The compliance deadline for smaller SEC-registered investment advisers under the U.S. Securities and Exchange Commission’s amended Regulation S-P is quickly approaching. Smaller SEC-registered investment advisers — generally those with less than $1.5 billion in regulatory assets under management — must comply with the amended Regulation S-P requirements by June 3, 2026. The SEC announced that smaller entities would have 24 months after Federal Register publication to comply, and the final amendments were published on June 3, 2024.
For many investment adviser firms, these amendments are not merely a “policy update.” They may require a more structured compliance build-out involving a written incident response program, customer notification procedures, service provider oversight, updated due diligence processes, privacy notice review, disposal procedures, training, and testing.
As we discussed in our prior post, Regulation S-P: The Upcoming Compliance Deadline for Smaller Investment Advisers, the amended Regulation S-P applies directly to SEC-registered investment advisers, not state-registered investment advisers. However, state securities regulators may view similar information security, cybersecurity, privacy, vendor oversight, and incident response practices as relevant to reasonable supervisory and fiduciary practices.
What Is the Compliance Date?
The compliance dates for the SEC’s amended Regulation S-P requirements are the following:
December 3, 2025 – Large SEC-registered investment advisers with $1.5 billion or more in RAUM; and
June 3, 2026 – Smaller SEC-registered investment advisers with less than $1.5 billion in RAUM.
For smaller SEC-registered investment adviser firms, the June 3, 2026 deadline is now close enough that firms should be focused on finalizing, documenting, and testing implementation rather than merely planning for it.
Key Regulation S-P Requirements for Investment Advisers
The SEC’s amended Regulation S-P represents a significant expansion of customer information safeguarding expectations. While each firm’s implementation should be tailored to its business model, technology environment, service providers, and client relationships, the following areas should generally be reviewed.
Written Incident Response Program
SEC-registered investment advisers must adopt and maintain a written incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. In practice, this means an investment adviser firm should have a documented process for identifying potential incidents, escalating concerns internally, assessing the scope of affected information, containing the incident, and determining whether customer notification is required.
A written incident response program should generally identify responsible personnel, escalation procedures, investigation steps, containment and control measures, documentation requirements, and post-incident review expectations. SEC-registered investment adviser firms should also consider whether they have tested the plan through a tabletop exercise or similar review.
Customer Notification Framework
The amended rule requires covered firms to notify affected individuals as soon as practicable, but no later than 30 days after becoming aware that sensitive customer information was accessed without authorization or was reasonably likely to have been accessed or used without authorization, unless a narrow exception applies.
For this reason, investment adviser firms should not wait until an incident occurs to determine how customer notification decisions will be made. Firms should consider developing procedures for identifying affected individuals, evaluating whether sensitive customer information was involved, determining whether notification is required, coordinating with legal and compliance professionals, and documenting the basis for the firm’s conclusions.
Service Provider Oversight
Service provider oversight is now an express part of the Regulation S-P framework. SEC-registered investment adviser firms should review service providers that receive, maintain, process, or otherwise have access to customer information and consider whether the firm has a reasonable basis for believing it will receive timely notice of relevant cybersecurity incidents.
This review may include due diligence questionnaires, contract provisions, vendor cybersecurity materials, business continuity information, incident response representations, SOC reports, portal security documentation, and other risk-based materials.
As discussed in our recent post, Does a Custodian Qualify as a “Service Provider” to an Investment Adviser Under Amended Regulation S-P?, investment advisers should be careful not to treat all third-party relationships as identical. The analysis may differ depending on whether a firm is evaluating traditional custodial services, adviser-facing technology, data feeds, reporting tools, integrations, billing services, or other operational services provided directly to the adviser.
Even where a qualified custodian does not characterize itself as a Regulation S-P service provider in its custodial capacity, investment advisers should still consider the custodian a critical third party for cybersecurity, operational, and incident response purposes.
Privacy Notice and Disposal Procedures
The amended Regulation S-P requirements also affect privacy notice and disposal considerations. Investment adviser firms should review whether their privacy notice practices remain accurate and whether their written policies address the proper disposal of customer information. The amended rule clarifies that disposal includes discarding, abandoning, selling, donating, or transferring any medium containing customer information.
