NASAA Series 63 — All Questions

Which set of elements must a covered firm's Identity Theft Prevention Program under Regulation S-ID include?

• a.Identifying relevant red flags, detecting them, responding appropriately, and updating the program periodically✓
• b.Identifying red flags and then filing each red flag detected with the SEC within five business days of detection
• c.Credit reports on every customer, annual fingerprinting of all account holders, and a dedicated telephone hotline for fraud
• d.Closing any account that triggers a red flag

Regulation S-ID requires reasonable policies and procedures to identify relevant red flags for the covered accounts, detect them, respond appropriately to prevent and mitigate identity theft, and update the program periodically for changes in risk. Reporting each flag to the SEC and automatic closure are not requirements.17 CFR 248.201(d)(2)

Which entity is within the scope of the SEC's Regulation S-ID identity theft rule?

• a.A state-registered investment adviser that is not registered or required to be registered under the federal act at all
• b.A bank that offers custody
• c.An investment adviser that is registered or required to be registered under the federal Investment Advisers Act✓
• d.An issuer of securities that has never opened an account for any customer but sells its own shares to the public

Regulation S-ID applies to financial institutions or creditors that are broker-dealers or other persons registered or required to be registered under the Exchange Act, registered investment companies and certain related entities, and investment advisers registered or required to be registered under the Advisers Act. A state-only adviser, an issuer with no accounts and a bank are not in the listed categories.17 CFR 248.201(a)

Under Regulation S-P, a covered institution learns of an incident of unauthorized access to customer information. Which procedures must its response program include?

• a.Closing all customer accounts until the incident has been resolved
• b.Offering every affected individual a refund of the fees paid during the past year as compensation for the unauthorized access or loss
• c.Assessing the nature and scope of the incident, containing and controlling it, and notifying affected individuals as required✓
• d.Publishing a notice about the incident in a local newspaper

The response program must include procedures to assess the nature and scope of the incident and the systems and information involved, take appropriate steps to contain and control it, and notify each affected individual whose sensitive customer information was or is reasonably likely to have been accessed, unless a reasonable investigation shows it has not been and is not reasonably likely to be misused in a way that causes substantial harm. Refunds, account closures and newspaper notices are not part of the rule.17 CFR 248.30(a)(3)