealer's marketing materials are provided to the identified consumers, 
the name of the investment company is displayed on the retail broker-
dealer's marketing materials, an introductory letter that accompanies 
the marketing materials, an account statement that accompanies the 
marketing materials, or the envelope containing the marketing 
materials. The requirements of paragraph (b)(5) of this section have 
been satisfied, and the retail broker-dealer has not made a marketing 
solicitation to the consumer.
    (vi) The same facts as in the example in paragraph (b)(6)(v) of 
this section, except that the terms and conditions permit the service 
provider to use the investment company's eligibility information to 
market the products and services of other affiliates to the investment 
company's consumers whenever the service provider deems it appropriate 
to do so. The service provider uses the investment company's 
eligibility information in accordance with the discretion afforded to 
it by the terms and conditions. Because the terms and conditions are 
not specific, the requirements of paragraph (b)(5) of this section have 
not been satisfied.
    (c) Exceptions. The provisions of this subpart do not apply to you 
if you use eligibility information that you receive from an affiliate:
    (1) To make a marketing solicitation to a consumer with whom you 
have a pre-existing business relationship;
    (2) To facilitate communications to an individual for whose benefit 
you provide employee benefit or other services pursuant to a contract 
with an employer related to and arising out of the current employment 
relationship or status of the individual as a participant or 
beneficiary of an employee benefit plan;
    (3) To perform services on behalf of an affiliate, except that this 
paragraph shall not be construed as permitting you to send marketing 
solicitations on behalf of an affiliate if the affiliate would not be 
permitted to send the marketing solicitation as a result of the 
election of the consumer to opt out under this subpart;
    (4) In response to a communication about your products or services 
initiated by the consumer;
    (5) In response to an authorization or request by the consumer to 
receive solicitations; or
    (6) If your compliance with this subpart would prevent you from 
complying with any provision of State insurance laws pertaining to 
unfair discrimination in any State in which you are lawfully doing 
business.
    (d) Examples of exceptions. (1) Example of the pre-existing 
business relationship exception. A consumer has a brokerage account 
with a broker-dealer. The consumer also has a deposit account with the 
broker-dealer's affiliated depository institution. The broker-dealer 
receives eligibility information about the consumer from its depository 
institution affiliate and uses that information to make a marketing 
solicitation to the consumer about the broker-dealer's college savings 
accounts. The broker-dealer may make this marketing solicitation even 
if the consumer has not been given a notice and opportunity to opt out 
because the broker-dealer has a pre-existing business relationship with 
the consumer.
    (2) Examples of service provider exception. (i) A consumer has a 
brokerage account with a broker-dealer. The broker-dealer furnishes 
eligibility information about the consumer to its affiliate, a 
registered investment adviser. Based on that eligibility information, 
the investment adviser wants to make a marketing solicitation to the 
consumer about its advisory services. The investment adviser does not 
have a pre-existing business relationship with the consumer and none of 
the other exceptions in paragraph (c) of this section apply. The 
consumer has been given an opt out notice and has elected to opt out of 
receiving such marketing solicitations. The investment adviser asks a 
service provider to send the marketing solicitation to the consumer on 
its behalf. The service provider may not send the marketing 
solicitation on behalf of the investment adviser because, as a result 
of the consumer's opt out election, the investment adviser is not 
permitted to make the marketing solicitation.
    (ii) The same facts as in paragraph (d)(2)(i) of this section, 
except the consumer has been given an opt out notice, but has not 
elected to opt out. The investment adviser asks a service provider to 
send the solicitation to the consumer on its behalf. The service 
provider may send the marketing solicitation on behalf of the 
investment adviser because, as a result of the consumer's not opting 
out, the investment adviser is permitted to make the marketing 
solicitation.
    (3) Examples of consumer-initiated communications. (i) A consumer 
who is the record owner of shares in an investment company initiates a 
communication with an affiliated registered investment adviser about 
advisory services. The affiliated investment adviser may use 
eligibility information about the consumer it obtains from the 
investment company or any other affiliate to make marketing 
solicitations regarding the affiliated investment adviser's services in 
response to the consumer-initiated communication.
    (ii) A consumer who has a brokerage account with a broker-dealer 
contacts the broker-dealer to request information about how to save and 
invest for a child's college education without specifying the type of 
savings or investment vehicle in which the consumer may be interested. 
Information about a range of different products or services offered by 
the broker-dealer and one or more of its affiliates may be responsive 
to that communication. Such products, services, and investments may 
include the following: investments in affiliated investment companies; 
investments in section 529 plans offered by the broker-dealer; or trust 
services offered by a different financial institution in the affiliated 
group. Any affiliate offering products or services that would be 
responsive to the consumer's request for information about saving and 
investing for a child's college education may use eligibility 
information to make marketing solicitations to the consumer in response 
to this communication.
    (iii) A registered investment adviser makes a marketing call to the 
consumer without using eligibility information received from an 
affiliate. The investment adviser leaves a voice-mail message that 
invites the consumer to call a toll-free number to receive information 
about services offered by the investment adviser. If the consumer calls 
the toll-free number to inquire about the investment advisory services, 
the call is a consumer-initiated communication about a product or 
service, and the investment adviser may now use eligibility information 
it receives from its affiliates to make marketing solicitations to the 
consumer.
    (iv) A consumer calls a broker-dealer to ask about retail locations 
and hours, but does not request information about

