# Gramm–Leach–Bliley Act

Canonical: https://web4.xpay.bi/en/wiki/wp-en-164103/

Language: en

Published: 2026-10-30T17:10:05.932Z

Updated: 2026-10-30T17:10:05.932Z

The Gramm–Leach–Bliley Act (GLBA), also known as the Financial Services Modernization Act of 1999, (Pub. L. 106–102 (text) (PDF), 113 Stat. 1338, enacted November 12, 1999) is an Act of the 106th United States Congress (1999–2001). It repealed part of the Glass–Steagall Act of 1933, removing barriers in the market among banking companies, securities companies, and insurance companies tha

## Key facts

## Overview

The Gramm–Leach–Bliley Act (GLBA), also known as the Financial Services Modernization Act of 1999, (Pub. L. 106–102 (text) (PDF), 113 Stat. 1338, enacted November 12, 1999) is an Act of the 106th United States Congress (1999–2001). It repealed part of the Glass–Steagall Act of 1933, removing barriers in the market among banking companies, securities companies, and insurance companies that prohibited any one institution from acting as any combination of an investment bank, a commercial bank, and an insurance company. With the passage of the Gramm–Leach–Bliley Act, commercial banks, investment banks, securities firms, and insurance companies were allowed to consolidate. Furthermore, it failed to give to the SEC or any other financial regulatory agency the authority to regulate large investment bank holding companies. The legislation was signed into law by President Bill Clinton. A year before the law was passed, Citicorp, a commercial bank holding company, merged with the insurance company Travelers Group in 1998 to form the conglomerate Citigroup, a corporation combining banking, securities and insurance services under a house of brands that included Citibank, Smith Barney, Primerica, and Travelers. Because this merger was a violation of the Glass–Steagall Act and the Bank Holding Company Act of 1956, the Federal Reserve gave Citigroup a temporary waiver in September 1998. Less than a year later, GLBA was passed to legalize these types of mergers on a permanent basis. The law also repealed Glass–Steagall's conflict of interest prohibitions "against simultaneous service by any officer, director, or employee of a securities firm as an officer, director, or employee of any member bank".

## Legislative history

The banking industry had been seeking the repeal of the 1933 Glass–Steagall Act since the 1980s, if not earlier. In 1987 the Congressional Research Service prepared a report that explored the cases for and against preserving the Glass–Steagall Act.

Respective versions of the Financial Services Act were introduced in the U.S. Senate by Phil Gramm (R–Texas) and in the U.S. House of Representatives by Jim Leach (R-Iowa). The third lawmaker associated with the bill was Rep. Thomas J. Bliley Jr. (R-Virginia), Chairman of the House Commerce Committee from 1995 to 2001. During debate in the House of Representatives, Rep. John Dingell (D–Michigan) argued that the bill would result in banks becoming "too big to fail". Dingell further argued that this would necessarily result in a bailout by the Federal Government. The House passed its version of the Financial Services Act of 1999 on July 1, 1999, by a bipartisan vote of 343–86 (Republicans 205–16; Democrats 138–69; Independent 0–1), two months after the Senate had already passed its version of the bill on May 6 by a much narrower 54–44 vote along basically partisan lines (53 Republicans and 1 Democrat in favor; 44 Democrats opposed).

When the two chambers could not agree on a joint version of the bill, the House voted on July 30 by a vote of 241–132 (R 58–131; D 182–1; Ind. 1–0) to instruct its negotiators to work for a law which ensured that consumers enjoyed medical and financial privacy as well as "robust competition and equal and non-discriminatory access to financial services and economic opportunities in their communities" (i.e., protection against exclusionary redlining). The bill then moved to a joint conference committee to work out the differences between the Senate and House versions. Democrats agreed to support the bill after Republicans agreed to strengthen provisions of the anti-redlining Community Reinvestment Act and address certain privacy concerns; the conference committee then finished its work by the beginning of November. On November 4, the final bill resolving the differences was passed by the Senate 90–8, and by the House 362–57. The legislation was signed into law by President Bill Clinton on November 12, 1999.

