The vendor clock: amended Regulation S-P rests on a 72-hour promise someone else makes

The week

On May 16, 2024, the Securities and Exchange Commission adopted amendments to Regulation S-P, the rule on protecting customer information at broker-dealers, funding portals, investment companies, registered investment advisers and transfer agents. Covered institutions must keep an incident response program for unauthorized access to customer information. They must generally notify affected individuals within 30 days of becoming aware that sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization. They must also oversee service providers, whose procedures must provide for notice to the institution as soon as possible and no later than 72 hours after the provider becomes aware of a qualifying breach. The proposal had said 48 hours. The amendments were published on June 3, 2024, with compliance due December 3, 2025 for larger entities and June 3, 2026 for smaller ones.

Earlier in this series we looked at the March 2023 package in which the SEC proposed these amendments alongside two other cyber rules. Of the three, the customer rule was the one adopted, and its most demanding clause was the one aimed at someone else. A wealth manager’s customer data typically sits with a custodian or clearing firm, a portfolio management system, a CRM, document storage, e-signature, email, planning software and an outsourced IT provider. The firm’s ability to protect and notify customers is mostly borrowed. The vendor clause is the SEC’s attempt to make that borrowing explicit. It raises three questions in order: which providers it reaches, what the 72-hour promise actually secures, and how the vendor’s clock connects to the customer’s.

Which providers it reaches

The rule defines a service provider as any person or entity that receives, maintains, processes or otherwise is permitted access to customer information through services provided directly to the covered institution. Three features of that definition shape the inventory.

First, it is direct. A CRM vendor’s hosting provider is not the firm’s service provider under the rule, even though a breach there exposes the firm’s customers. The firm’s visibility into that layer depends entirely on what its direct vendor is obliged to pass on.

Second, some counterparties are covered institutions in their own right. A clearing broker-dealer has its own Regulation S-P obligations, including its own customer notice duties for the accounts it carries. Introducing firms needed to work out with their clearing firms who notifies whom, and in what order, before an incident forced the question.

Third, access counts as much as storage. An outsourced IT provider with administrative credentials to the firm’s email tenant may hold no customer data in its own systems. It is still a service provider, and arguably the most dangerous one, because its compromise opens everything else.

A usable inventory therefore records more than vendor names. It notes what customer information each provider holds or can reach, whether the provider is itself a covered institution, and which of its own suppliers sit underneath. Most firms found the third column the hardest to fill.

What the 72-hour promise secures

The rule does not regulate vendors directly. It requires the firm’s oversight policies to be reasonably designed to ensure that providers protect customer information and give notice within 72 hours. In practice that means a contract term plus due diligence and monitoring.

The clause has narrower edges than its headline. The trigger is the provider’s awareness of a breach resulting in unauthorized access to a customer information system the provider maintains. A provider that detects intrusions slowly can meet a 72-hour promise while learning of a breach months late. Due diligence therefore has to cover detection capability, not only notice terms. Useful questions include log retention, monitoring coverage and whether the provider has its own incident response retainer.

The clause also says little about content. Notice that a breach occurred is not the same as a list of affected accounts and data elements. Firms negotiating amendments added terms requiring the provider to identify affected customers, preserve logs, support the firm’s investigation and provide updates on a set cadence.

Bargaining power varied. Large platforms generally offered standard security addenda and would not sign bespoke terms. For them, the work was reviewing the standard language against the rule and documenting the conclusion, including any gap and the compensating steps taken. Smaller specialist vendors were often willing to sign but had limited ability to detect anything quickly. That trade-off is worth recording too, because an examiner will ask how the firm judged it.

How the vendor clock connects to the customer’s

The 30-day customer notice runs from the covered institution’s own awareness of unauthorized access, not from the incident itself. A slow vendor therefore does not technically shorten the firm’s deadline. It does delay the moment the firm knows, and every day of that delay is a day customers are exposed without warning. Awareness can also arrive from elsewhere, such as press coverage or a customer complaint. A firm that hears about a vendor breach from the news starts its own clock without the facts it needs.

Firms can agree in writing that a service provider will send customer notices on their behalf. That can make sense for a custodian with good address data and a practiced notice operation. The firm still needs to approve the content, confirm the population and keep the records. Delegating the mailing does not delegate the obligation.

The sequencing work is concrete. Map each critical provider’s notice commitment to a named contact at the firm, monitored outside business hours. Pre-agree the data the provider will hand over for notice. Run at least one tabletop exercise per year with a major provider in the room.

Organizations should check with counsel on how the rule interacts with state breach laws, which continue to apply alongside it.

With hindsight

Both compliance dates have passed: December 3, 2025 for larger entities, including advisers with $1.5 billion or more in assets under management, and June 3, 2026 for smaller ones. The SEC’s Division of Examinations listed the amended rule in its fiscal 2026 examination priorities, released in November 2025, first assessing preparation and then compliance once the dates arrived.

The year the rule was adopted also showed why the vendor layer mattered. The 2024 campaign against Snowflake customer accounts and other platform incidents showed how much sensitive financial data sits with third parties, and how much a firm’s response depends on what those platforms can tell it. Later articles in this series follow what came next: the notification presumption as larger firms reached their date, and what smaller firms had to buy before theirs. The vendor clause remained the foundation both rested on.