NASAA Series 63 — All Questions

An adviser hires a portfolio manager from another firm and wants to advertise the manager's results at the prior firm. Which condition applies to this predecessor performance?

• a.The manager must have left the prior firm at least a year before joining the advertising adviser as an employee
• b.The people primarily responsible for the earlier results must now manage accounts at the advertising adviser✓
• c.The former employer must give written consent to the advertisement before the new adviser may publish the figures
• d.The results must be shown only as gross performance with no fee deduction, to keep them comparable to the prior firm

Predecessor performance may be advertised only if the people primarily responsible for the results manage accounts at the advertising adviser, the earlier accounts are sufficiently similar to the new ones, all substantially similar accounts are included unless leaving some out neither raises results materially nor changes the required time periods, and the advertisement clearly says the results came from another entity. A former employer's consent and a waiting period are not part of the rule, and gross-only figures would violate the net performance requirement.NASAA Model Rule 102(a)(4)-1(m)(4)(vii)

An adviser advertises a composite of its growth strategy accounts but leaves out two accounts that did poorly. When may related performance leave out related portfolios?

• a.Whenever the omitted clients were told in writing
• b.Whenever the omitted accounts have been open for under three years
• c.Only if the advertised results are not materially higher than with all included and the required time periods are not altered✓
• d.Whenever the omitted accounts are footnoted in the advertisement and make up less than ten percent of the strategy's assets under management

Related performance must include all related portfolios, meaning those with substantially similar policies, objectives and strategies. Exclusion is allowed only if the results are not materially higher than if all were included and the exclusion does not change the one-, five- and ten-year presentation. A footnote, an asset-size cutoff or notice to clients does not satisfy that test.NASAA Model Rule 102(a)(4)-1(m)(4)(iv)

An adviser calculates net performance for an advertisement. Which cost may the adviser leave out when calculating net performance under the model rule?

• a.Fees paid to the underlying investment vehicles held in the account, such as fund expense ratios
• b.Advisory fees the adviser charged the account for managing the portfolio over the whole period shown
• c.Fees paid to a bank or other third party for safekeeping funds and securities (custodian fees)✓
• d.Payments the client reimbursed to the adviser for expenses that the adviser paid on the client's behalf

Net performance is the result after deducting all fees and expenses the client paid or would pay for the adviser's services, including advisory fees, fees of underlying investment vehicles and reimbursements to the adviser. The one stated permission is that net performance may exclude custodian fees paid for safekeeping, because those are not charges for the adviser's services.NASAA Model Rule 102(a)(4)-1(m)(5)(xii)(A)

An advertisement uses a model fee to calculate net performance. Which model fee satisfies the model rule?

• a.A fee equal to the highest fee charged to the intended audience, or one that gives performance no higher than the actual fee would✓
• b.A fee equal to the lowest published fee
• c.A fee equal to the average fee paid by all clients
• d.A fee chosen by the adviser as long as the method used to choose it is disclosed in a footnote placed next to the performance table in the advertisement

When a model fee is used, it must either produce figures no higher than deducting the actual fee, or equal the highest fee charged to the audience that will receive the advertisement. An average or lowest fee could overstate net returns for some readers, and disclosure in a footnote does not make an arbitrary fee acceptable.NASAA Model Rule 102(a)(4)-1(m)(5)(xii)(B)

An adviser advertises a portfolio that started three years ago. Which performance periods must appear, with equal prominence, ending no earlier than the most recent calendar year-end?

• a.Whichever periods the adviser chooses to show, as long as the advertisement notes that the portfolio is new
• b.Only the three-year life of the portfolio, since a portfolio this young is too new to show the standard periods
• c.The one-year and three-year periods, with a projection filling the ten-year period so the table looks complete
• d.The one-year period, with the life of the portfolio shown in place of the five- and ten-year periods✓

For portfolios other than private funds, the rule requires one-, five- and ten-year results with equal prominence, ending no earlier than the latest calendar year-end. If the portfolio did not exist for a prescribed period, the life of the portfolio is substituted for that period. A projection would be hypothetical and a free choice of periods would not be fair and balanced.NASAA Model Rule 102(a)(4)-1(m)(4)(ii)

An adviser's brochure says that clients using its tax-aware strategy 'saved an average of $4,000 a year in taxes.' Which model rule requirement does the statement raise?

