Guidance for Investment Advisers and Broker-Dealers for Complying with Vermont Requirements for Protecting Client Financial Information

State of Vermont For consumer assistance: Department of Financial Regulation [Banking] 888-568-4547 89 Main Street [Insurance] 800-964- 1784 Montpelier, VT 05620-3101 [Securities] 877-550-3907 www.dfr.vermont.gov Securities Bulletin S-2025-02 (Revised) Guidance for Investment Advisers and Broker-Dealers for Complying with Vermont Requirements for Protecting Client Financial Information April 14, 2026 The purpose of this bulletin is to provide guidance to investment advisers and brokersdealers for complying with the Department of Financial Regulation (the “Department”) Securities Division’s rules for protecting personal financial information. The rules, which are part of the Vermont Securities Regulations in V.S.R. Chapter 10,1 are referred to as the “Privacy Rule.” This bulletin provides an overview of the requirements of the Privacy Rule and responses to frequently asked questions. Entities Covered by the Privacy Rule The Privacy Rule covers any investment adviser or broker-dealer that is required to be registered with the Department, including federal covered investment advisers that make notice filings with the Department. This includes representatives, agents, and employees of those investment advisers and broker-dealers. The Privacy Rule discussed in this bulletin is specific to the Department’s Securities Division, but it is not the Department’s only rule regarding protection of consumers’ private 1 Consumer privacy requirements were first implemented by the predecessor agency to the Department in Regulation S-2001-01, effective in 2001. The requirements were continued under Order in the Matter of Applying Provisions of Certain Regulations, Bulletins, Policy Statements and Orders in Effect Prior to July 1, 2006 to the Vermont Uniform Securities Act, Docket 06-43-S (July 7, 2006), Exhibit 5.1, available at: https://dfr.vermont.gov/reg-bul-ord/applying-provisions-certain-regulations-bulletins-policy-statementsand-orders-vermont; and Order In the Matter of Repealing in Part and Retaining in Part Order 06-23-S Applying Provisions of Certain Regulations, Bulletins, Policy Statements and Orders in Effect Prior to July 1, 2006 to the Vermont Uniform Securities Act, Docket 16-01-S (June 1, 2016), available at: https://dfr.vermont.gov/reg-bul-ord/repealing-part-order-06-023-s. The 2026 revisions to the Vermont Securities Regulations moved the requirements back into Department rule. Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 2 of 14 information. Other financial institutions, including insurance companies, banks, and other entities engaged in financial activities, that are not covered by the Securities Division’s Privacy Rule may be covered by a different but similar Department rule, and those entities should consult the applicable Department rule.2 Types of Information Covered by the Privacy Rule The Privacy Rule protects consumers’ nonpublic personal information, which includes financial and health information. Nonpublic personal financial information is information a consumer provides to obtain a product or service and information that an investment adviser or broker-dealer acquires about a consumer as a result of or in connection with providing a product or service. Nonpublic personal information includes, but isn’t limited to, information a consumer provides on an application, account information, the fact that the consumer is a client, any information about the consumer that indicates the consumer is a client, information collected through information collecting devices on a web server, and information collected through a consumer report. Nonpublic information does not include information that an investment adviser or broker-dealer reasonably believes is publicly available through government records, widely distributed media, or legally required public disclosures. A list or other form of aggregated information may be nonpublic personal information, depending on how it is compiled. A list that includes only public information is not nonpublic personal information, but if the list contains any nonpublic personal information, then the entire list is considered nonpublic personal information. If information is aggregated in a way that does not identify any consumer and does not include personal identifiers, like names, addresses, or account numbers, then the aggregated information is not considered nonpublic personal information. The Privacy Rule covers nonpublic personal information that an investment adviser or broker-dealer receives directly from an individual and any nonpublic personal information that an investment adviser or broker-dealer receives indirectly through another entity. This guidance explains the privacy obligations for each scenario in more detail below. Notice Obligations of Investment Advisers and Broker-Dealers Under the Privacy Rule Consumers and Customers To determine what obligations are imposed by the Privacy Rule, an investment adviser or broker-dealer must first identify whether its clients are “consumers” or “customers” as defined in the Privacy Rule. In broad terms, the Privacy Rule requires investment advisers and brokerdealers to give notice describing their privacy practices to all of their “customers,” and 2 See Department Rule IH-2001-01, Privacy of Consumer Financial and Health Information (June 20, 2023), available at: https://dfr.vermont.gov/content/privacy-consumer-financial-and-health-information (governing entities and people licensed under the insurance statutes); Department Rule B-2018-01, Privacy of Consumer Financial and Health Information (Feb. 18, 2018), available at: https://dfr.vermont.gov/reg-bul-ord/privacy-consumer-financial-and-health-information-regulation (governing banks and other financial institutions). Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 3 of 14 additionally, the Privacy Rule requires notice to “consumers” if the investment adviser or brokerdealer shares information in ways described in the Privacy Rule. Under the Privacy Rule, a “consumer” is anyone who obtains a financial product or service from an investment adviser or broker-dealer that is used primarily for personal, family, or household purposes. This includes anyone who applies for or seeks to obtain those services, even if they ultimately decide not to use the services, although it does not cover individuals who provide only a name and address in connection with requests for a prospectus, brochure, or other general information about financial products and services. Financial products or services include investment advisory services and brokerage services. There are a few exceptions where a brokerdealer or investment adviser acts only as an agent for another firm, or as a trustee or beneficiary of a trust. Please consult the Privacy Rule for specific exceptions. Within the group of consumers, there is a subset of individuals defined as “customers” with whom the investment adviser or broker-dealer has a continuing relationship. A continuing relationship is defined by the nature of the relationship and not its duration. A customer relationship exists where an investment adviser or broker-dealer has a continuing relationship to provide financial products or services, including where an investment adviser or broker-dealer holds the consumer’s account, enters into an investment advisory contract with the consumer, holds securities for the consumer, or regularly engages in securities transactions for the consumer. A customer relationship does not exist where a broker-dealer opens an account for the consumer solely for the purpose of liquidating or purchasing securities as an accommodation, i.e., on a onetime basis, without the expectation of engaging in other transactions. All customers are also consumers under the Privacy Rule. Summary of Privacy Notices to Customers and Consumers The Privacy Rule requires investment advisers and broker-dealers to provide a “clear and conspicuous” notice to customers initially and on an annual basis, and to consumers if the investment adviser or broker-dealer plans to share any nonpublic personal information with any nonaffiliated third party. For examples of the required content, please see V.S.R. § 10-6(c). Sample clauses that may be used, if they accurately represent the investment adviser or brokerdealer’s sharing of consumer nonpublic personal information, are available in V.S.R. § 10-26 and are also included as Exhibit A to this Bulletin. Summary of Notice Requirements Type of Notice To Whom When Required Contents Initial Customers No later than when the customer relationship is established, unless providing notice at the time the relationship is established would substantially delay the - Explanation of consumers’ right to opt-in prior to any disclosure of nonpublic personal financial information to nonaffiliated third parties Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 4 of 14 transaction and the customer agrees, or other exception applies. - Categories of nonpublic personal information collected and disclosed - Categories of affiliated and nonaffiliated third parties to whom nonpublic personal information is disclosed (other than certain exceptions) - Categories of nonpublic personal information about former customers that are disclosed, and the categories of affiliates and nonaffiliated third parties to whom it is disclosed - If any disclosures are made only under the exception for processing and servicing transactions (as described below under the section heading “Permitted sharing of consumer nonpublic personal information without consent and exceptions to privacy notice”), the categories of information and categories of nonaffiliated third parties with whom you have contracts - Any disclosures made under the Vermont Fair Credit Reporting Act or the federal Fair Credit Reporting Act - Policies and practices with respect to protecting the confidentiality and security of nonpublic personal information Consumers who are not customers At the same time as providing the opt-in notice, and before disclosure of any consumer nonpublic personal information to a nonaffiliated third party (other than certain exceptions) - Explanation of consumers’ right to opt-in prior to any disclosure of nonpublic personal financial information to nonaffiliated third parties - Information above or short form notice that clearly and conspicuously states that a privacy notice is available upon request, providing consumers reasonable means to obtain the privacy notice. Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 5 of 14 Annual Customers Delivery on a consistent basis at least once in any period of 12 consecutive months for the duration of the customer relationship Same information as required for the initial customer notice. Opt-in Consumers (including customers) With any initial privacy notice delivered to a consumer (including customers) - Clear and conspicuous notice of the categories of nonpublic personal financial information that may be disclosed and the categories of nonaffiliated third parties to whom it may be disclosed - Financial products or services that consumer obtains from the investment adviser or brokerdealer - Methods by which consumer may revoke the opt-in direction - Clear and conspicuous request that consumer affirmatively authorizes disclosure When disclosure of nonpublic personal information changes Consumers (including customers) Prior to the disclosure of any nonpersonal public information that is different than disclosed in the initial privacy notice - New explanation of consumers’ right to opt-in prior to any disclosure of nonpublic personal financial information to nonaffiliated third parties - Clear and conspicuous revised notice that describes policies and practices with respect to protecting the confidentiality and security of nonpublic personal information When an existing customer obtains a new product or service Customer No later than when the customer relationship for the new product or service is established, unless providing notice at the time the relationship is established would substantially delay the transaction and the customer agrees, or other exception applies. If the most recent notice (initial, revised, or annual) provided to the customer Same information as required for the initial customer notice. Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 6 of 14 covers the new product or service, a new notice is not required. Clear and conspicuous Where notice under the Privacy Rule must be provided in a clear and conspicuous manner, the notice must be reasonably understandable and designed to call attention to the nature and significance of the information it contains. To make a notice understandable, avoid technical language or terminology, imprecise explanations, or complicated grammatical structures. Instead, use clear and concise sentences, including bullet points and lists where possible. To make a notice conspicuous, it should be designed with a clear heading with font, formatting, and layout designed to call a reader’s attention to the notice. If the notice is provided on a web page, it must be a web page frequently visited by consumers and must be presented using the same principles to draw attention to the notice. Delivery An investment adviser or broker-dealer must deliver privacy notices to each consumer or customer in writing, or, if the consumer or customer agrees, electronically. The written notices may be delivered by mail or by hand. For individuals who conduct transactions with the investment adviser or broker-dealer electronically, a privacy notice posted on the investment adviser or broker-dealer’s website is sufficient if it requires the consumer to acknowledge receiving the notice as a necessary part of obtaining a particular product or service. For annual notices, an investment adviser or broker-dealer may reasonably expect that its customers have received the notice if they use its website to access financial products or services and agree to receive notices at the website. The notice must be posted continuously in a clear and conspicuous manner on the website. Notices given orally or posted in an investment adviser or broker-dealer’s office don’t satisfy the requirement of the Privacy Rule. Privacy notices required under federal law – will an initial notice that meets federal requirements also satisfy Vermont’s requirements? An investment adviser or broker-dealer may want to use the privacy notices it sends to comply with federal law to comply with Vermont’s Privacy Rule. Using one privacy notice to satisfy both federal and Vermont requirements is permitted, but the investment adviser or brokerdealer must make sure the notice covers all Vermont requirements. The primary difference is that Vermont requires an affirmative opt-in to information sharing from a consumer, which is different than the federal approach that starts from a default of allowing information sharing and gives consumers a right to opt-out. The required contents of an initial privacy notice in Vermont overlap substantially with the required content for an initial privacy notice under current federal rules, except for Vermont’s Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 7 of 14 opt-in requirement. Investment advisers and broker-dealers may use the federal model privacy forms to meet Vermont’s Privacy Rule as long as the additional language included in V.S.R. § 10- 6(g) is added to the notice. Use of the federal model privacy forms is not required. Opt-In Requirements For Data Sharing Under Vermont law, and unlike the opt-out provisions of federal law, consumers must affirmatively opt-in to allow investment advisers and broker-dealers to share nonpublic personal information with unaffiliated third parties (other than the exceptions noted below). Delivery of opt-in notice The opt-in notice must be delivered in writing or, if the consumer agrees, electronically. The notice must provide a clear and conspicuous statement of the categories of nonpublic personal financial information that may be disclosed and the categories of nonaffiliated third parties to whom the investment adviser or broker-dealer may disclose the consumer’s nonpublic personal financial information. The notice must also identify the financial products or services that the investment adviser or broker-dealer provides to which the opt-in notice will apply. Importantly, the notice must clearly and conspicuously request in writing or in electronic form that the consumer affirmatively agrees to the disclosures of nonpublic personal information described in the notice, and must also identify how the consumer may revoke an