and availability. Confidentiality means that NPPII is not available or disclosed to unauthorized persons. Integrity means that NPPII is not altered / destroyed in an unauthorized manner. Availability means that NPPII is accessible and usable on demand by an authorized person.

– Facebank attains administrative safeguards by implementing security measures that reduce risks/vulnerabilities to a reasonable and appropriate level.

– Facebank achieves physical safeguards by limiting physical access to its facilities while ensuring that authorized access is allowed and follows the appropriate procedures established.

– Facebank achieves technical safeguards by implementing technical policies and procedures that allow only authorized users to access electronic

NPPII. Electronic measures must be put in place to confirm that NPPII has not been improperly altered or destroyed.

– Facebank will achieve organizational safeguards by taking reasonable steps to cure any activity or practice that constitutes a material breach or violation. Violations include the failure to implement safeguards that reasonably and appropriately protect NPPII.

– Facebank will adopt reasonable and appropriate procedures to comply with this Policy. Facebank must maintain written security procedures and written records of required actions, activities or assessments.

– Facebank must perform a risk assessment if a breach occurs to evaluate probability of that the protected information has been compromised.

– The privacy notice will be provided so that each recipient can reasonably be expected to receive actual notice in writing or electronically.

– Privacy notices will be available in Facebank’ website.

– The privacy notice includes the following information:

• Categories of information disclosed,

• Categories of affiliates and nonaffiliated third parties to whom Facebank may disclose information,

• Policies and practices with respect to the treatment of former customers’

information,

• Categories of information disclosed to nonaffiliated third parties that perform services for Facebank or functions on Facebank’s behalf and categories of third parties with whom Facebank has contracted,

•

•

A statement that Facebank makes disclosures to other nonaffiliated third parties for everyday business purposes or as permitted by the law.

– Gramm-Leach-Bliley Act (GLBA) gives rule making authority to the CFPB and modifies Regulation P on the requirements of Annual Notice indicating that

accordance with the provisions of § 1016.13, § 1016.14, or § 1016.15; and (ii) Have not changed their policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed to the customer under § 1016.6(a)(2) through (5) and (9) in the most recent privacy notice provided pursuant to this part.”

Therefore, it is the policy of Facebank to provide the ongoing annual Privacy Notice to existing customers only if at any giving point in time a change in policies and/or practices occurs in regards to disclosing nonpublic personal information from the policies and practices that were disclosed to the customer under § 1016.6(a)(2) through (5) and (9) in the most recent privacy notice provided pursuant to this part.

– A new notice will be provided to an existing customer when the customer obtains a new financial product or services, only if the initial or annual notice most recently provided to the customer was not accurate with respect to

the financial product or service.

following information: his/her name, address, date of birth, profession, origin of income, and any other information that will allow the identification of the customer. This applies to both, deposits and credit accounts, and any other type of account offered by Facebank.

– Facebank might also request the license ID, Passport or any other identification documents to the customer or representative, if applicable.

– Facebank will notify that they will reserve the right of requesting additional documents to the accounts primary signature, authorized signatures, and/or origin of funds reflected on the account, and/or customers’ income.

– Facebank will notify that the client is not required to accept the disclaimers when opening a new account. If clients are not in agreement with the disclaimers, Facebank will close the new account and return the available funds by Check or via wire transfer without any cost to the client.

mail, providing this is the official method of communication, as all customers

– The opt out notice will allow a period of no less than 30 days for the consumer to opt out.

– Facebank will notify its new clients that their account or transaction information could be disclosed in the following scenarios:

(e.g. credit bureau, merchants)

• Complying with warrants made from courts or governmental agencies,

• When required in order to process or complete a transaction,

• When the customer authorizes in writing, and

• When required or permitted by legislation and applicable laws.

– Facebank will provide a revised notice before it begins to share a new category of nonpublic personal information or shares information with a

new category of nonaffiliated third party in a manner that was not described in the previous notice.

policy and/or pertinent procedure.

– All recommendations identified as a result of the monitoring process will be discussed with upper management in the Regulatory Compliance Committee.

– Action plans and/or corrective measures will be documented, approved and distributed within the affected area and management.

– The areas to be evaluated are:

• Annual privacy notice (if considered applicable),

• Content privacy notice,

• No Opt-out notice,

• Revised notice,

• Delivery methods,

• Limits on disclosure to nonaffiliated third parties,

• Limits on disclosure and reuse of information,

• Exceptions to notice and opt out requirements for processing servicing transaction, and

• Other exceptions to notice and opt out requirements.

procedures, to address unauthorized access to or use of customer information maintained by a Facebank or its service provider that could

– Facebank’s response program general procedures are:

• Notifying its primary regulators once Facebank becomes aware of an incident involving unauthorized access to or use of sensitive customer information; consistent with the Agency’s Suspicious Activity Report (“SAR”) regulations,

• Notifying appropriate law enforcement authorities;

• Taking appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information (e.g., by monitoring, freezing, or closing affected accounts and preserving records and other evidence); and

• Notifying the affected customers when warranted. Customer notice may only be delayed if an appropriate law enforcement agency determines that notification will interfere with a criminal investigation and provides the institution with a written request for the delay.

• Type of information subject to unauthorized access,

• A telephone number customers can call for further information and assistance,

• A reminder «to remain vigilant» over the next 12 to 24 months,

• A recommendation that incidents of suspected identity theft be reported promptly, and

• A general description of the steps taken by the financial institution to protect the information from further unauthorized access or use.

• Depending on the situation, Facebank may choose to contact all

Report (“SAR”)

calendar days after the date of initial detection of unusual facts that may constitute a basis for filing a suspicious activity report.

– If no suspect was identified on the date of detection of the incident

requiring the filing, Facebank may delay filing a suspicious activity report for an additional 30 calendar days to identify a suspect.

– In no case shall reporting be delayed more than 60 calendar days after the date of initial detection of a reportable transaction.

– Facebank must use the regular channels in order to submit Suspicious

Activity Reports.