Cybersecurity for Financial Advisers and RIAs

Registered investment advisers hold the data and the account access that fraudsters want most, often with a handful of staff and an outsourced IT provider. A small advisory firm can see client Social Security numbers, custodial account numbers and money movement instructions every day, and one compromised mailbox can be enough to send a client's savings to a criminal. This guide explains which SEC rules now set the security baseline for advisers, how to build a practical programme around Regulation S-P and Regulation S-ID, and how to stop the wire and account takeover fraud that drives most losses in the sector. It is written for chief compliance officers, operations leads and the IT providers who support SEC-registered advisers. The rule text itself is covered in the SEC Regulation S-P Amendments Guide; this page turns it into an operating plan for an advisory firm. It reflects the SEC rules as of November 2026 and is not legal advice.

Key takeaways

Regulation S-P is now a full incident response rule. The 2024 amendments require a written programme to detect, respond to and recover from unauthorised access to customer information, and notice to affected individuals within 30 days.
Both compliance dates have passed. Advisers with 1.5 billion US dollars or more in assets under management had to comply by 3 December 2025, and all other advisers by 3 June 2026.
Your vendors must tell you within 72 hours. Service provider oversight must include notice to the adviser no later than 72 hours after a provider becomes aware of a breach of a customer information system it maintains.
Money movement is the core control point. SEC examiners focus Regulation S-ID reviews on account takeovers and fraudulent transfers; a verified call-back on every disbursement request is the most effective single control.
The broader adviser cyber rule was withdrawn. The SEC withdrew its 2022 cybersecurity risk management proposal for advisers in June 2025, so Regulation S-P, S-ID and the compliance rule remain the federal baseline.

The adviser threat profile

Advisory firms are attacked less for their systems than for what those systems can move. The patterns that cause losses are consistent:

Client email compromise: a criminal takes over a client's personal mailbox and emails the adviser asking for a distribution to a "new" bank account, often with urgency around a house purchase or medical bill.
Adviser email compromise: a staff mailbox is taken over through phishing or a stolen session, and the attacker reads client correspondence, sets up forwarding rules and sends payment instructions to custodians or clients.
Custodian and portal account takeover: credentials for the custodian platform, CRM, financial planning or aggregation tools are phished or reused. These portals often allow address changes, standing instructions or third-party transfers.
Impersonation by phone and video: callers posing as clients, family members or the firm's principal, increasingly using cloned voices. See the Deepfake and Payment Fraud Executive Briefing.
Vendor compromise: an MSP, a CRM vendor or an outsourced back office is breached and client data or access travels with it.

The scale is visible in official figures: the FBI IC3 2024 Internet Crime Report recorded 21,442 business email compromise complaints with reported losses of about 2.77 billion US dollars, and investment fraud as the costliest category at about 6.57 billion US dollars. In ATT&CK terms, the common chain is T1566 Phishing and T1078 Valid Accounts for entry, T1199 Trusted Relationship through suppliers, and T1657 Financial Theft as the objective.

The SEC rules that set the baseline

Rule	Applies to	Core security duty	Status as of November 2026
Regulation S-P, Rule 248.30 (as amended May 2024)	SEC-registered investment advisers, broker-dealers, investment companies, transfer agents	Written safeguards policies; incident response programme; customer notice within 30 days; service provider oversight with 72-hour notice; disposal of customer and consumer information; records of compliance	In force. Larger entities complied by 3 December 2025, smaller entities by 3 June 2026
Regulation S-ID, Rule 248.201	Advisers, including those required to register, that are financial institutions or creditors and offer or maintain covered accounts	Written Identity Theft Prevention Program that identifies, detects and responds to red flags and is updated; initial board or committee approval; training; service provider oversight	In force
Advisers Act Rule 206(4)-7 (compliance rule)	SEC-registered advisers	Written compliance policies reasonably designed to prevent violations, reviewed annually, with a chief compliance officer; security policies sit within this programme	In force
2022 proposal on cybersecurity risk management for advisers and funds (S7-04-22)	Would have covered advisers and funds	Proposed policies, reporting and disclosure	Withdrawn on 12 June 2025; the SEC said it does not intend to adopt it

State-registered advisers are supervised by their state securities regulator, and many firms are also subject to state data security and breach notification laws, such as Massachusetts 201 CMR 17.00 where they hold data on Massachusetts residents. Firms with a New York Department of Financial Services licence for another line of business should check the NYDFS Part 500 Guide.