opt-in direction after the consumer has opted-in. Duration and revocation of opt-in direction A consumer’s agreement to opt-in to sharing of nonpublic personal information remains in effect until the consumer revokes it. This means that the approval may remain in effect after the termination of a customer relationship with respect to information collected during the customer relationship. The means for a consumer to revoke his or her opt-in direction must be reasonable. If the only means for revoking an opt-in notice is for the consumer to write a letter of revocation, that would not be considered reasonable means. It would also not be considered reasonable if the only way to revoke an opt-in notice is by checking a box that is only provided in the initial privacy notice, and not in subsequent or annual privacy notices. Permitted Sharing of Consumer Nonpublic Personal Information Without Consent and Exceptions to Privacy Notice The Privacy Rule allows for limited sharing of consumer nonpublic personal information without affirmative consent from an opt-in direction and, in some cases, without a privacy notice, as described below. The opt-in rights don’t apply when an investment adviser or broker-dealer shares nonpublic personal information with affiliated entities. A privacy notice is not required to be provided to consumers that are not customers for sharing nonpublic personal information with affiliates. Additionally, if an affiliated entity of an investment adviser or broker-dealer has already provided the consumer, including a consumer who is a customer, with an initial privacy Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 8 of 14 notice that meets Vermont’s requirements and clearly identifies the investment adviser or brokerdealer as an affiliate to whom the notice applies, then an additional initial notice is not required. The notice requirements for consumers that are not customers and opt-in requirements are not required for a few different types of disclosures to nonaffiliated third parties, which are set out in V.S.R. §§ 10-14, and 10-15, and an exception to the opt-in requirements (but not notice requirements) is set out in V.S.R. § 10-13. The notice requirements for customers still apply with respect to any nonpublic personal information disclosed under these sections. Account numbers and similar forms of access numbers are nonpublic personal information, but the sharing or disclosure is even more limited: this information can only be shared with a consumer reporting agency or to an investment adviser or broker-dealer’s own agent or service provider to perform marketing on the investment adviser or broker-dealer’s own products and services. - V.S.R. § 10-14 exception to opt-in requirements and notice requirements for processing or servicing transactions. V.S.R. § 10-14 creates an exception that allows disclosure of nonpublic personal information of consumers (including customers) without requiring consumers to optin. It also allows disclosure of nonpublic personal information of consumers who are not customers without an initial privacy notice. This exception applies to certain information sharing that is (1) necessary for processing or administering a financial transaction that is requested or authorized by a consumer, (2) is part of a private label credit card program, or (3) is part of a securitization, secondary market sale, or similar transaction. The exception includes sharing nonpublic personal information with service providers where such disclosure is required as a lawful, usual, or appropriate method of carrying out the transaction. - V.S.R. § 10-15 exception to opt-in requirements and notice requirements for other circumstances. V.S.R. § 10-15 creates an exception that allows disclosure of nonpublic personal information of consumers (including customers) without requiring consumers to opt-in. It also allows disclosure of nonpublic personal information of consumers who are not customers without an initial privacy notice. This exception applies to disclosures of nonpublic personal information (1) with consent of the consumer, (2) for purposes of preventing fraud or to protect the confidentiality or security of records, (3) for resolving customer disputes or inquiries, (4) to persons holding a legal or beneficial interest to the consumer or person acting as a fiduciary or representative of the consumer, (5) to provide information to agencies that are rating the investment adviser or broker-dealer and to the firm’s attorneys, accountants, and auditors, (6) to the extent permitted by certain federal statutes to law enforcement agencies and state and federal civil and administrative authorities and self-regulatory organizations, (7) to a consumer reporting agency in accordance with the Fair Credit Reporting Act, (8) in connection with an affiliation, sale, or merger of the investment adviser or broker-dealer, (9) in responding to judicial process or a subpoena or to respond to government regulatory authorities, (10) or as required to comply with federal, state, or local laws. - V.S.R. § 10-13 exception to opt-in requirements for disclosure to service providers and joint marketing. The opt-in rights that apply to disclosure of consumer nonpublic personal information do not apply for the limited disclosures to certain service providers that provide services for the investment adviser or broker-dealer disclosing the information and for certain Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 9 of 14 marketing activities, in each case as set out in V.S.R. § 10-13. Privacy notices to