Memo #
23686

SEC Adopts Reg. S-AM That Restricts Sharing Information With Affiliates For Marketing To Consumers; Compliance Date Is Jan. 1st
| Print

 

 

[23686]

 

August 7, 2009

TO: SEC RULES MEMBERS No. 86-09
SMALL FUNDS MEMBERS No. 47-09
COMPLIANCE MEMBERS No. 37-09
CLOSED-END INVESTMENT COMPANY MEMBERS No. 31-09
INVESTMENT ADVISER MEMBERS No. 13-09
UNIT INVESTMENT TRUST MEMBERS No. 6-09
PRIVACY ISSUES WORKING GROUP No. 8-09
OPERATIONS MEMBERS No. 16-09
BROKER/DEALER ADVISORY COMMITTEE No. 44-09
INTERNAL AUDIT ADVISORY COMMITTEE No. 4-09
TECHNOLOGY COMMITTEE No. 16-09
PENSION MEMBERS No. 38-09
529 PLAN MEMBERS No. 5-09     RE: SEC ADOPTS REG. S-AM THAT RESTRICTS SHARING INFORMATION WITH AFFILIATES FOR MARKETING TO CONSUMERS; COMPLIANCE DATE IS JAN. 1ST

 

Four years after proposing Regulation S-AM, [1] the SEC has adopted it, with a compliance date of January 1, 2010.  [2]  This new regulation, which applies to all SEC-registered investment companies, investment advisers, transfer agents, broker-dealers, and municipal securities dealers, generally prohibits an affiliate of such registrant from using certain consumer eligibility information supplied by the registrant to market the affiliate’s products or services to a consumer unless the consumer is first provided the ability to opt out of such marketing.  (There are exceptions to this general prohibition.)  The regulation is summarized below. [3]  Importantly, consumer information that will not be used by an affiliate to market products or services to particular customers can continue to be freely shared by an SEC registrant as permitted under Reg. S-P without complying with the requirements of Reg. S-AM.  Also, an SEC registrant may use its own eligibility information to market an affiliate’s products and services without complying with the regulation’s requirements. [4]

 

Persons Subject to the Rule

As noted above, the regulation restricts an affiliate of an SEC registrant from using consumers’ “eligibility information” that is provided to the affiliate by the registrant to make a “marketing solicitation” to such consumers.  The regulation applies to all brokers, dealers, investment companies, [5] investment advisers, transfer agents, and municipal securities dealers registered with the SEC.  “Affiliate” means any person that is related to such registrant by common ownership or common control.  “Consumer” means an individual.

 

“Eligibility Information”

Eligibility information is defined rather obtusely in Section 248.120(j) by reference to the definition of “consumer report” in the Fair Credit Reporting Act (FCRA).  According to the Release, the term includes

 

...transaction or experience information, such as information about a  consumer’s account history with [the SEC registrant], and ‘other’ information [under the FCRA] such as information from consumer reports or applications.

...Examples of personal identifiers listed in the definition include account numbers, names or addresses, and also could include Social Security numbers, driver’s license numbers, telephone numbers, or other types of information that, depending on the circumstances or when used in combination, could identify the individual or individuals to whom the data relates.  Other types of personal identifiers could include passwords, screen names, user names, e-mail addresses or Internet Protocol addresses. [6]

 

The definition expressly provides that the term does not include “aggregate or blind data that does not contain personal information such as account numbers, names, or addresses.”

 

“Marketing Solicitations”

“Marketing solicitation” means the marketing of a product or service to a particular consumer [7] that is (1) based on eligibility information provided by an SEC registrant to the affiliate and (2) intended to encourage the consumer to purchase or obtain the affiliate’s product or service. [8]  The definition clarifies that it includes, for example, “a telemarketing call, direct mail, e-mail, or other form of marketing communication directed to a particular consumer that is based on eligibility information received . . ..”  In addition to defining the term in Section 248.120, Section 248.121(b)(1) states that an affiliate makes a marketing solicitation if:

 

  • It receives eligibility information from the SEC registrant;
  • It uses that information to do one or more of the following: (1) identify the consumer or type of consumer to receive a marketing solicitation; (2) establish criteria used to select the consumer to receive a marketing solicitation; or (3) decide which of its  products or services to market to the consumer or tailor its marketing solicitation to that consumer; and
  • As a result of the affiliate’s use of the eligibility information, the consumer is provided a marketing solicitation.