## Changes caused by the Act

Many of the largest banks, brokerages, and insurance companies desired the Act at the time. The justification was that individuals usually put more money into investments when the economy is doing well, but they put most of their money into savings accounts when the economy turns bad. With the new Act, they would be able to do both 'savings' and 'investment' at the same financial institution, which would be able to do well in both good and bad economic times. Prior to the Act, most financial services companies were already offering both saving and investment opportunities to their customers. On the retail/consumer side, a bank called Norwest Corporation, which would later merge with Wells Fargo Bank, led the charge in offering all types of financial services products in 1986. American Express attempted to own participants in almost every field of financial business (although there was little synergy among them). Things culminated in 1998 when Citibank merged with The Travelers Companies, creating Citigroup. The merger violated the Bank Holding Company Act (BHCA), but Citibank was given a two-year forbearance that was based on an assumption that they would be able to force a change in the law. The Gramm–Leach–Bliley Act passed in November 1999, repealing portions of the BHCA and the Glass–Steagall Act, allowing banks, brokerages, and insurance companies to merge, thus making the CitiCorp/Travelers Group merger legal. Also prior to the passage of the Act, there were many relaxations to the Glass–Steagall Act. For example, a few years earlier, commercial Banks were allowed to pursue investment banking, and before that banks were also allowed to begin stock and insurance brokerage. Insurance underwriting was the only main operation they weren't allowed to do, something rarely done by banks even after the passage of the Act. The Act further enacted three provisions that allow for bank holding companies to engage in physical commodity activities. Prior to the enactment of the Act those activities were limited to those that were so closely related to banking to be considered incidental to it. Under GLBA depending on the provision the institution falls into, bank holding companies can engage in physical commodity trading, energy tolling, energy management services, and merchant banking activities. Much consolidation occurred in the financial services industry since, but not at the scale some had expected. Retail banks, for example, do not tend to buy insurance underwriters, as they seek to engage in a more profitable business of insurance brokerage by selling products of other insurance companies. Other retail banks were slow to market investments and insurance products and package those products in a convincing way. Brokerage companies had a hard time getting into banking, because they do not have a large branch and backshop footprint. Banks have recently tended to buy other banks, such as the 2004 Bank of America and Fleet Boston merger, yet they have had less success integrating with investment and insurance companies. Many banks have expanded into investment banking, but have found it hard to package it with their banking services, without resorting to questionable tie-ins which caused scandals at Smith Barney.

## Remaining restrictions

Crucial to the passing of this Act was an amendment made to the GLBA, stating that no merger may go ahead if any of the financial holding institutions, or affiliates thereof, received a "less than satisfactory  \[sic\] rating at its most recent CRA exam", essentially meaning that any merger may only go ahead with the strict approval of the regulatory bodies responsible for the Community Reinvestment Act (CRA). This was an issue of hot contention, and the Clinton Administration stressed that it "would veto any legislation that would scale back minority-lending requirements." GLBA also did not remove the restrictions on banks placed by the Bank Holding Company Act of 1956 which prevented financial institutions from owning non-financial corporations. It conversely prohibits corporations outside of the banking or finance industry from entering retail and/or commercial banking. Many assume Wal-Mart's desire to convert its industrial bank to a commercial/retail bank ultimately drove the banking industry to back the GLBA restrictions. Some restrictions remain to provide some amount of separation between the investment and commercial banking operations of a company. For example, licensed bankers must have separate business cards, e.g., "Personal Banker, Wells Fargo Bank" and "Investment Consultant, Wells Fargo Private Client Services". Much of the debate about financial privacy is specifically centered around allowing or preventing the banking, brokerage, and insurances divisions of a company from working together. In terms of compliance, the key rules under the Act include The Financial Privacy Rule which governs the collection and disclosure of customers' personal financial information by financial institutions. It also applies to companies, regardless of whether they are financial institutions, that receive such information. The Safeguards Rule requires all financial institutions to design, implement and maintain safeguards to protect customer information. The Safeguards Rule applies not only to financial institutions that collect information from their own customers, but also to financial institutions – such as credit reporting agencies, appraisers, and mortgage brokers – that receive customer information from other financial institutions.

## Privacy

GLBA compliance is mandatory; whether a financial institution discloses nonpublic information or not, there must be a policy in place to protect the information from foreseeable threats in security and data integrity. Major components put into place to govern the collection, disclosure, and protection of consumers' nonpublic personal information; or personally identifiable information include: Financial Privacy Rule Safeguards Rule Pretexting Protection

## Financial Privacy Rule

(Subtitle A: Disclosure of Nonpublic Personal Information, codified at 15 U.S.C. §§ 6801–6809) The Financial Privacy Rule requires financial institutions to provide each consumer with a privacy notice at the time the consumer relationship is established and annually thereafter. The privacy notice must explain the information collected about the consumer, where that information is shared, how that information is used, and how that information is protected. The notice must also identify the consumer's right to opt out of the information being shared with unaffiliated parties pursuant to the provisions of the Fair Credit Reporting Act. Should the privacy policy change at any point in time, the consumer must be notified again for acceptance. Each time the privacy notice is reestablished, the consumer has the right to opt out again. The unaffiliated parties receiving the nonpublic information are held to the acceptance terms of the consumer under the original relationship agreement. In summary, the financial privacy rule provides for a privacy policy agreement between the company and the consumer pertaining to the protection of the consumer's personal nonpublic information. On November 17, 2009, eight federal regulatory agencies released the final version of a model privacy notice form to make it easier for consumers to understand how financial institutions collect and share information about consumers.

