Both Reg S-P Deadlines Have Passed. Here's What SEC Examiners Are Now Checking When They Walk Into Your Firm.

TL;DR

• Both Regulation S-P compliance deadlines have passed: larger entities since December 3, 2025, smaller entities since June 3, 2026 — no grace period remains for any covered firm
• The SEC named Reg S-P an examination priority for FY 2026: examiners are testing whether firms have operational incident response programs, not just filed a policy document
• Three core requirements: a written IRP covering detection, response, and remediation; 30-day customer notification for breaches; and vendor contracts with a 72-hour notification obligation on service providers
• Most common gaps: IRP drafted but never tested, ambiguous triggering criteria for the 30-day clock, and vendor agreements that predate the amendment and don’t include the 72-hour clause
• The deficiency-to-enforcement pipeline is moving: deficiency letters today become enforcement referrals for firms that don’t remediate

There is a specific moment in an SEC examination when a firm realizes its Regulation S-P compliance was a paperwork exercise, not a program.

An examiner asks to see the firm’s incident response program. The compliance officer pulls up a policy document. The examiner asks when it was last tested. Pause. Asks to see the vendor contracts verifying the 72-hour notification obligation. Another pause. Asks for documentation showing how the firm would determine — for a specific hypothetical breach — when the 30-day customer notification clock starts running.

A firm that can answer all three with documentation is exam-ready. Most cannot.

Both Regulation S-P compliance deadlines have now passed. Larger entities — broker-dealers, investment companies, and RIAs with $1.5 billion or more in AUM — have been subject to the rule since December 3, 2025. Smaller entities reached their compliance deadline on June 3, 2026. The SEC named Regulation S-P an examination priority for fiscal year 2026, examiners are actively testing compliance, and the deficiency pipeline is accumulating.

Who the Rule Covers — and Why “Smaller Entity” Matters

The amended rule applies to five categories of SEC-regulated institutions: broker-dealers, registered investment advisers, investment companies, funding portals, and SEC-regulated transfer agents.

The “smaller entity” designation matters because it describes where compliance gaps are concentrated. Smaller entities include RIAs with less than $1.5 billion in AUM and smaller broker-dealers — a large share of the SEC-registered universe, particularly the independent RIA community. These firms had until June 3, 2026 to comply. That deadline has now passed.

One important boundary: amended Regulation S-P covers SEC-registered entities. State-registered RIAs — typically those below $100 million in AUM — are not subject to the SEC’s amended rule, though state-level data security requirements apply. Any firm uncertain about which framework governs it should clarify that threshold question before assuming compliance posture.

The Three Core Requirements

The amended rule adds three substantive requirements to the existing Safeguards Rule framework:

1. The Written Incident Response Program

Every covered firm must have a written incident response program (IRP) addressing unauthorized access to or use of customer information. The SEC’s examination guidance specifies that the IRP must cover detection, response, and remediation — three distinct phases with different operational content.

Detection is where many firms underinvest. A written IRP that covers response and notification but lacks detection procedures — specifically, how does the firm identify that a breach occurred, and how does it document the moment of “awareness” — is incomplete. Detection is also where the 30-day notification clock starts, which makes it the most legally consequential phase to have documented.

Response includes containment (stopping ongoing unauthorized access), evidence preservation, internal escalation, and coordination with outside counsel and forensic resources. The IRP needs enough procedural specificity that it could be executed by someone other than the person who drafted it.

Remediation covers root cause analysis, control improvements, and documentation of the completed response. Examiners ask to see evidence that closed incidents were actually remediated — not just marked closed in a log.

2. The 30-Day Notification Clock

When a covered firm becomes aware of unauthorized access to or use of customer information, it must notify affected individuals as soon as possible but no later than 30 days after becoming aware.

The triggering standard is awareness, not confirmation. A firm that detects a potential breach, opens an investigation, and delays notification pending investigation conclusion is not complying if the investigation runs past 30 days. The clock starts when the firm becomes aware of unauthorized access — a lower threshold than confirmed breach.

This has direct implications for IRP design. The moment of “awareness” needs to be defined and documented. Who at the firm has authority to determine that awareness has occurred? What documentation captures that determination? What happens if the 30-day deadline approaches before the investigation concludes?

Firms also need clarity on what “customer information” triggers the obligation. The rule covers information collected in connection with a product or service — financial account data, transaction records, personal information from account opening. The scope is broad; a firm relying on a narrow reading runs the risk of missing notifications it was required to send.

3. Vendor Oversight — The 72-Hour Clause

The amended rule includes a vendor oversight obligation that is frequently underimplemented: service providers must notify the covered firm within 72 hours of becoming aware of a qualifying breach involving the firm’s customer data.

The obligation runs to the service provider, but enforcing it requires action by the covered firm. Examiners are asking to see vendor contracts that include the 72-hour notification clause. If your service agreements were negotiated before the rule amendments took effect, there is a reasonable likelihood the 72-hour obligation is not in them.

