June 3, 2026 Deadline for Smaller Investment Advisers to Comply with Regulation S-P

As the deadline of June 3, 2026, looms closer, registered investment advisers managing less than $1.5 billion in assets are urged to take proactive measures to ensure compliance with the amended regulations under Regulation S-P established by the Securities and Exchange Commission (SEC). These changes represent the most significant modifications to Regulation S-P since its inception in 2000, signifying a critical step towards bolstering the protection of customer information. Notably, SEC Chair Gary Gensler highlighted the necessity of these amendments in response to the evolving landscape of data breaches, emphasizing the importance of safeguarding the privacy of customers’ financial data in an era of heightened cybersecurity threats.

The revised regulations, which came into effect on August 2, 2024, established varying compliance deadlines for different entities. While larger entities were required to comply with the amendments by December 3, 2025, smaller entities, such as registered investment advisers with assets under management below $1.5 billion, are granted an extended compliance deadline of June 3, 2026. This deadline underscores the urgency for smaller investment advisers to promptly initiate measures to ensure adherence to the amended regulations under Regulation S-P.

In anticipation of the impending compliance deadline, smaller investment advisers must undertake several crucial steps to align with the amended regulatory requirements. Initially, these advisers should conduct a comprehensive review of their existing policies and procedures to determine any gaps in compliance and update them accordingly to comply with the new regulations. Furthermore, it is imperative for advisers to assess their vendor contracts to ascertain if modifications are necessary and request written assurances where needed. Adequate training of staff members on the revised policies and procedures is also essential to ensure seamless implementation and adherence to the amended regulations.

In light of the SEC’s Division of Examinations identifying Regulation S-P compliance as a top examination priority for 2026, smaller investment advisers should prioritize their efforts to ensure preparedness for potential examinations. By diligently addressing these regulatory requirements ahead of the stipulated deadline, smaller investment advisers can fortify their compliance framework and mitigate potential risks of non-compliance.

The amended regulations under Regulation S-P outline certain key requirements that smaller investment advisers must fulfill to maintain compliance. One such requirement pertains to the development, implementation, and maintenance of written policies and procedures encompassing an incident response program. This program aims to detect, respond to, and recover from unauthorized access to or use of customer information, emphasizing the critical need for a proactive approach to cybersecurity incidents within the financial industry.

Additionally, the amended regulations mandate smaller investment advisers to establish and enforce written policies and procedures governing the oversight of service providers with access to customer information. This includes meticulous due diligence in selecting service providers, ongoing monitoring of their performance, and prompt notification of any breaches resulting in unauthorized access to customer information. By fostering robust oversight mechanisms, smaller investment advisers can enhance the security and privacy of customer data, thereby fostering trust and confidence among their clientele.

Furthermore, recordkeeping requirements necessitate smaller investment advisers to maintain comprehensive written records documenting their compliance with Regulation S-P. This includes retaining copies of written policies, service provider agreements, records of unauthorized access incidents, and documentation of any instances where customer notification was deemed unnecessary. By upholding meticulous recordkeeping practices, smaller investment advisers can demonstrate their commitment to regulatory compliance and accountability in safeguarding customer information.

In conclusion, the impending compliance deadline of June 3, 2026, underscores the critical importance for smaller investment advisers to prioritize their efforts in aligning with the amended regulatory requirements under Regulation S-P. By proactively implementing the necessary measures, including reviewing and updating policies, enhancing service provider oversight, and maintaining accurate records, smaller investment advisers can navigate the regulatory landscape effectively and uphold the privacy and security of customer information in an era of heightened cybersecurity risks.