What is Regulation S-P?

Regulation S-P is the SEC rule (17 CFR Part 248) governing how broker-dealers, registered investment advisers, investment companies, and transfer agents protect the nonpublic personal information (NPI) of their customers. The 2024 amendments added a written incident response program, a 30-day customer notification obligation, and expanded oversight of service providers.

When is the Regulation S-P compliance deadline?

Larger entities must comply by December 3, 2025. Smaller entities have until June 3, 2026. 'Larger' generally means investment companies with net assets of $1 billion or more, registered investment advisers with $1.5 billion or more in AUM, and broker-dealers and transfer agents that are not small entities under the Exchange Act.

Who does the amended Reg S-P apply to?

Broker-dealers (including funding portals), registered investment advisers, investment companies, and transfer agents registered with the SEC or another appropriate regulator. Law firms are not themselves 'covered institutions' — but their clients almost always are, and firms holding covered-institution data as service providers are pulled in through the oversight rule.

How quickly must customers be notified of a breach?

As soon as practicable, but no later than 30 days after the covered institution becomes aware that unauthorized access to or use of sensitive customer information has occurred or is reasonably likely to have occurred. The 30-day clock runs from awareness, not from confirmation of harm.

What has to be in the customer notice?

A description of the incident, the type of sensitive customer information involved, the date or estimated date range of the incident, contact information for the covered institution, and recommended steps customers can take to protect themselves, including guidance on placing a fraud alert or security freeze with a nationwide consumer reporting agency.

Does Reg S-P preempt state breach notification laws?

No. Reg S-P sets a federal floor. Covered institutions still have to comply with each state's breach notification statute in parallel, and the strictest applicable timeline governs the actual outreach schedule.

What counts as 'sensitive customer information'?

Any component of customer information — alone or in combination with other data elements — that could reasonably be used to commit identity theft or fraud, including SSNs, government IDs, financial account numbers, biometric data, and account credentials paired with security questions.

Do I have to notify customers of another covered institution?

Yes, in most cases. Under the amendments, when a covered institution maintains records containing sensitive customer information of another covered institution's customers (typical in clearing / introducing broker or sub-adviser arrangements), the entity that experienced the incident generally has to notify the affected individuals unless the other covered institution takes over the obligation in writing.

What incident-response program elements does Reg S-P now require?

Written policies and procedures reasonably designed to: (1) assess the nature and scope of any incident and identify the systems and information involved, (2) contain and control the incident to prevent further unauthorized access or use, and (3) notify affected individuals within the 30-day window with the prescribed content.

How does the service-provider oversight rule work?

Covered institutions must have written policies reasonably designed to require, through contract or otherwise, that service providers take appropriate measures to protect sensitive customer information and to notify the covered institution of a breach as soon as possible — and no later than 72 hours after becoming aware of unauthorized access or use — so the institution can meet its own 30-day clock.