An asset manager rarely holds client money itself, yet a single forged instruction, a compromised trader account or a breached fund administrator can move or expose millions of pounds or dollars of investor assets in an afternoon. This guide is a security programme for buy-side firms: investment advisers, fund managers, UCITS management companies and alternative investment fund managers. It covers what attackers target in a buy-side firm, the regulatory duties that apply in the US, EU and UK as of November 2026, how to protect trading and cash movement, and how to govern the custodians, administrators and data providers that hold most of the operational risk. It is written for chief operating officers, chief compliance officers, CISOs and heads of operations at small and mid-sized managers who run lean teams and outsource heavily. Bank-wide programmes are covered in the Banking Cybersecurity Programme Guide.
Key takeaways
- Protect the instruction, not just the data. The most direct path to loss at a manager is a fraudulent instruction to a custodian, administrator or transfer agent, so payment and settlement instruction controls deserve the same weight as data protection.
- Your providers hold your risk. Fund administrators, custodians, prime brokers and transfer agents run most of the processes regulators examine; contract for notification, test their controls and keep a current register.
- US advisers now run under amended Regulation S-P. Larger entities had to comply by 3 December 2025 and smaller ones by 3 June 2026, so every SEC-registered adviser now needs a written incident response programme, service provider oversight and 30-day customer notice.
- Trading access is privileged access. Order management and execution system roles, FIX connections and broker portals can move markets and leak material non-public information; manage them like administrator rights.
- Machine credentials connect everything. SFTP keys, API tokens and service accounts link the firm to custodians, data vendors and administrators, and are often the least governed access in a small manager.
What attackers target in an asset manager
A buy-side firm's attack surface is shaped by outsourcing. Investor assets sit with custodians, investor records often sit with an administrator or transfer agent, and the firm itself holds the decision rights: who can instruct, who can trade and who can see positions before the market does.
| Asset | Where it usually lives | What an attacker wants | Primary control |
|---|---|---|---|
| Settlement and payment instructions | Custodian and administrator portals, email, secure file transfer | Redirect redemptions, capital calls or fees to attacker accounts | Dual control, independent callback, standing instruction lock |
| Investor and client records | Administrator, transfer agent, CRM, investor portal | Identity data for fraud, account takeover of investors | Access review, provider oversight, portal MFA |
| Orders and positions | Order management system (OMS), execution management system (EMS), broker platforms | Front-running, market manipulation, ransom leverage | Role-based trading access, information barriers, logging |
| Research and deal information | File shares, collaboration tools, data rooms | Material non-public information for trading or resale | Need-to-know access, DLP, barrier monitoring |
| Executive and portfolio manager mailboxes | Cloud email | Impersonation for payment fraud, insight into deals | Phishing-resistant MFA, forwarding rule alerts |
| Integration credentials | Scripts, SFTP servers, middleware, cloud vaults | Silent, persistent access to provider data | Credential inventory, rotation, vaulting |
The fraud path is usually mundane: phishing (MITRE ATT&CK T1566) gives access to a mailbox, an email forwarding rule (T1114.003) lets the attacker watch payment threads, and a well-timed change of bank details produces financial theft (T1657). The Business Email Compromise Response Playbook covers the response.
Regulatory duties as of November 2026
The rules below are those most buy-side firms meet. They are summaries, not legal advice; confirm scope for your entity with counsel.
| Jurisdiction and rule | Who it covers | Core security duties | Status |
|---|---|---|---|
| US: Regulation S-P, as amended | Registered investment advisers, investment companies, broker-dealers and transfer agents | Written incident response programme to detect, respond to and recover from unauthorised access to customer information; notice to affected individuals within 30 days of becoming aware of unauthorised access to sensitive customer information; written service provider oversight, with providers notifying within 72 hours; written records documenting compliance | Adopted 16 May 2024. Larger entities by 3 December 2025; smaller entities by 3 June 2026 |
| US: Regulation S-ID (Identity Theft Red Flags) | Registered advisers that can direct transfers or payments from individuals' accounts to third parties, and other covered firms with covered accounts | Board-approved programme to identify, detect and respond to identity theft red flags and keep the programme updated | In force since 2013; named in the SEC Division of Examinations fiscal year 2026 priorities, with focus on account takeover and fraudulent transfers |
| US: proposed adviser cybersecurity rule | Advisers and funds | Would have added written cyber policies and incident reporting | Withdrawn by the SEC on 12 June 2025; Regulation S-P and S-ID remain |
| EU: Digital Operational Resilience Act (Regulation (EU) 2022/2554) | Managers of alternative investment funds (Article 2(1)(k)) and UCITS management companies (Article 2(1)(l)); certain smaller AIFMs under Article 3(2) of the AIFMD are excluded by Article 2(3)(a) | ICT risk management framework, major incident reporting, resilience testing, ICT third-party risk and a register of information, applied proportionately under Article 4 | Applies from 17 January 2025 |
| UK: FCA operational resilience rules | Includes enhanced scope SM&CR firms, among other firm types | Identify important business services, set impact tolerances, map and test | In force since 31 March 2022; mapping and testing deadline 31 March 2025; new operational incident and third-party reporting requirements from 18 March 2027 |
Firms with a New York licence may also fall under the NYDFS Part 500 Guide requirements, and listed managers under the SEC Cybersecurity Disclosure Rules Guide. Detail on each rule sits in the SEC Regulation S-P Amendments Guide, the DORA Guide and the Financial Services Cyber Regulation Map.