• a.The statement must be pre-approved by the Administrator because it concerns money saved
• b.The statement may be used only if each client named in the substantiation has consented in writing
• c.The statement is allowed without support if the brochure says the figures are an estimate
• d.The adviser must have a reasonable basis for believing it can substantiate the material statement of fact on demand by the Administrator✓

An advertisement may not include a material statement of fact that the adviser lacks a reasonable basis to believe it can substantiate if the Administrator asks. Labelling the number an estimate does not remove the duty, and the rule does not require pre-approval or client consent as a substitute for having a basis.NASAA Model Rule 102(a)(4)-1(m)(1)(ii)

An adviser's flyer describes the income and growth a client might receive from its strategy but says nothing about the strategy's risks or limits. What is the problem under the model advertising rule?

• a.Potential benefits may not be discussed without fair and balanced treatment of the material risks and limitations tied to those benefits✓
• b.The flyer is a violation only if a client actually loses money
• c.The flyer needed a client's signed acknowledgment before it could be mailed
• d.The flyer should have named each security the strategy might hold

An advertisement may not discuss potential benefits of the adviser's services or methods without also giving fair and balanced treatment to the material risks or limitations of those benefits. The violation is in the communication itself; it does not depend on a client loss, and no list of holdings or client acknowledgment is required.NASAA Model Rule 102(a)(4)-1(m)(1)(iv)

At a public seminar, an adviser answers questions from the audience live, and none of it is recorded or scripted. Is this an advertisement under the model rule's definition?

• a.No, but only if the seminar is free of charge and the adviser sells nothing to attendees there
• b.Yes, because the adviser is speaking to more than one person about advisory services at the seminar
• c.Yes, unless every member of the audience is already a client of the adviser at the time of the talk
• d.No, because extemporaneous, live, oral communications are excluded from the definition✓

The definition of advertisement covers communications to more than one person that offer advisory services, but it expressly excludes extemporaneous, live, oral communications. A recording or script would be treated differently, and whether the seminar is free or the audience are clients does not change the exclusion.NASAA Model Rule 102(a)(4)-1(m)(5)(i)(A)

A prospect emails an adviser, unprompted, and asks what a model portfolio would have returned. The adviser replies only to that prospect with the projection. Is the reply an advertisement under the model rule?

• a.Yes, because any communication that contains hypothetical performance is always treated as an advertisement, even if sent in reply to a request
• b.No, but only if the prospect is an institutional investor
• c.No, because a communication with hypothetical performance given in response to an unsolicited request is excluded✓
• d.Yes, because the reply promotes the adviser's services to a prospective client who may become a paying customer, whether or not the prospect asked

Communications to a single person are normally outside the definition, but hypothetical performance brings even a one-person communication in. The rule then excludes hypothetical performance provided in response to an unsolicited request from a prospective or current client. The prospect's institutional status is not a condition.NASAA Model Rule 102(a)(4)-1(m)(5)(i)(C)

An adviser mails one prospect, who never asked for anything, a letter offering its services that includes backtested returns for a strategy. Is the letter an advertisement under the model rule?

• a.No, because the letter went to a single person and the definition requires more than one recipient
• b.Yes, because a communication to even one person is an advertisement when it includes hypothetical performance and offers advisory services✓
• c.No, because backtested returns are research and not performance
• d.Yes, but only if the letter is also posted on the adviser's website

An advertisement is ordinarily a communication to more than one person, but the definition reaches one or more persons when the communication includes hypothetical performance and offers advisory services to a prospect. Backtested returns are hypothetical performance, and the exclusion for unsolicited requests does not help because the prospect asked for nothing.NASAA Model Rule 102(a)(4)-1(m)(5)(i)

An adviser's own employee appears in a company video recommending the firm to the public. Which requirement still applies to this testimonial or endorsement?

• a.The employee must disclose that cash or non-cash compensation was provided by the adviser for appearing in the video statement about the firm
• b.The employee's affiliation must be readily apparent or disclosed at the time, and the adviser must document the person's status✓
• c.The employee must state that he or she is a current client
• d.A signed statement of no disciplinary history

The rule excuses partners, officers, directors, employees and controlling or controlled persons from the standard client and compensation disclosures, provided the affiliation is readily apparent or disclosed when the statement is disseminated and the adviser documents the person's status. An employee is not a client, so a current-client statement would be wrong in any case.NASAA Model Rule 102(a)(4)-1(m)(2)(vi)

A man who has never been the adviser's client posts a glowing review of the adviser online. The adviser gives him a small gift card for it. How does the model rule classify the review?

