Regulation S-P for small advisers and broker-dealers

The safeguards section of Regulation S-P, 17 CFR 248.30, applies to a “covered institution”, which the rule defines as “any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission …”. So every broker-dealer is in, whatever its size, and so is every SEC-registered investment adviser. A state-registered adviser is not named in that definition; this guide does not cover state privacy rules, so ask your state regulator or counsel what applies to you.

A firm registered both ways is a covered institution on both counts, and its Regulation S-P records fall under two recordkeeping rules, covered in the records section below.

The SEC adopted the amendments on May 16, 2024 and published them at 89 FR 47688 on June 3, 2024. Before them, Regulation S-P asked for safeguards policies and a disposal rule. The amendments add what has to happen after a breach. In the SEC's own summary they add incident response programs with customer notification, “broaden the scope of information covered by the requirements for safeguarding customer records and information”, and “impose requirements to maintain written records documenting compliance with the amended rules.”

The scope point matters for a small firm more than it looks. Customer information now includes records about customers of other financial institutions where that information “has been provided to the covered institution”. Information another firm sends you about its own customers, in a referral or an account transfer, falls inside the rule once it reaches you.

The rule took effect on August 2, 2024, with a tiered compliance period. The SEC's Small Entity Compliance Guide puts it in calendar dates: “Larger entities must comply with the amendments by December 3, 2025 (i.e., 18 months after publication in the Federal Register), while smaller entities must comply with the amendments by June 3, 2026 (i.e., 24 months after publication in the Federal Register).”

An adviser with less than $1.5 billion in assets under management is a smaller entity. A broker-dealer should check the Regulatory Flexibility Act definition rather than assume it is small. Either way, the later date has passed too. Unless the SEC changes it, the amended rule now binds every covered firm, and an examiner can ask to see the program, the incident file and the vendor contracts.

The rest of an adviser's yearly obligations sit in our RIA compliance guide; broker-dealers will find theirs in FINRA compliance for broker-dealers.

Card 02

The base duty is short: written policies and procedures covering administrative, technical and physical safeguards. Paragraph (a)(2) says what they are for. They must be reasonably designed to “ensure the security and confidentiality of customer information”, to “protect against any anticipated threats or hazards” to it, and to protect against unauthorized access or use “that could result in substantial harm or inconvenience to any customer.”

The rule names no product and no specific control. The examples below are ours, the kind a firm of a few people can show an examiner; your policies should describe the controls you actually run.

The CRM is where most of your customer information lives, so its permissions are the technical safeguard an examiner is most likely to ask about. We read role-based access on vendors' own pages in the best CRM for financial advisors, wealth management CRMs for teams and Redtail vs Wealthbox. A firm starting on a free plan can check the same column in free CRMs for advisers.

The program reaches every “customer information system”, which the rule defines broadly as the information resources a firm owns or uses for the collection, processing, maintenance, use, sharing, dissemination or disposition of customer information. For a small firm that is the CRM, the email account, the shared drive, the custodian's portal as you use it, the planning software and the laptops. Paragraph (a)(3) then names three things the procedures must do.

The “in the file” lines are not decoration. The amendments made the incident documentation and the notice determination required records (see the records section), so a response that happened but was not written down is, for an examiner, a response that did not happen. A written plan that names who calls whom, and which vendor contacts to use, is what lets a three-person office run these steps on a bad Monday. Our compliance manual template has a place for it.

Notice turns on sensitive customer information: any customer information whose compromise “could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information.” The rule gives two families of examples.

• Identifiers on their ownA Social Security number, a driver's license or other government ID number, a passport number, an employer or taxpayer identification number, a biometric record.248.30(d)(9)(ii)(A)
• An account plus a keyAn account number, name or online user name combined with something that lets a person in: an access code, a security question and answer, a date of birth, a partial Social Security number.248.30(d)(9)(ii)(B)

When that kind of information was, or is reasonably likely to have been, reached without authorization, the firm must send a “clear and conspicuous notice” to each affected individual, by a means designed so that each can “reasonably be expected to receive actual notice in writing.” If the firm cannot tell whose information was reached, it notifies everyone whose sensitive information sits in the system that was reached, except people it reasonably determines were not affected.

