As investment adviser firms registered with the U.S. Securities and Exchange Commission (SEC) prepare for compliance with the SEC’s amended Regulation S-P Safeguards Rule, many chief compliance officers are asking an important question:
Is a qualified custodian considered a “service provider” to the SEC-registered investment adviser under the amended Safeguards Rule of Regulation S-P?
Recently, one qualified custodian responded to this question by taking the position that, in its custodial and brokerage capacity, it acts as an independent covered institution and not as a “service provider” to the SEC-registered investment adviser for purposes of Regulation S-P. That interpretation appears to have some support under the structure of the amended Safeguards Rule, although the SEC has not provided definitive custodian-specific guidance on the issue, and investment advisers should be careful not to oversimplify the analysis.
The Custodian’s Position
The qualified custodian explained that it:
- independently receives, maintains, and processes customer information;
- does so in connection with its brokerage and custodial services to account holders; and
- separately complies with applicable privacy and cybersecurity obligations as a covered institution under Regulation S-P.
In other words, the custodian is distinguishing itself from a traditional outsourced vendor of an investment adviser.
That distinction matters because the amended rule does not define “service provider” simply as any third party that has access to client or customer information. Under the SEC’s amended Safeguards Rule, a “service provider” generally refers to an entity that receives, maintains, processes, or otherwise is permitted access to customer information, as defined under Regulation S-P, through providing services directly to a covered institution, such as an SEC-registered investment adviser.
The qualified custodian’s position appears to be that:
- it provides brokerage and custodial services directly to the account holders;
- it independently operates as a regulated financial institution; and
- it is not merely processing information on behalf of the investment adviser in the manner of an outsourced technology or operational vendor.
A broker-dealer, bank or trust company acting as a qualified custodian for account holders may therefore argue that it receives and maintains the information in its own regulated capacity, not as an outsourced function of the investment adviser.
Why the Issue Is Not Entirely Settled
The SEC has not provided a categorical exclusion stating that banks, broker-dealers, or trust companies can never be considered service providers under Regulation S-P. Nor does the amended rule appear to resolve the question solely by entity type.
Importantly, the amended rule and related SEC adopting-release discussion appear to define “service provider” functionally rather than by entity type. In other words, the analysis focuses less on whether an entity is a bank, broker-dealer, or trust company and more on whether the entity receives, maintains, processes, or is otherwise permitted access to customer information through services provided directly to the covered institution.
As a result, a qualified custodian’s position may be more supportable with respect to its core custodial and brokerage functions performed for account holders, while the analysis could differ for adviser-facing services provided directly to the investment adviser.
That distinction matters because many qualified custodians and their affiliates now provide extensive adviser-facing operational and technology infrastructure, including:
- adviser-facing technology platforms;
- portfolio reporting systems;
- adviser portals;
- data feeds;
- integrations and APIs;
- billing services; and
- other operational or workflow tools.
Depending on the structure of those services and the related access to customer information, certain investment adviser-facing arrangements may warrant separate analysis under the amended Safeguards Rule.
Accordingly, investment advisers should avoid treating the issue as an “all-or-nothing” determination and instead apply a relationship-specific, risk-based analysis to custodial and related service arrangements.
What Advisers Should Do Now
Rather than taking an “all-or-nothing” approach, investment advisers should adopt a practical, risk-based compliance strategy.
1. Document the Custodian’s Position
If your qualified custodian provides written clarification regarding its Regulation S-P interpretation, retain that correspondence within your compliance files.
This demonstrates that the investment adviser identified the issue and evaluated it thoughtfully.
2. Continue Treating the Custodian as a Critical Third Party
Even if the qualified custodian is not formally classified as a Regulation S-P “service provider,” it remains one of the firm’s most important third-party relationships due to:
- extensive access to client information;
- operational dependence;
- account access, asset custody, and transaction processing;
- data integration; and
- cybersecurity exposure.
From a practical compliance standpoint, qualified custodians should remain part of the investment adviser’s broader cybersecurity and third-party/custodian due diligence oversight framework.
3. Perform Ongoing Cybersecurity Due Diligence
Investment advisers should continue reviewing available:
- cybersecurity disclosures;
- privacy policies;
- incident-response materials;
- business continuity information;
- SOC reports, if available;
- platform security information; and
- third-party risk documentation.
In examinations, securities regulators are increasingly focused on whether firms can demonstrate ongoing third-party and cybersecurity risk evaluation — particularly for critical relationships involving access to sensitive customer information.
4. Review Adviser-Facing Services Separately
Many SEC-registered investment advisers may need to separately analyze whether certain custodian-related services are being provided directly to the adviser rather than solely to account holders.