• a.Neither one, because a review of the adviser's services is not a statement about the adviser
• b.A third-party rating, because it was posted by a person independent of the adviser's business
• c.An endorsement, because the statement comes from a person other than a current client✓
• d.A testimonial, because the adviser paid for it and the statement praises the adviser's services

A testimonial is a statement by a current client; an endorsement is a statement by anyone else that approves of, recommends or describes experience with the adviser or refers clients to it. A third-party rating is a rating or ranking by an unrelated person in the ordinary course of business, not an individual's compensated review. Payment does not change the category.NASAA Model Rule 102(a)(4)-1(m)(5)(vi) and (xix)

An adviser wants to cite a third-party rating in its advertisement. Besides the required disclosures, what must the adviser have a reasonable basis to believe about the questionnaire or survey behind the rating?

• a.That it is structured to make favorable and unfavorable responses equally easy and is not designed to produce a predetermined result✓
• b.That the survey covered at least five years of performance
• c.That at least half of the participants surveyed were current clients of the advisers that were rated in that year's survey, as published
• d.That the survey was run by a regulator or an exchange

Before using a third-party rating, the adviser must reasonably believe that the questionnaire or survey is structured so favorable and unfavorable responses are equally easy to give and is not designed to produce a predetermined result. The rating must also disclose its date and period, who created it and any compensation. Nothing requires a regulator to run the survey or a particular number of years.NASAA Model Rule 102(a)(4)-1(m)(3)(i)

A person who gives an endorsement for an adviser is subject to a regulator's order that is not a disqualifying action, and the person is fully complying with the order's terms. What must the advertisement containing the endorsement include?

• a.A statement that the person is permanently barred
• b.The person's full disciplinary history back to the date the person first registered, whether or not the matter is still in effect
• c.Nothing, because compliance removes every disclosure duty
• d.For ten years after the order, a statement that the person is subject to a disciplinary order, with the order or a link to it✓

A matter that would otherwise be a disqualifying event does not make the person ineligible if the person complies with the order's terms, but the advertisement must then, for ten years after the order, state that the person is subject to an order about disciplinary action and include the order or a link to the regulator's website. A lifetime bar statement would be inaccurate, and a full history is not required.NASAA Model Rule 102(a)(4)-1(m)(5)(v)

A small state-registered adviser is exempt from federal registration. It proposes a contract with a fee arrangement that Section 205 of the Investment Advisers Act would prohibit. Under the model rule, does Section 205 reach the contract?

• a.No, because a state may not borrow a federal provision
• b.Yes, the rule applies to all advisers registered or required to be registered under the state act, even those exempt from federal registration✓
• c.Yes, but only if the adviser has more than fifteen clients
• d.No, because Section 205 binds only advisers registered with the SEC

The rule bars entering into, extending or renewing an advisory contract contrary to Section 205 of the federal Act and states that the bar applies to all advisers and representatives registered or required to be registered under the state act, regardless of any federal exemption. The fifteen-client figure has no role in this provision.NASAA Model Rule 102(a)(4)-1(r)

An adviser that is neither registered nor required to be registered with the SEC under Section 203 engages in a deceptive course of business. Does the model rule's reference to Section 206(4) of the Advisers Act apply?

• a.Yes, the rule applies whether or not the adviser is registered or required to be registered under Section 203✓
• b.No, because Section 206(4) reaches only advisers that are registered with the SEC under Section 203 of the federal act
• c.No, since deceptive conduct is purely a federal matter
• d.Yes, but only after the SEC has first brought an enforcement action against the adviser for the same course of business

The rule treats fraudulent, deceptive or manipulative conduct contrary to Section 206(4) of the Advisers Act as unethical, notwithstanding that the adviser is not registered or required to be registered under Section 203. A state need not wait for the SEC to act.NASAA Model Rule 102(a)(4)-1(t)

A state-registered adviser tells an unregistered friend to approach investors and sell advisory services, because the adviser itself may not do so under the act. Which model rule provision does this conduct most directly implicate?

