When a regulator issues a formal information request about a customer, which action best reflects proper procedure?

• A. Respond by sharing all records immediately
• B. Ignore the request
• C. Notify the regulator and compliance; respond as required
• D. Deny ever receiving the request

Answer: (C)

When a regulator issues a formal information request, the proper procedure is to acknowledge the request, bring in the right internal teams (compliance and, if needed, legal), and respond in the exact manner the regulator requires. This means collecting the requested information, reviewing it for accuracy and completeness, ensuring it’s disclosed only to the extent and in the format requested, and meeting any stated deadlines. Documenting what was provided creates an clear, auditable trail and helps protect customer privacy and data security while satisfying regulatory obligations.

Sharing all records immediately goes beyond what may be asked and can expose sensitive information unnecessarily. Ignoring the request or denying receipt signals noncompliance and can lead to enforcement actions. Following the regulator’s instructions with proper internal coordination is the best practice because it demonstrates a controlled, lawful, and accountable response.