consumers are required if investment advisers or broker-dealers disclose any information under this exception. To utilize the exception under V.S.R. § 10-13, an investment adviser or broker dealer must enter into a contract with those nonaffiliated third parties with which it shares nonpublic personal information. The contract must guarantee the confidentiality of the information by prohibiting the third party from using or disclosing the information for any purpose other than the one for which it was received. For joint marketing agreements, the information disclosed under this exception must be limited to the consumer’s name, contact information, and transaction and experience information between the consumer and investment adviser or broker-dealer. A joint agreement under this exception is limited to a written agreement with one or more other investment advisers or brokerdealers to jointly offer a financial product or service. Limits on Redisclosure and Reuse of Nonpublic Personal Financial Information An investment adviser or broker-dealer that receives nonpublic personal information from a nonaffiliated investment adviser or broker-dealer may only share that information with affiliates of the investment adviser or broker-dealer who shared the information or with their own affiliates (who are subject to the same restrictions on further disclosures). If the nonpublic personal information was shared through the V.S.R. § 10-14 exception or the V.S.R. § 10-15 exception, described above, then any further sharing of the information with nonaffiliated entities is limited to what is allowed under those exceptions. If the nonpublic personal information was lawfully shared otherwise (e.g., with consent of the consumer), then further sharing of the information is permitted if the investment adviser or broker-dealer who initially shared the information could have lawfully shared the information in the same way as the proposed redisclosure. This means, in effect, that the restrictions on disclosing nonpublic personal information remain attached to that information after it has been shared by an investment adviser or broker-dealer with a nonaffiliated investment adviser or broker-dealer. ______________________ Kaj Samsom, Commissioner ____________________ Date Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E 4/13/2026 Page 10 of 14 Exhibit A Sample Clauses A-1. Categories of information an investment adviser or broker-dealer collects (all institutions) An investment adviser or broker-dealer may use this clause, as applicable, to meet the requirement of V.S.R. § 10-6(a)(l) to describe the categories of nonpublic personal financial information it collects. Sample Clause A-1: We collect nonpublic personal financial information about you from the following sources: • Information we receive from you on applications or other forms; • Information about your transactions with us, our affiliates, or others; and • Information we receive from a consumer reporting agency. A-2. Categories of information an investment adviser or broker-dealer discloses (institutions that disclose outside of the exceptions) An investment adviser or broker-dealer may use one of these clauses, as applicable, to meet the requirement of V.S.R. § 10-6(a)(2) to describe the categories of nonpublic personal financial information it discloses. An investment adviser or broker-dealer may use these clauses if it discloses nonpublic personal financial information other than as permitted by the exceptions in V.S.R. §§ 10-13, 10-14 and 10-15. Sample Clause A-2, Alternative 1: We may disclose the following kinds of nonpublic personal financial information about you: • Information we receive from you on applications or other forms, such as [provide illustrative examples, such as "your name, address, social security number, assets, and income”]; • Information about your transactions with us, our affiliates, or others, such as [provide illustrative examples, such as "your account balance, payment history, parties to transactions, and credit card usage”]; and • Information we receive from a consumer reporting agency, such as [provide illustrative examples, such as "your creditworthiness and credit history”]. Sample Clause A-2, Alternative 2: We may disclose all of the information that we collect, as described [describe location in the notice, such as "above" or "below”]. Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 11 of 14 A-3. Categories of information an investment adviser or broker-dealer discloses and parties to whom an investment adviser or broker-dealer discloses (institutions that do not disclose outside of the exceptions) An investment adviser or broker-dealer may use this clause, as applicable, to meet the requirements of V.S.R. § 10-6(a)(2), (3), and (4) to describe the categories of nonpublic personal financial information about customers and former customers that it discloses and the categories of affiliates and nonaffiliated third parties to whom it discloses. An investment adviser or broker-dealer may use this clause if it does not disclose nonpublic personal financial information to any party, other than as permitted by the exceptions in V.S.R. §§ 10-14 and 10-15. Sample Clause A-3: We do not disclose any nonpublic personal financial information about our customers or former customers to anyone, except as permitted by law. A-4. Categories of parties to whom an investment adviser or broker-dealer discloses (institutions that disclose outside of the exceptions) An investment adviser or broker-dealer may use this clause, as applicable, to meet the