[[Page 40436]]

its products or services. The broker-dealer may not use eligibility 
information it receives from an affiliate to make marketing 
solicitations to the consumer because the consumer-initiated 
communication does not relate to the broker-dealer's products or 
services. Thus, the use of eligibility information received from an 
affiliate would not be responsive to the communication and the 
exception does not apply.
    (v) A consumer calls a broker-dealer to ask about retail locations 
and hours. The customer service representative asks the consumer if 
there is a particular product or service about which the consumer is 
seeking information. The consumer responds that the consumer wants to 
stop in and find out about mutual funds (i.e., registered open-end 
investment companies). The customer service representative offers to 
provide that information by telephone and mail additional information 
to the consumer. The consumer agrees and provides or confirms contact 
information for receipt of the materials to be mailed. The broker-
dealer may use eligibility information it receives from an affiliate to 
make marketing solicitations to the consumer about mutual funds because 
such marketing solicitations would respond to the consumer-initiated 
communication about mutual funds.
    (4) Examples of consumer authorization or request for marketing 
solicitations. (i) A consumer who has a brokerage account with a 
broker-dealer authorizes or requests information about life insurance 
offered by the broker-dealer's insurance affiliate. The authorization 
or request, whether given to the broker-dealer or the insurance 
affiliate, would permit the insurance affiliate to use eligibility 
information about the consumer it obtains from the broker-dealer or any 
other affiliate to make marketing solicitations to the consumer about 
life insurance.
    (ii) A consumer completes an online application to open an online 
brokerage account with a broker-dealer. The broker-dealer's online 
application contains a blank check box that the consumer may check to 
authorize or request information from the broker-dealer's affiliates. 
The consumer checks the box. The consumer has authorized or requested 
marketing solicitations from the broker-dealer's affiliates.
    (iii) A consumer completes an online application to open an online 
brokerage account with a broker-dealer. The broker-dealer's online 
application contains a check box indicating that the consumer 
authorizes or requests information from the broker-dealer's affiliates. 
The consumer does not deselect the check box. The consumer has not 
authorized or requested marketing solicitations from the broker-
dealer's affiliates.
    (iv) The terms and conditions of a brokerage account agreement 
contain preprinted boilerplate language stating that by applying to 
open an account the consumer authorizes or requests to receive 
solicitations from the broker-dealer's affiliates. The consumer has not 
authorized or requested marketing solicitations from the broker-
dealer's affiliates.
    (e) Relation to affiliate-sharing notice and opt out. Nothing in 
this subpart limits the responsibility of a person to comply with the 
notice and opt out provisions of Section 603(d)(2)(A)(iii) of the FCRA 
(15 U.S.C. 1681a(d)(2)(A)(iii)) where applicable.


Sec.  248.122  Scope and duration of opt out.

