17 CFR 227.305: Payments to third parties.

(a) Prohibition on payments for personally identifiable information. An intermediary may not compensate any person for providing the intermediary with the personally identifiable information of any investor or potential investor in securities offered and sold in reliance on section 4(a)(6) of the Securities Act (15 U.S.C. 77d(a)(6)).

(b) For purposes of this rule, personally identifiable information means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.