 

Sharing Eligibility Information Through the Use of Common Databases

According to Section 248.121(b)(2) of the regulation, an affiliate may receive eligibility information from an SEC registrant in a variety of ways, including by the registrant placing such information into a common database that its affiliate can access.  Use of such information from a common database by an affiliate to make a marketing solicitation would be covered by the regulation. [9]   Also, as discussed in more detail below, the regulation applies to an affiliate’s use of a registrant’s eligibility information [10] that has been provided to a service provider acting on the registrant’s behalf.   Pursuant to Section 248.121(b)(4)(ii), a registrant may direct its service provider to use the registrant’s own eligibility information to market an affiliate’s products or services to the consumer if the affiliate does not communicate directly with the service provider regarding use of the information.  Section 248.121(b)(6)(iii) provides an example of the use of eligibility information in a common database that would comply with the regulation’s requirements.

 

Impact on Service Providers’ Activities

The regulation contains express provisions addressing its application to service providers of SEC registrants.  Section 248.121(b)(3) provides that an affiliate receives eligibility information if a service provider (affiliated or third-party) that is acting on the registrant’s behalf receives or uses eligibility information to make a marketing solicitation.  Section 248.121(b)(5) clarifies that the affiliate does not make a marketing solicitation subject to the rule if the service provider receives eligibility information from the registrant that the registrant has obtained in connection with a pre-existing business relationship it has, or had, with the consumer and uses that information to market the affiliate’s products or services to the registrant’s consumer so long as the following five conditions are met:

 

  1. The registrant controls access to and use of its eligibility information by the service provider (including the specific terms and conditions under which the service provider may use the information to market the registrant’s products or services);
  2. The registrant establishes specific terms and conditions [11] under which the service provider may access and use its eligibility information to market the affiliate’s products and services to the registrant’s consumers and periodically evaluates the service provider’s compliance with those terms and conditions;
  3. The registrant requires the service provider to implement reasonable policies and procedures designed to ensure that the service provider uses the registrant’s eligibility information in accordance with the terms and conditions established by the registrant relating to the marketing of the registrant’s goods and services;
  4. The registrant is identified on or with the marketing materials provided to the consumer; and
  5. The affiliate does not directly use the registrant’s eligibility information to make a marketing solicitation. [12]

 

Section 248.121(b)(6)(v) provides an example of using eligibility information in a manner that would comply with these requirements.

 

Notice and Opt Out Requirements

The regulation prohibits an affiliate from using eligibility information it receives from a registrant to make marketing solicitations to consumers unless each of the following conditions is met:

 

  1. The potential marketing use of the information has been “clearly, conspicuously, and concisely” disclosed to the consumer;
  2. The consumer has been provided a “reasonable opportunity and simple method to opt-out of receiving the marketing solicitation;” and
  3. The consumer has not opted out.

 

The required notice and opt out must be provided either by the entity that has a pre-existing business relationship with the consumer or as part of a joint notice from two or more members of an affiliated group of companies, provided that at least one of the entities on the joint notice has a pre-existing business relationship with the consumer.  Opt out notices must be provided in writing or, if the consumer agrees, electronically; they may not be provided orally.

 

Clear, Conspicuous, and Concise Notice Disclosure

The tem “clear and conspicuous” is defined in the regulation to mean “reasonably understandable and designed to call attention to the nature and significance of the information presented.”  While registrants are not required to implement any particular method or combination of methods to make their disclosures clear and conspicuous, the Release lists various methods, including design methods, registrants might consider using (e.g., short explanatory sentences, bullet lists, active voice, easy-to-read type face, plain-language headings, etc.). [13]  According to the Release, the Reg. S-AM notice can be combined with other disclosures required by law and the Commission expressly encourages registrants to consolidate their Reg. S-AM notices with their Reg. S-P privacy notices so consumers receive only a single notice to review and exercise all applicable opt outs. [14]  For registrants that choose to combine these disclosures, the Release notes that “there is no need to use distinctive features to differentiate an affiliate marketing opt out notice from other components of a required disclosure” and “nothing in the clear and conspicuous standard requires segregation of the affiliate marketing opt out notice when it is combined with the [Reg. S-P] privacy notice or other required disclosure.” [15]

 

Requirements Applicable to the Opt Out

As discussed above, the regulation requires that the consumer be provided “a reasonable opportunity and a reasonable and simple method to ‘opt out’”  prior to an affiliate’s use of eligibility information for marketing solicitations.  Section 248.123 governs the contents of the opt out notice and the use of consolidated opt out notices.  Pursuant to this section, the notice must be clear, conspicuous, and concise and must accurately disclose:

 

  • The name of the entity providing the notice.  For notices provided jointly by multiple affiliates in which each affiliate shares a common name (e.g., “ABC”), the notice may indicate that it is being provided by multiple companies with the ABC name or within the ABC group or family of companies. [16]

  • A list of the affiliates or types of affiliates whose use of eligibility information is covered by the notice.  Generally speaking, the provisions applicable to the name of the entity providing the notice apply to this requirement as well.  So, for example, the notice could indicate that it applies to multiple companies with the ABC name by stating that it is provided by “all of the ABC companies.”

