§ 40.4 - Initial privacy notice to consumers required.

(a) Initial notice requirement. A bank must provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to:

(1) Customer. An individual who becomes the bank's customer, not later than when the bank establishes a customer relationship, except as provided in paragraph (e) of this section; and

(2) Consumer. A consumer, before the bank discloses any nonpublic personal information about the consumer to any nonaffiliated third party, if the bank makes such a disclosure other than as authorized by §§ 40.14 and 40.15.

(b) When initial notice to a consumer is not required. A bank is not required to provide an initial notice to a consumer under paragraph (a) of this section if:

(1) The bank does not disclose any nonpublic personal information about the consumer to any nonaffiliated third party, other than as authorized by §§ 40.14 and 40.15; and

(2) The bank does not have a customer relationship with the consumer.

(c) When the bank establishes a customer relationship—(1) General rule. A bank establishes a customer relationship when it and the consumer enter into a continuing relationship.

(2) Special rule for loans. A bank establishes a customer relationship with a consumer when the bank originates a loan to the consumer for personal, family, or household purposes. If the bank subsequently transfers the servicing rights to that loan to another financial institution, the customer relationship transfers with the servicing rights.

(3)(i) Examples of establishing customer relationship. A bank establishes a customer relationship when the consumer:

(A) Opens a credit card account with the bank;

(B) Executes the contract to open a deposit account with the bank, obtains credit from the bank, or purchases insurance from the bank;

(C) Agrees to obtain financial, economic, or investment advisory services from the bank for a fee; or

(D) Becomes the bank's client for the purpose of the bank's providing credit counseling or tax preparation services.

(ii) Examples of loan rule. A bank establishes a customer relationship with a consumer who obtains a loan for personal, family, or household purposes when the bank:

(A) Originates the loan to the consumer; or

(B) Purchases the servicing rights to the consumer's loan.

(d) Existing customers. When an existing customer obtains a new financial product or service from a bank that is to be used primarily for personal, family, or household purposes, the bank satisfies the initial notice requirements of paragraph (a) of this section as follows:

(1) The bank may provide a revised privacy notice, under § 40.8, that covers the customer's new financial product or service; or

(2) If the initial, revised, or annual notice that the bank most recently provided to that customer was accurate with respect to the new financial product or service, the bank does not need to provide a new privacy notice under paragraph (a) of this section.

(e) Exceptions to allow subsequent delivery of notice. (1) A bank may provide the initial notice required by paragraph (a)(1) of this section within a reasonable time after the bank establishes a customer relationship if:

(i) Establishing the customer relationship is not at the customer's election; or

(ii) Providing notice not later than when the bank establishes a customer relationship would substantially delay the customer's transaction and the customer agrees to receive the notice at a later time.

(2) Examples of exceptions. (i) Not at customer's election. Establishing a customer relationship is not at the customer's election if a bank acquires a customer's deposit liability or the servicing rights to a customer's loan from another financial institution and the customer does not have a choice about the bank's acquisition.

(ii) Substantial delay of customer's transaction. Providing notice not later than when a bank establishes a customer relationship would substantially delay the customer's transaction when:

(A) The bank and the individual agree over the telephone to enter into a customer relationship involving prompt delivery of the financial product or service; or

(B) The bank establishes a customer relationship with an individual under a program authorized by title IV of the Higher Education Act of 1965 (20 U.S.C. 1070 et seq.) or similar student loan programs where loan proceeds are disbursed promptly without prior communication between the bank and the customer.

(iii) No substantial delay of customer's transaction. Providing notice not later than when a bank establishes a customer relationship would not substantially delay the customer's transaction when the relationship is initiated in person at the bank's office or through other means by which the customer may view the notice, such as on a web site.

(f) Delivery. When a bank is required to deliver an initial privacy notice by this section, the bank must deliver it according to § 40.9. If the bank uses a short-form initial notice for non-customers according to § 40.6(d), the bank may deliver its privacy notice according to § 40.6(d)(3).