Regulation S-P for Smaller RIAs: What Changed and What Examiners Ask

Both compliance dates for the SEC’s 2024 amendments to Regulation S-P have passed: December 3, 2025 for larger entities and June 3, 2026 for every other SEC-registered adviser, with no extension granted.

The SEC’s fiscal 2026 examination priorities say that after those dates the Division of Examinations will examine “whether firms have developed, implemented, and maintained policies and procedures in accordance with the rule’s new provisions.”

So the question for a 10-to-50-person RIA is no longer “when is this due.” It is “what do we have to be able to show.”

This page answers that one obligation at a time, with the rule cite, what each obligation looks like at a small firm, and the record that proves it to an examiner. It is written for the owner or chief compliance officer who already has an IT firm and is not an IT person.

The deadlines and dates come from the SEC’s own small entity compliance guide, and the broader picture of what the SEC expects from a small adviser is on our cybersecurity for RIAs page.

What is Regulation S-P?

Regulation S-P is the SEC’s privacy rule for broker-dealers, investment companies, and SEC-registered investment advisers. The SEC adopted it in 2000 under the Gramm-Leach-Bliley Act.

From the start it required three things: privacy notices to customers, opt-out rights before sharing nonpublic personal information with non-affiliated third parties, and a safeguards rule, meaning written policies with administrative, technical, and physical safeguards for customer records. A disposal rule followed in 2004 under the FACT Act, covering the proper disposal of consumer report information.

The 2024 amendments update both the safeguards rule and the disposal rule. They add the incident response program, the 30-day customer notice, service-provider oversight with the 72-hour vendor notice, the new records under Rule 204-2(a)(25), and an annual privacy-notice exception. The SEC adopted the amendments on May 16, 2024. They were published in the Federal Register on June 3, 2024, took effect August 2, 2024, and set compliance dates 18 and 24 months after publication.

Which Regulation S-P compliance date applied to us?

The test is assets under management, not headcount. The SEC’s adopting release explains that for registered investment advisers, the qualification is “$1.5 billion or more in assets under management,” and the release adds, “We estimate that, as of September 2023, 23% of registered investment advisers would be considered to be larger registered investment advisers.

This estimate is based on data reported in response to Items 2.A and 5.F.2.(c) on Form ADV.” Everyone below that line is a smaller entity, which means roughly three in four SEC-registered RIAs had the Reg S-P compliance date of June 3, 2026.

Staff size tells you nothing here. A firm with 20 people can sit above the line and a firm with 40 can be well below it. If your Form ADV shows regulatory assets under management below $1.5 billion, you were a smaller entity, and your date was June 3, 2026.

Now that both dates have passed, the distinction only changes one thing: how long an examiner will expect your program to have been running. A larger entity has had the new provisions in force for close to a year. A smaller one has had them for a few months, and should still expect to be asked for the same documents.

What has to be in a Regulation S-P incident response program?

Regulation S-P amendments made quite a few changes. In fact, the amended rule, at 17 CFR 248.30(a)(3), requires written policies and procedures that include a program “reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information.” The program has to include procedures to assess the nature and scope of an incident and identify which systems and what kinds of customer information were involved, to contain and control it, and to notify affected individuals.

The big changes we have made across client policies over the past year as a result of the updates are:

1. Updating policies to reflect the 30-day notification requirement to clients
2. Working through the list of third-party vendors to see if we can get the 72-hour notification clause added
3. Formally adding an annual incident response tabletop, which is how we show the plan has been tested.

The document is the easy part. You could have an AI assistant write an incident response plan tonight and be compliant on paper. What a 10-person firm actually needs is a document its people will reach for in the first two hours of a real incident, before the experts are on the phone.

When we redlined one firm’s plan, we found a number of critical items missing: concrete first steps for a real breach, a section on preserving evidence (where firms make the mistakes they can’t undo), a requirement to test the plan, and more names in the contact list.

The test is where the paper meets the people. The rule requires a firm to “develop, implement, and maintain” the program, and the only evidence that a plan is implemented rather than filed is a dated record of running it.

In a tabletop exercise we ran recently, nobody mentioned the firm’s incident response policy until well into the scenario. In the exercises we run, about two-thirds of teams never open the document. We like to start a firm’s first exercise with a Microsoft 365 account takeover, because it is the most common breach we see and it forces both technical and business decisions.

