Where could I find penalties for violations of Reg P Privacy? I didn't see a section under the regulation.

There are no specific penalties in the regulation, nor in GLBA. However, as with any regulation, the regulators have the authority to assess civil money penalties (CMPs) for non compliance under the National Bank Act, Federal Reserve Act, or the Federal Deposit Insurance Act. The top end on CMPs is generally $1.1MM per day.

In addition, you may be subject to action in state court under unfair and deceptive trade practices statutes. Prior to the passage of GLB, state AGs (that's either Attorney General or Aspiring Governor, depending on your level of cynicism) pursued several successful actions against banking organizations such as Fleet and US Bank.

You can also anticipate exposure in civil courts, once again for unfair and deceptive acts and practices.

The biggest risk is the harm to your reputation, however. And that's all you have to sell, in the end. If clients don't trust you, you'll be out of business soon enough.

Thanks for taking the time to provide this information. It's just what I was looking for.