Amended Regulation S-P: The 30-Day Breach Notification Rule That Now Applies to Every Investment Adviser and Broker-Dealer

TL;DR:

• The SEC’s May 2024 amendment to Regulation S-P requires registered investment advisers, broker-dealers, investment companies, and transfer agents to notify affected customers within 30 days of a breach of their nonpublic personal information.
• Larger entities (RIAs with $1.5B+ AUM, larger broker-dealers) had a December 3, 2025 deadline. Smaller entities just hit their June 3, 2026 deadline — two weeks ago.
• Three operational requirements are now active: a written incident response program, a 30-day customer notification process, and service-provider oversight designed to produce notification within 72 hours of a qualifying breach.
• Reg S-P is separate from and in addition to GLBA Regulation P (annual privacy notices) — common confusion, separate obligations.

June 3, 2026 was a quiet deadline for an important rule.

If your registered investment advisory firm manages less than $1.5 billion in AUM, that was your compliance deadline for the SEC’s amended Regulation S-P — the first time the SEC has required investment advisers and broker-dealers to have a written incident response program and notify customers within 30 days of a data breach affecting their nonpublic personal information.

The deadline came and went two weeks ago. OCIE examinations are already incorporating Regulation S-P compliance reviews, and the gap between what the rule requires and what most small and mid-size firms have built is wider than most practitioners realize.

What Is the Amended Regulation S-P and Why Now?

Regulation S-P was originally adopted in 2000 to implement privacy and safeguards requirements for SEC-registered broker-dealers, investment advisers, investment companies, and transfer agents under the Gramm-Leach-Bliley Act. The original rule required firms to adopt safeguards and limit the disclosure of customer nonpublic personal information — but it predated most of the threat landscape that practitioners deal with today.

The SEC adopted amendments on May 16, 2024, adding three substantial new requirements to an existing framework that had been largely unchanged for nearly 25 years:

1. A mandatory written incident response program
2. A 30-day customer notification obligation when customer information is compromised
3. A service provider oversight requirement, including a 72-hour notification from your service providers

The amendments apply to the same covered institutions as the original rule: SEC-registered broker-dealers, registered investment advisers, registered investment companies (including mutual funds), registered transfer agents, and funding portals.

Who Is — and Isn’t — Covered

This is a common source of confusion because multiple rules use similar language for different populations.

Covered by amended Regulation S-P:

• SEC-registered investment advisers (regardless of AUM)
• SEC-registered broker-dealers
• Registered investment companies (mutual funds, closed-end funds, ETFs)
• Registered transfer agents
• SEC-registered funding portals

Not covered by amended Regulation S-P:

• Banks and bank holding companies — they have analogous obligations under their primary federal banking regulators’ rules, including the GLBA Safeguards Rule and GLBA Regulation P requirements
• State-registered investment advisers — not SEC-registered, not in scope, though state-level analogues may apply
• Exempt reporting advisers — generally not covered by the full Regulation S-P framework

If you’re a dual-registrant (registered as both a broker-dealer and an investment adviser), you’re covered on both sides. The requirements apply to all your customer-facing activities.

Requirement 1: Written Incident Response Program

Covered institutions must adopt written policies and procedures for an incident response program. The amendment specifies what that program must address:

• Assessment of which information systems and data assets contain customer information
• Detection controls to identify unauthorized access or use
• Defined response procedures covering containment, investigation, and remediation
• Recovery procedures to restore systems and data
• Customer notification procedures (see below)
• Post-incident review and program improvement processes

The written program requirement is foundational — the 30-day notification obligation and the service provider notification requirement both depend on having documented processes that your team can execute under pressure. An incident response program that exists only in the CISO’s head, or in a decade-old document that predates cloud adoption and remote work, does not satisfy the amendment.

SEC examination staff reviewing Reg S-P compliance will ask to see the written program, will review whether it addresses all required elements, and will assess whether firm personnel are trained on it. A common exam gap is a program that looks adequate on paper but has never been tested — no tabletop exercise, no walkthrough with the notification process, no evidence that the 30-day clock has been operationalized.

Requirement 2: The 30-Day Customer Notification

When a breach of customer information occurs — or is “reasonably likely” to have occurred — covered institutions must notify affected customers as soon as practicable, and no later than 30 days from awareness of the event.

What triggers the clock: Awareness that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. This is not a confirmed-breach standard. You don’t need a completed forensic investigation before the clock starts. The moment a reasonable assessment concludes that customer information was likely accessed without authorization, the 30-day window opens.

This matters operationally. Firms that wait for a full forensic report before characterizing an event as a potential breach will routinely find that their 30-day window has already been running — and may have partially expired — by the time they engage the notification process.

What the notification must include:

• A clear description of what happened
• The types of customer information affected
• What steps the firm has taken or is taking to address the incident
• What steps customers can take to protect themselves
• Contact information for customers to get more information or ask questions

Who gets notified: Affected customers whose information was compromised. If you cannot identify specifically which customers were affected because the breach involved a system that stored all customer records, the obligation extends to all customers whose data was in that system.

Format requirements: The SEC’s small entity compliance guide specifies that notification must be provided in writing, in plain language, and by means designed to reach the affected customer — which for most advisers and broker-dealers means electronic notice to the email address on file, with written notice by first-class mail as an alternative or supplement.