Securing trading and investment systems
Trading platforms are business-critical and latency-sensitive, which tempts firms to leave them outside normal access governance. Treat them as privileged systems.
- Role design: separate portfolio manager, trader, compliance and operations roles in the OMS and EMS. Order entry, order approval and allocation should not sit with one person for the same account.
- Pre-trade limits as security controls: restricted lists, position limits and fat-finger checks also stop a compromised trader account from doing much damage. Changes to limits should need approval and leave a log.
- Broker and venue connections: keep an inventory of FIX sessions and broker portals, who can use each, and which credentials or certificates authenticate them. Disable sessions for brokers no longer on the approved list.
- Information barriers: where the firm holds material non-public information, enforce need-to-know access to research and deal folders and monitor crossings. See the Information barriers and ethical walls guide.
- Change control: trading system configuration, model code and allocation rules change through a reviewed process, with emergency changes reviewed after the fact.
- Communications: trading conversations on personal messaging apps create both a records problem and an attack surface. See the Enterprise Messaging Retention and Off-Channel Communications Guide.
Protecting custody and cash movement
Managers instruct; custodians and administrators execute. Attackers exploit that hand-off. The controls below are NHI Mgmt Group recommendations built from common practice; agree them with your providers, because many sit on the provider side.
- Standing settlement instructions locked: agree with each custodian and administrator that new or changed beneficiary details need a separate authorised request through a channel other than email, plus a callback to a number already on file.
- Dual authorisation: every outbound payment and every change to bank details needs two authorised signatories, with neither able to approve their own request. See the Dual control and four-eyes approval guide.
- Investor redemption checks: redemption requests that change the receiving account, arrive soon after a contact detail change, or request full balance payment get extra verification by the administrator or transfer agent.
- Capital call and distribution notices: publish bank details only in the investor portal and tell investors you will never change them by email, so a spoofed notice stands out.
- Portal hardening: custodian, administrator and bank portals use phishing-resistant MFA, named users and a quarterly user review. Remove leavers on the day they leave.
- Reconciliation: daily cash and position reconciliation against the custodian catches unauthorised movements early.
These controls also support a Regulation S-ID programme, since account takeover and fraudulent transfers are exactly the red flags examiners named for 2026. The Account Takeover Prevention Guide covers investor-facing controls.
Governing administrators, custodians and other providers
For most managers, providers carry more operational risk than the firm's own estate. Regulation S-P now requires written oversight of service providers, DORA requires a register of information, and examiners in all three jurisdictions ask how you know your providers are secure.
| Provider | What they hold or do | Contract and oversight points |
|---|---|---|
| Fund administrator | NAV, investor records, payments, anti-money laundering checks | 72-hour incident notice for customer information, payment verification procedures, SOC 1 and SOC 2 reports, user access lists for your staff |
| Custodian and prime broker | Assets, settlement, financing | Instruction authentication methods, callback rules, portal MFA, notification of suspected fraud |
| Transfer agent | Shareholder registers, redemptions | Change of address and bank detail verification, notice duties, recordkeeping |
| Market data and research vendors | Data feeds, terminals, analytics | Credential handling, licence-based user lists, API key scope |
| Outsourced IT and managed security | Your endpoints, cloud and email | Privileged access model, logging, right to audit, exit plan |
Rank providers by what they can move or expose, review the top tier annually with evidence rather than questionnaires alone, and run at least one joint incident exercise with your administrator. The Third-Party Risk Management Guide and DORA ICT Third-Party Risk and Register of Information Guide cover the programme in depth.
Where identity fits
Small managers often have more machine identities than staff. Daily position files arrive by SFTP with key-based accounts, risk systems pull data with API keys, and reporting scripts log in to custodian portals with shared service accounts. Each is a standing path into investor data. Inventory them with an owner, store secrets in a vault rather than scripts or spreadsheets, scope API keys to read-only where the provider allows it, and rotate on staff departure and on any provider incident. See the Financial Services Identity Security Guide. Human administrator rights to email, cloud and trading platforms belong under the Privileged Access Management Guide approach.
Implementation steps
This sequence is NHI Mgmt Group's recommended order for a small or mid-sized manager starting from an informal programme.
- Map critical services: list trading, cash movement, investor servicing and reporting, with the systems and providers behind each. This doubles as the FCA important business service list and DORA critical function view.
- Lock down cash movement first: agree callback and dual authorisation rules with every custodian and administrator within the first month, because this is where losses are fastest.
- Enforce phishing-resistant MFA: start with executives, finance, operations and traders, then all staff and every provider portal. Pilot with one team, keep a documented break-glass account, and roll back per user if a provider portal fails.