  • A general description of the types of eligibility information that may be used to make marketing solicitations to the consumer.  Aside from the model forms in the Appendix to the Release, no further information is provided in the Release on this requirement.

  • That the consumer may elect to limit the use of eligibility information to make marketing solicitations to the consumer.  Section 248.122(a)(4) provides that a consumer may be given a menu of alternative when electing to prohibit solicitations, such as prohibiting solicitations from certain types of, but not all, affiliates, solicitations based on certain types of eligibility information, or solicitations by certain, but not all, types of delivery (e.g., e-mail v. U.S. mail solicitations).  This provision requires that one of the alternatives provided to the consumer allow the consumer to prohibit all marketing solicitations by all affiliates.

  • That the consumer’s election will apply for a specified period of time stated in the notice and, if applicable, that the consumer will be allowed to renew the election once that period expires. [17]  The opt out period must be at least five years, beginning as soon as reasonably practicable after the consumer’s opt out election is received. [18]  Nothing in the regulation prohibits an indefinite opt out or an opt out that remains in effect until revoked by the consumer.  A consumer that (for whatever reason) opts out again during the existence of an opt out begins the five year clock running again with the new opt out.  An opt out period expires upon a consumer revoking the opt out in writing or electronically.  Oral revocations are not allowed.

  • A reasonable and simple method for the consumer to opt out.  Section 248.124 governs what constitutes both a reasonable opportunity and an unreasonable opportunity to opt out.  The reasonableness requirement applies both to the time provided to the consumer within which to exercise an opt out and the method to opt out. 
    • Timing – If the opt out is mailed to the consumer, giving the consumer up to 30 days from the date the notice is mailed to opt out is considered reasonable.  A reasonable period for opting out pursuant to an electronic notice would be 30 days.  For e-mails, this period would begin to run after the e-mail is sent to a consumer who has agreed to receive disclosures by e-mail from the person sending the e- mail.  For disclosure provided by posting them at an Internet Web site at which the consumer has obtained a product or service, the 30 days would begin to run when the consumer acknowledges receipt of the electronic notice.  For electronic transactions, it would be reasonable to provide the opt out notice to the consumer at the time of the transaction and require the consumer to decide before completing the transaction whether to opt out.  For in-person transactions, it would also be reasonable to require an opt out decision prior to completing the transaction. 

    • Method – The regulation lists the following examples of reasonable methods to opt out: designating a check off box in a prominent position on an opt out form; including a reply form and self- addressed envelope with the notice; providing an electronic opt out option for consumers that agree to the electronic delivery of information; or providing a toll-free telephone number.  Also included as a reasonable method is permitting consumers to exercise all of their opt out rights under Reg. S-P and Reg. S-AM in a consolidated manner (e.g., by calling a toll-free phone number).  The regulation lists the following as unreasonable methods: requiring the consumer to write his or her own letter; requiring the consumer to contact the firm to obtain an opt out form; or requiring consumers who receive the opt out notice electronically to respond by mail or via a different website without providing a link to such website.  The Release discourages registrants from requiring consumers to provide their Social Security number in order to opt out and notes that such a requirement is contrary to the efforts of Federal agencies to limit the private sector’s use of Social Security numbers.

 

Additional Requirements Applicable to Notices

  • Delivery of Notices – Section 248.126 governs delivery of notices and provides examples of when a consumer can reasonably expect to receive the notice and when such expectation is unreasonable.

