The SEC's Reg S-P Deadline Has Passed. Division of Examinations Is Already Knocking. Here's What They're Looking For.

TL;DR:

• The SEC’s Reg S-P deadline for smaller entities (RIAs under $1.5B AUM, smaller broker-dealers) passed June 3, 2026 — every covered institution is now required to be in compliance.
• The SEC’s Division of Examinations listed Reg S-P as a top FY2026 examination priority; examinations at smaller firms are already underway.
• Three operational requirements are being tested: a written and operational incident response program, a documented 30-day customer notification process, and service-provider oversight with contract provisions requiring 72-hour notice from vendors.
• The most common gap is the difference between having a program document and having a program that actually runs — examiners are asking for test evidence, vendor inventories, and staff training records, not just the Word file.

Four months ago, the last group of SEC-registered investment advisers and broker-dealers ran out of time on Regulation S-P. The June 3, 2026 deadline for “smaller entities” was the final compliance date in the amended rule’s two-phase rollout. Larger firms had been required to comply since December 3, 2025.

That deadline passing is not the end of the story. It’s where the examination story starts.

The SEC’s Division of Examinations identified compliance with the 2024 amendments to Regulation S-P as an examination priority for fiscal year 2026. Examinations are not waiting for the fiscal year to close. Smaller RIAs and broker-dealers are getting exam requests that specifically list incident response programs, breach notification processes, and service-provider oversight as areas of review.

If your firm’s Reg S-P compliance is still a Word document sitting in a shared drive with no evidence of implementation behind it, you are not compliant. Here’s what examiners are actually testing — and where programs at smaller firms tend to fail.

What Amended Regulation S-P Actually Requires

The 2024 amendment added Subpart F to 17 CFR Part 248. The practical requirements for smaller covered institutions come down to three things:

1. A written incident response program. The program must be specifically designed to detect, respond to, and recover from unauthorized access to or use of customer information. “Customer information” means records containing nonpublic personal information (NPI) — account numbers, Social Security numbers, credentials, financial data. The program must be in writing. But the rule does not say it must merely exist in writing — it requires the policies and procedures to be “reasonably designed” to achieve the protective outcome. Examiners interpret that to mean the program must actually function.

2. A 30-day customer notification process. When you become “aware” that customer information was accessed without authorization — or is “reasonably likely” to have been — you have 30 days to notify affected customers. The standard is awareness, not certainty. The clock does not pause for forensic investigation completion. This is a materially shorter timeline than most RIAs and smaller broker-dealers had in their legacy incident response plans, which were often written around state breach notification laws with 30–90 day windows running from “discovery” rather than “awareness.”

3. Service provider oversight. Your written policies and procedures must be designed to oversee service providers with access to customer information. That includes due diligence before engagement, ongoing monitoring, and contract terms designed to ensure the provider notifies you within 72 hours of a qualifying breach. The SEC’s adopting release says firms might contractually require 72-hour vendor notice, but the rule frames the requirement as a policies-and-procedures and oversight obligation — meaning a vendor contract with the provision plus no follow-up monitoring is not adequate compliance.

What Examiners Are Actually Testing

The examination reality at smaller firms is that having a program document is not the same as being in compliance. SEC examination teams have been clear that Reg S-P reviews are operational reviews, not paper reviews.

The Written Program Must Show Evidence of Implementation

Examiners ask for the written incident response program — and then ask for evidence it has been implemented. That means:

• Tabletop exercise records. Has the program been tested? When? Who participated? What gaps were identified and how were they addressed?
• Staff awareness documentation. Do employees know what to do when they receive a phishing notification, a vendor breach alert, or a suspicious login attempt? Training records and communication logs matter.
• Escalation path clarity. Does the program name who makes the decision to start the 30-day notification clock? Who at your firm is the “aware” person for Reg S-P purposes — the CISO, the CCO, the CEO? Examiners ask.

The gap that shows up most often: the program was drafted by outside counsel or a compliance vendor, filed in a SharePoint folder, and never walked through with staff. The firm has the document. The firm does not have compliance.

The Customer Notification Process Must Be Tested and Documented

The 30-day clock is shorter and more demanding than many smaller firms expected. Most legacy incident response plans at RIAs were built around state laws. Under state laws, the clock typically runs from “discovery” of a breach, defined more narrowly, and the window is often 60–90 days. Reg S-P uses “awareness” — a lower threshold — and 30 days.

