Regulation S-P changed in 2024. Registered advisers with $1.5 billion or more in assets had to comply by December 3, 2025. Everyone else, which is most small RIAs, had to comply by June 3, 2026. That date has passed.
I read the SEC's adopting release (Release 34-100155) and 17 CFR 248.30 to see what a small adviser has to be able to show. Four duties matter.
What the rule asks for
| Duty | The rule's words | What you can show |
|---|---|---|
| Incident response program | Written policies "reasonably designed to detect, respond to, and recover from" unauthorized access to customer information | The written program, plus who does what |
| Service provider oversight | Oversight "including through due diligence and monitoring, of service providers" | One entry per vendor with the due diligence you did |
| Provider breach notice | Providers must notify you "no later than 72 hours after becoming aware" of a breach | The clause or written confirmation, per vendor |
| Customer notice | "As soon as practicable, but not later than 30 days" after you become aware | The decision record and the notice |
Advisers keep these records for at least five years, the first two in an easily accessible place (Rule 204-2).
The part most small firms skip
Incident response gets the attention. Vendor oversight is where the paperwork is. A five-person firm might have a custodian, a CRM, email, e-signature, planning software, a data aggregator and now one or two AI tools. Each of them holds customer information. Each needs an entry.
A minimal entry has five fields:
- Vendor and what customer data it holds
- Date of the last due diligence and what you looked at (SOC 2 report, security questionnaire, contract clause)
- Whether the 72-hour breach notice is in the contract, confirmed by email, or missing
- Who at the firm owns the relationship
- Date of the next review
Fields 3 and 5 are the ones that are usually empty.
A rule for where to start
If a vendor holds customer names plus account numbers, do it first. If the contract has no notice term, ask for the 72-hour confirmation in writing before anything else, because that one email is the evidence. If a vendor will not answer, write down that you asked and when. A log that shows you asked is better than a log with no entry.
What I could not confirm
One law-firm alert in August 2026 reports that the SEC has started sending document requests about Reg S-P to advisers. I could not find that in an SEC publication, so treat it as a report, not a fact. What the SEC did publish: its FY2026 examination priorities say exams of Regulations S-ID and S-P "will focus on firms' policies and procedures, internal controls, oversight of third-party vendors, and governance practices." Vendors are named in the priorities themselves.
Disclosure
I used an AI assistant to read the adopting release and draft this post. The rule quotes come from the SEC text and I checked them by hand.
If you run compliance for small advisers and would pay for a finished vendor-oversight file per client, say so in the comments and tell me what it would need to include.
![The Adventures of Blink S6e8: Crypto isn't just Ponzi Schemes [NIST 800-53 CM(3)]](https://media2.dev.to/dynamic/image/width=1200,height=627,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fih7t2d7kuhdgzzxrkdvc.png)
