Regulation S-P amendments: who may see investor data, and 30 days

The Regulation S-P amendments, adopted by the SEC in May 2024 and published on 3 June 2024, require broker-dealers, investment companies, registered investment advisers and registered transfer agents to run an incident response programme for unauthorised access to customer information, to notify affected individuals within 30 days when sensitive customer information was or is reasonably likely to have been accessed or used without authorisation, and to make sure their service providers tell them of a breach within 72 hours (89 FR 47688). They also brought every registered transfer agent under the safeguards rule for the first time, and widened the information the rule protects to cover securityholders of the issuers a transfer agent serves. Both compliance dates have passed: 3 December 2025 for larger entities and 3 June 2026 for smaller ones. For anyone answering investors, the amendments turn a habit into a duty: every system that reads an investor's account to answer a question must decide who may see it, and be able to show afterwards what it read. Botminds' Investor Relations AI makes that decision before any record is opened, and logs it on every answer.

The rule text below is quoted from the eCFR and the SEC's adopting release. Where the solution appears, it is on its fictional sample data: a manager called Quillfield Capital and its investors.

What do the Regulation S-P amendments require?

Four new duties and two wider definitions. The duties: a written incident response programme reasonably designed to detect, respond to and recover from unauthorised access to or use of customer information; notice to affected individuals within 30 days; oversight of service providers, including policies reasonably designed to make them report breaches within 72 hours; and written records showing compliance with the safeguards and disposal rules. The definitions: "customer information" now covers records about the institution's own customers and the customers of other financial institutions that were handed to it, and transfer agents are covered for the first time (89 FR 47688).

The amendments did not add a written-contract requirement for vendors, which the SEC had proposed. They reach the same result through policies: the institution must oversee its service providers by checking them before and watching them after, and make sure each protects customer information and gives notice of a breach. The SEC moved the service-provider deadline from the proposed 48 hours to 72 in the final rule.

When is the Regulation S-P compliance date?

The amendments took effect on 2 August 2024, with compliance due 18 months after publication for larger entities and 24 months for smaller ones: 3 December 2025 and 3 June 2026, both now past. The SEC defined "larger" by type of firm, as below.

The examiners are now testing it. The SEC Division of Examinations' fiscal 2027 priorities, published on 23 October 2026, say transfer agents will be examined for compliance with the amendments, including the safeguards rule, the disposal rule and incident response programmes, and that examiners will evaluate response-programme policies, customer notification procedures and oversight of service providers across registrants (SEC Division of Examinations).

Does Reg S-P apply to transfer agents?

Yes, since the amendments, and with its own definition of who the customer is. Before 2024 only transfer agents registered with the SEC were covered, and only by the disposal rule; now every transfer agent registered with the SEC or another appropriate regulatory agency must comply with the safeguards rule as well. For a transfer agent the rule does not wait for a customer relationship in the ordinary sense:

“With respect to a transfer agent registered with the Commission or another ARA, for purposes of this section, customer means any natural person who is a securityholder of an issuer for which the transfer agent acts or has acted as a transfer agent.”

17 CFR 248.30(d)(4)(ii), as amended in 2024

That definition reaches every individual on the register, including former holders of issues the agent once served. The SEC explained why it went that far with its own cases: in one settled matter, a transfer agent's records manager had looked up holders' addresses, dates of birth and identification numbers to take deceased foreign holders' funds. Its data showed transfer agents reporting about one million individual accounts each on average, the largest 61 million. What a transfer agent does, seat by seat shows how many of those accounts end in a question.

Who does Reg S-P apply to?

To "covered institutions", which the amended rule defines as "any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency" (17 CFR 248.30(d)(3)). A registered fund is covered in its own right, and so is its adviser if registered.

A private fund is not an investment company for this purpose, because the 3(c)(1) and 3(c)(7) exclusions take it out of the definition, so for private funds the questions are generally the registered adviser's to answer under its own programme. The practical effect for an IR team is the same: the people and systems answering LPs are handling an adviser's customer information, and the adviser's incident response programme and service-provider oversight must cover them. For institutional LPs, much of the personal information an IR team holds is about the individuals who act for them: signatories, contacts and their identification documents.

How fast must customers be notified of a breach?

As soon as practicable, and no later than 30 days after the firm becomes aware that unauthorised access to or use of customer information has occurred or is reasonably likely to have occurred (17 CFR 248.30(a)(4)(iii)). The only delay the rule allows is one the US Attorney General requests in writing on national security or public safety grounds. The notice is owed for sensitive customer information, which the rule defines as information whose compromise "could create a reasonably likely risk of substantial harm or inconvenience" to the person it identifies, with examples: Social Security, passport and taxpayer numbers; biometric records; and an account number or user name combined with an access code or password.