• a.The ban on providing a report prepared by someone else without disclosing that fact to the client
• b.The ban on charging an unreasonable advisory fee that is out of line with the services provided
• c.The ban on borrowing money or securities from a client who is not a broker-dealer or an affiliate
• d.The ban on doing indirectly, or through another person, what would be unlawful to do directly✓

The rule lists engaging in conduct or any act, indirectly or through or by any other person, which would be unlawful for that person to do directly under the act. Using an intermediary does not move the conduct outside the rule. The other provisions concern different practices.NASAA Model Rule 102(a)(4)-1(u)

An adviser's compliance manual contains a policy that regulations require the adviser to have, but the adviser never follows or enforces it. How does the model rule treat this?

• a.As acceptable, because a written manual satisfies the rule even if the adviser never follows or enforces the policies in it in practice
• b.As an unethical business practice, because it lists failing to establish, maintain and enforce a required policy or procedure✓
• c.As an issue only for federal covered advisers, not state-registered advisers
• d.As a recordkeeping matter only, with no ethics consequence unless a client sues

The rule's last listed practice is failing to establish, maintain and enforce a required policy or procedure. Having the written manual is not enough if it is not enforced, and no client complaint or lawsuit is needed.NASAA Model Rule 102(a)(4)-1(w)

Shareholders of a corporation vote, as its charter allows, to merge into another corporation and receive that corporation's stock for their shares. Under the Uniform Securities Act, what is the effect of the class vote on the question of a sale?

• a.The act is a sale only when the new stock is listed
• b.The act is a sale unless the Administrator has approved the merger in advance by a written order for the corporation in the transaction
• c.Each shareholder has made a sale of the old stock for value, and that sale must either be registered or qualify for an exemption
• d.Any act incident to the class vote is not a sale, so the shareholders are not treated as having bought the new stock✓

The Act's definition of sale excludes any act incident to a class vote by stockholders, under the certificate of incorporation or the corporation statute, on a merger, consolidation, reclassification of securities, or sale of corporate assets in consideration of the issuance of securities of another corporation. Because there is no sale, there is nothing to register or exempt.Uniform Securities Act (1956, as amended by NASAA) Sec. 401(k)(6)(C)

A corporation sells shares of its own treasury stock to investors in the state. Under the Act's definition of security, how is treasury stock treated?

• a.It is not a security, because the corporation already issued it once
• b.It is not a security, because it carries no voting rights while held by the corporation
• c.It is a security only if the corporation pays a commission on its sale
• d.It is a security, because the definition lists treasury stock✓

The definition of security specifically lists treasury stock along with stock, bonds, notes, debentures, investment contracts and the other named instruments. Prior issuance and whether a commission is paid do not take it out of the definition.Uniform Securities Act (1956, as amended by NASAA) Sec. 401(m)

Under the Uniform Securities Act, which description of the term 'state' is correct?

• a.Only the fifty states of the Union, which are the jurisdictions that have adopted a securities act of their own
• b.Any state, territory or possession of the United States, the District of Columbia and Puerto Rico✓
• c.The fifty states and the District of Columbia, but not territories, possessions or Puerto Rico under any rule
• d.The fifty states and any foreign country that has adopted a securities act similar to the Uniform Act

The Act defines state broadly to include any state, any territory or possession of the United States, the District of Columbia and Puerto Rico. The definition does not extend to foreign countries, and it does not stop at the fifty states.Uniform Securities Act (1956, as amended by NASAA) Sec. 401(n)

A broker-dealer's employment agreement forbids employees from telling anyone outside the firm about internal matters, and a manager reminds an employee of it after she mentions a possible securities violation to SEC staff. What does SEC Rule 21F-17 say about this?

• a.No person may impede an individual from communicating directly with SEC staff about a possible violation, including by enforcing or threatening to enforce a confidentiality agreement✓
• b.The agreement controls, because contracts take priority over voluntary reports to the SEC
• c.The agreement may be enforced if the firm first notifies its compliance department
• d.The agreement may be enforced as long as the firm pays the employee for her silence

Rule 21F-17(a) says no person may take any action to impede an individual from communicating directly with Commission staff about a possible securities law violation, including enforcing or threatening to enforce a confidentiality agreement. Payment or internal notification does not cure that, and the narrow exception covers information from legal representation, not ordinary workplace matters.17 CFR 240.21F-17(a)

Under Regulation S-P, what is 'sensitive customer information'?

