Regulation S-P compliance checklist for investment advisers

Regulation S-P requires SEC-registered investment advisers to protect customer information, and since the 2024 amendments it requires much more than a privacy notice and a safeguards policy. Every adviser now needs a written incident response program, a plan to notify affected individuals within 30 days, oversight of the service providers that hold customer information, and records proving all of it.

The amendments were adopted in May 2024 (Release No. 34-100155, IA-6604, published at 89 FR 47688) and took effect on 2 August 2024. Larger entities had to comply from 3 December 2025 and smaller entities from 3 June 2026. Both dates have passed: the amended rule applies to every SEC-registered adviser today.

Who Regulation S-P applies to

• SEC-registered investment advisers, along with broker-dealers, investment companies and transfer agents.
• Not state-registered advisers or exempt reporting advisers, which are not registered with the SEC. They are generally covered instead by the Federal Trade Commission's Safeguards Rule under the Gramm-Leach-Bliley Act, and by state privacy and breach notification laws.

State breach notification laws apply alongside Regulation S-P for every adviser, so a single incident can trigger both federal and state notice obligations with different content and timing.

What the 2024 amendments changed

1. An incident response program

The safeguards policies must now include a written program reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information. It has to cover:

• assessing the nature and scope of an incident, including which systems and what kinds of customer information may have been accessed
• containing and controlling the incident to prevent further unauthorized access or use
• notifying affected individuals where required

2. Notice to affected individuals within 30 days

An adviser must notify each individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice is due as soon as practicable, and no later than 30 days after the adviser becomes aware that the unauthorized access occurred or is reasonably likely to have occurred.

The clock runs from awareness, not from the end of the investigation. Notice is not required if, after a reasonable investigation, the adviser determines that the sensitive customer information has not been, and is not reasonably likely to be, used in a way that would result in substantial harm or inconvenience. That determination is an off-ramp only if it is actually made and documented.

Sensitive customer information is information whose compromise could create a reasonably likely risk of substantial harm or inconvenience to the person: for example a Social Security number, a driver's license or passport number, biometric data, or an account number together with a code or password that permits access to the account.

The notice must be clear and conspicuous, and must describe the incident in general terms, the types of information involved, the date or estimated date of the incident, how to contact the adviser, and what the individual can do to protect themselves, such as reviewing account statements, placing a fraud alert or credit freeze, and reporting identity theft to the FTC.

Notice may be delayed only if the Attorney General tells the Commission in writing that it poses a substantial risk to national security or public safety.

3. Service provider oversight and 72-hour notice

An adviser must have written policies to oversee, through due diligence and monitoring, every service provider that receives, maintains, processes or otherwise has access to customer information. The oversight must be reasonably designed to ensure the provider protects that information and notifies the adviser within 72 hours of becoming aware of a breach in security that results in unauthorized access to a customer information system it maintains.

An adviser can arrange for a service provider to send customer notices on its behalf, but the adviser stays responsible for them.

4. Broader scope

"Customer information" now includes information about customers of other financial institutions that the adviser receives, not only its own clients. The disposal rule now covers customer information as well as consumer report information.

5. Records

Advisers must keep written records documenting compliance: the policies and procedures, each incident and the response to it, any determination that notice was not required and the investigation behind it, notices sent, and the service provider oversight policies. For advisers these are books and records under Rule 204-2.

6. The annual privacy notice exception

The amendments write into the rule the statutory exception from delivering an annual privacy notice. An adviser that shares nonpublic personal information only within the exceptions, and has not changed its policies and practices since the last notice, does not have to send one every year.

The checklist

1. Map where customer information lives. Every system, cloud service, shared drive, inbox and paper file, including information about other institutions' customers.
2. Update the written safeguards policies for administrative, technical and physical safeguards, and make sure they describe how the firm actually operates.
3. Write the incident response program: who leads, how an incident is assessed, how it is contained, and how the notice decision is made.
4. Define a reasonable investigation and a template for documenting the substantial-harm determination, so the decision not to notify is recorded on the day it is made.
5. Prepare the customer notice in advance, with the required contents, and a calendar method for counting 30 days from awareness.
6. Inventory service providers with access to customer information, and rate them by risk.
7. Complete due diligence on each, and keep the record.
8. Amend contracts to require the 72-hour breach notice and appropriate safeguards. Contracts that predate the amendments usually say nothing about it.
9. Update the disposal policy to cover customer information and consumer report information, on paper and electronically.
10. Check the privacy notice and whether the firm qualifies for the annual delivery exception.
11. Test the plan with a tabletop exercise, record the result, and fix what it finds. A plan that has never been exercised is a common finding.
12. Train staff and review annually as part of the Rule 206(4)-7 annual compliance review, including state breach law changes.

What examiners look for

• A privacy notice on file with no safeguards program behind it.
• No incident response plan, or one that has never been exercised.
• Vendors handling customer information with no diligence record, and vendor agreements that predate the amendments.
• An incident that was not notified, with no record of the harm determination.
• Policies that describe systems the firm no longer uses.

Regulation S-P and Regulation S-ID

Regulation S-ID is a separate rule that also lives in 17 CFR Part 248. It requires an identity theft prevention program, built around red flags, for an adviser that maintains covered accounts, for example where it can direct transfers or payments from client accounts to third parties. Many advisers address both in one privacy and identity theft policy.

Common questions

When did the Reg S-P amendments take effect?

They became effective on 2 August 2024. Larger entities had to comply from 3 December 2025 and smaller entities from 3 June 2026, so every SEC-registered adviser is now subject to the amended rule.

What is Release No. 34-100155?

It is the Commission's adopting release for the 2024 Regulation S-P amendments, also numbered IA-6604 and IC-35193 and published at 89 FR 47688. It explains what the Commission changed and why, and answers the comments it received, which is where most of the edge cases are worked out.

Does a solo adviser need an incident response program?

If the adviser is registered with the SEC, yes. Regulation S-P has no size exemption. The program should fit the firm, and for a solo adviser it can be short, but it has to be written, it has to cover assessment, containment and notice, and the service providers that hold client data still need oversight.

Do state-registered advisers have to comply with Reg S-P?

No. Regulation S-P applies to SEC-registered advisers. State-registered advisers are generally subject to the FTC Safeguards Rule and to state law, which impose many similar obligations.

Start from a template

Luna's privacy and identity theft policy template covers the amended Regulation S-P and Regulation S-ID, and the vendor oversight policy template covers service providers with access to customer information.