The hard part is the second sentence of the duty. If the firm cannot tell whose sensitive information was reached, it must notify every individual whose sensitive information resides in the affected system. A system that answers investor questions, and can read every investor's account, therefore turns one intrusion into a notice to everyone. A system that reads only the account the sender is entitled to, and logs every read, gives the firm a way to show whose information was and was not touched.

What must service providers do under Regulation S-P?

Under the firm's policies, protect customer information and report any breach of a customer information system they maintain within 72 hours. The amended rule defines a service provider as "any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution" (17 CFR 248.30(d)(10)). The firm may have a service provider send the notices to individuals, but the duty to make sure they go out stays with the firm.

By that definition an AI system that reads investors' capital accounts to answer their emails is a service provider, and so is the portal that shows those accounts and the vendor that hosts either. A firm adding one should be able to answer, before the contract, the questions in the checklist at the end of this page.

Reg S-P and Reg S-ID: protecting information and spotting identity theft

Regulation S-P protects customer information; Regulation S-ID requires a programme to detect, prevent and mitigate identity theft in covered accounts. S-ID applies to broker-dealers, registered investment companies and registered advisers that are financial institutions or creditors, and its definition of account expressly includes "a mutual fund account" (17 CFR 248.201). A covered account includes a fund account that permits wire transfers or other payments to third parties, which is exactly the account a fraudster wants to redirect.

The cases show why both matter at the same desk. In a 2024 settled order, the SEC found that one transfer agent lost more than $6.6 million of client funds in two intrusions: in one, an intruder took over an existing email thread and posed as an issuer's employee; in the other, accounts opened with stolen Social Security numbers were linked automatically to real holders' accounts because the numbers matched, and securities in the real accounts were then sold and the cash moved out (SEC, Equiniti Trust Co.). The second is an entitlement failure: a system decided who owned an account from one matching field.

Who may see which account: entitlement before any record is read

A system that answers investor questions should decide who may see which account before it opens anything, from records the firm controls, and write that decision on the answer. In Investor Relations AI the Entitlement agent checks the sender against the CRM's authorized contacts, the transfer agency register and the signatory list, sets what the other agents may read, and holds the message if anything is in doubt.

The entitlement line: why this sender may see this account, and exactly what was read

The counter-case is as important. In the sample data, a contact authorised only for one fund's reports asked about another fund's account and was held with nothing read, and a lookalike domain asking to change bank details was held the same way. Holding before reading is the difference between a near miss and an incident: if nothing was read, there is no customer information to have been accessed.

Not entitled: held before any record is opened

Where data is processed is part of the same answer. The solution keeps investor data in regions chosen by investor domicile in its settings, with records kept seven years and sealed daily; a firm should know the equivalent for every system in its chain, because the rule makes the firm, not the vendor, answerable for the notice. What each agent may read and send sets out the full list of limits.

What to ask any system that reads investor data

Ask the questions the rule will ask after an incident. Each item below maps to a duty in the amended rule; a vendor that cannot answer one in writing is a gap in the firm's own programme.

The same questions apply to a portal that shows investors their documents; investor portal software for private equity, compared with answering systems, weighs the two. To see entitlement decided and logged on every answer, start from Investor Relations AI.

Questions people ask

When did the Regulation S-P amendments take effect?

They took effect on 2 August 2024. Larger entities had to comply from 3 December 2025 and smaller ones from 3 June 2026, 18 and 24 months after publication in the Federal Register on 3 June 2024. Both dates have passed, and the SEC's fiscal 2027 examination priorities include the amendments.

Do the amendments require a written contract with vendors?

No. The SEC dropped the proposed written-contract requirement and instead requires policies and procedures reasonably designed to make service providers protect customer information and report breaches within 72 hours, with oversight through due diligence and monitoring.

What must the breach notice to individuals contain?

A clear and conspicuous notice that describes the incident and the type of sensitive information in general terms, gives the date or estimated date where it can be determined, and provides a telephone number, email and postal address to ask about it. It must also recommend reviewing statements, explain fraud alerts and free credit reports, and point to the FTC's identity-theft guidance, sent so each person can reasonably be expected to receive it in writing.

Does Reg S-P cover institutional investors?

The safeguards protect information about natural persons, so a pension fund or endowment is not itself a protected customer. The individuals who act for it, such as signatories and contacts whose identification the firm holds, may be, which is why the signatory list deserves the same protection as an individual investor's account.

Is a breach at a fund administrator our problem?

Yes, if the administrator holds your customers' information as your service provider. The rule makes the covered institution responsible for its incident response and for making sure affected individuals are notified, even when a service provider sends the notices on its behalf.