- Write the incident response programme: include assessment, containment, the 30-day Regulation S-P customer notice decision, DORA or FCA reporting where relevant, and recordkeeping. Test it with a tabletop that includes the administrator.
- Repaper providers: add 72-hour notice, audit rights, access lists and exit terms at renewal, and build the provider register.
- Govern trading and machine access: role review in the OMS and EMS, FIX session inventory, and a credential register for SFTP, API and service accounts.
- Measure and report: give the board or management committee a quarterly view against the metrics below.
Decision guidance by firm size
| Question | Small manager (under about 50 staff) | Larger manager or fund complex |
|---|---|---|
| Build or buy security operations | Managed detection and response with clear escalation to the COO | In-house team or hybrid with a 24x7 provider |
| Who owns cyber | COO or CCO with an external virtual CISO | Dedicated CISO reporting to the CEO or risk committee |
| Provider assurance | SOC reports plus a targeted call on payment and notice procedures | Onsite or virtual audits of top-tier providers and joint testing |
| Trading platform | Hosted OMS with vendor-managed infrastructure; focus on roles and MFA | Self-hosted components need network segmentation and change control |
| Testing | Annual penetration test and payment fraud tabletop | Threat-led testing where regulators require it, plus red teaming of payment paths |
Detection and metrics
Log and alert on new mailbox forwarding and inbox rules, sign-ins to email and provider portals from new countries or devices, changes to standing settlement instructions, bulk downloads from research or investor folders, OMS role and limit changes, and use of dormant service accounts. Send logs off the systems that generate them, and keep them long enough to support a Regulation S-P investigation.
- Payment changes verified: percentage of bank detail changes confirmed by independent callback (target 100 per cent).
- MFA coverage: share of staff and provider portal accounts on phishing-resistant MFA.
- Provider assurance: share of top-tier providers with a current assurance review and 72-hour notice clause.
- Access hygiene: days from leaver date to removal across email, OMS and provider portals.
- Machine credential age: share of SFTP keys and API tokens with an owner and rotated within policy.
- Exercise cadence: incident tabletops run with the administrator in the last 12 months.
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | Regulatory hook |
|---|---|---|---|
| Provider oversight | GV.SC-07 | SA-9, SR-6 | Regulation S-P service provider oversight; DORA ICT third-party risk |
| Trading and admin access | PR.AA-05 | AC-6 | Regulation S-P safeguards |
| Investor data protection | PR.DS-01 | AC-6 | Regulation S-P safeguards |
| Monitoring | DE.CM-09 | IR-6 | Regulation S-ID red flag detection |
| Recovery | RC.RP-01 | CP-10 | FCA impact tolerances; DORA business continuity |
| Governance review | GV.OV-01 | IR-6 | Board approval of the S-ID programme |
Common failure patterns
- Trusting email for instructions: a change of bank details accepted on the strength of a reply from a known address, which an attacker controls through a compromised or look-alike mailbox.
- Assuming the administrator has it covered: the manager stays responsible for Regulation S-P compliance even when a provider sends notices on its behalf.
- Shared provider logins: one custodian portal account used by the whole operations team, so no one can tell who approved what and leavers keep access.
- Orphaned machine credentials: SFTP keys and API tokens created by a departed analyst, still live years later.
- Untested plans: an incident plan that names no one at the administrator and has never been run against the 30-day notice clock.
- Trading outside governance: OMS roles granted at onboarding and never reviewed, with limit changes made without approval.
Practitioner checklist
- Critical services mapped to systems and providers, reviewed annually.
- Callback and dual authorisation agreed in writing with every custodian, administrator and bank.
- Phishing-resistant MFA on email, cloud, OMS and all provider portals.
- Written incident response programme covering the Regulation S-P 30-day notice and any DORA or FCA reporting.
- Provider register with tiering, 72-hour notice clauses and current assurance evidence.
- Regulation S-ID programme approved by the board, with account takeover and transfer red flags.
- OMS and EMS roles, limits and FIX sessions reviewed at least quarterly.
- Machine credential register with owners, vault storage and rotation.
- Annual tabletop with the fund administrator.
Standards and references
- SEC: SEC Adopts Rule Amendments to Regulation S-P to Enhance Protection of Customer Information
- EUR-Lex: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector
- FCA: Operational resilience
- Baker Donelson: Regulation S-P June 3, 2026 compliance deadline for smaller investment advisers
- SEC: Regulation S-P small entity compliance guide
- SEC: Division of Examinations fiscal year 2026 priorities
- Willkie Farr: December 3 compliance date for SEC amendments to Regulation S-P
- Sidley: SEC and CFTC issue final Red Flags Rules relating to identity theft
- Goodwin: 2026 SEC exam priorities for registered investment advisers
- Stinson: SEC withdraws proposed rules affecting investment advisers, funds and broker-dealers
Related NHI Mgmt Group resources: SEC Regulation S-P Amendments Guide · Financial Services Identity Security Guide · Financial Services Incident Response Guide · DORA Guide