Requirement 3: Service Provider Oversight and 72-Hour Notification

The rule requires written policies and procedures reasonably designed to oversee service providers, including through due diligence and monitoring. Those controls must be designed to ensure that providers protect customer information and notify the covered institution as soon as possible, but no later than 72 hours after becoming aware of a breach involving unauthorized access to a customer information system they maintain.

“Service provider” in this context means any third party that accesses, maintains, processes, or otherwise handles customer information on behalf of the covered institution. This encompasses:

• Custodians and clearing firms
• Portfolio management software providers
• CRM and client portal vendors
• Document management and archiving services
• Cloud storage and infrastructure providers
• Third-party administrators

The practical implication: review existing agreements, incident-escalation procedures, provider contacts, and monitoring evidence together. A clear contractual notice term is one sensible way to support the control, but the rule does not prescribe one universal clause for every relationship.

Terms such as “promptly” or “without undue delay” may create operational ambiguity if the institution cannot show how they reliably support the 72-hour outcome. The control file should connect the agreement, the provider’s escalation process, current contacts, and evidence from testing or monitoring.

A systematic approach: identify each provider that maintains customer information, document the due-diligence and monitoring performed, map its incident-notification mechanism, and remediate any arrangement that cannot reliably produce notice within the rule’s timeframe.

How This Differs from Regulation P — and Why It Matters

The most common misconception: assuming that Regulation P compliance covers Regulation S-P, or that they’re the same rule. They’re not.

Both apply to SEC-registered investment advisers and broker-dealers. Both are independent requirements with independent obligations. Being current on your Regulation P annual notice does not mean you’re in compliance with amended Regulation S-P.

What SEC Examiners Are Checking

The SEC’s Division of Examinations has signaled that Regulation S-P compliance will be a priority focus in 2026 examinations. Based on the amendment’s structure and what similar examinations under analogous rules have surfaced, expect examiners to:

1. Request the written incident response program — reviewing whether it exists, whether it addresses all required elements, and whether it’s been tested
2. Ask about service provider oversight — including due diligence, monitoring, agreements, escalation contacts, and evidence that providers can notify the firm within 72 hours
3. Review any actual incidents — if a breach or likely breach has occurred since your compliance date, examiners will assess whether notification went out within 30 days and whether the notification content was adequate
4. Test employee awareness — asking staff how they would identify and escalate a potential breach, and whether they know what the firm’s notification obligations are

NYDFS Part 500 enforcement offers separate, state-law examples of how regulators examine documented incident-response and notification controls. See our analysis of NYDFS Part 500 enforcement patterns while keeping the two regulatory regimes distinct.

The Regulatory Notification Landscape for Covered Firms

Investment advisers and broker-dealers subject to Regulation S-P are often subject to additional notification requirements that run parallel to — but don’t replace — the Reg S-P obligation.

State breach notification laws can separately require notice to affected individuals and state authorities on their own triggers and timelines. See our 50-state breach notification law comparison for how those obligations interact with Reg S-P.

For registered investment advisers that are also broker-dealers with SEC public company reporting obligations, the SEC’s Form 8-K Item 1.05 requirement may also apply if the incident is material to the company. That’s a separate four-business-day obligation to the SEC itself — not to customers.

The practical result: a single cybersecurity incident at a dual-registrant investment adviser may trigger Regulation S-P customer notification (30 days), state breach notification law obligations (often 30-72 hours depending on state), Form 8-K materiality assessment (if the firm is a public company), and FINRA notification (for broker-dealers, within 30 days under Rule 4370).

None of these clocks pause while you figure out which other clocks are running.

So What?

The June 3, 2026 deadline has passed. A smaller covered institution that has not built its incident response program, implemented service-provider oversight designed around the 72-hour notice requirement, and operationalized customer notification has a current compliance gap.

The path forward is concrete:

1. Draft or update your written incident response program to address all required elements — detection, response, notification, recovery, and post-incident review
2. Audit service-provider oversight — identify every provider that maintains customer information and test whether due diligence, monitoring, escalation procedures, and supporting contract terms can reliably deliver notice within 72 hours
3. Operationalize the 30-day clock — document the internal escalation path from incident detection to legal review to customer notification decision, with accountability owners at each stage
4. Train your team — the program document alone is not compliance; staff need to know what to escalate and when

The Data Privacy Compliance Kit includes an incident response program template mapped to Regulation S-P’s requirements, a service provider agreement clause library with 72-hour notification language, and a customer breach notification workflow you can adapt to your firm’s specific structure.

Sources:

• SEC Press Release: SEC Adopts Amendments to Regulation S-P to Enhance Protection of Customer Information (May 16, 2024)
• 17 CFR 248.30 — current service-provider oversight and notification text
• SEC Small Entity Compliance Guide: Enhancements to Regulation S-P
• Holland & Knight: Regulation S-P Amendments — Compliance Deadline Approaching for Smaller Entities (May 2026)
• Goodwin: Approaching Effective Date for Regulation S-P Amendments (November 2025)
• Skadden: SEC Amends Reg S-P to Strengthen Data Breach Response Requirements and Protect Investor Information