Gramm-Leach-Bliley Act

The Gramm-Leach-Bliley Act (GLBA), enacted in 1999, is the Financial Services Modernization Act. It repealed key provisions of the Glass-Steagall Act, allowing financial institutions to combine commercial banking, investment banking, and insurance under one holding company. GLBA also created a privacy rule protecting consumer financial information and updated regulations for a new era of “financial services” supermarkets.

Repeal of Glass-Steagall: Section 225

The headline of GLBA was the repeal of Glass-Steagall’s separations. Section 225 explicitly repealed Section 20 of the Glass-Steagall Act, which had prohibited banks from affiliating with securities firms. Banks could now directly engage in securities underwriting and trading. Insurance companies could affiliate with banks. The old walls came down.

This was not entirely a surprise — regulatory interpretation had been eroding Glass-Steagall since the 1980s. By 1999, major banks were already combining commercial and investment operations through holding companies. GLBA simply formalized and accelerated the merger.

The financial holding company structure

GLBA created a new regulatory structure: the “financial holding company.” A bank holding company could now engage in virtually any financial service, including investment banking, insurance, and securities trading. However, it had to comply with regulatory approval and maintained specified conditions:

• Its insured depository institutions had to be well-capitalized and well-managed
• It had to comply with Community Reinvestment Act (lending to low-income communities)
• It had to have adequate risk management

This structure allowed consolidation at the holding company level (a Citigroup holding company could own Citibank, Citigroup Securities, and Citigroup Insurance) but imposed some controls.

Regulatory fragmentation and functional regulation

GLBA attempted to address the fact that different financial services had been regulated by different agencies. It created a system of “functional regulation” in which:

• The SEC regulates securities activities
• The CFTC regulates futures
• Banking regulators (OCC, Federal Reserve, FDIC) regulate banking
• State regulators regulate insurance

The holding company (the parent) is supervised by the Federal Reserve. The idea was that each activity would be regulated by the agency with expertise, and the Fed would monitor the whole organization for systemic risk.

In practice, this created gaps and overlaps. A large bank might be regulated by four federal agencies plus state agencies, and communication between them was spotty. The 2008 financial crisis revealed the weakness of this fragmented system.

The Privacy Rule

GLBA also contained a major consumer protection: the Privacy Rule. It required financial institutions to disclose their privacy practices and gave consumers a right to opt out of sharing personal financial information with nonaffiliated third parties. The rule aimed to prevent banks from selling customer information to marketers without consent.

However, the rule had holes. Banks could share information with affiliates without consent (a Citibank could share with Citicorp Insurance without asking). And “nonaffiliated third parties” often excluded firms that were functionally part of the financial conglomerate. The Privacy Rule is considered weak; most consumer advocates wanted stronger protections.

Insurance regulation remains state-based

GLBA allowed banks and securities firms to enter insurance but did not federalize insurance regulation. Insurance remains primarily regulated by state insurance commissioners. This has created odd situations where a federal bank holding company owns an insurance company regulated at the state level, with uneven oversight.

Post-crisis assessment

After the 2008 financial crisis, GLBA was re-examined. Some argued its repeal of Glass-Steagall was a key factor — that universal banks took excessive risk and that separation would have prevented the crisis. Others noted that investment banks (not covered by Glass-Steagall or GLBA) also failed, so separation may not have helped. The Dodd-Frank Act (2010) did not repeal GLBA but imposed new capital standards and the Volcker Rule, which partially re-implemented Glass-Steagall concepts.

See also