The compliance deadline for smaller SEC-registered investment advisers under the U.S. Securities and Exchange Commission’s amended Regulation S-P is quickly approaching. Smaller SEC-registered investment advisers — generally those with less than $1.5 billion in regulatory assets under management — must comply with the amended Regulation S-P requirements by June 3, 2026. The SEC announced that smaller entities would have 24 months after Federal Register publication to comply, and the final amendments were published on June 3, 2024.
Category Archives: Information Security
Does a Custodian Qualify as a “Service Provider” to an Investment Adviser Under Amended Regulation S-P?
May 11, 2026
As investment adviser firms registered with the U.S. Securities and Exchange Commission (SEC) prepare for compliance with the SEC’s amended Regulation S-P Safeguards Rule, many chief compliance officers are asking an important question:
Upcoming Reg S-P Deadline for Large Investment Advisers
November 25, 2025
The first major compliance deadline under the amended Regulation S-P of the U.S. Securities and Exchange Commission (SEC) is approaching quickly. Large SEC-registered investment advisers – those with $1.5 billion or more in regulatory assets under management – must comply by December 3, 2025, while smaller SEC-registered investment advisers (those under $1.5 billion RAUM) must be compliant by June 3, 2026. Given the scope of the amendments, investment advisory firms should begin preparing now to ensure their programs, service-provider agreements, and internal procedures are ready before examination.
Beware of Phishing Emails Impersonating FINRA
On Thursday, April 4, we received numerous inquiries from investment adviser firm owners and/or senior executives who had received an unexpected email supposedly from FINRA’s Chief Legal Officer or Chief Information Officer which utilized an email address ending in @ data-finra .org. In response, our Consulting Team contacted the IARD Entitlement Support Line which confirmed that these emails did not originate from FINRA.
The U.S. Securities and Exchange Commission (SEC) continues to promote the importance of cybersecurity and protecting confidential investor information. On September 22, 2015 the SEC’s Office of Investor Education and Advocacy issued an Investor Alert regarding investment accounts if they become victims of identity theft or a data breach. This Investor Alert came one week after the SEC issued a Risk Alert on the topic of its Cybersecurity Exam Initiative (September 15, 2015).
The SEC’s Cybersecurity Enforcement Action and Risk Alert
September 25, 2015
The Securities and Exchange Commission (SEC) had a busy week regarding investment adviser and broker-dealer cybersecurity. On September 15, 2015 the SEC’s Office of Compliance Inspections and Examination (OCIE) issued a Risk Alert on the topic of its Cybersecurity Examination Initiative. The Risk Alert provides information on the areas of focus for OCIE’s cybersecurity examination (more on this below). The SEC followed up its Risk Alert with an enforcement action against an investment adviser for a cybersecurity incident. The SEC censured the investment adviser and imposed a fine of $75,000. The SEC found that the investment adviser failed to adopt written policies and procedures reasonably designed to protect customer records and information, in violation of Rule 30(a) of Regulation S-P (17 C.F.R. § 248.30(a)) (the “Safeguards Rule”).
When cybersecurity is covered in the industry press these days, there often is discussion about its importance but unfortunately a lack of specificity in what steps an investment adviser can take to improve information security and IT practices. Even the recent cybersecurity exam sweep results of the Office of Compliance Inspections and Examinations (OCIE) of the U.S. Securities and Exchange Commission (“SEC”) are somewhat difficult for investment advisers to interpret and translate into an information security plan; however, the SEC’s Office of Investor Education and Advocacy recently issued a bulletin giving investors tips on protecting their online accounts. These recommendations to help protect an investor’s online account from fraud appear to RIA Compliance just as applicable to an investment adviser devising its cybersecurity policies and practices.
Cybersecurity for Investment Advisers
October 28, 2014
In its Examination Priorities for 2014 notice the U.S. Securities and Exchange Commission’s (SEC) Office of Compliance Inspections and Examinations (OCIE) indicated that technology would be one of the most significant initiatives in 2014. This focus on technology will include an assessment on an investment adviser’s cybersecurity preparedness. In April 2014, OCIE issued a National Exam Program Risk Alert to provide additional information regarding its focus on assessing cybersecurity preparedness in the securities industry. The Risk Alert discusses OCIE’s cybersecurity initiative and the registered investment adviser and broker-dealer examinations OCIE is conducting of as part of this initiative that will, at a minimum, focus on the following:
RIA Compliance Consultants recently hosted a webinar, Establishing Information Security Programs for Registered Investment Advisors. During this webinar, our compliance consultant discussed the regulatory requirements for establishing an information security program and then went into a detailed discussion on how a registered investment advisor can establish an information security program that effectively protects its client data.
Does Your Investment Adviser Have a Written Privacy Policy?
September 12, 2012
Under Rule 30 of Regulation S-P, registered investment advisers are required to implement a written security program to safeguard customer information. Specifically, investment advisers are required to have in place an information security program that is reasonably designed to:
