This page is general information, not legal, tax or financial advice. Talk to a qualified professional about your situation.
Financial advisors, broker-dealers and insurance agencies should keep client financial information out of any data licence unless compliance counsel approves a specific approach. Under the Gramm-Leach-Bliley Act a financial institution may not disclose nonpublic personal information to a nonaffiliated third party without first giving the consumer notice and a chance to opt out (15 U.S.C. 6802), and the SEC’s Regulation S-P applies the same conditions to firms it regulates (17 CFR 248.10). What remains is the firm’s own operational record, and Mercor lists finance and insurance among the industries it takes data from.
Records and how they are usually treated
| Records | Usually | Why |
|---|---|---|
| Client account, policy and claims data | Exclude | Nonpublic personal information under GLBA |
| Client lists and segments built from that data | Exclude | Regulation P counts groupings of consumers derived from nonpublic financial data |
| Client correspondence and meeting notes | Exclude | Personal financial information; often required books and records |
| Internal email and chat on operations | Possible, after review | Scrub client details; licensing a copy does not end retention duties |
| Policies, procedures, compliance manuals, training | Often possible | Firm work product |
| Firm finance, HR and vendor records | Possible | Employee data needs de-identification |
Keep the originals
A licence covers a copy. The originals must still be kept for their required periods:
| Rule | Who | Retention |
|---|---|---|
| SEC Rule 204-2(e)(1) | Registered investment advisers | Most books and records at least 5 years from the end of the fiscal year of the last entry, the first 2 years in an appropriate office of the adviser |
| FINRA Rule 4511(b) | FINRA member firms | At least 6 years for records with no other specified period |
Before you apply
- Ask compliance first. A licence touches privacy notices, vendor due diligence and recordkeeping.
- Exclude client-facing systems (CRM with client data, policy administration, portfolio systems) unless counsel signs off.
- Check your privacy notice against anything you plan to include.
Which buyers take this industry
| Buyer and program | Industry rule | Company minimums | Operating or closed |
|---|---|---|---|
| micro1: Enterprise Data Partnership | No industry limit in the buyer’s published rules | 30+ full-time employees and substantial historical data; several years of records across systems is a stronger fit. No fixed minimum file count or size. | Both. Operating companies apply to the Enterprise Data Partnership; companies no longer operating apply to the Defunct Company Data Partnership. |
| micro1: Defunct Company Data Partnership | No industry limit in the buyer’s published rules | 30+ full-time employees and substantial historical data; several years of records across systems is a stronger fit. No fixed minimum file count or size. | Both. Operating companies apply to the Enterprise Data Partnership; companies no longer operating apply to the Defunct Company Data Partnership. |
| Nyne: Company data licensing | No industry limit in the buyer’s published rules | 20+ full-time US W-2 employees and 3+ years in business, plus a decision maker who can approve the licence | Operating companies only |
| Mode: Company data partnership | No industry limit in the buyer’s published rules | 10+ employees for legal; 15+ for accounting, medical and finance; 50+ for all other businesses. Several years of records you own make a stronger fit. | Not stated. Mode says businesses and nonprofits can qualify. |
| Mercor: Enterprise data | Buyer lists this industry | Not stated. Names target industries: legal, healthcare, finance and insurance, professional services, manufacturing, retail, real estate, logistics. | Not stated |
| Troveo: Business data licensing | No industry limit in the buyer’s published rules | Not stated | Not stated |
Questions people ask
Does de-identification take client data outside GLBA?
Regulation P's definition of nonpublic personal information includes any list, description or grouping of consumers derived from nonpublic financial data. Whether a de-identified data set falls outside it is a question for your compliance counsel; most firms keep client data out of scope.
Can we license records we are required to keep?
Licensing a copy does not end your duty to keep the originals. Investment advisers keep most books and records for at least five years under SEC Rule 204-2, and FINRA members keep records with no specified period for at least six years under Rule 4511.
Sources
- 15 U.S. Code § 6802: Obligations with respect to disclosures of personal information (Cornell LII)
- 12 CFR § 1016.10: Limits on disclosure to nonaffiliated third parties (Regulation P, Cornell LII)
- 12 CFR § 1016.3: Definitions (Regulation P, Cornell LII)
- 17 CFR § 248.10: Limits on disclosure (Regulation S-P, Cornell LII)
- 17 CFR § 275.204-2: Books and records to be maintained by investment advisers (Cornell LII)
- FINRA Rule 4511: General Requirements
- Mercor: Enterprise data