Amendments to SEC Regulation S-P Took Effect for Smaller Entities on June 3, 2026

Smaller broker-dealers, registered investment advisers, investment companies, funding portals, and transfer agents now operate under a new set of data protection obligations. The compliance date for the 2024 amendments to Regulation S-P arrived for these firms on June 3, 2026, six months after the same requirements took hold for larger entities on December 3, 2025. A firm that waited now has no tested plan for its next breach and no file to hand an SEC examiner who asks for one.

What the Regulation S-P Amendments Changed

The Securities and Exchange Commission adopted the amendments to Regulation S-P in May 2024, the first substantial update to the rule in over two decades. Regulation S-P governs how covered institutions handle nonpublic personal information about consumers, and the original rule dated back to 2000, when data breaches looked nothing like they do now. The SEC built a staggered rollout into the final rule: entities that qualify as "larger" under the thresholds below had to comply by December 3, 2025. Every other covered institution, the "smaller entities" that make up the bulk of SEC-registered firms, had until June 3, 2026.

That second date has now passed. Firms in this category are not in a transition period or a grace window. They are expected to have the required program built, tested, and documented.

Four Regulation S-P Obligations Every Firm Now Carries

The amendments add duties for after customer data is exposed, on top of the safeguards the rule already required. A covered institution needs a written incident response program reasonably designed to detect, respond to, and recover from unauthorized access to customer information. The program can't just exist as a policy binder sitting in a compliance folder. It must function as an operational plan that staff can actually follow when something goes wrong at 2am.

Notification duties run alongside that program. When sensitive customer information has been accessed without authorization, or is reasonably likely to have been, the rule requires notice describing what happened and what the customer can do about it. Notice is not required if a reasonable investigation shows the information is not reasonably likely to be used in a way causing substantial harm or inconvenience. The notice is due as soon as practicable, and no later than 30 days after the firm becomes aware of the incident. A firm that cannot tell which customers were affected must notify everyone whose sensitive information sat in the compromised system. Without a rehearsed process, that clock is hard to meet.

Oversight of service providers is the third piece. A firm that uses outside vendors for custody, technology or back-office work is exposed through them: a breach at any one of those vendors can reach the same customer data the firm is responsible for protecting. The rule requires due diligence and ongoing monitoring of these providers, and written policies designed to ensure a provider notifies the firm no later than 72 hours after becoming aware of a breach of a customer information system it maintains. The duty to notify customers still rests with the firm, even when the breach happened at the vendor.

Finally, the amendments require records proving that all of it happened. For a broker-dealer, we recommend keeping it with the written supervisory procedures, so it is reviewed on the same cycle. Firms need to retain documentation of their policies and procedures; records of any actual or suspected incidents and how they were investigated; copies of notices sent to customers; and evidence of service provider agreements and oversight. An examiner is not going to take a firm's word that a program exists. The file has to be there.

FINRA and SEC Guidance on Regulation S-P

FINRA issued a cybersecurity advisory in November 2025, reminding member firms of the two compliance dates and urging firms to determine early which category, larger or smaller, applies to them under the rule's asset thresholds. FINRA noted that its own large and small firm definitions, which count registered representatives, do not match the SEC's Regulation S-P categories. It pointed firms to Table 3, "Designation of Larger Entities," in the SEC's final rule release to decide which applies.

The SEC's examiners are on it too. The agency's Division of Examinations named Regulation S-P in its fiscal year 2026 exam priorities, alongside other information security and operational resiliency work, and said it will engage firms during examinations about their incident response programs. Have the written program ready first, with the vendor oversight and incident records the rule requires behind it. A firm that treated the June deadline as a formality is the firm most likely to draw follow-up questions.

Closing the Regulation S-P Compliance Gap Now

Firms that have not finished building out their programs are past the point where "in progress" is a defensible answer.

None of this eliminates the risk of a breach. It does mean that when an examiner asks how the firm handled an incident, there is a documented answer instead of a reconstruction.

For advisers and broker-dealers

Get your Regulation S-P file exam-ready with PK Tech

PK Tech has managed IT and security for small and mid-sized firms in regulated industries for more than 16 years, and holds AICPA SOC 2 Type II attestation from an independent audit. Bring your incident response plan and your vendor list to the call.

Schedule a call with Jordan →