This review may include:
- adviser platform agreements;
- portal terms;
- integration agreements;
- reporting arrangements;
- data-feed relationships; and
- other technology services.
The legal and operational characterization of those services could differ from the custodian’s traditional brokerage and custody functions.
5. Seek Additional Clarity Regarding Incident Notification
One practical concern under amended Regulation S-P is incident notification timing and coordination.
Importantly, if the qualified custodian is not a Regulation S-P service provider to the SEC-registered investment adviser in a particular capacity, the amended rule’s 72-hour service-provider notification provision may not directly apply to that custodial relationship. But investment advisers still need timely information to evaluate their own incident-response and client-notification obligations.
Advisers should also recognize that a custodian’s promise to notify investment advisers when individual customer notice is legally required may be narrower than what the investment adviser needs operationally. The investment adviser may need earlier or broader notice to assess whether its own incident-response procedures are implicated.
Advisers may want to ask qualified custodians:
- whether adviser notification occurs only when individual customer notice is legally required;
- when during the incident-response process advisers would be informed;
- whether advisers will be notified regarding incidents affecting adviser credentials, portals, integrations, reports, or client accounts; and
- whether formal written policies or contractual provisions govern adviser notification procedures.
These operational details may become increasingly important as firms refine their incident-response programs.
A Practical Compliance Approach
At this stage, SEC-registered investment advisers likely do not need to challenge a qualified custodian’s interpretation with respect to its core custodial and brokerage functions performed for account holders or insist that the custodian universally characterize itself as a Regulation S-P service provider.
However, investment advisers should recognize that the analysis may differ depending upon the nature of the specific custodial, operational, technology, reporting, integration, or adviser-facing services being provided and the extent to which those services are provided directly to the SEC-registered investment adviser.
Accordingly, SEC registered investment adviser firms should be prepared to demonstrate that they:
- considered the relevant custodial and adviser-facing relationships;
- evaluated how customer information is received, maintained, processed, accessed, or shared;
- reviewed the applicable contractual and operational arrangements;
- assessed the cybersecurity and incident-response risks associated with those relationships; and
- implemented a reasonable third-party due diligence oversight, and incident-response framework.
As with many areas of cybersecurity regulation, securities regulators will often focus on whether the firm applied a thoughtful, well-documented, risk-based compliance process.
Preparing for SEC Examinations
As SEC examinations increasingly focus on cybersecurity governance, incident response, and third-party due diligence, SEC-registered investment advisers should ensure that their Regulation S-P documentation reflects:
- identified critical third parties;
- documented risk assessments;
- third-party/custodian oversight procedures;
- incident-response coordination processes; and
- ongoing due diligence efforts.
Investment adviser firms that proactively document their analysis and compliance approach will likely be in a significantly stronger position during future examinations.
Related Resources
Regulation S-P: The Upcoming Compliance Deadline for Smaller Investment Advisers (04/27/2026)
Upcoming Reg S-P Deadline for Large Investment Advisers (11/25/2025)
Regulatory Alert – SEC Amends Reg S-P (05/28/2024)
Investment Advisers Should Review Cybersecurity Incident Response Plans of Vendors (03/21/2020)
NASAA Cybersecurity Model Rule Package (05/31/2019)
Sample WSP/CoE – Incident Response Program
Sample WSP/CoE – Information Security Plan
Sample WSP/CoE Section – Service Provider – Due Diligence
Cybersecurity – Best Practices Checklist
Cybersecurity – Best Practices for RIA Collecting Devices for Digital Forensic Expert
Recorded Webinar/IAR CE Course: Mastering SEC’s Amendments to Regulation S-P
Disclosures
This regulatory alert is a brief summary which is general in nature and offered only for educational purposes. It should not be considered as a comprehensive review or analysis of this development. There are certain requirements and exceptions outlined in the rule which are not covered in this regulatory alert. This communication is not intended to constitute compliance consulting advice or apply to any particular investment adviser firm’s specific situation without further analysis. This regulatory alert is not a safe harbor or a legal opinion. The reader should study the actual guidance, rule or enforcement action in detail and consult with his or her compliance professionals. This information in this regulatory alert may become out of date.
*NASAA Disclaimer: NASAA does not endorse any particular provider of IAR CE courses. The content of any course offered by RIA Compliance Consultants, Inc. through CE4Advisers.com and any views expressed therein are our own and do not necessarily reflect the views of NASAA or any of its member jurisdictions.
Posted by Bryan Hill
Labels: Incident Response Plan, Information Security, Privacy Policy, Regulation S-P
