Since 3 June 2026 every SEC-registered broker-dealer, investment adviser, investment company, funding portal and transfer agent must run a written incident response programme that can notify affected customers within 30 days and must make its service providers report breaches within 72 hours. The 2024 amendments to Regulation S-P turned a short safeguards rule into a federal breach notification regime for the US securities industry, with a presumption that notice is required unless an investigation shows harm is not reasonably likely. They apply to customer information the firm holds or that is handled on its behalf, including information about other institutions' customers. This guide covers who is covered, the rule text in 17 CFR 248.30, the compliance dates, enforcement history, how service accounts, API keys and AI agents fit, and a practical implementation plan. It is for CISOs, CCOs, privacy and vendor risk teams at US registrants; for the wider picture see the Financial Services Cyber Regulation Map.
Status checked 27 October 2026 against the eCFR text of 17 CFR 248.30 and the SEC adopting release. No extension of either compliance date was found. This page is not legal advice.
Key takeaways
- Both compliance dates have passed: larger entities had to comply by 3 December 2025 and all other covered institutions by 3 June 2026.
- Notice is the default: affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorisation must be notified unless a reasonable investigation shows substantial harm or inconvenience is not reasonably likely.
- Thirty days from awareness: notice is due as soon as practicable and no later than 30 days after the firm becomes aware of the incident; only the US Attorney General can delay it.
- Seventy-two hours for vendors: written policies must require service providers to notify the firm as soon as possible and no later than 72 hours after becoming aware of a breach of a customer information system they maintain.
- Machine access is service provider access: any vendor, integration or AI service granted access to customer information through its services is a "service provider" under the rule.
Scope: who and what is covered
| Element | Position under the amended rule | Source |
|---|---|---|
| Covered institutions | Broker-dealers (including funding portals), investment companies, SEC-registered investment advisers and transfer agents | SEC adopting release |
| Transfer agents | Newly brought under the safeguards and disposal rules | Federal Register release |
| Customer information | Nonpublic personal information about a customer, held by the institution or handled on its behalf, including information about customers of other financial institutions provided to it | 17 CFR 248.30(d) |
| Sensitive customer information | Any component whose compromise creates a reasonably likely risk of substantial harm or inconvenience, for example SSN, driver's licence, passport, taxpayer ID, biometric record or unique electronic identifier; or an account number, name or username combined with an access code, security answers, date of birth or similar | 248.30(d) |
| Service provider | Any person or entity that receives, maintains, processes or is otherwise permitted access to customer information through providing services directly to the institution | 248.30(d) |
| Disposal | Reasonable measures and written procedures for disposing of consumer and customer information (notice-registered broker-dealers excepted) | 248.30(b) |
Larger and smaller entities
| Institution type | Larger entity (complied by 3 December 2025) | Others (complied by 3 June 2026) |
|---|---|---|
| Investment companies | Net assets of $1 billion or more as of the most recent fiscal year end | Below $1 billion |
| Registered investment advisers | $1.5 billion or more in assets under management | Below $1.5 billion |
| Broker-dealers | All that are not "small entities" under the Exchange Act (broadly, total capital of $500,000 or more, or affiliated with a non-small entity) | Small broker-dealers |
| Transfer agents | All that are not small entities under the Exchange Act | Small transfer agents (broadly, fewer than 500 items processed and fewer than 1,000 shareholder accounts) |
Thresholds are as summarised by Goodwin and Paul Hastings from the adopting release. Because both dates have passed, the distinction now matters mainly for how examiners read your implementation history.
Key obligations
Incident response programme (248.30(a)(3))
The safeguards policies must include a programme "reasonably designed to detect, respond to, and recover from" unauthorised access to or use of customer information, with procedures to:
- Assess: the nature and scope of any incident, identifying the customer information systems and types of customer information that may have been accessed or used without authorisation.
- Contain and control: take appropriate steps to stop further unauthorised access or use.
- Notify: affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorisation, unless the no-harm determination applies.
Customer notification (248.30(a)(4))
- Standard: a clear and conspicuous notice, delivered so that each individual can reasonably be expected to receive actual notice in writing.
- Unidentified individuals: if the firm cannot tell whose data was affected, it notifies everyone whose sensitive customer information resided in the affected system, except those reasonably determined to be unaffected.
- No-harm exception: available only after a reasonable investigation that concludes the sensitive information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. The determination and its basis must be documented.
- Timing: as soon as practicable, not later than 30 days after becoming aware that unauthorised access or use occurred or is reasonably likely to have occurred.
