Regulation S-P Amendments: The IR Plan RIAs Need Now

The amendments were adopted in May 2024, but the compliance clock runs on entity size. Larger entities have to comply by December 3, 2025. Smaller entities get until June 3, 2026. "Larger" generally tracks the same asset and revenue thresholds the SEC already uses elsewhere in its rules for RIAs, broker-dealers, and transfer agents, so if you already report as a large advisory firm for other purposes, assume you're in the first wave.

Entity size	Compliance deadline	What that means practically
Larger entities	December 3, 2025	Written IR program, vendor oversight, and notice procedures need to be operational now, not drafted
Smaller entities	June 3, 2026	More runway, but vendor contract renegotiation and tooling changes take months — start the inventory work this quarter

Don't read the later date as a reason to wait. Vendor contracts that need amendment language, SIEM retention policies that need to extend, and staff training that needs to happen before an incident — none of that gets done in a weekend sprint.

A written program isn't a one-page policy that says "we take security seriously." Examiners expect it to define what counts as unauthorized access to customer information, who gets notified internally within what timeframe, how containment decisions get made, and how you determine whether the 30-day client notice clock has started. That last part trips firms up — the clock starts at discovery, not at confirmation of harm, so your detection tooling and escalation process need to be fast enough that you're not burning weeks figuring out whether something happened.

Concrete controls that map to this requirement:

• Continuous monitoring and alerting (SOC/SIEM-style automated detection) so "discovery" happens in hours, not weeks
• A documented escalation path from IT to compliance to the executive team, with named roles, not just a generic "security team" reference
• Tested backup and recovery procedures, because containment and recovery are explicit parts of the required program
• A breach notification template pre-approved by counsel, so the 30-day window isn't spent drafting language from scratch

A properly built cybersecurity program gives you most of this scaffolding already — the gap for most RIAs is tying technical detection to the compliance notification clock, not building detection from zero.

This is the part that catches firms off guard. The amendments require advisers to take reasonable steps to oversee service providers that receive, maintain, or process customer information, including contractual provisions requiring those vendors to notify you of breaches so you can meet your own 30-day obligation. If your custodian, portfolio management software vendor, or document storage provider has a breach and doesn't tell you quickly, you can't notify your clients on time — and "my vendor didn't tell me" isn't a defense examiners accept.

Practically, this means revisiting vendor contracts for breach-notification clauses, running a documented review of which vendors touch customer data at all, and tightening who inside your firm and your vendors can actually reach sensitive client records. Controls worth tightening here include privileged access management so vendor and employee access to customer data is scoped and logged, and cloud configuration reviews for any platform — including Microsoft 365 environments — where client documents or communications live.

For firms that serve registered investment advisers and broker-dealers as a core part of their book, this oversight burden sits squarely inside broader work on IT support built around financial regulatory requirements, since the vendor-risk and notification obligations under Reg S-P don't exist in isolation from the rest of your compliance stack.

If your firm has already built a cybersecurity program around the FTC Safeguards Rule or HIPAA because of adjacent business lines, you're not starting from scratch. The core architecture — written program, incident response, vendor oversight, breach notification — is similar across FTC Safeguards Rule requirements and Reg S-P. Texas firms with 20-99 employees should also know that implementing CIS Controls IG1 (56 safeguards) under Texas SB 2610, effective September 1, 2025, shields a business from exemplary damages in a breach lawsuit — it doesn't replace federal notification duties, but it's a meaningful layer of legal protection worth building alongside your Reg S-P program.

None of this works well bolted onto an existing managed IT setup as an afterthought. The firms that handle this cleanly treat detection, logging, and vendor contract review as one connected project, not three separate checkboxes.

Does Regulation S-P apply to small RIAs?

Yes. Smaller entities get a later compliance date — June 3, 2026 versus December 3, 2025 for larger entities — but the substantive requirements are the same. Size affects the timeline, not whether the rule applies.

What triggers the 30-day customer notification requirement?

The clock starts when the firm discovers unauthorized access to or use of sensitive customer information, not when harm is confirmed. That means detection speed directly affects how much time you have left to investigate, contain, and notify within the window.

Do we need new contracts with our vendors?

Most firms do. Existing vendor agreements rarely include breach-notification timelines tight enough to support your own 30-day obligation, so contract review and amendment is usually the first concrete step once the written program is drafted.

Is a written policy enough, or do examiners want proof it works?

Examiners generally expect evidence that the program is operational — incident logs, test results, training records — not just a document sitting in a compliance binder. Treat the written program as the start of the work, not the end of it.

If your firm hasn't mapped its Reg S-P obligations to actual IT controls yet, get a free IT assessment and find out where the gaps are before an examiner does.