• a.Any component of customer information whose compromise could create a reasonably likely risk of substantial harm or inconvenience to the individual identified✓
• b.Only account numbers and passwords, and nothing else
• c.Any information the firm has chosen to classify as sensitive in its own policies
• d.Only information a customer has marked confidential in writing

Regulation S-P defines sensitive customer information as any component of customer information, alone or with other information, whose compromise could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with it. The test turns on the risk to the person, not on a customer's label or the firm's own labels.17 CFR 248.30(d)(9)(i)

A broker-dealer's cloud vendor suffers a breach, and the firm has a written agreement under which the vendor will send notices to affected customers. Who remains responsible under Regulation S-P for making sure the customers are notified?

• a.The customers' custodian, which must notify the SEC
• b.The responsibility is shared equally between the two, with each liable only for its own half of the affected customers, as agreed
• c.The vendor alone, once the written agreement is signed
• d.The broker-dealer, because the notification obligation rests with the covered institution despite its use of a service provider✓

A covered institution may enter into a written agreement with a service provider to notify affected individuals on its behalf, but the obligation to ensure that they are notified rests with the covered institution. The agreement lets the vendor do the work; it does not shift legal responsibility.17 CFR 248.30(a)(5)(iii)

Which firm is excepted from the Regulation S-P standard on properly disposing of consumer information and customer information?

• a.A notice-registered broker-dealer✓
• b.A broker-dealer that has never had a data breach
• c.A broker-dealer that has fewer than ten employees
• d.A registered investment adviser that keeps all records electronically

The disposal standard applies to every covered institution other than notice-registered broker-dealers, which are firms registered by notice with the SEC under section 15(b)(11) of the Exchange Act. Size, electronic recordkeeping and breach history are not exceptions.17 CFR 248.30(b)(1)

Under Regulation S-ID, which account is a 'covered account' that a broker-dealer must address in its identity theft program?

• a.A consumer brokerage account that permits multiple payments or transactions, such as wire transfers to third parties✓
• b.Only an account that has already been the target of identity theft at least once during the previous twelve months, even if it permits multiple payments
• c.Any account with a balance below $500
• d.Only a business account that was opened by a corporation, partnership or other entity rather than by a person, and not a personal account of any kind

A covered account includes an account offered primarily for personal, family or household purposes that involves or permits multiple payments or transactions, such as a brokerage account that allows wire transfers or payments to third parties, and any other account with a reasonably foreseeable identity theft risk. Past theft, entity type or balance does not decide it.17 CFR 248.201(b)(3)

A registered broker-dealer makes a recommendation that is subject to Regulation Best Interest and that also endorses an investment adviser's services. Under the model advertising rule, which requirement does it not have to meet?

• a.The requirement that the advertisement discuss benefits and risks in a fair and balanced manner for all readers alike, for every reader of the page
• b.The ban on a compensated endorsement from an ineligible person
• c.The disclosures about client status, compensation and material conflicts that the rule requires with other endorsements✓
• d.The ban on untrue or misleading statements of material fact anywhere in the advertisement that carries the endorsement, not merely the endorsement

The rule excuses a registered broker-dealer from the endorsement disclosure requirements when the endorsement is a recommendation subject to Regulation Best Interest, since that regulation brings its own disclosure and conflict duties. The general prohibitions on misleading content and the fair-and-balanced standard still apply to the advertisement, and the ineligible-person ban is not waived by this provision.NASAA Model Rule 102(a)(4)-1(m)(2)(vii)(A)

An adviser plans to pay a blogger $200 a month for posts recommending the adviser. Besides disclosures, what must the adviser have in place before the posts run?

• a.Registration of the blogger as a representative
• b.An opinion letter from the adviser's outside counsel approving each post before it is published, kept in the compliance file
• c.A written agreement with the blogger describing the scope of the agreed activities and the terms of compensation✓
• d.A signed statement from each reader of the blog that no investment decision will rest on the posts by themselves alone

For a compensated testimonial or endorsement, the adviser must have a reasonable basis to believe it complies with the rule and a written agreement with the person describing the scope of the activities and the terms of compensation. Reader statements, counsel opinions and representative registration are not part of the requirement.NASAA Model Rule 102(a)(4)-1(m)(2)(iii)(B)

An adviser's referral firm has a partner with a disqualifying event that is still within the look-back period. A junior employee of that firm, who has a clean record, offers an endorsement for pay. How does the model rule treat the junior employee?

