What should SEC-regulated smaller firms have completed for Regulation S-P?

The SEC's amendments became effective 2 August 2024, with compliance dates of 3 December 2025 for larger entities and 3 June 2026 for smaller entities. Covered categories include broker-dealers, investment companies, SEC-registered investment advisers and registered transfer agents, as specified in the rule. SEC compliance guide.

The guide describes a written incident-response program and service-provider oversight. Provider notification must be as soon as possible, no later than 72 hours after awareness of the specified breach; affected-customer notice is generally as soon as practicable, no later than 30 days after the institution becomes aware of the relevant unauthorized access or use, subject to the rule's conditions and exceptions. These are different triggers, not interchangeable clocks. Official guide.

What to do now: test the path from supplier notification to investigation, escalation and a documented notification decision. Ask the legal owner to validate the exact rule text, trigger and exceptions for your institution. The SEC's January 2026 outreach session offers useful implementation context. Small-firm outreach materials.

Buying trap: delegating a task without checking whether the institution retains responsibility. A provider contract should specify the facts, timing, contact routes and records the institution needs to perform its own duties.