- Attorney General delay: where notice poses a substantial risk to national security or public safety, the Attorney General can delay it for up to 30 days, extend once by up to 30 days, and in extraordinary circumstances by a final 60 days, notifying the SEC in writing.
| Required notice content (248.30(a)(4)(iv)) | Practical source |
|---|---|
| General description of the incident and the type of sensitive customer information involved | Forensic summary |
| Date of the incident, estimated date or date range, if reasonably possible | Investigation timeline |
| Contact information: telephone number (toll-free if available), email or equivalent, postal address and the name of a specific office | Customer service |
| For account holders, a recommendation to review account statements and report suspicious activity | Template text |
| What a fraud alert is and how to place one with the nationwide credit reporting companies | Template text |
| A recommendation to obtain credit reports periodically and have fraudulent information removed | Template text |
| How to obtain a free credit report | Template text |
| Information on FTC and usa.gov identity theft guidance, encouragement to report to the FTC, and the FTC website | Template text |
Service provider oversight (248.30(a)(5))
- Due diligence and monitoring: written policies to oversee service providers, so they take appropriate measures to protect against unauthorised access to or use of customer information.
- 72-hour notice: providers must notify the firm as soon as possible, and no later than 72 hours after becoming aware of a breach in security resulting in unauthorised access to a customer information system they maintain.
- Delegated notice: the firm may contract a service provider to send customer notices, but the responsibility for ensuring notice stays with the firm.
Recordkeeping and annual notices
Firms must keep written records documenting compliance: the safeguards and disposal policies, incident documentation, investigation and no-notice determinations, Attorney General delay requests, copies of notices, and service provider policies and contracts. Retention follows each registrant type's existing books-and-records rule; for the investment companies covered directly by 248.30(c), it is six years, the first two in an easily accessible place. The amendments also align annual privacy notice delivery with the statutory exception added to the Gramm-Leach-Bliley Act. See the GLBA Safeguards Rule Guide for the FTC rule that covers non-SEC financial institutions.
Timeline and current status
| Date | Event |
|---|---|
| 16 May 2024 | SEC announces adoption of the amendments (press release 2024-58) |
| 3 June 2024 | Published in the Federal Register (89 FR 47688) |
| 2 August 2024 | Amendments effective |
| 3 December 2025 | Compliance date for larger entities |
| 3 June 2026 | Compliance date for all other covered institutions |
| 2026 | The SEC Division of Examinations names Regulation S-P compliance an examination priority (per Baker Donelson, February 2026) |
No extension of either date was found in the sources checked on 27 October 2026. State breach laws continue to apply alongside Regulation S-P, so one incident can trigger both federal and state notices with different content and deadlines. See the Data Breach Notification Checklist.
Enforcement and penalties
Regulation S-P has no fixed penalty schedule; the SEC enforces it through its general powers under the securities laws, typically with censures, cease-and-desist orders, undertakings and civil penalties. Two pre-amendment cases show where examiners look.
- Disposal and vendor oversight: in September 2022 Morgan Stanley Smith Barney paid $35 million over Safeguards and Disposal Rule failures affecting about 15 million customers. It had used a moving and storage company with no data destruction experience to decommission devices, some of which were resold online with customer data intact, and encryption on some decommissioned devices had not been enabled. See the Media Sanitisation Guide.
- Account takeover: in August 2021 Cetera ($300,000), Cambridge ($250,000) and KMS ($200,000) settled Safeguards Rule charges after takeovers of cloud email accounts of more than 60, 121 and 15 personnel respectively exposed customer data. Cetera entities were also charged over breach notices with misleading language about when incidents were discovered. See the Securing Your Email Account Guide.
Under the amended rule, expect examiners to test the written programme, the 30-day clock against incident records, the evidence behind any no-harm decision, and whether contracts and practice actually deliver 72-hour vendor notice.
What it means for AI agents and non-human identities
The rule is technology-neutral, but its definitions pull machine access into scope. A "service provider" is anyone "permitted access" to customer information through its services, and "sensitive customer information" includes usernames combined with access codes and unique electronic identifiers.
- Integrations are service providers: a CRM plug-in, portfolio analytics platform, AI note-taker or LLM API that receives customer data through a token is a service provider. It needs due diligence, monitoring and the 72-hour clause. See the Third-Party AI Risk Guide.
- Token theft at a vendor is your incident: the Salesloft Drift breach showed OAuth tokens held by an integration provider being used to export customer CRM records, including support cases where people had pasted credentials. Under Regulation S-P the vendor's 72-hour notice starts your assessment and your 30-day clock.
- Scoping depends on identity telemetry: the assessment step requires identifying the systems and data types accessed. Without logs that tie API calls and agent actions to a specific non-human identity, firms cannot narrow the affected population and fall back on notifying everyone whose data sat in the system.
- Credentials in data are sensitive data: stored usernames with security answers or access codes fall within the sensitive customer information definition, so credential stores, help desk tickets and agent memory that contain them raise the stakes of any breach. See the Secrets Management Guide.
- Containment means revocation: plan to revoke and rotate the keys, tokens and service account credentials of a compromised vendor or agent within hours, and record when you did. See the Leaked Credential Response Playbook.
