SEC Regulation S-P
Amended United States (Federal) · In force Aug 2, 2024 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Requires broker-dealers, investment companies, registered investment advisers and transfer agents to adopt a written incident response program and notify affected individuals as soon as practicable, and no later than 30 days, after becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Service providers must be overseen and must notify the covered institution within 72 hours of a breach; recordkeeping and annual privacy notice changes also apply.
- Who it applies to
- SEC-registered broker-dealers (incl. funding portals), investment companies, registered investment advisers and transfer agents. 'Larger entities' (earlier deadline): investment companies with $1 billion+ net assets (with related funds), RIAs with $1.5 billion+ AUM, and broker-dealers and transfer agents that are not small entities; all others are smaller entities.
- Penalties
- No fixed fine schedule; enforced under the federal securities laws (civil penalties, cease-and-desist orders, censures, bars).
- Enforced by
- U.S. Securities and Exchange Commission
- Official name
- Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information (2024 amendments)
- Citation
- 17 CFR Part 248; 89 FR 47688 (June 3, 2024)
- Topics
- financial, privacy, cybersecurity, breach-notification
Research notes
Compliance dates are stated in the release as 18 and 24 months after the June 3, 2024 publication. No delay of these dates was found in the Federal Register as of 2026-09-22.
Related
CIRCIAQuestions about SEC Regulation S-P
- What are the SEC Regulation S-P compliance deadlines?
- Aug 2, 2024: Amendments effective. Dec 3, 2025: Larger entities must comply. Jun 3, 2026: Smaller entities must comply.
- When does SEC Regulation S-P take effect?
- SEC Regulation S-P took effect on Aug 2, 2024.
- Who does SEC Regulation S-P apply to?
- SEC-registered broker-dealers (incl. funding portals), investment companies, registered investment advisers and transfer agents. 'Larger entities' (earlier deadline): investment companies with $1 billion+ net assets (with related funds), RIAs with $1.5 billion+ AUM, and broker-dealers and transfer agents that are not small entities; all others are smaller entities.
- What are the penalties under SEC Regulation S-P?
- No fixed fine schedule; enforced under the federal securities laws (civil penalties, cease-and-desist orders, censures, bars).