Should custodian API integrations be in your Reg S-P vendor inventory?

Why are custodian integrations a vendor risk?

Every API connection between your custodian and another platform is a standing door into client accounts, and those doors are easy to leave off a vendor list. When an adviser links a CRM, a portfolio management system, a rebalancer, a billing engine, a planning tool or an account aggregator to a custodian feed, that vendor gets ongoing access to account numbers, holdings, balances and often client identity data. Some connections can also place trades or initiate transfers. That makes each one a vendor access management question as much as a contract question.

The vendor contract usually lands in the compliance file. The connection itself often does not. It was set up by an operations lead or the vendor's onboarding team, it authenticates with an API key or token that nobody rotates, and it keeps working after the person who created it leaves. That gap matters because an attacker or a failing vendor would use the connection itself, whatever the contract says.

Does Regulation S-P treat integration vendors as service providers?

In most cases, yes. Amended Regulation S-P defines a service provider broadly as any person or entity that receives, maintains, processes or is otherwise permitted access to customer information through services it provides directly to your firm. A platform pulling nightly custodian data on your behalf fits that description on its face. Whether a particular arrangement qualifies is a question for your compliance counsel, but the definition leaves little room for treating data integrations as outside the program.

Once a vendor is a service provider, 17 CFR 248.30(a)(5) requires your incident response program to include written policies and procedures reasonably designed to require oversight of it, including through due diligence and monitoring. Those procedures must be designed so the provider protects against unauthorized access to customer information and notifies your firm as soon as possible, and no later than 72 hours, after becoming aware of a breach affecting a customer information system it maintains. You can agree in writing for the provider to notify affected individuals, but the SEC's small entity compliance guide is explicit that the ultimate responsibility for notice stays with your firm. We covered the contract side in our piece on the 72-hour notice.

Both compliance dates have passed: December 3, 2025 for larger entities and June 3, 2026 for smaller ones. Every SEC-registered adviser and broker-dealer, including dual-registered firms, is now examined against the amended rule.

What are SEC examiners saying about third-party access?

They are naming it directly. The Division of Examinations' Fiscal Year 2027 priorities say staff will focus on advisers using third parties to access clients' accounts where existing controls may be insufficient to protect client assets and data. The same document says cybersecurity reviews will cover access controls and account management, and will assess risks from registrants' increased use of third-party service providers and shared technologies. Under the Regulation S-P heading, staff will evaluate customer notification procedures and oversight of service providers. Our overview of the FY2027 exam priorities for RIAs covers the rest of the list.

The priorities also tie this to Regulation S-ID, with a focus on how firms identify and detect red flags, particularly during customer account takeovers and fraudulent transfers. An integration with money movement or trading permissions belongs in that conversation, because a compromised token can act on accounts without anyone logging into the custodian's website.

A September 14, 2026 risk alert on annual compliance reviews adds a related observation: staff found policies that delegated the execution of services or operations to others but did not identify how the adviser should oversee those delegated responsibilities. An integration that runs unattended every night is a delegated operation. Under Rule 206(4)-7, the annual review of your policies is the natural place to show you oversee it.

What does vendor access management look like for custodian integrations?

It starts with an inventory that answers three examiner questions: who has access, to what, and who at your firm is accountable for it. Neither Regulation S-P nor the exam priorities prescribe a format, so the fields below are a practical starting point a firm can adapt.

• The vendor and product, and the custodian or platform it connects to.
• The data in scope, mapped against your sensitive customer information inventory: account numbers, Social Security numbers, balances, transaction history.
• The permission level: read only, trade authority, or money movement.
• The credential type (API key, OAuth token, service account or shared login), where it is stored and when it was last rotated.
• The internal owner who approved it and who would revoke it.
• The vendor's breach notification commitment and where that commitment is documented.
• The date of the last due diligence review and what evidence was collected.

Advisers should also confirm the inventory and related oversight records are kept under Rule 204-2(a)(25), which requires SEC-registered advisers to make and keep records tied to their Regulation S-P policies, including service provider arrangements.

Where do API keys and tokens usually go wrong?

Most API key management problems come from credentials that outlive their purpose. The common patterns are the same ones that show up with user accounts, applied to machines, and most are fixed by regular API key rotation and prompt revocation.

• Keys created under an individual employee's login, which break or stay active in unpredictable ways when that person leaves.
• Integrations granted broader permissions than the workflow needs, such as trade authority on a reporting tool.
• Credentials pasted into spreadsheets, shared mailboxes or vendor support tickets.
• Trial or retired platforms whose connections were never revoked after the firm stopped using them.
• No alerting when an integration pulls far more data than usual or connects from an unexpected location.

Each of these is an access control and account management issue, the same language the FY2027 priorities use. The fix is the discipline firms already apply to people: least privilege, named ownership, periodic review and prompt removal. Our guide to monthly stale account reviews applies equally to service accounts and tokens.

What should you do this quarter?

Start with discovery, since no third-party vendor risk management program can oversee a connection nobody knows exists.

• Pull the list of authorized third-party applications from each custodian and platform portal, and compare it to your vendor list.
• Revoke any connection with no current business owner or no active contract.
• Reduce permissions to the minimum each workflow needs, and document any trade or money movement authority with a named approver.
• Rotate long-lived keys and move them into a managed secrets store or the vendor's supported token method.
• Add integrations to your Regulation S-P service provider oversight procedures and to the agenda for your next annual compliance review.
• Confirm each integration vendor's breach notification commitment in writing, and file it where your recordkeeping procedures say it belongs.

None of this requires new software. It requires someone to own the list and review it on a schedule your policies define, which also gives you evidence of ongoing vendor monitoring when examiners ask.

How does s90 help?

s90 manages IT and security for RIAs, broker-dealers and family offices in Los Angeles and Orange County. We help firms find the integrations already connected to their custodians and platforms, tighten permissions, rotate credentials, and keep an inventory that maps to Regulation S-P oversight. Our agreements include 72-hour breach notification and 24-hour evidence production, so the provider overseeing your integrations meets the same standard you hold other vendors to. If you want a second set of eyes on your integration list before your next exam, we are happy to talk.