    (a) Scope of opt out. (1) In general. Except as otherwise provided 
in this section, the consumer's election to opt out prohibits any 
affiliate covered by the opt out notice from using eligibility 
information received from another affiliate as described in the notice 
to make marketing solicitations to the consumer.
    (2) Continuing relationship. (i) In general. If the consumer 
establishes a continuing relationship with you or your affiliate, an 
opt out notice may apply to eligibility information obtained in 
connection with:
    (A) A single continuing relationship or multiple continuing 
relationships that the consumer establishes with you or your 
affiliates, including continuing relationships established subsequent 
to delivery of the opt out notice, so long as the notice adequately 
describes the continuing relationships covered by the opt out; or
    (B) Any other transaction between the consumer and you or your 
affiliates as described in the notice.
    (ii) Examples of continuing relationships. A consumer has a 
continuing relationship with you or your affiliate if the consumer:
    (A) Opens a brokerage account or enters into an advisory contract 
with you or your affiliate;
    (B) Obtains a loan for which you or your affiliate owns the 
servicing rights;
    (C) Purchases investment company shares in his or her own name;
    (D) Holds an investment through you or your affiliate; such as when 
you act or your affiliate acts as a custodian for securities or for 
assets in an individual retirement arrangement;
    (E) Enters into an agreement or understanding with you or your 
affiliate whereby you or your affiliate undertakes to arrange or broker 
a home mortgage loan for the consumer;
    (F) Enters into a lease of personal property with you or your 
affiliate; or
    (G) Obtains financial, investment, or economic advisory services 
from you or your affiliate for a fee.
    (3) No continuing relationship. (i) In general. If there is no 
continuing relationship between a consumer and you or your affiliate, 
and you or your affiliate obtain eligibility information about a 
consumer in connection with a transaction with the consumer, such as an 
isolated transaction or an application that is denied, an opt out 
notice provided to the consumer only applies to eligibility information 
obtained in connection with that transaction.
    (ii) Examples of isolated transactions. An isolated transaction 
occurs if:
    (A) The consumer uses your or your affiliate's ATM to withdraw cash 
from an account at another financial institution; or
    (B) A broker-dealer opens a brokerage account for the consumer 
solely for the purpose of liquidating or purchasing securities as an 
accommodation, i.e., on a one-time basis, without the expectation of 
engaging in other transactions.
    (4) Menu of alternatives. A consumer may be given the opportunity 
to choose from a menu of alternatives when electing to prohibit 
solicitations, such as by electing to prohibit solicitations from 
certain types of affiliates covered by the opt out notice but not other 
types of affiliates covered by the notice, electing to prohibit 
marketing solicitations based on certain types of eligibility 
information but not other types of eligibility information, or electing 
to prohibit marketing solicitations by certain methods of delivery but 
not other methods of delivery. However, one of the alternatives must 
allow the consumer to prohibit all marketing solicitations from all of 
the affiliates that are covered by the notice.
    (5) Special rule for a notice following termination of all 
continuing relationships. (i) In general. A consumer must be given a 
new opt out notice if, after all continuing relationships with you or 
your affiliate(s) are terminated, the consumer subsequently establishes 
another continuing relationship with you or your affiliate(s) and the 
consumer's eligibility information is to be used to make a marketing 
solicitation. The new opt out notice must apply, at a minimum, to 
eligibility information obtained in connection with the new continuing 
relationship. Consistent with paragraph (b) of this section, the 
consumer's decision not to opt out after receiving the new opt out

[[Page 40437]]

notice would not override a prior opt out election by the consumer that 
applies to eligibility information obtained in connection with a 
terminated relationship, regardless of whether the new opt out notice 
applies to eligibility information obtained in connection with the 
terminated relationship.
    (ii) Example. A consumer has an advisory contract with a company 
that is registered with the Commission as both a broker-dealer and an 
investment adviser, and that is part of an affiliated group. The 
consumer terminates the advisory contract. One year after terminating 
the advisory contract, the consumer opens a brokerage account with the 
same company. The consumer must be given a new notice and opportunity 
to opt out before the company's affiliates may make marketing 
solicitations to the consumer using eligibility information obtained by 
the company in connection with the new brokerage account relationship, 
regardless of whether the consumer opted out in connection with the 
advisory contract.
    (b) Duration of opt out. The election of a consumer to opt out must 
be effective for a period of at least five years (the ``opt out 
period'') beginning when the consumer's opt out election is received 
and implemented, unless the consumer subsequently revokes the opt out 
in writing or, if the consumer agrees, electronically. An opt out 
period of more than five years may be established, including an opt out 
period that does not expire unless revoked by the consumer.
    (c) Time of opt out. A consumer may opt out at any time.


Sec.  248.123  Contents of opt out notice; consolidated and equivalent 
notices.

