Regulation S-P for small RIAs: what the 2024 amendments ask of you
Regulation S-P is the SEC rule on protecting customer information. The 2024 amendments require SEC-registered advisers to keep a written incident response program, to notify affected individuals no later than 30 days after becoming aware of a breach of their sensitive information, and to make sure service providers notify the firm within 72 hours of becoming aware of a breach. Smaller entities, which for advisers means under $1.5 billion in assets under management, had 24 months from Federal Register publication on 3 June 2024, so their compliance date was 3 June 2026.
Most small advisers think of Regulation S-P as the annual privacy notice. Since the 2024 amendments, it is also about what happens on the day something goes wrong: a phished email account, a lost laptop, a vendor that tells you three weeks late that it was breached. For smaller firms the compliance date has already passed, so this is now part of normal operations.
What is Regulation S-P?
Regulation S-P is the SEC rule on the privacy of consumer financial information and the safeguarding of customer information. It covers broker-dealers, investment companies, SEC-registered investment advisers and transfer agents. The SEC adopted the amendments on 16 May 2024 to deal with how data breaches have changed since the rule was first adopted in 2000 (SEC press release 2024-58).
What do the amendments require?
| Requirement | In plain words |
|---|---|
| Incident response program | Written policies and procedures to detect, respond to and recover from unauthorized access to or use of customer information. |
| Customer notice | Tell affected individuals as soon as practicable, and no later than 30 days after becoming aware that their sensitive information was, or is reasonably likely to have been, accessed or used without authorization. The notice explains the incident, the data involved and what they can do. |
| Service provider oversight | Make sure service providers notify you as soon as possible, and no later than 72 hours after becoming aware of a breach that affects your customer information. |
Sources: SEC press release 2024-58 and the adopting release.
When did small firms have to comply?
The amendments were published in the Federal Register on 3 June 2024. Larger entities had 18 months to comply and smaller entities had 24 months. For investment advisers, a larger entity is one with $1.5 billion or more in assets under management, so most small RIAs are smaller entities with a compliance date of 3 June 2026. If you haven't built the program yet, you are behind, and that is worth fixing this quarter.
A worked example
Take a hypothetical two-person RIA with about 120 households. It uses a CRM, a document storage service, firm email, a billing spreadsheet and its custodian's portal. Here is what it puts in place:
| Piece | What the firm does |
|---|---|
| Vendor list | Lists every service that holds customer information: CRM, document storage, email, custodian portal. |
| Vendor notice | Gets each vendor's written commitment to notify within 72 hours, or records why it couldn't. |
| Response steps | A one-page plan: who leads, how to contain (reset passwords, revoke access), how to work out whose information was affected, and when to call the compliance consultant. |
| Notice template | A draft customer notice with the required content, ready to fill in. |
| Record | An incident log entry for every event, including ones that turn out to be nothing. |
| Test | Once a year, walk through a made-up incident and time each step. |
What does a good incident record show?
- When the firm learned of it, and from whom.
- What happened and what data was involved.
- Which customers were affected, and how that was decided.
- Containment steps, with times.
- Whether notice was required, the reasoning, and when notices went out.
- What changed afterwards.
When is this overkill?
A one-person firm doesn't need a 20-page plan. It does need the four pieces the rule points to: a written response program, a way to notify customers within 30 days, vendor commitments on 72-hour notice, and a record of what happened. Keep it short enough that you would actually open it during a bad day.
How Advorra fits
Advorra keeps each firm's data separate from every other firm's at the database level and encrypts it in transit and at rest. The firm's incidents and complaints log is built in, so an incident record sits with the rest of the compliance records. Advorra is one of your service providers, so it belongs on your vendor list too. See the product page, or read about the complaints and incidents log.
One thing to do this week: write down every service that holds customer information, and next to each one, how fast it has promised to tell you about a breach.
A plain summary of public SEC material, not legal or compliance advice. Your compliance consultant decides what your firm's program needs. Facts checked against SEC sources on 17 October 2026.
Questions advisors ask
Does Regulation S-P apply to state-registered advisers?
Regulation S-P applies to SEC-registered investment advisers. State-registered firms should check their state's privacy and data security rules, which can be different.
What is "sensitive customer information"?
Broadly, information that could cause harm or inconvenience to a customer if accessed or used without authorization, such as a Social Security number combined with an account number. Read the rule's definition with your compliance consultant.
Do I need new contracts with every vendor?
You need written policies and procedures for overseeing service providers, including the 72-hour notice. Many firms update agreements or get written confirmations from vendors that handle customer information.
What if a vendor won't commit to 72 hours?
Record the gap and how you are dealing with it, and talk to your compliance consultant about whether to keep using that vendor for customer information.
Is this compliance advice?
No. It is a plain summary of public SEC material. Your compliance consultant decides what your firm's program needs.
See it on a demo firm
Advorra is practice software for independent RIAs: clients, models, IPS, billing and compliance records in one place, on top of the custodian you already use. Built by The CollabHub.
Get in touch