What proves it to an examiner is:

• The dated plan
• A contact appendix with no “TBD” entries (breach counsel, the cyber insurer’s claims line, the custodian fraud desks)
• A written summary of the last exercise
• Training-completion records for the last 12 months (the M Holdings finding below)

The rest of the written program is in our RIA cybersecurity policy checklist, and the recovery half is in our business continuity post. The document itself can start from our incident response policy template.

Do we have to notify clients after a breach, and how fast?

Yes, and the clock is 30 days. Under 17 CFR 248.30(a)(4), a covered institution must notify each affected individual “as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.

Two defined terms do the work here.

“Customer information” is any record with nonpublic personal information about a customer of a financial institution, in any form, that your firm holds or that’s handled on its behalf. It includes information about customers of other financial institutions that was provided to you.

“Sensitive customer information” is any piece of that information whose compromise “could create a reasonably likely risk of substantial harm or inconvenience” to the person. The rule’s own examples:

• A Social Security, driver’s license, passport, or taxpayer identification number
• A biometric record
• A name, account number, or username combined with a password, security code, card expiration date, security question, date of birth, or mother’s maiden name”

The clock starts at awareness, not at the end of the investigation. There is one exit: after a reasonable investigation, the firm determines that the sensitive customer information “has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.” Only the U.S. Attorney General can delay a notice on national security grounds. Nothing in the rule requires a report to the SEC.

The rule doesn’t define “substantial harm or inconvenience.” The adopting release says personal injury, financial loss, expenditure of effort, or loss of time can each qualify, and it lists theft, fraud, harassment, impersonation, damaged reputation, impaired eligibility for credit, and misuse of the information to open or access an account as examples. The investigation doesn’t stop the clock. It has to finish inside the 30 days, and the release says a no-notice decision should be revisited whenever new facts turn up.

The part small firms miss is in paragraph (a)(4)(ii): if the firm “is unable to identify which specific individuals’ sensitive customer information has been accessed or used without authorization, the covered institution must provide notice to all individuals whose sensitive customer information resides in the customer information system that was, or was reasonably likely to have been, accessed or used without authorization.

This reach is wider than state breach laws. State statutes cover listed data types and residents of that state. The SEC wrote in the adopting release that the amendments require notice to all affected customers “regardless of State residency.””

We have been involved in breaches where an attacker got in and there were no logs to prove what the attacker actually looked at. We had to treat it as if the attacker looked at everything because we could not prove otherwise, and every client got a notice.

That is why logging decides this obligation more than policy language does. In a breach situation, we want logs that can tell us as much as possible about who is sitting in front of the computer and what data they accessed, because what an attacker actually viewed is what informs the legal opinion about which notifications need to be sent and to whom.

Preparing a tabletop for one client recently, our first question was what logging their CRM had on and how long it kept records of which client records were viewed. The answer was 30 days, the default.

The mechanics of the notice itself usually run through the attorney the cyber insurer assigns. Expect forensics to take weeks, so a 30-day window leaves less room than it sounds. The notice must include:

• A description of the incident and the data involved
• The date or date range if known
• A phone number
• Email and postal address for questions
• Advice to review statements
• An explanation of fraud alerts and free credit reports
• Pointers to the FTC’s identity theft resources

At a 10-person firm this looks like mailbox audit logging turned on and retained well past the default, a notice template drafted before anything happens, and one named person who makes the call with counsel. It also means writing down what “aware” means at your firm: whose knowledge starts the clock, and whether an alert, a confirmed sign-in from an unknown location, or a vendor’s notice counts. What proves it is the written determination (what you investigated, what you found, why notice was or was not required), the template, and the log retention setting.

What does service-provider oversight actually require?

The rule, at 17 CFR 248.30(a)(5), requires your incident response program to include written policies “reasonably designed to require oversight, including through due diligence and monitoring, of service providers.” Those policies must be designed to ensure providers protect customer information and notify you “as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred” on a system they maintain.

You can contract for a provider to send customer notices on your behalf, but the obligation to see that notices go out stays with you. The rule does not require a specific contract clause, and it requires oversight that is reasonably designed.

In practice, firms are handling this with a targeted reach-out to each vendor asking for confirmation, in writing, that the vendor will abide by the 72-hour notification requirement.

The SEC dropped the written-contract requirement from the 2023 proposal. The adopting release says the final rule works “without requiring covered institutions to enter into a written contract with their service providers.” So the commitment can live in a contract clause, an addendum, the vendor’s data processing addendum, a certification or attestation, or another written assurance.

