Regulation S-P Amendments: What an RIA Has to Have in Place Now

What changed in Regulation S-P?

The SEC adopted amendments to Regulation S-P on May 16, 2024, the first real overhaul since the rule was written in 2000. Before, Reg S-P mostly asked you to have safeguards and send privacy notices. Now it asks you to plan for the day something goes wrong, tell clients when it does, and prove you did both.

Per the SEC’s small entity compliance guide, the amendments:

• require a written incident response program
• require notice to clients whose sensitive information was, or is reasonably likely to have been, accessed or used without authorization
• require written oversight of service providers
• expand the disposal rule so it covers customer information, not just consumer information
• require written records documenting compliance
• codify a statutory exception to the annual privacy notice

The rule applies to investment advisers registered with the SEC, along with broker-dealers, funding portals, investment companies, and registered transfer agents. If you are a state-registered adviser, ask your compliance counsel what applies to you.

The scope also got wider. The safeguarding and disposal rules now cover all “customer information,” meaning any record with nonpublic personal information about a customer that you hold, or that someone holds on your behalf. That last part matters. Your custodian portal, your CRM, and your email provider are all in the picture.

I write about this because I run IT for financial advisors, and nearly every requirement in the rule lands on a system somebody in IT manages.

When did it take effect for smaller firms?

June 3, 2026. The amendments became effective August 2, 2024, with a tiered compliance period. For registered investment advisers, the adopting release draws the line at assets under management:

Today is October 1, 2026. Both dates have passed. There is no grace period left to plan in. If an examiner asks for your incident response program, they expect to see one.

What does the incident response program need?

It has to be written, and it has to be “reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information.” The SEC guide says it must include procedures to:

1. Assess the nature and scope of an incident.
2. Take steps to contain and control it so it doesn’t get worse.
3. Notify affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

Client notice timing. Notice goes out “as soon as practicable, but not later than 30 days” after you become aware the unauthorized access happened or is reasonably likely to have happened. It has to describe the incident, the data involved, and what clients can do to protect themselves.

The exception. You don’t have to notify if, after a reasonable investigation, you determine the sensitive information has not been, and is not reasonably likely to be, used in a way that would cause substantial harm or inconvenience. The key words are “reasonable investigation.” You have to actually do one, and you have to write down how you reached the answer.

The delay. Notice can be delayed only if the U.S. Attorney General determines it poses a substantial risk to national security or public safety and tells the SEC in writing. For a small RIA, plan as if that will never apply.

“Sensitive customer information” is narrower than all customer information. The SEC’s examples are a Social Security number, or an account number or username paired with something that could get someone into the account. That is exactly what sits in an advisor’s inbox on any given day.

Here is the practical version. When we handled a title company closer whose inbox was taken over, the containment steps were a password reset, killing every session, removing the attacker’s mail rules, and a phone call to the other party. Under Reg S-P, an advisory firm in the same spot would also need to work out what client data was in that mailbox, whether it was reasonably likely to be misused, and whether the 30-day notice clock had started. You can’t answer those questions well at 11 a.m. on the day it happens unless the procedure was written before.

What about your vendors?

You need written policies “reasonably designed to require oversight, including through due diligence and monitoring,” of your service providers. A service provider is anyone who receives, maintains, processes, or is otherwise permitted access to customer information through services they provide directly to you.

That list is longer than most firms think. It includes your CRM, your financial planning software, your document storage, your email host, and your IT provider. Yes, that includes us.

Those policies must be reasonably designed to make sure each provider:

• takes appropriate measures to protect against unauthorized access to or use of customer information, and
• notifies you as soon as possible, and no later than 72 hours after becoming aware of a breach that resulted in unauthorized access to a customer information system they maintain.

When that notice comes in, your own incident response program has to kick off. You can sign a written agreement letting a vendor send client notices on your behalf, but the SEC is clear that the responsibility for the notice stays with you.

In practice: pull your vendor list, find the contracts, and check that each one says what happens and how fast if they get breached. Where a contract says nothing, that’s your gap.

What IT has to document

The amendments added a new paragraph, 204-2(a)(25), to the Advisers Act books-and-records rule. RIAs now have to keep:

• the written incident response policies and procedures
• written documentation of any detected unauthorized access to customer information, and the response and recovery
• written documentation of any investigation into whether notice was required, including the basis for the decision, any Attorney General delay letter, and a copy of any notice sent
• the written service provider oversight policies, and any contracts or agreements made under them
• the written disposal policies and procedures

The adopting release notes that Rule 204-2 records are kept for five years, the first two in an easily accessible place.

Most of what goes in that file comes out of IT. Sign-in logs that show when an account was accessed and from where. Mailbox audit logs that show what an attacker opened. An asset list that tells you which laptop held which client files. If those logs aren’t turned on and kept, the “reasonable investigation” behind a no-notice decision has nothing to stand on. The financial advisors page covers the day-to-day controls we put around that data.

This is a summary, not legal advice. Confirm the specifics for your firm with your compliance counsel.

What this looks like when we do it

We map controls to the specific rule, and for an RIA that rule is Reg S-P. The work is boring on purpose:

• Write the IT half of the incident response program. Who calls whom, how we contain a compromised account, which logs we pull, and where the evidence lands so your CCO can make the notice call within 30 days.
• Turn on the logs the investigation depends on, and keep them long enough to matter.
• Build the vendor list from what’s actually on your network, not from memory, so your oversight policy covers the real systems that hold client data.
• Keep the paper trail. Every incident, every decision, every notice, filed where an examiner can find it.

When something does go wrong, critical issues get a response in under 15 minutes. The owner of the firm doesn’t have to sort out a compromised inbox alone.

If you’re an RIA in East Tennessee and you aren’t sure your Reg S-P file would hold up, book a 15-minute call. Month-to-month, three-user minimum, and I’ll tell you straight what’s missing.