The one way out is a finding, after “a reasonable investigation of the facts and circumstances”, that the sensitive information “has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.” That finding is itself a record you must keep, with its basis. In our reading, an encrypted laptop lost without its key is the kind of fact that can support it, and a mailbox an outsider read for a week is much harder to fit. Either way, the reasoning goes in writing.

The delays are not the firm's to choose. Each one needs the United States Attorney General to determine that notice poses a substantial risk to national security or public safety (national security alone for the final 60 days) and to tell the SEC in writing. Past the final 60 days, the SEC may consider further requests from the Attorney General. For a small firm the working deadline is 30 days.

Draft the letter now, with the contact block and the FTC and credit-report paragraphs filled in, and leave only the incident description and dates blank. Thirty days goes quickly when the same two people are also running the response and the business.

A service provider is anyone who “receives, maintains, processes, or otherwise is permitted access to customer information” by providing services directly to the firm. In a small office that list is long: the CRM, the email host and its archive, the IT support firm, the planning software, the document scanner service, an outsourced compliance consultant.

That sentence is what your oversight policies must be reasonably designed to secure, alongside the provider taking appropriate measures to protect customer information. The policies must provide for oversight “including through due diligence and monitoring”. Notice from the vendor starts your own program: “Upon receipt of such notification, the covered institution must initiate its incident response program.” And whatever the contract says, the obligation to make sure customers are notified “rests with the covered institution.”

Due diligence in practice means reading each contract for the terms below before you sign or renew. They are what we would look for; the rule sets the outcome, not the clause wording.

1. 01Notice to you as soon as possible, and no later than 72 hours, after the vendor becomes aware of a breach of a system holding your customer information.
2. 02The vendor's security measures against unauthorized access to or use of customer information, in terms you can monitor.
3. 03Who sends customer notices. The rule lets you agree in writing that the vendor sends them on your behalf; the duty stays yours.
4. 04A named contact on each side, so the 72-hour notice reaches someone on a weekend.
5. 05What happens to your data when the contract ends, so its disposal meets your own disposal policy.

Our vendor compares list a “Not verified by us” line for each product, which is a ready list of what to ask. Archives hold years of client email, so the breach clause matters as much there as in the CRM; see email archiving software. If an outside compliance officer touches client files, the same oversight applies to them, see outsourced chief compliance officers.

Every covered institution other than a notice-registered broker-dealer must “properly dispose of consumer information and customer information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal”, and must have written disposal policies. Before the amendments the disposal rule applied only to consumer information; it now reaches customer information too.

Disposal is wider than shredding. The rule counts “the sale, donation, or transfer of any medium, including computer equipment” on which the information is stored. The old office laptop given to a relative, the copier returned at the end of its lease, the phone traded in: each is a disposal, and the policy should say how each is wiped and who signs off.

The amendments wrote six Regulation S-P records into the recordkeeping rules: Rule 204-2(a)(25) for advisers and Rule 17a-4(e)(14) for broker-dealers. The list is the same on both sides. The broker-dealer rule states its own periods, quoted in the last column.

Rule 204-2 gives the adviser records no period of their own. Its general period in (e)(1) covers the records made under paragraph (a) except a listed few, and (a)(25) is not on that list. By our reading the adviser keeps these records “for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser.”

A dual registrant should not pick one period by itself. Rule 204-2(h)(1) says a record kept under 17a-3 or 17a-4 “which is substantially the same as the book or other record required to be made, kept, maintained and preserved under this section, shall be deemed to be made, kept, maintained and preserved in compliance with this section.” How that applies to your files is a question for your compliance counsel. The wider record sets are covered in Rule 204-2 books and records and in Rule 17a-4 and WORM storage.

The amendments also brought the annual privacy notice in line with a statutory exception in the Gramm-Leach-Bliley Act. A firm that shares information only under the rule's listed exceptions may not owe the yearly mailing at all.

Both conditions must hold. If the firm changes its sharing practices, the rule says when the annual notice comes back, in 248.5(e)(2). Keep a note in the file of why the firm relies on the exception each year.

Put together, the rule asks a small firm to hold one file that it can hand over on request. This is how we would lay it out; the order is ours, the rule references are the rule's.

Review the file once a year with the rest of the program; an adviser can fold it into the annual review under Rule 206(4)-7 and plan it with the annual compliance review planner. The books and records checklist lists the S-P records beside the rest. This guide explains the rule; it is not legal advice. Check your policies against the full text on eCFR with your compliance counsel.