    (a) Contents of opt out notice. (1) In general. A notice must be 
clear, conspicuous, and concise, and must accurately disclose:
    (i) The name of the affiliate(s) providing the notice. If the 
notice is provided jointly by multiple affiliates and each affiliate 
shares a common name, such as ``ABC,'' then the notice may indicate 
that it is being provided by multiple companies with the ABC name or 
multiple companies in the ABC group or family of companies, for 
example, by stating that the notice is provided by ``all of the ABC 
companies,'' ``the ABC banking, credit card, insurance, and securities 
companies,'' or by listing the name of each affiliate providing the 
notice. But if the affiliates providing the joint notice do not all 
share a common name, then the notice must either separately identify 
each affiliate by name or identify each of the common names used by 
those affiliates, for example, by stating that the notice is provided 
by ``all of the ABC and XYZ companies'' or by ``the ABC bank and 
securities companies and the XYZ insurance companies'';
    (ii) A list of the affiliates or types of affiliates whose use of 
eligibility information is covered by the notice, which may include 
companies that become affiliates after the notice is provided to the 
consumer. If each affiliate covered by the notice shares a common name, 
such as ``ABC,'' then the notice may indicate that it applies to 
multiple companies with the ABC name or multiple companies in the ABC 
group or family of companies, for example, by stating that the notice 
is provided by ``all of the ABC companies,'' ``the ABC banking, credit 
card, insurance, and securities companies,'' or by listing the name of 
each affiliate providing the notice. But if the affiliates covered by 
the notice do not all share a common name, then the notice must either 
separately identify each covered affiliate by name or identify each of 
the common names used by those affiliates, for example, by stating that 
the notice applies to ``all of the ABC and XYZ companies'' or to ``the 
ABC banking and securities companies and the XYZ insurance companies'';
    (iii) A general description of the types of eligibility information 
that may be used to make marketing solicitations to the consumer;
    (iv) That the consumer may elect to limit the use of eligibility 
information to make marketing solicitations to the consumer;
    (v) That the consumer's election will apply for the specified 
period of time stated in the notice and, if applicable, that the 
consumer will be allowed to renew the election once that period 
expires;
    (vi) If the notice is provided to consumers who may have previously 
opted out, such as if a notice is provided to consumers annually, that 
the consumer who has chosen to limit marketing solicitations does not 
need to act again until the consumer receives a renewal notice; and
    (vii) A reasonable and simple method for the consumer to opt out.
    (2) Joint relationships. (i) If two or more consumers jointly 
obtain a product or service, a single opt out notice may be provided to 
the joint consumers. Any of the joint consumers may exercise the right 
to opt out.
    (ii) The opt out notice must explain how an opt out direction by a 
joint consumer will be treated. An opt out direction by a joint 
consumer may be treated as applying to all of the associated joint 
consumers, or each joint consumer may be permitted to opt out 
separately. If each joint consumer is permitted to opt out separately, 
one of the joint consumers must be permitted to opt out on behalf of 
all of the joint consumers and the joint consumers must be permitted to 
exercise their separate rights to opt out in a single response.
    (iii) It is impermissible to require all joint consumers to opt out 
before implementing any opt out direction.
    (3) Alternative contents. If the consumer is afforded a broader 
right to opt out of receiving marketing than is required by this 
subpart, the requirements of this section may be satisfied by providing 
the consumer with a clear, conspicuous, and concise notice that 
accurately discloses the consumer's opt out rights.
    (4) Model notices. Model notices are provided in the Appendix to 
this subpart.
    (b) Coordinated and consolidated notices. A notice required by this 
subpart may be coordinated and consolidated with any other notice or 
disclosure required to be issued under any other provision of law by 
the entity providing the notice, including but not limited to the 
notice described in section 603(d)(2)(A)(iii) of the FCRA (15 U.S.C. 
1681a(d)(2)(A)(iii)) and the GLBA privacy notice.
    (c) Equivalent notices. A notice or other disclosure that is 
equivalent to the notice required by this subpart, and that is provided 
to a consumer together with disclosures required by any other provision 
of law, satisfies the requirements of this section.


Sec.  248.124  Reasonable opportunity to opt out.

    (a) In general. You must not use eligibility information that you 
receive from an affiliate to make marketing solicitations to a consumer 
about your products or services unless the consumer is provided a 
reasonable opportunity to opt out, as required by Sec.  
248.121(a)(1)(ii).
    (b) Examples of a reasonable opportunity to opt out. The consumer 
is given a reasonable opportunity to opt out if:
    (1) By mail. The opt out notice is mailed to the consumer. The 
consumer is given 30 days from the date the notice is mailed to elect 
to opt out by any reasonable means.
    (2) By electronic means. (i) The opt out notice is provided 
electronically to the consumer, such as by posting the notice at an 
Internet Web site at which the consumer has obtained a product or