What the Regulation S-P amendments ask of an adviser

Incident response programme: written policies and procedures reasonably designed to detect, respond to and recover from unauthorised access to or use of customer information, including assessing the nature and scope of an incident and taking steps to contain and control it.
Customer notice: notify individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorisation, as soon as practicable and no later than 30 days after becoming aware. The notice describes the incident, the data involved and how individuals can protect themselves.
The no-harm exception: notice is not required if, after a reasonable investigation, the firm determines the sensitive information has not been and is not reasonably likely to be used in a way that would cause substantial harm or inconvenience. Document that investigation; it is the evidence an examiner will ask for.
Sensitive customer information: includes identifiers likely to be used to authenticate identity, such as a Social Security number, and a user name or account number combined with a security code or similar access information.
Service providers: written policies to oversee providers, including that each notifies the adviser as soon as possible and no later than 72 hours after becoming aware of a breach of a customer information system it maintains. A provider may send customer notices on the firm's behalf, but the firm stays responsible.
Disposal: disposal requirements now cover customer information as well as consumer information.

Building the programme in a small or mid-sized firm

Map the data and the money: list every system that holds client nonpublic personal information (CRM, custodian portals, planning and aggregation tools, document storage, email, e-signature, scanned paper) and every path through which money can leave a client account. This map drives everything else.
Lock down identities first: enforce MFA on email, CRM, document storage, custodian and other platforms. Use phishing-resistant methods (security keys or passkeys) for staff who can initiate or approve money movement. See the Phishing-Resistant MFA Guide.
Write the money movement procedure: define how disbursement, address change and standing instruction requests are received, verified and approved. This doubles as the core of the Regulation S-ID red flag response.
Write the incident response programme: roles, the decision on whether sensitive customer information was involved, the reasonable-investigation record for the no-harm exception, the 30-day notice workflow and template, and regulator and custodian contacts. The Incident Response Plan Template is a starting point.
Bring vendors under contract: inventory service providers with access to customer information, add the 72-hour breach notice and safeguard clauses, and record the oversight you perform. See Choosing an IT Support Provider or MSP Securely.
Train with the firm's real scenarios: a client email asking for a wire, a caller who knows the client's details, a custodian "alert" link. Include advisers and assistants, not only operations.
Test and record: run a tabletop exercise on a compromised client mailbox and on a vendor breach, test backups of the CRM and document store, and keep the evidence for the annual compliance review under Rule 206(4)-7.

Rollout and rollback: introduce new verification steps with a short client communication so that call-backs are expected rather than resisted, and pilot MFA changes with operations staff first, keeping emergency administrator access stored securely.

Stopping wire and account takeover fraud

Request type	Red flags	Required verification
Third-party wire or ACH from a client account	New payee, urgency, request by email or text only, client "travelling" or unreachable by phone	Call the client at the number on file before the request (never one in the email); confirm amount and payee by voice; second-person approval above a set threshold
Change of address, email or phone	Change followed quickly by a disbursement request; request from a new email address	Confirm through the old contact details; impose a cooling-off period before money moves to new instructions
New standing instruction or bank link	Bank name not matching client's history; account in another person's name	Call-back plus documentary evidence of ownership where the custodian process allows
Instruction "from" the firm principal or a custodian	Secrecy, pressure, unusual channel	Verify through a known internal number; no exceptions for seniority
Client or family member calling to change access	Caller knows public details but hesitates on account specifics; voice quality oddities	Use pre-agreed verification questions or a code word recorded at onboarding; call back

Record each verification in the CRM. That record is also evidence that the Identity Theft Prevention Program detects and responds to red flags, which SEC examination priorities name as a focus during account takeovers and fraudulent transfers. If a fraudulent wire has already gone, work the Business Email Compromise Response Playbook and contact the receiving bank and the FBI IC3 straight away.

