kitlegaliaRegulation S-P amendments: what small investment advisers must have in place since June 3, 2026
The SEC adopted amendments to Regulation S-P on May 16, 2024. Larger firms had to comply by December 3, 2025. Smaller entities, which includes registered investment advisers with $1.5 billion or less in assets under management, had to comply by June 3, 2026. If your firm is in that group, the new rules already apply.
Who counts as a smaller entity
For investment advisers, a larger entity is one with more than $1.5 billion in assets under management. At or below that, you are a smaller entity and your compliance date was June 3, 2026 (Davis Wright Tremaine, May 20, 2026). The amendments were published in the Federal Register on June 3, 2024 (FR Doc. 2024-11116).
What you must have now
1. A written incident response program
Written policies and procedures to detect, respond to and recover from unauthorized access to or use of customer information. The program must cover how you assess the scope of an incident, contain and control it, and notify affected customers.
2. Customer notice within 30 days
If sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization, you must send affected individuals a clear and conspicuous notice "as soon as practicable, but not later than 30 days" after you become aware of the incident. Notice to the SEC is not required.
3. Oversight of service providers, with a 72-hour notice
You need written policies to oversee your service providers, including a requirement that they notify you "as soon as possible, but no later than 72 hours" after becoming aware of a breach in their systems that affects your customers. Think of your custodian, CRM, portfolio software and IT support.
4. Records
Keep records of your policies, each incident and how you handled it, the customer notices you sent, and your service provider arrangements (Davis Polk summary of the final rule).
Why this matters even without a breach
The policies must exist before anything happens. In an SEC exam, the first questions are whether you have a written incident response program, whether your vendor contracts and oversight cover the 72-hour notice, and whether you could produce a compliant customer notice within 30 days. A firm that has none of these on paper is out of compliance today, breach or not.
A checklist for a small RIA
- Written incident response program, approved and dated.
- A customer notice template that meets the content requirements.
- A list of service providers with access to customer information, and a 72-hour notice requirement for each.
- A records folder for incidents, notices and vendor reviews.
- Staff who know where all of it is.
If you are an IT or compliance consultant serving several advisers, our white-label license lets you produce these documents for your clients under your own brand.
Get your Reg S-P documents in place
The Reg S-P Builder writes your policies, incident response program, customer notice and vendor letters. $399 for the 2027 edition, works offline. Consultants: see the white-label license.
See the builderFrequently asked questions
When did small investment advisers have to comply with the amended Regulation S-P?
Smaller entities, including RIAs with $1.5 billion or less in assets under management, had to comply by June 3, 2026. Larger entities had to comply by December 3, 2025.
How fast must customers be notified after a breach?
As soon as practicable, but not later than 30 days after the firm becomes aware that sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization.
What must service providers do?
Firms need written policies to oversee service providers, including that providers notify the firm as soon as possible, and no later than 72 hours, after becoming aware of a breach affecting its customers.
Do we have to notify the SEC of a breach under Regulation S-P?
No. The amended rule requires notice to affected individuals, not to the SEC.