Regulation S-P Definitions

Below are formal definitions of key terms included in Regulation S-P:

Covered Institutions: Amended Regulation S-P outlines which entities will be considered “larger entities”, included in the table below. Smaller entities will be the covered institutions that do not meet these standards.

Entity	Qualification to be Considered a “Large Entity”
Investment companies together with other investment companies in the same group of related investment companies1	Net assets of $1 billion or more as of the end of the most recent fiscal year
Registered investment advisers²	$1.5 billion or more in assets under management
Broker-dealers³	All broker-dealers that are not small entities under the Securities Exchange Act for purposes of the Regulatory Flexibility Act
Transfer agents⁴	All transfer agents that are not small entities under the Securities Exchange Act for purposes of the Regulatory Flexibility Act

Customer Information: Any record containing nonpublic personal information as defined in section 248.3(t) about a customer of a financial institution, whether in paper, electronic, or other form.

Customer Information (for transfer agents): Any record containing nonpublic personal information “identified with any natural person, who is a security holder of an issuer for which the transfer agent acts or has acted as transfer agent, that is handled or maintained by the transfer agent or on its behalf.”

Sensitive Customer Information: Any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information. See final rule 248.30(a); infra section II.B.1.

• In addition to identification numbers, PINs, and passwords, many other pieces of nonpublic information have the potential to satisfy this standard. Many financial institutions have processes for establishing identity that require the user to provide a number of pieces of information that—on their own—are not especially sensitive (e.g., mother’s maiden name, name of a first pet, make and model of first car), but which—together—could allow access to a customer’s account.

Service Provider: Any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution. Final rule 248.30(a)(4). If a covered institution is acting as a service provider, in addition to its own obligations under rule 248.30, it must provide notification to the other covered institution as required by the policies and procedures required in rule 248.30(a)(5)(i).

Substantial Harm or Inconvenience: Intentionally not defined in the amendments.

Notes from adopting release:

1. “Group of related investment companies” is as defined in 17 CFR 270.0-10. We estimate that, as of September 2023, 77% of registered investment companies would be considered to be larger entities. This estimate is based on data reported in response to Items B.5, C.19, and F.11 on Form N-CEN. 2. We estimate that, as of September 2023, 23% of registered investment advisers would be considered to be larger registered investment advisers. This estimate is based on data reported in response to Items 2.A and 5.F.2.(c) on Form ADV. 3. A broker or dealer is a small entity if it: (i) had total capital of less than $500,000 on the date in its prior fiscal year as of which its audited financial statements were prepared or, if not required to file audited financial statements, on the last business day of its prior fiscal year; and (ii) is not affiliated with any person that is not a small entity. This threshold was chosen to include all broker-dealers who do not fall within the definition of a small entity under the Regulatory Flexibility Act (5 U.S.C. 553). Based upon FOCUS filings for the third quarter of 2023, we estimate approximately 77% of broker-dealers, not including funding portals, would be considered larger entities. Based upon staff analysis and review of public filings, we estimate approximately 3% of funding portals would be considered larger entities. 4. A transfer agent is a small entity if it: (i) received less than 500 items for transfer and less than 500 items for processing during the preceding six months; (ii) transferred items only of issuers that are small entities; (iii) maintained master shareholder files that in the aggregate contained less than 1,000 shareholder accounts or was the named transfer agent for less than 1,000 shareholder accounts at all times during the preceding fiscal year; and (iv) is not affiliated with any person that is not a small entity. 17 CFR 240.0-10. This threshold was chosen to include all transfer agents who do not fall within the definition of a small entity under the Regulatory Flexibility Act. Based on the number of transfer agents that reported a value of fewer than 1,000 for items 4(a) and 5(a) on Form TA-2 filed with the Commission as of September 30, 2023, we estimate approximately 132 transfer agents may be considered small entities, of 315 total registered transfer agents. See infra section VI.