Compliance steps
- Confirm status and scope: record which registered entities are covered, whether each was a larger entity, and which systems hold customer information, including information about other institutions' customers.
- Inventory service providers by access, not by contract: list every vendor, integration and AI service with access to customer information, using identity sources (OAuth grants, API keys, SFTP accounts, federated roles) to find those procurement missed.
- Paper the 72 hours: amend contracts or obtain written commitments for 72-hour breach notice, and define what "becoming aware" and "customer information system" mean in each.
- Write the programme: assessment, containment and notification procedures with named roles, an incident severity model and the decision path for the no-harm exception.
- Build the clock: define "awareness" internally, start a 30-day timer from it, and track Attorney General delay requests separately.
- Prepare notices: pre-approve templates containing every element of 248.30(a)(4)(iv), plus state-law variants, and agree who signs off.
- Exercise it: run a tabletop where a vendor reports a token compromise at hour 70; test assessment, revocation, the no-harm analysis and notice drafting. Use the Incident Response Plan Template as the base document.
- Keep the records: store investigation files, determinations, notices and vendor policies under your books-and-records retention rule.
- Review disposal: confirm device and media destruction contracts, certificates and encryption, the area the 2022 case exposed.
Decision guidance
| Situation | Approach | Trade-off |
|---|---|---|
| Small RIA with a handful of vendors | Short programme document, outsourced forensics retainer, vendor addenda for the 72-hour clause | Relies on vendors' willingness to sign; keep evidence of requests where they refuse and of compensating monitoring |
| Broker-dealer with many integrations | Identity-based vendor inventory, automated token revocation, central incident clock | Engineering effort; pays back by narrowing notice populations |
| Fund complex using third-party transfer agents and administrators | Delegate notice contractually where sensible, keep oversight evidence | Delegation does not move responsibility; you still need proof notices were sent on time |
| Uncertain whether data was misused | Notify unless the investigation positively supports the no-harm finding | Over-notification costs money; an unsupported no-notice decision is an examination finding |
Measurement and framework mapping
- Metrics: median days from awareness to customer notice (target well under 30); share of service providers with access to customer information under a 72-hour notice commitment; integrations and tokens with a named owner and vendor record; time to revoke credentials after a vendor incident; no-notice determinations with a documented investigation; tabletop exercises completed per year.
| Regulation S-P requirement | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Incident response programme (a)(3) | IR-8, IR-4 | RS.MA-01 | A.5.24, A.5.26 |
| Customer notification (a)(4) | IR-6 | RS.CO-02 | A.5.26 |
| Service provider oversight (a)(5) | SA-9, SR-8 | GV.SC-07 | A.5.19, A.5.22 |
| Safeguards policies (a)(1) | AC-2, IA-2 | PR.AA-05 | A.5.15 |
| Disposal (b) | MP-6 | PR.DS-01 | A.7.14, A.8.10 |
| Recordkeeping | SI-12 | GV.OC-03 | A.5.33 |
Common failure patterns
- Vendor list from accounts payable: free tools, OAuth apps and AI services with customer data never appear, so they never receive the 72-hour clause.
- Starting the clock late: treating "awareness" as the end of forensics rather than the point the firm learned access was reasonably likely.
- Thin no-harm decisions: concluding no notice is needed without the investigation evidence the rule requires.
- Logs that cannot scope: missing per-identity API and mailbox logs force notification of every customer in the system.
- Disposal left to logistics: device decommissioning handled by vendors without destruction expertise or verification.
Practitioner checklist
- Confirm every registered entity is operating under the amended rule as of its compliance date.
- Adopt written assessment, containment and notification procedures under 248.30(a)(3).
- Define internal "awareness" and run a 30-day clock from it.
- Hold notice templates containing all eight required elements.
- Inventory service providers using identity and integration data, including AI services.
- Secure 72-hour breach notice commitments from every provider with customer information access.
- Log API, integration and agent activity per identity so incidents can be scoped.
- Rehearse revocation of a vendor's tokens and keys.
- Document every no-notice determination with its investigation basis.
- Verify secure disposal of devices and media, with certificates.
Standards and references
- eCFR: 17 CFR 248.30, Procedures to Safeguard Customer Information
- Federal Register: Regulation S-P Final Rule (89 FR 47688)
- SEC: SEC Adopts Amendments to Regulation S-P
- SEC: Morgan Stanley Smith Barney Charged with Failing to Protect Customer Information
- SEC: Safeguards Rule Charges Against Cetera, Cambridge and KMS
- Goodwin: Approaching Effective Date for Regulation S-P Amendments
- Baker Donelson: Regulation S-P June 3, 2026 Compliance Deadline
Related NHI Mgmt Group resources: Financial Services Cyber Regulation Map · SEC Cybersecurity Disclosure Rules Guide · NYDFS Part 500 Guide · Third-Party Risk Management Guide. This guide summarises the 2024 amendments to SEC Regulation S-P as of October 2026 and is not legal advice.