Where identity fits

Advisers rely heavily on third-party platforms connected to each other through credentials that nobody logs in with: aggregation services pulling custodial data, CRM integrations with planning tools, and API connections between portfolio management and reporting systems. The SEC examination priorities flag advisers that use third parties to access client accounts where controls may be insufficient. Keep a register of each integration, the account or token it uses, what it can read or change, and who owns it. Remove access when a tool is retired and rotate credentials when a staff member who set them up leaves. For the wider pattern, see the Financial Services Identity Security Guide.

Decision guidance by firm size

Decision	Small firm (under about 10 staff)	Larger RIA or multi-office firm
Who runs security	CCO owns policies; MSP runs technical controls under a written scope	Dedicated security or IT lead reporting to the CCO and management
Identity platform	Cloud email and office suite identity with MFA and conditional sign-in rules	Central identity provider with single sign-on into CRM, custodians where supported, and document systems
Detection	Endpoint protection with alerting to the MSP; mailbox rule and sign-in alerts	Managed detection and response with 24/7 coverage and log retention for investigations
Vendor oversight	Questionnaire and contract review for critical vendors yearly	Tiered vendor programme with evidence review, right to audit and incident clauses
Testing	Annual tabletop and phishing simulation	Annual penetration test, tabletop with management, and restore tests

Detection and measurement

Monitor sign-ins to email and the identity provider (new country, impossible travel, legacy protocols), new inbox rules and external forwarding, MFA method changes, bulk downloads from document storage or CRM exports, and changes to client contact and bank details. Metrics that show the programme working:

MFA coverage: share of staff accounts on all client-data systems with MFA enforced; phishing-resistant MFA for everyone who can move money.
Call-back compliance: share of disbursement and instruction changes with a recorded verification call; target 100 percent.
Vendor readiness: share of service providers with customer information access whose contracts include the 72-hour notice clause.
Notice readiness: time to produce a draft customer notice in the last exercise against the 30-day limit.
Phishing resilience: report rate in simulations, not only click rate.
Leaver time: hours from departure to removal of access to custodian, CRM and email.

Common failure patterns

Acting on email instructions: treating a familiar client email address as proof of identity is the most frequent cause of loss.
Policies copied from a template: examiners compare written procedures with practice; a programme that names systems the firm does not use undermines the whole compliance file.
No record of the no-harm decision: deciding not to notify without a documented reasonable investigation leaves the firm unable to show compliance.
Vendor contracts left unchanged: older contracts rarely contain the 72-hour notice commitment the amended rule expects firms to obtain.
Shared custodian logins: they make it impossible to tell who changed an instruction and often bypass MFA.
Personal devices and messaging apps: client data and instructions arriving through unmanaged phones and texting apps sit outside both security controls and books and records.

Framework mapping

Adviser control	Rule source	NIST CSF 2.0	NIST SP 800-53 Rev 5
Risk-based written safeguards	Reg S-P 248.30	ID.RA	RA-3
MFA and access control	Reg S-P safeguards	PR.AA	IA-2
Red flag detection on money movement	Reg S-ID 248.201	DE.CM	SI-4
Incident response programme and notice	Reg S-P amendments	RS.MA	IR-4, IR-6
Service provider oversight and 72-hour notice	Reg S-P amendments, Reg S-ID	GV.SC	SA-9, SR-6
Training	Reg S-ID administration	PR.AT	AT-2
Recovery of client data systems	Reg S-P (recover)	RC.RP	CP-9

Practitioner checklist

Confirm whether the firm is a larger or smaller entity under Regulation S-P and that the programme was in place by its compliance date.
Map every system holding client data and every route by which money can leave a client account.
Enforce MFA on all client-data systems, with phishing-resistant MFA for anyone who can move money.
Adopt a written call-back procedure for disbursements, address changes and new bank instructions.
Review the Identity Theft Prevention Program for account takeover red flags and record approvals.
Write the incident response programme, the no-harm investigation record and the customer notice template.
Add 72-hour breach notice and safeguard clauses to every relevant service provider contract.
Register every integration and API connection to custodial data with an owner.
Run a tabletop on a client mailbox takeover and keep the evidence for the annual compliance review.

Cybersecurity for Financial Advisers and RIAs: SEC Duties, Client Data and Wire Fraud Controls