Practical Compliance Steps Before the Deadline
Chief Compliance Officers of smaller SEC-registered investment adviser firms should consider whether the firm has completed the following steps before the June 3, 2026 compliance deadline:
- Updated the compliance manual to include Regulation S-P incident response, customer notification, service provider oversight, privacy notice, and disposal procedures;
- Adopted or updated a written incident response program;
- Reviewed the firm’s information security plan and cybersecurity practices;
- Identified service providers and other critical third parties with access to customer information;
- Reviewed service provider agreements, cybersecurity materials, and incident notification procedures;
- Updated due diligence questionnaires and supplemental vendor review forms;
- Reviewed custodian and adviser-facing platform arrangements;
- Conducted employee training;
- Tested the incident response program through a tabletop exercise or similar process; and
- Documented the firm’s implementation steps for future regulatory review.
These steps may help demonstrate that the firm implemented a thoughtful, risk-based compliance process rather than waiting until after an incident or regulatory examination to address the amended requirements.
State-Registered Investment Advisers Should Also Pay Attention
Although the amended SEC Regulation S-P requirements apply directly to SEC-registered investment advisers, state-registered investment advisers should also pay attention to these developments. State securities regulators may have separate cybersecurity, privacy, information security, books and records, fiduciary, or supervisory expectations that overlap with many of the same concepts.
In addition, state regulators may look to SEC rules, NASAA cybersecurity resources, enforcement actions, and examination practices when evaluating whether a state-registered investment adviser has reasonably protected client information. Accordingly, state-registered investment advisers should consider reviewing their cybersecurity, vendor oversight, incident response, and client notification practices even if the amended SEC rule does not directly apply.
RCC Compliance Manual Updates, Supplemental Forms and Webinars
RIA Compliance Consultants, Inc. has prepared updated sample compliance manual sections and supplemental forms to assist investment adviser firms preparing for the amended Regulation S-P requirements.
Available Compliance Manual Updates & Checklists
The available sample materials include:
Sample WSP/CoE – Incident Response Program
Sample WSP/CoE – Information Security Plan
Sample WSP/CoE Section – Service Provider – Due Diligence
Cybersecurity – Best Practices Checklist
Cybersecurity – Best Practices for RIA Collecting Devices for Digital Forensic Expert
Due Diligence – Regulation S-P Service Provider Review Package
Sample WSP/CoE Package – Regulation S-P Policies & Procedures
Regulation S‑P Service Provider Due Diligence & Information Security Bundle
Recorded Regulation S-P Webinars
RIA Compliance Consultants, Inc. also offers webinars and training materials addressing the amended Regulation S-P requirements, including incident response, vendor oversight, customer notification, cybersecurity documentation, and implementation considerations.
Recorded Webinar/IAR CE Course: Mastering SEC’s Amendments to Regulation S-P
Where applicable, certain webinars may be eligible for IAR continuing education credit. Please review the applicable product page for credit availability, timing, category, and completion requirements.*
Related Resources
Regulation S-P: The Upcoming Compliance Deadline for Smaller Investment Advisers (04/27/2026)
Upcoming Reg S-P Deadline for Large Investment Advisers (11/25/2025)
Regulatory Alert – SEC Amends Reg S-P (05/28/2024)
Investment Advisers Should Review Cybersecurity Incident Response Plans of Vendors (03/21/2020)
NASAA Cybersecurity Model Rule Package (05/31/2019)
Disclosures
This regulatory alert is a brief summary which is general in nature and offered only for educational purposes. It should not be considered as a comprehensive review or analysis of this development. There are certain requirements and exceptions outlined in the rule which are not covered in this regulatory alert. This communication is not intended to constitute compliance consulting advice or apply to any particular investment adviser firm’s specific situation without further analysis.
This regulatory alert is not a safe harbor or a legal opinion. The reader should study the actual guidance, rule or enforcement action in detail and consult with his or her compliance professionals. This information in this regulatory alert may become out of date.
*NASAA Disclaimer: NASAA does not endorse any particular provider of IAR CE courses. The content of any course offered by RIA Compliance Consultants, Inc. through CE4Advisers.com and any views expressed therein are our own and do not necessarily reflect the views of NASAA or any of its member jurisdictions.
Posted by Bryan Hill
Labels: Due Diligence, Information Security, Privacy, Regulation S-P, Written Policies and Procedures
