Reg S-P vendor oversight for small advisers (June 2026)

The SEC adopted the amendments on 16 May 2024 in Release 34-100155 (IA-6604), effective 2 August 2024. Section II.F gave larger entities 18 months and smaller entities 24 months from Federal Register publication (3 June 2024). For registered advisers the release sets the larger-entity line at "$1.5 billion or more in assets under management", so a one to five person firm is almost certainly a smaller entity with a compliance date of 3 June 2026. That date has passed. If your program is not written down yet, it is overdue, not upcoming.

What changed in 2024?

• Incident response program. Rule 248.30(a)(3) requires written procedures to assess an incident, contain and control it, and notify affected individuals.
• Customer notification within 30 days. Under 248.30(a)(4)(iii), notice goes out "as soon as practicable, but not later than 30 days" after you become aware that unauthorised access to customer information has occurred or is reasonably likely to have occurred. You can skip notice only if a reasonable investigation shows the sensitive customer information has not been, and is not reasonably likely to be, used in a way that would cause substantial harm or inconvenience. Paragraph (a)(4)(iv) lists what the notice must contain, including contact details and how to place a fraud alert.
• Service provider oversight. 248.30(a)(5) requires written policies "reasonably designed to require oversight, including through due diligence and monitoring, of service providers". They must be reasonably designed to ensure each provider takes appropriate measures to (A) protect against unauthorised access to or use of customer information and (B) notify you "as soon as possible, but no later than 72 hours after becoming aware" of a breach affecting a customer information system it maintains.
• Broader scope and disposal. "Customer information" now covers records about customers of other financial institutions that are given to you, and the disposal rule in 248.30(b) requires written disposal procedures.
• Records. For advisers, Rule 204-2(a)(25) requires keeping the policies, documentation of any detected incident and your response, the notification analysis and any notice sent, the service provider policies, and "any contract or agreement entered into" under 248.30(a)(5).
• Annual privacy notice exception. Rule 248.5(e) lets you skip the annual notice if you share nonpublic personal information only under the 248.13 to 248.15 exceptions and your policies have not changed since your last notice.

Do I need a 72-hour clause in every vendor contract?

No. The proposal would have required a written contract, and the final rule dropped it. The release says the Commission adopted the amendments "without requiring covered institutions to enter into a written contract with their service providers", while building the same protections into your policies. In practice a contract clause or a data processing addendum with 72-hour notice is the simplest evidence. Where a large provider's terms are fixed, record what its standard terms, security page or SOC 2 report say about breach notice, decide whether that is good enough, and write down why. A service provider is anyone who "receives, maintains, processes, or otherwise is permitted access to customer information" through services provided directly to you (248.30(d)(10)).

How should a small adviser build the vendor inventory?

1. List every system that touches client data. Start from your bank statement and card bills: every subscription is a candidate.
2. Mark which ones hold sensitive customer information, such as Social Security numbers, government ID numbers, or account numbers combined with access details like a date of birth or security answer (examples from 248.30(d)(9)).
3. For each, record the evidence: breach notice terms and the hours they promise, a security attestation if one exists, who at the vendor to call, and the date you reviewed it.
4. Set a review date and repeat at least annually, or when a vendor changes ownership or terms.
5. Write the incident runbook: who decides, how you contain (password resets, revoking access), the 30-day notice clock, and a notice template.

Leave out tools that never see customer information. Plumb, for example, is built to hold no client data, so it belongs outside the inventory, though its vendor register is where the inventory itself can live with a review date on each row. The annual review fits the compliance calendar, and the records count toward the five-year retention in Rule 204-2.

This is general information, not legal advice. The SEC has not published a small entity compliance guide for these amendments that we could find, so this page relies on the rule text and the adopting release.