[[Page 40438]]

service. The consumer acknowledges receipt of the electronic notice. 
The consumer is given 30 days after the date the consumer acknowledges 
receipt to elect to opt out by any reasonable means.
    (ii) The opt out notice is provided to the consumer by e-mail where 
the consumer has agreed to receive disclosures by e-mail from the 
person sending the notice. The consumer is given 30 days after the e-
mail is sent to elect to opt out by any reasonable means.
    (3) At the time of an electronic transaction. The opt out notice is 
provided to the consumer at the time of an electronic transaction, such 
as a transaction conducted on an Internet Web site. The consumer is 
required to decide, as a necessary part of proceeding with the 
transaction, whether to opt out before completing the transaction. 
There is a simple process that the consumer may use to opt out at that 
time using the same mechanism through which the transaction is 
conducted.
    (4) At the time of an in-person transaction. The opt out notice is 
provided to the consumer in writing at the time of an in-person 
transaction. The consumer is required to decide, as a necessary part of 
proceeding with the transaction, whether to opt out before completing 
the transaction, and is not permitted to complete the transaction 
without making a choice. There is a simple process that the consumer 
may use during the course of the in-person transaction to opt out, such 
as completing a form that requires consumers to write a ``yes'' or 
``no'' to indicate their opt out preference or that requires the 
consumer to check one of two blank check boxes--one that allows 
consumers to indicate that they want to opt out and one that allows 
consumers to indicate that they do not want to opt out.
    (5) By including in a privacy notice. The opt out notice is 
included in a GLBA privacy notice. The consumer is allowed to exercise 
the opt out within a reasonable period of time and in the same manner 
as the opt out under that privacy notice.


Sec.  248.125  Reasonable and simple methods of opting out.

    (a) In general. You must not use eligibility information about a 
consumer that you receive from an affiliate to make a marketing 
solicitation to the consumer about your products or services, unless 
the consumer is provided a reasonable and simple method to opt out, as 
required by Sec.  248.121(a)(1)(ii).
    (b) Examples. (1) Reasonable and simple opt out methods. Reasonable 
and simple methods for exercising the opt out right include:
    (i) Designating a check-off box in a prominent position on the opt 
out form;
    (ii) Including a reply form and a self-addressed envelope together 
with the opt out notice;
    (iii) Providing an electronic means to opt out, such as a form that 
can be electronically mailed or processed at an Internet Web site, if 
the consumer agrees to the electronic delivery of information;
    (iv) Providing a toll-free telephone number that consumers may call 
to opt out; or
    (v) Allowing consumers to exercise all of their opt out rights 
described in a consolidated opt out notice that includes the GLBA 
privacy, FCRA affiliate sharing, and FCRA affiliate marketing opt outs, 
by a single method, such as by calling a single toll-free telephone 
number.
    (2) Opt out methods that are not reasonable and simple. Reasonable 
and simple methods for exercising an opt out right do not include:
    (i) Requiring the consumer to write his or her own letter;
    (ii) Requiring the consumer to call or write to obtain a form for 
opting out, rather than including the form with the opt out notice; or
    (iii) Requiring the consumer who receives the opt out notice in 
electronic form only, such as through posting at an Internet Web site, 
to opt out solely by paper mail or by visiting a different Web site 
without providing a link to that site.
    (c) Specific opt out means. Each consumer may be required to opt 
out through a specific means, as long as that means is reasonable and 
simple for that consumer.


Sec.  248.126  Delivery of opt out notices.

    (a) In general. The opt out notice must be provided so that each 
consumer can reasonably be expected to receive actual notice. For opt 
out notices provided electronically, the notice may be provided in 
compliance with either the electronic disclosure provisions in this 
subpart or the provisions in section 101 of the Electronic Signatures 
in Global and National Commerce Act, 15 U.S.C. 7001, et seq.
    (b) Examples of reasonable expectation of actual notice. A consumer 
may reasonably be expected to receive actual notice if the affiliate 
providing the notice:
    (1) Hand-delivers a printed copy of the notice to the consumer;
    (2) Mails a printed copy of the notice to the last known mailing 
address of the consumer;
    (3) Provides a notice by e-mail to a consumer who has agreed to 
receive electronic disclosures by e-mail from the affiliate providing 
the notice; or
    (4) Posts the notice on the Internet Web site at which the consumer 
obtained a product or service electronically and requires the consumer 
to acknowledge receipt of the notice.
    (c) Examples of no reasonable expectation of actual notice. A 
consumer may not reasonably be expected to receive actual notice if the 
affiliate providing the notice:
    (1) Only posts the notice on a sign in a branch or office or 
generally publishes the notice in a newspaper;
    (2) Sends the notice by e-mail to a consumer who has not agreed to 
receive electronic disclosures by e-mail from the affiliate providing 
the notice; or
    (3) Posts the notice on an Internet Web site without requiring the 
consumer to acknowledge receipt of the notice.


Sec.  248.127  Renewal of opt out elections.