requirement of V.S.R. § 10-6(a)(3) to describe the categories of affiliates and nonaffiliated third parties to whom it discloses nonpublic personal financial information. An investment adviser or broker-dealer may use this clause if it discloses nonpublic personal financial information other than as permitted by the exceptions in V.S.R. §§ 10-13, 10-14 and 10-15, as well as when permitted by the exceptions in V.S.R. §§ 10-14 and 10-15. Sample Clause A-4: We may disclose nonpublic personal financial information about you to the following types of third parties: • Financial service providers, such as [provide illustrative examples, such as "mortgage bankers, securities broker-dealers, and insurance agents”]; • Non-financial companies, such as [provide illustrative examples, such as "retailers, direct marketers, airlines, and publishers”]; and • Others, such as [provide illustrative examples, such as "non-profit organizations”] We may also disclose nonpublic personal financial information about you to nonaffiliated third parties as permitted by law. A-5. Service provider/joint marketing exception An investment adviser or broker-dealer may use one of these clauses, as applicable, to meet the requirements of V.S.R. § 10-6(a)(5) related to the exception for service providers and joint marketers in V.S.R. § 10-13. If an investment adviser or broker-dealer discloses nonpublic personal information under this exception, it must describe the categories of nonpublic personal Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 12 of 14 financial information it discloses and the categories of third parties with whom it has contracted. Sample Clause A-5, Alternative 1: We may disclose the following information to companies that perform marketing services on our behalf or to other broker-dealer and/or investment advisers with which we have joint marketing agreements. Information we receive from you on applications or other forms, such as [provide illustrative examples, such as ''your name, address, social security number, assets, and income”1; • Information about your transactions with us, our affiliates, or others, such as [provide illustrative examples, such as ''your account balance, payment history, parties to transactions, and credit card usage”1; and • Information we receive from a consumer reporting agency, such as [provide illustrative examples, such as ''your creditworthiness and credit history”]. Sample Clause A-5, Alternative 2: We may disclose all of the information we collect, as described [describe location in the notice, such as "above" or "below”1 to companies that perform marketing services on our behalf or to other broker-dealer and/or investment advisers with whom we have joint marketing agreements. Sample Clause A-5, Alternative 3: We may disclose the following information to other broker-dealer and/or investment advisers with which we have joint marketing agreements: • The following information we receive from you: "your name and contact information"; • Information about your transactions with us or our affiliates, such as [provide illustrative examples of own transaction and experience information, such as "your account balance, payment history, parties to transactions, and credit card usage"]. A-6. Explanation of opt-in right (institutions that disclose to nonaffiliates outside of the exceptions) An investment adviser or broker-dealer may use this clause, as applicable, to meet the requirement of V.S.R. § 10-6(a)(6) to provide an explanation of the consumer's right to opt in to the disclosure of nonpublic personal financial information to nonaffiliated third parties, including the method(s) by which the consumer may exercise that right. An investment adviser or broker-dealer may use this clause if it discloses nonpublic personal financial information to Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 13 of 14 nonaffiliated third parties other than as permitted by the exceptions in V.S.R. §§ 10-13, 10-14 and 10-15. Sample Clause A-6-b: We will not disclose nonpublic personal financial information about you to nonaffiliated third parties (other than disclosures permitted by law), unless you authorize us to make those disclosures. Your authorization must be in writing or, if you agree, in electronic form. If you wish to authorize us to disclose your nonpublic personal financial information to nonaffiliated third parties, you may [describe a reasonable means of opting in, such as "sign the attached, postage prepaid card and mail it to us”]. A-7. Confidentiality and security (all institutions) An investment adviser or broker-dealer may use this clause, as applicable, to meet the requirement of V.S.R. § 10-6(a)(8) to describe its policies and practices with respect to protecting the confidentiality and security of nonpublic personal information. Sample Clause A-7: We restrict access to nonpublic personal information about you to [provide an appropriate description, such as "those employees who need to know that information to provide products or services to you”]. We maintain physical, electronic, and procedural safeguards that comply with federal standards to guard your nonpublic personal information. (Authorized by 8 V.S.A. §§ 10 and 15, and 9 V.S.A. § 5605) Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E Page 14 of 14 Bulletin Version History Version Date Description 1 December 5, 2025 Initial Bulletin Issued 2 April 14, 2026 Updated references to Vermont Securities Regulations effective April 10, 2026. Substantive requirements unchanged. Docusign Envelope ID: D5ACB86B-E0F8-4658-AD3D-2A6E241AB46E