SEC Regulation S⁠-⁠P compliance for investment advisers and broker-dealers.

Regulation S-P readiness checklist

What the 2024 amendments changed

• Incident response program: written policies and procedures to detect, respond to and recover from unauthorized access to or use of customer information.
• Customer notification: notify affected individuals as soon as practicable, and within 30 days of becoming aware.
• Service provider oversight: due diligence and monitoring, with providers telling you within 72 hours of a breach.
• Broader scope: "customer information" is now a defined term, and it reaches information about customers of other financial institutions that you receive.
• Transfer agents: the safeguards and disposal rules now cover them too.
• Records: written records documenting compliance (funding portals excepted).
• Annual privacy notice: the exception from the FAST Act is written into the rule, so the notice is not needed when its conditions are met.

What your incident response program should cover

1. Who declares an incident, and how staff and vendors report one.
2. How you assess the nature and scope: which systems, and which customer information.
3. How you contain and control it, including preserving evidence.
4. How you decide whether sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, and who signs that decision off with counsel.
5. The notification path: drafting, approving and sending notices within the 30-day limit.
6. Recovery, lessons learned, and the records an examiner will ask for.

What to check in each service provider contract

• Notice to you as soon as possible, and no later than 72 hours after the provider becomes aware of a breach affecting a system it maintains for you.
• The security measures the provider must keep, and your right to check them.
• Who sends customer notices, if you delegate that in writing. Responsibility for the notice stays with your firm either way.
• Secure disposal or return of customer information when the contract ends.

Service provider due diligence under Regulation S-P

The rule defines a service provider as any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to your firm. That usually means your custodian and portfolio-management platform, CRM, email and file hosting, managed IT provider, and anyone who backs up or archives client records.

Your written policies must require oversight of these providers, "including through due diligence and monitoring". In the adopting release the SEC explains what that does and does not mean:

• A written contract is not required, but the SEC says firms should generally consider whether one is appropriate to record what each side expects.
• A provider's assurance is not enough on its own where you know, or have reason to know, it is inaccurate.
• Independent certifications and attestations, such as a SOC 2 report, can form part of your due diligence, tailored to the relationship.
• Review the policies periodically over the life of the relationship, and update them with what your monitoring turns up.
• A provider's breach notice triggers your program: when it arrives, you must start your incident response program.
• If a provider notifies customers for you, you remain responsible. The SEC suggests confirming delivery, for example through the provider's attestation or by checking with a sample of affected customers, and keeping a copy of every notice.

Due diligence questions to ask each provider

1. Which of our customer information do you receive, store or process, and where is it held?
2. Who on your side can access it, and how is that access controlled and logged?
3. Do you encrypt it at rest and in transit, and do you enforce multi-factor authentication?
4. What independent evidence can you share: a SOC 2 Type II report, an ISO 27001 certificate, a recent penetration test summary?
5. How and to whom will you report a breach, and can you commit to telling us within 72 hours of becoming aware of one?
6. Who at your firm do we contact during an incident, and what records will you give us for our own investigation?
7. Which subcontractors touch our customer information, and how do you oversee them?
8. How do you return or securely dispose of our customer information when the relationship ends?

Keep the answers, the evidence and the date you reviewed them. That file is how you show an examiner the oversight actually happened.

Sources: SEC fact sheet, release 34-100155; adopting release 34-100155 (service providers, section II.A.4); FINRA cybersecurity advisory on the amendments. General information, not legal advice.