    (a) Renewal notice and opt out requirement. (1) In general. After 
the opt out period expires, you may not make marketing solicitations to 
a consumer who previously opted out, unless:
    (i) The consumer has been given a renewal notice that complies with 
the requirements of this section and Sec. Sec.  248.124 through 
248.126, and a reasonable opportunity and a reasonable and simple 
method to renew the opt out, and the consumer does not renew the opt 
out; or
    (ii) An exception in Sec.  248.121(c) applies.
    (2) Renewal period. Each opt out renewal must be effective for a 
period of at least five years as provided in Sec.  248.122(b).
    (3) Affiliates who may provide the notice. The notice required by 
this paragraph must be provided:
    (i) By the affiliate that provided the previous opt out notice, or 
its successor; or
    (ii) As part of a joint renewal notice from two or more members of 
an affiliated group of companies, or their successors, that jointly 
provided the previous opt out notice.
    (b) Contents of renewal notice. The renewal notice must be clear, 
conspicuous, and concise, and must accurately disclose:
    (1) The name of the affiliate(s) providing the notice. If the 
notice is provided jointly by multiple affiliates and each affiliate 
shares a common name, such as ``ABC,'' then the notice may indicate it 
is being provided by multiple companies with the ABC name

[[Page 40439]]

or multiple companies in the ABC group or family of companies, for 
example, by stating that the notice is provided by ``all of the ABC 
companies,'' ``the ABC banking, credit card, insurance, and securities 
companies,'' or by listing the name of each affiliate providing the 
notice. But if the affiliates providing the joint notice do not all 
share a common name, then the notice must either separately identify 
each affiliate by name or identify each of the common names used by 
those affiliates, for example, by stating that the notice is provided 
by ``all of the ABC and XYZ companies'' or by ``the ABC banking and 
securities companies and the XYZ insurance companies'';
    (2) A list of the affiliates or types of affiliates whose use of 
eligibility information is covered by the notice, which may include 
companies that become affiliates after the notice is provided to the 
consumer. If each affiliate covered by the notice shares a common name, 
such as ``ABC,'' then the notice may indicate that it applies to 
multiple companies with the ABC name or multiple companies in the ABC 
group or family of companies, for example, by stating that the notice 
is provided by ``all of the ABC companies,'' ``the ABC banking, credit 
card, insurance, and securities companies,'' or by listing the name of 
each affiliate providing the notice. But if the affiliates covered by 
the notice do not all share a common name, then the notice must either 
separately identify each covered affiliate by name or identify each of 
the common names used by those affiliates, for example, by stating that 
the notice applies to ``all of the ABC and XYZ companies'' or to ``the 
ABC banking and securities companies and the XYZ insurance companies'';
    (3) A general description of the types of eligibility information 
that may be used to make marketing solicitations to the consumer;
    (4) That the consumer previously elected to limit the use of 
certain information to make marketing solicitations to the consumer;
    (5) That the consumer's election has expired or is about to expire;
    (6) That the consumer may elect to renew the consumer's previous 
election;
    (7) If applicable, that the consumer's election to renew will apply 
for the specified period of time stated in the notice and that the 
consumer will be allowed to renew the election once that period 
expires; and
    (8) A reasonable and simple method for the consumer to opt out.
    (c) Timing of the renewal notice. (1) In general. A renewal notice 
may be provided to the consumer either:
    (i) A reasonable period of time before the expiration of the opt 
out period; or
    (ii) Any time after the expiration of the opt out period but before 
marketing solicitations that would have been prohibited by the expired 
opt out are made to the consumer.
    (2) Combination with annual privacy notice. If you provide an 
annual privacy notice under the GLBA, providing a renewal notice with 
the last annual privacy notice provided to the consumer before 
expiration of the opt out period is a reasonable period of time before 
expiration of the opt out in all cases.
    (d) No effect on opt out period. An opt out period may not be 
shortened by sending a renewal notice to the consumer before expiration 
of the opt out period, even if the consumer does not renew the opt out.


Sec.  248.128  Effective date, compliance date, and prospective 
application.

    (a) Effective date. This subpart is effective September 10, 2009.
    (b) Mandatory compliance date. Compliance with this subpart is 
required not later than January 1, 2010.
    (c) Prospective application. The provisions of this subpart do not 
prohibit you from using eligibility information that you receive from 
an affiliate to make a marketing solicitation to a consumer if you 
receive such information prior to January 1, 2010. For purposes of this 
section, you are deemed to receive eligibility information when such 
information is placed into a common database and is accessible by you.

