Guide
Regulation S-P Compliance Checklist for RIAs and Broker-Dealers
The amended SEC Regulation S-P now applies to covered firms of every size. This checklist covers the IT controls and records advisers and broker-dealers need to meet it.
Key takeaways
- Larger firms had to comply by December 3, 2025 and smaller firms by June 3, 2026.
- Every covered firm needs a written incident response program that can detect, respond to and recover from unauthorized access to customer information.
- Affected individuals must be notified no later than 30 days after the firm becomes aware of unauthorized access to sensitive customer information, unless an investigation shows harm is not reasonably likely.
- Service providers must notify the firm within 72 hours of a breach affecting customer information.
The rule
What changed in Regulation S-P
The SEC adopted amendments to Regulation S-P in May 2024. Regulation S-P has long required broker-dealers, investment companies and SEC-registered investment advisers to have written policies and procedures that protect customer records and information. The amendments add specific requirements for responding to incidents, notifying customers, overseeing vendors and keeping records, and they extend the rule to transfer agents.
Who has to comply
Broker-dealers (including funding portals), investment companies, investment advisers registered with the SEC and transfer agents. Larger entities, such as advisers with $1.5 billion or more in assets under management, had to comply by December 3, 2025. Smaller entities had until June 3, 2026, so the amended rule now applies to every covered firm.
The new core requirements
- Incident response program: written procedures to detect, respond to and recover from unauthorized access to or use of customer information, including assessing and containing an incident.
- Customer notification: notice to affected individuals as soon as practicable, and no later than 30 days after becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.
- Service provider oversight: policies and procedures that require service providers to protect customer information and to notify the firm within 72 hours of becoming aware of a breach affecting it.
- Recordkeeping: written records showing the firm followed its policies, including incident investigations and notification decisions.
- Broader coverage: the safeguards now also cover information the firm holds about customers of other financial institutions.
Checklist
Regulation S-P IT compliance checklist
Use this list to check whether the technology behind your program can support what the written policies promise.
- Map where customer information lives: CRM, portfolio management, custodian downloads, Microsoft 365 mailboxes and OneDrive, file shares, scanners, backups and vendor platforms.
- Require multi-factor authentication everywhere customer information can be reached, including email, remote access, CRM and custodian portals.
- Limit access by role, review it at least once a year and remove access the day someone leaves.
- Keep the logs you need to investigate: Microsoft 365 audit and sign-in logs and endpoint detection and response data, kept long enough to reconstruct what happened.
- Encrypt laptops, phones and email that carry customer information.
- Run endpoint detection and response and email security to catch account takeover and ransomware early.
- Write and test the incident response program with a tabletop exercise, including who decides whether customer notice is required.
- Prepare customer notices in advance: templates, a current client contact list and a decision log for the substantial harm or inconvenience assessment.
- List every service provider that receives, maintains or processes customer information, confirm the 72-hour notice is covered and review their security, for example their SOC 2 reports.
- Keep the records: policies, incident files, notification decisions and service provider oversight.
- Train staff to spot phishing and to confirm money-movement requests through a known phone number.
- Back up and test restores so an incident does not turn into an outage.
Managed IT
Where managed IT fits
Most of this checklist is technical work that happens every day, not once a year. FinFortify’s managed IT services for financial advisors put multi-factor authentication, logging, endpoint detection and response, encryption and tested backups in place and keep the records your chief compliance officer needs. As your IT provider we are also one of the service providers your program oversees, and we work with your compliance team on the 72-hour notification requirement.
See our IT compliance services and managed cybersecurity services for more detail.
This guide is general information about IT and cybersecurity practices, not legal advice. Your compliance officer or counsel should confirm how each rule applies to your firm.
FAQ
Regulation S-P questions
When did the amended Regulation S-P take effect?
The amendments became effective in August 2024. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026.
Does Regulation S-P apply to state-registered investment advisers?
Regulation S-P covers investment advisers registered with the SEC. State-registered advisers are generally subject to the FTC Safeguards Rule and state requirements instead, which call for many of the same safeguards.
How fast do we have to notify clients after a breach?
As soon as practicable, and no later than 30 days after becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless a reasonable investigation shows it has not been and is not reasonably likely to be used in a way that would cause substantial harm or inconvenience.
Get your Regulation S-P controls in place
Talk with us about a compliance gap assessment for your advisory firm.
