Gramm-Leach-Bliley Act (GLBA) is the correct option.

Gramm-Leach-Bliley Act (GLBA) is a United States federal law that specifically governs how financial institutions handle customers personally identifiable information. The law includes the Financial Privacy Rule and the Safeguards Rule and it requires firms to provide privacy notices to customers and to implement administrative, technical, and physical safeguards to protect nonpublic personal information.

Payment Card Industry Data Security Standard (PCI DSS) is not a United States statute. It is an industry security standard managed by the PCI Security Standards Council and it focuses on protecting payment card data rather than establishing statutory obligations for banks.

General Data Protection Regulation (GDPR) is an EU regulation and not a US law. It governs personal data processing in the European Union and does not serve as the United States statute that controls how banks handle customer PII.

Health Insurance Portability and Accountability Act (HIPAA) is a United States law but it applies to protected health information for covered entities and their business associates. It does not generally govern how banks handle financial customer information unless a bank is acting in a role that brings it under HIPAA rules, which is uncommon.

Full AWS Practitioner Certification Question