Under Regulation S-P, the firm that knows least about a breach tells the most customers

The week

December 3, 2025 was the compliance date for larger entities under the SEC’s May 2024 amendments to Regulation S-P, the privacy rule for broker-dealers, investment companies, registered investment advisers and transfer agents. Smaller entities had until June 3, 2026. The amendments require a written incident response program for unauthorized access to or use of customer information. Covered institutions must notify individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice is due as soon as practicable and no later than 30 days after the firm becomes aware of the incident. The exception is where a reasonable investigation shows the information has not been, and is not reasonably likely to be, used in a way that causes substantial harm or inconvenience. The rule does not apply to banks or credit unions.

Earlier in this series, we looked at the 2024 amendments through their most contested clause: the requirement that service providers report breaches within 72 hours. With the first compliance date in force, the in-house mechanics mattered more. Before the amendments, Regulation S-P had no federal notice requirement, and firms worked from state breach laws. After them, notice is the default and silence needs a documented basis. That produces a counterintuitive result. A firm that cannot reconstruct what an intruder touched will usually notify more people than one that can. Three things determine which kind of firm it is: the evidence it keeps before an incident, the determination it makes during one, and the population of records it counts as in scope.

The evidence kept before an incident

The rule asks for a program reasonably designed to detect, respond to and recover from unauthorized access. It also asks firms to assess the nature and scope of an incident and identify the customer information systems and types of information involved. Both depend on records that must exist before anything goes wrong.

Three kinds matter most. Access logs for systems holding sensitive customer information need to record who queried which records, not only who logged in. Retention has to outlast a realistic detection gap, because intrusions are often found weeks after they begin. And a data map has to say which systems hold Social Security numbers, account numbers with access codes and other sensitive elements, by system and by field.

Each has a common failure. Default log retention in some cloud and software-as-a-service tiers is short, and extended retention is a separate purchase that nobody owns. Application logs often record transactions but not reads, so they show what changed, not what was viewed. Data maps are usually drawn for applications. They leave out the file shares, exports and analytics copies where sensitive fields accumulate.

The fixes are procurement and configuration decisions with clear owners. Security operations should set minimum retention for each system in scope. Application owners should confirm that read access is logged where it matters. The privacy or data governance function should maintain the field-level map. The cost is mostly storage and engineering time, set against a notification bill that grows with every record a firm cannot rule out.

The determination made during one

The core of the amendment is the notification standard. A firm must notify unless a reasonable investigation supports a finding of no likely harm. That means the sensitive customer information has not been, and is not reasonably likely to be, used in a way that would cause substantial harm or inconvenience. The burden sits with the firm. Deciding not to notify is the decision that needs support, and the rule requires records of it.

Where a firm cannot identify which individuals’ information was accessed, it must notify everyone whose sensitive customer information resided in the affected system, unless it can make the same no-harm determination. This is where evidence turns into cost. With record-level read logs, a firm can show that an intruder queried a defined set of accounts and notify those people. Without them, the population defaults to the whole system.

The investigation also has to fit inside 30 days. In practice the clock forces decisions on partial facts. A sensible program sets internal checkpoints: scope hypothesis by the end of the first week, evidence review by the third, a notice decision with legal sign-off before day 30. It also assigns one person to keep the decision record, so that the reasoning behind a narrow notice survives an examination months later. The only route to delay is a written determination by the U.S. Attorney General that notice poses a substantial risk to national security or public safety. Firms should not plan around it, and the facts of any incident should be worked through with counsel.

The records counted as in scope

The amendments widened “customer information” to include information about customers of other financial institutions that a firm has received. A broker-dealer processing account transfers, an adviser receiving data from a custodian or a transfer agent keeping records for issuers holds data about people who are not its own customers. Those records count for protection and for notice.

That changes how scope is measured. Data inventories built from the customer master file miss these populations, because the people never became customers. Their records sit in transfer queues, reconciliation files, custodial feeds and archived correspondence. During an incident, a firm that has not mapped them faces a choice between notifying blind and missing people it was obliged to tell.

The same widening affects notice mechanics. A firm may hold sensitive data for someone with no current address on file, or whose relationship runs through another institution. Firms should decide in advance how they will reach those people, and whether to coordinate with the other institution. State breach laws continue to apply alongside the federal rule, so notices often have to satisfy several sets of content requirements at once.

Taken together, the three parts turn a notification rule into a data visibility requirement. Firms that invest in evidence and scope before an incident make narrower, better-supported decisions during one. Firms that do not will find the rule’s default does the deciding for them.

With hindsight

Both compliance dates held. Larger firms have been subject to the amendments since December 3, 2025, and smaller firms since June 3, 2026. The SEC withdrew many pending proposals from the previous administration in 2025, but these amendments were already final and were not part of that retreat. The agency named Regulation S-P compliance among its examination priorities for fiscal 2026, so the first exam cycles are now testing the programs firms built.

What we would emphasize in hindsight is the economics. The presumption of notice turned logging, retention and field-level data mapping into measures that reduce the size of a notice population, and therefore its cost. That is a stronger budget case than abstract risk reduction. The rule’s reach into other institutions’ customers also pushed firms to look at transfer and custodial data they had rarely inventoried. Firms that did that work before an incident have choices during one. Those that did not are left with the default.