  • Renewal of Opt Out Elections – Section 248.127 governs renewal of opt out elections.  As discussed above, opt out elections are valid for a minimum of five years.  Upon the expiration of an opt out, affiliates are prohibited from making marketing solicitations to a consumer who previously opted out unless the consumer is first provided a renewal notice and a reasonable opportunity and a reasonable and simple method to renew the opt out and the consumer does not renew such opt out.  To ensure that a consumer receives a meaningful renewal notice, the consumer must be: (1) reminded that he or she previously opted out; (2) informed that such opt out has expired or is about to expire; and (3) advised that to continue to limit solicitations from affiliates, the opt out must be renewed.  The requirements applicable to the contents, delivery, timing, and other aspects of the renewal notice largely track those applicable to the initial notice.  Sending a renewal notice prior to the expiration of a current opt out period will not shorten the existing period.  Also, entities that prefer not to provide renewal notices may do so by honoring the consumer’s opt out in perpetuity. [19]

 

Exceptions to the Requirements

As previously discussed, if the registrant does not share with an affiliate eligibility information that is used by the affiliate to market to consumers, the rule does not apply.  Section 248.121(c) of the regulation provides the following additional exceptions: [20]

 

  1. Pre-existing Business Relationships (Section 248.121(c)(1)) – The term “pre-existing business relationship” is defined in Section 248.120(q).  The definition includes examples of such relationships and when they are created.  In addition to establishing a relationship based upon the consumer’s contract or account with the registrant, [21] the term includes any inquiry or application by the consumer within three months preceding the solicitation. The Release clarifies certain issues relating to this exception, including the following:
    • Eligibility information provided to a person who is licensed for more than one SEC-registrant may be used by that agent to market the products or services of any of the registrants with which the person is affiliated without offering a notice and opt out; [22]
    • A pre-existing business relationship terminates when an investor redeems or sells investment company shares or closes or transfers an account; [23]
    • Capturing the telephone number, return mail address, or Internet address (through cookies) of a consumer contacting the registrant is not sufficient to constitute an “inquiry” for purposes of the exception;
    • A call in response to an advertisement for a free promotional item is not an inquiry about a product or service that would establish a pre-existing business relationship;
    • Consumer-initiated inquiries unrelated to a product or service (e.g., contacting the entity to ask about their hours or address) do not qualify for the exception; [24] and
    • Visiting a publicly available Web site “should not, by itself, constitute an ‘inquiry’ for purposes of the pre-existing business relationship exception.” [25]  
  2. Employee Benefit Plans (Section 248.121(c)(2)) – The regulation does not apply to the use of information “to facilitate communications to an individual for whose benefit [the SEC registrant] provide[s] an employee benefit or other services pursuant to a contract with an employer related to and arising out of the current employment relationship or status of the individual as a participant or beneficiary of an employee benefit plan.”
  3. Service Providers (Section 248.121(c)(3)) – The regulation does not apply to a service provider’s use of eligibility information to perform services on behalf of the registrant, but the service provider cannot send out marketing solicitations on behalf of the registrant’s affiliate unless the affiliate would be permitted to send out such solicitations on its own behalf.  As noted in the Release, this exception “simply allows a service provider to do what the affiliate on whose behalf it is acting may do . . .” [26]
  4. Consumer Initiated Inquiries (Section 248.121(c)(4)) – Marketing solicitations sent in response to a consumer’s communication about products or services are similarly exempt from the regulation.  The Release clarifies that, to be excepted, the marketing solicitation must be in response to an inquiry initiated by the consumer and must concern the solicitor’s products or services.
  5. Consumer Authorization or Request (Section 248.121(c)(5)) – The regulation excepts any marketing solicitation made in response to an authorization or request by the consumer to receive solicitations.  According to the Release, “affiliated companies cannot avoid use of . . . the notice and opt out requirement by including preprinted boilerplate language in the disclosures or contracts they provide to consumers, such as a sentence (or pre-selected box next to a sentence) stating that by applying to open an account, the consumer authorizes or requests to receive marketing solicitations from affiliates.” [27]
  6. Compliance with Applicable Law (Section 248.121(c)(6)) – The regulation provides a carve-out for persons whose compliance with its requirements would prevent them from complying with any provision of State insurance laws pertaining to unfair discrimination in any State in which such person is lawfully doing business.

 

Use of Model Forms

The Appendix to the regulation provides model forms that may be used to comply with the regulation’s requirements.  The Appendix and Release both make clear that use of the forms is not required but merely one way to comply with the regulation’s requirement to use clear, conspicuous, and concise notices.  The Model Forms included in the Appendix are as follows:

              Model Form A-1 – Form for Initial Opt Out Notice (Single-Affiliate Notice)

              Model Form A-2 – Form for Initial Opt Out Notice (Joint Notice)

              Model Form A-3 – Form for Renewal Notice (Single-Affiliate Notice)

              Model Form A-4 – Form for Renewal Notice (Joint Notice)

              Model Form A-5 – Form for Voluntary “No Marketing” Notice

 

Compliance Date

Compliance with the regulation is required by January 1, 2010.  This date is intended to provide registrants time to incorporate their Reg. S-AM notices with the Reg. S-P annual notices if they choose to do so.

