Federal Regulatory
SEC Enforces Regulation S-P Amendments
March 11, 2026
The Securities and Exchange Commission (SEC) has finalized amendments to Regulation S-P that impose enhanced data privacy and security requirements on registered investment advisers, investment companies, broker-dealers, and transfer agents. Smaller entities managing less than $1.5 billion in assets under management (AUM) must comply by June 3, 2026. Compliance mandates include updating incident response programs, customer notification procedures, service provider oversight, recordkeeping, and privacy notices to meet the new standards.
- Key deadline: Smaller entities have until June 3, 2026, to implement required changes.
- Procurement and compliance teams should prioritize revising contracts and service agreements to ensure vendor oversight aligns with SEC mandates.
- Organizations should update cybersecurity policies and incident response plans to meet the enhanced regulatory expectations.
- This development signals increased regulatory scrutiny on data privacy, impacting procurement strategies for IT and security services providers.
Entities that have not yet taken action should now revisit their information security policies and procedures to align them with the new obligations.
— Seward & Kissel LLP
Agencies
Securities and Exchange Commission