Short answer
Regulation S-P is the SEC rule that requires broker-dealers, investment advisers, investment companies and transfer agents to protect customer information. Amendments adopted in 2024 added written incident response programs, customer notification within 30 days of certain breaches, and oversight of service providers.
Regulation S-P explained
Regulation S-P has long required privacy notices and safeguards for customer records. The 2024 amendments require covered firms to have an incident response program to detect, respond to and recover from unauthorized access to customer information, to notify affected individuals as soon as practicable and no later than 30 days after becoming aware of a breach involving sensitive information, to oversee service providers (who must notify the firm within 72 hours), and to keep records of compliance.
Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026. CRM and AI vendors that hold client data fall under the service provider oversight requirement.
How Vantage Point helps: we document data flows, access controls and vendor dependencies in Salesforce and HubSpot so firms can evidence their Reg S-P controls.
Frequently asked questions
Who does Regulation S-P apply to?
SEC-registered broker-dealers, funding portals, investment companies, investment advisers and transfer agents.
Does Reg S-P cover my CRM vendor?
The amendments require firms to oversee service providers that receive, maintain or process customer information, which includes CRM and AI vendors.