Guides › Reg S-P amendments

The amended Regulation S-P in plain language

The SEC adopted the amendments in 2024. They apply to registered investment advisers as covered institutions.

• Incident response program. Written policies must include a program to detect, respond to and recover from unauthorized access to or use of customer information: assess, contain and control, and notify (17 CFR 248.30(a)(3)).
• Customer notice in 30 days. Notify affected individuals as soon as practicable, and not later than 30 days after becoming aware, unless a reasonable investigation shows the sensitive information has not been and is not reasonably likely to be used in a way that would cause substantial harm or inconvenience (17 CFR 248.30(a)(3)(iii), (a)(4)).
• Service providers. Oversee them through due diligence and monitoring, and make sure they tell you of a breach within 72 hours. Notifying individuals remains your obligation (17 CFR 248.30(a)(5)).
• Records. Keep the policies, incident documentation, notification determinations and provider contracts (17 CFR 275.204-2(a)(25)).
• Compliance dates. December 3, 2025 for larger advisers ($1.5 billion or more in assets under management), June 3, 2026 for smaller ones. Both have passed.

Build your plan

Sources: 17 CFR 248.30, SEC Release 34-100155. Read 2026-10-16. Not legal advice.