Examiners look at the process for determining when awareness is triggered. They want to see a documented decision framework, not a case-by-case judgment call. They also look at whether the firm has drafted a template customer notification letter, knows which regulatory bodies require concurrent notification, and has a communications workflow to deliver notices within 30 days without relying entirely on outside counsel turnaround time.

A November 2025 SEC settlement involving a dual-registrant broker-dealer and investment adviser included allegations of violations of Rule 30(a) of Regulation S-P — a signal that enforcement against smaller entities for program deficiencies, not just post-breach failures, is a real risk.

Vendor Oversight Has a Specific Evidence Requirement

The service-provider piece is where smaller firms tend to have the most underdeveloped compliance. The examination tests vendor oversight across three dimensions:

Inventory completeness. Examiners have specifically identified incomplete vendor inventories as a common gap in firm compliance programs. If your firm cannot produce a list of all service providers with access to customer information — the custodian, the portfolio management system, the CRM, the e-mail archival service, the IT support vendor, the cloud backup provider — you cannot demonstrate the required oversight.

Contract review. Do existing contracts with service providers include notification provisions? If a vendor that holds your clients’ account data suffers a breach, does your contract give you any notification rights? Contracts signed before Reg S-P’s adoption may have no such provisions. Firms need to have reviewed — and in many cases renegotiated — vendor agreements.

Ongoing monitoring. Due diligence at engagement is necessary but not sufficient. The rule requires ongoing oversight. Examiners ask what the firm does when a vendor announces a data breach, and whether the firm has a process to evaluate whether client data was involved.

The Common Gaps at Smaller Firms

Based on the SEC’s examination priorities and the post-deadline commentary, the most common Reg S-P gaps at smaller entities cluster around four categories:

The fix for these is operational, not legal. It is not about amending the program document. It is about running the program.

So What Does This Mean for Your Firm?

If you are a smaller RIA or broker-dealer and your Reg S-P program was adopted before June 3 but has not been operationalized, the examination risk is not hypothetical. It is a function of exam cycle frequency and your firm’s risk profile. The SEC’s FY2026 priority list did not distinguish between firms that filed a program and firms that implemented one. Examiners are making that distinction in the field.

The areas to address before an exam notice lands:

Test the program. Run a tabletop exercise using a realistic scenario — a vendor notifies you of a breach of your client CRM at 4:30 on a Friday. Who is called? Who decides the awareness threshold is crossed? Who drafts the client notification? Who notifies regulators? Work through it and document the exercise.

Confirm vendor notifications are in contracts. Pull a list of service providers with access to customer information and check whether their agreements include breach notification provisions. For those that do not, add them at the next renewal or renegotiation. For high-risk vendors, do not wait for renewal.

Draft your 30-day notification template. Have a customer notification letter drafted, reviewed, and ready to adapt. Know which state breach notification laws may run concurrently with the federal 30-day obligation and which regulators (FINRA, SEC, state regulators) require concurrent notification.

Document staff awareness. Train front and back office staff on what constitutes a potential security incident under Reg S-P. Make sure at least two people in your organization know they are in the chain of notification.

Reg S-P compliance for smaller entities started in June. The examination follow-through is happening now.

Internal Resources

For firms building or refreshing incident response programs, the Incident Response & Breach Notification Kit covers program design, the 30-day notification workflow, vendor oversight documentation, and a tabletop exercise framework calibrated to SEC and FINRA examination expectations.

For background on the rule itself, including the full compliance timeline and service-provider obligation detail: Amended Regulation S-P: The 30-Day Breach Notification Rule That Now Applies to Every Investment Adviser and Broker-Dealer.

For a broader look at how incident response planning connects to business continuity: Cyber Resilience and Business Continuity: Building a Unified Response Framework.

External Sources

• SEC Division of Examinations FY2026 Examination Priorities
• Regulation S-P compliance deadline commentary — Troutman Pepper
• Smaller Entities Must Comply with Amended Reg S-P by June 3, 2026 — Davis Wright Tremaine
• SEC Exam Priorities 2026: Reg S-P Duties for Smaller RIAs — Fintech Law AI
• Holland & Knight: Regulation S-P Amendments — Compliance Deadline Approaching for Smaller Entities