The fix is a targeted vendor contract review — identifying which service providers handle customer information and confirming the 72-hour clause is present. For service providers that handle significant customer data but won’t agree to the clause, that’s a vendor risk issue that belongs in your TPRM program. As covered separately in today’s post on the September 2026 TPRM guidance proposal, regulators are increasingly focused on whether vendor oversight actually reflects the risk each relationship presents — and a service provider that won’t commit to 72-hour breach notification is a risk that warrants documented response.

What the SEC Examination Actually Looks Like

The SEC’s examination of Reg S-P compliance focuses on operational reality, not policy documents. Examiners are testing whether the program functions, not whether a policy binder exists.

Typical examination requests include:

• Produce the written incident response program — and expect follow-up on its completeness across all three phases
• Demonstrate testing — when was the IRP last tested or exercised? Produce evidence: tabletop exercise records, simulation documentation, or table-of-contents from a post-incident review
• Walk through the awareness determination — for a hypothetical breach scenario, explain how the firm would identify and document the moment “awareness” occurred
• Show vendor contracts — covering the firm’s top data-handling service providers, with the 72-hour notification clause identified
• Confirm incident history — has the firm had any incidents or potential incidents since the compliance effective date? If so, what was the documented response?
• Describe the notification process — how would the firm send 30-day notifications? What template, what distribution list, what documentation that notices were sent?

Firms that can answer with documentation are exam-ready. Firms with a written policy but no operational evidence are likely to receive a deficiency letter. The SEC’s stated position is that beyond deficiency letters, referral to the Division of Enforcement remains a possibility where examiners identify significant or repeated gaps.

The Most Common Deficiencies

Based on examiner staff guidance and practitioner-reported patterns, the deficiencies appearing most frequently fall into five categories:

No written IRP at all. Firms that treated Reg S-P compliance as a matter for their existing privacy policy or a policy addendum — rather than a standalone documented program covering detection, response, and remediation — are non-compliant on the most basic requirement.

IRP drafted but never tested. A policy document that has never been through a tabletop exercise, simulation, or post-incident review doesn’t demonstrate operational readiness. The rule’s intent is a functioning program; an untested document doesn’t satisfy that intent.

Ambiguous awareness triggers. IRPs that describe response procedures without defining how awareness is determined — and who has authority to make that call — leave firms exposed when an examiner walks through a hypothetical. A well-drafted IRP defines awareness criteria, documents who makes the determination, and creates a paper trail from detection to awareness declaration.

Vendor contracts without the 72-hour clause. This is the most operationally fixable gap but requires active remediation: reviewing contracts for the clause and negotiating its inclusion where absent. Examiners are checking this.

No detection-to-awareness documentation. For past incidents, firms need to be able to show the timeline from initial detection to the awareness determination that started the 30-day clock. If that documentation doesn’t exist for historical incidents, it’s worth creating a retrospective record.

What the Breach Data Shows

The regulatory urgency isn’t theoretical. According to 2026 financial services cybersecurity data, Q1 2026 recorded 65 finance-sector incidents — a 76% increase over Q1 2025. The average cost of a financial sector data breach reached $5.56 million in 2025, second only to healthcare.

The SEC named Reg S-P as an exam priority before that Q1 data was available. The trend reinforces the regulatory logic: the volume and cost of breaches in the financial sector means the question of whether firms’ notification and response programs actually function is consequential, not procedural.

For firms that have experienced incidents since December 2025 without triggering formal notifications, now is the time to document the basis for that determination. If customer information was accessed without authorization and no notification was sent, there needs to be a documented rationale — not a gap an examiner fills in with the worst-case interpretation.

The NYDFS Overlap

For New York-regulated firms, Reg S-P operates alongside NYDFS’s heightened cybersecurity examination standards, which include their own incident response plan requirements under Part 500. The two frameworks are complementary but not identical: NYDFS Part 500 applies to NYDFS-licensed entities, while Reg S-P covers SEC-registered ones. An SEC-registered investment adviser that also holds a New York license faces both.

The practical implication: a unified IRP that addresses both frameworks’ requirements is more defensible than two documents that may be inconsistent. If your firm is subject to both, a gap analysis identifying where the frameworks diverge is a worthwhile project before the next examination cycle.

So What?

Both deadlines have passed. There is no forthcoming grace period, and no amendment pending that extends the compliance window. The SEC has told you it considers Regulation S-P an examination priority, which means it will appear on the examination checklist.

The deficiency-to-enforcement timeline works like this: deficiency letter, remediation deadline, follow-up examination. Firms that receive a deficiency letter today have a window to remediate. Firms that receive a second deficiency letter for the same gap are looking at enforcement referral territory.

The good news: Regulation S-P compliance is achievable for firms of any size. A written IRP covering detection, response, and remediation. Documented testing evidence. Vendor contracts with the 72-hour clause. A defined process for starting the 30-day notification clock. None of these require a GRC platform or a large compliance team — they require documented procedures and evidence of actually running them.

The SEC’s broader compliance examination posture — noted in the risk alert on annual compliance reviews — is consistent: examiners are evaluating whether your compliance program is functional, not whether your policy binder is current. Reg S-P is one piece of that interest.

The policy binder is not the program. The program is what happens when the breach occurs at 11pm on a Friday and someone at your firm needs to determine whether the 30-day clock just started.