If you run an SEC-registered advisory firm, Regulation S-P isn't new. It has required written policies to protect client information for years. What changed is the set of amendments the SEC adopted in May 2024, which spell out what you have to do when something goes wrong.
Larger firms had to comply by December 3, 2025. Smaller firms had until June 3, 2026. That means the amended rule now applies to every SEC-registered advisor, whatever its size. For advisors, the line between larger and smaller was $1.5 billion in assets under management.
Here's what the amendments require, and what meeting them looks like in a small or mid-sized practice.
Who it covers
Regulation S-P applies to SEC-registered investment advisers, broker-dealers, investment companies, funding portals and transfer agents.
Advisors registered with the state instead of the SEC aren't covered by Regulation S-P, but that doesn't leave them without rules. The FTC Safeguards Rule lists "investment advisors that aren't required to register with the SEC" among the businesses it covers, and state regulators have their own expectations.
1. A written incident response program
Your safeguards policies now have to include a written program "reasonably designed to detect, respond to, and recover from" unauthorized access to or use of customer information. It has to include procedures to:
- Assess what happened, and which systems and information were involved
- Contain and control the incident
- Notify affected clients when the rule requires it
Notice the word "detect." A plan that says "call IT" doesn't help much if nobody would notice an intrusion in the first place. In practice, that means a written plan plus monitoring that would actually catch an intrusion.
2. Vendor oversight, with 72-hour notice
You need written policies for due diligence and ongoing monitoring of service providers that have access to customer information. Those policies must be reasonably designed to make sure a provider tells you as soon as possible, and no later than 72 hours after it becomes aware of a breach that gives someone unauthorized access to customer information systems it maintains.
Think about every outside company that touches client data: your CRM, financial planning and portfolio software, document storage, email, your IT provider and your shredding company. The rule doesn't require you to write the 72-hour timeline into each contract, but many firms do, because it's the clearest way to show the requirement is covered.
3. Client notice within 30 days
The clock starts when you become aware that unauthorized access to customer information has occurred or is reasonably likely to have occurred. If sensitive customer information was, or is reasonably likely to have been, involved, you must notify the affected individuals as soon as practicable, and no later than 30 days after that.
Sensitive customer information is defined broadly: any piece of customer information that, alone or combined with other information, could create a reasonably likely risk of substantial harm or inconvenience if compromised. Examples include Social Security numbers, driver license and passport numbers, and an account number together with the password or code that opens it.
The notice has to describe what happened in general terms, the type of information involved, the date, estimated date or date range if it can reasonably be determined, and contact information including a phone number. It also has to suggest specific steps clients can take, like reviewing account statements, placing a fraud alert and getting their free credit reports.
There is one exception. You don't have to notify clients if, after a reasonable investigation, you determine the information hasn't been used, and isn't reasonably likely to be used, in a way that would cause substantial harm or inconvenience. That conclusion depends on evidence: logs showing what was and wasn't accessed. Without them, it's hard to show anything other than the worst case.
The rule requires notice to individuals, not to the SEC. Notice can be delayed only if the U.S. Attorney General decides it would pose a substantial risk to national security or public safety and tells the SEC in writing. The first delay is up to 30 days.
4. Records
You have to keep written records that show you're complying, including:
- Your safeguards, incident response, vendor oversight and disposal policies
- Documentation of any detected unauthorized access to customer information, your response, and any investigation and decision on whether to notify clients
- Copies of any notices you sent
- Any agreement for a service provider to send notices on your behalf
Good habits go beyond the minimum. If a staff member enters a password on a phishing page, investigate and write it down, even if nothing was accessed. That record is what supports a decision not to notify clients.
5. A broader definition of customer information
The amendments replaced the old term "customer records and information" with "customer information." It now covers nonpublic personal information held by or for your firm about customers of any financial institution, including information another financial institution shares with you about its customers, not just records about your own clients.
What this looks like in a small advisory firm
There's no official checklist. For most small and mid-sized firms, these steps cover what the amendments describe:
- A written incident response plan, a few pages long, naming who does what. Keep the phone numbers somewhere you can reach if email is down.
- 24/7 monitoring on computers and Microsoft 365, so someone notices an intrusion at 2 a.m.
- Multi-factor authentication on email, your CRM, custodian portals and document storage
- A vendor list showing which providers have access to client data, your due diligence notes and their breach notice terms
- An incident log that includes suspected incidents and how you resolved them
- A yearly practice run. Walk through a scenario, like a hacked email account or a lost laptop, with the people who would be involved.
- Encrypted laptops and phones, with the ability to wipe a lost device
- A callback rule for money movement requests that arrive by email. Here's how to spot a fake payment request.
- Staff training, because most incidents start with an email
Where IT fits
Regulation S-P is your firm's obligation, and your chief compliance officer owns the policies. Your IT provider supplies much of what makes them work: the monitoring that detects an incident, the logs that show what was accessed, the investigation, and the technical safeguards behind your written procedures.
During an incident, that evidence can decide whether you have to notify clients at all.
How we help
We support financial advisors across the Phoenix area with the technical side of Regulation S-P: 24/7 security monitoring, multi-factor authentication, encrypted devices, email protection, and a written incident response plan to go with them. We work alongside your compliance consultant or attorney, not in place of them.
This article is general information, not legal or compliance advice. Your compliance counsel can tell you how Regulation S-P applies to your firm.