Does GLBA apply to Fintechs? (2024)

Does GLBA apply to Fintechs?

The federal GLBA and its implementing regulations are the primary source of laws regulating the data use of consumer financial information. The GLBA is implemented and enforced by a number of different federal regulators potentially relevant to fintech businesses, including the OCC, FDIC, Federal Reserve, SEC and FTC.

Do Fintechs have to comply with GLBA?

What constitutes a financial activity has been construed broadly; therefore, many Fintechs are likely subject to the GLBA. The GLBA preempts state laws only to the extent that compliance with a state law would be “inconsistent with” the requirements of the GLBA.

Who is not covered by GLBA?

The Gramm–Leach–Bliley Act (GLBA) and its implementing regulations impose privacy requirements when financial institutions collect “nonpublic personal information about individuals who obtain financial products or services primarily for personal, family, or household purposes.”[1] GLBA does not apply, however, when a ...

What companies are subject to GLBA?

Privacy and Security

The Gramm-Leach-Bliley Act requires financial institutions – companies that offer consumers financial products or services like loans, financial or investment advice, or insurance – to explain their information-sharing practices to their customers and to safeguard sensitive data.

Who regulates fintech companies in the US?

The Consumer Financial Protection Bureau (CFPB) makes consumer financial markets work for consumers, responsible providers, and the economy as a whole. The CFPB protects consumers from unfair, deceptive, or abusive practices and takes action against companies that break the law.

Who does GLBA apply to?

The Gramm-Leach-Bliley Act seeks to protect consumer financial privacy. Its provisions limit when a "financial institution" may disclose a consumer's "nonpublic personal information" to nonaffiliated third parties.

What are the three key rules of GLBA?

What is an example of a GLBA violation?

failing to provide users with a clear initial privacy notice, failing to deliver it in a way that each consumer could be reasonably expected to receive it, and by distributing a notice that didn't accurately affect its practices.”

Is GLBA exempt from CCPA?

The California Consumer Privacy Act (CCPA) provides an exemption for personal information that is covered by the federal privacy law governing financial institutions, the Gramm-Leach-Bliley Act (GLB Act or GLBA).

Does GLBA apply to universities?

Does GLBA apply to higher education institutions? Yes, as of June 9, 2023, the GLBA Safeguards Rule applies to all Title IV colleges and universities and is included in the SAIG agreement and the Federal Single Audit.

Is GLBA a law or regulation?

The GLBA is a federal law that became effective in the United States In 1999. The GLBA is also known as the Financial Services Modernization Act of 1999.

What is the difference between SOX and GLBA?

The primary difference between each set of compliance regulations is that they are all focused on protecting a different type of data. HIPAA protects a patient's healthcare information, SOX protects financial information of public companies, and GLBA protects the data of financial institution customers.

Are FinTech companies are not regulated?

In addition to the federal banking agencies, other federal regulators play an important role in regulating the impact and influence of Fintech. The Consumer Financial Protection Bureau (“CFPB”) supervises and enforces compliance with many federal consumer financial protection laws that impact Fintech.

Do Fintechs need to be regulated?

One of the main regulatory challenges for fintechs is compliance with KYC (Know Your Customer) and AML (Anti-Money Laundering) regulations. Fintechs are required to comply with these regulations in order to prevent money laundering and terrorist financing.

What constitutes as FinTech?

Financial technology (better known as fintech) is used to describe new technology that seeks to improve and automate the delivery and use of financial services. ​​​At its core, fintech is utilized to help companies, business owners, and consumers better manage their financial operations, processes, and lives.

Does the CFPB regulate Fintechs?

A closer look at the CFPB fintech proposal

Under the proposal, fintechs offering products like digital wallets, payment apps, and peer-to-peer (P2P) apps that process 5 million payments yearly would be subject to CFPB oversight.

What are the six FinTech entities?

The six entities are — Bahwan Cybertek, Crediwatch Information Analytics, enStage Software (Wibmo), HSBC in collaboration with Wibmo, napID Cybersec and Trusting Social.

What is regulatory FinTech?

A sandbox allows FinTech organizations to test new service offerings, assess their risks, and create an additional buffer between the market and the end consumers, thus reducing adoption risk (Dayal and Narayanan 2021).

What does the Gramm Leach Bliley Act allow?

The Gramm–Leach–Bliley Act passed in November 1999, repealing portions of the BHCA and the Glass–Steagall Act, allowing banks, brokerages, and insurance companies to merge, thus making the CitiCorp/Travelers Group merger legal. Also prior to the passage of the Act, there were many relaxations to the Glass–Steagall Act.

Who is responsible for GLBA compliance?

The GLBA is enforced by the FTC, the federal banking agencies, and other federal regulatory authorities, as well as state insurance oversight agencies.

What is the difference between GDPR and GLBA?

GLBA and GDPR

While the end goals of the two laws are the same, there are a few differences between the two. Scope: GLBA applies only to financial institutions, while GDPR applies to any organization that processes the personal data of E.U. citizens.

What is the GLBA 2 year rule?

Financial institutions must adopt controls for securely disposing of customer information no later than two years after the last date that the information was used, unless retention is otherwise required or necessary for legitimate business purposes.

What happens if you fail to comply with GLBA?

Under GLBA, penalties for non-compliance can include fines of up to $100,000 per violation, with fines for officers and directors of up to $10,000 per violation. And if that wasn't enough, the provisions include criminal penalties of up to five years in prison, and the revocation of licenses.

What data is considered GLBA?

GLBA nonpublic personal information

It includes: Any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any personally identifiable financial information that is not publicly available.

Are brokers subject to GLBA?

Certain functionally regulated subsidiaries, such as brokers, dealers, and investment advisers, are subject to GLBA implementing regulations issued by the SEC.