Regulation S-P for smaller advisers

Who it applies to

US broker-dealers, investment companies, SEC-registered investment advisers and transfer agents. The 2024 amendments to Regulation S-P gave "smaller entities" a later compliance date than larger ones. For investment advisers, the smaller-entity category is defined by assets under management; check the SEC's definition against your own figures.

What it requires, in plain terms

The amendments, adopted by the SEC in May 2024, add four main obligations to the existing privacy rule.

• An incident response programme. Written policies and procedures to detect, respond to and recover from unauthorised access to customer information.
• Customer notification. Where sensitive customer information was, or is reasonably likely to have been, accessed or used without authorisation, affected individuals must be notified as soon as practicable and no later than 30 days after the firm becomes aware of the incident, unless the firm determines after investigation that harm is not reasonably likely.
• Service provider oversight. Policies requiring oversight of service providers, including that a provider notifies the firm within 72 hours of becoming aware of a breach affecting customer information it holds.
• Records. Written records showing compliance with these requirements.

Key dates

As of November 2026:

What it means for your systems

• A firm needs an up-to-date record of which vendors hold or process customer information, what they hold, and what each contract says about breach notification. For most small advisers this lives in spreadsheets and email.
• Incident response depends on knowing quickly which customers' records sit in which system, so the 30-day clock can be met.
• Any AI tool that reads client documents is itself a service provider or a system holding customer information, and belongs in the same record.

Official sources

• SEC: Enhancements to Regulation S-P, final rule (Release 34-100155) (opens in a new tab) and small entity compliance guide (opens in a new tab)
• Sidley: compliance deadline approaching for smaller entities (opens in a new tab)

How this connects to our work

A data foundation can keep the vendor and data-location record current from contracts and system inventories, with changes reviewed by the compliance lead. Systems we build are designed to support your obligations under Regulation S-P; they do not by themselves make a firm compliant. See also Investment firms.