🦖 Serve docs via Docusaurus

[JFWooten4]

closes #30

Regulatory basis

Subsection (k): transfer-agent Reg S-P record retention

Every registered transfer agent shall maintain in an easily accessible place:

1. The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(1) of this chapter for no less than three years after the termination of the use of the policies and procedures;

2. The written documentation of any detected unauthorized access to or use of customer information, as well as any response to, and recovery from such unauthorized access to or use of customer information required by § 248.30(a)(3) of this chapter for no less than three years from the date when the records were made;

3. The written documentation of any investigation and determination made regarding whether notification is required pursuant to § 248.30(a)(4) of this chapter, including the basis for any determination made, any written documentation from the United States Attorney General related to a delay in notice, as well as a copy of any notice transmitted following such determination, for no less than three years from the date when the records were made;

4. The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(5)(i) of this chapter until three years after the termination of the use of the policies and procedures;

5. The written documentation of any contract or agreement entered into pursuant to § 248.30(a)(5) of this chapter until three years after the termination of such contract or agreement; and

6. The written policies and procedures required to be adopted and implemented pursuant to § 248.30(b)(2) of this chapter for no less than three years after the termination of the use of the policies and procedures.

Changes to be made

• Create a transfer-agent Reg S-P recordkeeping binder or index for records required under Subsection (k).
• Add a section for written safeguards policies and procedures required by § 248.30(a)(1).
• Add a section for detected unauthorized access to or use of customer information, including response and recovery documentation required by § 248.30(a)(3).
• Add a section for customer-notification investigations and determinations required by § 248.30(a)(4), including the basis for each determination.
• Add a section for any Attorney General delay documentation related to customer notice timing.
• Add a section for copies of customer notices transmitted after notification determinations.
• Add a section for service-provider oversight policies and procedures required by § 248.30(a)(5)(i).
• Add a section for service-provider contracts or agreements entered into under § 248.30(a)(5).
• Add a section for written disposal policies and procedures required by § 248.30(b)(2).
• Define naming, dating, ownership, and storage conventions so records are maintained in an easily accessible place.
• Define retention periods for each record category based on Subsection (k).
• Cross-reference the safeguards, incident response, assessment, containment, customer notice, service-provider oversight, 72-hour vendor notice, and disposal workstreams.