What it can’t live in is a SOC 2 report, which says nothing about incident reporting. We can’t make the request on a client’s behalf. Vendors want it to come from their own clients.

If you’re renewing a contract anyway, the terms worth asking for are:

• Breach notice within 72 hours
• Cooperation with forensics and access to logs
• Flow-down of the same terms to the vendor’s subcontractors
• The right to SOC 2 reports and penetration-test summaries
• Who sends client notices if the vendor is breached

RIA-focused vendors tend to have a pre-canned answer ready. The large ones (Microsoft, DocuSign, Salesforce) answer with some version of “we will notify you in compliance with our contract.” We are not compliance attorneys, but we can’t see a scenario where an SEC examiner penalizes a 10-person firm for lacking negotiating power with Microsoft. Note whatever the vendor says, keep a copy of the contract in the compliance folder, and move on. No examiner is going to tell you to fire Microsoft.

One small firm asked every service provider for 72-hour notice and documented each answer: the RIA-specific vendors gave the specific language, the large general vendors gave the “we will meet all regulatory requirements” version, and where a vendor would not commit the firm wrote down that it had no way to push further, kept the vendor’s SOC 2 report, and recorded why it was still comfortable. That is a defensible file.

Which vendors? The ones that hold client data, plus your IT firm. You can’t answer that without a data map: where customer information lives, system by system, including what each vendor holds on your behalf. The incident response program already requires you to identify the customer information systems involved in an incident, and that’s impossible without the map. We treat only vendors that handle personal or non-public information as high risk.

Custodians get a different treatment. The rule’s definition turns on access to customer information “through its provision of services directly to a covered institution,” so the custodial relationship itself may not make a custodian a service provider, though adviser-facing portals, data feeds, and integrations can. We keep custodians on the list anyway and rely on their own SEC and FINRA regulation for the review. What proves it is the data map, a vendor inventory with a column for breach-notification commitment (yes, no, or where it lives in the contract), and a log of each request and each answer.

What records does Rule 204-2(a)(25) add?

The regulation S-P amendments added a new paragraph to the Advisers Act books-and-records rule. Under Rule 204-2(a)(25), an adviser must make and keep six things:

1. The written safeguards policies and procedures
2. Written documentation of any detected unauthorized access to or use of customer information, and the response and recovery
3. Written documentation of any investigation and determination about whether notification was required, including the basis for the determination and a copy of any notice sent
4. The service-provider oversight policies and procedures
5. Any contract or agreement with a service provider under the rule
6. The disposal policies and procedures

Under Rule 204-2(e)(1), those records are kept for five years from the end of the fiscal year during which the last entry was made, the first two years in an appropriate office of the adviser. That’s the same schedule as the rest of your books and records. The details are in our SEC books and records post

Our recommendation is to keep documentation about all of this. The examiner’s version is less forgiving. When we reviewed a pair of SEC cybersecurity exam requests against one client’s program a few years ago, the questions were not “do you have a policy.” They were: are you keeping an incident log, can you produce the supporting evidence, can you produce a log of patches applied, can you produce an accurate list of terminated employees. A firm that did all of the work but cannot find the paper during the exam gets no credit for the work.

Two of the six items are the ones a small firm most often cannot produce: the incident documentation (because minor events never got written down) and the notification determination (because “we decided it was fine” was a conversation, not a memo).

At a 10-person firm this looks like one folder per record type in the compliance files, with superseded policy versions kept and dated, because “what did your policy say at the time of the incident” is a real question. What proves it is that anyone in compliance can pull any of the six in a few minutes.

What changed about disposing of customer information?

Before the Regulation S-P amendments, the disposal rule covered consumer information, meaning consumer report data. It now covers customer information too, including any record with nonpublic personal information about a customer that the firm holds or that is handled on its behalf.

Under 17 CFR 248.30(b), every covered institution must “properly dispose” of both by “taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal,” and must adopt written policies and procedures that say how.

At a small advisory firm the problem is rarely malice. It’s the equipment nobody paid any attention to. One client’s principal described the firm’s file server as “30-something years of nobody deleting anything.” Retired laptops pile up to be dealt with later and leave on an e-waste day with the drives intact. Copiers go back at the end of a lease with a hard drive full of scanned statements. The policy is a paragraph, but the practice is a habit and a log.

