The SEC is moving forward with some of its new rulemaking despite the talk of deregulation. While several proposed rules have been abandoned and compliance dates have been pushed forward for certain adopted rules, others have been finalized in a typical fashion with more immediate compliance dates. This includes the 2024 amendments to Regulation S-P that were adopted in May last year and will become a new requirement for all large investment advisers on the compliance date of December 3, 2025. A large adviser is one with $1.5 billion in assets under management or more. All other investment advisers have a compliance date of June 3, 2026.
The new requirements involve modifications to incident response plans along with a new client notification requirement for advisers regarding data breaches. As most advisers already have incident response programs as part of written cybersecurity programs, the requirements of the rule regarding incident response programs are most likely covered. However, since this rule is specific to Reg S-P, it is important for advisers to make sure that written privacy policies are updated to include the requirements either by reference to the adviser’s cybersecurity program or actual inclusion so that privacy policies will not be deemed deficient during an SEC examination.
The amendments make it clear that customer information included is not just information directly obtained from customers of the adviser, but also customers of other financial institutions whose information has been provided to the adviser.
A general summary of the new rule requirements is found below:
Incident Response Program
To protect against harms resulting from security incidents involving customer information, advisers will need to adopt an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. The incident response program must include:
- Assessment – evaluate the nature and scope of any such incident;
- Containment and Control – take appropriate steps to contain and control such incidents to prevent further unauthorized access or use; and
- Notice to Affected Individuals – a requirement to notify each affected individual whose Sensitive Customer Information was, or is reasonably likely to have been, accessed or used without authorization.
Sensitive Customer Information is defined as any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information. Examples of Sensitive Customer Information include social security number, driver’s license number, passport number, customer username or password, or information in combination with other information that can be used to gain access to a customer account, such as an access code, date of birth, or mother’s maiden name.
Client Notifications
In the event there has been unauthorized access or use of Sensitive Customer Information, an adviser must provide a written notice to affected clients. The written notice to clients must contain the following information:
- A description of the incident and the type of sensitive customer information that was or is reasonably believed to have been accessed or used without authorization.
- The date of the incident, the estimated date of the incident, or the date range within which the incident occurred.
- Contact information sufficient to permit an affected individual to contact the adviser to inquire about the incident, including the following: a telephone number, an email address or equivalent method or means, a postal address and the name of a specific office to contact for further information and assistance.
- A recommendation that the customer review account statements and immediately report any suspicious activity to the adviser.
- An explanation of what a fraud alert is and how an individual may place a fraud alert in the individual’s credit reports to put their creditors on notice that they may be a victim of fraud, including identity theft.
- A recommendation that the individual periodically obtain credit reports from each nationwide credit reporting company and that the individual have information relating to fraudulent transactions deleted.
- An explanation as to how the individual may obtain a credit report free of charge.
- Information about the availability of online guidance from the Federal Trade Commission (FTC) and usa.gov regarding steps an individual can take to protect against identity theft, a statement encouraging the individual to report any incidents of identity theft to the FTC, and include the FTC’s website address where individuals may obtain government information about identity theft and report suspected incidents of identity theft.
The notice must be sent by the adviser to affected clients no later than 30 days after becoming aware of the unauthorized access to or use of customer information.
Service Provider Notifications
Each firm service provider that has access to customer data is required to notify the adviser no later than 72 hours after becoming aware of a breach in data security that resulted in unauthorized access to a customer information system maintained by the service provider on behalf of the adviser’s clients.
It is up to the adviser to notify each of its service providers of the new timeline for notification of breaches and ensure that they understand their reporting obligation to the adviser.
Other components of the rule amendments include expanded definitions and updates to recordkeeping requirements. Annual privacy notice delivery is now exempted under certain conditions (as previously allowed under the FAST Act).
FrontLine Compliance recommends that advisers ensure that their written privacy policies are updated prior to their respective compliance date and that service providers are aware of their role in the notification process. Upon the initial compliance date, all other staff notices, statements, or staff no-action letters are rescinded.
View the final rule, “Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information” for the new requirements, exemptions, and additional details.
