[Code of Federal Regulations]
[Title 12 Volume 1]
[Revised as of January 1, 2004]
From the U.S. Government Printing Office via GPO Access
[CITE: 12CFR40.4]

[Page 362-363]
 
                       TITLE 12--BANKS AND BANKING
 
   CHAPTER I--COMPTROLLER OF THE CURRENCY, DEPARTMENT OF THE TREASURY
 
PART 40--PRIVACY OF CONSUMER FINANCIAL INFORMATION--Table of Contents
 
                 Subpart A--Privacy and Opt Out Notices
 
Sec. 40.4  Initial privacy notice to consumers required.


    (a) Initial notice requirement. A bank must provide a clear and 
conspicuous notice that accurately reflects its privacy policies and 
practices to:
    (1) Customer. An individual who becomes the bank's customer, not 
later than when the bank establishes a customer relationship, except as 
provided in paragraph (e) of this section; and
    (2) Consumer. A consumer, before the bank discloses any nonpublic 
personal information about the consumer to any nonaffiliated third 
party, if the bank makes such a disclosure other than as authorized by 
Sec. Sec. 40.14 and 40.15.
    (b) When initial notice to a consumer is not required. A bank is not 
required to provide an initial notice to a consumer under paragraph (a) 
of this section if:
    (1) The bank does not disclose any nonpublic personal information 
about the consumer to any nonaffiliated third party, other than as 
authorized by Sec. Sec. 40.14 and 40.15; and
    (2) The bank does not have a customer relationship with the 
consumer.
    (c) When the bank establishes a customer relationship. (1) General 
rule. A bank establishes a customer relationship when it and the 
consumer enter into a continuing relationship.
    (2) Special rule for loans. A bank establishes a customer 
relationship with a consumer when the bank originates a loan to the 
consumer for personal, family, or household purposes. If the bank 
subsequently transfers the servicing rights to that loan to another 
financial institution, the customer relationship transfers with the 
servicing rights.
    (3)(i) Examples of establishing customer relationship. A bank 
establishes a customer relationship when the consumer:
    (A) Opens a credit card account with the bank;
    (B) Executes the contract to open a deposit account with the bank, 
obtains credit from the bank, or purchases insurance from the bank;
    (C) Agrees to obtain financial, economic, or investment advisory 
services from the bank for a fee; or
    (D) Becomes the bank's client for the purpose of the bank's 
providing credit counseling or tax preparation services.
    (ii) Examples of loan rule. A bank establishes a customer 
relationship with a consumer who obtains a loan for personal, family, or 
household purposes when the bank:
    (A) Originates the loan to the consumer; or
    (B) Purchases the servicing rights to the consumer's loan.
    (d) Existing customers. When an existing customer obtains a new 
financial

[[Page 363]]

product or service from a bank that is to be used primarily for 
personal, family, or household purposes, the bank satisfies the initial 
notice requirements of paragraph (a) of this section as follows:
    (1) The bank may provide a revised privacy notice, under Sec. 40.8, 
that covers the customer's new financial product or service; or
    (2) If the initial, revised, or annual notice that the bank most 
recently provided to that customer was accurate with respect to the new 
financial product or service, the bank does not need to provide a new 
privacy notice under paragraph (a) of this section.
    (e) Exceptions to allow subsequent delivery of notice. (1) A bank 
may provide the initial notice required by paragraph (a)(1) of this 
section within a reasonable time after the bank establishes a customer 
relationship if:
    (i) Establishing the customer relationship is not at the customer's 
election; or
    (ii) Providing notice not later than when the bank establishes a 
customer relationship would substantially delay the customer's 
transaction and the customer agrees to receive the notice at a later 
time.
    (2) Examples of exceptions. (i) Not at customer's election. 
Establishing a customer relationship is not at the customer's election 
if a bank acquires a customer's deposit liability or the servicing 
rights to a customer's loan from another financial institution and the 
customer does not have a choice about the bank's acquisition.
    (ii) Substantial delay of customer's transaction. Providing notice 
not later than when a bank establishes a customer relationship would 
substantially delay the customer's transaction when:
    (A) The bank and the individual agree over the telephone to enter 
into a customer relationship involving prompt delivery of the financial 
product or service; or
    (B) The bank establishes a customer relationship with an individual 
under a program authorized by Title IV of the Higher Education Act of 
1965 (20 U.S.C. 1070 et seq.) or similar student loan programs where 
loan proceeds are disbursed promptly without prior communication between 
the bank and the customer.
    (iii) No substantial delay of customer's transaction. Providing 
notice not later than when a bank establishes a customer relationship 
would not substantially delay the customer's transaction when the 
relationship is initiated in person at the bank's office or through 
other means by which the customer may view the notice, such as on a web 
site.
    (f) Delivery. When a bank is required to deliver an initial privacy 
notice by this section, the bank must deliver it according to Sec. 
40.9. If the bank uses a short-form initial notice for non-customers 
according to Sec. 40.6(d), the bank may deliver its privacy notice 
according to Sec. 40.6(d)(3).