2018 Regulation P Amendments
Read an executive summary of the 2018 Regulation P amendments here.
The following is a transcript of this video:
"This Compliance Clip is going to focus on the 2018 amendments to regulation P that were implemented by the CFPB in August of 2018. These changes, or amendments to regulation P, do four main things.
First, they finalized an exemption to sending the annual privacy notice which technically took place, by law, in December of 2015. We will talk about that in a minute. These amendments also provide timing requirements for sending the annual privacy notice when an institution was previously able to use the new exemption to not send the notice. The third thing it does is that it removes the alternative delivery option from regulation P that was previously there. The fourth thing that it does is to make a technical change to a definition found in Regulation P.
Let's take a look at each of these four changes.
The first change is that regulation P has finalized the exemption that was found in the 2015 law, known as the FAST act. This new exemption provides that financial institutions who do not share non-public financial information are not required to provide an annual privacy notice. Keep in mind that the initial privacy notice is still required, but the annual notice that used to be required every year is no longer required to be sent to customers if a financial institution does not share information.
The second change in the Regulation P amendments relates to timing requirements for financial institutions who were previously exempt and were not initially required to send the annual privacy notice. If an institution is initially exempt from Regulation P and the annual privacy notice delivery requirements because they didn’t share information, but how changes to their policy or practices, then there are some timing requirements for sending a new notice. In fact, there are two different acquirements: 1) before the change is made and 2) within 100 days after making the change.
The first requirement is before changes are made. This requirement applies to financial institutions who are losing their exemption altogether. For example, if you are now going to be sharing non-public personally identifiable information, you now have to provide a new annual notice before you make those changes, because you have to give the consumers a chance to opt-out before you make those changes. The bottom line is that you have to send a new notice before the change when you make a change that now requires an opt-out notice for your customers.
The third change to the Regulation P amendments relates to the removal of the alternative delivery exemption. This was an exemption that was implemented by the CFPB. It was implemented in 2014, and basically was the best they could do without a law change from Congress, where the CFPB was able to help provide some relief to Banks but it still required jumping through too many hoops. The bottom line is that the alternative delivery notice is no longer needed because this new exemption (found in the amendments) says you do not have to deliver an annual notice or do anything at all, where the alternative delivery notice required annual action from financial institutions. Therefore, the CFPB stated that all financial institutions will utilize the new exemption and nobody is going to utilize the alternative delivery option. Therefore, the alternative delivery exemption is being removed altogether from the rules.
The fourth and final change to the regulation P amendments was a technical change to the definition of “you” in regulation P. Long story short, the definition of “you” used to refer to both financial institutions and certain other institutions, but the amendments removed the other institutions so that the definition of you now only includes financial institutions. If you are a compliance person who does not work for a financial institution, you might want to take a look at this. I know I have some viewers who are in that case, so that might apply to you.
The effective date of this change is 30 days after the date of publication of the Federal Register. As of the date I'm recording this video, it has not yet been published in the Federal Register, but this really is not an issue for us since the FAST act went into effect several years ago and we can go ahead and follow these rules right away. "