What proves it is a disposal section in the information security policy that names shredding for paper, drive destruction or a verified wipe for devices, copier and printer storage, and deletion confirmation when the firm leaves a software vendor. You’ll also need a simple log (device or batch, date, method, who) with the shredding and destruction certificates filed, better still from a NAID-certified company.

One client’s IT vendor was already wiping every decommissioned drive as standard practice. The gap was that the firm could not yet produce the destruction certificates, so for exam purposes, the work had not happened.

Do we still have to send an annual Regulation S-P privacy notice?

Not always. The amendments codified an exception Congress created in the FAST Act. You can skip the annual notice if your firm shares nonpublic personal information with non-affiliated third parties only under an exception to the opt-out right, and your sharing practices haven’t changed since the last notice you sent. If the practices change, the annual notices resume.

Most small RIAs qualify. What proves it is the current privacy notice on file and a short, dated note of the sharing practices it describes.

What did the SEC fine M Holdings for?

On November 25, 2025, the SEC settled with M Holdings Securities, a dually registered broker-dealer and investment adviser, for $325,000. The order found violations of Regulation S-P Rule 30(a), the safeguards rule, and Reg S-ID Rule 201, the identity theft red flags rule, between July 2019 and March 2024.

In the order’s words, “M Holdings did not have written policies and procedures to govern information security across its member firms until September 2020, when M Holdings adopted an information security policy that required member firms to adopt their own information security policies and controls in 17 categories, which included multi-factor authentication (“MFA”), incident response policies, and security awareness training.” The policy “and its new requirements for member firms, however, were not reasonably designed because, as M Holdings was aware, a significant number of M Holdings member firms continued to lack required information security policies and controls through the Relevant Period.”

What that looked like: “the electronic mail (“email”) accounts of 17 registered representatives and employees at 13 out of 120 member firms were accessed by unauthorized third parties who sent malicious credential-harvesting emails from the compromised accounts to approximately 8,500 individuals, which included a significant number of customers.” Those takeovers “occurred at these 13 member firms that either had no written information security policies or had policies that were not reasonably designed because, for example, they did not have information security controls required by the Policy, such as MFA, incident response policies, or annual security awareness training.”

One of them “resulted in an unauthorized wire from a customer’s account.” The firm’s own data in 2021 and 2023 showed the gaps, and “M Holdings did not impose any consequences on member firms that did not comply with the Policy.”

Two things to be honest about. M Holdings reported about $4.1 billion in assets under management across 120 offices, so it is not a 10-person firm. And the conduct ran from July 2019 to March 2024, so it was charged under the old safeguards language, not the new 30-day and 72-hour provisions. The lesson is the gap between a policy on the books and a policy that is running, which is the same gap examiners test now.

Reg S-ID is the other half of the order, and it is the rule most small RIAs forget. The plain-English split: Regulation S-P is “do what you should to protect client data.” Reg S-ID is “be able to spot criminals who try to take over your clients’ identity.” It requires a written program with red flags that gets updated as the threats change, and the compliance manuals we see from RIA lawyers usually combine the two rules in one section.

The test for your own firm is short. Is MFA enforced on every account, or is it just available? Can someone produce training-completion records for the last 12 months without digging? Does the incident response plan name the person who decides whether to notify clients?

What are Regulation S-P and Reg S-ID examiners asking for?

The SEC’s fiscal 2026 priorities call cybersecurity “a perennial examination priority” and say Regulation S-P and Reg S-ID exams will focus on “policies and procedures, internal controls, oversight of third-party vendors, and governance practices.”

The SEC has not published a post-amendment request letter. What exists is a letter reported by law firms in August 2026 and described as a sweep of registered advisers. As reported, it asks for six groups of documents:

• Governance and risk management: org charts, cybersecurity reporting lines, IT governance, and risk assessment documentation.
• The compliance program: the Rule 206(4)-7 policies and procedures, the most recent annual compliance review, compliance testing, and records of non-compliance or internal investigations.
• Privacy and information security: privacy notices and evidence they were delivered, safeguards, complaints, and incident-response materials.
• Cybersecurity incidents: during the review period, including client harm and remediation.
• Service providers: vendor policies, risk assessments, service agreements, monitoring, and complete vendor lists.
• Personnel and AUM: current and terminated personnel, outside counsel and consultants, and client account data.

Treat that as reported but not as official. It matches what we have seen in the two real cybersecurity request letters we work from and in a 2022 letter that circulated among compliance officers, which asked for the Reg S-ID covered-accounts determination, the approximate number of customer relationships under Regulation S-P Rule 30, the Section 248.30 safeguards policies, an inventory of every system holding nonpublic personal information, and a list of incidents for the period with root cause and mitigation.