 

Tamara K. Salmon
Senior Associate Counsel

endnotes

 [1]  See Institute Memorandum No. 17762 (July 13, 2004) summarizing Limitations on Affiliate Marketing (Regulation S-AM), SEC Release Nos. 34-49985, IC -26494, and IA-2259 (July 8, 2004).

 [2]  See Regulation S-AM: Limitations on Affiliate Marketing, SEC Release Nos. 34-60423, IC-28842, and IA-2911 (August 4, 2009) (“Release”), which is available at: http://www.sec.gov/rules/final/2009/34 -60423.pdf.

 [3]  As discussed below, an Appendix to Reg. S-AM provides model forms that may be used to comply with the regulation’s requirements.

 [4]  See Section 248.121(b)(4).

 [5] Pursuant to Section 248.120(n) of the regulation, “investment company . . . includes a separate series of the investment company.”

 [6]  Release at pp. 23-24.

 [7]  The Release clarifies that “there is no restriction on using eligibility information received from an affiliate in marketing directed at the general public, such as radio, television, general circulation magazine, billboard advertisements, or publicly available Web sites that are not directed to particular consumers.”  Invitations to a financial educational seminar may be a marketing solicitation if invitees are selected based on eligibility information received from an affiliate and the seminar is used to solicit the consumer to purchase or obtain an investment product or service.  A pre-recorded message played while a consumer is on hold with a call center “would be a marketing solicitation if it is targeted to a particular consumer based on eligibility information received from an affiliate, but would not be a marketing solicitation if it is played for all consumers who are on hold with the call center.” (Emphasis added.)  See Release at pp. 30-31.

 [8]  See Section 248.120(o).

 [9]  The Release notes that the regulation does not apply to eligibility information placed in a common database before the mandatory compliance date by an affiliate that has a pre-existing business relationship with a consumer.  Release at p. 104.

 [10]  The Release emphasizes that the regulation only prohibits the use of eligibility information – not its sharing.  See, e,g,, Release at p. 51.

 [11]  According to the regulation, these terms and conditions may include the identity of the affiliated companies whose products or services may be marketed, the types of products or services that may be marketed, and the number of times consumers may receive marketing materials.

 [12]  The regulation requires that 1) and 3) of these conditions be set forth in a written agreement with the service provider and that the specific terms and conditions required by 2) be set forth in writing. 

 [13]  Release at p. 16.

 [14]  Release at p. 85.

 [15]  Release at p. 17.

 [16]  If the affiliates do not share a common name, the joint notice must either separately identify each affiliate by name or identify each of the common names used by those affiliates (e.g., “all of the ABC and XYZ Companies” or “the ABC bank and securities companies and XYZ insurance companies.”)  Release at p. 152.

 [17]  If the notice is provided to consumers who have previously opted out (e.g., an annual notice), the notice must also state that a consumer who has chosen to limit marketing solicitations does not need to act again until the consumer receives a renewal notice.  Release at pp. 80-81.

 [18]  The duration of the opt out is not affected by the termination of a continuing relationship – i.e., the opt out remains in effect for its duration even though the consumer no longer has a relationship with the SEC registrant.  Section 248.122(a)(5) governs notices in situations where the consumer has terminated, and then re-established, a relationship with the registrant.

 [19]  Release at pp. 100-101.

 [20]  Section 248.121(d) provides examples of each of these exceptions except the last one.

 [21]  For those consumers who do not maintain an ongoing account or relationship with the registrant, the consumer is considered to have a pre- existing business relationship with the registrant for 18 months following a contract or transaction.  See definition of “pre-existing business relationship” in Section 240.20(q)(1)(ii).

 [22]  So, for example, a person dually registered with one firm as an insurance agent and another as a broker-dealer representative may market one firm’s products or services based on eligibility information it received from a customer of the other firm.

 [23]  See also, footnote 20, above.

 [24]  However, if the consumer-initiated conversation “turns to a discussion of products or services the consumer may need, marketing solicitations may be responsive if the consumer agrees to receive marketing materials and provides or confirms contact information by which he or she can receive those materials.”  Release at p. 63.

 [25]  Release at n. 97.

 [26]  Release at p. 60.

 [27]  Release at p. 68.