Vendor Due Diligence and Oversight Policy Template
Regulation S-P (as amended in 2024) and Advisers Act Rule 206(4)-7
How the firm rates its vendors by risk, what due diligence each tier gets, what contracts must say, how service providers are monitored, and how the firm exits a relationship.
Included in Firm and Firm Plus. 14-day free trial.
What the rule requires
Regulation S-P, as amended in 2024, requires an adviser to oversee service providers that receive, maintain, process or access customer information, including by requiring them to notify the adviser of a breach within 72 hours. An adviser remains responsible for functions it outsources.
The Commission withdrew its proposed outsourcing rule for advisers in June 2025, but examiners continue to ask how advisers select and oversee the vendors their operations and compliance depend on.
What the policy covers
The sections of Luna's model Third-Party Risk Management policy. Your draft includes only the clauses that apply to your firm.
- 1Purpose, scope and administration
- 2Planning and risk assessment
- 3Due diligence and selection
- 4Service providers with access to customer information (Regulation S-P)
- 5Contracts
- 6Ongoing monitoring
- 7Escalation and corrective action
- 8Termination and exit
- 9Records and program review
- 10Affiliated service providers (private funds)
What Luna asks you
A few of the questions that shape the draft:
- The risk categories the firm rates vendors on
- What due diligence critical vendors get
- What critical vendor contracts must include
- Who receives vendor oversight reports, and how often
How drafting works
- 01Answer questions about your firm
Plain questions about how you operate. Where there is a common answer, Luna suggests it; where you are not sure, say so and it is flagged rather than assumed.
- 02Luna drafts the policy
Only the clauses that apply to your firm, in your firm's name, each traced to the rule or choice it comes from.
- 03Review what is left
Anything unanswered is marked in the text and listed for you, and the policy cannot be approved until each is settled.
- 04Edit, approve and roll out
It is your policy: edit it like any other, approve it, and have employees acknowledge it in the same place.
Read the source
Other policies
A summary of what the rule requires, current as of October 2026, so you can see what the policy covers. It is not legal advice. A policy drafted in Luna is your firm's draft to review, edit and adopt.