## Financial institutions

GLBA defines financial institutions as: "companies that offer financial products or services to individuals, like loans, financial or investment advice, or insurance". The Federal Trade Commission (FTC) has jurisdiction over financial institutions similar to, and including, these:

Non-bank mortgage lenders, Real estate appraisers, Loan brokers, Some financial or investment advisers, Debt collectors, Tax return preparers, Banks, and Real estate settlement service providers. These companies must also be considered significantly engaged in the financial service or production that defines them as a "financial institution". Insurance has jurisdiction first by the state, provided the state law at minimum complies with the GLB. State law can require greater compliance, but not less than what is otherwise required by the GLB.

## Consumer vs. customer defined

The Gramm–Leach–Bliley Act defines a "consumer" as

"an individual who obtains, from a financial institution, financial products or services which are to be used primarily for personal, family, or household purposes, and also means the legal representative of such an individual." (See 15 U.S.C. § 6809(9).) A customer is a consumer that has developed a relationship with privacy rights protected under the GLB. A customer is not someone using an automated teller machine (ATM) or having a check cashed at a cash advance business. These are not ongoing relationships like a customer might have—i.e., a mortgage loan, tax advising, or credit financing. A business is not an individual with personal nonpublic information, so a business cannot be a customer under the GLB. A business, however, may be liable for compliance to the GLB depending upon the type of business and the activities utilizing individual's personal nonpublic information.

Definition: A "consumer" is an individual who obtains or has obtained a financial product or service from a financial institution that is to be used primarily for personal, family, or household purposes, or that individual's legal representative. Examples of consumer relationships:

Applying for a loan Obtaining cash from a foreign ATM, even if it occurs on a regular basis Cashing a check with a check-cashing company Arranging for a wire transfer Definition: A "customer" is a consumer who has a "customer relationship" with a financial institution. A "customer relationship" is a continuing relationship with a consumer. Examples of establishing a customer relationship:

Opening a credit card account with a financial institution Entering into an automobile lease (on a non-operating basis for an initial lease term of at least 90 days) with an automobile dealer Providing personally identifiable financial information to a broker in order to obtain a mortgage loan Obtaining a loan from a mortgage lender Agreeing to obtain tax preparation or credit counseling services "Special Rule" for Loans: The customer relationship travels with ownership of the servicing rights.

## Consumer/client privacy rights

Under the GLB, financial institutions must provide their clients a privacy notice that explains what information the company gathers about the client, where this information is shared, and how the company safeguards that information. This privacy notice must be given to the client prior to entering into an agreement to do business. There are exceptions to this when the client accepts a delayed receipt of the notice in order to complete a transaction on a timely basis. This has been somewhat mitigated due to online acknowledgement agreements requiring the client to read or scroll through the notice and check a box to accept terms. The privacy notice must also explain to the customer the opportunity to 'opt out'. Opting out means that the client can say "no" to allowing their information to be shared with nonaffiliated third parties. The Fair Credit Reporting Act is responsible for the 'opt-out' opportunity, but the privacy notice must inform the customer of this right under the GLB. The client cannot opt out of:

Information shared with those providing priority service to the financial institution Marketing of products or services for the financial institution When the information is deemed legally required. When entering into a financial transaction, the institution providing said transaction must provide the customer a secure room with the ability to close in order to better protect the clients personal information.

## Service of notice requirements

Notice requirements may vary. In most cases, service of a GLBA notice is not necessary unless the entity serving the notice intends to "share" customer information, which the FTC defines as, "non-public personal information (NPI)", of customers required to be protected under GLBA.

## Response to receipt of a GLBA notice

A consumer may react to service of a GLBA notice by:

Not responding Indicating, on an acknowledgment form that notice was not provided (typically for in-person signed documents) Responding according to format suggested in the GLBA Notice Responding with a prepared letter (alone or in addition to the form)

## Synergy between GLBA and GDPR

The European Union's General Data Protection Regulation (GDPR) became enforceable on 25 May 2018. As applies to consumers, the GDPR includes provision on scope of data collection, but also includes right of access, right to erasure, right to restriction of processing and right to data portability. Due to the multinational nature of some transactions, including data and internet transactions, and the possible implementation of corresponding regulations in some US states, it is likely that business and other entities will comply with the GDPR as well as US GLBA requirements. Individualized requests for privacy under the GLBA are likely to include provisions guaranteed by the European Union's GDPR.

## Sources

- Gramm–Leach–Bliley Act · Wikipedia: https://en.wikipedia.org/?curid=164103

Source: Wikipedia contributors — https://en.wikipedia.org/?curid=164103&oldid=1372721844

Licence: CC BY-SA 4.0 — https://creativecommons.org/licenses/by-sa/4.0/

Adaptation notice: Reformatted for XPay; the source may be abridged, restructured or translated. Consult the cited revision for the original.