• a.As ineligible only if earning over $1,000 from the adviser
• b.As eligible, as long as the junior employee discloses the partner's record and the firm's history in the endorsement itself in writing
• c.As eligible, because only the individual with the event is ineligible
• d.As an ineligible person too, because employees of an ineligible person are included, so the adviser may not pay for the endorsement✓

An ineligible person is one who is subject to a disqualifying event plus any employee, officer or director of that person and others with similar status or functions. The adviser may not compensate such persons for endorsements. Disclosure does not cure ineligibility, and the dollar amount is irrelevant to the definition.NASAA Model Rule 102(a)(4)-1(m)(5)(xi)

Which order makes a person's involvement a 'disqualifying action' for purposes of the model advertising rule's endorsement provisions?

• a.A customer complaint filed with a broker-dealer about a representative
• b.An order of a foreign regulator suspending the person from a local exchange
• c.An order of a state administrator, the SEC or a self-regulatory organization, entered after notice and opportunity for hearing, barring or revoking the person's registration or barring the person from the industry✓
• d.A warning letter from a state administrator that mentions a late filing

A disqualifying action is an order of the Administrator, another state's administrator, the SEC or an SRO barring, denying, suspending or revoking registration, or barring the person from associating with the industry, entered after notice and opportunity for hearing. A mere warning letter, complaint or foreign order is not described in the definition.NASAA Model Rule 102(a)(4)-1(m)(5)(iii)

An adviser wants to advertise the results of a proprietary account it manages for its own money. Under the model rule's definition, can that account be a 'portfolio' for performance advertising?

• a.Yes, a portfolio can be an account or private fund, including one for the adviser itself or its advisory affiliates✓
• b.No, since an adviser's own money is not managed for anyone else
• c.Yes, but only if the proprietary account has held at least five different securities throughout the entire period shown
• d.No, because only accounts that belong to clients of the adviser can be treated as portfolios under the rule's own definition

The rule defines a portfolio as a group of investments managed by an adviser, which may be an account or a private fund and includes accounts of the adviser or its advisory affiliates. Mislabelling real results as hypothetical would not make sense, and no minimum number of securities is stated.NASAA Model Rule 102(a)(4)-1(m)(5)(xiii)

Which set of elements must a covered firm's Identity Theft Prevention Program under Regulation S-ID include?

• a.Identifying relevant red flags, detecting them, responding appropriately, and updating the program periodically✓
• b.Identifying red flags and then filing each red flag detected with the SEC within five business days of detection
• c.Credit reports on every customer, annual fingerprinting of all account holders, and a dedicated telephone hotline for fraud
• d.Closing any account that triggers a red flag

Regulation S-ID requires reasonable policies and procedures to identify relevant red flags for the covered accounts, detect them, respond appropriately to prevent and mitigate identity theft, and update the program periodically for changes in risk. Reporting each flag to the SEC and automatic closure are not requirements.17 CFR 248.201(d)(2)

Which entity is within the scope of the SEC's Regulation S-ID identity theft rule?

• a.A state-registered investment adviser that is not registered or required to be registered under the federal act at all
• b.A bank that offers custody
• c.An investment adviser that is registered or required to be registered under the federal Investment Advisers Act✓
• d.An issuer of securities that has never opened an account for any customer but sells its own shares to the public

Regulation S-ID applies to financial institutions or creditors that are broker-dealers or other persons registered or required to be registered under the Exchange Act, registered investment companies and certain related entities, and investment advisers registered or required to be registered under the Advisers Act. A state-only adviser, an issuer with no accounts and a bank are not in the listed categories.17 CFR 248.201(a)

Under Regulation S-P, a covered institution learns of an incident of unauthorized access to customer information. Which procedures must its response program include?

• a.Closing all customer accounts until the incident has been resolved
• b.Offering every affected individual a refund of the fees paid during the past year as compensation for the unauthorized access or loss
• c.Assessing the nature and scope of the incident, containing and controlling it, and notifying affected individuals as required✓
• d.Publishing a notice about the incident in a local newspaper

The response program must include procedures to assess the nature and scope of the incident and the systems and information involved, take appropriate steps to contain and control it, and notify each affected individual whose sensitive customer information was or is reasonably likely to have been accessed, unless a reasonable investigation shows it has not been and is not reasonably likely to be misused in a way that causes substantial harm. Refunds, account closures and newspaper notices are not part of the rule.17 CFR 248.30(a)(3)