30 day notice

SECURITIES AND EXCHANGE COMMISSION
Submission for OMB Review; Comment Request
Upon Written Request, Copies Available From
Securities and Exchange Commission
Office of FOIA Services
100 F Street, NE
Washington, DC 20549-2736
Extension: Rule 248.30
SEC File No. 270-549, OMB Control No. 3235-0610
Notice is hereby given that pursuant to the Paperwork Reduction Act of 1995 (44 U.S.C.
3501 et seq.), the Securities and Exchange Commission (the “Commission”) has submitted to the
Office of Management and Budget a request for extension of the previously approved collection
of information discussed below.
Rule 248.30 (17 CFR 248.30) under Regulation S-P is titled “Procedures to Safeguard
Customer Records and Information; Disposal of Consumer Report Information.” Rule 248.30
(the “safeguard rule”) requires brokers, dealers, investment companies, and investment advisers
registered with the Commission (“registered investment advisers”) (collectively “covered
institutions”) to adopt written policies and procedures for administrative, technical, and physical
safeguards to protect customer records and information. The safeguards must be reasonably
designed to “insure the security and confidentiality of customer records and information,”
“protect against any anticipated threats or hazards to the security and integrity” of those records,
and protect against unauthorized access to or use of those records or information, which “could
result in substantial harm or inconvenience to any customer.” The safeguard rule’s requirement
that covered institutions’ policies and procedures be documented in writing constitutes a
collection of information and must be maintained on an ongoing basis. This requirement

-2eliminates uncertainty as to required employee actions to protect customer records and
information and promotes more systematic and organized reviews of safeguard policies and
procedures by institutions. The information collection also assists the Commission’s
examination staff in assessing the existence and adequacy of covered institutions’ safeguard
policies and procedures.
We estimate that as of the end of 2018, there are 3,926 broker-dealers, 4,095 investment
companies, and 13,230 investment advisers registered with the Commission, for a total of 21,251
covered institutions. We believe that all of these covered institutions have already documented
their safeguard policies and procedures in writing and therefore will incur no hourly burdens
related to the initial documentation of policies and procedures.
Although existing covered institutions would not incur any initial hourly burden in
complying with the safeguards rule, we expect that newly registered institutions would incur
some hourly burdens associated with documenting their safeguard policies and procedures. We
estimate that approximately 1,350 broker-dealers, investment companies, or investment advisers
register with the Commission annually. However, we also expect that approximately 55% of
these newly registered covered institutions, or 743 institutions, are affiliated with an existing
covered institution, and will rely on an organization-wide set of previously documented
safeguard policies and procedures created by their affiliates. We estimate that these affiliated
newly registered covered institutions will incur a significantly reduced hourly burden in
complying with the safeguards rule, as they will need only to review their affiliate’s existing
policies and procedures, and identify and adopt the relevant policies for their business.
Therefore, we expect that newly registered covered institutions with existing affiliates will incur

-3an hourly burden of approximately 15 hours in identifying and adopting safeguard policies and
procedures for their business, for a total hourly burden for all affiliated new institutions of 11,145
hours. We expect that half of this time would be incurred by inside counsel at an hourly rate of
$401, and half would be by a compliance officer at an hourly rate of $352, for a total cost of
$4,196,093.
Finally, we expect that the 607 newly registered entities that are not affiliated with an
existing institution will incur a significantly higher hourly burden in reviewing and documenting
their safeguard policies and procedures. We expect that virtually all of the newly registered
covered entities that do not have an affiliate are likely to be small entities and are likely to have
smaller and less complex operations, with a correspondingly smaller set of safeguard policies and
procedures to document, compared to other larger existing institutions with multiple affiliates.
We estimate that it will take a typical newly registered unaffiliated institution approximately 60
hours to review, identify, and document their safeguard policies and procedures, for a total of
36,420 hours for all newly registered unaffiliated entities. We expect that half of this time would
be incurred by inside counsel at an hourly rate of $401, and half would be by a compliance
officer at an hourly rate of $352, for a total cost of $13,712,130.
Therefore, we estimate that the total annual hourly burden associated with the safeguards
rule is 47,565 hours at a total hourly cost of $17,908,223. We also estimate that all covered
institutions will be respondents each year, for a total of 21,251 respondents.
These estimates of average burden hours are made solely for the purposes of the
Paperwork Reduction Act. An agency may not conduct or sponsor, and a person is not required
to respond to a collection of information unless it displays a currently valid control number. The

-4safeguard rule does not require the reporting of any information or the filing of any documents
with the Commission. The collection of information required by the safeguard rule is mandatory.
The public may view the background documentation for this information collection at the
following website, www.reginfo.gov. Comments should be directed to: (i) Desk Officer for the
Securities and Exchange Commission, Office of Information and Regulatory Affairs, Office of
Management and Budget, Room 10102, New Executive Office Building, Washington, DC
20503, or by sending an e-mail to Lindsay.M.Abate@omb.eop.gov; and (ii) Charles Riddle,
Acting Director/Chief Information Officer, Securities and Exchange Commission, c/o Candace
Kenner, 100 F Street, NE, Washington, DC 20549, or send an email to PRA_Mailbox@sec.gov.
Comments must be submitted to OMB within 30 days of this notice.

Vanessa A. Countryman
Acting Secretary

June 18, 2019