Appendix to Subpart B--Model Forms

    a. Although you and your affiliates are not required to use the 
model forms in this Appendix, use of a model form (if applicable to 
each person that uses it) complies with the requirement in section 
624 of the FCRA for clear, conspicuous, and concise notices.
    b. Although you may need to change the language or format of a 
model form to reflect your actual policies and procedures, any such 
changes may not be so extensive as to affect the substance, clarity, 
or meaningful sequence of the language in the model forms. 
Acceptable changes include, for example:
    1. Rearranging the order of the references to ``your income,'' 
``your account history,'' and ``your credit score.''
    2. Substituting other types of information for ``income,'' 
``account history,'' or ``credit score'' for accuracy, such as 
``payment history,'' ``credit history,'' ``payoff status,'' or 
``claims history.''
    3. Substituting a clearer and more accurate description of the 
affiliates providing or covered by the notice for phrases such as 
``the [ABC] group of companies.''
    4. Substituting other types of affiliates covered by the notice 
for ``credit card,'' ``insurance,'' or ``securities'' affiliates.
    5. Omitting items that are not accurate or applicable. For 
example, if a person does not limit the duration of the opt out 
period, the notice may omit information about the renewal notice.
    6. Adding a statement informing the consumer how much time they 
have to opt out before shared eligibility information may be used to 
make solicitations to them.
    7. Adding a statement that the consumer may exercise the right 
to opt out at any time.
    8. Adding the following statement, if accurate: ``If you 
previously opted out, you do not need to do so again.''
    9. Providing a place on the form for the consumer to fill in 
identifying information, such as his or her name and address.
    10. Adding disclosures regarding the treatment of opt-outs by 
joint consumers to comply with Sec.  248.123(a)(2), if applicable.

A-1--Model Form for Initial Opt Out Notice (Single-Affiliate Notice)

A-2--Model Form for Initial Opt Out Notice (Joint Notice)

A-3--Model Form for Renewal Notice (Single-Affiliate Notice)

A-4--Model Form for Renewal Notice (Joint Notice)

A-5--Model Form for Voluntary ``No Marketing'' Notice

A-1--Model Form for Initial Opt Out Notice (Single-Affiliate Notice)--
[Your Choice to Limit Marketing]/[Marketing Opt Out]

    <bullet> [Name of Affiliate] is providing this notice.
    <bullet> [Optional: Federal law gives you the right to limit 
some but not all marketing from our affiliates. Federal law also 
requires us to give you this notice to tell you about your choice to 
limit marketing from our affiliates.]
    <bullet> You may limit our affiliates in the [ABC] group of 
companies, such as our [investment adviser, broker, transfer agent, 
and investment company] affiliates, from marketing their products or 
services to you based on your personal information that we collect 
and share with them. This information includes your [income], your 
[account history with us], and your [credit score].
    <bullet> Your choice to limit marketing offers from our 
affiliates will apply [until you tell us to change your choice]/[for 
x years from when you tell us your choice]/[for at least 5 years 
from when you tell us your choice]. [Include if the opt out period 
expires.] Once that period expires, you will receive a renewal 
notice that will allow you to continue to limit marketing offers 
from our affiliates for [another x years]/[at least another 5 
years].
    <bullet> [Include, if applicable, in a subsequent notice, 
including an annual notice, for consumers who may have previously 
opted out.] If you have already made a choice to limit marketing 
offers from our affiliates, you do not need to act again until you 
receive the renewal notice.
    To limit marketing offers, contact us [include all that apply]:
    <bullet> By telephone: 1-877-<greek-i><greek-i><greek-i>-
<greek-i><greek-i><greek-i><greek-i>
    <bullet> On the Web: www._.com
    <bullet> By mail: check the box and complete the form below, and 
send the form to:

[Company name]


[[Page 40440]]


[Company address]

    [ballot] Do not allow your affiliates to use my personal 
information to market to me.