One other SEC document matters here. The September 14, 2026 risk alert on Rule 206(4)-7 annual reviews lists what examiners found, including reviews skipped or stretched past 12 months, testing not documented, corrective actions never taken, and policies that “delegated the execution of services and/or operations to others, but did not identify how the adviser should oversee these delegated responsibilities.” That last finding is the one an RIA with an outsourced IT firm should read twice.

Exams come in two flavors. A general exam, the kind a newly registered firm gets, is light on cybersecurity: the examiner wants the policy, the latest quarterly reports, and a list of incidents, and then turns to marketing or best execution.

A targeted technology exam goes much deeper, and one of our smaller clients got one recently. The follow-up request asked for the full vendor list, every breach in the period, and the methodology behind the firm’s vendor risk ratings, including the questionnaire used for vendors without a SOC 2. The exam has since closed, and we did not hear of any deficiency.

The best way to prepare for either is a mock exam. As we told one client after reviewing its program against a pair of real request letters: “I often find when we start actually collecting the kind of evidence that the SEC will be requesting, we will usually find things that are not working how we think they are.”

The questions that list raised were not about policy. “Are you keeping any kind of incident log? I know they’ll want to see that, and may ask for supporting evidence.” “They will want to see a security tabletop exercise.” “We need to confirm with [IT] that we can produce a log of patches applied across all systems if requested.”

Does this replace the 2022 proposed cybersecurity rule?

No. The two are separate, and only one of them is law. In early 2022 the SEC proposed a standalone cybersecurity rule for advisers and funds that would have required written cybersecurity policies, public disclosure of significant incidents, and confidential reports to the SEC within 48 hours of a significant incident on a new Form ADV-C. That proposal was never adopted.

On June 12, 2025 the Commission issued a notice formally withdrawing it, effective June 17, 2025, along with thirteen other proposals including the predictive data analytics rule and the outsourcing-by-advisers rule. The notice says the Commission “does not intend to issue final rules with respect to these proposals” and that any future action would start with a new proposal.

So there is no Form ADV-C, no 48-hour report to the SEC, and no standalone adviser cybersecurity rule. What governs a small RIA’s cybersecurity in 2026 is the trio the SEC has pointed to for a decade: Regulation S-P (safeguards, incident response, customer notice, vendor oversight, disposal, records), Reg S-ID (identity theft red flags, where the firm maintains covered accounts), and Rule 206(4)-7 (written compliance policies reviewed at least annually, which examiners expect to cover cybersecurity).

If a compliance template you bought in 2022 or 2023 still talks about Form ADV-C or 48-hour reporting, it was written to a proposal that no longer exists.

What if we are state-registered?

Regulation S-P’s new provisions apply to SEC-registered advisers. A state-registered adviser answers to its state securities regulator, and the framework there is NASAA’s Investment Adviser Written Policies and Procedures Model Rule, which NASAA’s members adopted on November 30, 2020 and which folded the 2019 information-security model rule into one set of required policies covering physical security and cybersecurity, among other areas.

Whether and how a state has adopted it varies, and the wording varies with it. Some states also run their own breach-notification clocks, which sit beside the federal one once a firm is SEC-registered, so a tabletop can end up walking both the SEC’s 30-day clock and a state attorney general’s 60-day clock.

Firms crossing the SEC threshold inherit the full rule the day they register. If you are within a year of crossing, build to the SEC standard now.

Someone who isn’t your IT guy has to check your IT guy

Every obligation above lands on the adviser, not on whoever runs its systems. The rule says it directly for service providers: you can hire a vendor to send client notices, but the duty to see that they went out stays with you. The September 2026 risk alert says it for the whole compliance program, faulting advisers whose policies handed operations to others without saying how the adviser would oversee them.

Many of the firms we talk with are run by someone who describes themselves as a wealth manager, not an IT person.

Our answer when a firm asks whether we replace their IT company is the same every time: “We don’t provide basic IT services. Typically we partner with MSPs who do that, and then we provide the overall guidance and design to be compliant with the SEC’s cybersecurity rules and to double-check that the IT company is doing things correctly.”

More often than you would expect, things aren’t done correctly. That is not an accusation. IT companies usually aren’t as good at keeping software patched as they think they are. It’s not because they’re doing anything wrong, but because the tools they rely on only tell part of the story. The good ones realize they’re IT experts, not SEC experts, and most of them appreciate having someone handle that part.

