Third Party Users (TPUs) and Confidentiality Agreements - Frequently Asked Questions (FAQs)

Is there a Policy that governs Third-Party Users (TPU)?

Yes. See the System Third-Party Users policy.

What is a TPU?

A TPU is a sole proprietor or an entity that provides support to a supervised Company with its licensing, examination, investigation, consumer complaint, or other activity in the System¹. Examples may include law firms, audit firms, accounting firms, consultants, or compliance providers. TPUs do not include employees of a supervised Company’s parent or subsidiary entities.

What is the purpose of the confidentiality agreement?

The confidentiality agreement entered into by and between a supervised company and the TPU sets forth requirements and establishes expectations regarding the handling and safeguarding of sensitive examination or investigation information of the supervised company.

Does CSBS review or approve TPUs or confidentiality agreements?

No. CSBS provides the SES functionality that supports TPU requests and confidentiality agreement uploads. CSBS does not review, approve, endorse, or validate TPUs or confidentiality agreements.

Does uploading a confidentiality agreement automatically grant TPU access?

No. Uploading a confidentiality agreement does not grant access. All required regulatory approvals must be obtained before a TPU may be added to an examination or investigation. For single-state examinations, the Examiner-in-Charge (EIC) approves or rejects the request. For multi-state examinations, the EIC and all participating state team leads must approve the request.

Can regulators review confidentiality agreements?

Yes. Regulators may review confidentiality agreements when evaluating whether a TPU should be granted access to a supervised company’s SA in the system. A regulator may request additional clarification or information before approving TPU participation.

More information can be found on the SES System Releases page.