A-2--Model Form for Initial Opt Out Notice (Joint Notice)--[Your Choice 
to Limit Marketing]/[Marketing Opt Out]

    <bullet> The [ABC group of companies] is providing this notice.
    <bullet> [Optional: Federal law gives you the right to limit 
some but not all marketing from the [ABC] companies. Federal law 
also requires us to give you this notice to tell you about your 
choice to limit marketing from the [ABC] companies.]
    <bullet> You may limit the [ABC] companies, such as the [ABC 
investment companies, investment advisers, transfer agents, and 
broker-dealers] affiliates, from marketing their products or 
services to you based on your personal information that they receive 
from other [ABC] companies. This information includes your [income], 
your [account history], and your [credit score].
    <bullet> Your choice to limit marketing offers from the [ABC] 
companies will apply [until you tell us to change your choice]/[for 
x years from when you tell us your choice]/[for at least 5 years 
from when you tell us your choice]. [Include if the opt out period 
expires.] Once that period expires, you will receive a renewal 
notice that will allow you to continue to limit marketing offers 
from the [ABC] companies for [another x years]/[at least another 5 
years].
    <bullet> [Include, if applicable, in a subsequent notice, 
including an annual notice, for consumers who may have previously 
opted out.] If you have already made a choice to limit marketing 
offers from the [ABC] companies, you do not need to act again until 
you receive the renewal notice.
    To limit marketing offers, contact us [include all that apply]:
    <bullet> By telephone: 1-877-<greek-i><greek-i><greek-i>-
<greek-i><greek-i><greek-i><greek-i>
    <bullet> On the Web: www._.com
    <bullet> By mail: check the box and complete the form below, and 
send the form to:

[Company name]

[Company address]

    [ballot] Do not allow any company [in the ABC group of 
companies] to use my personal information to market to me.

A-3--Model Form for Renewal Notice (Single-Affiliate Notice)--[Renewing 
Your Choice to Limit Marketing]/[Renewing Your Marketing Opt Out]

    <bullet> [Name of Affiliate] is providing this notice.
    <bullet> [Optional: Federal law gives you the right to limit 
some but not all marketing from our affiliates. Federal law also 
requires us to give you this notice to tell you about your choice to 
limit marketing from our affiliates.]
    <bullet> You previously chose to limit our affiliates in the 
[ABC] group of companies, such as our [investment adviser, 
investment company, transfer agent, and broker-dealer] affiliates, 
from marketing their products or services to you based on your 
personal information that we share with them. This information 
includes your [income], your [account history with us], and your 
[credit score].
    <bullet> Your choice has expired or is about to expire.
    To renew your choice to limit marketing for [x] more years, 
contact us [include all that apply]:
    <bullet> By telephone: 1-877-<greek-i><greek-i><greek-i>-
<greek-i><greek-i><greek-i><greek-i>
    <bullet> On the Web: www._.com
    <bullet> By mail: check the box and complete the form below, and 
send the form to:

[Company name]

[Company address]

    [ballot] Renew my choice to limit marketing for [x] more years.

A-4--Model Form for Renewal Notice (Joint Notice)--[Renewing Your 
Choice to Limit Marketing]/[Renewing Your Marketing Opt Out]

    <bullet> The [ABC group of companies] is providing this notice.
    <bullet> [Optional: Federal law gives you the right to limit 
some but not all marketing from the [ABC] companies. Federal law 
also requires us to give you this notice to tell you about your 
choice to limit marketing from the [ABC] companies.]
    <bullet> You previously chose to limit the [ABC] companies, such 
as the [ABC investment adviser, investment company, transfer agent, 
and broker-dealer] affiliates, from marketing their products or 
services to you based on your personal information that they receive 
from other ABC companies. This information includes your [income], 
your [account history], and your [credit score].
    <bullet> Your choice has expired or is about to expire.
    To renew your choice to limit marketing for [x] more years, 
contact us [include all that apply]:
    <bullet> By telephone: 1-877-<greek-i><greek-i><greek-i>-
<greek-i><greek-i><greek-i><greek-i>
    <bullet> On the Web: www._.com
    <bullet> By mail: check the box and complete the form below, and 
send the form to:

[Company name]

[Company address]

    [ballot] Renew my choice to limit marketing for [x] more years.

A-5--Model Form for Voluntary ``No Marketing'' Notice--Your Choice to 
Stop Marketing

    <bullet> [Name of Affiliate] is providing this notice.
    <bullet> You may choose to stop all marketing from us and our 
affiliates.
    <bullet> [Your choice to stop marketing from us and our 
affiliates will apply until you tell us to change your choice.]
    To stop all marketing, contact us [include all that apply]:
    <bullet> By telephone: 1-877-<greek-i><greek-i><greek-i>-
<greek-i><greek-i><greek-i><greek-i>
    <bullet> On the Web: www._.com
    <bullet> By mail: check the box and complete the form below, and 
send the form to:

[Company name]

[Company address]

    [ballot] Do not market to me.

    Dated: August 4, 2009.

    By the Commission.
Elizabeth M. Murphy,
Secretary.
[FR Doc. E9-19020 Filed 8-10-09; 8:45 am]
BILLING CODE 8010-01-P