We are not an IT firm, and we have no desire to be one. We’re the strategy and oversight layer; the IT firm keeps doing the hands-on work, and we work well with most IT providers.

That separation is actually the point. You want to be able to audit your IT provider, and they can’t audit themselves. Good IT companies like working with us because we make them look good and we usually bring them more work. Even the list of company computers needs a second set of eyes, because those lists go stale fast.

That is why we send clients a short list to forward to whoever runs their Microsoft 365 or Google Workspace, and ask for a reply on each one:

• Is text-message and voice-call MFA turned off everywhere, with an authenticator app or passkey in its place?
• Is automatic forwarding to outside email addresses blocked?
• Is there an immutable backup of Microsoft 365 or Google Workspace, and when was the last restore test?
• Which EDR product is on every computer, by name, and is any computer missing it?
• Is mailbox audit logging turned on, and how long is it kept?

Ask them to reply with which ones are already in place. Anything that comes back unclear is the thing to look at first.

The Regulation S-P evidence checklist

Every “what proves it” line above, in one place. If you can produce these on request, you can show an examiner the program is running, not filed.

If you would rather have someone else run that check, book a time with us. Our RIA cybersecurity services do exactly that, alongside the IT firm you already have.

Frequently asked questions About Regulation S-P for RIA Firms

Do we have to tell the SEC about a breach?

No. The amended Reg S-P requires notice to affected individuals within 30 days, but it doesn’t require you to report to the SEC. The 48-hour SEC report was part of the 2022 proposal that was withdrawn in June 2025. State breach laws and your cyber insurance policy have their own notice requirements, and your contract with the insurer usually obligates you to report an incident to them promptly or risk the claim.

Does Regulation S-P require a tabletop exercise?

The rule text does not use the word. It requires a firm to “develop, implement, and maintain” a program “reasonably designed to detect, respond to, and recover from” unauthorized access.

Rule 206(4)-7 then requires an annual review of whether the compliance program is adequate and working, and the SEC’s September 2026 risk alert lists advisers whose own procedures called for annual testing that was then left out of the review.

An annual tabletop exercise with a written summary is how firms show the plan was run. In our experience it is also the only time most people open the plan.

Which vendors count as service providers?

Any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information while providing services to you. The practical list at a small RIA is every system that holds client data (CRM, document storage, portfolio and reporting tools, email) plus the IT firm with administrative access. Custodians are regulated by the SEC and FINRA on their own, and many firms treat them separately.

What if a vendor will not agree to notify us within 72 hours?

Keep the request and the answer. Note what the vendor’s standard contract or data processing addendum says about breach notification and file a copy. The rule requires oversight that is reasonably designed, but it does not mandate a specific clause, and a large vendor’s “we will notify you in compliance with our contract” is a normal answer to have on file.

How long do we keep Regulation S-P records?

Five years from the end of the fiscal year of the last entry, the first two years in an appropriate office, under Advisers Act Rule 204-2(e)(1). That covers the policies, incident documentation, notification determinations and notices, service-provider agreements, and disposal policies listed in Rule 204-2(a)(25).

Was there an extension to the June 3, 2026 date?

No. Industry groups asked the SEC for six more months, but none was granted, and the SEC’s rulemaking page lists no relief. Both dates have passed.

Does Regulation S-P apply if our only clients are funds?

That is a question for your compliance counsel, answered against your actual client base. The safeguards, service-provider, and disposal provisions apply to whatever customer information the adviser holds; how far the notification provisions reach when no natural persons are customers is the part counsel has to settle. The reasoning is that a private fund isn’t a covered institution, but its adviser is, and information the adviser holds about fund investors who are natural persons is customer information in the adviser’s hands.

While Regulation S-P can cause a lot of anxiety for RIAs, the SEC isn’t looking for a perfect firm. It’s looking for a process that exists on paper, runs in practice, and leaves a record. Both deadlines have passed, so “we’re working on it” has stopped being an answer, but your actual list of changes you need to make is pretty short: have a plan your people actually use, a notice you could send in 30 days, a vendor file with the asks and the answers, and the records to prove all of it.

If you can produce those on request, you’re in good shape. If you’re not sure you can, the fastest way to find out is to have someone who isn’t your IT firm go looking. That’s what we do, alongside the IT provider you already use. Book a time and we’ll walk through the evidence checklist against what your firm actually has.